Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6009ac66 authored by JW Wang's avatar JW Wang
Browse files

mService.unlinkToDeath might be called without having linkToDeath 

See b/152932464#comment1 for the analysis.

Fix a race where #unlinkToDeath might be called without a preceding
call to #linkToDeath and result in an exception.

Bug: 152932464
Test: presubmit
Change-Id: I061b314ebd895a400b1bb2e2956233775d5816e5
parent 1e51bc36

services/accessibility/java/com/android/server/accessibility/UiAutomationManager.java

+6 −4
Original line number Original line Diff line number Diff line
@@ -239,16 +239,18 @@ class UiAutomationManager { 
            mMainHandler.post(() -> {

            mMainHandler.post(() -> {

                try {

                try {

                    final IAccessibilityServiceClient serviceInterface;

                    final IAccessibilityServiceClient serviceInterface;

                    final IBinder service;

                    synchronized (mLock) {

                    synchronized (mLock) {

                        serviceInterface = mServiceInterface;

                        serviceInterface = mServiceInterface;

                        mService = (serviceInterface == null) ? null : mServiceInterface.asBinder();

                        if (serviceInterface == null) {

                        service = mService;

                            mService = null;

                        } else {

                            mService = mServiceInterface.asBinder();

                            mService.linkToDeath(this, 0);

                        }

                    }

                    }

                    // If the serviceInterface is null, the UiAutomation has been shut down on

                    // If the serviceInterface is null, the UiAutomation has been shut down on

                    // another thread.

                    // another thread.

                    if (serviceInterface != null) {

                    if (serviceInterface != null) {

                        service.linkToDeath(this, 0);

                        serviceInterface.init(this, mId,

                        serviceInterface.init(this, mId,

                                mOverlayWindowTokens.get(Display.DEFAULT_DISPLAY));

                                mOverlayWindowTokens.get(Display.DEFAULT_DISPLAY));

                    }

                    }