From 34320067d5e0f35fa3bfa7cead7fb0ece52f7955 Mon Sep 17 00:00:00 2001
From: Galia Peycheva <galinap@google.com>
Date: Fri, 10 Dec 2021 11:37:32 +0100
Subject: [PATCH] Fix NullPointerException in DreamManagerService

mCurrentDreamName has one access from an unlocked context, which causes
a race condition between the dream being stopped and started. This
causes a NullPointerExcpetion.

This CL fixes this by moving the mCurrentDreamName read operation back
into a locked block.

Bug: 209911670
Test: m
Change-Id: Icb8e904f067199fbfa62ff90aecd57bf38015546
---
 .../com/android/server/dreams/DreamManagerService.java     | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/services/core/java/com/android/server/dreams/DreamManagerService.java b/services/core/java/com/android/server/dreams/DreamManagerService.java
index 258689a3ed933..8b56d535b07d9 100644
--- a/services/core/java/com/android/server/dreams/DreamManagerService.java
+++ b/services/core/java/com/android/server/dreams/DreamManagerService.java
@@ -416,13 +416,14 @@ public final class DreamManagerService extends SystemService {
         mCurrentDreamCanDoze = canDoze;
         mCurrentDreamUserId = userId;
 
+        if (!mCurrentDreamName.equals(mAmbientDisplayComponent)) {
+            mUiEventLogger.log(DreamManagerEvent.DREAM_START);
+        }
+
         PowerManager.WakeLock wakeLock = mPowerManager
                 .newWakeLock(PowerManager.PARTIAL_WAKE_LOCK, "startDream");
         mHandler.post(wakeLock.wrap(() -> {
             mAtmInternal.notifyDreamStateChanged(true);
-            if (!mCurrentDreamName.equals(mAmbientDisplayComponent)) {
-                mUiEventLogger.log(DreamManagerEvent.DREAM_START);
-            }
             mController.startDream(newToken, name, isTest, canDoze, userId, wakeLock,
                     mDreamOverlayServiceName);
         }));