commit 10e6217a8de772395d9b74174eeb1280bfe821aa
author Feng Cao <fengcao@google.com> Sun Jun 07 18:46:19 2020 -0700
committer Feng Cao <fengcao@google.com> Mon Jun 08 18:52:21 2020 -0700
tree ad540dc29866250473fbe68f26bb419250cbb6b5
parent 8083336a8897437f8290de43d30e7fb1b62e9fda

Fix NPE in InlineContentView

* The NPE is due to in the InlineContentView we try to reparent the
  surface view which is no longer attached to the window, this can
  happen if the InlineContentView is attached to window and then
  immediately detached from the window, before the surface package
  is returned from the remote view process.
* Release the surface package immediately in this case, so the
  remote view can be released.

Test: atest android.autofillservice.cts.inline
Bug: 158139090

Change-Id: I9efdf8ba182a1d66334362edcfb6ba58fcdc222a

core/java/android/view/inputmethod/InlineSuggestion.java

diff --git a/core/java/android/view/inputmethod/InlineSuggestion.java b/core/java/android/view/inputmethod/InlineSuggestion.java
index e4ac588..b8893ce 100644
--- a/core/java/android/view/inputmethod/InlineSuggestion.java
+++ b/core/java/android/view/inputmethod/InlineSuggestion.java
@@ -317,8 +317,24 @@
          */
         @MainThread
         private void handleOnSurfacePackage(SurfaceControlViewHost.SurfacePackage surfacePackage) {
+            if (surfacePackage == null) {
+                return;
+            }
+            if (mSurfacePackage != null || mSurfacePackageConsumer == null) {
+                // The surface package is not consumed, release it immediately.
+                surfacePackage.release();
+                try {
+                    mInlineContentProvider.onSurfacePackageReleased();
+                } catch (RemoteException e) {
+                    Slog.w(TAG, "Error calling onSurfacePackageReleased(): " + e);
+                }
+                return;
+            }
             mSurfacePackage = surfacePackage;
-            if (mSurfacePackage != null && mSurfacePackageConsumer != null) {
+            if (mSurfacePackage == null) {
+                return;
+            }
+            if (mSurfacePackageConsumer != null) {
                 mSurfacePackageConsumer.accept(mSurfacePackage);
                 mSurfacePackageConsumer = null;
             }
@@ -334,6 +350,10 @@
                 }
                 mSurfacePackage = null;
             }
+            // Clear the pending surface package consumer, if any. This can happen if the IME
+            // attaches the view to window and then quickly detaches it from the window, before
+            // the surface package requested upon attaching to window was returned.
+            mSurfacePackageConsumer = null;
         }
 
         @MainThread

core/java/android/widget/inline/InlineContentView.java

diff --git a/core/java/android/widget/inline/InlineContentView.java b/core/java/android/widget/inline/InlineContentView.java
index 8657e82..6a85de5 100644
--- a/core/java/android/widget/inline/InlineContentView.java
+++ b/core/java/android/widget/inline/InlineContentView.java
@@ -197,7 +197,9 @@
             mSurfacePackageUpdater.getSurfacePackage(
                     sp -> {
                         if (DEBUG) Log.v(TAG, "Received new SurfacePackage");
-                        mSurfaceView.setChildSurfacePackage(sp);
+                        if (getViewRootImpl() != null) {
+                            mSurfaceView.setChildSurfacePackage(sp);
+                        }
                     });
         }
     }