commit d6e3cf4ab55ea68e60597526f43e973026aa2909
author John Reck <jreck@google.com> Mon Mar 28 09:35:00 2016 -0700
committer John Reck <jreck@google.com> Mon Mar 28 09:37:20 2016 -0700
tree a57aff74a4c40762cd43540379e83fe053d05804
parent 5bee05960dcc415c28076d8efd2ff94c0f89f9fd

Fix array out of bounds access in JankTracker

Fixes: 27873879

If frametime > max janktracker would accidentally
double-increment totalFrameCount due to overflowing
the end of frameCounts

Change-Id: Iebfd1349b7014ade807f42d9c196139274a96684

libs/hwui/JankTracker.cpp

diff --git a/libs/hwui/JankTracker.cpp b/libs/hwui/JankTracker.cpp
index 2246cf9c..76e587e 100644
--- a/libs/hwui/JankTracker.cpp
+++ b/libs/hwui/JankTracker.cpp
@@ -244,7 +244,7 @@
     int64_t totalDuration =
             frame[FrameInfoIndex::FrameCompleted] - frame[FrameInfoIndex::IntendedVsync];
     uint32_t framebucket = frameCountIndexForFrameTime(
-            totalDuration, mData->frameCounts.size());
+            totalDuration, mData->frameCounts.size() - 1);
     // Keep the fast path as fast as possible.
     if (CC_LIKELY(totalDuration < mFrameInterval)) {
         mData->frameCounts[framebucket]++;