From c17200a23a9c60d185f1c6b60da9acbc49675324 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cosmin=20B=C4=83ie=C8=99?= <cosminbaies@google.com>
Date: Wed, 17 May 2023 17:01:59 +0200
Subject: [PATCH] Fix race condition in dumpDebug

The dumpDebug method was calling isImeSessionAvailableLocked to ensure
that mCurBindState was not null, but this was happening before
acquiring the lock. When acquiring the lock and reading the value, this
was now null due to an intermediary unbind operation which already had
the lock.

Test: none
Bug: 282815830
Change-Id: I0fddfb12c14eda109cc985eedadc9d3237dff8b0
---
 .../view/inputmethod/InputMethodManager.java        | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/core/java/android/view/inputmethod/InputMethodManager.java b/core/java/android/view/inputmethod/InputMethodManager.java
index 41ef44e1ac1f6..40b060ad0bbfb 100644
--- a/core/java/android/view/inputmethod/InputMethodManager.java
+++ b/core/java/android/view/inputmethod/InputMethodManager.java
@@ -4361,15 +4361,14 @@ public final class InputMethodManager {
      * @param icProto {@link InputConnection} call data in proto format.
      * @hide
      */
-    @GuardedBy("mH")
     public void dumpDebug(ProtoOutputStream proto, @Nullable byte[] icProto) {
-        if (!isImeSessionAvailableLocked()) {
-            return;
-        }
-
-        proto.write(DISPLAY_ID, mDisplayId);
-        final long token = proto.start(INPUT_METHOD_MANAGER);
         synchronized (mH) {
+            if (!isImeSessionAvailableLocked()) {
+                return;
+            }
+
+            proto.write(DISPLAY_ID, mDisplayId);
+            final long token = proto.start(INPUT_METHOD_MANAGER);
             proto.write(CUR_ID, mCurBindState.mImeId);
             proto.write(FULLSCREEN_MODE, mFullscreenMode);
             proto.write(ACTIVE, mActive);