Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 00f7b3f7 authored by Svetoslav Ganov's avatar Svetoslav Ganov
Browse files

Crash in the TouchExplorer 

1. No clearing the last touch explore event in all cases
   when transitioning to another mode.

2. Incorrectly assuming the the action index of an up/down
   events is 0.

bug:4551506

Change-Id: I43f8e800b54a340968489dc924a539795a9195cb
parent c8307c88

services/java/com/android/server/accessibility/TouchExplorer.java

+12 −8
Original line number Diff line number Diff line
@@ -226,8 +226,9 @@ public class TouchExplorer implements Explorer { 
                // Send a hover for every finger down so the user gets feedback

                // where she is currently touching.

                mSendHoverDelayed.forceSendAndRemove();

                mSendHoverDelayed.post(event, MotionEvent.ACTION_HOVER_ENTER, 1, policyFlags,

                        DELAY_SEND_HOVER_MOVE);

                final int pointerIdBits = (1 << event.getActionIndex());

                mSendHoverDelayed.post(event, MotionEvent.ACTION_HOVER_ENTER, pointerIdBits,

                        policyFlags, DELAY_SEND_HOVER_MOVE);

            } break;

            case MotionEvent.ACTION_POINTER_DOWN: {

                switch (activePointerCount) {
@@ -355,6 +356,7 @@ public class TouchExplorer implements Explorer { 
                                sendAccessibilityEvent(TYPE_TOUCH_EXPLORATION_GESTURE_END);

                                mTouchExploreGestureInProgress = false;

                            }

                            mLastTouchExploreEvent = null;

                            mDraggingPointerId = pointerId;

                            sendMotionEvent(event, MotionEvent.ACTION_DOWN, pointerIdBits,

                                    policyFlags);
@@ -365,6 +367,7 @@ public class TouchExplorer implements Explorer { 
                                sendAccessibilityEvent(TYPE_TOUCH_EXPLORATION_GESTURE_END);

                                mTouchExploreGestureInProgress = false;

                            }

                            mLastTouchExploreEvent = null;

                            sendDownForAllActiveNotInjectedPointers(event, policyFlags);

                        }

                    } break;
@@ -382,6 +385,7 @@ public class TouchExplorer implements Explorer { 
                            sendAccessibilityEvent(TYPE_TOUCH_EXPLORATION_GESTURE_END);

                            mTouchExploreGestureInProgress = false;

                        }

                        mLastTouchExploreEvent = null;

                        sendDownForAllActiveNotInjectedPointers(event, policyFlags);

                    }

                }
@@ -728,7 +732,7 @@ public class TouchExplorer implements Explorer { 
    /**

     * Sends an event.

     *

     * @param event The event to send.

     * @param prototype The prototype from which to create the injected events.

     * @param action The action of the event.

     * @param pointerIdBits The bits of the pointers to send.

     * @param policyFlags The policy flags associated with the event.
@@ -979,7 +983,7 @@ public class TouchExplorer implements Explorer { 
                case MotionEvent.ACTION_DOWN: {

                    // New gesture so restart tracking injected down pointers.

                    mInjectedPointersDown = 0;

                    handleReceivedPointerDown(0, event);

                    handleReceivedPointerDown(event.getActionIndex(), event);

                } break;

                case MotionEvent.ACTION_POINTER_DOWN: {

                    handleReceivedPointerDown(event.getActionIndex(), event);
@@ -988,7 +992,7 @@ public class TouchExplorer implements Explorer { 
                    handleReceivedPointerMove(event);

                } break;

                case MotionEvent.ACTION_UP: {

                    handleReceivedPointerUp(0, event);

                    handleReceivedPointerUp(event.getActionIndex(), event);

                } break;

                case MotionEvent.ACTION_POINTER_UP: {

                    handleReceivedPointerUp(event.getActionIndex(), event);
@@ -1008,13 +1012,13 @@ public class TouchExplorer implements Explorer { 
            final int action = event.getActionMasked();

            switch (action) {

                case MotionEvent.ACTION_DOWN: {

                    handleInjectedPointerDown(0, event);

                    handleInjectedPointerDown(event.getActionIndex(), event);

                } break;

                case MotionEvent.ACTION_POINTER_DOWN: {

                    handleInjectedPointerDown(event.getActionIndex(), event);

                } break;

                case MotionEvent.ACTION_UP: {

                    handleInjectedPointerUp(0, event);

                    handleInjectedPointerUp(event.getActionIndex(), event);

                } break;

                case MotionEvent.ACTION_POINTER_UP: {

                    handleInjectedPointerUp(event.getActionIndex(), event);