Add null check for RemoteToken#getContainer()

RemoteToken is using WeakReference, which can be null after all strong
references are gone.

Fix: 172337708
Test: atest WmTests:WindowOrganizerTests
Change-Id: I629f1900f93c702ec4e32492d7fc23a6a157cf96

3 files changed, 39 insertions, 7 deletions

diff --git a/services/core/java/com/android/server/wm/TaskOrganizerController.java b/services/core/java/com/android/server/wm/TaskOrganizerController.java
index a1c5670ec9af..f5caaba7fdf5 100644
--- a/services/core/java/com/android/server/wm/TaskOrganizerController.java
+++ b/services/core/java/com/android/server/wm/TaskOrganizerController.java
@@ -442,7 +442,11 @@ class TaskOrganizerController extends ITaskOrganizerController.Stub {
         final long origId = Binder.clearCallingIdentity();
         try {
             synchronized (mGlobalLock) {
-                final Task task = WindowContainer.fromBinder(token.asBinder()).asTask();
+                final WindowContainer wc = WindowContainer.fromBinder(token.asBinder());
+                if (wc == null) {
+                    throw new IllegalArgumentException("Can't resolve window from token");
+                }
+                final Task task = wc.asTask();
                 if (task == null) return false;
                 if (!task.mCreatedByOrganizer) {
                     throw new IllegalArgumentException(
@@ -564,8 +568,14 @@ class TaskOrganizerController extends ITaskOrganizerController.Stub {
                 if (defaultTaskDisplayArea == null) {
                     return;
                 }
-                Task task = token == null
-                        ? null : WindowContainer.fromBinder(token.asBinder()).asTask();
+                WindowContainer wc = null;
+                if (token != null) {
+                    wc = WindowContainer.fromBinder(token.asBinder());
+                    if (wc == null) {
+                        throw new IllegalArgumentException("Can't resolve window from token");
+                    }
+                }
+                final Task task = wc == null ? null : wc.asTask();
                 if (task == null) {
                     defaultTaskDisplayArea.mLaunchRootTask = null;
                     return;
@@ -666,7 +676,12 @@ class TaskOrganizerController extends ITaskOrganizerController.Stub {
             synchronized (mGlobalLock) {
                 ProtoLog.v(WM_DEBUG_WINDOW_ORGANIZER, "Set intercept back pressed on root=%b",
                         interceptBackPressed);
-                final Task task = WindowContainer.fromBinder(token.asBinder()).asTask();
+                final WindowContainer wc = WindowContainer.fromBinder(token.asBinder());
+                if (wc == null) {
+                    Slog.w(TAG, "Could not resolve window from token");
+                    return;
+                }
+                final Task task = wc.asTask();
                 if (task == null) {
                     Slog.w(TAG, "Could not resolve task from token");
                     return;
diff --git a/services/core/java/com/android/server/wm/WindowContainer.java b/services/core/java/com/android/server/wm/WindowContainer.java
index 0f6b62bae55f..e4b3542f81a9 100644
--- a/services/core/java/com/android/server/wm/WindowContainer.java
+++ b/services/core/java/com/android/server/wm/WindowContainer.java
@@ -2878,6 +2878,7 @@ class WindowContainer<E extends WindowContainer> extends ConfigurationContainer<
         return true;
     }
 
+    @Nullable
     static WindowContainer fromBinder(IBinder binder) {
         return RemoteToken.fromBinder(binder).getContainer();
     }
@@ -2891,6 +2892,7 @@ class WindowContainer<E extends WindowContainer> extends ConfigurationContainer<
             mWeakRef = new WeakReference<>(container);
         }
 
+        @Nullable
         WindowContainer getContainer() {
             return mWeakRef.get();
         }
diff --git a/services/core/java/com/android/server/wm/WindowOrganizerController.java b/services/core/java/com/android/server/wm/WindowOrganizerController.java
index 7d54ea95579e..f11cd933616b 100644
--- a/services/core/java/com/android/server/wm/WindowOrganizerController.java
+++ b/services/core/java/com/android/server/wm/WindowOrganizerController.java
@@ -249,7 +249,7 @@ class WindowOrganizerController extends IWindowOrganizerController.Stub
             for (int i = 0, n = hops.size(); i < n; ++i) {
                 final WindowContainerTransaction.HierarchyOp hop = hops.get(i);
                 final WindowContainer wc = WindowContainer.fromBinder(hop.getContainer());
-                if (!wc.isAttached()) {
+                if (wc == null || !wc.isAttached()) {
                     Slog.e(TAG, "Attempt to operate on detached container: " + wc);
                     continue;
                 }
@@ -260,7 +260,13 @@ class WindowOrganizerController extends IWindowOrganizerController.Stub
                 if (transition != null) {
                     transition.collect(wc);
                     if (hop.isReparent() && hop.getNewParent() != null) {
-                        transition.collect(WindowContainer.fromBinder(hop.getNewParent()));
+                        final WindowContainer parentWc =
+                                WindowContainer.fromBinder(hop.getNewParent());
+                        if (parentWc == null) {
+                            Slog.e(TAG, "Can't resolve parent window from token");
+                            continue;
+                        }
+                        transition.collect(parentWc);
                     }
                 }
             }
@@ -269,7 +275,12 @@ class WindowOrganizerController extends IWindowOrganizerController.Stub
             entries = t.getChanges().entrySet().iterator();
             while (entries.hasNext()) {
                 final Map.Entry<IBinder, WindowContainerTransaction.Change> entry = entries.next();
-                final Task task = WindowContainer.fromBinder(entry.getKey()).asTask();
+                final WindowContainer wc = WindowContainer.fromBinder(entry.getKey());
+                if (wc == null || !wc.isAttached()) {
+                    Slog.e(TAG, "Attempt to operate on detached container: " + wc);
+                    continue;
+                }
+                final Task task = wc.asTask();
                 final Rect surfaceBounds = entry.getValue().getBoundsChangeSurfaceBounds();
                 if (task == null || !task.isAttached() || surfaceBounds == null) {
                     continue;
@@ -429,6 +440,10 @@ class WindowOrganizerController extends IWindowOrganizerController.Stub
                 WindowContainer newParent = hop.getNewParent() == null
                         ? dc.getDefaultTaskDisplayArea()
                         : WindowContainer.fromBinder(hop.getNewParent());
+                if (newParent == null) {
+                    Slog.e(TAG, "Can't resolve parent window from token");
+                    return 0;
+                }
                 if (task.getParent() != newParent) {
                     if (newParent instanceof TaskDisplayArea) {
                         // For now, reparenting to displayarea is different from other reparents...