From 3f2de7479c884dd7c89dbab0a0c45bc1da1f564b Mon Sep 17 00:00:00 2001
From: Riddle Hsu <riddlehsu@google.com>
Date: Mon, 25 Feb 2019 15:21:38 +0800
Subject: [PATCH] Fix leakage of input window handle on removed display

While the display is alive, the handles are set from SurfaceControl
indirectly. But when removing display, there is no path to inform
InputDispatcher to clean up the handles.

The change uses the legacy method to set empty handles directly for
the removed display.

Bug: 126141550
Test: manual - Create virtual display with system decoration support.
      Close the display and check "dumpsys input" that there should
      not have records in the removed display.

Change-Id: I9087f41ff3acb8990cfb71fed43450230ebe0cc6
---
 .../java/com/android/server/input/InputManagerService.java   | 5 +++++
 services/core/java/com/android/server/wm/InputMonitor.java   | 1 +
 2 files changed, 6 insertions(+)

diff --git a/services/core/java/com/android/server/input/InputManagerService.java b/services/core/java/com/android/server/input/InputManagerService.java
index 87c7441387975..622c49e67967b 100644
--- a/services/core/java/com/android/server/input/InputManagerService.java
+++ b/services/core/java/com/android/server/input/InputManagerService.java
@@ -1452,6 +1452,11 @@ public class InputManagerService extends IInputManager.Stub
         nativeSetFocusedDisplay(mPtr, displayId);
     }
 
+    /** Clean up input window handles of the given display. */
+    public void onDisplayRemoved(int displayId) {
+        nativeSetInputWindows(mPtr, null /* windowHandles */, displayId);
+    }
+
     @Override
     public void requestPointerCapture(IBinder windowToken, boolean enabled) {
         if (mFocusedWindow == null || mFocusedWindow.asBinder() != windowToken) {
diff --git a/services/core/java/com/android/server/wm/InputMonitor.java b/services/core/java/com/android/server/wm/InputMonitor.java
index 3c5d911903e74..2a9c2b01ece60 100644
--- a/services/core/java/com/android/server/wm/InputMonitor.java
+++ b/services/core/java/com/android/server/wm/InputMonitor.java
@@ -168,6 +168,7 @@ final class InputMonitor {
 
     void onDisplayRemoved() {
         mHandler.removeCallbacks(mUpdateInputWindows);
+        mService.mInputManager.onDisplayRemoved(mDisplayId);
         mDisplayRemoved = true;
     }