From b6cd9c2003d258e1f60a839d22720f442e150d52 Mon Sep 17 00:00:00 2001
From: wilsonshih <wilsonshih@google.com>
Date: Mon, 24 Feb 2020 11:51:43 +0800
Subject: [PATCH] Fix race condition while WallpaperMS rebinding service.

Connection object could not receive onServiceConnected after
new process of the service was active.

How issue happen:
1. The process of wallpaper service died, AM schedule to restart,
WallpaperMS schedule to rebind.
2. WallpaperMS bind service with new connection object.
=> ActiveService bring up new process. Add this ServiceRecord to
   mPendingServices.
3. WallpaperMS unbind previous connection object.
=> ActiveService remove previous connection, also remove this
   ServiceRecord object from mPendingServices list.
4. Process ready, attach application but cannot find the service
   from pendingServices.

Solution: Do not remove the ServiceRecord object from mPendingServices
if there is any connection left.

Also use runnable object instead of method reference.

Bug: 148834472

Test: atest WallpaperManagerTest WallpaperManagerServiceTests
Change-Id: I3adec66de8ac0c7efc9ad3ffbf604b01eacb5720
Merged-In: I3adec66de8ac0c7efc9ad3ffbf604b01eacb5720
(cherry picked from commit d1551333823f4e86ec0e19b65c4faafeb617f87b)
---
 .../core/java/com/android/server/am/ActiveServices.java   | 7 +++++--
 .../android/server/wallpaper/WallpaperManagerService.java | 8 ++++++--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/services/core/java/com/android/server/am/ActiveServices.java b/services/core/java/com/android/server/am/ActiveServices.java
index 5d72828964c73..f03d9df6ed5f5 100644
--- a/services/core/java/com/android/server/am/ActiveServices.java
+++ b/services/core/java/com/android/server/am/ActiveServices.java
@@ -3159,8 +3159,11 @@ public final class ActiveServices {
                 }
             }
 
-            // If unbound while waiting to start, remove the pending service
-            mPendingServices.remove(s);
+            // If unbound while waiting to start and there is no connection left in this service,
+            // remove the pending service
+            if (s.getConnections().isEmpty()) {
+                mPendingServices.remove(s);
+            }
 
             if ((c.flags&Context.BIND_AUTO_CREATE) != 0) {
                 boolean hasAutoCreate = s.hasAutoCreateConnections();
diff --git a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
index 4e136af0fdc34..0e2f0ce991c75 100644
--- a/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
+++ b/services/core/java/com/android/server/wallpaper/WallpaperManagerService.java
@@ -1180,6 +1180,10 @@ public class WallpaperManagerService extends IWallpaperManager.Stub
             }
         };
 
+        private Runnable mTryToRebindRunnable = () -> {
+            tryToRebind();
+        };
+
         WallpaperConnection(WallpaperInfo info, WallpaperData wallpaper, int clientUid) {
             mInfo = info;
             mWallpaper = wallpaper;
@@ -1286,7 +1290,7 @@ public class WallpaperManagerService extends IWallpaperManager.Stub
                         saveSettingsLocked(mWallpaper.userId);
                     }
                     FgThread.getHandler().removeCallbacks(mResetRunnable);
-                    mContext.getMainThreadHandler().removeCallbacks(this::tryToRebind);
+                    mContext.getMainThreadHandler().removeCallbacks(mTryToRebindRunnable);
                 }
             }
         }
@@ -1344,7 +1348,7 @@ public class WallpaperManagerService extends IWallpaperManager.Stub
                         < WALLPAPER_RECONNECT_TIMEOUT_MS) {
                     // Bind fail without timeout, schedule rebind
                     Slog.w(TAG, "Rebind fail! Try again later");
-                    mContext.getMainThreadHandler().postDelayed(this::tryToRebind, 1000);
+                    mContext.getMainThreadHandler().postDelayed(mTryToRebindRunnable, 1000);
                 } else {
                     // Timeout
                     Slog.w(TAG, "Reverting to built-in wallpaper!");