From 83f4c75f8030254093e514220a2ea361ecc7a044 Mon Sep 17 00:00:00 2001
From: Tim Murray <timmurray@google.com>
Date: Thu, 27 Apr 2023 11:31:56 -0700
Subject: [PATCH] CachedAppOptimizer: update pending freeze inside the process
 lock

Only update pending freeze once mProcLock has been acquired. If this
doesn't happen, the following is possible:

1. FreezeHandler calls setPendingFreeze(false)
2. FreezeHandler blocks on mProcLock, held by someone
3. BroadcastQueue calls notifyStartedRunning
4. BroadcastQueue calls unfreezeTemporarily, which grabs mProcLock
5. BQ wins mProcLock race and sees opt.isPendingFreeze == false
and opt.isFrozen == false so skips unfreeze
6. FreezeHandler wakes up, grabs mProcLock, and freezes the process

Test: boots
Bug: 267949291
Change-Id: I52ab99f3b838e86d187a5a2a27652f78896ffaa4
---
 .../java/com/android/server/am/CachedAppOptimizer.java    | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/services/core/java/com/android/server/am/CachedAppOptimizer.java b/services/core/java/com/android/server/am/CachedAppOptimizer.java
index 1426cfd652866..3bc5de91b2bdf 100644
--- a/services/core/java/com/android/server/am/CachedAppOptimizer.java
+++ b/services/core/java/com/android/server/am/CachedAppOptimizer.java
@@ -2100,9 +2100,12 @@ public final class CachedAppOptimizer {
             final boolean frozen;
             final ProcessCachedOptimizerRecord opt = proc.mOptRecord;
 
-            opt.setPendingFreeze(false);
-
             synchronized (mProcLock) {
+                // someone has canceled this freeze
+                if (!opt.isPendingFreeze()) {
+                    return;
+                }
+                opt.setPendingFreeze(false);
                 pid = proc.getPid();
 
                 if (mFreezerOverride) {
@@ -2148,7 +2151,6 @@ public final class CachedAppOptimizer {
                 try {
                     traceAppFreeze(proc.processName, pid, -1);
                     Process.setProcessFrozen(pid, proc.uid, true);
-
                     opt.setFreezeUnfreezeTime(SystemClock.uptimeMillis());
                     opt.setFrozen(true);
                     opt.setHasCollectedFrozenPSS(false);