commit 8a918b13a814ae8985e283aa42e68f32b677d8b1
author Jeff Sharkey <jsharkey@android.com> Wed Jul 06 17:38:59 2016 -0600
committer Jeff Sharkey <jsharkey@android.com> Wed Jul 06 17:39:21 2016 -0600
tree 2ca2f2f3b9db9ec0bedf0e79d6f77d7a5db12dc3
parent 400960a40e84f7f0968b3019ac3c01fcf4954575

Snapshot RemoteViews before releasing lock.

The MSG_NOTIFY_UPDATE_APP_WIDGET message is sent asynchronously,
meaning it tries sending RemoteViews without the lock held, possibly
while another Binder thread is trying to mutate it.

Fix this by creating a copy for the thread to safely dispatch.

Bug: 29889779
Change-Id: I341fbbf89abee97a66cd67f1dd2a728282b68bfa

services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java

diff --git a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
index feceb14..6defd0f 100644
--- a/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
+++ b/services/appwidget/java/com/android/server/appwidget/AppWidgetServiceImpl.java
@@ -1905,7 +1905,7 @@
         SomeArgs args = SomeArgs.obtain();
         args.arg1 = widget.host;
         args.arg2 = widget.host.callbacks;
-        args.arg3 = updateViews;
+        args.arg3 = updateViews.clone();
         args.arg4 = requestTime;
         args.argi1 = widget.appWidgetId;