From 6b82a0843e0cec1092d3660d32dbb6f99fed2c00 Mon Sep 17 00:00:00 2001
From: Hyunyoung Song <hyunyoungs@google.com>
Date: Thu, 4 Oct 2018 12:00:36 -0700
Subject: [PATCH] Fix issue where pointer id was being used to set as action
 index

Bug: 117157432
Bug: 116744159

Context: In vary rare case, Pointer id can be higher than
MotionEvent.getPointerCount. When I was fabricating ACTION_POINTER_DOWN
event, I was using pointer id instead of index to create MotionEvent.
This resulted in stack trace as seen in the bug.

Change-Id: I802c2a45a274f0dda5984f1d266334fc8b6b0bea
---
 .../launcher3/touch/TouchEventTranslator.java  | 18 +++++++++++-------
 1 file changed, 11 insertions(+), 7 deletions(-)

diff --git a/src/com/android/launcher3/touch/TouchEventTranslator.java b/src/com/android/launcher3/touch/TouchEventTranslator.java
index 8a5c93264c..55a88ee0f0 100644
--- a/src/com/android/launcher3/touch/TouchEventTranslator.java
+++ b/src/com/android/launcher3/touch/TouchEventTranslator.java
@@ -77,7 +77,7 @@ public class TouchEventTranslator {
     public void dispatchDownEvents(MotionEvent ev) {
         for(int i = 0; i < ev.getPointerCount() && i < mDownEvents.size(); i++) {
             int pid = ev.getPointerId(i);
-            put(pid, ev.getX(i), 0, mDownEvents.get(i).timeStamp, ev);
+            put(pid, i, ev.getX(i), 0, mDownEvents.get(i).timeStamp, ev);
         }
     }
 
@@ -98,7 +98,7 @@ public class TouchEventTranslator {
                     }
                     generateEvent(ev.getAction(), ev);
                 } else {
-                    put(pid, x, y, ev);
+                    put(pid, index, x, y, ev);
                 }
                 break;
             case MotionEvent.ACTION_MOVE:
@@ -123,11 +123,11 @@ public class TouchEventTranslator {
         }
     }
 
-    private TouchEventTranslator put(int id, float x, float y, MotionEvent ev) {
-        return put(id, x, y, ev.getEventTime(), ev);
+    private TouchEventTranslator put(int id, int index, float x, float y, MotionEvent ev) {
+        return put(id, index, x, y, ev.getEventTime(), ev);
     }
 
-    private TouchEventTranslator put(int id, float x, float y, long ms, MotionEvent ev) {
+    private TouchEventTranslator put(int id, int index, float x, float y, long ms, MotionEvent ev) {
         checkFingerExistence(id, false);
         boolean isInitialDown = (mFingers.size() == 0);
 
@@ -150,7 +150,7 @@ public class TouchEventTranslator {
         } else {
             action = MotionEvent.ACTION_POINTER_DOWN;
             // Set the id of the changed pointer.
-            action |= id << MotionEvent.ACTION_POINTER_INDEX_SHIFT;
+            action |= index << MotionEvent.ACTION_POINTER_INDEX_SHIFT;
         }
         generateEvent(action, ms, ev);
         return this;
@@ -204,7 +204,7 @@ public class TouchEventTranslator {
     public void printSamples(String msg, MotionEvent ev) {
         System.out.printf("%s %s", msg, MotionEvent.actionToString(ev.getActionMasked()));
         final int pointerCount = ev.getPointerCount();
-        System.out.printf("#%d/%d", ev.getPointerId(ev.getActionIndex()), pointerCount);
+        System.out.printf("#%d/%d", ev.getActionIndex(), pointerCount);
         System.out.printf(" t=%d:", ev.getEventTime());
         for (int p = 0; p < pointerCount; p++) {
             System.out.printf("  id=%d: (%f,%f)",
@@ -237,6 +237,10 @@ public class TouchEventTranslator {
         if (DEBUG) {
             printSamples(TAG + " generateEvent", event);
         }
+        if (event.getPointerId(event.getActionIndex()) < 0) {
+            printSamples(TAG + "generateEvent", event);
+            throw new IllegalStateException(event.getActionIndex() + " not found in MotionEvent");
+        }
         mListener.accept(event);
         event.recycle();
     }