From ddcd54813b01b01d4d5734ad69344201fb5c628c Mon Sep 17 00:00:00 2001 From: Mihai Popa Date: Mon, 3 Sep 2018 17:25:54 +0100 Subject: [PATCH] [Magnifier-60] Fix race condition after #dismiss The CL fixes a race condition introduced by I2799229bee7acfbd6236089487a5766f46605366, which caused apps to crash when, for example, the following happened: 1. #show(xc, yc, xm, ym) is called on the main thread, and the arguments are stored in mPrevShow[Source/Window]Coords 2. #show(xc, yc, xm', ym') is called on the main thread (note that only the window position is different from the previous call), and we post a job to the pixel copy handler thread to only update the expected position of mWindow (without doing pixel copy) 3. the job starts and checks that mWindow != currentWindowInstance is false 4. #dismiss() is called on the main thread, mWindow is set to null 5. the position update job at step 3 continues, grabs mLock but now mWindow is null and the crash happens Bug: 113272299 Test: manual testing Test: atest CtsWidgetTestCases:android.widget.cts.MagnifierTest Change-Id: Ibc815888f4eeaf077fa1a9ddfb1d4d401382623a --- core/java/android/widget/Magnifier.java | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/core/java/android/widget/Magnifier.java b/core/java/android/widget/Magnifier.java index 3280d477b23d6..8e2786d51a430 100644 --- a/core/java/android/widget/Magnifier.java +++ b/core/java/android/widget/Magnifier.java @@ -215,11 +215,11 @@ public final class Magnifier { final Point windowCoords = getCurrentClampedWindowCoordinates(); final InternalPopupWindow currentWindowInstance = mWindow; sPixelCopyHandlerThread.getThreadHandler().post(() -> { - if (mWindow != currentWindowInstance) { - // The magnifier was dismissed (and maybe shown again) in the meantime. - return; - } synchronized (mLock) { + if (mWindow != currentWindowInstance) { + // The magnifier was dismissed (and maybe shown again) in the meantime. + return; + } mWindow.setContentPositionForNextDraw(windowCoords.x, windowCoords.y); } });