From 4d93b189a9c33bb07a62d8d134357965744ff817 Mon Sep 17 00:00:00 2001
From: Brett Chabot <brettchabot@google.com>
Date: Fri, 13 Mar 2020 15:39:58 -0700
Subject: [PATCH] Attempt to fix race condition in PooledLambdaImpl.

invoke can read flags after object has been returned to
pool/recycled.

Skip reading isRecycled in that case.

Bug: 151407445
Test: See repro instructions in bug
Change-Id: I0ae42c4fcd121d42dfaedb26d186ac7d51508f6c
---
 .../internal/util/function/pooled/PooledLambdaImpl.java      | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/core/java/com/android/internal/util/function/pooled/PooledLambdaImpl.java b/core/java/com/android/internal/util/function/pooled/PooledLambdaImpl.java
index 8446bbd09df74..e4a44084e91c1 100755
--- a/core/java/com/android/internal/util/function/pooled/PooledLambdaImpl.java
+++ b/core/java/com/android/internal/util/function/pooled/PooledLambdaImpl.java
@@ -200,8 +200,9 @@ final class PooledLambdaImpl<R> extends OmniFunction<Object,
         try {
             return doInvoke();
         } finally {
-            if (isRecycleOnUse()) doRecycle();
-            if (!isRecycled()) {
+            if (isRecycleOnUse()) {
+                doRecycle();
+            } else if (!isRecycled()) {
                 int argsSize = ArrayUtils.size(mArgs);
                 for (int i = 0; i < argsSize; i++) {
                     popArg(i);