From 6a5657f340b059c92c4e085ba95705c356779780 Mon Sep 17 00:00:00 2001
From: adhiti <adhiti@codeaurora.org>
Date: Tue, 10 Dec 2013 16:09:13 +0530
Subject: Browser: Fix browser force close

Issue: Cursor was accessed by handler thread
       when it was closed. During Orientation change,
       BrowserBookmarksPage#onDestroyView is called
       which clears all the loaders [and cursors].
       Simultaneously ThreadedCursorAdapter#loadRowObject
       is getting called which then calls
       BrowserBookmarksAdapter#getRowObject
       where closed cursor is accessed and force close happens.

Fix: Synchronized cursors wrt main thread and handler thread.
     Checked mCursorAdapter for invalid conditions

CRs-Fixed: 576176
Change-Id: I9f16c2f1a55f35e8256bbf56afce3538850f9d42
---
 src/com/android/browser/BrowserBookmarksPage.java       | 4 +++-
 src/com/android/browser/util/ThreadedCursorAdapter.java | 6 +++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

(limited to 'src')

diff --git a/src/com/android/browser/BrowserBookmarksPage.java b/src/com/android/browser/BrowserBookmarksPage.java
index cb53107..3a0c65a 100644
--- a/src/com/android/browser/BrowserBookmarksPage.java
+++ b/src/com/android/browser/BrowserBookmarksPage.java
@@ -411,7 +411,9 @@ public class BrowserBookmarksPage extends Fragment implements View.OnCreateConte
         LoaderManager lm = getLoaderManager();
         lm.destroyLoader(LOADER_ACCOUNTS);
         for (int id : mBookmarkAdapters.keySet()) {
-            lm.destroyLoader(id);
+            synchronized (mBookmarkAdapters.get(id).mCursorLock) {
+                lm.destroyLoader(id);
+            }
         }
         mBookmarkAdapters.clear();
     }
diff --git a/src/com/android/browser/util/ThreadedCursorAdapter.java b/src/com/android/browser/util/ThreadedCursorAdapter.java
index 72a07ea..d350999 100644
--- a/src/com/android/browser/util/ThreadedCursorAdapter.java
+++ b/src/com/android/browser/util/ThreadedCursorAdapter.java
@@ -39,7 +39,7 @@ public abstract class ThreadedCursorAdapter<T> extends BaseAdapter {
     private static final boolean DEBUG = false;
 
     private Context mContext;
-    private Object mCursorLock = new Object();
+    public Object mCursorLock = new Object();
     private CursorAdapter mCursorAdapter;
     private T mLoadingObject;
     private Handler mLoadHandler;
@@ -150,6 +150,10 @@ public abstract class ThreadedCursorAdapter<T> extends BaseAdapter {
             return;
         }
         synchronized (mCursorLock) {
+            if ((mCursorAdapter == null) || (mCursorAdapter.getCursor() == null)
+                    || mCursorAdapter.getCursor().isClosed()) {
+                return;
+            }
             Cursor c = (Cursor) mCursorAdapter.getItem(position);
             if (c == null || c.isClosed()) {
                 return;
-- 
cgit v1.1