From 7ac52d5bf6652883e204ba322069f6960f58f611 Mon Sep 17 00:00:00 2001
From: Matthew Williams <mjwilliams@google.com>
Date: Fri, 12 Sep 2014 14:40:18 -0700
Subject: Fix NPE in JobServiceContext

BUG: 17485390
The VERB_BINDING timeout that is set to wait for onBind() to complete
wasn't being cleared when onBind() returns false, i.e. that the service wasn't
available to be bound to.
This led to an NPE when the stale timeout expired. Fix is to clear the timeout
when onBind fails.

Change-Id: I318ca5ce1f3e12b170f7f256608ea7e28f3f120a
---
 .../java/com/android/server/job/JobServiceContext.java   | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

(limited to 'services')

diff --git a/services/core/java/com/android/server/job/JobServiceContext.java b/services/core/java/com/android/server/job/JobServiceContext.java
index d0447bc..9df21a2 100644
--- a/services/core/java/com/android/server/job/JobServiceContext.java
+++ b/services/core/java/com/android/server/job/JobServiceContext.java
@@ -170,6 +170,7 @@ public class JobServiceContext extends IJobCallback.Stub implements ServiceConne
                 mRunningJob = null;
                 mParams = null;
                 mExecutionStartTimeElapsed = 0L;
+                removeOpTimeOut();
                 return false;
             }
             try {
@@ -299,7 +300,7 @@ public class JobServiceContext extends IJobCallback.Stub implements ServiceConne
         public void handleMessage(Message message) {
             switch (message.what) {
                 case MSG_SERVICE_BOUND:
-                    removeMessages(MSG_TIMEOUT);
+                    removeOpTimeOut();
                     handleServiceBoundH();
                     break;
                 case MSG_CALLBACK:
@@ -307,7 +308,7 @@ public class JobServiceContext extends IJobCallback.Stub implements ServiceConne
                         Slog.d(TAG, "MSG_CALLBACK of : " + mRunningJob + " v:" +
                                 (mVerb >= 0 ? VERB_STRINGS[mVerb] : "[invalid]"));
                     }
-                    removeMessages(MSG_TIMEOUT);
+                    removeOpTimeOut();
 
                     if (mVerb == VERB_STARTING) {
                         final boolean workOngoing = message.arg2 == 1;
@@ -498,7 +499,7 @@ public class JobServiceContext extends IJobCallback.Stub implements ServiceConne
          * VERB_STOPPING.
          */
         private void sendStopMessageH() {
-            mCallbackHandler.removeMessages(MSG_TIMEOUT);
+            removeOpTimeOut();
             if (mVerb != VERB_EXECUTING) {
                 Slog.e(TAG, "Sending onStopJob for a job that isn't started. " + mRunningJob);
                 closeAndCleanupJobH(false /* reschedule */);
@@ -540,7 +541,7 @@ public class JobServiceContext extends IJobCallback.Stub implements ServiceConne
                 service = null;
                 mAvailable = true;
             }
-            removeMessages(MSG_TIMEOUT);
+            removeOpTimeOut();
             removeMessages(MSG_CALLBACK);
             removeMessages(MSG_SERVICE_BOUND);
             removeMessages(MSG_CANCEL);
@@ -555,7 +556,7 @@ public class JobServiceContext extends IJobCallback.Stub implements ServiceConne
      * on with life.
      */
     private void scheduleOpTimeOut() {
-        mCallbackHandler.removeMessages(MSG_TIMEOUT);
+        removeOpTimeOut();
 
         final long timeoutMillis = (mVerb == VERB_EXECUTING) ?
                 EXECUTING_TIMESLICE_MILLIS : OP_TIMEOUT_MILLIS;
@@ -568,4 +569,9 @@ public class JobServiceContext extends IJobCallback.Stub implements ServiceConne
         mCallbackHandler.sendMessageDelayed(m, timeoutMillis);
         mTimeoutElapsed = SystemClock.elapsedRealtime() + timeoutMillis;
     }
+
+
+    private void removeOpTimeOut() {
+        mCallbackHandler.removeMessages(MSG_TIMEOUT);
+    }
 }
-- 
cgit v1.1