Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Copy child window list when destroying surface

Browse Source 
When removing a child window, we may trigger a layout pass via:

WindowState.removeImmediately calls
WMS.postWindowRemoveCleanupLocked calls
WindowPlacer.performSurfacePlacement

Then, under certain conditions, we either remove a window from
mService.mForceRemoves or mService.mPendingRemove. If a child
is in any of these two lists, it will lead to a crash.

Test: go/wm-smoke
Change-Id: I4eac6a6ec9092521542590fad1aa9643818b2fe6
Fixes: 71499373
This commit is contained in:
Jorim Jaggi
2018-01-05 15:40:32 +01:00
parent 88f620534f
commit 59f3e926ce
2 changed files with 7 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
services/core/java/com/android/server/wm/AppWindowToken.java
View File

@@ -645,8 +645,7 @@ class AppWindowToken extends WindowToken implements WindowManagerService.AppFree
boolean destroyedSomething = false;
// Copying to a different list as multiple children can be removed.
// TODO: Not sure why this is needed.
final LinkedList<WindowState> children = new LinkedList<>(mChildren);
final ArrayList<WindowState> children = new ArrayList<>(mChildren);
for (int i = children.size() - 1; i >= 0; i--) {
final WindowState win = children.get(i);
destroyedSomething |= win.destroySurface(cleanupOnResume, mAppStopped);

10
services/core/java/com/android/server/wm/WindowState.java
View File

@@ -2642,8 +2642,11 @@ class WindowState extends WindowContainer<WindowState> implements WindowManagerP
boolean destroySurface(boolean cleanupOnResume, boolean appStopped) {
boolean destroyedSomething = false;
for (int i = mChildren.size() - 1; i >= 0; --i) {
final WindowState c = mChildren.get(i);
// Copying to a different list as multiple children can be removed.
final ArrayList<WindowState> childWindows = new ArrayList<>(mChildren);
for (int i = childWindows.size() - 1; i >= 0; --i) {
final WindowState c = childWindows.get(i);
destroyedSomething |= c.destroySurface(cleanupOnResume, appStopped);
}
@@ -3873,8 +3876,7 @@ class WindowState extends WindowContainer<WindowState> implements WindowManagerP
if (!mChildren.isEmpty()) {
// Copying to a different list as multiple children can be removed.
// TODO: Not sure if we really need to copy this into a different list.
final LinkedList<WindowState> childWindows = new LinkedList(mChildren);
final ArrayList<WindowState> childWindows = new ArrayList<>(mChildren);
for (int i = childWindows.size() - 1; i >= 0; i--) {
childWindows.get(i).onExitAnimationDone();
}