Fixed index out of bounds issue when removing windows.

Child windows are also removed when WMS.removeWindowInnerLocked()
is called to removed a window. This causes the number of windows
to decrement by more than 1 which causes an out of bounds exception
in AppWindowToken.removeAllWindows() which was expecting a decrement
of 1. Changed code to only continue looping if the size of the
Windows array is still greater than 0.

Bug: 18202119
Change-Id: I6124717272c552ec98e89cbacaadcd964fdba02e

1 files changed, 10 insertions, 4 deletions

diff --git a/services/core/java/com/android/server/wm/AppWindowToken.java b/services/core/java/com/android/server/wm/AppWindowToken.java
index b2575e6..1086eb2 100644
--- a/services/core/java/com/android/server/wm/AppWindowToken.java
+++ b/services/core/java/com/android/server/wm/AppWindowToken.java
@@ -252,11 +252,17 @@ class AppWindowToken extends WindowToken {
         return false;
     }
 
+    @Override
     void removeAllWindows() {
-        for (int winNdx = allAppWindows.size() - 1; winNdx >= 0; --winNdx) {
-            WindowState win = allAppWindows.get(winNdx);
-            if (WindowManagerService.DEBUG_WINDOW_MOVEMENT) Slog.w(WindowManagerService.TAG,
-                    "removeAllWindows: removing win=" + win);
+        int winNdx;
+        while ((winNdx = allAppWindows.size()) > 0) {
+            WindowState win = allAppWindows.get(winNdx - 1);
+            if (WindowManagerService.DEBUG_WINDOW_MOVEMENT) {
+                Slog.w(WindowManagerService.TAG, "removeAllWindows: removing win=" + win);
+            }
+
+            // {@link WindowManagerService.removeWindowLocked} may remove multiple entries from
+            // {@link #allAppWindows} if the window to be removed has child windows.
             win.mService.removeWindowLocked(win.mSession, win);
         }
     }