Clean up a11y overlays after service exits or crashes.

Fix: 271490102
Test: atest AccessibilityOverlayTest
Change-Id: I1443d2c98c6ba4801a2e71b247fac7d662173bdf

2 files changed, 27 insertions, 0 deletions

diff --git a/services/accessibility/accessibility.aconfig b/services/accessibility/accessibility.aconfig
index 75ecdb78fe00..a19920f4fc02 100644
--- a/services/accessibility/accessibility.aconfig
+++ b/services/accessibility/accessibility.aconfig
@@ -10,6 +10,13 @@ flag {
 }
 
 flag {
+    name: "cleanup_a11y_overlays"
+    namespace: "accessibility"
+    description: "Removes all attached accessibility overlays when a service is removed."
+    bug: "271490102"
+}
+
+flag {
     name: "deprecate_package_list_observer"
     namespace: "accessibility"
     description: "Stops using the deprecated PackageListObserver."
diff --git a/services/accessibility/java/com/android/server/accessibility/AbstractAccessibilityServiceConnection.java b/services/accessibility/java/com/android/server/accessibility/AbstractAccessibilityServiceConnection.java
index fa73cffb83ea..6d82b749fda3 100644
--- a/services/accessibility/java/com/android/server/accessibility/AbstractAccessibilityServiceConnection.java
+++ b/services/accessibility/java/com/android/server/accessibility/AbstractAccessibilityServiceConnection.java
@@ -224,6 +224,9 @@ abstract class AbstractAccessibilityServiceConnection extends IAccessibilityServ
 
     final SparseArray<IBinder> mOverlayWindowTokens = new SparseArray();
 
+    // All the embedded accessibility overlays that have been added by this service.
+    private List<SurfaceControl> mOverlays = new ArrayList<>();
+
     /** The timestamp of requesting to take screenshot in milliseconds */
     private long mRequestTakeScreenshotTimestampMs;
     /**
@@ -1554,6 +1557,9 @@ abstract class AbstractAccessibilityServiceConnection extends IAccessibilityServ
             final int displayId = displays[i].getDisplayId();
             onDisplayRemoved(displayId);
         }
+        if (Flags.cleanupA11yOverlays()) {
+            detachAllOverlays();
+        }
     }
 
     /**
@@ -2677,6 +2683,7 @@ abstract class AbstractAccessibilityServiceConnection extends IAccessibilityServ
         try {
             mSystemSupport.attachAccessibilityOverlayToDisplay(
                     interactionId, displayId, sc, callback);
+            mOverlays.add(sc);
         } finally {
             Binder.restoreCallingIdentity(identity);
         }
@@ -2707,10 +2714,23 @@ abstract class AbstractAccessibilityServiceConnection extends IAccessibilityServ
                 connection
                         .getRemote()
                         .attachAccessibilityOverlayToWindow(sc, interactionId, callback);
+                mOverlays.add(sc);
             }
 
         } finally {
             Binder.restoreCallingIdentity(identity);
         }
     }
+
+    protected void detachAllOverlays() {
+        SurfaceControl.Transaction t = new SurfaceControl.Transaction();
+        for (SurfaceControl sc : mOverlays) {
+            if (sc.isValid()) {
+                t.reparent(sc, null);
+            }
+        }
+        t.apply();
+        t.close();
+        mOverlays.clear();
+    }
 }