Prevent NPE in dispatchUserSwitch

Access to mCurWaitingUserSwitchCallbacks should be synchronized and it's
safer to access the local variable curWaitingUserSwitchCallbacks

Bug: 29039588
Change-Id: Id91699670ca16467d385f476ba06da2cb29a984b

services/core/java/com/android/server/am/UserController.java

@@ -1061,7 +1061,9 @@ final class UserController {
                 try {
                     // Prepend with unique prefix to guarantee that keys are unique
                     final String name = "#" + i + " " + mUserSwitchObservers.getBroadcastCookie(i);
-                    mCurWaitingUserSwitchCallbacks.add(name);
+                    synchronized (mService) {
+                        curWaitingUserSwitchCallbacks.add(name);
+                    }
                     final IRemoteCallback callback = new IRemoteCallback.Stub() {
                         @Override
                         public void sendResult(Bundle data) throws RemoteException {