Not user generated accessibility events can change the interrogation allowing window.

1. Events not generated by the user can change the interrogation allowing window
   unpredicatably. For example when a ListView lays out its children it fires an
   accessibility events and changes the currently active window while the user
   interaction may be happening in another window say a dialog. Now the interrogation
   allowing window is changed when a new window is shown or the user has touch
   explored it.

bug:5074116

Change-Id: I8dde12bbec807d32445a781eedced9b95312b3e2

2 files changed, 10 insertions, 14 deletions

diff --git a/core/java/android/accessibilityservice/AccessibilityService.java b/core/java/android/accessibilityservice/AccessibilityService.java
index 68c9926..1e238f0 100644
--- a/core/java/android/accessibilityservice/AccessibilityService.java
+++ b/core/java/android/accessibilityservice/AccessibilityService.java
@@ -130,20 +130,11 @@ import android.view.accessibility.AccessibilityNodeInfo;
  * For security purposes an accessibility service can retrieve only the content of the
  * currently active window. The currently active window is defined as the window from
  * which was fired the last event of the following types:
- * {@link AccessibilityEvent#TYPE_TOUCH_EXPLORATION_GESTURE_START},
- * {@link AccessibilityEvent#TYPE_TOUCH_EXPLORATION_GESTURE_END},
- * {@link AccessibilityEvent#TYPE_VIEW_CLICKED},
- * {@link AccessibilityEvent#TYPE_VIEW_FOCUSED},
+ * {@link AccessibilityEvent#TYPE_WINDOW_STATE_CHANGED},
  * {@link AccessibilityEvent#TYPE_VIEW_HOVER_ENTER},
  * {@link AccessibilityEvent#TYPE_VIEW_HOVER_EXIT},
- * {@link AccessibilityEvent#TYPE_VIEW_LONG_CLICKED},
- * {@link AccessibilityEvent#TYPE_VIEW_SELECTED},
- * {@link AccessibilityEvent#TYPE_VIEW_TEXT_CHANGED},
- * {@link AccessibilityEvent#TYPE_WINDOW_STATE_CHANGED},
- * {@link AccessibilityEvent#TYPE_VIEW_SCROLLED},
- * {@link AccessibilityEvent#TYPE_VIEW_TEXT_SELECTION_CHANGED},
- * {@link AccessibilityEvent#TYPE_WINDOW_CONTENT_CHANGED}.
- * In other words, the active window is the one where the user interaction is taking place.
+ * In other words, the last window that was shown or the last window that the user has touched
+ * during touch exploration.
  * </p>
  * <p>
  * The entry point for retrieving window content is through calling
diff --git a/services/java/com/android/server/accessibility/AccessibilityManagerService.java b/services/java/com/android/server/accessibility/AccessibilityManagerService.java
index 92647e6..d0f8843 100644
--- a/services/java/com/android/server/accessibility/AccessibilityManagerService.java
+++ b/services/java/com/android/server/accessibility/AccessibilityManagerService.java
@@ -1205,6 +1205,10 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub
             | AccessibilityEvent.TYPE_VIEW_TEXT_SELECTION_CHANGED
             | AccessibilityEvent.TYPE_VIEW_SCROLLED;
 
+        private static final int RETRIEVAL_ALLOWING_WINDOW_CHANGE_EVENT_TYPES =
+            AccessibilityEvent.TYPE_WINDOW_STATE_CHANGED | AccessibilityEvent.TYPE_VIEW_HOVER_ENTER
+            | AccessibilityEvent.TYPE_VIEW_HOVER_EXIT;
+
         private int mRetrievalAlowingWindowId;
 
         private boolean canDispatchAccessibilityEvent(AccessibilityEvent event) {
@@ -1216,9 +1220,10 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub
         public void updateRetrievalAllowingWindowAndEventSourceLocked(AccessibilityEvent event) {
             final int windowId = event.getWindowId();
             final int eventType = event.getEventType();
-            if ((eventType & RETRIEVAL_ALLOWING_EVENT_TYPES) != 0) {
+            if ((eventType & RETRIEVAL_ALLOWING_WINDOW_CHANGE_EVENT_TYPES) != 0) {
                 mRetrievalAlowingWindowId = windowId;
-            } else { 
+            }
+            if ((eventType & RETRIEVAL_ALLOWING_EVENT_TYPES) == 0) {
                 event.setSource(null);
             }
         }