commit 6033d76bc68c04155dfa763ac86a229169d78cfb
author Seigo Nonaka <nona@google.com> Thu Jul 19 16:22:02 2018 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Thu Aug 16 01:20:21 2018 +0000
tree 3c5e99c6009fcee8130f34ad4fe0e5215306b3a4
parent 1cd4656371f50289432ecf8f6aa5179d3b8b2442

Fix crash during cursor moving on BiDi text

The crash was introduced by Ib66ef392c19c937718e7101f6d48fac3abe51ad0
The root cause of the crashing is requesting out-of-line access for the
horizontal width. This invalid access is silently ignored by
TextLine#measure() method but new implementation end up with out of
bounds access.

To makes behavior as old implementation, calling getHorizontal instead
of accessing measured result array.

Bug: 78464361, 111580019
Test: Manually done
Change-Id: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8
(cherry picked from commit 960647d582911ae7ab8b9491097898e6c313aaf1)
Merged-In: I5c5778718f6b397adbb1e4f2cf95e9f635f6e5c8
(cherry picked from commit d30c55e3ccf25668fcbccf29c94224fd1d2e67b6)

core/java/android/text/Layout.java

diff --git a/core/java/android/text/Layout.java b/core/java/android/text/Layout.java
index 1210f43..84ef943 100644
--- a/core/java/android/text/Layout.java
+++ b/core/java/android/text/Layout.java
@@ -1553,7 +1553,8 @@
         }
 
         float get(final int offset) {
-            if (mHorizontals == null) {
+            if (mHorizontals == null || offset < mLineStartOffset
+                    || offset >= mLineStartOffset + mHorizontals.length) {
                 return getHorizontal(offset, mPrimary);
             } else {
                 return mHorizontals[offset - mLineStartOffset];