More than one finger at a time can trigger a system crash.

1. The crash was happening if: two active pointers are performing a drag;
   there are some inactive pointers down; the main dragging pointer (we are
   merging the dragging pointers into one) goes up; now an inactive pointer
   goes up and the explorer tries to inject up for the dragging pointer
   which is no longer in the event resulting in a crash. Basically two
   problems: inactive pointers were not ignored; 2) having only one
   active pointer should not only send the up event but also transition
   the explorer in touch exploring state.

bug:6874128

Change-Id: I341fc360ebc074fe3919d5ba3b98ee5cb08dd71e

1 files changed, 4 insertions, 10 deletions

diff --git a/services/java/com/android/server/accessibility/TouchExplorer.java b/services/java/com/android/server/accessibility/TouchExplorer.java
index c84f988..0468b4d 100644
--- a/services/java/com/android/server/accessibility/TouchExplorer.java
+++ b/services/java/com/android/server/accessibility/TouchExplorer.java
@@ -25,7 +25,6 @@ import android.gesture.GestureStore;
 import android.gesture.GestureStroke;
 import android.gesture.Prediction;
 import android.graphics.Rect;
-import android.os.Build;
 import android.os.Handler;
 import android.os.SystemClock;
 import android.util.Slog;
@@ -687,15 +686,10 @@ class TouchExplorer implements EventStreamTransformation {
                 }
             } break;
             case MotionEvent.ACTION_POINTER_UP: {
-                final int activePointerCount = mReceivedPointerTracker.getActivePointerCount();
-                switch (activePointerCount) {
-                    case 1: {
-                        // Send an event to the end of the drag gesture.
-                        sendMotionEvent(event, MotionEvent.ACTION_UP, pointerIdBits, policyFlags);
-                    } break;
-                    default: {
-                        mCurrentState = STATE_TOUCH_EXPLORING;
-                    }
+                final int pointerId = event.getPointerId(event.getActionIndex());
+                if (mReceivedPointerTracker.isActiveOrWasLastActiveUpPointer(pointerId)) {
+                    sendUpForInjectedDownPointers(event, policyFlags);
+                    mCurrentState = STATE_TOUCH_EXPLORING;
                 }
              } break;
             case MotionEvent.ACTION_UP: {