From 4d318287ba5bf3151ef6aa6e1ae52dd814f85412 Mon Sep 17 00:00:00 2001
From: Edward Savage-Jones <edward.savage-jones@sony.com>
Date: Mon, 28 Aug 2017 10:44:18 +0200
Subject: [PATCH] IllegalArgumentException in MagnificationGestureHandler

When enabling the magnifier feature it is possible to trigger
a system crash.

Problem:
On ACTION_DOWN a MESSAGE_ON_ACTION_TAP_AND_HOLD is sent to the
handler with a delay based on long-press timeout.  If the user
then removes their finger while outside of the magnification area,
(ACTION_UP) this message is not removed.  Then when the message
is handled on long-press timeout, it puts the state into
STATE_VIEWPORT_DRAGGING.  If the user then taps the screen again
it is handled by the StateViewportDraggingHandler resulting in:

 IllegalArgumentException: Unexpected event type: ACTION_DOWN

and a system server crash.

Bug: 65101895
Test: Manual:
1. Enable "Magnify with button" from accessibility settings
2. Tap accessibility button on the right navbar
3. Touch & hold bottom part of application area
4. Quickly drag down to the navbar and release
5. Touch anywhere
With this patch it should not crash

Change-Id: I7df8d2185f6db9d148d24d2b155cb357b3637a71
---
 .../server/accessibility/MagnificationGestureHandler.java       | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/accessibility/java/com/android/server/accessibility/MagnificationGestureHandler.java b/services/accessibility/java/com/android/server/accessibility/MagnificationGestureHandler.java
index 7e82edaae3e5b..b1ac5891dafa7 100644
--- a/services/accessibility/java/com/android/server/accessibility/MagnificationGestureHandler.java
+++ b/services/accessibility/java/com/android/server/accessibility/MagnificationGestureHandler.java
@@ -690,6 +690,7 @@ class MagnificationGestureHandler implements EventStreamTransformation {
                 }
                 break;
                 case MotionEvent.ACTION_UP: {
+                    mHandler.removeMessages(MESSAGE_ON_ACTION_TAP_AND_HOLD);
                     if (!mMagnificationController.magnificationRegionContains(
                             event.getX(), event.getY())) {
                         transitionToDelegatingState(!mShortcutTriggered);
@@ -703,7 +704,6 @@ class MagnificationGestureHandler implements EventStreamTransformation {
                     if (mLastDownEvent == null) {
                         return;
                     }
-                    mHandler.removeMessages(MESSAGE_ON_ACTION_TAP_AND_HOLD);
                     if (!GestureUtils.isTap(mLastDownEvent, event, mTapTimeSlop,
                             mTapDistanceSlop, 0)) {
                         transitionToDelegatingState(true);