summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorSeigo Nonaka <nona@google.com>2018-07-19 16:22:02 -0700
committerandroid-build-team Robot <android-build-team-robot@google.com>2018-09-14 20:45:52 +0000
commited996edcd6c0de5a8054d226aa34da9391937793 (patch)
tree80735c9c7d084c7169b39c840ba571c0c2235b6e
parent5678a812b858fc2114172ed32b66cb97523006b3 (diff)
downloadbase-ed996edcd6c0de5a8054d226aa34da9391937793.tar.gz
Fix crash during cursor moving on BiDi text
The crash was introduced by Ib66ef392c19c937718e7101f6d48fac3abe51ad0 The root cause of the crashing is requesting out-of-line access for the horizontal width. This invalid access is silently ignored by TextLine#measure() method but new implementation end up with out of bounds access. To makes behavior as old implementation, calling getHorizontal instead of accessing measured result array. Bug: 78464361, 111580019 Test: Manually done Change-Id: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8 (cherry picked from commit 960647d582911ae7ab8b9491097898e6c313aaf1) Merged-In: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8 (cherry picked from commit 82c84d5fbb692f5ed56175c55031e30566c18ee2)
-rw-r--r--core/java/android/text/Layout.java3
1 files changed, 2 insertions, 1 deletions
diff --git a/core/java/android/text/Layout.java b/core/java/android/text/Layout.java
index c94e489f89cf..3bc9390c5815 100644
--- a/core/java/android/text/Layout.java
+++ b/core/java/android/text/Layout.java
@@ -1390,7 +1390,8 @@ public abstract class Layout {
}
float get(final int offset) {
- if (mHorizontals == null) {
+ if (mHorizontals == null || offset < mLineStartOffset
+ || offset >= mLineStartOffset + mHorizontals.length) {
return getHorizontal(offset, mPrimary);
} else {
return mHorizontals[offset - mLineStartOffset];