Merge "Close race condition in binderDied()" (90cfc192) · Commits · e / os / android_frameworks_base

core/jni/android_util_Binder.cpp

+18 −5

Original line number	Diff line number	Diff line
		@@ -358,6 +358,8 @@ public:
		void add(const sp<JavaDeathRecipient>& recipient);
		void remove(const sp<JavaDeathRecipient>& recipient);
		sp<JavaDeathRecipient> find(jobject recipient);

		Mutex& lock(); // Use with care; specifically for mutual exclusion during binder death
		};

		// ----------------------------------------------------------------------------
		@@ -392,6 +394,12 @@ public:
		"*** Uncaught exception returned from death notification!");
		}

		// Serialize with our containing DeathRecipientList so that we can't
		// delete the global ref on mObject while the list is being iterated.
		sp<DeathRecipientList> list = mList.promote();
		if (list != NULL) {
		AutoMutex _l(list->lock());

		// Demote from strong ref to weak after binderDied() has been delivered,
		// to allow the DeathRecipient and BinderProxy to be GC'd if no longer needed.
		mObjectWeak = env->NewWeakGlobalRef(mObject);
		@@ -399,6 +407,7 @@ public:
		mObject = NULL;
		}
		}
		}

		void clearReference()
		{
		@@ -518,6 +527,10 @@ sp<JavaDeathRecipient> DeathRecipientList::find(jobject recipient) {
		return NULL;
		}

		Mutex& DeathRecipientList::lock() {
		return mLock;
		}

		// ----------------------------------------------------------------------------

		namespace android {