Make node retrieval methods in AccessibilityManagerService use separate Region instances to make them thread safe.

b/21087793

Change-Id: Ice690e3d7494788fb9e1e234a54f14831bd4e0d3
(cherry picked from commit ebd8eb4610d6bb9322a374f8965a78ba1c39ee63)

2 files changed, 76 insertions, 12 deletions

diff --git a/core/java/android/view/AccessibilityInteractionController.java b/core/java/android/view/AccessibilityInteractionController.java
index 3781d40..28e78bf 100644
--- a/core/java/android/view/AccessibilityInteractionController.java
+++ b/core/java/android/view/AccessibilityInteractionController.java
@@ -19,6 +19,7 @@ package android.view;
 import android.graphics.Point;
 import android.graphics.Rect;
 import android.graphics.Region;
+import android.os.Binder;
 import android.os.Bundle;
 import android.os.Handler;
 import android.os.Looper;
@@ -158,7 +159,9 @@ final class AccessibilityInteractionController {
             try {
                 mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
                 applyAppScaleAndMagnificationSpecIfNeeded(infos, spec);
-                if (spec != null) {
+                // Recycle if called from another process. Specs are cached in the
+                // system process and obtained from a pool when read from parcel.
+                if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
                     spec.recycle();
                 }
                 adjustIsVisibleToUserIfNeeded(infos, interactiveRegion);
@@ -167,6 +170,12 @@ final class AccessibilityInteractionController {
             } catch (RemoteException re) {
                 /* ignore - the other side will time out */
             }
+
+            // Recycle if called from the same process. Regions are obtained in
+            // the system process and instantiated  when read from parcel.
+            if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+                interactiveRegion.recycle();
+            }
         }
     }
 
@@ -244,7 +253,9 @@ final class AccessibilityInteractionController {
             try {
                 mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
                 applyAppScaleAndMagnificationSpecIfNeeded(infos, spec);
-                if (spec != null) {
+                // Recycle if called from another process. Specs are cached in the
+                // system process and obtained from a pool when read from parcel.
+                if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
                     spec.recycle();
                 }
                 adjustIsVisibleToUserIfNeeded(infos, interactiveRegion);
@@ -252,6 +263,12 @@ final class AccessibilityInteractionController {
             } catch (RemoteException re) {
                 /* ignore - the other side will time out */
             }
+
+            // Recycle if called from the same process. Regions are obtained in
+            // the system process and instantiated  when read from parcel.
+            if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+                interactiveRegion.recycle();
+            }
         }
     }
 
@@ -354,7 +371,9 @@ final class AccessibilityInteractionController {
             try {
                 mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
                 applyAppScaleAndMagnificationSpecIfNeeded(infos, spec);
-                if (spec != null) {
+                // Recycle if called from another process. Specs are cached in the
+                // system process and obtained from a pool when read from parcel.
+                if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
                     spec.recycle();
                 }
                 adjustIsVisibleToUserIfNeeded(infos, interactiveRegion);
@@ -362,6 +381,12 @@ final class AccessibilityInteractionController {
             } catch (RemoteException re) {
                 /* ignore - the other side will time out */
             }
+
+            // Recycle if called from the same process. Regions are obtained in
+            // the system process and instantiated  when read from parcel.
+            if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+                interactiveRegion.recycle();
+            }
         }
     }
 
@@ -468,7 +493,9 @@ final class AccessibilityInteractionController {
             try {
                 mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
                 applyAppScaleAndMagnificationSpecIfNeeded(focused, spec);
-                if (spec != null) {
+                // Recycle if called from another process. Specs are cached in the
+                // system process and obtained from a pool when read from parcel.
+                if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
                     spec.recycle();
                 }
                 adjustIsVisibleToUserIfNeeded(focused, interactiveRegion);
@@ -476,6 +503,12 @@ final class AccessibilityInteractionController {
             } catch (RemoteException re) {
                 /* ignore - the other side will time out */
             }
+
+            // Recycle if called from the same process. Regions are obtained in
+            // the system process and instantiated  when read from parcel.
+            if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+                interactiveRegion.recycle();
+            }
         }
     }
 
@@ -545,7 +578,9 @@ final class AccessibilityInteractionController {
             try {
                 mViewRootImpl.mAttachInfo.mAccessibilityFetchFlags = 0;
                 applyAppScaleAndMagnificationSpecIfNeeded(next, spec);
-                if (spec != null) {
+                // Recycle if called from another process. Specs are cached in the
+                // system process and obtained from a pool when read from parcel.
+                if (spec != null && android.os.Process.myPid() != Binder.getCallingPid()) {
                     spec.recycle();
                 }
                 adjustIsVisibleToUserIfNeeded(next, interactiveRegion);
@@ -553,6 +588,12 @@ final class AccessibilityInteractionController {
             } catch (RemoteException re) {
                 /* ignore - the other side will time out */
             }
+
+            // Recycle if called from the same process. Regions are obtained in
+            // the system process and instantiated  when read from parcel.
+            if (interactiveRegion != null && android.os.Process.myPid() == Binder.getCallingPid()) {
+                interactiveRegion.recycle();
+            }
         }
     }
 
diff --git a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
index 860939c..9c21a1a 100644
--- a/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
+++ b/services/accessibility/java/com/android/server/accessibility/AccessibilityManagerService.java
@@ -166,8 +166,6 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
     private final List<AccessibilityServiceInfo> mEnabledServicesForFeedbackTempList =
             new ArrayList<>();
 
-    private final Region mTempRegion = new Region();
-
     private final Rect mTempRect = new Rect();
 
     private final Rect mTempRect1 = new Rect();
@@ -2241,7 +2239,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 throws RemoteException {
             final int resolvedWindowId;
             IAccessibilityInteractionConnection connection = null;
-            Region partialInteractiveRegion = mTempRegion;
+            Region partialInteractiveRegion = Region.obtain();
             synchronized (mLock) {
                 // We treat calls from a profile as if made by its parent as profiles
                 // share the accessibility state of the parent. The call below
@@ -2265,6 +2263,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
                         resolvedWindowId, partialInteractiveRegion)) {
+                    partialInteractiveRegion.recycle();
                     partialInteractiveRegion = null;
                 }
             }
@@ -2282,6 +2281,10 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
             } finally {
                 Binder.restoreCallingIdentity(identityToken);
+                // Recycle if passed to another process.
+                if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+                    partialInteractiveRegion.recycle();
+                }
             }
             return false;
         }
@@ -2293,7 +2296,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 throws RemoteException {
             final int resolvedWindowId;
             IAccessibilityInteractionConnection connection = null;
-            Region partialInteractiveRegion = mTempRegion;
+            Region partialInteractiveRegion = Region.obtain();
             synchronized (mLock) {
                 // We treat calls from a profile as if made by its parent as profiles
                 // share the accessibility state of the parent. The call below
@@ -2317,6 +2320,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
                         resolvedWindowId, partialInteractiveRegion)) {
+                    partialInteractiveRegion.recycle();
                     partialInteractiveRegion = null;
                 }
             }
@@ -2334,6 +2338,10 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
             } finally {
                 Binder.restoreCallingIdentity(identityToken);
+                // Recycle if passed to another process.
+                if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+                    partialInteractiveRegion.recycle();
+                }
             }
             return false;
         }
@@ -2345,7 +2353,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 long interrogatingTid) throws RemoteException {
             final int resolvedWindowId;
             IAccessibilityInteractionConnection connection = null;
-            Region partialInteractiveRegion = mTempRegion;
+            Region partialInteractiveRegion = Region.obtain();
             synchronized (mLock) {
                 // We treat calls from a profile as if made by its parent as profiles
                 // share the accessibility state of the parent. The call below
@@ -2369,6 +2377,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
                         resolvedWindowId, partialInteractiveRegion)) {
+                    partialInteractiveRegion.recycle();
                     partialInteractiveRegion = null;
                 }
             }
@@ -2386,6 +2395,10 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
             } finally {
                 Binder.restoreCallingIdentity(identityToken);
+                // Recycle if passed to another process.
+                if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+                    partialInteractiveRegion.recycle();
+                }
             }
             return false;
         }
@@ -2397,7 +2410,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 throws RemoteException {
             final int resolvedWindowId;
             IAccessibilityInteractionConnection connection = null;
-            Region partialInteractiveRegion = mTempRegion;
+            Region partialInteractiveRegion = Region.obtain();
             synchronized (mLock) {
                 // We treat calls from a profile as if made by its parent as profiles
                 // share the accessibility state of the parent. The call below
@@ -2422,6 +2435,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
                         resolvedWindowId, partialInteractiveRegion)) {
+                    partialInteractiveRegion.recycle();
                     partialInteractiveRegion = null;
                 }
             }
@@ -2439,6 +2453,10 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
             } finally {
                 Binder.restoreCallingIdentity(identityToken);
+                // Recycle if passed to another process.
+                if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+                    partialInteractiveRegion.recycle();
+                }
             }
             return false;
         }
@@ -2450,7 +2468,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 throws RemoteException {
             final int resolvedWindowId;
             IAccessibilityInteractionConnection connection = null;
-            Region partialInteractiveRegion = mTempRegion;
+            Region partialInteractiveRegion = Region.obtain();
             synchronized (mLock) {
                 // We treat calls from a profile as if made by its parent as profiles
                 // share the accessibility state of the parent. The call below
@@ -2474,6 +2492,7 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
                 if (!mSecurityPolicy.computePartialInteractiveRegionForWindowLocked(
                         resolvedWindowId, partialInteractiveRegion)) {
+                    partialInteractiveRegion.recycle();
                     partialInteractiveRegion = null;
                 }
             }
@@ -2491,6 +2510,10 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
                 }
             } finally {
                 Binder.restoreCallingIdentity(identityToken);
+                // Recycle if passed to another process.
+                if (partialInteractiveRegion != null && Binder.isProxy(connection)) {
+                    partialInteractiveRegion.recycle();
+                }
             }
             return false;
         }