Make node retrieval methods in AccessibilityManagerService use separate Region instances to make them thread safe.
b/21087793
Change-Id: Ice690e3d7494788fb9e1e234a54f14831bd4e0d3
(cherry picked from commit ebd8eb4610d6bb9322a374f8965a78ba1c39ee63)
diff --git a/core/java/android/view/AccessibilityInteractionController.java b/core/java/android/view/AccessibilityInteractionController.java
index 3781d40..28e78bf 100644
--- a/core/java/android/view/AccessibilityInteractionController.java
+++ b/core/java/android/view/AccessibilityInteractionController.java
@@ -19,6 +19,7 @@
import android.graphics.Point;
import android.graphics.Rect;
import android.graphics.Region;
+import android.os.Binder;
import android.os.Bundle;
import android.os.Handler;
import android.os.Looper;
@@ -158,7 +159,9 @@
try {
mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
applyAppScaleAndMagnificationSpecIfNeeded(infos, spec);
- if (spec != null) {
+ // Recycle if called from another process. Specs are cached in the
+ // system process and obtained from a pool when read from parcel.
+ if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
spec.recycle();
}
adjustIsVisibleToUserIfNeeded(infos, interactiveRegion);
@@ -167,6 +170,12 @@
} catch (RemoteException re) {
/* ignore - the other side will time out */
}
+
+ // Recycle if called from the same process. Regions are obtained in
+ // the system process and instantiated when read from parcel.
+ if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+ interactiveRegion.recycle();
+ }
}
}
@@ -244,7 +253,9 @@
try {
mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
applyAppScaleAndMagnificationSpecIfNeeded(infos, spec);
- if (spec != null) {
+ // Recycle if called from another process. Specs are cached in the
+ // system process and obtained from a pool when read from parcel.
+ if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
spec.recycle();
}
adjustIsVisibleToUserIfNeeded(infos, interactiveRegion);
@@ -252,6 +263,12 @@
} catch (RemoteException re) {
/* ignore - the other side will time out */
}
+
+ // Recycle if called from the same process. Regions are obtained in
+ // the system process and instantiated when read from parcel.
+ if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+ interactiveRegion.recycle();
+ }
}
}
@@ -354,7 +371,9 @@
try {
mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
applyAppScaleAndMagnificationSpecIfNeeded(infos, spec);
- if (spec != null) {
+ // Recycle if called from another process. Specs are cached in the
+ // system process and obtained from a pool when read from parcel.
+ if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
spec.recycle();
}
adjustIsVisibleToUserIfNeeded(infos, interactiveRegion);
@@ -362,6 +381,12 @@
} catch (RemoteException re) {
/* ignore - the other side will time out */
}
+
+ // Recycle if called from the same process. Regions are obtained in
+ // the system process and instantiated when read from parcel.
+ if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+ interactiveRegion.recycle();
+ }
}
}
@@ -468,7 +493,9 @@
try {
mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
applyAppScaleAndMagnificationSpecIfNeeded(focused, spec);
- if (spec != null) {
+ // Recycle if called from another process. Specs are cached in the
+ // system process and obtained from a pool when read from parcel.
+ if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
spec.recycle();
}
adjustIsVisibleToUserIfNeeded(focused, interactiveRegion);
@@ -476,6 +503,12 @@
} catch (RemoteException re) {
/* ignore - the other side will time out */
}
+
+ // Recycle if called from the same process. Regions are obtained in
+ // the system process and instantiated when read from parcel.
+ if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+ interactiveRegion.recycle();
+ }
}
}
@@ -545,7 +578,9 @@
try {
mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
applyAppScaleAndMagnificationSpecIfNeeded(next, spec);
- if (spec != null) {
+ // Recycle if called from another process. Specs are cached in the
+ // system process and obtained from a pool when read from parcel.
+ if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
spec.recycle();
}
adjustIsVisibleToUserIfNeeded(next, interactiveRegion);
@@ -553,6 +588,12 @@
} catch (RemoteException re) {
/* ignore - the other side will time out */
}
+
+ // Recycle if called from the same process. Regions are obtained in
+ // the system process and instantiated when read from parcel.
+ if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+ interactiveRegion.recycle();
+ }
}
}
diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
index 860939c..9c21a1a 100644
--- a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
+++ b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
@@ -166,8 +166,6 @@
private final List<AccessibilityServiceInfo> mEnabledServicesForFeedbackTempList =
new ArrayList<>();
- private final Region mTempRegion = new Region();
-
private final Rect mTempRect = new Rect();
private final Rect mTempRect1 = new Rect();
@@ -2241,7 +2239,7 @@
throws RemoteException {
final int resolvedWindowId;
IAccessibilityInteractionConnection connection = null;
- Region partialInteractiveRegion = mTempRegion;
+ Region partialInteractiveRegion = Region.obtain();
synchronized (mLock) {
// We treat calls from a profile as if made by its parent as profiles
// share the accessibility state of the parent. The call below
@@ -2265,6 +2263,7 @@
}
if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
resolvedWindowId, partialInteractiveRegion)) {
+ partialInteractiveRegion.recycle();
partialInteractiveRegion = null;
}
}
@@ -2282,6 +2281,10 @@
}
} finally {
Binder.restoreCallingIdentity(identityToken);
+ // Recycle if passed to another process.
+ if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+ partialInteractiveRegion.recycle();
+ }
}
return false;
}
@@ -2293,7 +2296,7 @@
throws RemoteException {
final int resolvedWindowId;
IAccessibilityInteractionConnection connection = null;
- Region partialInteractiveRegion = mTempRegion;
+ Region partialInteractiveRegion = Region.obtain();
synchronized (mLock) {
// We treat calls from a profile as if made by its parent as profiles
// share the accessibility state of the parent. The call below
@@ -2317,6 +2320,7 @@
}
if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
resolvedWindowId, partialInteractiveRegion)) {
+ partialInteractiveRegion.recycle();
partialInteractiveRegion = null;
}
}
@@ -2334,6 +2338,10 @@
}
} finally {
Binder.restoreCallingIdentity(identityToken);
+ // Recycle if passed to another process.
+ if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+ partialInteractiveRegion.recycle();
+ }
}
return false;
}
@@ -2345,7 +2353,7 @@
long interrogatingTid) throws RemoteException {
final int resolvedWindowId;
IAccessibilityInteractionConnection connection = null;
- Region partialInteractiveRegion = mTempRegion;
+ Region partialInteractiveRegion = Region.obtain();
synchronized (mLock) {
// We treat calls from a profile as if made by its parent as profiles
// share the accessibility state of the parent. The call below
@@ -2369,6 +2377,7 @@
}
if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
resolvedWindowId, partialInteractiveRegion)) {
+ partialInteractiveRegion.recycle();
partialInteractiveRegion = null;
}
}
@@ -2386,6 +2395,10 @@
}
} finally {
Binder.restoreCallingIdentity(identityToken);
+ // Recycle if passed to another process.
+ if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+ partialInteractiveRegion.recycle();
+ }
}
return false;
}
@@ -2397,7 +2410,7 @@
throws RemoteException {
final int resolvedWindowId;
IAccessibilityInteractionConnection connection = null;
- Region partialInteractiveRegion = mTempRegion;
+ Region partialInteractiveRegion = Region.obtain();
synchronized (mLock) {
// We treat calls from a profile as if made by its parent as profiles
// share the accessibility state of the parent. The call below
@@ -2422,6 +2435,7 @@
}
if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
resolvedWindowId, partialInteractiveRegion)) {
+ partialInteractiveRegion.recycle();
partialInteractiveRegion = null;
}
}
@@ -2439,6 +2453,10 @@
}
} finally {
Binder.restoreCallingIdentity(identityToken);
+ // Recycle if passed to another process.
+ if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+ partialInteractiveRegion.recycle();
+ }
}
return false;
}
@@ -2450,7 +2468,7 @@
throws RemoteException {
final int resolvedWindowId;
IAccessibilityInteractionConnection connection = null;
- Region partialInteractiveRegion = mTempRegion;
+ Region partialInteractiveRegion = Region.obtain();
synchronized (mLock) {
// We treat calls from a profile as if made by its parent as profiles
// share the accessibility state of the parent. The call below
@@ -2474,6 +2492,7 @@
}
if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
resolvedWindowId, partialInteractiveRegion)) {
+ partialInteractiveRegion.recycle();
partialInteractiveRegion = null;
}
}
@@ -2491,6 +2510,10 @@
}
} finally {
Binder.restoreCallingIdentity(identityToken);
+ // Recycle if passed to another process.
+ if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+ partialInteractiveRegion.recycle();
+ }
}
return false;
}