am 94474515: Merge "Prevent memory corruption from use-after-free" into lmp-mr1-dev automerge: bb8d7ff

automerge: 1e5dd46

* commit '1e5dd46133bd47445ba0657692fb86492acad705':
  Prevent memory corruption from use-after-free

1 files changed, 3 insertions, 2 deletions

diff --git a/graphics/java/android/graphics/Bitmap.java b/graphics/java/android/graphics/Bitmap.java
index 1892dcb..132c6ef 100644
--- a/graphics/java/android/graphics/Bitmap.java
+++ b/graphics/java/android/graphics/Bitmap.java
@@ -304,7 +304,7 @@ public final class Bitmap implements Parcelable {
      * there are no more references to this bitmap.
      */
     public void recycle() {
-        if (!mRecycled) {
+        if (!mRecycled && mFinalizer.mNativeBitmap != 0) {
             if (nativeRecycle(mNativeBitmap)) {
                 // return value indicates whether native pixel object was actually recycled.
                 // false indicates that it is still in use at the native level and these
@@ -1571,7 +1571,7 @@ public final class Bitmap implements Parcelable {
     }
 
     private static class BitmapFinalizer {
-        private final long mNativeBitmap;
+        private long mNativeBitmap;
 
         // Native memory allocated for the duration of the Bitmap,
         // if pixel data allocated into native memory, instead of java byte[]
@@ -1597,6 +1597,7 @@ public final class Bitmap implements Parcelable {
                     VMRuntime.getRuntime().registerNativeFree(mNativeAllocationByteCount);
                 }
                 nativeDestructor(mNativeBitmap);
+                mNativeBitmap = 0;
             }
         }
     }