Don't allow the negative height of ListPopupWindow

Symptom:
If an application set a negative height to the popup list,
surfaceflinger is crashed with SIGABRT.

Root cause:
WindowManagerService dose not expect negative
height of ListPopupWindow. If it's negative,
WindowManagerService set the negative value to GraphicBufferAlloc,
but GraphicBufferAlloc handle the value as unsigned int,
then surfaceflinger is crashed with SIGABRT.

Solution:
Setting a negative height is a developer error.
We should throw an IAE from setHeigh(int).

Bug: 33441454

Author: Kazuki Nakayama <kazuki.x.nakayama@sonymobile.com>
Change-Id: I5887674d302e567abfe66147de4819cfdf0ef97b

1 files changed, 9 insertions, 1 deletions

diff --git a/core/java/android/widget/ListPopupWindow.java b/core/java/android/widget/ListPopupWindow.java
index 78d18fdbca5f..ab4cce479005 100644
--- a/core/java/android/widget/ListPopupWindow.java
+++ b/core/java/android/widget/ListPopupWindow.java
@@ -523,9 +523,17 @@ public class ListPopupWindow implements ShowableListMenu {
     /**
      * Sets the height of the popup window in pixels. Can also be {@link #MATCH_PARENT}.
      *
-     * @param height Height of the popup window.
+     * @param height Height of the popup window must be a positive value,
+     *               {@link #MATCH_PARENT}, or {@link #WRAP_CONTENT}.
+     *
+     * @throws IllegalArgumentException if height is set to negative value
      */
     public void setHeight(int height) {
+        if (height < 0 && ViewGroup.LayoutParams.WRAP_CONTENT != height
+                && ViewGroup.LayoutParams.MATCH_PARENT != height) {
+            throw new IllegalArgumentException(
+                   "Invalid height. Must be a positive value, MATCH_PARENT, or WRAP_CONTENT.");
+        }
         mDropDownHeight = height;
     }