Crash in the touch explorer.

1. The touch explorer was notified for accessibility events from
   a binder thread which was poking the internal state of the
   latter which by design is not tread safe. Since the touch
   explorer is expected to be running only on the main thread
   the accessibility manager service delivers the accessibility
   events to the explorer on that thread.

bug:6635496

Change-Id: Ifdc5329e4be8e485d7f77f0fb472184494fa0d15

Author: sganov

services/java/com/android/server/accessibility/AccessibilityManagerService.java

@@ -113,6 +113,8 @@ public class AccessibilityManagerService extends IAccessibilityManager.Stub {
 
     private static final int MSG_TOGGLE_TOUCH_EXPLORATION = 2;
 
+    private static final int MSG_SEND_ACCESSIBILITY_EVENT_TO_INPUT_FILTER = 3;
+
     private static int sIdCounter = 0;
 
     private static int sNextWindowId;
@@ -402,7 +404,9 @@ public boolean sendAccessibilityEvent(AccessibilityEvent event) {
                 notifyAccessibilityServicesDelayedLocked(event, true);
             }
             if (mHasInputFilter && mInputFilter != null) {
-                mInputFilter.onAccessibilityEvent(event);
+                mMainHandler.obtainMessage(MSG_SEND_ACCESSIBILITY_EVENT_TO_INPUT_FILTER,
+                        AccessibilityEvent.obtain(event)).sendToTarget();
+
             }
             event.recycle();
             mHandledFeedbackTypes = 0;
@@ -1104,7 +1108,14 @@ public void onClick(DialogInterface dialog, int which) {
                         mEnableTouchExplorationDialog.setCanceledOnTouchOutside(true);
                         mEnableTouchExplorationDialog.show();
                     }
-                }
+                } break;
+                case MSG_SEND_ACCESSIBILITY_EVENT_TO_INPUT_FILTER: {
+                    AccessibilityEvent event = (AccessibilityEvent) msg.obj;
+                    if (mHasInputFilter && mInputFilter != null) {
+                        mInputFilter.onAccessibilityEvent(event);
+                    }
+                    event.recycle();
+                } break;
             }
         }
     }