From 05b6857f6b4b4ce7c0e4df38d38264bf42297d3b Mon Sep 17 00:00:00 2001
From: Koji Fukui <koji.fukui@sony.com>
Date: Fri, 20 Oct 2017 16:42:51 +0900
Subject: [PATCH] Stop observing death of PrintManager listener when it is
 removed

Symptom:
Global reference table overflow happens on system_server.

Root cause:
When a listener is added to the PrintManager, death notification for
the listener is registered. So the listener is added to global
reference table.
But the death notification is not unregistered when the listener is
removed from PrintManager. The listener isn't removed from the global
reference table until client process die. If client process repeatedly
add/remove listener, the global reference table overflow.

Solution:
Call unlinkToDeath() when the listener is removed from PrintManager.

Test: cts-tradefed run cts-dev -m Print
Bug: 68746445
Change-Id: I0b133e4607317a15e51bdf6e1248552dcc920d6d
---
 .../java/com/android/server/print/UserState.java      | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/services/print/java/com/android/server/print/UserState.java b/services/print/java/com/android/server/print/UserState.java
index 5770c5079d942..fcc6f525ef14f 100644
--- a/services/print/java/com/android/server/print/UserState.java
+++ b/services/print/java/com/android/server/print/UserState.java
@@ -586,6 +586,7 @@ final class UserState implements PrintSpoolerCallbacks, PrintServiceCallbacks,
                 PrintJobStateChangeListenerRecord record =
                         mPrintJobStateChangeListenerRecords.get(i);
                 if (record.listener.asBinder().equals(listener.asBinder())) {
+                    record.destroy();
                     mPrintJobStateChangeListenerRecords.remove(i);
                     break;
                 }
@@ -628,6 +629,7 @@ final class UserState implements PrintSpoolerCallbacks, PrintServiceCallbacks,
                 ListenerRecord<IPrintServicesChangeListener> record =
                         mPrintServicesChangeListenerRecords.get(i);
                 if (record.listener.asBinder().equals(listener.asBinder())) {
+                    record.destroy();
                     mPrintServicesChangeListenerRecords.remove(i);
                     break;
                 }
@@ -675,6 +677,7 @@ final class UserState implements PrintSpoolerCallbacks, PrintServiceCallbacks,
                 ListenerRecord<IRecommendationsChangeListener> record =
                         mPrintServiceRecommendationsChangeListenerRecords.get(i);
                 if (record.listener.asBinder().equals(listener.asBinder())) {
+                    record.destroy();
                     mPrintServiceRecommendationsChangeListenerRecords.remove(i);
                     break;
                 }
@@ -1222,6 +1225,10 @@ final class UserState implements PrintSpoolerCallbacks, PrintServiceCallbacks,
             listener.asBinder().linkToDeath(this, 0);
         }
 
+        public void destroy() {
+            listener.asBinder().unlinkToDeath(this, 0);
+        }
+
         @Override
         public void binderDied() {
             listener.asBinder().unlinkToDeath(this, 0);
@@ -1239,6 +1246,10 @@ final class UserState implements PrintSpoolerCallbacks, PrintServiceCallbacks,
             listener.asBinder().linkToDeath(this, 0);
         }
 
+        public void destroy() {
+            listener.asBinder().unlinkToDeath(this, 0);
+        }
+
         @Override
         public void binderDied() {
             listener.asBinder().unlinkToDeath(this, 0);