Fix bug 5357295 NPE on display when remote control client dies

When a IRemoteControlClient dies, that client is set to null
 in the stack of remote control entries (mRCStack). This is done
 by calling registerRemoteControlClient() with a null client.
The bug is that registerRemoteControlClient(), after storing
 the new client, uses it to let it know what the current
 remote control display is. When that display is non null, the
 client is sent the current display. So when a client died
 when there was a display, the client reference was accessed
 in the part of the method where we haven't yet checked whether
 it is null or not.
The fix consists in moving the setting of the display on the
 client (method plugRemoteControlDisplay) only after having
 checked that the client is non-null.

Change-Id: Ic74d6cba9e3a3a16e78cd80a1ae5901abfeb3905

Author: jmtrivi

media/java/android/media/AudioService.java

@@ -2958,7 +2958,7 @@ public void binderDied() {
             Log.w(TAG, "  RemoteControlClient died");
             // remote control client died, make sure the displays don't use it anymore
             //  by setting its remote control client to null
-            registerRemoteControlClient(mMediaIntent, null, null/*ignored*/);
+            registerRemoteControlClient(mMediaIntent, null/*rcClient*/, null/*ignored*/);
         }
 
         public IBinder getBinder() {
@@ -3366,7 +3366,12 @@ public void unregisterMediaButtonIntent(PendingIntent mediaIntent, ComponentName
         }
     }
 
-    /** see AudioManager.registerRemoteControlClient(ComponentName eventReceiver, ...) */
+    /**
+     * see AudioManager.registerRemoteControlClient(ComponentName eventReceiver, ...)
+     * Note: using this method with rcClient == null is a way to "disable" the IRemoteControlClient
+     *     without modifying the RC stack, but while still causing the display to refresh (will
+     *     become blank as a result of this)
+     */
     public void registerRemoteControlClient(PendingIntent mediaIntent,
             IRemoteControlClient rcClient, String callingPackageName) {
         if (DEBUG_RC) Log.i(TAG, "Register remote control client rcClient="+rcClient);
@@ -3384,6 +3389,15 @@ public void registerRemoteControlClient(PendingIntent mediaIntent,
                         }
                         // save the new remote control client
                         rcse.mRcClient = rcClient;
+                        rcse.mCallingPackageName = callingPackageName;
+                        rcse.mCallingUid = Binder.getCallingUid();
+                        if (rcClient == null) {
+                            rcse.mRcClientDeathHandler = null;
+                            break;
+                        }
+
+                        // there is a new (non-null) client:
+                        // 1/ give the new client the current display (if any)
                         if (mRcDisplay != null) {
                             try {
                                 rcse.mRcClient.plugRemoteControlDisplay(mRcDisplay);
@@ -3392,14 +3406,8 @@ public void registerRemoteControlClient(PendingIntent mediaIntent,
                                 e.printStackTrace();
                             }
                         }
-                        rcse.mCallingPackageName = callingPackageName;
-                        rcse.mCallingUid = Binder.getCallingUid();
-                        if (rcClient == null) {
-                            rcse.mRcClientDeathHandler = null;
-                            break;
-                        }
-                        // monitor the new client's death
-                        IBinder b = rcClient.asBinder();
+                        // 2/ monitor the new client's death
+                        IBinder b = rcse.mRcClient.asBinder();
                         RcClientDeathHandler rcdh =
                                 new RcClientDeathHandler(b, rcse.mMediaIntent);
                         try {