Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d0b55c01 authored by Mathias Agopian's avatar Mathias Agopian
Browse files

fix [4093196] Device lock up - log spam with SharedBufferStack:... 

fix [4093196] Device lock up - log spam with SharedBufferStack: waitForCondition(LockCondition) timed out

a memory corruption happned when the buffer pool was resized
(like when playing a video or using camera) and there was
no current active buffer. In this case, the faulty code
would index into an array at position -1 which corrupted
24 bytes of data.

also improved region validation code (ifdef'ed out by default)

Bug: 4093196
Change-Id: I915c581d131148959d720e00e3892e9186ab733d
parent d5b7248a

include/utils/Vector.h

+3 −0
Original line number Diff line number Diff line
@@ -162,6 +162,9 @@ public: 
     inline status_t        sort(compar_t cmp);

     inline status_t        sort(compar_r_t cmp, void* state);



     // for debugging only

     inline size_t getItemSize() const { return itemSize(); }



protected:

    virtual void    do_construct(void* storage, size_t num) const;

    virtual void    do_destroy(void* storage, size_t num) const;

libs/ui/Region.cpp

+11 −1
Original line number Diff line number Diff line
@@ -56,6 +56,9 @@ Region::Region() 
Region::Region(const Region& rhs)

    : mBounds(rhs.mBounds), mStorage(rhs.mStorage)

{

#if VALIDATE_REGIONS

    validate(rhs, "rhs copy-ctor");

#endif

}



Region::Region(const Rect& rhs)
@@ -76,7 +79,8 @@ Region::~Region() 
Region& Region::operator = (const Region& rhs)

{

#if VALIDATE_REGIONS

    validate(rhs, "operator=");

    validate(*this, "this->operator=");

    validate(rhs, "rhs.operator=");

#endif

    mBounds = rhs.mBounds;

    mStorage = rhs.mStorage;
@@ -366,6 +370,12 @@ void Region::boolean_operation(int op, Region& dst, 
        const Region& lhs,

        const Region& rhs, int dx, int dy)

{

#if VALIDATE_REGIONS

    validate(lhs, "boolean_operation (before): lhs");

    validate(rhs, "boolean_operation (before): rhs");

    validate(dst, "boolean_operation (before): dst");

#endif



    size_t lhs_count;

    Rect const * const lhs_rects = lhs.getArray(&lhs_count);

services/surfaceflinger/Layer.cpp

+7 −5
Original line number Diff line number Diff line
@@ -858,11 +858,13 @@ status_t Layer::BufferManager::resize(size_t size, 
    Mutex::Autolock _l(mLock);



    if (size < mNumBuffers) {

        // Move the active texture into slot 0

        // If there is an active texture, move it into slot 0 if needed

        if (mActiveBufferIndex > 0) {

            BufferData activeBufferData = mBufferData[mActiveBufferIndex];

            mBufferData[mActiveBufferIndex] = mBufferData[0];

            mBufferData[0] = activeBufferData;

            mActiveBufferIndex = 0;

        }



        // Free the buffers that are no longer needed.

        for (size_t i = size; i < mNumBuffers; i++) {