diff options
| author | Suprabh Shukla <suprabh@google.com> | 2018-05-14 14:22:11 -0700 |
|---|---|---|
| committer | Suprabh Shukla <suprabh@google.com> | 2018-05-14 14:51:01 -0700 |
| commit | 1938e34e42969053f1b553779fa21257a28d708d (patch) | |
| tree | 7e0bb948f506e08f23072bf4a11a7058be4416ff /core/java/android/util/ArrayMap.java | |
| parent | 1b69d7b40661640bbcbe9b456de8b8c21aefee37 (diff) | |
Mitigating cache corruption in ArrayMap
Before calling freeArrays, storing the array reference into a temporary
pointer so that the main pointer doesn't end up corrupting the static
pool of arrays on concurrent access. An earlier change missed a rare
case when removeAt was called for the last element in the map.
Test: atest android.util.ArrayMapTest
atest android.util.cts.ArrayMapTest
Bug: 78898947
Change-Id: I454c5b1600eb0a6c690e746df10f6a0ebcd8aa1d
Diffstat (limited to 'core/java/android/util/ArrayMap.java')
| -rw-r--r-- | core/java/android/util/ArrayMap.java | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/core/java/android/util/ArrayMap.java b/core/java/android/util/ArrayMap.java index d51a13f3d119..f1e937e83dc1 100644 --- a/core/java/android/util/ArrayMap.java +++ b/core/java/android/util/ArrayMap.java @@ -644,9 +644,11 @@ public final class ArrayMap<K, V> implements Map<K, V> { if (osize <= 1) { // Now empty. if (DEBUG) Log.d(TAG, "remove: shrink from " + mHashes.length + " to 0"); - freeArrays(mHashes, mArray, osize); + final int[] ohashes = mHashes; + final Object[] oarray = mArray; mHashes = EmptyArray.INT; mArray = EmptyArray.OBJECT; + freeArrays(ohashes, oarray, osize); nsize = 0; } else { nsize = osize - 1; |