A bug of user switch funtion in Android5 and its fix in Android7

In Android 5, user switching function is implemented by AMS.

In frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java

    public boolean switchUser(final int userId) {
        // fosmod_multiple_users begin
        return switchUser(userId, true);
    }

    public boolean switchUser(final int userId, final boolean showKeyguard) {
        mShowKeyguard = showKeyguard;
        // fosmod_multiple_users end
        enforceShellRestriction(UserManager.DISALLOW_DEBUGGING_FEATURES, userId);
        String userName;
        synchronized (this) {
            UserInfo userInfo = getUserManagerLocked().getUserInfo(userId);
            if (userInfo == null) {
                Slog.w(TAG, "No user info for user #" + userId);
                return false;
            }
            if (userInfo.isManagedProfile()) {
                Slog.w(TAG, "Cannot switch to User #" + userId + ": not a full user");
                return false;
            }
            userName = userInfo.name;
            mTargetUserId = userId;
        }
        mHandler.removeMessages(START_USER_SWITCH_MSG);
        mHandler.sendMessage(mHandler.obtainMessage(START_USER_SWITCH_MSG, userId, 0, userName));
        return true;
    }

            case START_USER_SWITCH_MSG: {
                showUserSwitchDialog(msg.arg1, (String) msg.obj);
                break;
            }
    private void showUserSwitchDialog(int userId, String userName) {
            Dialog d = new UserSwitchingDialog(this, mContext, userId, userName,
                    true /* above system */);
            d.show();
    }

It create an Alert dialog (showUserSwitchDialog) and show it. The dialog is to indicate that system is switching user.
In frameworks/base/services/core/java/com/android/server/am/UserSwitchingDialog.java

    @Override
    public void show() {
        // Slog.v(TAG, "show called");
        super.show();     // show dialog
        final View decorView = getWindow().getDecorView();
        if (decorView != null) {
            decorView.getViewTreeObserver().addOnWindowShownListener(this);      // register listener, so onWindowShown will be called if dialog is shown on the screen.
        }
    }

    @Override
    public void onWindowShown() {
        // Slog.v(TAG, "onWindowShown called");
        mService.startUserInForeground(mUserId, this);    // In the callback function, it will call AMS.startUserInForeground
        final View decorView = getWindow().getDecorView();
        if (decorView != null) {
            decorView.getViewTreeObserver().removeOnWindowShownListener(this);
        }
    }
In frameworks/base/services/core/java/com/android/server/am/ActivityManagerService.java
    boolean startUserInForeground(final int userId, Dialog dlg) {
        boolean result = startUser(userId, /* foreground */ true);       // do user switching operations.
        dlg.dismiss();      // dismiss the dialog
        return result;
    }
But onWindowShown method will no be called if screen is off. So there may be a special case that user click "user switching" button first, and quickly click power key.
In this case UserSwitchingDialog will be shown, but onWindowShown method will not be called. So system will not switch user, and the dialog will not be dismissed.
And user can do nothing on the screen because the dialog is on the top of all window. Its window type is WindowManager.LayoutParams.TYPE_SYSTEM_ERROR.

In Android N, there is a fix for this issue.
commit 5e5cb463b6e2540a7ef6c261ba5fed074be536e1
Author: Amith Yamasani <yamasani@google.com>
Date:   Mon Feb 9 15:45:26 2015 -0800

    Timeout to ensure user-switching dialog is closed
    
    In the event of user-switch invoked by a remote device admin call,
    the window manager does not make window-shown callbacks when the
    screen is off. Add a timeout to continue the user switch in case
    the callback doesn't come through.
    
    This fixes a stuck "Switching to user.." dialog when a profile
    owner requests a user wipe.
    
    Bug: 19275716
    Change-Id: I3a51bbaaf3d9ac6c006464360f1146b2499d205b