Merge "Properly close fd backing a MemoryIntArray" into nyc-dev
diff --git a/Android.mk b/Android.mk
index 49825b9..5d99f8b 100644
--- a/Android.mk
+++ b/Android.mk
@@ -890,7 +890,7 @@
 
 ## SDK version identifiers used in the published docs
   # major[.minor] version for current SDK. (full releases only)
-framework_docs_SDK_VERSION:=6.0
+framework_docs_SDK_VERSION:=7.0
   # release version (ie "Release x")  (full releases only)
 framework_docs_SDK_REL_ID:=1
 
@@ -899,7 +899,7 @@
 		-hdf sdk.preview.version 5 \
 		-hdf sdk.version $(framework_docs_SDK_VERSION) \
 		-hdf sdk.rel.id $(framework_docs_SDK_REL_ID) \
-		-hdf sdk.preview 1
+		-hdf sdk.preview 0
 
 # ====  the api stubs and current.xml ===========================
 include $(CLEAR_VARS)
@@ -1094,13 +1094,13 @@
 		-hdf android.whichdoc offline \
 		-referenceonly
 
-LOCAL_DROIDDOC_CUSTOM_TEMPLATE_DIR:=build/tools/droiddoc/templates-sdk
+LOCAL_DROIDDOC_CUSTOM_TEMPLATE_DIR:=build/tools/droiddoc/templates-sdk-dev
 
 include $(BUILD_DROIDDOC)
 
 static_doc_index_redirect := $(out_dir)/index.html
 $(static_doc_index_redirect): \
-	$(LOCAL_PATH)/docs/docs-preview-index.html | $(ACP)
+	$(LOCAL_PATH)/docs/docs-documentation-redirect.html | $(ACP)
 	$(hide) mkdir -p $(dir $@)
 	$(hide) $(ACP) $< $@
 
diff --git a/core/java/android/provider/Settings.java b/core/java/android/provider/Settings.java
index 9c567a9..42ac76b 100755
--- a/core/java/android/provider/Settings.java
+++ b/core/java/android/provider/Settings.java
@@ -6236,6 +6236,12 @@
                 "managed_profile_contact_remote_search";
 
         /**
+         * Holds comma separated list of ordering of QS tiles.
+         * @hide
+         */
+        public static final String QS_TILES = "sysui_qs_tiles";
+
+        /**
          * This are the settings to be backed up.
          *
          * NOTE: Settings are backed up and restored in the order they appear
@@ -6308,7 +6314,8 @@
             PREFERRED_TTY_MODE,
             ENHANCED_VOICE_PRIVACY_ENABLED,
             TTY_MODE_ENABLED,
-            INCALL_POWER_BUTTON_BEHAVIOR
+            INCALL_POWER_BUTTON_BEHAVIOR,
+            QS_TILES,
         };
 
         /**
diff --git a/core/java/android/text/SpannableStringInternal.java b/core/java/android/text/SpannableStringInternal.java
index 47e71be..4b02df86 100644
--- a/core/java/android/text/SpannableStringInternal.java
+++ b/core/java/android/text/SpannableStringInternal.java
@@ -33,6 +33,7 @@
             mText = source.toString().substring(start, end);
 
         mSpans = EmptyArray.OBJECT;
+        // Invariant: mSpanData.length = mSpans.length * COLUMNS
         mSpanData = EmptyArray.INT;
 
         if (source instanceof Spanned) {
@@ -99,7 +100,7 @@
             Object[] srcSpans = src.mSpans;
             mSpanCount = count;
             mSpans = ArrayUtils.newUnpaddedObjectArray(mSpanCount);
-            mSpanData = new int[mSpanCount * COLUMNS];
+            mSpanData = new int[mSpans.length * COLUMNS];
             for (int i = 0, j = 0; i < limit; i++) {
                 int spanStart = srcData[i * COLUMNS + START];
                 int spanEnd = srcData[i * COLUMNS + END];
diff --git a/docs/html/_redirects.yaml b/docs/html/_redirects.yaml
index aefe1c1..c689378 100644
--- a/docs/html/_redirects.yaml
+++ b/docs/html/_redirects.yaml
@@ -1219,6 +1219,8 @@
   to: /studio/intro/index.html?utm_medium=android-studio
 - from: /r/studio-ui/menu-start.html
   to: /training/index.html?utm_medium=android-studio
+- from: /r/studio-ui/run-with-work-profile.html
+  to: /studio/run/index.html#ir-work-profile?utm_medium=android-studio
 
 # Redirects from (removed) N Preview documentation
 - from: /preview/features/afw.html
diff --git a/docs/html/guide/topics/media/camera.jd b/docs/html/guide/topics/media/camera.jd
index c806c88..4995a13d 100644
--- a/docs/html/guide/topics/media/camera.jd
+++ b/docs/html/guide/topics/media/camera.jd
@@ -9,12 +9,7 @@
     <li><a href="#considerations">Considerations</a></li>
     <li><a href="#basics">The Basics</a>
     <li><a href="#manifest">Manifest Declarations</a></li>
-    <li><a href="#intents">Using Existing Camera Apps</a>
-      <ol>
-        <li><a href="#intent-image">Image capture intent</a></li>
-        <li><a href="#intent-video">Video capture intent</a></li>
-        <li><a href="#intent-receive">Receiving camera intent result</a></li>
-      </ol>
+    <li><a href="#camera-apps">Using Existing Camera Apps</a>
     <li><a href="#custom-camera">Building a Camera App</a>
       <ol>
         <li><a href="#detect-camera">Detecting camera hardware</a></li>
@@ -72,7 +67,7 @@
   <li><strong>Quick Picture or Customized Camera</strong> - How will your application use the
 camera? Are you just interested in snapping a quick picture or video clip, or will your application
 provide a new way to use cameras? For a getting a quick snap or clip, consider
-<a href="#intents">Using Existing Camera Apps</a>. For developing a customized camera feature, check
+<a href="#camera-apps">Using Existing Camera Apps</a>. For developing a customized camera feature, check
 out the <a href="#custom-camera">Building a Camera App</a> section.</li>
 
   <li><strong>Storage</strong> - Are the images or videos your application generates intended to be
@@ -122,8 +117,9 @@
 <pre>
 &lt;uses-permission android:name=&quot;android.permission.CAMERA&quot; /&gt;
 </pre>
-  <p class="note"><strong>Note:</strong> If you are using the camera <a href="#intents">via an
-intent</a>, your application does not need to request this permission.</p>
+  <p class="note"><strong>Note:</strong> If you are using the camera <a href="#camera-apps">by
+invoking an existing camera app</a>,
+your application does not need to request this permission.</p>
   </li>
   <li><strong>Camera Features</strong> - Your application must also declare use of camera features,
 for example:
@@ -169,193 +165,17 @@
 </ul>
 
 
-<h2 id="intents">Using Existing Camera Apps</h2>
+<h2 id="camera-apps">Using Existing Camera Apps</h2>
 <p>A quick way to enable taking pictures or videos in your application without a lot of extra code
-is to use an {@link android.content.Intent} to invoke an existing Android camera application. A
-camera intent makes a request to capture a picture or video clip through an existing camera app and
-then returns control back to your application. This section shows you how to capture an image or
-video using this technique.</p>
-
-<p>The procedure for invoking a camera intent follows these general steps:</p>
-
-<ol>
-  <li><strong>Compose a Camera Intent</strong> - Create an {@link android.content.Intent} that
-requests an image or video, using one of these intent types:
-    <ul>
-      <li>{@link android.provider.MediaStore#ACTION_IMAGE_CAPTURE MediaStore.ACTION_IMAGE_CAPTURE} -
-Intent action type for requesting an image from an existing camera application.</li>
-      <li>{@link android.provider.MediaStore#ACTION_VIDEO_CAPTURE MediaStore.ACTION_VIDEO_CAPTURE} -
-Intent action type for requesting a video from an existing camera application. </li>
-    </ul>
-  </li>
-  <li><strong>Start the Camera Intent</strong> - Use the {@link
-android.app.Activity#startActivityForResult(android.content.Intent, int) startActivityForResult()}
-method to execute the camera intent. After you start the intent, the Camera application user
-interface appears on the device screen and the user can take a picture or video.</li>
-  <li><strong>Receive the Intent Result</strong> - Set up an {@link
-android.app.Activity#onActivityResult(int, int, android.content.Intent) onActivityResult()} method
-in your application to receive the callback and data from the camera intent. When the user
-finishes taking a picture or video (or cancels the operation), the system calls this method.</li>
-</ol>
-
-
-<h3 id="intent-image">Image capture intent</h3>
-<p>Capturing images using a camera intent is quick way to enable your application to take pictures
-with minimal coding. An image capture intent can include the following extra information:</p>
-
-<ul>
-  <li>{@link android.provider.MediaStore#EXTRA_OUTPUT MediaStore.EXTRA_OUTPUT} - This setting
-requires a {@link android.net.Uri} object specifying a path and file name where you'd like to
-save the picture. This setting is optional but strongly recommended. If you do not specify this
-value, the camera application saves the requested picture in the default location with a default
-name, specified in the returned intent's {@link android.content.Intent#getData() Intent.getData()}
-field.</li>
-</ul>
-
-<p>The following example demonstrates how to construct a image capture intent and execute it.
-The {@code getOutputMediaFileUri()} method in this example refers to the sample code shown in <a
-href= "#saving-media">Saving Media Files</a>.</p>
-
-<pre>
-private static final int CAPTURE_IMAGE_ACTIVITY_REQUEST_CODE = 100;
-private Uri fileUri;
-
-&#64;Override
-public void onCreate(Bundle savedInstanceState) {
-    super.onCreate(savedInstanceState);
-    setContentView(R.layout.main);
-
-    // create Intent to take a picture and return control to the calling application
-    Intent intent = new Intent(MediaStore.ACTION_IMAGE_CAPTURE);
-
-    fileUri = getOutputMediaFileUri(MEDIA_TYPE_IMAGE); // create a file to save the image
-    intent.putExtra(MediaStore.EXTRA_OUTPUT, fileUri); // set the image file name
-
-    // start the image capture Intent
-    startActivityForResult(intent, CAPTURE_IMAGE_ACTIVITY_REQUEST_CODE);
-}
-</pre>
-
-<p>When the {@link android.app.Activity#startActivityForResult(android.content.Intent, int)
-startActivityForResult()} method is executed, users see a camera application interface.
-After the user finishes taking a picture (or cancels the operation), the user interface returns to
-your application, and you must intercept the {@link
-android.app.Activity#onActivityResult(int, int, android.content.Intent) onActivityResult()}
-method to receive the result of the intent and continue your application execution. For information
-on how to receive the completed intent, see <a href="#intent-receive">Receiving camera intent
-result</a>.</p>
-
-
-<h3 id="intent-video">Video capture intent</h3>
-<p>Capturing video using a camera intent is a quick way to enable your application to take videos
-with minimal coding. A video capture intent can include the following extra information:</p>
-
-<ul>
-  <li>{@link android.provider.MediaStore#EXTRA_OUTPUT MediaStore.EXTRA_OUTPUT} - This setting
-requires a {@link android.net.Uri} specifying a path and file name where you'd like to save the
-video. This setting is optional but strongly recommended. If you do not specify this value, the
-Camera application saves the requested video in the default location with a default name, specified
-in the returned intent's {@link android.content.Intent#getData() Intent.getData()} field.</li>
-  <li>{@link android.provider.MediaStore#EXTRA_VIDEO_QUALITY MediaStore.EXTRA_VIDEO_QUALITY} -
-This value can be 0 for lowest quality and smallest file size or 1 for highest quality and
-larger file size.</li>
-  <li>{@link android.provider.MediaStore#EXTRA_DURATION_LIMIT MediaStore.EXTRA_DURATION_LIMIT} -
-Set this value to limit the length, in seconds, of the video being captured.</li>
-  <li>{@link android.provider.MediaStore#EXTRA_SIZE_LIMIT MediaStore.EXTRA_SIZE_LIMIT} -
-Set this value to limit the file size, in bytes, of the video being captured.
-</li>
-</ul>
-
-<p>The following example demonstrates how to construct a video capture intent and execute it.
-The {@code getOutputMediaFileUri()} method in this example refers to the sample code shown in <a
-href= "#saving-media">Saving Media Files</a>.</p>
-
-<pre>
-private static final int CAPTURE_VIDEO_ACTIVITY_REQUEST_CODE = 200;
-private Uri fileUri;
-
-&#64;Override
-public void onCreate(Bundle savedInstanceState) {
-    super.onCreate(savedInstanceState);
-    setContentView(R.layout.main);
-
-    //create new Intent
-    Intent intent = new Intent(MediaStore.ACTION_VIDEO_CAPTURE);
-
-    fileUri = getOutputMediaFileUri(MEDIA_TYPE_VIDEO);  // create a file to save the video
-    intent.putExtra(MediaStore.EXTRA_OUTPUT, fileUri);  // set the image file name
-
-    intent.putExtra(MediaStore.EXTRA_VIDEO_QUALITY, 1); // set the video image quality to high
-
-    // start the Video Capture Intent
-    startActivityForResult(intent, CAPTURE_VIDEO_ACTIVITY_REQUEST_CODE);
-}
-</pre>
-
-<p>When the {@link
-android.app.Activity#startActivityForResult(android.content.Intent, int)
-startActivityForResult()} method is executed, users see a modified camera application interface.
-After the user finishes taking a video (or cancels the operation), the user interface
-returns to your application, and you must intercept the {@link
-android.app.Activity#onActivityResult(int, int, android.content.Intent) onActivityResult()}
-method to receive the result of the intent and continue your application execution. For information
-on how to receive the completed intent, see the next section.</p>
-
-<h3 id="intent-receive">Receiving camera intent result</h3>
-<p>Once you have constructed and executed an image or video camera intent, your application must be
-configured to receive the result of the intent. This section shows you how to intercept the callback
-from a camera intent so your application can do further processing of the captured image or
-video.</p>
-
-<p>In order to receive the result of an intent, you must override the {@link
-android.app.Activity#onActivityResult(int, int, android.content.Intent) onActivityResult()} in the
-activity that started the intent. The following example demonstrates how to override {@link
-android.app.Activity#onActivityResult(int, int, android.content.Intent) onActivityResult()} to
-capture the result of the <a href="#intent-image">image camera intent</a> or <a
-href="#intent-video">video camera intent</a> examples shown in the previous sections.</p>
-
-<pre>
-private static final int CAPTURE_IMAGE_ACTIVITY_REQUEST_CODE = 100;
-private static final int CAPTURE_VIDEO_ACTIVITY_REQUEST_CODE = 200;
-
-&#64;Override
-protected void onActivityResult(int requestCode, int resultCode, Intent data) {
-    if (requestCode == CAPTURE_IMAGE_ACTIVITY_REQUEST_CODE) {
-        if (resultCode == RESULT_OK) {
-            // Image captured and saved to fileUri specified in the Intent
-            Toast.makeText(this, "Image saved to:\n" +
-                     data.getData(), Toast.LENGTH_LONG).show();
-        } else if (resultCode == RESULT_CANCELED) {
-            // User cancelled the image capture
-        } else {
-            // Image capture failed, advise user
-        }
-    }
-
-    if (requestCode == CAPTURE_VIDEO_ACTIVITY_REQUEST_CODE) {
-        if (resultCode == RESULT_OK) {
-            // Video captured and saved to fileUri specified in the Intent
-            Toast.makeText(this, "Video saved to:\n" +
-                     data.getData(), Toast.LENGTH_LONG).show();
-        } else if (resultCode == RESULT_CANCELED) {
-            // User cancelled the video capture
-        } else {
-            // Video capture failed, advise user
-        }
-    }
-}
-</pre>
-
-<p>Once your activity receives a successful result, the captured image or video is available in the
-specified location for your application to access.</p>
-
-
+is to use an {@link android.content.Intent} to invoke an existing Android camera application.
+The details are described in the training lessons
+<a href="{@docRoot}training/camera/photobasics.html">Taking Photos Simply</a> and
+<a href="{@docRoot}training/camera/videobasics.html">Recording Videos Simply</a>.</p>
 
 <h2 id="custom-camera">Building a Camera App</h2>
 <p>Some developers may require a camera user interface that is customized to the look of their
-application or provides special features. Creating a customized camera activity requires more
-code than <a href="#intents">using an intent</a>, but it can provide a more compelling experience
-for your users.</p>
+application or provides special features. Writing your own picture-taking code
+can provide a more compelling experience for your users.</p>
 
 <p><strong> Note: The following guide is for the older, deprecated {@link android.hardware.Camera}
 API. For new or advanced camera applications, the newer {@link android.hardware.camera2} API is
@@ -419,7 +239,7 @@
 <h3 id="access-camera">Accessing cameras</h3>
 <p>If you have determined that the device on which your application is running has a camera, you
 must request to access it by getting an instance of {@link android.hardware.Camera} (unless you
-are using an <a href="#intents">intent to access the camera</a>). </p>
+are using an <a href="camera-apps">intent to access the camera</a>). </p>
 
 <p>To access the primary camera, use the {@link android.hardware.Camera#open() Camera.open()} method
 and be sure to catch any exceptions, as shown in the code below:</p>
diff --git a/docs/html/work/guide.jd b/docs/html/work/guide.jd
index 30b895b..b2be949 100644
--- a/docs/html/work/guide.jd
+++ b/docs/html/work/guide.jd
@@ -412,6 +412,17 @@
   </li>
 </ol>
 
+<p class="caution"><b>Caution</b>: When running your app with Instant Run in
+Android Studio, attempting to open your app with a Work profile or secondary
+profile will crash your app. To use your app with the Work profile, we
+recommend you create a new <a href="/studio/run/rundebugconfig.html">run
+configuration</a> that includes the <code>--user <var>user_id</var></code> flag,
+specifying the Work profile user ID. You can find the user ID by executing
+<code>adb shell pm list users</code> from command line. For more information,
+see the <a href="/studio/run/index.html#ir-work-profile">Instant Run
+documentation</a>.</p>
+
+
 <h3>Provision a device owner</h3>
 
 <p>
diff --git a/packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java b/packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java
index 79f9de6..11bf0c5 100644
--- a/packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java
+++ b/packages/SystemUI/src/com/android/systemui/qs/external/TileLifecycleManager.java
@@ -63,6 +63,9 @@
     private static final int MAX_BIND_RETRIES = 5;
     private static final int BIND_RETRY_DELAY = 1000;
 
+    // Shared prefs that hold tile lifecycle info.
+    private static final String TILES = "tiles_prefs";
+
     private final Context mContext;
     private final Handler mHandler;
     private final Intent mIntent;
@@ -123,6 +126,12 @@
     }
 
     public void setBindService(boolean bind) {
+        if (mBound && mUnbindImmediate) {
+            // If we are already bound and expecting to unbind, this means we should stay bound
+            // because something else wants to hold the connection open.
+            mUnbindImmediate = false;
+            return;
+        }
         mBound = bind;
         if (bind) {
             if (mBindTryCount == MAX_BIND_RETRIES) {
@@ -399,4 +408,13 @@
     public interface TileChangeListener {
         void onTileChanged(ComponentName tile);
     }
+
+    public static boolean isTileAdded(Context context, ComponentName component) {
+        return context.getSharedPreferences(TILES, 0).getBoolean(component.flattenToString(), false);
+    }
+
+    public static void setTileAdded(Context context, ComponentName component, boolean added) {
+        context.getSharedPreferences(TILES, 0).edit().putBoolean(component.flattenToString(),
+                added).commit();
+    }
 }
diff --git a/packages/SystemUI/src/com/android/systemui/qs/external/TileServiceManager.java b/packages/SystemUI/src/com/android/systemui/qs/external/TileServiceManager.java
index 3d030f9..da2c5245 100644
--- a/packages/SystemUI/src/com/android/systemui/qs/external/TileServiceManager.java
+++ b/packages/SystemUI/src/com/android/systemui/qs/external/TileServiceManager.java
@@ -86,8 +86,15 @@
         IntentFilter filter = new IntentFilter();
         filter.addAction(Intent.ACTION_PACKAGE_REMOVED);
         filter.addDataScheme("package");
-        mServices.getContext().registerReceiverAsUser(mUninstallReceiver,
+        Context context = mServices.getContext();
+        context.registerReceiverAsUser(mUninstallReceiver,
                 new UserHandle(ActivityManager.getCurrentUser()), filter, null, mHandler);
+        ComponentName component = tileLifecycleManager.getComponent();
+        if (!TileLifecycleManager.isTileAdded(context, component)) {
+            TileLifecycleManager.setTileAdded(context, component, true);
+            mStateManager.onTileAdded();
+            mStateManager.flushMessagesAndUnbind();
+        }
     }
 
     public void setTileChangeListener(TileChangeListener changeListener) {
diff --git a/packages/SystemUI/src/com/android/systemui/statusbar/phone/QSTileHost.java b/packages/SystemUI/src/com/android/systemui/statusbar/phone/QSTileHost.java
index fa57775..4002473 100644
--- a/packages/SystemUI/src/com/android/systemui/statusbar/phone/QSTileHost.java
+++ b/packages/SystemUI/src/com/android/systemui/statusbar/phone/QSTileHost.java
@@ -86,7 +86,7 @@
     private static final String TAG = "QSTileHost";
     private static final boolean DEBUG = Log.isLoggable(TAG, Log.DEBUG);
 
-    public static final String TILES_SETTING = "sysui_qs_tiles";
+    public static final String TILES_SETTING = Secure.QS_TILES;
 
     private final Context mContext;
     private final PhoneStatusBar mStatusBar;
@@ -407,19 +407,7 @@
                         new UserHandle(ActivityManager.getCurrentUser()));
                 lifecycleManager.onStopListening();
                 lifecycleManager.onTileRemoved();
-                lifecycleManager.flushMessagesAndUnbind();
-            }
-        }
-        for (int i = 0; i < NA; i++) {
-            String tileSpec = newTiles.get(i);
-            if (!tileSpec.startsWith(CustomTile.PREFIX)) continue;
-            if (!previousTiles.contains(tileSpec)) {
-                ComponentName component = CustomTile.getComponentFromSpec(tileSpec);
-                Intent intent = new Intent().setComponent(component);
-                TileLifecycleManager lifecycleManager = new TileLifecycleManager(new Handler(),
-                        mContext, mServices, new Tile(component), intent,
-                        new UserHandle(ActivityManager.getCurrentUser()));
-                lifecycleManager.onTileAdded();
+                TileLifecycleManager.setTileAdded(mContext, component, false);
                 lifecycleManager.flushMessagesAndUnbind();
             }
         }
diff --git a/services/core/java/com/android/server/power/ShutdownThread.java b/services/core/java/com/android/server/power/ShutdownThread.java
index 27d1671..5b9d139 100644
--- a/services/core/java/com/android/server/power/ShutdownThread.java
+++ b/services/core/java/com/android/server/power/ShutdownThread.java
@@ -68,7 +68,7 @@
     private static final int MAX_BROADCAST_TIME = 10*1000;
     private static final int MAX_SHUTDOWN_WAIT_TIME = 20*1000;
     private static final int MAX_RADIO_WAIT_TIME = 12*1000;
-    private static final int MAX_UNCRYPT_WAIT_TIME = 30*60*1000;
+    private static final int MAX_UNCRYPT_WAIT_TIME = 15*60*1000;
     // constants for progress bar. the values are roughly estimated based on timeout.
     private static final int BROADCAST_STOP_PERCENT = 2;
     private static final int ACTIVITY_MANAGER_STOP_PERCENT = 4;
diff --git a/services/net/java/android/net/apf/ApfFilter.java b/services/net/java/android/net/apf/ApfFilter.java
index ce37426..bae889c 100644
--- a/services/net/java/android/net/apf/ApfFilter.java
+++ b/services/net/java/android/net/apf/ApfFilter.java
@@ -131,6 +131,7 @@
 
     private static final int ICMP6_TYPE_OFFSET = ETH_HEADER_LEN + IPV6_HEADER_LEN;
     private static final int ICMP6_NEIGHBOR_ANNOUNCEMENT = 136;
+    private static final int ICMP6_ROUTER_ADVERTISEMENT = 134;
 
     // NOTE: this must be added to the IPv4 header length in IPV4_HEADER_SIZE_MEMORY_SLOT
     private static final int UDP_DESTINATION_PORT_OFFSET = ETH_HEADER_LEN + 2;
@@ -306,7 +307,11 @@
         }
 
         private long uint32(int s) {
-            return s & 0xffffffff;
+            return s & 0xffffffffL;
+        }
+
+        private long getUint16(ByteBuffer buffer, int position) {
+            return uint16(buffer.getShort(position));
         }
 
         private void prefixOptionToString(StringBuffer sb, int offset) {
@@ -375,6 +380,15 @@
             mPacket.clear();
             mLastSeen = curTime();
 
+            // Sanity check packet in case a packet arrives before we attach RA filter
+            // to our packet socket. b/29586253
+            if (getUint16(mPacket, ETH_ETHERTYPE_OFFSET) != ETH_P_IPV6 ||
+                    uint8(mPacket.get(IPV6_NEXT_HEADER_OFFSET)) != IPPROTO_ICMPV6 ||
+                    uint8(mPacket.get(ICMP6_TYPE_OFFSET)) != ICMP6_ROUTER_ADVERTISEMENT) {
+                throw new IllegalArgumentException("Not an ICMP6 router advertisement");
+            }
+
+
             // Ignore the checksum.
             int lastNonLifetimeStart = addNonLifetime(0,
                     ICMP6_RA_CHECKSUM_OFFSET,