Browser: Fix browser force close

Issue: Cursor was accessed by handler thread
       when it was closed. During Orientation change,
       BrowserBookmarksPage#onDestroyView is called
       which clears all the loaders [and cursors].
       Simultaneously ThreadedCursorAdapter#loadRowObject
       is getting called which then calls
       BrowserBookmarksAdapter#getRowObject
       where closed cursor is accessed and force close happens.

Fix: Synchronized cursors wrt main thread and handler thread.
     Checked mCursorAdapter for invalid conditions

CRs-Fixed: 576176
Change-Id: I9f16c2f1a55f35e8256bbf56afce3538850f9d42

2 files changed, 8 insertions, 2 deletions

diff --git a/src/com/android/browser/BrowserBookmarksPage.java b/src/com/android/browser/BrowserBookmarksPage.java
index cb531073c..3a0c65af8 100644
--- a/src/com/android/browser/BrowserBookmarksPage.java
+++ b/src/com/android/browser/BrowserBookmarksPage.java
@@ -411,7 +411,9 @@ public class BrowserBookmarksPage extends Fragment implements View.OnCreateConte
         LoaderManager lm = getLoaderManager();
         lm.destroyLoader(LOADER_ACCOUNTS);
         for (int id : mBookmarkAdapters.keySet()) {
-            lm.destroyLoader(id);
+            synchronized (mBookmarkAdapters.get(id).mCursorLock) {
+                lm.destroyLoader(id);
+            }
         }
         mBookmarkAdapters.clear();
     }
diff --git a/src/com/android/browser/util/ThreadedCursorAdapter.java b/src/com/android/browser/util/ThreadedCursorAdapter.java
index 72a07eafd..d35099955 100644
--- a/src/com/android/browser/util/ThreadedCursorAdapter.java
+++ b/src/com/android/browser/util/ThreadedCursorAdapter.java
@@ -39,7 +39,7 @@ public abstract class ThreadedCursorAdapter<T> extends BaseAdapter {
     private static final boolean DEBUG = false;
 
     private Context mContext;
-    private Object mCursorLock = new Object();
+    public Object mCursorLock = new Object();
     private CursorAdapter mCursorAdapter;
     private T mLoadingObject;
     private Handler mLoadHandler;
@@ -150,6 +150,10 @@ public abstract class ThreadedCursorAdapter<T> extends BaseAdapter {
             return;
         }
         synchronized (mCursorLock) {
+            if ((mCursorAdapter == null) || (mCursorAdapter.getCursor() == null)
+                    || mCursorAdapter.getCursor().isClosed()) {
+                return;
+            }
             Cursor c = (Cursor) mCursorAdapter.getItem(position);
             if (c == null || c.isClosed()) {
                 return;