From a9ddb1e0daf3f55596ae8838a75c3524a9630aaf Mon Sep 17 00:00:00 2001
From: Joanne Chung <joannechung@google.com>
Date: Thu, 6 May 2021 15:15:38 +0800
Subject: [PATCH] Fix IndexOutOfBoundsException when calling
 dispatchProvideStructure()

dispatchProvideStructure() will get preorderedList by buildOrderedChildList().
buildOrderedChildList() returns mPreSortedChildren directly. During
the traversal, the mPreSortedChildren is changed by the
View#populateAccessibilityNodeInfoDrawingOrderInParent(). When one of
child traversal is done, the preorderedList is already changed, the
IndexOutOfBoundsException will occurr when trying to travese the next
child.

To fix it, try to make a copy not directly refer to mPreSortedChildren.
Bug: 185971133
Test: manual. App doesn't crash
Test: atest CtsAutoFillServiceTestCases
Change-Id: Ie077948dd45426c1204d153ca0a921c7c67351d8
---
 core/java/android/view/ViewGroup.java | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/core/java/android/view/ViewGroup.java b/core/java/android/view/ViewGroup.java
index a02281be12285..c6053e5dc8361 100644
--- a/core/java/android/view/ViewGroup.java
+++ b/core/java/android/view/ViewGroup.java
@@ -3581,7 +3581,9 @@ public abstract class ViewGroup extends View implements ViewParent, ViewManager
         }
 
         structure.setChildCount(childrenCount);
-        ArrayList<View> preorderedList = buildOrderedChildList();
+        ArrayList<View> tempPreorderedList = buildOrderedChildList();
+        ArrayList<View> preorderedList =
+                tempPreorderedList != null ? new ArrayList<>(tempPreorderedList) : null;
         boolean customOrder = preorderedList == null
                 && isChildrenDrawingOrderEnabled();
         for (int i = 0; i < childrenCount; i++) {