From 38641831460c80f554dc926e486a67e9b9449b11 Mon Sep 17 00:00:00 2001
From: Fyodor Kupolov <fkupolov@google.com>
Date: Tue, 28 Jun 2016 17:37:09 -0700
Subject: [PATCH] Fixed race condition by using a separate counter

Otherwise a broadcast item replies before the loop completes causing
curWaitingUserSwitchCallbacks to be erroneously empty triggering a
premature call to sendContinueUserSwitchLocked.

Bug: 29039588
Change-Id: I48f48ef68c178166d3473b898346f516905ee70c
---
 services/core/java/com/android/server/am/UserController.java | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/am/UserController.java b/services/core/java/com/android/server/am/UserController.java
index 6b44f14883e52..d25f2cb76d74b 100644
--- a/services/core/java/com/android/server/am/UserController.java
+++ b/services/core/java/com/android/server/am/UserController.java
@@ -99,6 +99,7 @@ import java.util.HashSet;
 import java.util.List;
 import java.util.Objects;
 import java.util.Set;
+import java.util.concurrent.atomic.AtomicInteger;
 
 /**
  * Helper class for {@link ActivityManagerService} responsible for multi-user functionality.
@@ -1057,6 +1058,7 @@ final class UserController {
                 uss.switching = true;
                 mCurWaitingUserSwitchCallbacks = curWaitingUserSwitchCallbacks;
             }
+            final AtomicInteger waitingCallbacksCount = new AtomicInteger(observerCount);
             for (int i = 0; i < observerCount; i++) {
                 try {
                     // Prepend with unique prefix to guarantee that keys are unique
@@ -1075,7 +1077,7 @@ final class UserController {
                                 }
                                 curWaitingUserSwitchCallbacks.remove(name);
                                 // Continue switching if all callbacks have been notified
-                                if (curWaitingUserSwitchCallbacks.isEmpty()) {
+                                if (waitingCallbacksCount.decrementAndGet() == 0) {
                                     sendContinueUserSwitchLocked(uss, oldUserId, newUserId);
                                 }
                             }