Fix crash in TextDropShadowCache
The lengths used to copy/read arrays were completely wrong.
Change-Id: If21f23a73cce59bbd32975760e6d728eeeb9e40d
diff --git a/libs/hwui/TextDropShadowCache.cpp b/libs/hwui/TextDropShadowCache.cpp
index 4d80f73..9c7a5ab 100644
--- a/libs/hwui/TextDropShadowCache.cpp
+++ b/libs/hwui/TextDropShadowCache.cpp
@@ -30,7 +30,7 @@
///////////////////////////////////////////////////////////////////////////////
hash_t ShadowText::hash() const {
- uint32_t charCount = len * sizeof(char16_t);
+ uint32_t charCount = len / sizeof(char16_t);
uint32_t hash = JenkinsHashMix(0, len);
hash = JenkinsHashMix(hash, android::hash_type(radius));
hash = JenkinsHashMix(hash, android::hash_type(textSize));
@@ -38,9 +38,13 @@
hash = JenkinsHashMix(hash, flags);
hash = JenkinsHashMix(hash, android::hash_type(italicStyle));
hash = JenkinsHashMix(hash, android::hash_type(scaleX));
- hash = JenkinsHashMixShorts(hash, text, charCount);
- for (uint32_t i = 0; i < charCount * 2; i++) {
- hash = JenkinsHashMix(hash, android::hash_type(positions[i]));
+ if (text) {
+ hash = JenkinsHashMixShorts(hash, text, charCount);
+ }
+ if (positions) {
+ for (uint32_t i = 0; i < charCount * 2; i++) {
+ hash = JenkinsHashMix(hash, android::hash_type(positions[i]));
+ }
}
return JenkinsHashWhiten(hash);
}
diff --git a/libs/hwui/TextDropShadowCache.h b/libs/hwui/TextDropShadowCache.h
index 38bf05a..0bed72b6 100644
--- a/libs/hwui/TextDropShadowCache.h
+++ b/libs/hwui/TextDropShadowCache.h
@@ -35,6 +35,7 @@
flags(0), italicStyle(0.0f), scaleX(0), text(NULL), positions(NULL) {
}
+ // len is the number of bytes in text
ShadowText(SkPaint* paint, float radius, uint32_t len, const char* srcText,
const float* positions):
len(len), radius(radius), positions(positions) {
@@ -69,11 +70,12 @@
}
void copyTextLocally() {
- str.setTo((const char16_t*) text, len * sizeof(char16_t));
+ uint32_t charCount = len / sizeof(char16_t);
+ str.setTo((const char16_t*) text, charCount);
text = str.string();
if (positions != NULL) {
positionsCopy.clear();
- positionsCopy.appendArray(positions, len);
+ positionsCopy.appendArray(positions, charCount * 2);
positions = positionsCopy.array();
}
}