From 9f7fb09fa393eadbb42a4d67343f118975c851b0 Mon Sep 17 00:00:00 2001
From: Chong Zhang <chz@google.com>
Date: Fri, 20 May 2016 17:03:08 -0700
Subject: [PATCH] Dispose HideNavInputEventReceiver on PhoneWindowManager's
 handler

Disposal of input event receiver needs to happen on the handler
specified for receiving the inputs, otherwise nativeFinishInputEvent
could crash due to race with native dispose.

Instead of disposing mInputConsumer in beginLayoutLw(), post to
PhoneWindowManager's handler to dispose, and skip any input events
received after mInputConsumer is set to null by beginLayoutLw().

bug: 26927018
Change-Id: I094eb4472ea68f2c8bd6a428161d7edb11dc8900
---
 .../server/policy/PhoneWindowManager.java        | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/policy/PhoneWindowManager.java b/services/core/java/com/android/server/policy/PhoneWindowManager.java
index b30817f53cdbb..28c06f1eae834 100644
--- a/services/core/java/com/android/server/policy/PhoneWindowManager.java
+++ b/services/core/java/com/android/server/policy/PhoneWindowManager.java
@@ -716,6 +716,7 @@ public class PhoneWindowManager implements WindowManagerPolicy {
     private static final int MSG_REQUEST_TRANSIENT_BARS = 16;
     private static final int MSG_SHOW_TV_PICTURE_IN_PICTURE_MENU = 17;
     private static final int MSG_BACK_LONG_PRESS = 18;
+    private static final int MSG_DISPOSE_INPUT_CONSUMER = 19;
 
     private static final int MSG_REQUEST_TRANSIENT_BARS_ARG_STATUS = 0;
     private static final int MSG_REQUEST_TRANSIENT_BARS_ARG_NAVIGATION = 1;
@@ -783,6 +784,9 @@ public class PhoneWindowManager implements WindowManagerPolicy {
                 case MSG_BACK_LONG_PRESS:
                     backLongPress();
                     break;
+                case MSG_DISPOSE_INPUT_CONSUMER:
+                    disposeInputConsumer((InputConsumer) msg.obj);
+                    break;
             }
         }
     }
@@ -1260,6 +1264,12 @@ public class PhoneWindowManager implements WindowManagerPolicy {
         }
     }
 
+    private void disposeInputConsumer(InputConsumer inputConsumer) {
+        if (inputConsumer != null) {
+            inputConsumer.dismiss();
+        }
+    }
+
     private void sleepPress(long eventTime) {
         if (mShortPressOnSleepBehavior == SHORT_PRESS_SLEEP_GO_TO_SLEEP_AND_GO_HOME) {
             launchHomeFromHotKey(false /* awakenDreams */, true /*respectKeyguard*/);
@@ -3738,6 +3748,9 @@ public class PhoneWindowManager implements WindowManagerPolicy {
                         // When the user taps down, we re-show the nav bar.
                         boolean changed = false;
                         synchronized (mWindowManagerFuncs.getWindowManagerLock()) {
+                            if (mInputConsumer == null) {
+                                return;
+                            }
                             // Any user activity always causes us to show the
                             // navigation controls, if they had been hidden.
                             // We also clear the low profile and only content
@@ -3991,7 +4004,8 @@ public class PhoneWindowManager implements WindowManagerPolicy {
             // bar and ensure the application doesn't see the event.
             if (navVisible || navAllowedHidden) {
                 if (mInputConsumer != null) {
-                    mInputConsumer.dismiss();
+                    mHandler.sendMessage(
+                            mHandler.obtainMessage(MSG_DISPOSE_INPUT_CONSUMER, mInputConsumer));
                     mInputConsumer = null;
                 }
             } else if (mInputConsumer == null) {