Fix TextDropShadowCache infinite loop

Bug: 26862239

Switch TextDropCacheShadow to use the tracked objectSize()
instead of the optional bitmapSize. A mismatch here
results in ::get() infinite looping trying to free space in
the cache since the LRU removal callback would always
decrement mSize by 0 since bitmapSize was not being set.

Also prevent the infinite loop in the future by crashing if
this scenario happens again.

Change-Id: Ib4e9fbe1c8327af2335ad650fd694a1627d9824f

1 files changed, 5 insertions, 3 deletions

diff --git a/libs/hwui/TextDropShadowCache.cpp b/libs/hwui/TextDropShadowCache.cpp
index 62a20fcfa699..1707468f169d 100644
--- a/libs/hwui/TextDropShadowCache.cpp
+++ b/libs/hwui/TextDropShadowCache.cpp
@@ -148,7 +148,7 @@ void TextDropShadowCache::setMaxSize(uint32_t maxSize) {
 
 void TextDropShadowCache::operator()(ShadowText&, ShadowTexture*& texture) {
     if (texture) {
-        mSize -= texture->bitmapSize;
+        mSize -= texture->objectSize();
 
         if (mDebugEnabled) {
             ALOGD("Shadow texture deleted, size = %d", texture->bitmapSize);
@@ -195,7 +195,9 @@ ShadowTexture* TextDropShadowCache::get(const SkPaint* paint, const char* glyphs
         // Don't even try to cache a bitmap that's bigger than the cache
         if (size < mMaxSize) {
             while (mSize + size > mMaxSize) {
-                mCache.removeOldest();
+                LOG_ALWAYS_FATAL_IF(!mCache.removeOldest(),
+                        "Failed to remove oldest from cache. mSize = %"
+                        PRIu32 ", mCache.size() = %zu", mSize, mCache.size());
             }
         }
 
@@ -212,7 +214,7 @@ ShadowTexture* TextDropShadowCache::get(const SkPaint* paint, const char* glyphs
 
             entry.copyTextLocally();
 
-            mSize += size;
+            mSize += texture->objectSize();
             mCache.put(entry, texture);
         } else {
             texture->cleanup = true;