SF: update mInputFlinger on main thread

mInputFlinger can be accessed by bootFinished() and updateInputFlinger().
These function can run in different thread at the same time, but
mInputFlinger was not protected.

update mInputFlinger on main thread

Fixes: 157871763
Fixes: 147009853
Fixes: 169256435
Test: adb shell stop / start
Test: boot ok
Test: Race was only reproducible in monkey tests
Change-Id: I4d87e90793a88a646aaa1ae5806f118f1ae51e30
Merged-In: I4d87e90793a88a646aaa1ae5806f118f1ae51e30
(cherry picked from commit 58fbf9fb2c82ee09b0d572e0936b8370c4d35aef)
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 1a25b82..bc134cb 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -538,13 +538,6 @@
     if (window != 0) {
         window->linkToDeath(static_cast<IBinder::DeathRecipient*>(this));
     }
-    sp<IBinder> input(defaultServiceManager()->getService(
-            String16("inputflinger")));
-    if (input == nullptr) {
-        ALOGE("Failed to link to input service");
-    } else {
-        mInputFlinger = interface_cast<IInputFlinger>(input);
-    }
 
     if (mVrFlinger) {
       mVrFlinger->OnBootFinished();
@@ -559,7 +552,15 @@
     LOG_EVENT_LONG(LOGTAG_SF_STOP_BOOTANIM,
                    ns2ms(systemTime(SYSTEM_TIME_MONOTONIC)));
 
-    postMessageAsync(new LambdaMessage([this]() NO_THREAD_SAFETY_ANALYSIS {
+    sp<IBinder> input(defaultServiceManager()->getService(String16("inputflinger")));
+
+    postMessageAsync(new LambdaMessage([=]() NO_THREAD_SAFETY_ANALYSIS {
+        if (input == nullptr) {
+            ALOGE("Failed to link to input service");
+        } else {
+            mInputFlinger = interface_cast<IInputFlinger>(input);
+        }
+
         readPersistentProperties();
         mBootStage = BootStage::FINISHED;