Fixed race condition by using a separate counter

Otherwise a broadcast item replies before the loop completes causing
curWaitingUserSwitchCallbacks to be erroneously empty triggering a
premature call to sendContinueUserSwitchLocked.

Bug: 29039588
Change-Id: I48f48ef68c178166d3473b898346f516905ee70c

services/core/java/com/android/server/am/UserController.java

@@ -99,6 +99,7 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicInteger;
 
 /**
  * Helper class for {@link ActivityManagerService} responsible for multi-user functionality.
@@ -1057,6 +1058,7 @@ final class UserController {
                 uss.switching = true;
                 mCurWaitingUserSwitchCallbacks = curWaitingUserSwitchCallbacks;
             }
+            final AtomicInteger waitingCallbacksCount = new AtomicInteger(observerCount);
             for (int i = 0; i < observerCount; i++) {
                 try {
                     // Prepend with unique prefix to guarantee that keys are unique
@@ -1075,7 +1077,7 @@ final class UserController {
                                 }
                                 curWaitingUserSwitchCallbacks.remove(name);
                                 // Continue switching if all callbacks have been notified
-                                if (curWaitingUserSwitchCallbacks.isEmpty()) {
+                                if (waitingCallbacksCount.decrementAndGet() == 0) {
                                     sendContinueUserSwitchLocked(uss, oldUserId, newUserId);
                                 }
                             }