From 723ba2e82bb7ab37742e5e46c23fffa43e3a1f13 Mon Sep 17 00:00:00 2001
From: Feng Cao <fengcao@google.com>
Date: Wed, 13 May 2020 11:54:40 -0700
Subject: [PATCH] Fix inline suggestion ref counting to not over-count

* Imagine this event sequence:
  1) the IME tries to re-attach an inline suggestion view to the
  window (e.g. because IME layout changes), it calls into the system
  server which causes recreating the backing view because it was
  destroyed earlier due to 0 ref-count (this happens under the hood
  without IME knowing it happens, so the view is still attached to
  the window).
  2) the IME receives a new inline suggestion pointing to the same
  backing view (perhaps due to filtering kicks in).
  3) the recreation from step 1 finishes, but now it will callback
  to the new inline suggestion, therefore the old view doesn't receive
  the new SurfacePackage. See RemoteInlineSuggestionUi for why.
  4) the view in step 1 is detached from window, since it never
  receives a SurfacePackage from the remote view, its detach shouldn't
  cause a reference count down on the remote view.

Test: atest android.autofillservice.cts.inline (sanity test)
Bug: 154683107

Change-Id: I2e6814ef3889de603f6e170efcb795b69ec9febe
---
 .../android/view/inputmethod/InlineSuggestion.java | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/core/java/android/view/inputmethod/InlineSuggestion.java b/core/java/android/view/inputmethod/InlineSuggestion.java
index 4c72474435a42..e4ac5889a3c0d 100644
--- a/core/java/android/view/inputmethod/InlineSuggestion.java
+++ b/core/java/android/view/inputmethod/InlineSuggestion.java
@@ -326,11 +326,13 @@ public final class InlineSuggestion implements Parcelable {
 
         @MainThread
         private void handleOnSurfacePackageReleased() {
-            mSurfacePackage = null;
-            try {
-                mInlineContentProvider.onSurfacePackageReleased();
-            } catch (RemoteException e) {
-                Slog.w(TAG, "Error calling onSurfacePackageReleased(): " + e);
+            if (mSurfacePackage != null) {
+                try {
+                    mInlineContentProvider.onSurfacePackageReleased();
+                } catch (RemoteException e) {
+                    Slog.w(TAG, "Error calling onSurfacePackageReleased(): " + e);
+                }
+                mSurfacePackage = null;
             }
         }
 
@@ -573,7 +575,7 @@ public final class InlineSuggestion implements Parcelable {
     };
 
     @DataClass.Generated(
-            time = 1588308946517L,
+            time = 1589396017700L,
             codegenVersion = "1.0.15",
             sourceFile = "frameworks/base/core/java/android/view/inputmethod/InlineSuggestion.java",
             inputSignatures = "private static final  java.lang.String TAG\nprivate final @android.annotation.NonNull android.view.inputmethod.InlineSuggestionInfo mInfo\nprivate final @android.annotation.Nullable com.android.internal.view.inline.IInlineContentProvider mContentProvider\nprivate @com.android.internal.util.DataClass.ParcelWith(android.view.inputmethod.InlineSuggestion.InlineContentCallbackImplParceling.class) @android.annotation.Nullable android.view.inputmethod.InlineSuggestion.InlineContentCallbackImpl mInlineContentCallback\npublic static @android.annotation.TestApi @android.annotation.NonNull android.view.inputmethod.InlineSuggestion newInlineSuggestion(android.view.inputmethod.InlineSuggestionInfo)\npublic  void inflate(android.content.Context,android.util.Size,java.util.concurrent.Executor,java.util.function.Consumer<android.widget.inline.InlineContentView>)\nprivate static  boolean isValid(int,int,int)\nprivate synchronized  android.view.inputmethod.InlineSuggestion.InlineContentCallbackImpl getInlineContentCallback(android.content.Context,java.util.concurrent.Executor,java.util.function.Consumer<android.widget.inline.InlineContentView>)\nclass InlineSuggestion extends java.lang.Object implements [android.os.Parcelable]\n@com.android.internal.util.DataClass(genEqualsHashCode=true, genToString=true, genHiddenConstDefs=true, genHiddenConstructor=true)")