Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 2a4c5acc authored by Jeff Brown's avatar Jeff Brown
Browse files

Fix race in removeDeadProvider. 

Bug: 5202824

It's possible for removeDeadProvider to be called after the provider
has already been removed from the provider map due to a race between
binderDied and removing the provider.

Deleted removeDeadProviderLocked; it was dead code.

Change-Id: Iecdc68703225e7ac171746e63f1b3141c6f2ce4c
parent f9838d0b

core/java/android/app/ActivityThread.java

+1 −12
Original line number Diff line number Diff line
@@ -4091,7 +4091,7 @@ public final class ActivityThread { 
    final void removeDeadProvider(String name, IContentProvider provider) {

        synchronized(mProviderMap) {

            ProviderClientRecord pr = mProviderMap.get(name);

            if (pr.mProvider.asBinder() == provider.asBinder()) {

            if (pr != null && pr.mProvider.asBinder() == provider.asBinder()) {

                Slog.i(TAG, "Removing dead content provider: " + name);

                ProviderClientRecord removed = mProviderMap.remove(name);

                if (removed != null) {
@@ -4101,17 +4101,6 @@ public final class ActivityThread { 
        }

    }



    final void removeDeadProviderLocked(String name, IContentProvider provider) {

        ProviderClientRecord pr = mProviderMap.get(name);

        if (pr.mProvider.asBinder() == provider.asBinder()) {

            Slog.i(TAG, "Removing dead content provider: " + name);

            ProviderClientRecord removed = mProviderMap.remove(name);

            if (removed != null) {

                removed.mProvider.asBinder().unlinkToDeath(removed, 0);

            }

        }

    }



    private IContentProvider installProvider(Context context,

            IContentProvider provider, ProviderInfo info, boolean noisy) {

        ContentProvider localProvider = null;