Fix un-dismissable incoming call for auto-rejected calls

When the device receives an incoming call indication and quickly
receives another call terminated indication (such as the auto
reject case), there is the possiblity that the call terminated indication
happens while onIncomingCall is still being processed. This is due to the
fact that binder oneway calls are only guaranteed to be on the same binder
thread for the same IBinder node. Since these callbacks are happening on
two separate nodes potentially, there are running in two binder threads
at the same time, causing race conditions.

Instead, the onIncomingCall binder call should not be oneway (as it is
required to complete before other indications should occur) and only
return control back to the ImsService thread once the
MmTelFeature#notifyIncomingCall call completes.

Bug: 160213239
Test: incoming call, auto-rejected incoming call on MSIM
Change-Id: I054e6b00656fc04f48f7f378076e29322daf59ad

1 files changed, 5 insertions, 2 deletions

diff --git a/telephony/java/android/telephony/ims/aidl/IImsMmTelListener.aidl b/telephony/java/android/telephony/ims/aidl/IImsMmTelListener.aidl
index 7bbe30a444b9..52464703c608 100644
--- a/telephony/java/android/telephony/ims/aidl/IImsMmTelListener.aidl
+++ b/telephony/java/android/telephony/ims/aidl/IImsMmTelListener.aidl
@@ -27,8 +27,11 @@ import com.android.ims.internal.IImsCallSession;
  * See MmTelFeature#Listener for more information.
  * {@hide}
  */
-oneway interface IImsMmTelListener {
+ // This interface is not considered oneway because we need to ensure that these operations are
+ // processed by telephony before the control flow returns to the ImsService to perform
+ // operations on the IImsCallSession.
+interface IImsMmTelListener {
     void onIncomingCall(IImsCallSession c, in Bundle extras);
     void onRejectedCall(in ImsCallProfile callProfile, in ImsReasonInfo reason);
-    void onVoiceMessageCountUpdate(int count);
+    oneway void onVoiceMessageCountUpdate(int count);
 }