BroadcastQueue: fix subtle resultTo bugs.

Even when no remote IApplicationThread is provided, we should still
clear out the IIntentReceiver reference so that it can be GC'ed in
the remote process.

Additionally, fix related bug where startActivityIntentSender()
has an IApplicationThread instance but doesn't pass it along.

Add log message to aid future investigations where IApplicationThread
might have been omitted by the caller.

Bug: 255833934
Test: atest --rerun-until-failure 100 NexusLauncherTests:WellbeingTests
Change-Id: I84a40c7f44eb761943e3c2aa0d3b78ffc2cbe901

services/core/java/com/android/server/am/BroadcastQueueModernImpl.java

@@ -816,9 +816,9 @@ class BroadcastQueueModernImpl extends BroadcastQueue {
      * ordered broadcast; assumes the sender is still a warm process.
      */
     private void scheduleResultTo(@NonNull BroadcastRecord r) {
-        if ((r.resultToApp == null) || (r.resultTo == null)) return;
+        if (r.resultTo == null) return;
         final ProcessRecord app = r.resultToApp;
-        final IApplicationThread thread = app.getOnewayThread();
+        final IApplicationThread thread = (app != null) ? app.getOnewayThread() : null;
         if (thread != null) {
             mService.mOomAdjuster.mCachedAppOptimizer.unfreezeTemporarily(
                     app, OOM_ADJ_REASON_FINISH_RECEIVER);

services/core/java/com/android/server/am/PendingIntentRecord.java

@@ -490,6 +490,11 @@ public final class PendingIntentRecord extends IIntentSender.Stub {
 
             final IApplicationThread finishedReceiverThread = caller;
             boolean sendFinish = finishedReceiver != null;
+            if ((finishedReceiver != null) && (finishedReceiverThread == null)) {
+                Slog.w(TAG, "Sending of " + intent + " from " + Binder.getCallingUid()
+                        + " requested resultTo without an IApplicationThread!", new Throwable());
+            }
+
             int userId = key.userId;
             if (userId == UserHandle.USER_CURRENT) {
                 userId = controller.mUserController.getCurrentOrTargetUserId();

services/core/java/com/android/server/wm/ActivityTaskManagerService.java

@@ -1316,7 +1316,7 @@ public class ActivityTaskManagerService extends IActivityTaskManager.Stub {
                 mAppSwitchesState = APP_SWITCH_ALLOW;
             }
         }
-        return pir.sendInner(0, fillInIntent, resolvedType, allowlistToken, null, null,
+        return pir.sendInner(caller, 0, fillInIntent, resolvedType, allowlistToken, null, null,
                 resultTo, resultWho, requestCode, flagsMask, flagsValues, bOptions);
     }