From ced251f389b156031e5228d76ac8ecb77d787684 Mon Sep 17 00:00:00 2001
From: Tiger Huang <tigerhuang@google.com>
Date: Mon, 16 Dec 2019 21:42:11 +0800
Subject: [PATCH] Call InputEventReceiver.dispose from the right thread

TaskPositioner attaches the InputEventReceiver to the animation thread.
This CL makes it to dispose the receiver in the same thread to avoid
race conditions.

This CL also makes InputEventReceiver.finalize call dispose from the
right thread.

Bug: 122054478
Fix: 122096091
Test: 1. Make a task enter free-form mode.
      2. Drag and drop the task.
      3. Check if InputEventReceiver.dispose and finishInputEvent are
         executed in the same thread.

Change-Id: I2f8831e7fccca4f96562f2abe4962811339d02e9
---
 core/java/android/view/InputEventReceiver.java                | 3 +++
 .../java/com/android/server/wm/TaskPositioningController.java | 4 +++-
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/core/java/android/view/InputEventReceiver.java b/core/java/android/view/InputEventReceiver.java
index 5674de8c1925c..c67ff6ea0111c 100644
--- a/core/java/android/view/InputEventReceiver.java
+++ b/core/java/android/view/InputEventReceiver.java
@@ -25,6 +25,7 @@ import android.util.SparseIntArray;
 
 import dalvik.system.CloseGuard;
 
+import java.lang.ref.Reference;
 import java.lang.ref.WeakReference;
 
 /**
@@ -86,6 +87,7 @@ public abstract class InputEventReceiver {
 
     /**
      * Disposes the receiver.
+     * Must be called on the same Looper thread to which the receiver is attached.
      */
     public void dispose() {
         dispose(false);
@@ -109,6 +111,7 @@ public abstract class InputEventReceiver {
             mInputChannel = null;
         }
         mMessageQueue = null;
+        Reference.reachabilityFence(this);
     }
 
     /**
diff --git a/services/core/java/com/android/server/wm/TaskPositioningController.java b/services/core/java/com/android/server/wm/TaskPositioningController.java
index c38e63e54239e..2d303faa79216 100644
--- a/services/core/java/com/android/server/wm/TaskPositioningController.java
+++ b/services/core/java/com/android/server/wm/TaskPositioningController.java
@@ -198,7 +198,9 @@ class TaskPositioningController {
     }
 
     void finishTaskPositioning() {
-        mHandler.post(() -> {
+        // TaskPositioner attaches the InputEventReceiver to the animation thread. We need to
+        // dispose the receiver on the same thread to avoid race conditions.
+        mService.mAnimationHandler.post(() -> {
             if (DEBUG_TASK_POSITIONING) Slog.d(TAG_WM, "finishPositioning");
 
             synchronized (mService.mGlobalLock) {