NPE in GMail / TextLine

Bug 5753061

https://android-git.corp.google.com/g/#/c/154756/1 revealed an
other bug in SpanSet. The fitered (non empty) spans were added
in their original position instead of being indexed by count.

The nullation on recycle hence left null holes in the array.

Change-Id: If5c1435cee9a2cb88a608aa8e5f4f2f23382154c

Author: Gilles Debunne

core/java/android/text/TextLine.java

@@ -886,7 +886,7 @@ public void init(Spanned spanned, int start, int limit) {
                 spanFlags = new int[length];
             }
 
-            int count = 0;
+            numberOfSpans = 0;
             for (int i = 0; i < length; i++) {
                 final E span = allSpans[i];
 
@@ -896,14 +896,13 @@ public void init(Spanned spanned, int start, int limit) {
 
                 final int spanFlag = spanned.getSpanFlags(span);
 
-                spans[i] = span;
-                spanStarts[i] = spanStart;
-                spanEnds[i] = spanEnd;
-                spanFlags[i] = spanFlag;
+                spans[numberOfSpans] = span;
+                spanStarts[numberOfSpans] = spanStart;
+                spanEnds[numberOfSpans] = spanEnd;
+                spanFlags[numberOfSpans] = spanFlag;
 
-                count++;
+                numberOfSpans++;
             }
-            numberOfSpans = count;
         }
 
         public boolean hasSpansIntersecting(int start, int end) {
@@ -926,6 +925,7 @@ int getNextTransition(int start, int limit) {
         }
 
         public void recycle() {
+            // The spans array is guaranteed to be not null when numberOfSpans is > 0
             for (int i = 0; i < numberOfSpans; i++) {
                 spans[i] = null; // prevent a leak: no reference kept when TextLine is recycled
             }