commit 9cde7244b633028d12fedcf3c66f16c0f25af9a7
author Raph Levien <raph@google.com> Mon Jul 25 10:05:35 2016 -0700
committer Raph Levien <raph@google.com> Fri Aug 26 23:44:47 2016 +0000
tree 54afbb8c75d26226daddb4046e632ce832e714b2
parent c2b9d558186f01716f643e1b095086fd608802d7

Enforce consistent sizes for arrays in SpannableStringInternal

The grow logic in SpannableStringInternal#setSpan assumes that the
size of mSpanData is consistent with that of mSpans, in particular
that if the latter doesn't need to grow, neither does the former.
The copySpans() method didn't enforce this, creating an mSpanData
array only big enough to hold the data.

This patch documents the invariant in a comment and enforces it.

Bug: 30359314
Change-Id: Ie25db70a76836e97af8476a7f5c10cb4b976c1cf
(cherry picked from commit 83549088c643586aa6013d947ad2c21464a3878e)

core/java/android/text/SpannableStringInternal.java

diff --git a/core/java/android/text/SpannableStringInternal.java b/core/java/android/text/SpannableStringInternal.java
index 47e71be..4b02df86 100644
--- a/core/java/android/text/SpannableStringInternal.java
+++ b/core/java/android/text/SpannableStringInternal.java
@@ -33,6 +33,7 @@
             mText = source.toString().substring(start, end);
 
         mSpans = EmptyArray.OBJECT;
+        // Invariant: mSpanData.length = mSpans.length * COLUMNS
         mSpanData = EmptyArray.INT;
 
         if (source instanceof Spanned) {
@@ -99,7 +100,7 @@
             Object[] srcSpans = src.mSpans;
             mSpanCount = count;
             mSpans = ArrayUtils.newUnpaddedObjectArray(mSpanCount);
-            mSpanData = new int[mSpanCount * COLUMNS];
+            mSpanData = new int[mSpans.length * COLUMNS];
             for (int i = 0, j = 0; i < limit; i++) {
                 int spanStart = srcData[i * COLUMNS + START];
                 int spanEnd = srcData[i * COLUMNS + END];