Don't allow the negative height of ListPopupWindow

Symptom:
If an application set a negative height to the popup list,
surfaceflinger is crashed with SIGABRT.

Root cause:
WindowManagerService dose not expect negative
height of ListPopupWindow. If it's negative,
WindowManagerService set the negative value to GraphicBufferAlloc,
but GraphicBufferAlloc handle the value as unsigned int,
then surfaceflinger is crashed with SIGABRT.

Solution:
Setting a negative height is a developer error.
We should throw an IAE from setHeigh(int).

Bug: 33441454

Author: Kazuki Nakayama <kazuki.x.nakayama@sonymobile.com>
Change-Id: I5887674d302e567abfe66147de4819cfdf0ef97b

diff --git a/core/java/android/widget/ListPopupWindow.java b/core/java/android/widget/ListPopupWindow.java
index 78d18fd..ab4cce4 100644 (file)
--- a/core/java/android/widget/ListPopupWindow.java
+++ b/core/java/android/widget/ListPopupWindow.java
@@ -523,9 +523,17 @@ public class ListPopupWindow implements ShowableListMenu {
     /**
      * Sets the height of the popup window in pixels. Can also be {@link #MATCH_PARENT}.
      *
-     * @param height Height of the popup window.
+     * @param height Height of the popup window must be a positive value,
+     *               {@link #MATCH_PARENT}, or {@link #WRAP_CONTENT}.
+     *
+     * @throws IllegalArgumentException if height is set to negative value
      */
     public void setHeight(int height) {
+        if (height < 0 && ViewGroup.LayoutParams.WRAP_CONTENT != height
+                && ViewGroup.LayoutParams.MATCH_PARENT != height) {
+            throw new IllegalArgumentException(
+                   "Invalid height. Must be a positive value, MATCH_PARENT, or WRAP_CONTENT.");
+        }
         mDropDownHeight = height;
     }