From 8503a8de17611ebccec7922bf3755afebb016d2d Mon Sep 17 00:00:00 2001
From: Gaurav Bhola <gauravbhola@google.com>
Date: Mon, 23 Jan 2023 11:36:16 -0800
Subject: [PATCH] Add a null check for the WindowContainer for insets related
 ops.

- This is to prevent NPE because of race conditions where the window
  container might get destroyed while the hierarchyOp binder transaction
  is in progress.

Bug: 265446463
Test: atest WindowOrganizerTests
Change-Id: Id978adba59058f8526118a446639619d4ec7e145
---
 .../server/wm/WindowOrganizerController.java  | 25 ++++++++++++++-----
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/services/core/java/com/android/server/wm/WindowOrganizerController.java b/services/core/java/com/android/server/wm/WindowOrganizerController.java
index 5c68b127c45bb..ce50d735aad97 100644
--- a/services/core/java/com/android/server/wm/WindowOrganizerController.java
+++ b/services/core/java/com/android/server/wm/WindowOrganizerController.java
@@ -1013,17 +1013,30 @@ class WindowOrganizerController extends IWindowOrganizerController.Stub
                 taskDisplayArea.moveRootTaskBehindRootTask(thisTask.getRootTask(), restoreAt);
                 break;
             }
-            case HIERARCHY_OP_TYPE_ADD_RECT_INSETS_PROVIDER:
+            case HIERARCHY_OP_TYPE_ADD_RECT_INSETS_PROVIDER: {
                 final Rect insetsProviderWindowContainer = hop.getInsetsProviderFrame();
-                final WindowContainer receiverWindowContainer =
+                final WindowContainer container =
                         WindowContainer.fromBinder(hop.getContainer());
-                receiverWindowContainer.addLocalRectInsetsSourceProvider(
+                if (container == null) {
+                    Slog.e(TAG, "Attempt to add local insets source provider on unknown: "
+                                    + container);
+                    break;
+                }
+                container.addLocalRectInsetsSourceProvider(
                         insetsProviderWindowContainer, hop.getInsetsTypes());
                 break;
-            case HIERARCHY_OP_TYPE_REMOVE_INSETS_PROVIDER:
-                WindowContainer.fromBinder(hop.getContainer())
-                        .removeLocalInsetsSourceProvider(hop.getInsetsTypes());
+            }
+            case HIERARCHY_OP_TYPE_REMOVE_INSETS_PROVIDER: {
+                final WindowContainer container =
+                        WindowContainer.fromBinder(hop.getContainer());
+                if (container == null) {
+                    Slog.e(TAG, "Attempt to remove local insets source provider from unknown: "
+                                    + container);
+                    break;
+                }
+                container.removeLocalInsetsSourceProvider(hop.getInsetsTypes());
                 break;
+            }
             case HIERARCHY_OP_TYPE_SET_ALWAYS_ON_TOP: {
                 final WindowContainer container = WindowContainer.fromBinder(hop.getContainer());
                 if (container == null || container.asDisplayArea() == null