Merge "Fix sanitizer in handleTransitionLocked." am: 66d9ea6345

am: 201a44a961

Change-Id: I42d2b3c03424b971755d03b6b2e6aa2fc32f3b31

1 files changed, 3 insertions, 2 deletions

diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 7a8737f930..ee85e387b5 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -2163,7 +2163,7 @@ void SurfaceFlinger::handleTransactionLocked(uint32_t transactionFlags)
             // (ie: in drawing state but not in current state)
             // also handle displays that changed
             // (ie: displays that are in both lists)
-            for (size_t i=0 ; i<dc ; i++) {
+            for (size_t i=0 ; i<dc ;) {
                 const ssize_t j = curr.indexOfKey(draw.keyAt(i));
                 if (j < 0) {
                     // in drawing state but not in current state
@@ -2198,7 +2198,7 @@ void SurfaceFlinger::handleTransactionLocked(uint32_t transactionFlags)
                             hw->disconnect(getHwComposer());
                         mDisplays.removeItem(display);
                         mDrawingState.displays.removeItemsAt(i);
-                        dc--; i--;
+                        dc--;
                         // at this point we must loop to the next item
                         continue;
                     }
@@ -2220,6 +2220,7 @@ void SurfaceFlinger::handleTransactionLocked(uint32_t transactionFlags)
                         }
                     }
                 }
+                ++i;
             }
 
             // find displays that were added