commit b6cd9c2003d258e1f60a839d22720f442e150d52
author wilsonshih <wilsonshih@google.com> Mon Feb 24 11:51:43 2020 +0800
committer Wei Sheng Shih <wilsonshih@google.com> Fri Mar 13 08:08:35 2020 +0000
tree a3678fd5dd57b1cbfc089216e5ed45416a0cede7
parent 6a1b278be8915a47660c27897a662c51f7051b6a

Fix race condition while WallpaperMS rebinding service.

Connection object could not receive onServiceConnected after
new process of the service was active.

How issue happen:
1. The process of wallpaper service died, AM schedule to restart,
WallpaperMS schedule to rebind.
2. WallpaperMS bind service with new connection object.
=> ActiveService bring up new process. Add this ServiceRecord to
   mPendingServices.
3. WallpaperMS unbind previous connection object.
=> ActiveService remove previous connection, also remove this
   ServiceRecord object from mPendingServices list.
4. Process ready, attach application but cannot find the service
   from pendingServices.

Solution: Do not remove the ServiceRecord object from mPendingServices
if there is any connection left.

Also use runnable object instead of method reference.

Bug: 148834472

Test: atest WallpaperManagerTest WallpaperManagerServiceTests
Change-Id: I3adec66de8ac0c7efc9ad3ffbf604b01eacb5720
Merged-In: I3adec66de8ac0c7efc9ad3ffbf604b01eacb5720
(cherry picked from commit d1551333823f4e86ec0e19b65c4faafeb617f87b)

services/core/java/com/android/server/am/ActiveServices.java

diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java
index 5d72828..f03d9df 100644
--- a/services/core/java/com/android/server/am/ActiveServices.java
+++ b/services/core/java/com/android/server/am/ActiveServices.java
@@ -3159,8 +3159,11 @@
                 }
             }
 
-            // If unbound while waiting to start, remove the pending service
-            mPendingServices.remove(s);
+            // If unbound while waiting to start and there is no connection left in this service,
+            // remove the pending service
+            if (s.getConnections().isEmpty()) {
+                mPendingServices.remove(s);
+            }
 
             if ((c.flags&Context.BIND_AUTO_CREATE) != 0) {
                 boolean hasAutoCreate = s.hasAutoCreateConnections();

services/core/java/com/android/server/wallpaper/WallpaperManagerService.java

diff --git a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
index 4e136af..0e2f0ce 100644
--- a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
+++ b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
@@ -1180,6 +1180,10 @@
             }
         };
 
+        private Runnable mTryToRebindRunnable = () -> {
+            tryToRebind();
+        };
+
         WallpaperConnection(WallpaperInfo info, WallpaperData wallpaper, int clientUid) {
             mInfo = info;
             mWallpaper = wallpaper;
@@ -1286,7 +1290,7 @@
                         saveSettingsLocked(mWallpaper.userId);
                     }
                     FgThread.getHandler().removeCallbacks(mResetRunnable);
-                    mContext.getMainThreadHandler().removeCallbacks(this::tryToRebind);
+                    mContext.getMainThreadHandler().removeCallbacks(mTryToRebindRunnable);
                 }
             }
         }
@@ -1344,7 +1348,7 @@
                         < WALLPAPER_RECONNECT_TIMEOUT_MS) {
                     // Bind fail without timeout, schedule rebind
                     Slog.w(TAG, "Rebind fail! Try again later");
-                    mContext.getMainThreadHandler().postDelayed(this::tryToRebind, 1000);
+                    mContext.getMainThreadHandler().postDelayed(mTryToRebindRunnable, 1000);
                 } else {
                     // Timeout
                     Slog.w(TAG, "Reverting to built-in wallpaper!");