frameworks/base
Revisión | ee1a0f0cedf96f804e856b8100b75f49a12d9fc9 (tree) |
---|---|
Tiempo | 2018-08-31 05:34:10 |
Autor | Seigo Nonaka <nona@goog...> |
Commiter | Ryan Longair |
Fix crash during cursor moving on BiDi text
The crash was introduced by Ib66ef392c19c937718e7101f6d48fac3abe51ad0
The root cause of the crashing is requesting out-of-line access for the
horizontal width. This invalid access is silently ignored by
TextLine#measure() method but new implementation end up with out of
bounds access.
To makes behavior as old implementation, calling getHorizontal instead
of accessing measured result array.
Bug: 78464361, 111580019
Test: Manually done
Change-Id: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8
(cherry picked from commit 960647d582911ae7ab8b9491097898e6c313aaf1)
Merged-In: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8
(cherry picked from commit 82c84d5fbb692f5ed56175c55031e30566c18ee2)
@@ -1390,7 +1390,8 @@ public abstract class Layout { | ||
1390 | 1390 | } |
1391 | 1391 | |
1392 | 1392 | float get(final int offset) { |
1393 | - if (mHorizontals == null) { | |
1393 | + if (mHorizontals == null || offset < mLineStartOffset | |
1394 | + || offset >= mLineStartOffset + mHorizontals.length) { | |
1394 | 1395 | return getHorizontal(offset, mPrimary); |
1395 | 1396 | } else { |
1396 | 1397 | return mHorizontals[offset - mLineStartOffset]; |