Guard onPictureInPictureUiStateChanged with WM lock

The AIDL override needs to be guarded with WM lock before calling into
WMS.

Fix: 326578999
Test: pass existing
Change-Id: I8354d6ef6568e366e8a739401d0cc9acdca35699

1 files changed, 15 insertions, 13 deletions

diff --git a/services/core/java/com/android/server/wm/ActivityTaskManagerService.java b/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
index 218b7512b861..e283f3e8ef0e 100644
--- a/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
+++ b/services/core/java/com/android/server/wm/ActivityTaskManagerService.java
@@ -4163,19 +4163,21 @@ public class ActivityTaskManagerService extends IActivityTaskManager.Stub {
     @Override
     public void onPictureInPictureUiStateChanged(PictureInPictureUiState pipState) {
         enforceTaskPermission("onPictureInPictureUiStateChanged");
-        // The PictureInPictureUiState is sent to current pip task if there is any
-        // -or- the top standard task (state like entering PiP does not require a pinned task).
-        final Task task;
-        if (mRootWindowContainer.getDefaultTaskDisplayArea().hasPinnedTask()) {
-            task = mRootWindowContainer.getDefaultTaskDisplayArea().getRootPinnedTask();
-        } else {
-            task = mRootWindowContainer.getDefaultTaskDisplayArea().getRootTask(
-                    t -> t.isActivityTypeStandard());
-        }
-        if (task != null && task.getTopMostActivity() != null
-                && !task.getTopMostActivity().isState(FINISHING, DESTROYING, DESTROYED)) {
-            mWindowManager.mAtmService.mActivityClientController.onPictureInPictureUiStateChanged(
-                    task.getTopMostActivity(), pipState);
+        synchronized (mGlobalLock) {
+            // The PictureInPictureUiState is sent to current pip task if there is any
+            // -or- the top standard task (state like entering PiP does not require a pinned task).
+            final Task task;
+            if (mRootWindowContainer.getDefaultTaskDisplayArea().hasPinnedTask()) {
+                task = mRootWindowContainer.getDefaultTaskDisplayArea().getRootPinnedTask();
+            } else {
+                task = mRootWindowContainer.getDefaultTaskDisplayArea().getRootTask(
+                        t -> t.isActivityTypeStandard());
+            }
+            if (task != null && task.getTopMostActivity() != null
+                    && !task.getTopMostActivity().isState(FINISHING, DESTROYING, DESTROYED)) {
+                mWindowManager.mAtmService.mActivityClientController
+                        .onPictureInPictureUiStateChanged(task.getTopMostActivity(), pipState);
+            }
         }
     }