Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1938e34e authored by Suprabh Shukla's avatar Suprabh Shukla
Browse files

Mitigating cache corruption in ArrayMap 

Before calling freeArrays, storing the array reference into a temporary
pointer so that the main pointer doesn't end up corrupting the static
pool of arrays on concurrent access. An earlier change missed a rare
case when removeAt was called for the last element in the map.

Test: atest android.util.ArrayMapTest
atest android.util.cts.ArrayMapTest

Bug: 78898947
Change-Id: I454c5b1600eb0a6c690e746df10f6a0ebcd8aa1d
parent 1b69d7b4

core/java/android/util/ArrayMap.java

+3 −1
Original line number Original line Diff line number Diff line
@@ -644,9 +644,11 @@ public final class ArrayMap<K, V> implements Map<K, V> { 
        if (osize <= 1) {

        if (osize <= 1) {

            // Now empty.

            // Now empty.

            if (DEBUG) Log.d(TAG, "remove: shrink from " + mHashes.length + " to 0");

            if (DEBUG) Log.d(TAG, "remove: shrink from " + mHashes.length + " to 0");

            freeArrays(mHashes, mArray, osize);

            final int[] ohashes = mHashes;

            final Object[] oarray = mArray;

            mHashes = EmptyArray.INT;

            mHashes = EmptyArray.INT;

            mArray = EmptyArray.OBJECT;

            mArray = EmptyArray.OBJECT;

            freeArrays(ohashes, oarray, osize);

            nsize = 0;

            nsize = 0;

        } else {

        } else {

            nsize = osize - 1;

            nsize = osize - 1;