Dispose HideNavInputEventReceiver on PhoneWindowManager's handler

Disposal of input event receiver needs to happen on the handler
specified for receiving the inputs, otherwise nativeFinishInputEvent
could crash due to race with native dispose.

Instead of disposing mInputConsumer in beginLayoutLw(), post to
PhoneWindowManager's handler to dispose, and skip any input events
received after mInputConsumer is set to null by beginLayoutLw().

bug: 26927018
Change-Id: I094eb4472ea68f2c8bd6a428161d7edb11dc8900

1 files changed, 15 insertions, 1 deletions

diff --git a/services/core/java/com/android/server/policy/PhoneWindowManager.java b/services/core/java/com/android/server/policy/PhoneWindowManager.java
index b30817f53cdb..28c06f1eae83 100644
--- a/services/core/java/com/android/server/policy/PhoneWindowManager.java
+++ b/services/core/java/com/android/server/policy/PhoneWindowManager.java
@@ -716,6 +716,7 @@ public class PhoneWindowManager implements WindowManagerPolicy {
     private static final int MSG_REQUEST_TRANSIENT_BARS = 16;
     private static final int MSG_SHOW_TV_PICTURE_IN_PICTURE_MENU = 17;
     private static final int MSG_BACK_LONG_PRESS = 18;
+    private static final int MSG_DISPOSE_INPUT_CONSUMER = 19;
 
     private static final int MSG_REQUEST_TRANSIENT_BARS_ARG_STATUS = 0;
     private static final int MSG_REQUEST_TRANSIENT_BARS_ARG_NAVIGATION = 1;
@@ -783,6 +784,9 @@ public class PhoneWindowManager implements WindowManagerPolicy {
                 case MSG_BACK_LONG_PRESS:
                     backLongPress();
                     break;
+                case MSG_DISPOSE_INPUT_CONSUMER:
+                    disposeInputConsumer((InputConsumer) msg.obj);
+                    break;
             }
         }
     }
@@ -1260,6 +1264,12 @@ public class PhoneWindowManager implements WindowManagerPolicy {
         }
     }
 
+    private void disposeInputConsumer(InputConsumer inputConsumer) {
+        if (inputConsumer != null) {
+            inputConsumer.dismiss();
+        }
+    }
+
     private void sleepPress(long eventTime) {
         if (mShortPressOnSleepBehavior == SHORT_PRESS_SLEEP_GO_TO_SLEEP_AND_GO_HOME) {
             launchHomeFromHotKey(false /* awakenDreams */, true /*respectKeyguard*/);
@@ -3738,6 +3748,9 @@ public class PhoneWindowManager implements WindowManagerPolicy {
                         // When the user taps down, we re-show the nav bar.
                         boolean changed = false;
                         synchronized (mWindowManagerFuncs.getWindowManagerLock()) {
+                            if (mInputConsumer == null) {
+                                return;
+                            }
                             // Any user activity always causes us to show the
                             // navigation controls, if they had been hidden.
                             // We also clear the low profile and only content
@@ -3991,7 +4004,8 @@ public class PhoneWindowManager implements WindowManagerPolicy {
             // bar and ensure the application doesn't see the event.
             if (navVisible || navAllowedHidden) {
                 if (mInputConsumer != null) {
-                    mInputConsumer.dismiss();
+                    mHandler.sendMessage(
+                            mHandler.obtainMessage(MSG_DISPOSE_INPUT_CONSUMER, mInputConsumer));
                     mInputConsumer = null;
                 }
             } else if (mInputConsumer == null) {