DO NOT MERGE Fix race condition between binder deaths

If a Binder dies there is a race between activity manager and window
manager to see who can handle the binderDied call first. If the
activity manager wins the race it will remove the activity and task
but leave the windows around. Until the WindowState.binderDied call
is made and all animation is complete the windows will try to access
the task that they were associated with.

This fix removes the windows of an activity when the activity is
removed. It also defers removal of the activity and task until
exiting windows have completed their animation.

Fixes bug 17031518.

Change-Id: Idf52f55c5feb0cad4e3664ef2eae5b7e95bbf490
(cherry picked from commit 5acd163b828d5b26408eb3a7904d750a1570239e)

3 files changed, 13 insertions, 2 deletions

diff --git a/services/core/java/com/android/server/wm/AppWindowToken.java b/services/core/java/com/android/server/wm/AppWindowToken.java
index ca4ad8a..4fe37e8 100644
--- a/services/core/java/com/android/server/wm/AppWindowToken.java
+++ b/services/core/java/com/android/server/wm/AppWindowToken.java
@@ -245,6 +245,15 @@ class AppWindowToken extends WindowToken {
         return false;
     }
 
+    void removeAllWindows() {
+        for (int winNdx = allAppWindows.size() - 1; winNdx >= 0; --winNdx) {
+            WindowState win = allAppWindows.get(winNdx);
+            if (WindowManagerService.DEBUG_WINDOW_MOVEMENT) Slog.w(WindowManagerService.TAG,
+                    "removeAllWindows: removing win=" + win);
+            win.mService.removeWindowLocked(win.mSession, win);
+        }
+    }
+
     @Override
     void dump(PrintWriter pw, String prefix) {
         super.dump(pw, prefix);
diff --git a/services/core/java/com/android/server/wm/TaskStack.java b/services/core/java/com/android/server/wm/TaskStack.java
index 72b4034..6823577 100644
--- a/services/core/java/com/android/server/wm/TaskStack.java
+++ b/services/core/java/com/android/server/wm/TaskStack.java
@@ -155,7 +155,7 @@ public class TaskStack {
                 final ArrayList<WindowState> windows = activities.get(activityNdx).allAppWindows;
                 for (int winNdx = windows.size() - 1; winNdx >= 0; --winNdx) {
                     final WindowStateAnimator winAnimator = windows.get(winNdx).mWinAnimator;
-                    if (winAnimator.isAnimating() && !winAnimator.isDummyAnimation()) {
+                    if (winAnimator.isAnimating() || winAnimator.mWin.mExiting) {
                         return true;
                     }
                 }
diff --git a/services/core/java/com/android/server/wm/WindowManagerService.java b/services/core/java/com/android/server/wm/WindowManagerService.java
index 751919b..2b57f50 100644
--- a/services/core/java/com/android/server/wm/WindowManagerService.java
+++ b/services/core/java/com/android/server/wm/WindowManagerService.java
@@ -3540,7 +3540,7 @@ public class WindowManagerService extends IWindowManager.Stub
                 return;
             }
             final Task oldTask = mTaskIdToTask.get(atoken.groupId);
-            removeAppFromTaskLocked(atoken);
+            oldTask.removeAppToken(atoken);
 
             atoken.groupId = groupId;
             Task newTask = mTaskIdToTask.get(groupId);
@@ -4562,6 +4562,8 @@ public class WindowManagerService extends IWindowManager.Stub
     }
 
     void removeAppFromTaskLocked(AppWindowToken wtoken) {
+        wtoken.removeAllWindows();
+
         final Task task = mTaskIdToTask.get(wtoken.groupId);
         if (task != null) {
             if (!task.removeAppToken(wtoken)) {