Fix: Double-free error on RemoteFillService

Symptom:
RemoteFillService was crashed due to IllegalArgumentException
"Service not registered:" at onServiceConnected.

Root cause:
RemoteFillService#onServiceConnected tries to unbind the connection
if mDestroyed is flagged or mBinding is not flagged. It always fails
with IllegalArgumentException.
Both mDestroyed and !mBinding mean the connection was unbound.
You can't unbind the unbound connection. It's not allowed.

Fixes: 73864601
Fixes: 69905688

Change-Id: If5481468ddac7be41accad63e9d5382bc6c029fd

1 files changed, 2 insertions, 1 deletions

diff --git a/services/autofill/java/com/android/server/autofill/RemoteFillService.java b/services/autofill/java/com/android/server/autofill/RemoteFillService.java
index af55807ff1f0..93df50747723 100644
--- a/services/autofill/java/com/android/server/autofill/RemoteFillService.java
+++ b/services/autofill/java/com/android/server/autofill/RemoteFillService.java
@@ -342,7 +342,8 @@ final class RemoteFillService implements DeathRecipient {
         @Override
         public void onServiceConnected(ComponentName name, IBinder service) {
             if (mDestroyed || !mBinding) {
-                mContext.unbindService(mServiceConnection);
+                // This is abnormal. Unbinding the connection has been requested already.
+                Slog.wtf(LOG_TAG, "onServiceConnected was dispatched after unbindService.");
                 return;
             }
             mBinding = false;