Fix NetworkAgent 4-way binder interlock

System server        |    Client (e.g. phone)
------------------------------|-----------------------------
                              |
NetworkAgentMessageHandler ←--|--- INetworkAgentRegistry
              ↓               |              ↑
                              |         NetworkAgent
        NetworkAgentInfo      |              ↑
              ↓               |      NetworkAgentHandler
                              |              ↑
         INetworkAgent     ---|--→   NetworkAgentBinder

The simplest artifact is observed by watching the output of
adb shell dumpsys meminfo -d phone | grep 'Proxy Binders'
while turning airplane mode on and off (slowly, to allow the
cell network to connect and disconnect).
This will display the number of binder proxies. Before this, the binder
proxy count increases by 2 with each connection and never goes down (there
is some noise, as proxy objects are sometimes created for other reasons,
and get GC'd eventually). After this, the binder proxy count is always
eventually stable.

Also see b/133174607.

Bug: 400358935
Flag: EXEMPT bugfix
Test: manual, also regression test on the way
Change-Id: I1dcdaec1f3bd42bc2a406c9e9318208f96266bd6

framework/src/android/net/NetworkAgent.java

@@ -679,6 +679,21 @@ public abstract class NetworkAgent {
                     synchronized (mRegisterLock) {
                         mState = STATE_UNREGISTERED;
                         mConnected = false;
+                        // Nulling out the registry here is necessary for the GC to notice that
+                        // this object can be reclaimed. Because :
+                        // ■ Here in the client side :
+                        // - the agent is a Binder object to the system server
+                        // - the agent owns the registry
+                        // - the registry is a Binder object from the system server
+                        // ■ On the system server side :
+                        // - the registry is a NetworkAgentInfo Binder to the client
+                        // - the NetworkAgentInfo owns the NetworkAgent
+                        // - the NetworkAgent is a Binder object from the client
+                        // This means there is a four-way binder interlock preventing the GC from
+                        // noticing these objects can be reclaimed. Nulling out the registry here
+                        // breaks that loop, which the GC can then unwind.
+                        // See b/400358935 for details.
+                        mRegistry = null;
                     }
                     break;
                 }