Merge "Fix a11y crash when window layer isn't unique." into nyc-dev

2 files changed, 19 insertions, 2 deletions

diff --git a/core/java/android/util/SparseArray.java b/core/java/android/util/SparseArray.java
index dc965edd7fad..34e6f04f0404 100644
--- a/core/java/android/util/SparseArray.java
+++ b/core/java/android/util/SparseArray.java
@@ -160,6 +160,9 @@ public class SparseArray<E> implements Cloneable {
 
     /**
      * Removes the mapping at the specified index.
+     *
+     * <p>For indices outside of the range <code>0...size()-1</code>,
+     * the behavior is undefined.</p>
      */
     public void removeAt(int index) {
         if (mValues[index] != DELETED) {
@@ -173,6 +176,9 @@ public class SparseArray<E> implements Cloneable {
      *
      * @param index Index to begin at
      * @param size Number of mappings to remove
+     *
+     * <p>For indices outside of the range <code>0...size()-1</code>,
+     * the behavior is undefined.</p>
      */
     public void removeAtRange(int index, int size) {
         final int end = Math.min(mSize, index + size);
@@ -262,6 +268,9 @@ public class SparseArray<E> implements Cloneable {
      * be in ascending order, e.g., <code>keyAt(0)</code> will return the
      * smallest key and <code>keyAt(size()-1)</code> will return the largest
      * key.</p>
+     *
+     * <p>For indices outside of the range <code>0...size()-1</code>,
+     * the behavior is undefined.</p>
      */
     public int keyAt(int index) {
         if (mGarbage) {
@@ -281,6 +290,9 @@ public class SparseArray<E> implements Cloneable {
      * <code>valueAt(0)</code> will return the value associated with the
      * smallest key and <code>valueAt(size()-1)</code> will return the value
      * associated with the largest key.</p>
+     *
+     * <p>For indices outside of the range <code>0...size()-1</code>,
+     * the behavior is undefined.</p>
      */
     @SuppressWarnings("unchecked")
     public E valueAt(int index) {
@@ -295,6 +307,8 @@ public class SparseArray<E> implements Cloneable {
      * Given an index in the range <code>0...size()-1</code>, sets a new
      * value for the <code>index</code>th key-value mapping that this
      * SparseArray stores.
+     *
+     * <p>For indices outside of the range <code>0...size()-1</code>, the behavior is undefined.</p>
      */
     public void setValueAt(int index, E value) {
         if (mGarbage) {
diff --git a/core/java/android/view/accessibility/AccessibilityCache.java b/core/java/android/view/accessibility/AccessibilityCache.java
index 1da305f09f54..28e31c4c7aa8 100644
--- a/core/java/android/view/accessibility/AccessibilityCache.java
+++ b/core/java/android/view/accessibility/AccessibilityCache.java
@@ -221,8 +221,11 @@ final class AccessibilityCache {
                     sortedWindows.put(window.getLayer(), window);
                 }
 
-                List<AccessibilityWindowInfo> windows = new ArrayList<>(windowCount);
-                for (int i = windowCount - 1; i >= 0; i--) {
+                // It's possible in transient conditions for two windows to share the same
+                // layer, which results in sortedWindows being smaller than mWindowCache
+                final int sortedWindowCount = sortedWindows.size();
+                List<AccessibilityWindowInfo> windows = new ArrayList<>(sortedWindowCount);
+                for (int i = sortedWindowCount - 1; i >= 0; i--) {
                     AccessibilityWindowInfo window = sortedWindows.valueAt(i);
                     windows.add(AccessibilityWindowInfo.obtain(window));
                     sortedWindows.removeAt(i);