Check for null before returing a chunk from the pool.

Since references can be queued in another thread, the first entry in the pool
could have been queued after processPoolLocked. Check for null and create a new
chunk if the check fails.

1 files changed, 8 insertions, 5 deletions

diff --git a/core/java/android/webkit/ByteArrayBuilder.java b/core/java/android/webkit/ByteArrayBuilder.java
index d32a962..334526b 100644
--- a/core/java/android/webkit/ByteArrayBuilder.java
+++ b/core/java/android/webkit/ByteArrayBuilder.java
@@ -114,14 +114,17 @@ class ByteArrayBuilder {
             length = DEFAULT_CAPACITY;
         }
         synchronized (sPool) {
-            // Process any queued references so that sPool does not contain
-            // dead entries.
+            // Process any queued references and remove them from the pool.
             processPoolLocked();
             if (!sPool.isEmpty()) {
-                return sPool.removeFirst().get();
-            } else {
-                return new Chunk(length);
+                Chunk c = sPool.removeFirst().get();
+                // The first item may have been queued after processPoolLocked
+                // so check for null.
+                if (c != null) {
+                    return c;
+                }
             }
+            return new Chunk(length);
         }
     }