Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7584836d authored by Dominik Laskowski's avatar Dominik Laskowski
Browse files

SF: Register layers on first strong reference 

In ag/9549429, LayerHistory stores a wp<Layer> on Layer construction, at
which point RefBase::mStrong is not yet 1. Since wp<T>::promote succeeds
in that case, LayerHistory may concurrently create a sp<Layer> with sole
ownership on the main thread while checking for expired weak references,
resulting in premature layer destruction.

Bug: 144218964
Test: None (sporadic crash)
Change-Id: Ia7c89a090920588b216b719fce36c9f64a126e81
parent e00dd195

services/surfaceflinger/Layer.cpp

+4 −1
Original line number Diff line number Diff line
@@ -120,7 +120,10 @@ Layer::Layer(const LayerCreationArgs& args) 


    mCallingPid = args.callingPid;

    mCallingUid = args.callingUid;

    mFlinger->onLayerCreated(this);

}



void Layer::onFirstRef() {

    mFlinger->onLayerFirstRef(this);

}



Layer::~Layer() {

services/surfaceflinger/Layer.h

+2 −0
Original line number Diff line number Diff line
@@ -221,6 +221,8 @@ public: 
    explicit Layer(const LayerCreationArgs& args);

    virtual ~Layer();



    void onFirstRef() override;



    int getWindowType() const { return mWindowType; }



    void setPrimaryDisplayOnly() { mPrimaryDisplayOnly = true; }

services/surfaceflinger/SurfaceFlinger.cpp

+1 −1
Original line number Diff line number Diff line
@@ -5508,7 +5508,7 @@ sp<Layer> SurfaceFlinger::fromHandle(const sp<IBinder>& handle) { 
    return nullptr;

}



void SurfaceFlinger::onLayerCreated(Layer* layer) {

void SurfaceFlinger::onLayerFirstRef(Layer* layer) {

    mNumLayers++;

    mScheduler->registerLayer(layer);

}

services/surfaceflinger/SurfaceFlinger.h

+1 −1
Original line number Diff line number Diff line
@@ -310,7 +310,7 @@ public: 
    bool authenticateSurfaceTextureLocked(

        const sp<IGraphicBufferProducer>& bufferProducer) const;



    void onLayerCreated(Layer*);

    void onLayerFirstRef(Layer*);

    void onLayerDestroyed(Layer*);



    TransactionCompletedThread& getTransactionCompletedThread() {