camera2 ndk/vndk: cleanup->stop CameraDevice's looper in ~ACameraDevice()
It's possible that the following sequence happens: 1) hwbinder / binder thread T1: onResultReceived() starts -> promotes wp<CameraDevice> to sp<>; 2) Some other app thread T2 : ACameraDevice_close() -> delete ACameraDevice -> doesn't result in CameraDevice's destructor running since mCameraDevice has another live reference, app destroys some object O1. 3) T3 (callback looper thread): callback is received since looper is still running which accesses dead app object O1 -> results in undefined behavior. 4) T1: onResultReceived completes and CameraDevice is destructed We need to stop CameraDevice's looper thread (that waits for all callbacks queued to complete) in ~ACameraDevice() so we receive no callbacks after ACameraDevice is closed. Bug: 135641415 Test: CTS native tests: no new failures Test: AImageReaderVendorTest; enroll; while(1) auth; Change-Id: Ia24de753f6ee409d941fff39616f09df2164880a Merged-In: Ia24de753f6ee409d941fff39616f09df2164880a Signed-off-by: Jayant Chowdhary <jchowdhary@google.com> (cherry picked from commit 17408401) Signed-off-by: Jayant Chowdhary <jchowdhary@google.com>
Loading
Please register or sign in to comment