Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 143912fe authored by Chris Craik's avatar Chris Craik
Browse files

Remove use-after-free signal in RenderNode

bug:9321162

mDestroyed is no longer useful, as RenderNode is ref counted (not to
mention having its lifecycle significantly redesigned).

Change-Id: I429b9dd7740362c85d6416fbae567f0d47098e4e
parent 494fb7b5
Loading
Loading
Loading
Loading
+1 −9
Original line number Diff line number Diff line
@@ -50,17 +50,13 @@ void RenderNode::outputLogBuffer(int fd) {
}

RenderNode::RenderNode()
        : mDestroyed(false)
        , mNeedsPropertiesSync(false)
        : mNeedsPropertiesSync(false)
        , mNeedsDisplayListDataSync(false)
        , mDisplayListData(0)
        , mStagingDisplayListData(0) {
}

RenderNode::~RenderNode() {
    LOG_ALWAYS_FATAL_IF(mDestroyed, "Double destroyed DisplayList %p", this);

    mDestroyed = true;
    delete mDisplayListData;
    delete mStagingDisplayListData;
}
@@ -525,10 +521,6 @@ void RenderNode::issueOperationsOfProjectedChildren(OpenGLRenderer& renderer, T&
template <class T>
void RenderNode::issueOperations(OpenGLRenderer& renderer, T& handler) {
    const int level = handler.level();
    if (CC_UNLIKELY(mDestroyed)) { // temporary debug logging
        ALOGW("Error: %s is drawing after destruction", mName.string());
        CRASH();
    }
    if (mDisplayListData->isEmpty() || properties().getAlpha() <= 0) {
        DISPLAY_LIST_LOGD("%*sEmpty display list (%p, %s)", level * 2, "", this, mName.string());
        return;
+0 −1
Original line number Diff line number Diff line
@@ -210,7 +210,6 @@ private:
    void prepareSubTree(TreeInfo& info, DisplayListData* subtree);

    String8 mName;
    bool mDestroyed; // used for debugging crash, TODO: remove once invalid state crash fixed

    bool mNeedsPropertiesSync;
    RenderProperties mProperties;