From 69fcbccf476ffc55af4da4dfedc72c3de8f91ce8 Mon Sep 17 00:00:00 2001
From: Romain Guy <romainguy@google.com>
Date: Fri, 30 Nov 2012 15:29:15 -0800
Subject: Fix crash in TextDropShadowCache

The lengths used to copy/read arrays were completely wrong.

Change-Id: If21f23a73cce59bbd32975760e6d728eeeb9e40d
---
 libs/hwui/TextDropShadowCache.cpp | 12 ++++++++----
 libs/hwui/TextDropShadowCache.h   |  6 ++++--
 2 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/libs/hwui/TextDropShadowCache.cpp b/libs/hwui/TextDropShadowCache.cpp
index 4d80f7382318..9c7a5ab3d077 100644
--- a/libs/hwui/TextDropShadowCache.cpp
+++ b/libs/hwui/TextDropShadowCache.cpp
@@ -30,7 +30,7 @@ namespace uirenderer {
 ///////////////////////////////////////////////////////////////////////////////
 
 hash_t ShadowText::hash() const {
-    uint32_t charCount = len * sizeof(char16_t);
+    uint32_t charCount = len / sizeof(char16_t);
     uint32_t hash = JenkinsHashMix(0, len);
     hash = JenkinsHashMix(hash, android::hash_type(radius));
     hash = JenkinsHashMix(hash, android::hash_type(textSize));
@@ -38,9 +38,13 @@ hash_t ShadowText::hash() const {
     hash = JenkinsHashMix(hash, flags);
     hash = JenkinsHashMix(hash, android::hash_type(italicStyle));
     hash = JenkinsHashMix(hash, android::hash_type(scaleX));
-    hash = JenkinsHashMixShorts(hash, text, charCount);
-    for (uint32_t i = 0; i < charCount * 2; i++) {
-        hash = JenkinsHashMix(hash, android::hash_type(positions[i]));
+    if (text) {
+        hash = JenkinsHashMixShorts(hash, text, charCount);
+    }
+    if (positions) {
+        for (uint32_t i = 0; i < charCount * 2; i++) {
+            hash = JenkinsHashMix(hash, android::hash_type(positions[i]));
+        }
     }
     return JenkinsHashWhiten(hash);
 }
diff --git a/libs/hwui/TextDropShadowCache.h b/libs/hwui/TextDropShadowCache.h
index 38bf05a0a0d1..0bed72b6b03f 100644
--- a/libs/hwui/TextDropShadowCache.h
+++ b/libs/hwui/TextDropShadowCache.h
@@ -35,6 +35,7 @@ struct ShadowText {
             flags(0), italicStyle(0.0f), scaleX(0), text(NULL), positions(NULL) {
     }
 
+    // len is the number of bytes in text
     ShadowText(SkPaint* paint, float radius, uint32_t len, const char* srcText,
             const float* positions):
             len(len), radius(radius), positions(positions) {
@@ -69,11 +70,12 @@ struct ShadowText {
     }
 
     void copyTextLocally() {
-        str.setTo((const char16_t*) text, len * sizeof(char16_t));
+        uint32_t charCount = len / sizeof(char16_t);
+        str.setTo((const char16_t*) text, charCount);
         text = str.string();
         if (positions != NULL) {
             positionsCopy.clear();
-            positionsCopy.appendArray(positions, len);
+            positionsCopy.appendArray(positions, charCount * 2);
             positions = positionsCopy.array();
         }
     }
-- 
cgit v1.2.3-59-g8ed1b