Commit 8a918b13 authored Jul 06, 2016 by Jeff Sharkey

Snapshot RemoteViews before releasing lock.

The MSG_NOTIFY_UPDATE_APP_WIDGET message is sent asynchronously,
meaning it tries sending RemoteViews without the lock held, possibly
while another Binder thread is trying to mutate it.

Fix this by creating a copy for the thread to safely dispatch.

Bug: 29889779
Change-Id: I341fbbf89abee97a66cd67f1dd2a728282b68bfa

parent 400960a4

services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java

+1 −1

Original line number	Diff line number	Diff line
		@@ -1905,7 +1905,7 @@ class AppWidgetServiceImpl extends IAppWidgetService.Stub implements WidgetBacku
		SomeArgs args = SomeArgs.obtain();
		args.arg1 = widget.host;
		args.arg2 = widget.host.callbacks;
		args.arg3 = updateViews;
		args.arg3 = updateViews.clone();
		args.arg4 = requestTime;
		args.argi1 = widget.appWidgetId;