Don't call remoteFillService.destroy() until session is removed.

Test: CtsAutoFillServiceTestCases pass

Fixes: 62200831
Bug: 62106708

Change-Id: I4e54e28a347e800c0b8353938399c860f213edfa

services/autofill/java/com/android/server/autofill/AutofillManagerServiceImpl.java

@@ -51,6 +51,7 @@ import android.service.autofill.FillEventHistory.Event;
 import android.service.autofill.FillResponse;
 import android.service.autofill.IAutoFillService;
 import android.text.TextUtils;
+import android.util.ArraySet;
 import android.util.LocalLog;
 import android.util.Slog;
 import android.util.SparseArray;
@@ -465,10 +466,17 @@ final class AutofillManagerServiceImpl {
         if (sVerbose) Slog.v(TAG, "destroyLocked()");
 
         final int numSessions = mSessions.size();
+        final ArraySet<RemoteFillService> remoteFillServices = new ArraySet<>(numSessions);
         for (int i = 0; i < numSessions; i++) {
-            mSessions.valueAt(i).destroyLocked();
+            final RemoteFillService remoteFillService = mSessions.valueAt(i).destroyLocked();
+            if (remoteFillService != null) {
+                remoteFillServices.add(remoteFillService);
+            }
         }
         mSessions.clear();
+        for (int i = 0; i < remoteFillServices.size(); i++) {
+            remoteFillServices.valueAt(i).destroy();
+        }
 
         sendStateToClients(true);
     }

services/autofill/java/com/android/server/autofill/Session.java

@@ -1496,15 +1496,15 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
         }
     }
 
-    void destroyLocked() {
+    RemoteFillService destroyLocked() {
         if (mDestroyed) {
-            return;
+            return null;
         }
-        mRemoteFillService.destroy();
         hideAllUiIfOwnedByMe();
         mUi.clearCallback(this);
         mDestroyed = true;
         mMetricsLogger.action(MetricsEvent.AUTOFILL_SESSION_FINISHED, mPackageName);
+        return mRemoteFillService;
     }
 
     private void hideAllUiIfOwnedByMe() {
@@ -1528,8 +1528,11 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
                     + id + " destroyed");
             return;
         }
-        destroyLocked();
+        final RemoteFillService remoteFillService = destroyLocked();
         mService.removeSessionLocked(id);
+        if (remoteFillService != null) {
+            remoteFillService.destroy();
+        }
     }
 
     private int getLastResponseIndex() {