blast: fix crop and display frame

BufferStateLayers can have an infinite width and height. Check for
this edge case when calculating the Layer's transform.

Test: atest CtsViewTestCases:android.view.cts.ASurfaceControlTest
Bug: 124128940
Change-Id: I01f53483f154076b24cb3cf588026e410b2f87f9
diff --git a/services/surfaceflinger/Layer.cpp b/services/surfaceflinger/Layer.cpp
index 4567916..c7fb459 100644
--- a/services/surfaceflinger/Layer.cpp
+++ b/services/surfaceflinger/Layer.cpp
@@ -285,6 +285,14 @@
         return mEffectiveTransform;
     }
 
+    // If the layer is a buffer state layer, the active width and height
+    // could be infinite. In that case, return the effective transform.
+    const uint32_t activeWidth = getActiveWidth(getDrawingState());
+    const uint32_t activeHeight = getActiveHeight(getDrawingState());
+    if (activeWidth >= UINT32_MAX && activeHeight >= UINT32_MAX) {
+        return mEffectiveTransform;
+    }
+
     int bufferWidth;
     int bufferHeight;
     if ((mCurrentTransform & NATIVE_WINDOW_TRANSFORM_ROT_90) == 0) {
@@ -294,8 +302,9 @@
         bufferHeight = mActiveBuffer->getWidth();
         bufferWidth = mActiveBuffer->getHeight();
     }
-    float sx = getActiveWidth(getDrawingState()) / static_cast<float>(bufferWidth);
-    float sy = getActiveHeight(getDrawingState()) / static_cast<float>(bufferHeight);
+    float sx = activeWidth / static_cast<float>(bufferWidth);
+    float sy = activeHeight / static_cast<float>(bufferHeight);
+
     ui::Transform extraParentScaling;
     extraParentScaling.set(sx, 0, 0, sy);
     return mEffectiveTransform * extraParentScaling;
@@ -399,6 +408,15 @@
     Rect activeCrop = computeInitialCrop(display);
     Rect bufferSize = getBufferSize(s);
 
+    int32_t winWidth = bufferSize.getWidth();
+    int32_t winHeight = bufferSize.getHeight();
+
+    // The bufferSize for buffer state layers can be unbounded ([0, 0, -1, -1]) if display frame
+    // hasn't been set and the parent is an unbounded layer.
+    if (winWidth < 0 && winHeight < 0) {
+        return crop;
+    }
+
     // Transform the window crop to match the buffer coordinate system,
     // which means using the inverse of the current transform set on the
     // SurfaceFlingerConsumer.
@@ -418,8 +436,6 @@
                         ui::Transform(invTransform)).getOrientation();
     }
 
-    int winWidth = bufferSize.getWidth();
-    int winHeight = bufferSize.getHeight();
     if (invTransform & NATIVE_WINDOW_TRANSFORM_ROT_90) {
         // If the activeCrop has been rotate the ends are rotated but not
         // the space itself so when transforming ends back we can't rely on