Fix ConcurrentModification in onUidStateChanged

Bug: 172776374
Fixes: 173078211
Test: Presubmit
Merged-In: Ib4c96e81cbe2adcfd53ea23ae644e978effb7a92
Change-Id: Ib4c96e81cbe2adcfd53ea23ae644e978effb7a92
diff --git a/services/core/java/com/android/server/appop/AppOpsService.java b/services/core/java/com/android/server/appop/AppOpsService.java
index 12eb8f2..1b12dc7 100644
--- a/services/core/java/com/android/server/appop/AppOpsService.java
+++ b/services/core/java/com/android/server/appop/AppOpsService.java
@@ -1011,10 +1011,11 @@
             }
 
             int numInProgressEvents = mInProgressEvents.size();
+            List<IBinder> binders = new ArrayList<>(mInProgressEvents.keySet());
             for (int i = 0; i < numInProgressEvents; i++) {
-                InProgressStartOpEvent event = mInProgressEvents.valueAt(i);
+                InProgressStartOpEvent event = mInProgressEvents.get(binders.get(i));
 
-                if (event.getUidState() != newState) {
+                if (event != null && event.getUidState() != newState) {
                     try {
                         // Remove all but one unfinished start count and then call finished() to
                         // remove start event object
@@ -1025,7 +1026,10 @@
                         // Call started() to add a new start event object and then add the
                         // previously removed unfinished start counts back
                         started(event.getClientId(), newState, false);
-                        event.numUnfinishedStarts += numPreviousUnfinishedStarts - 1;
+                        InProgressStartOpEvent newEvent = mInProgressEvents.get(binders.get(i));
+                        if (newEvent != null) {
+                            newEvent.numUnfinishedStarts += numPreviousUnfinishedStarts - 1;
+                        }
                     } catch (RemoteException e) {
                         if (DEBUG) Slog.e(TAG, "Cannot switch to new uidState " + newState);
                     }