Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e4b117ad authored by Mathias Agopian's avatar Mathias Agopian Committed by Android (Google) Code Review
Browse files

Merge "Fix a race-condtion in SurfaceFlinger that could lead to a crash."

parents 13947c3c 4f113740

services/surfaceflinger/SurfaceFlinger.cpp

+12 −8
Original line number Diff line number Diff line
@@ -1094,15 +1094,15 @@ status_t SurfaceFlinger::addLayer_l(const sp<LayerBase>& layer) 
ssize_t SurfaceFlinger::addClientLayer(const sp<Client>& client,

        const sp<LayerBaseClient>& lbc)

{

    Mutex::Autolock _l(mStateLock);



    // attach this layer to the client

    ssize_t name = client->attachLayer(lbc);

    size_t name = client->attachLayer(lbc);



    Mutex::Autolock _l(mStateLock);



    // add this layer to the current state list

    addLayer_l(lbc);



    return name;

    return ssize_t(name);

}



status_t SurfaceFlinger::removeLayer(const sp<LayerBase>& layer)
@@ -2381,15 +2381,17 @@ status_t Client::initCheck() const { 
    return NO_ERROR;

}



ssize_t Client::attachLayer(const sp<LayerBaseClient>& layer)

size_t Client::attachLayer(const sp<LayerBaseClient>& layer)

{

    int32_t name = android_atomic_inc(&mNameGenerator);

    Mutex::Autolock _l(mLock);

    size_t name = mNameGenerator++;

    mLayers.add(name, layer);

    return name;

}



void Client::detachLayer(const LayerBaseClient* layer)

{

    Mutex::Autolock _l(mLock);

    // we do a linear search here, because this doesn't happen often

    const size_t count = mLayers.size();

    for (size_t i=0 ; i<count ; i++) {
@@ -2399,9 +2401,11 @@ void Client::detachLayer(const LayerBaseClient* layer) 
        }

    }

}

sp<LayerBaseClient> Client::getLayerUser(int32_t i) const {

sp<LayerBaseClient> Client::getLayerUser(int32_t i) const

{

    Mutex::Autolock _l(mLock);

    sp<LayerBaseClient> lbc;

    const wp<LayerBaseClient>& layer(mLayers.valueFor(i));

    wp<LayerBaseClient> layer(mLayers.valueFor(i));

    if (layer != 0) {

        lbc = layer.promote();

        LOGE_IF(lbc==0, "getLayerUser(name=%d) is dead", int(i));

services/surfaceflinger/SurfaceFlinger.h

+9 −3
Original line number Diff line number Diff line
@@ -65,7 +65,7 @@ public: 
    status_t initCheck() const;



    // protected by SurfaceFlinger::mStateLock

    ssize_t attachLayer(const sp<LayerBaseClient>& layer);

    size_t attachLayer(const sp<LayerBaseClient>& layer);

    void detachLayer(const LayerBaseClient* layer);

    sp<LayerBaseClient> getLayerUser(int32_t i) const;
@@ -81,9 +81,15 @@ private: 
    virtual status_t destroySurface(SurfaceID surfaceId);

    virtual status_t setState(int32_t count, const layer_state_t* states);



    DefaultKeyedVector< size_t, wp<LayerBaseClient> > mLayers;

    // constant

    sp<SurfaceFlinger> mFlinger;

    int32_t mNameGenerator;



    // protected by mLock

    DefaultKeyedVector< size_t, wp<LayerBaseClient> > mLayers;

    size_t mNameGenerator;



    // thread-safe

    mutable Mutex mLock;

};



class UserClient : public BnSurfaceComposerClient