Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a820af96 authored by Adithya Srinivasan's avatar Adithya Srinivasan
Browse files

Fix the call the onFrameDequeued inside dequeueBuffer 

Having a separate mutex lock for calling onFrameDequeued at the end of
the dequeueBuffer function seems to be problematic since there is a
chance that the buffer can be acquired before obtaining this lock
resulting in a null pointer dereference. Moving the call inside the
existing auto-lock scoped blocks in this CL.

Test: CtsCameraTestCases:MultiViewTest#testSharedSurfaceYUVImageReaderSwitch on blueline and crosshatch
Bug: 143542027
Change-Id: If9e4b36ca2c54337eb0e5a6647773db20e43a6a3
parent 0355ecab

libs/gui/BufferQueueProducer.cpp

+10 −5
Original line number Diff line number Diff line
@@ -512,6 +512,12 @@ status_t BufferQueueProducer::dequeueBuffer(int* outSlot, sp<android::Fence>* ou 
            mCore->mSharedBufferSlot = found;

            mSlots[found].mBufferState.mShared = true;

        }



        if (!(returnFlags & BUFFER_NEEDS_REALLOCATION)) {

            if (mCore->mConsumerListener != nullptr) {

                mCore->mConsumerListener->onFrameDequeued(mSlots[*outSlot].mGraphicBuffer->getId());

            }

        }

    } // Autolock scope



    if (returnFlags & BUFFER_NEEDS_REALLOCATION) {
@@ -528,6 +534,10 @@ status_t BufferQueueProducer::dequeueBuffer(int* outSlot, sp<android::Fence>* ou 
            if (error == NO_ERROR && !mCore->mIsAbandoned) {

                graphicBuffer->setGenerationNumber(mCore->mGenerationNumber);

                mSlots[*outSlot].mGraphicBuffer = graphicBuffer;

                if (mCore->mConsumerListener != nullptr) {

                    mCore->mConsumerListener->onFrameDequeued(

                            mSlots[*outSlot].mGraphicBuffer->getId());

                }

            }



            mCore->mIsAllocating = false;
@@ -580,11 +590,6 @@ status_t BufferQueueProducer::dequeueBuffer(int* outSlot, sp<android::Fence>* ou 
    }

    addAndGetFrameTimestamps(nullptr, outTimestamps);



    { // Autolock scope

        std::lock_guard<std::mutex> lock(mCore->mMutex);

        mCore->mConsumerListener->onFrameDequeued(mSlots[*outSlot].mGraphicBuffer->getId());

    }



    return returnFlags;

}