Commit 9e3e5266 authored Mar 21, 2013 by Guobin Zhang Committed by Gerrit Code Review Mar 27, 2013

Two REMOVE_PROVIDER messages caused by race condition.

Fix a bug in unstable ContentProvider.
IllegalStateException: ref counts can't go to zero here: stable=0 unstable=0
IllegalStateException: unstable count < 0: -1

There is a race between main thread and background database thread. Main thread
is responsible for handling the REMOVE_PROVIDER message. Database thread starts
insert or query request again and again. acquireProvider in db thread will often
snatch provider from the jaws of death, sometime it fails to remove REMOVE_PROVIDER
which is already fired out from MessageQueue. But completeRemoveProvider in main
thread gets suspended when trying to execute the critical section. If db thread
released the provider before main thread resumes the execution, then two
REMOVE_PROVIDER messages will be executed.

Change-Id: I8588aa1d1a8bc444dcd2adf6f8bc3f055cebbdc4
Signed-off-by: Guobin Zhang <guobin.zhang@intel.com>

parent 083bfa5a

core/java/android/app/ActivityThread.java

+7 −0

Original line number	Diff line number	Diff line
		@@ -4492,6 +4492,8 @@ public final class ActivityThread {
		+ "snatched provider from the jaws of death");
		}
		prc.removePending = false;
		// There is a race! It fails to remove the message, which
		// will be handled in completeRemoveProvider().
		mH.removeMessages(H.REMOVE_PROVIDER, prc);
		} else {
		unstableDelta = 0;
		@@ -4671,6 +4673,11 @@ public final class ActivityThread {
		return;
		}

		// More complicated race!! Some client managed to acquire the
		// provider and release it before the removal was completed.
		// Continue the removal, and abort the next remove message.
		prc.removePending = false;

		final IBinder jBinder = prc.holder.provider.asBinder();
		ProviderRefCount existingPrc = mProviderRefCountMap.get(jBinder);
		if (existingPrc == prc) {