Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix crash when user changes after a11yservice dies

Browse Source 
We were failing to create a death link for the service that
replaces the crashed a11y service. Adding an invariant that
mService is always linked to death if it is non-null.

Bug: 31044551
Change-Id: I98b6a3969cfacb0309e19938899a51c809249d6b
This commit is contained in:
Phil Weaver
2016-08-24 17:04:59 -07:00
parent f50ff35cea
commit e797b84ed2
1 changed files with 21 additions and 16 deletions
Download Patch File Download Diff File Expand all files Collapse all files

37
services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
View File

@@ -2224,6 +2224,8 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
AccessibilityServiceInfo mAccessibilityServiceInfo;
// The service that's bound to this instance. Whenever this value is non-null, this
// object is registered as a death recipient
IBinder mService;
IAccessibilityServiceClient mServiceInterface;
@@ -2358,14 +2360,14 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
}
} else {
userState.mBindingServices.add(mComponentName);
mService = userState.mUiAutomationServiceClient.asBinder();
mMainHandler.post(new Runnable() {
@Override
public void run() {
// Simulate asynchronous connection since in onServiceConnected
// we may modify the state data in case of an error but bind is
// called while iterating over the data and bad things can happen.
onServiceConnected(mComponentName, mService);
onServiceConnected(mComponentName,
userState.mUiAutomationServiceClient.asBinder());
}
});
userState.mUiAutomationService = this;
@@ -2457,7 +2459,19 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
@Override
public void onServiceConnected(ComponentName componentName, IBinder service) {
synchronized (mLock) {
mService = service;
if (mService != service) {
if (mService != null) {
mService.unlinkToDeath(this, 0);
}
mService = service;
try {
mService.linkToDeath(this, 0);
} catch (RemoteException re) {
Slog.e(LOG_TAG, "Failed registering death link");
binderDied();
return;
}
}
mServiceInterface = IAccessibilityServiceClient.Stub.asInterface(service);
UserState userState = getUserStateLocked(mUserId);
addServiceLocked(this, userState);
@@ -3091,7 +3105,6 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
}
public void onAdded() throws RemoteException {
linkToOwnDeathLocked();
final long identity = Binder.clearCallingIdentity();
try {
mWindowManagerService.addWindowToken(mOverlayWindowToken,
@@ -3108,17 +3121,6 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
} finally {
Binder.restoreCallingIdentity(identity);
}
unlinkToOwnDeathLocked();
}
public void linkToOwnDeathLocked() throws RemoteException {
mService.linkToDeath(this, 0);
}
public void unlinkToOwnDeathLocked() {
if (mService != null) {
mService.unlinkToDeath(this, 0);
}
}
public void resetLocked() {
@@ -3131,7 +3133,10 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
} catch (RemoteException re) {
/* ignore */
}
mService = null;
if (mService != null) {
mService.unlinkToDeath(this, 0);
mService = null;
}
mServiceInterface = null;
}