From d493c2f9eb06fe4ea539bf1b8f4da35e62eefffd Mon Sep 17 00:00:00 2001
From: Feng Cao <fengcao@google.com>
Date: Wed, 18 Mar 2020 09:38:43 -0700
Subject: Fix potential NPE in autofill Session

Test: atest android.widget.cts.CompoundButtonTest#testPerformClick
Test: atest CtsAutoFillServiceTestCases
Fix: 151814848

Change-Id: I22f70ff47b47b92d6093698719022febf7b076d3
---
 .../java/com/android/server/autofill/Session.java  | 25 ++++++++++++++++------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/services/autofill/java/com/android/server/autofill/Session.java b/services/autofill/java/com/android/server/autofill/Session.java
index de3111867ab8..9af7cbe5bffe 100644
--- a/services/autofill/java/com/android/server/autofill/Session.java
+++ b/services/autofill/java/com/android/server/autofill/Session.java
@@ -311,6 +311,10 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
      */
     private final AssistDataReceiverImpl mAssistReceiver = new AssistDataReceiverImpl();
 
+    /**
+     * TODO(b/151867668): improve how asynchronous data dependencies are handled, without using
+     * CountDownLatch.
+     */
     private final class AssistDataReceiverImpl extends IAssistDataReceiver.Stub {
 
         @GuardedBy("mLock")
@@ -318,7 +322,7 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
         @GuardedBy("mLock")
         private FillRequest mPendingFillRequest;
         @GuardedBy("mLock")
-        private CountDownLatch mCountDownLatch;
+        private CountDownLatch mCountDownLatch = new CountDownLatch(0);
 
         @Nullable Consumer<InlineSuggestionsRequest> newAutofillRequestLocked(
                 boolean isInlineRequest) {
@@ -327,6 +331,9 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
             mPendingInlineSuggestionsRequest = null;
             return isInlineRequest ? (inlineSuggestionsRequest) -> {
                 synchronized (mLock) {
+                    if (mCountDownLatch.getCount() == 0) {
+                        return;
+                    }
                     mPendingInlineSuggestionsRequest = inlineSuggestionsRequest;
                     mCountDownLatch.countDown();
                     maybeRequestFillLocked();
@@ -335,8 +342,7 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
         }
 
         void maybeRequestFillLocked() {
-            if (mCountDownLatch == null || mCountDownLatch.getCount() > 0
-                    || mPendingFillRequest == null) {
+            if (mCountDownLatch.getCount() > 0 || mPendingFillRequest == null) {
                 return;
             }
             if (mPendingInlineSuggestionsRequest != null) {
@@ -347,7 +353,6 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
             mRemoteFillService.onFillRequest(mPendingFillRequest);
             mPendingInlineSuggestionsRequest = null;
             mPendingFillRequest = null;
-            mCountDownLatch = null;
         }
 
         @Override
@@ -447,9 +452,15 @@ final class Session implements RemoteFillService.FillServiceCallbacks, ViewState
                 request = new FillRequest(requestId, contexts, mClientState, flags,
                         /*inlineSuggestionsRequest=*/null);
 
-                mPendingFillRequest = request;
-                mCountDownLatch.countDown();
-                maybeRequestFillLocked();
+                if (mCountDownLatch.getCount() > 0) {
+                    mPendingFillRequest = request;
+                    mCountDownLatch.countDown();
+                    maybeRequestFillLocked();
+                } else {
+                    // TODO(b/151867668): ideally this case should not happen, but it was
+                    //  observed, we should figure out why and fix.
+                    mRemoteFillService.onFillRequest(request);
+                }
             }
 
             if (mActivityToken != null) {
-- 
cgit v1.2.3-59-g8ed1b