title: android content provider robustness on provider crash
body: <p>On android platforms (confirmed on ICS), if a content provider dies while a client is in the middle of a query (i.e. has a open cursor) the framework decides to kill the client processes holding a open cursor.  </p>
  
  <p>Here is a logcat output when i tried this with a download manager query that sleeps after doing a query. The "sleep" was to reproduce the problem. you can imagine it happening in a regular use case when the provider dies at the right/wrong time.  And then do a  kill of com.android.media (which hosts the downloadProvider).</p>
  
  <p>"Killing com.example (pid 12234) because provider com.android.providers.downloads.DownloadProvider is in dying process android.process.media"</p>
  
  <p>I tracked the code for this in ActivityManagerService::removeDyingProviderLocked</p>
  
  <pre><code> 10203     private final void removeDyingProviderLocked(ProcessRecord proc,
   10204             ContentProviderRecord cpr) {
   10205         synchronized (cpr) {
   10206             cpr.launchingApp = null;
   10207             cpr.notifyAll();
   10208         }
   10210         mProvidersByClass.remove(cpr.name);
   10211         String names[] = cpr.info.authority.split(";");
   10212         for (int j = 0; j &lt; names.length; j++) {
   10213             mProvidersByName.remove(names[j]);
   10214         }
   10215 
   10216         Iterator&lt;ProcessRecord&gt; cit = cpr.clients.iterator();
   10217         while (cit.hasNext()) {
   10218             ProcessRecord capp = cit.next();
   10219             if (!capp.persistent &amp;&amp; capp.thread != null
   10220                     &amp;&amp; capp.pid != 0
   10221                     &amp;&amp; capp.pid != MY_PID) {
   10222                 Slog.i(TAG, "Kill " + capp.processName
   10223                         + " (pid " + capp.pid + "): provider " + cpr.info.name
   10224                         + " in dying process " + (proc != null ? proc.processName : "??"));
   10225                 EventLog.writeEvent(EventLogTags.AM_KILL, capp.pid,
   10226                         capp.processName, capp.setAdj, "dying provider "
   10227                                 + cpr.name.toShortString());
   10228                 Process.killProcessQuiet(capp.pid);
   10229             }
   10230         }
   10231 
   10232         mLaunchingProviders.remove(cpr);
   10233     }
  </code></pre>
  
  <p>Is this a policy decision or is the cursor access unsafe after the provider has died? </p>
  
  <p>It looks like the client cursor is holding a fd for an ashmem location populated by the CP.
  Is this the reason the clients are killed instead of throwing an exception  like Binders when the server (provider) dies ?</p>