Skip to content
Commit 7d716426 authored by Chris Wailes's avatar Chris Wailes Committed by Alistair Delva
Browse files

Fixes a system crash in VibratorService on x86 hosts

Original symptom: Cuttlefish devices would crash when the "recent apps"
tray was swiped up from the bottom.

Root cause: Raising the "recent apps" tray triggers a vibration.  Close
to the bottom of the call stack responsible for this action in
VibratorService is the native function vibratorPerformEffect().  The
Java Language signature for this function has a long as the type of the
second parameter, as does the JNI signature that is registered with the
environment.  The native function, however, uses an int type for this
parameter.  As a result, when the arguments are passed via the stack on
x86 devices the high bits of the second long argument are read as the
contents of the third argument, which is a jobject reference.  When the
code attempts to convert this NULL local reference into a global
reference the JNI code aborts the runtime for the process.  Because the
VibratorService is part of the SystemServer, when it crashes the Zygote
is notified and restarts the entire shell.

Why this wasn't an issue on ARM devices: ARMs calling conventions pass
many of a function's arguments via registers instead of via the stack.
This means that the long argument is passed in a register, preventing it
from stomping on any other arguments.  When the native function uses the
argument it simply reads the lower bits from the register and ignores
the higher bits.

Why this wasn't previously an issue on X86 hosts: ag/9158254 introduced
a new parameter to the vibratorPerformEffect() function.  This new
parameter is located after the mis-typed parameter and will be aliased
to the high bits of the mis-typed long argument.

Fix: Correct the type signature of the native vibratorPerformEffect()
function.

Bug: 143082450
Test: Build -> start cuttlefish -> raise recent apps tray -> no crash
[adelva: port to AOSP to close potential ASAN issues]
Change-Id: If50f68df9579f84bddc9d70a0a30cd73f4485e96
Merged-In: If50f68df9579f84bddc9d70a0a30cd73f4485e96
parent 149ad21f
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment