TIF: fix callback cleanup logic in removeSessionStateLocked().

Adding DeathRecipient to callback instance is enough. removeSessionStateLocked()
can be called in normal session release case, and the current logic will remove
valid callback instances.
Also, ConcurrentModificationException in abortPendingCreateSessionRequestsLocked()
is fixed.

Bug: 17212681
Change-Id: I42cacfa33086bf9182b061553ff52c0e25d94d9b

1 files changed, 7 insertions, 7 deletions

diff --git a/services/core/java/com/android/server/tv/TvInputManagerService.java b/services/core/java/com/android/server/tv/TvInputManagerService.java
index 27023ad..fe35f95 100644
--- a/services/core/java/com/android/server/tv/TvInputManagerService.java
+++ b/services/core/java/com/android/server/tv/TvInputManagerService.java
@@ -467,15 +467,19 @@ public final class TvInputManagerService extends SystemService {
             String inputId, int userId) {
         // Let clients know the create session requests are failed.
         UserState userState = getUserStateLocked(userId);
+        List<SessionState> sessionsToAbort = new ArrayList<>();
         for (IBinder sessionToken : serviceState.mSessionTokens) {
             SessionState sessionState = userState.sessionStateMap.get(sessionToken);
             if (sessionState.mSession == null && (inputId == null
                     || sessionState.mInfo.getId().equals(inputId))) {
-                removeSessionStateLocked(sessionToken, sessionState.mUserId);
-                sendSessionTokenToClientLocked(sessionState.mClient,
-                        sessionState.mInfo.getId(), null, null, sessionState.mSeq);
+                sessionsToAbort.add(sessionState);
             }
         }
+        for (SessionState sessionState : sessionsToAbort) {
+            removeSessionStateLocked(sessionState.mSessionToken, sessionState.mUserId);
+            sendSessionTokenToClientLocked(sessionState.mClient,
+                    sessionState.mInfo.getId(), null, null, sessionState.mSeq);
+        }
         updateServiceConnectionLocked(serviceState.mComponent, userId);
     }
 
@@ -759,10 +763,6 @@ public final class TvInputManagerService extends SystemService {
             clientState.mSessionTokens.remove(sessionToken);
             if (clientState.isEmpty()) {
                 userState.clientStateMap.remove(sessionState.mClient.asBinder());
-                if (userState.clientStateMap.isEmpty()) {
-                    // No longer need to keep the callbacks since there is no client.
-                    userState.callbackSet.clear();
-                }
             }
         }