From 1b636fa64cec2bf151d8d0dd5b34e9f3a95af736 Mon Sep 17 00:00:00 2001
From: Arthur Hung <arthurhung@google.com>
Date: Tue, 4 Dec 2018 15:53:49 +0800
Subject: [PATCH] Fix InputConsumer for RecentsAnimationController may access
 null pointer

Once recents died, it would post a cancel animation
and remove its InputConsumer. So it would be a race condition
when updateInputWindows and remove the InputConsumer.
We need to add a protect for this.

Bug: 120439400
Test: go/wm-smoke
Test: swiping up on the Home button
Change-Id: I5c4323d90ee5a54a2fe655d803be7a3f1561fe2d
---
 .../android/server/wm/RecentsAnimationController.java  | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/services/core/java/com/android/server/wm/RecentsAnimationController.java b/services/core/java/com/android/server/wm/RecentsAnimationController.java
index b6609e467e858..6c12cea4a1d88 100644
--- a/services/core/java/com/android/server/wm/RecentsAnimationController.java
+++ b/services/core/java/com/android/server/wm/RecentsAnimationController.java
@@ -504,10 +504,12 @@ public class RecentsAnimationController implements DeathRecipient {
     public void binderDied() {
         cancelAnimation(REORDER_MOVE_TO_ORIGINAL_POSITION, "binderDied");
 
-        // Clear associated input consumers on runner death
-        final InputMonitor inputMonitor =
-                mService.mRoot.getDisplayContent(mDisplayId).getInputMonitor();
-        inputMonitor.destroyInputConsumer(INPUT_CONSUMER_RECENTS_ANIMATION);
+        synchronized (mService.getWindowManagerLock()) {
+            // Clear associated input consumers on runner death
+            final InputMonitor inputMonitor =
+                    mService.mRoot.getDisplayContent(mDisplayId).getInputMonitor();
+            inputMonitor.destroyInputConsumer(INPUT_CONSUMER_RECENTS_ANIMATION);
+        }
     }
 
     void checkAnimationReady(WallpaperController wallpaperController) {