Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 143912fe authored by Chris Craik's avatar Chris Craik
Browse files

Remove use-after-free signal in RenderNode 

bug:9321162

mDestroyed is no longer useful, as RenderNode is ref counted (not to
mention having its lifecycle significantly redesigned).

Change-Id: I429b9dd7740362c85d6416fbae567f0d47098e4e
parent 494fb7b5

libs/hwui/RenderNode.cpp

+1 −9
Original line number Diff line number Diff line
@@ -50,17 +50,13 @@ void RenderNode::outputLogBuffer(int fd) { 
}



RenderNode::RenderNode()

        : mDestroyed(false)

        , mNeedsPropertiesSync(false)

        : mNeedsPropertiesSync(false)

        , mNeedsDisplayListDataSync(false)

        , mDisplayListData(0)

        , mStagingDisplayListData(0) {

}



RenderNode::~RenderNode() {

    LOG_ALWAYS_FATAL_IF(mDestroyed, "Double destroyed DisplayList %p", this);



    mDestroyed = true;

    delete mDisplayListData;

    delete mStagingDisplayListData;

}
@@ -525,10 +521,6 @@ void RenderNode::issueOperationsOfProjectedChildren(OpenGLRenderer& renderer, T& 
template <class T>

void RenderNode::issueOperations(OpenGLRenderer& renderer, T& handler) {

    const int level = handler.level();

    if (CC_UNLIKELY(mDestroyed)) { // temporary debug logging

        ALOGW("Error: %s is drawing after destruction", mName.string());

        CRASH();

    }

    if (mDisplayListData->isEmpty() || properties().getAlpha() <= 0) {

        DISPLAY_LIST_LOGD("%*sEmpty display list (%p, %s)", level * 2, "", this, mName.string());

        return;

libs/hwui/RenderNode.h

+0 −1
Original line number Diff line number Diff line
@@ -210,7 +210,6 @@ private: 
    void prepareSubTree(TreeInfo& info, DisplayListData* subtree);



    String8 mName;

    bool mDestroyed; // used for debugging crash, TODO: remove once invalid state crash fixed



    bool mNeedsPropertiesSync;

    RenderProperties mProperties;