Commit 930c982a authored Jun 30, 2025 by huwenbin1 Committed by Aurélien Pomini Jul 29, 2025

[WallpaperManagerService] java.lang.ArrayIndexOutOfBoundsException--Array index out of range: 0



[RootCause]:
1. attachServiceLocked() calls the forEachDisplayConnector() method to traverse the SparseArray, and then executes the connectLocked() method
2. Due to DeadObjectException, the connectLocked() method is executed and the detachWallpaperLocked() method is called according to the logic
3. Then wallpaper.connection.mDisplayConnector.clear() is executed;
4. After that, the size becomes 0, and forEachDisplayConnector reports ArrayIndexOutOfBoundsException when traversing the next element

Details: issue number:428643555

[Modify]:
Re-obtain size() before each access to ensure the index is valid

[Test]
UAT stability

Flag: EXEMPT trivial fix
Bug: 428643555
Test: presubmit

Change-Id: Id5751f9c64bf70f4f779dcb34a50d8a3b6f8eb9a
Signed-off-by: huwenbin1 <huwenbin1@xiaomi.com>

parent 052d5fd9

services/core/java/com/android/server/wallpaper/WallpaperManagerService.java

+6 −2

Original line number	Diff line number	Diff line
		@@ -1075,11 +1075,15 @@ public class WallpaperManagerService extends IWallpaperManager.Stub
		void forEachDisplayConnector(Consumer<DisplayConnector> action) {
		synchronized (mLock) {
		for (int i = mDisplayConnector.size() - 1; i >= 0; i--) {
		// Double check the index. Some actions, such as connectLocked, may revert the
		// wallpaper and clear the list of display connectors in case of failure.
		if (i < mDisplayConnector.size()) {
		final DisplayConnector connector = mDisplayConnector.valueAt(i);
		action.accept(connector);
		}
		}
		}
		}

		int getConnectedEngineSize() {
		int engineSize = 0;