Fixes a system crash in VibratorService on x86 hosts
Original symptom: Cuttlefish devices would crash when the "recent apps" tray was swiped up from the bottom. Root cause: Raising the "recent apps" tray triggers a vibration. Close to the bottom of the call stack responsible for this action in VibratorService is the native function vibratorPerformEffect(). The Java Language signature for this function has a long as the type of the second parameter, as does the JNI signature that is registered with the environment. The native function, however, uses an int type for this parameter. As a result, when the arguments are passed via the stack on x86 devices the high bits of the second long argument are read as the contents of the third argument, which is a jobject reference. When the code attempts to convert this NULL local reference into a global reference the JNI code aborts the runtime for the process. Because the VibratorService is part of the SystemServer, when it crashes the Zygote is notified and restarts the entire shell. Why this wasn't an issue on ARM devices: ARMs calling conventions pass many of a function's arguments via registers instead of via the stack. This means that the long argument is passed in a register, preventing it from stomping on any other arguments. When the native function uses the argument it simply reads the lower bits from the register and ignores the higher bits. Why this wasn't previously an issue on X86 hosts: ag/9158254 introduced a new parameter to the vibratorPerformEffect() function. This new parameter is located after the mis-typed parameter and will be aliased to the high bits of the mis-typed long argument. Fix: Correct the type signature of the native vibratorPerformEffect() function. Bug: 143082450 Test: Build -> start cuttlefish -> raise recent apps tray -> no crash Change-Id: If50f68df9579f84bddc9d70a0a30cd73f4485e96
Loading
Please register or sign in to comment