6 files changed, 29 insertions, 3 deletions
diff --git a/libs/androidfw/ResourceTypes.cpp b/libs/androidfw/ResourceTypes.cpp
index 2ad2e76cc696..8a035dbbc0f5 100644
--- a/libs/androidfw/ResourceTypes.cpp
+++ b/libs/androidfw/ResourceTypes.cpp
@@ -6902,9 +6902,8 @@ std::unique_ptr<DynamicRefTable> DynamicRefTable::clone() const {
 status_t DynamicRefTable::load(const ResTable_lib_header* const header)
 {
     const uint32_t entryCount = dtohl(header->count);
-    const uint32_t sizeOfEntries = sizeof(ResTable_lib_entry) * entryCount;
     const uint32_t expectedSize = dtohl(header->header.size) - dtohl(header->header.headerSize);
-    if (sizeOfEntries > expectedSize) {
+    if (entryCount > (expectedSize / sizeof(ResTable_lib_entry))) {
         ALOGE("ResTable_lib_header size %u is too small to fit %u entries (x %u).",
                 expectedSize, entryCount, (uint32_t)sizeof(ResTable_lib_entry));
         return UNKNOWN_ERROR;
diff --git a/libs/hwui/DisplayListOps.in b/libs/hwui/DisplayListOps.in
index 2deb5657c877..4a252afc1df3 100644
--- a/libs/hwui/DisplayListOps.in
+++ b/libs/hwui/DisplayListOps.in
@@ -49,3 +49,4 @@ X(DrawVertices)
 X(DrawAtlas) 
 X(DrawShadowRec)
 X(DrawVectorDrawable)
+X(DrawWebView)
diff --git a/libs/hwui/RecordingCanvas.cpp b/libs/hwui/RecordingCanvas.cpp
index c8eb1ca55910..c0df2faf120a 100644
--- a/libs/hwui/RecordingCanvas.cpp
+++ b/libs/hwui/RecordingCanvas.cpp
@@ -16,6 +16,7 @@
 
 #include "RecordingCanvas.h"
 
+#include "pipeline/skia/FunctorDrawable.h"
 #include "VectorDrawable.h"
 
 #include "SkAndroidFrameworkUtils.h"
@@ -496,6 +497,16 @@ struct DrawVectorDrawable final : Op {
     SkPaint paint;
     BitmapPalette palette;
 };
+struct DrawWebView final : Op {
+    static const auto kType = Type::DrawWebView;
+    DrawWebView(skiapipeline::FunctorDrawable* drawable) : drawable(sk_ref_sp(drawable)) {}
+    sk_sp<skiapipeline::FunctorDrawable> drawable;
+    // We can't invoke SkDrawable::draw directly, because VkFunctorDrawable expects
+    // SkDrawable::onSnapGpuDrawHandler callback instead of SkDrawable::onDraw.
+    // SkCanvas::drawDrawable/SkGpuDevice::drawDrawable has the logic to invoke
+    // onSnapGpuDrawHandler.
+    void draw(SkCanvas* c, const SkMatrix&) const { c->drawDrawable(drawable.get()); }
+};
 }
 
 template <typename T, typename... Args>
@@ -680,6 +691,9 @@ void DisplayListData::drawShadowRec(const SkPath& path, const SkDrawShadowRec& r
 void DisplayListData::drawVectorDrawable(VectorDrawableRoot* tree) {
     this->push<DrawVectorDrawable>(0, tree);
 }
+void DisplayListData::drawWebView(skiapipeline::FunctorDrawable* drawable) {
+    this->push<DrawWebView>(0, drawable);
+}
 
 typedef void (*draw_fn)(const void*, SkCanvas*, const SkMatrix&);
 typedef void (*void_fn)(const void*);
@@ -986,5 +1000,9 @@ void RecordingCanvas::drawVectorDrawable(VectorDrawableRoot* tree) {
     fDL->drawVectorDrawable(tree);
 }
 
+void RecordingCanvas::drawWebView(skiapipeline::FunctorDrawable* drawable) {
+    fDL->drawWebView(drawable);
+}
+
 }  // namespace uirenderer
 }  // namespace android
diff --git a/libs/hwui/RecordingCanvas.h b/libs/hwui/RecordingCanvas.h
index 16ec877002f7..a79b7c00ba04 100644
--- a/libs/hwui/RecordingCanvas.h
+++ b/libs/hwui/RecordingCanvas.h
@@ -36,6 +36,10 @@
 namespace android {
 namespace uirenderer {
 
+namespace skiapipeline {
+class FunctorDrawable;
+}
+
 enum class DisplayListOpType : uint8_t {
 #define X(T) T,
 #include "DisplayListOps.in"
@@ -119,6 +123,7 @@ private:
                    SkBlendMode, const SkRect*, const SkPaint*);
     void drawShadowRec(const SkPath&, const SkDrawShadowRec&);
     void drawVectorDrawable(VectorDrawableRoot* tree);
+    void drawWebView(skiapipeline::FunctorDrawable*);
 
     template <typename T, typename... Args>
     void* push(size_t, Args&&...);
@@ -203,6 +208,7 @@ public:
     void onDrawShadowRec(const SkPath&, const SkDrawShadowRec&) override;
 
     void drawVectorDrawable(VectorDrawableRoot* tree);
+    void drawWebView(skiapipeline::FunctorDrawable*);
 
     /**
      * If "isClipMayBeComplex" returns false, it is guaranteed the current clip is a rectangle.
diff --git a/libs/hwui/hwui/MinikinSkia.h b/libs/hwui/hwui/MinikinSkia.h
index 90f7d48a47ee..298967689cd9 100644
--- a/libs/hwui/hwui/MinikinSkia.h
+++ b/libs/hwui/hwui/MinikinSkia.h
@@ -20,6 +20,8 @@
 #include <SkRefCnt.h>
 #include <cutils/compiler.h>
 #include <minikin/MinikinFont.h>
+#include <string>
+#include <string_view>
 
 class SkFont;
 class SkTypeface;
diff --git a/libs/hwui/pipeline/skia/SkiaRecordingCanvas.cpp b/libs/hwui/pipeline/skia/SkiaRecordingCanvas.cpp
index 0db5133037b0..d67cf8c9c73f 100644
--- a/libs/hwui/pipeline/skia/SkiaRecordingCanvas.cpp
+++ b/libs/hwui/pipeline/skia/SkiaRecordingCanvas.cpp
@@ -158,7 +158,7 @@ void SkiaRecordingCanvas::drawWebViewFunctor(int functor) {
         functorDrawable = mDisplayList->allocateDrawable<GLFunctorDrawable>(functor, asSkCanvas());
     }
     mDisplayList->mChildFunctors.push_back(functorDrawable);
-    drawDrawable(functorDrawable);
+    mRecorder.drawWebView(functorDrawable);
 #endif
 }