Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 26c93c94 authored by Tetsutoki Shiozawa's avatar Tetsutoki Shiozawa Committed by Felipe Leme
Browse files

Fix: Double-free error on RemoteFillService 

Symptom:
RemoteFillService was crashed due to IllegalArgumentException
"Service not registered:" at onServiceConnected.

Root cause:
RemoteFillService#onServiceConnected tries to unbind the connection
if mDestroyed is flagged or mBinding is not flagged. It always fails
with IllegalArgumentException.
Both mDestroyed and !mBinding mean the connection was unbound.
You can't unbind the unbound connection. It's not allowed.

Fixes: 73864601
Fixes: 69905688

Change-Id: If5481468ddac7be41accad63e9d5382bc6c029fd
parent cb071433

services/autofill/java/com/android/server/autofill/RemoteFillService.java

+2 −1
Original line number Diff line number Diff line
@@ -342,7 +342,8 @@ final class RemoteFillService implements DeathRecipient { 
        @Override

        public void onServiceConnected(ComponentName name, IBinder service) {

            if (mDestroyed || !mBinding) {

                mContext.unbindService(mServiceConnection);

                // This is abnormal. Unbinding the connection has been requested already.

                Slog.wtf(LOG_TAG, "onServiceConnected was dispatched after unbindService.");

                return;

            }

            mBinding = false;