NPE in GMail / TextLine

Bug 5753061

https://android-git.corp.google.com/g/#/c/154756/1 revealed an
other bug in SpanSet. The fitered (non empty) spans were added
in their original position instead of being indexed by count.

The nullation on recycle hence left null holes in the array.

Change-Id: If5c1435cee9a2cb88a608aa8e5f4f2f23382154c

1 files changed, 7 insertions, 7 deletions

diff --git a/core/java/android/text/TextLine.java b/core/java/android/text/TextLine.java
index 303a30e..1e8a2f7 100644
--- a/core/java/android/text/TextLine.java
+++ b/core/java/android/text/TextLine.java
@@ -886,7 +886,7 @@ class TextLine {
                 spanFlags = new int[length];
             }
 
-            int count = 0;
+            numberOfSpans = 0;
             for (int i = 0; i < length; i++) {
                 final E span = allSpans[i];
 
@@ -896,14 +896,13 @@ class TextLine {
 
                 final int spanFlag = spanned.getSpanFlags(span);
 
-                spans[i] = span;
-                spanStarts[i] = spanStart;
-                spanEnds[i] = spanEnd;
-                spanFlags[i] = spanFlag;
+                spans[numberOfSpans] = span;
+                spanStarts[numberOfSpans] = spanStart;
+                spanEnds[numberOfSpans] = spanEnd;
+                spanFlags[numberOfSpans] = spanFlag;
 
-                count++;
+                numberOfSpans++;
             }
-            numberOfSpans = count;
         }
 
         public boolean hasSpansIntersecting(int start, int end) {
@@ -926,6 +925,7 @@ class TextLine {
         }
 
         public void recycle() {
+            // The spans array is guaranteed to be not null when numberOfSpans is > 0
             for (int i = 0; i < numberOfSpans; i++) {
                 spans[i] = null; // prevent a leak: no reference kept when TextLine is recycled
             }