Fix typo: decrement not increment

When iterating a list backwards, one must decrement the index
rather than increment it.

Bug: 123562063
Test: test procedure given in bug
Test: tests/ActivityTests
Change-Id: I09d7bd045ff00291befe9d4e829d153f41a01a15
(cherry picked from commit d4caf851d32b2f1e87a1f43c876886d65506b9c9)
diff --git a/services/core/java/com/android/server/am/BroadcastDispatcher.java b/services/core/java/com/android/server/am/BroadcastDispatcher.java
index 0d46379..6371cd3 100644
--- a/services/core/java/com/android/server/am/BroadcastDispatcher.java
+++ b/services/core/java/com/android/server/am/BroadcastDispatcher.java
@@ -312,7 +312,7 @@
         final Intent intent = r.intent;
         // Any in-flight broadcast has already been popped, and cannot be replaced.
         // (This preserves existing behavior of the replacement API)
-        for (int i = list.size() - 1; i >= 0; i++) {
+        for (int i = list.size() - 1; i >= 0; i--) {
             old = list.get(i);
             if (old.userId == r.userId && intent.filterEquals(old.intent)) {
                 if (DEBUG_BROADCAST) {
diff --git a/tests/ActivityTests/src/com/google/android/test/activity/ActivityTestMain.java b/tests/ActivityTests/src/com/google/android/test/activity/ActivityTestMain.java
index 2581e08..d5549cc 100644
--- a/tests/ActivityTests/src/com/google/android/test/activity/ActivityTestMain.java
+++ b/tests/ActivityTests/src/com/google/android/test/activity/ActivityTestMain.java
@@ -77,6 +77,7 @@
     static final int MSG_SPAM_ALARM = 2;
     static final int MSG_SLOW_RECEIVER = 3;
     static final int MSG_SLOW_ALARM_RECEIVER = 4;
+    static final int MSG_REPLACE_BROADCAST = 5;
 
     final Handler mHandler = new Handler() {
         @Override
@@ -138,6 +139,20 @@
                     Log.i(TAG, "Setting alarm for now + 5 seconds");
                     am.setExact(AlarmManager.ELAPSED_REALTIME, now + 5_000, pi);
                 } break;
+                case MSG_REPLACE_BROADCAST: {
+                    Intent intent = new Intent(ActivityTestMain.this, SlowReceiver.class);
+                    intent.setAction(SLOW_RECEIVER_ACTION);
+                    intent.putExtra(SLOW_RECEIVER_EXTRA, 1);
+                    sendOrderedBroadcast(intent, null, mSlowReceiverCompletion, mHandler,
+                            Activity.RESULT_OK, null, null);
+                    intent.putExtra(SLOW_RECEIVER_EXTRA, 2);
+                    sendOrderedBroadcast(intent, null, mSlowReceiverCompletion, mHandler,
+                            Activity.RESULT_OK, null, null);
+                    intent.putExtra(SLOW_RECEIVER_EXTRA, 5038);
+                    intent.addFlags(Intent.FLAG_RECEIVER_REPLACE_PENDING);
+                    sendOrderedBroadcast(intent, null, mSlowReceiverCompletion, mHandler,
+                            Activity.RESULT_OK, null, null);
+                } break;
             }
             super.handleMessage(msg);
         }
@@ -418,6 +433,12 @@
                 return true;
             }
         });
+        menu.add("Replace broadcast").setOnMenuItemClickListener(new MenuItem.OnMenuItemClickListener() {
+            @Override public boolean onMenuItemClick(MenuItem item) {
+                scheduleReplaceBroadcast();
+                return true;
+            }
+        });
         menu.add("Stack Doc").setOnMenuItemClickListener(new MenuItem.OnMenuItemClickListener() {
             @Override public boolean onMenuItemClick(MenuItem item) {
                 ActivityManager.AppTask task = findDocTask();
@@ -616,6 +637,11 @@
         mHandler.sendMessageDelayed(mHandler.obtainMessage(MSG_SLOW_ALARM_RECEIVER), 500);
     }
 
+    void scheduleReplaceBroadcast() {
+        mHandler.removeMessages(MSG_REPLACE_BROADCAST);
+        mHandler.sendMessageDelayed(mHandler.obtainMessage(MSG_REPLACE_BROADCAST), 500);
+    }
+
     private View scrollWrap(View view) {
         ScrollView scroller = new ScrollView(this);
         scroller.addView(view, new ScrollView.LayoutParams(ScrollView.LayoutParams.MATCH_PARENT,