https://android.googlesource.com/platform/frameworks/base/+/master/services/core/java/com/android/server/am/ActivityManagerService.java#18624
https://android.googlesource.com/platform/frameworks/base/+/master/services/core/java/com/android/server/am/ActivityManagerShellCommand.java

-> com.android.server.am.ActivityManagerShellCommand.runSendBroadcast()

calls

-> com.android.server.am.ActivityManagerService.broadcastIntent()

with IApplicationThread caller = null, this means

	final ProcessRecord callerApp = getRecordForAppLocked(caller);

fails and

-> com.android.server.am.ActivityManagerService.broadcastIntentLocked()

is being called with ProcessRecord callerApp = null, String callerPackage = null

These are passed as parameters to

-> com.android.server.am.ActivityManagerService.isInstantApp(),

where

		if (callerPackage == null) {
            Slog.e(TAG, "isInstantApp with an application's uid, no record, and no package name");
            throw new IllegalArgumentException("Calling application did not provide package name");
        }

finally causes an exception.

This is bypassed when running the /system/bin/cmd through `su` on a rooted phone.
In that case isInstantApp will return false before throwing the exception:

        if (UserHandle.getAppId(uid) < FIRST_APPLICATION_UID) {
            return false;
        }