From 8828d86e79424fc1c7b7d1f908e3450879d5cea0 Mon Sep 17 00:00:00 2001
From: Craig Mautner <cmautner@google.com>
Date: Thu, 14 Aug 2014 16:08:26 -0700
Subject: [PATCH] DO NOT MERGE Fix race condition between binder deaths

If a Binder dies there is a race between activity manager and window
manager to see who can handle the binderDied call first. If the
activity manager wins the race it will remove the activity and task
but leave the windows around. Until the WindowState.binderDied call
is made and all animation is complete the windows will try to access
the task that they were associated with.

This fix removes the windows of an activity when the activity is
removed. It also defers removal of the activity and task until
exiting windows have completed their animation.

Fixes bug 17031518.

Change-Id: Idf52f55c5feb0cad4e3664ef2eae5b7e95bbf490
(cherry picked from commit 5acd163b828d5b26408eb3a7904d750a1570239e)
---
 .../core/java/com/android/server/wm/AppWindowToken.java  | 9 +++++++++
 services/core/java/com/android/server/wm/TaskStack.java  | 2 +-
 .../java/com/android/server/wm/WindowManagerService.java | 4 +++-
 3 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/services/core/java/com/android/server/wm/AppWindowToken.java b/services/core/java/com/android/server/wm/AppWindowToken.java
index ca4ad8a32e0d8..4fe37e8cbdea7 100644
--- a/services/core/java/com/android/server/wm/AppWindowToken.java
+++ b/services/core/java/com/android/server/wm/AppWindowToken.java
@@ -245,6 +245,15 @@ class AppWindowToken extends WindowToken {
         return false;
     }
 
+    void removeAllWindows() {
+        for (int winNdx = allAppWindows.size() - 1; winNdx >= 0; --winNdx) {
+            WindowState win = allAppWindows.get(winNdx);
+            if (WindowManagerService.DEBUG_WINDOW_MOVEMENT) Slog.w(WindowManagerService.TAG,
+                    "removeAllWindows: removing win=" + win);
+            win.mService.removeWindowLocked(win.mSession, win);
+        }
+    }
+
     @Override
     void dump(PrintWriter pw, String prefix) {
         super.dump(pw, prefix);
diff --git a/services/core/java/com/android/server/wm/TaskStack.java b/services/core/java/com/android/server/wm/TaskStack.java
index 72b403405bb85..6823577607ea4 100644
--- a/services/core/java/com/android/server/wm/TaskStack.java
+++ b/services/core/java/com/android/server/wm/TaskStack.java
@@ -155,7 +155,7 @@ public class TaskStack {
                 final ArrayList<WindowState> windows = activities.get(activityNdx).allAppWindows;
                 for (int winNdx = windows.size() - 1; winNdx >= 0; --winNdx) {
                     final WindowStateAnimator winAnimator = windows.get(winNdx).mWinAnimator;
-                    if (winAnimator.isAnimating() && !winAnimator.isDummyAnimation()) {
+                    if (winAnimator.isAnimating() || winAnimator.mWin.mExiting) {
                         return true;
                     }
                 }
diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java
index 751919bfe6a6f..2b57f50573875 100644
--- a/services/core/java/com/android/server/wm/WindowManagerService.java
+++ b/services/core/java/com/android/server/wm/WindowManagerService.java
@@ -3540,7 +3540,7 @@ public class WindowManagerService extends IWindowManager.Stub
                 return;
             }
             final Task oldTask = mTaskIdToTask.get(atoken.groupId);
-            removeAppFromTaskLocked(atoken);
+            oldTask.removeAppToken(atoken);
 
             atoken.groupId = groupId;
             Task newTask = mTaskIdToTask.get(groupId);
@@ -4562,6 +4562,8 @@ public class WindowManagerService extends IWindowManager.Stub
     }
 
     void removeAppFromTaskLocked(AppWindowToken wtoken) {
+        wtoken.removeAllWindows();
+
         final Task task = mTaskIdToTask.get(wtoken.groupId);
         if (task != null) {
             if (!task.removeAppToken(wtoken)) {