Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 68dd2e86 authored by Vladislav Kaznacheev's avatar Vladislav Kaznacheev
Browse files

Fix cross-app drag and drop crash. 

A DragEvent created in DragState.broadcastDragEndedLw
could be recycled twice if one of the notified windows
belongs to the system process. In this case the same
instance of DragEvent is recycled first inside the event
handler, and then the second time before exiting the
function (which causes a RuntimeException).

Added a Pid check similar to another four places in this
class where dispatchDragEvent is called.

Bug: 25079983
Change-Id: Ia7c1b9258a0c624bc7e2451650e2fb362848a16d
parent 3128c842

services/core/java/com/android/server/wm/DragState.java

+10 −4
Original line number Diff line number Diff line
@@ -265,21 +265,27 @@ class DragState { 
    }



    void broadcastDragEndedLw() {

        final int myPid = Process.myPid();



        if (WindowManagerService.DEBUG_DRAG) {

            Slog.d(WindowManagerService.TAG, "broadcasting DRAG_ENDED");

        }

        for (WindowState ws : mNotifiedWindows) {

            DragEvent evt = DragEvent.obtain(DragEvent.ACTION_DRAG_ENDED,

                    0, 0, null, null, null, null, mDragResult);

        for (WindowState ws: mNotifiedWindows) {

            try {

                ws.mClient.dispatchDragEvent(evt);

            } catch (RemoteException e) {

                Slog.w(WindowManagerService.TAG, "Unable to drag-end window " + ws);

            }

            // if the current window is in the same process,

            // the dispatch has already recycled the event

            if (myPid != ws.mSession.mPid) {

                evt.recycle();

            }

        }

        mNotifiedWindows.clear();

        mDragInProgress = false;

        evt.recycle();

    }



    void endDragLw() {