From 5a6ef737edbf57577443ac056613afe6cb121519 Mon Sep 17 00:00:00 2001
From: Dianne Hackborn <hackbod@google.com>
Date: Fri, 11 Nov 2011 12:31:52 -0800
Subject: [PATCH] Fix issue #5595933: GREF leak due to race condition in...

...LoadedApk.ServiceDispatcher.connected , LoadedApk.forgetServiceDispatcher

Don't be stupid if we receive a new binding to a ServiceConnection after it
has already been unbound.

Change-Id: I85a49de97372bf9af55542a89031f0b7a2ac8fbb
---
 core/java/android/app/LoadedApk.java | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/core/java/android/app/LoadedApk.java b/core/java/android/app/LoadedApk.java
index 522f47760a49a..0c6baebf26b98 100644
--- a/core/java/android/app/LoadedApk.java
+++ b/core/java/android/app/LoadedApk.java
@@ -901,6 +901,7 @@ public final class LoadedApk {
         private RuntimeException mUnbindLocation;
 
         private boolean mDied;
+        private boolean mForgotten;
 
         private static class ConnectionInfo {
             IBinder binder;
@@ -959,6 +960,7 @@ public final class LoadedApk {
                     ci.binder.unlinkToDeath(ci.deathMonitor, 0);
                 }
                 mActiveConnections.clear();
+                mForgotten = true;
             }
         }
 
@@ -1020,6 +1022,11 @@ public final class LoadedApk {
             ServiceDispatcher.ConnectionInfo info;
 
             synchronized (this) {
+                if (mForgotten) {
+                    // We unbound before receiving the connection; ignore
+                    // any connection received.
+                    return;
+                }
                 old = mActiveConnections.get(name);
                 if (old != null && old.binder == service) {
                     // Huh, already have this one.  Oh well!