From 72465ea7876da0de29c03d34c075d9d2a7c76548 Mon Sep 17 00:00:00 2001
From: Adam Powell <adamp@google.com>
Date: Thu, 27 Oct 2011 17:46:07 -0700
Subject: [PATCH 1/2] DO NOT MERGE Cherry pick from ics-mr1 - Bug 5275928 -
 Don't try to open an overflow menu under invalid circumstances.

Change-Id: Ifb847b914b880ffb21dd5fc6efa833f46466f224
---
 .../com/android/internal/view/menu/ActionMenuPresenter.java | 6 ++++--
 .../com/android/internal/widget/ActionBarContextView.java   | 3 +++
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/core/java/com/android/internal/view/menu/ActionMenuPresenter.java b/core/java/com/android/internal/view/menu/ActionMenuPresenter.java
index f25d65fcdabdf..530809b869c30 100644
--- a/core/java/com/android/internal/view/menu/ActionMenuPresenter.java
+++ b/core/java/com/android/internal/view/menu/ActionMenuPresenter.java
@@ -300,6 +300,7 @@ public class ActionMenuPresenter extends BaseMenuPresenter
     public boolean hideOverflowMenu() {
         if (mPostedOpenRunnable != null && mMenuView != null) {
             ((View) mMenuView).removeCallbacks(mPostedOpenRunnable);
+            mPostedOpenRunnable = null;
             return true;
         }
 
@@ -653,10 +654,11 @@ public class ActionMenuPresenter extends BaseMenuPresenter
 
         public void run() {
             mMenu.changeMenuMode();
-            if (mPopup.tryShow()) {
+            final View menuView = (View) mMenuView;
+            if (menuView != null && menuView.getWindowToken() != null && mPopup.tryShow()) {
                 mOverflowPopup = mPopup;
-                mPostedOpenRunnable = null;
             }
+            mPostedOpenRunnable = null;
         }
     }
 }
diff --git a/core/java/com/android/internal/widget/ActionBarContextView.java b/core/java/com/android/internal/widget/ActionBarContextView.java
index 18d45f7c59581..ed02636f1c6a1 100644
--- a/core/java/com/android/internal/widget/ActionBarContextView.java
+++ b/core/java/com/android/internal/widget/ActionBarContextView.java
@@ -216,6 +216,9 @@ public class ActionBarContextView extends AbsActionBarView implements AnimatorLi
         });
 
         final MenuBuilder menu = (MenuBuilder) mode.getMenu();
+        if (mActionMenuPresenter != null) {
+            mActionMenuPresenter.dismissPopupMenus();
+        }
         mActionMenuPresenter = new ActionMenuPresenter(mContext);
         mActionMenuPresenter.setReserveOverflow(true);
 

From fd1d05a01a704db47f6e60425c0ac3e1bd4cffbf Mon Sep 17 00:00:00 2001
From: Jeff Brown <jeffbrown@google.com>
Date: Fri, 11 Nov 2011 15:03:05 -0800
Subject: [PATCH 2/2] Fix bug in TextLayoutCacheKey handling embedded nulls.

We were not passing the length of the UTF-16 string to
String16::setTo.  As a result, it was copying the contents of
the text up to the first null it found.

First problem, these strings are not typically null terminated!

Second problem, if the string contained a null character, then
we might truncate it.  However, we only truncated the string
when the copy constructor was invoked (say, when we called
get() on the cache) but not in internalTextCopy() (before
adding the key to the cache).

As a result of the second problem, we would first search
the cache for a key that matched a partially copied truncated
string (potentially reading uninitialized memory that followed it).
Finding none, we would add the entry to the cache using
the correct key.

If the cache already had a value associated with the correct key,
then the put would fail, returning false.  Charging ever onwards,
we would add the size of the entry to the cache size.

Proceeding in this manner, it was possible for the cache to
believe it had less remaining space than it really did.  At that
point, it was possible for the cache to evict all entries and
yet still not think it had room to add a new one, so it would
continue trying to make space indefinitely.

Bug: 5576812
Change-Id: I05251594f6b2da0a5dc09f7200f04fe9100ec766
---
 core/jni/android/graphics/TextLayoutCache.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/jni/android/graphics/TextLayoutCache.cpp b/core/jni/android/graphics/TextLayoutCache.cpp
index 7db8abd39d689..f67b8b18aa58a 100644
--- a/core/jni/android/graphics/TextLayoutCache.cpp
+++ b/core/jni/android/graphics/TextLayoutCache.cpp
@@ -249,7 +249,7 @@ TextLayoutCacheKey::TextLayoutCacheKey(const TextLayoutCacheKey& other) :
         flags(other.flags),
         hinting(other.hinting) {
     if (other.text) {
-        textCopy.setTo(other.text);
+        textCopy.setTo(other.text, other.contextCount);
     }
 }