fix(replay): Make close's idle cleanup claim the gate atomically

close() checked !frameInFlight.get() non-atomically before scheduleCleanup, so a
capture racing in after the check could take the gate, see isClosed, and have its
finishFrame schedule a second cleanup. Extract the shared "claim the gate, then the
winner cleans up once" invariant into cleanUpIfIdle() so close() and finishFrame()
use the same CAS.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: romtsn

sentry-android-replay/src/main/java/io/sentry/android/replay/screenshot/PixelCopyStrategy.kt

@@ -369,18 +369,24 @@ internal class PixelCopyStrategy(
   override fun close() {
     isClosed.set(true)
     unstableCaptures.set(0)
-    if (!frameInFlight.get()) {
-      scheduleCleanup()
-    }
+    cleanUpIfIdle()
   }
 
   private fun finishFrame() {
     frameInFlight.set(false)
-    // Only clean up if we're closed AND can re-take the gate. If a new capture slipped in after we
-    // released it (its CAS won), that frame now owns the shared screenshot; its own finishFrame
-    // will
-    // clean up. Backing off here avoids recycling the bitmap while that capture is still using it.
-    if (isClosed.get() && frameInFlight.compareAndSet(false, true)) {
+    if (isClosed.get()) {
+      cleanUpIfIdle()
+    }
+  }
+
+  /**
+   * Schedules cleanup only for the caller that owns the gate. Whoever wins [frameInFlight]'s CAS
+   * (close when no frame is running, or the finishFrame of the last in-flight frame after close)
+   * runs cleanup exactly once; a racing capture that took the gate loses the CAS and backs off, so
+   * we never recycle the shared screenshot while that capture is still using it.
+   */
+  private fun cleanUpIfIdle() {
+    if (frameInFlight.compareAndSet(false, true)) {
       scheduleCleanup()
     }
   }

sentry-android-replay/src/test/java/io/sentry/android/replay/screenshot/PixelCopyStrategyTest.kt

@@ -279,6 +279,30 @@ class PixelCopyStrategyTest {
     verify(executor, times(1)).submit(any<Runnable>())
   }
 
+  @Test
+  @Config(shadows = [DeferredWindowPixelCopyShadow::class])
+  fun `idle close claims the gate so a racing capture cannot schedule a second cleanup`() {
+    // Mirror of the finishFrame guard, but for close()'s idle path (no frame in flight). close()
+    // must atomically claim the gate before scheduling cleanup; otherwise a capture racing in right
+    // after the check can take the gate, see isClosed, run finishFrame and schedule cleanup a
+    // second
+    // time. Both cleanups are idempotent, but a single submit is the invariant we keep uniform.
+    val activity = buildActivity(SimpleActivity::class.java).setup()
+    shadowOf(Looper.getMainLooper()).idle()
+    val root = activity.get().findViewById<View>(android.R.id.content)
+    val executor = mock<ScheduledExecutorService>()
+    whenever(executor.submit(any<Runnable>())).thenReturn(mock<Future<*>>())
+    val strategy = fixture.getSut(executor)
+
+    strategy.close() // idle -> claims gate, schedules the one cleanup
+    // A capture landing after close must be dropped (gate held), not schedule cleanup again.
+    strategy.capture(root)
+    DeferredWindowPixelCopyShadow.flush()
+    shadowOf(Looper.getMainLooper()).idle()
+
+    verify(executor, times(1)).submit(any<Runnable>())
+  }
+
   @Test
   @Config(shadows = [DeferredWindowPixelCopyShadow::class])
   fun `frame gate is released when masking submit is rejected`() {