From 10e6217a8de772395d9b74174eeb1280bfe821aa Mon Sep 17 00:00:00 2001
From: Feng Cao <fengcao@google.com>
Date: Sun, 7 Jun 2020 18:46:19 -0700
Subject: [PATCH] Fix NPE in InlineContentView

* The NPE is due to in the InlineContentView we try to reparent the
  surface view which is no longer attached to the window, this can
  happen if the InlineContentView is attached to window and then
  immediately detached from the window, before the surface package
  is returned from the remote view process.
* Release the surface package immediately in this case, so the
  remote view can be released.

Test: atest android.autofillservice.cts.inline
Bug: 158139090

Change-Id: I9efdf8ba182a1d66334362edcfb6ba58fcdc222a
---
 .../view/inputmethod/InlineSuggestion.java    | 22 ++++++++++++++++++-
 .../widget/inline/InlineContentView.java      |  4 +++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/core/java/android/view/inputmethod/InlineSuggestion.java b/core/java/android/view/inputmethod/InlineSuggestion.java
index e4ac5889a3c0d..b8893cee834d5 100644
--- a/core/java/android/view/inputmethod/InlineSuggestion.java
+++ b/core/java/android/view/inputmethod/InlineSuggestion.java
@@ -317,8 +317,24 @@ public final class InlineSuggestion implements Parcelable {
          */
         @MainThread
         private void handleOnSurfacePackage(SurfaceControlViewHost.SurfacePackage surfacePackage) {
+            if (surfacePackage == null) {
+                return;
+            }
+            if (mSurfacePackage != null || mSurfacePackageConsumer == null) {
+                // The surface package is not consumed, release it immediately.
+                surfacePackage.release();
+                try {
+                    mInlineContentProvider.onSurfacePackageReleased();
+                } catch (RemoteException e) {
+                    Slog.w(TAG, "Error calling onSurfacePackageReleased(): " + e);
+                }
+                return;
+            }
             mSurfacePackage = surfacePackage;
-            if (mSurfacePackage != null && mSurfacePackageConsumer != null) {
+            if (mSurfacePackage == null) {
+                return;
+            }
+            if (mSurfacePackageConsumer != null) {
                 mSurfacePackageConsumer.accept(mSurfacePackage);
                 mSurfacePackageConsumer = null;
             }
@@ -334,6 +350,10 @@ public final class InlineSuggestion implements Parcelable {
                 }
                 mSurfacePackage = null;
             }
+            // Clear the pending surface package consumer, if any. This can happen if the IME
+            // attaches the view to window and then quickly detaches it from the window, before
+            // the surface package requested upon attaching to window was returned.
+            mSurfacePackageConsumer = null;
         }
 
         @MainThread
diff --git a/core/java/android/widget/inline/InlineContentView.java b/core/java/android/widget/inline/InlineContentView.java
index 8657e828a3f61..6a85de5ca7576 100644
--- a/core/java/android/widget/inline/InlineContentView.java
+++ b/core/java/android/widget/inline/InlineContentView.java
@@ -197,7 +197,9 @@ public class InlineContentView extends ViewGroup {
             mSurfacePackageUpdater.getSurfacePackage(
                     sp -> {
                         if (DEBUG) Log.v(TAG, "Received new SurfacePackage");
-                        mSurfaceView.setChildSurfacePackage(sp);
+                        if (getViewRootImpl() != null) {
+                            mSurfaceView.setChildSurfacePackage(sp);
+                        }
                     });
         }
     }