Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e797b84e authored by Phil Weaver's avatar Phil Weaver
Browse files

Fix crash when user changes after a11yservice dies 

We were failing to create a death link for the service that
replaces the crashed a11y service. Adding an invariant that
mService is always linked to death if it is non-null.

Bug: 31044551
Change-Id: I98b6a3969cfacb0309e19938899a51c809249d6b
parent f50ff35c

services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java

+21 −16
Original line number Diff line number Diff line
@@ -2224,6 +2224,8 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub { 


        AccessibilityServiceInfo mAccessibilityServiceInfo;



        // The service that's bound to this instance. Whenever this value is non-null, this

        // object is registered as a death recipient

        IBinder mService;



        IAccessibilityServiceClient mServiceInterface;
@@ -2358,14 +2360,14 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub { 
                }

            } else {

                userState.mBindingServices.add(mComponentName);

                mService = userState.mUiAutomationServiceClient.asBinder();

                mMainHandler.post(new Runnable() {

                    @Override

                    public void run() {

                        // Simulate asynchronous connection since in onServiceConnected

                        // we may modify the state data in case of an error but bind is

                        // called while iterating over the data and bad things can happen.

                        onServiceConnected(mComponentName, mService);

                        onServiceConnected(mComponentName,

                                userState.mUiAutomationServiceClient.asBinder());

                    }

                });

                userState.mUiAutomationService = this;
@@ -2457,7 +2459,19 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub { 
        @Override

        public void onServiceConnected(ComponentName componentName, IBinder service) {

            synchronized (mLock) {

                if (mService != service) {

                    if (mService != null) {

                        mService.unlinkToDeath(this, 0);

                    }

                    mService = service;

                    try {

                        mService.linkToDeath(this, 0);

                    } catch (RemoteException re) {

                        Slog.e(LOG_TAG, "Failed registering death link");

                        binderDied();

                        return;

                    }

                }

                mServiceInterface = IAccessibilityServiceClient.Stub.asInterface(service);

                UserState userState = getUserStateLocked(mUserId);

                addServiceLocked(this, userState);
@@ -3091,7 +3105,6 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub { 
        }



        public void onAdded() throws RemoteException {

            linkToOwnDeathLocked();

            final long identity = Binder.clearCallingIdentity();

            try {

                mWindowManagerService.addWindowToken(mOverlayWindowToken,
@@ -3108,17 +3121,6 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub { 
            } finally {

                Binder.restoreCallingIdentity(identity);

            }

            unlinkToOwnDeathLocked();

        }



        public void linkToOwnDeathLocked() throws RemoteException {

            mService.linkToDeath(this, 0);

        }



        public void unlinkToOwnDeathLocked() {

            if (mService != null) {

                mService.unlinkToDeath(this, 0);

            }

        }



        public void resetLocked() {
@@ -3131,7 +3133,10 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub { 
            } catch (RemoteException re) {

                /* ignore */

            }

            if (mService != null) {

                mService.unlinkToDeath(this, 0);

                mService = null;

            }

            mServiceInterface = null;

        }