From 47308691549b9e09aa4d4b6df930ce09e32e6d83 Mon Sep 17 00:00:00 2001
From: Jerry Chang <chenghsiuchang@google.com>
Date: Fri, 5 Aug 2022 03:09:30 +0000
Subject: [PATCH] Prevent updating invlid child task surfaces in the sync queue

The task surface might be released before running in the sync queue for
the case like trampoline launch, so check if the surface is valid before
processing it in StageTaskListener.

Fix: 239490752
Test: atest WMShellUnitTests
Test: no crash when dragging a "clean" shortcut of Files to enter split
Change-Id: I8f927f644149cf9b24f4c9110f8ac745bb558dcd
---
 .../android/wm/shell/splitscreen/StageTaskListener.java  | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageTaskListener.java b/libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageTaskListener.java
index f6dc68be946ab..7b6256e9a659c 100644
--- a/libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageTaskListener.java
+++ b/libs/WindowManager/Shell/src/com/android/wm/shell/splitscreen/StageTaskListener.java
@@ -32,6 +32,7 @@ import android.content.Context;
 import android.graphics.Point;
 import android.graphics.Rect;
 import android.os.IBinder;
+import android.util.Slog;
 import android.util.SparseArray;
 import android.view.SurfaceControl;
 import android.view.SurfaceSession;
@@ -361,7 +362,13 @@ class StageTaskListener implements ShellTaskOrganizer.TaskListener {
             SurfaceControl leash, boolean firstAppeared) {
         final Point taskPositionInParent = taskInfo.positionInParent;
         mSyncQueue.runInSync(t -> {
-            t.setWindowCrop(leash, null);
+            // The task surface might be released before running in the sync queue for the case like
+            // trampoline launch, so check if the surface is valid before processing it.
+            if (!leash.isValid()) {
+                Slog.w(TAG, "Skip updating invalid child task surface of task#" + taskInfo.taskId);
+                return;
+            }
+            t.setCrop(leash, null);
             t.setPosition(leash, taskPositionInParent.x, taskPositionInParent.y);
             if (firstAppeared && !ENABLE_SHELL_TRANSITIONS) {
                 t.setAlpha(leash, 1f);