Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Always copy sources to outInsetsState before writeToParcel

Browse Source 
InsetsState#writeToParcel is executed outside of mGlobalLock, so there
could be two threads accessing the same object at the same time. This CL
copies sources to outInsetsState to prevent the race condition.

Fix: 235019713
Fix: 242037615
Test: presubmit
Change-Id: I78d9b89f88f75ab673761bbfce86330ff0163adc
This commit is contained in:
Tiger Huang
2022-08-16 16:57:38 +08:00
parent 81ae41092e
commit fc8f9637c8
1 changed files with 4 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
services/core/java/com/android/server/wm/WindowManagerService.java
View File

@@ -1866,7 +1866,7 @@ public class WindowManagerService extends IWindowManager.Stub
displayContent.getInsetsStateController().updateAboveInsetsState(
false /* notifyInsetsChanged */);
outInsetsState.set(win.getCompatInsetsState(), win.isClientLocal());
outInsetsState.set(win.getCompatInsetsState(), true /* copySources */);
getInsetsSourceControls(win, outActiveControls);
if (win.mLayoutAttached) {
@@ -2560,7 +2560,7 @@ public class WindowManagerService extends IWindowManager.Stub
}
if (outInsetsState != null) {
outInsetsState.set(win.getCompatInsetsState(), win.isClientLocal());
outInsetsState.set(win.getCompatInsetsState(), true /* copySources */);
}
ProtoLog.v(WM_DEBUG_FOCUS, "Relayout of %s: focusMayChange=%b",
@@ -8877,7 +8877,6 @@ public class WindowManagerService extends IWindowManager.Stub
@Override
public boolean getWindowInsets(WindowManager.LayoutParams attrs, int displayId,
InsetsState outInsetsState) {
final boolean fromLocal = Binder.getCallingPid() == MY_PID;
final int uid = Binder.getCallingUid();
final long origId = Binder.clearCallingIdentity();
try {
@@ -8891,10 +8890,8 @@ public class WindowManagerService extends IWindowManager.Stub
final float overrideScale = mAtmService.mCompatModePackages.getCompatScale(
attrs.packageName, uid);
final InsetsState state = dc.getInsetsPolicy().getInsetsForWindowMetrics(attrs);
final boolean hasCompatScale =
WindowState.hasCompatScale(attrs, token, overrideScale);
outInsetsState.set(state, hasCompatScale || fromLocal);
if (hasCompatScale) {
outInsetsState.set(state, true /* copySources */);
if (WindowState.hasCompatScale(attrs, token, overrideScale)) {
final float compatScale = token != null && token.hasSizeCompatBounds()
? token.getSizeCompatScale() * overrideScale
: overrideScale;