From 68dd2e864412851cd4e8b00c02a3a9ff0347df32 Mon Sep 17 00:00:00 2001 From: Vladislav Kaznacheev Date: Thu, 22 Oct 2015 17:06:40 -0700 Subject: Fix cross-app drag and drop crash. A DragEvent created in DragState.broadcastDragEndedLw could be recycled twice if one of the notified windows belongs to the system process. In this case the same instance of DragEvent is recycled first inside the event handler, and then the second time before exiting the function (which causes a RuntimeException). Added a Pid check similar to another four places in this class where dispatchDragEvent is called. Bug: 25079983 Change-Id: Ia7c1b9258a0c624bc7e2451650e2fb362848a16d --- services/core/java/com/android/server/wm/DragState.java | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/services/core/java/com/android/server/wm/DragState.java b/services/core/java/com/android/server/wm/DragState.java index 352168283229..f5e97e5a5d7c 100644 --- a/services/core/java/com/android/server/wm/DragState.java +++ b/services/core/java/com/android/server/wm/DragState.java @@ -265,21 +265,27 @@ class DragState { } void broadcastDragEndedLw() { + final int myPid = Process.myPid(); + if (WindowManagerService.DEBUG_DRAG) { Slog.d(WindowManagerService.TAG, "broadcasting DRAG_ENDED"); } - DragEvent evt = DragEvent.obtain(DragEvent.ACTION_DRAG_ENDED, - 0, 0, null, null, null, null, mDragResult); - for (WindowState ws: mNotifiedWindows) { + for (WindowState ws : mNotifiedWindows) { + DragEvent evt = DragEvent.obtain(DragEvent.ACTION_DRAG_ENDED, + 0, 0, null, null, null, null, mDragResult); try { ws.mClient.dispatchDragEvent(evt); } catch (RemoteException e) { Slog.w(WindowManagerService.TAG, "Unable to drag-end window " + ws); } + // if the current window is in the same process, + // the dispatch has already recycled the event + if (myPid != ws.mSession.mPid) { + evt.recycle(); + } } mNotifiedWindows.clear(); mDragInProgress = false; - evt.recycle(); } void endDragLw() { -- cgit v1.2.3-59-g8ed1b