Fix race in removeDeadProvider.

Bug: 5202824

It's possible for removeDeadProvider to be called after the provider
has already been removed from the provider map due to a race between
binderDied and removing the provider.

Deleted removeDeadProviderLocked; it was dead code.

Change-Id: Iecdc68703225e7ac171746e63f1b3141c6f2ce4c

1 files changed, 1 insertions, 12 deletions

diff --git a/core/java/android/app/ActivityThread.java b/core/java/android/app/ActivityThread.java
index e3762206588d..6fb79656b683 100644
--- a/core/java/android/app/ActivityThread.java
+++ b/core/java/android/app/ActivityThread.java
@@ -4091,7 +4091,7 @@ public final class ActivityThread {
     final void removeDeadProvider(String name, IContentProvider provider) {
         synchronized(mProviderMap) {
             ProviderClientRecord pr = mProviderMap.get(name);
-            if (pr.mProvider.asBinder() == provider.asBinder()) {
+            if (pr != null && pr.mProvider.asBinder() == provider.asBinder()) {
                 Slog.i(TAG, "Removing dead content provider: " + name);
                 ProviderClientRecord removed = mProviderMap.remove(name);
                 if (removed != null) {
@@ -4101,17 +4101,6 @@ public final class ActivityThread {
         }
     }
 
-    final void removeDeadProviderLocked(String name, IContentProvider provider) {
-        ProviderClientRecord pr = mProviderMap.get(name);
-        if (pr.mProvider.asBinder() == provider.asBinder()) {
-            Slog.i(TAG, "Removing dead content provider: " + name);
-            ProviderClientRecord removed = mProviderMap.remove(name);
-            if (removed != null) {
-                removed.mProvider.asBinder().unlinkToDeath(removed, 0);
-            }
-        }
-    }
-
     private IContentProvider installProvider(Context context,
             IContentProvider provider, ProviderInfo info, boolean noisy) {
         ContentProvider localProvider = null;