Fix: Double-free error on RemoteFillService

Symptom:
RemoteFillService was crashed due to IllegalArgumentException
"Service not registered:" at onServiceConnected.

Root cause:
RemoteFillService#onServiceConnected tries to unbind the connection
if mDestroyed is flagged or mBinding is not flagged. It always fails
with IllegalArgumentException.
Both mDestroyed and !mBinding mean the connection was unbound.
You can't unbind the unbound connection. It's not allowed.

Fixes: 73864601
Fixes: 69905688

Change-Id: If5481468ddac7be41accad63e9d5382bc6c029fd
This commit is contained in:
Tetsutoki Shiozawa
2018-02-23 13:16:56 +09:00
committed by Felipe Leme
parent cb0714332d
commit 26c93c94c9

View File

@@ -342,7 +342,8 @@ final class RemoteFillService implements DeathRecipient {
@Override
public void onServiceConnected(ComponentName name, IBinder service) {
if (mDestroyed || !mBinding) {
mContext.unbindService(mServiceConnection);
// This is abnormal. Unbinding the connection has been requested already.
Slog.wtf(LOG_TAG, "onServiceConnected was dispatched after unbindService.");
return;
}
mBinding = false;