From 25bdf74a0b3b8f2607baa3f2e55f4625d0e21041 Mon Sep 17 00:00:00 2001
From: Robert Carr <racarr@google.com>
Date: Mon, 4 Apr 2022 12:19:50 -0700
Subject: [PATCH] ViewRootImpl: Ensure seqId only increases

We could process an earlier scheduled MSG_RESIZED after
a later executed relayoutWindow. In this case we might
accidentally move the seqId backwards, which could mess
up our logic. While we are touching this area, we
take the opportunity to ensure SyncHandlers execute
in the order they were added.

Bug: 161810301
Bug: 227561299
Test: Existing tests pass
Change-Id: I8e5ceea1ef34e4da94807582c89a33df95772c04
---
 core/java/android/view/ViewRootImpl.java            |  7 +++++--
 .../java/com/android/server/wm/WindowState.java     | 13 ++++++++++---
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/core/java/android/view/ViewRootImpl.java b/core/java/android/view/ViewRootImpl.java
index 7b3fed74a9be5..ee1e80defb6be 100644
--- a/core/java/android/view/ViewRootImpl.java
+++ b/core/java/android/view/ViewRootImpl.java
@@ -1742,7 +1742,7 @@ public final class ViewRootImpl implements ViewParent,
 
         mForceNextWindowRelayout = forceNextWindowRelayout;
         mPendingAlwaysConsumeSystemBars = args.argi2 != 0;
-        mSyncSeqId = args.argi4;
+        mSyncSeqId = args.argi4 > mSyncSeqId ? args.argi4 : mSyncSeqId;
 
         if (msg == MSG_RESIZED_REPORT) {
             reportNextDraw();
@@ -7986,7 +7986,10 @@ public final class ViewRootImpl implements ViewParent,
                     insetsPending ? WindowManagerGlobal.RELAYOUT_INSETS_PENDING : 0,
                     mTmpFrames, mPendingMergedConfiguration, mSurfaceControl, mTempInsets,
                     mTempControls, mRelayoutBundle);
-            mSyncSeqId = mRelayoutBundle.getInt("seqid");
+            final int maybeSyncSeqId = mRelayoutBundle.getInt("seqid");
+            if (maybeSyncSeqId > 0) {
+                mSyncSeqId = maybeSyncSeqId;
+            }
 
             if (mTranslator != null) {
                 mTranslator.translateRectInScreenToAppWindow(mTmpFrames.frame);
diff --git a/services/core/java/com/android/server/wm/WindowState.java b/services/core/java/com/android/server/wm/WindowState.java
index 8546e8002602b..51d68bc0177ad 100644
--- a/services/core/java/com/android/server/wm/WindowState.java
+++ b/services/core/java/com/android/server/wm/WindowState.java
@@ -6125,14 +6125,21 @@ class WindowState extends WindowContainer<WindowState> implements WindowManagerP
             applyHere = true;
         }
 
-        for (int i = mDrawHandlers.size() - 1; i >= 0; i--) {
-            DrawHandler h = mDrawHandlers.get(i);
+        final List<DrawHandler> handlersToRemove = new ArrayList<>();
+        // Iterate forwards to ensure we process in the same order
+        // we added.
+        for (int i = 0; i < mDrawHandlers.size(); i++) {
+            final DrawHandler h = mDrawHandlers.get(i);
             if (h.mSeqId <= seqId) {
                 h.mConsumer.accept(t);
-                mDrawHandlers.remove(h);
+                handlersToRemove.add(h);
                 hadHandlers = true;
             }
         }
+        for (int i = 0; i < handlersToRemove.size(); i++) {
+            final DrawHandler h = handlersToRemove.get(i);
+            mDrawHandlers.remove(h);
+        }
 
         if (hadHandlers) {
             mWmService.mH.removeMessages(WINDOW_STATE_BLAST_SYNC_TIMEOUT, this);