Remove ContentCaptureServerSession when app died.

Test: manual verification
Test: atest CtsContentCaptureServiceTestCases:android.contentcaptureservice.cts.AppKilledTest

Fixes: 119524920

Change-Id: I324aa7d83721ba078752dda2f91b32d788ce304f

2 files changed, 23 insertions, 2 deletions

diff --git a/services/contentcapture/java/com/android/server/contentcapture/ContentCapturePerUserService.java b/services/contentcapture/java/com/android/server/contentcapture/ContentCapturePerUserService.java
index b4a1f381f7ff..5a42e7893ab4 100644
--- a/services/contentcapture/java/com/android/server/contentcapture/ContentCapturePerUserService.java
+++ b/services/contentcapture/java/com/android/server/contentcapture/ContentCapturePerUserService.java
@@ -313,7 +313,7 @@ final class ContentCapturePerUserService
         // Make sure service is bound, just in case the initial connection failed somehow
         mRemoteService.ensureBoundLocked();
 
-        final ContentCaptureServerSession newSession = new ContentCaptureServerSession(
+        final ContentCaptureServerSession newSession = new ContentCaptureServerSession(mLock,
                 activityToken, this, componentName, clientReceiver, taskId, displayId, sessionId,
                 uid, flags);
         if (mMaster.verbose) {
diff --git a/services/contentcapture/java/com/android/server/contentcapture/ContentCaptureServerSession.java b/services/contentcapture/java/com/android/server/contentcapture/ContentCaptureServerSession.java
index 1ad66d869eae..d38dfd409439 100644
--- a/services/contentcapture/java/com/android/server/contentcapture/ContentCaptureServerSession.java
+++ b/services/contentcapture/java/com/android/server/contentcapture/ContentCaptureServerSession.java
@@ -65,11 +65,14 @@ final class ContentCaptureServerSession {
      */
     private final int mUid;
 
-    ContentCaptureServerSession(@NonNull IBinder activityToken,
+    private final Object mLock;
+
+    ContentCaptureServerSession(@NonNull Object lock, @NonNull IBinder activityToken,
             @NonNull ContentCapturePerUserService service, @NonNull ComponentName appComponentName,
             @NonNull IResultReceiver sessionStateReceiver, int taskId, int displayId, int sessionId,
             int uid, int flags) {
         Preconditions.checkArgument(sessionId != NO_SESSION_ID);
+        mLock = lock;
         mActivityToken = activityToken;
         mService = service;
         mId = sessionId;
@@ -77,6 +80,11 @@ final class ContentCaptureServerSession {
         mContentCaptureContext = new ContentCaptureContext(/* clientContext= */ null,
                 appComponentName, taskId, displayId, flags);
         mSessionStateReceiver = sessionStateReceiver;
+        try {
+            sessionStateReceiver.asBinder().linkToDeath(() -> onClientDeath(), 0);
+        } catch (Exception e) {
+            Slog.w(TAG, "could not register DeathRecipient for " + activityToken);
+        }
     }
 
     /**
@@ -182,6 +190,19 @@ final class ContentCaptureServerSession {
                 /* binder= */ null);
     }
 
+    /**
+     * Called when the session client binder object died - typically when its process was killed
+     * and the activity was not properly destroyed.
+     */
+    private void onClientDeath() {
+        if (mService.isVerbose()) {
+            Slog.v(TAG, "onClientDeath(" + mActivityToken + "): removing session " + mId);
+        }
+        synchronized (mLock) {
+            removeSelfLocked(/* notifyRemoteService= */ true);
+        }
+    }
+
     @GuardedBy("mLock")
     public void dumpLocked(@NonNull String prefix, @NonNull PrintWriter pw) {
         pw.print(prefix); pw.print("id: ");  pw.print(mId); pw.println();