Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 1a4dba4b authored by chaviw's avatar chaviw
Browse files

Hold mMutex lock and check abandoned when accessing mLayer 

The Layer lifecycle is tied to BufferLayerConsumer so when the Layer is
removed, the BufferLayerConsumer is abandoned. However, abandoned
doesn't necessarily mean it was cleaned up yet. Therefore, we need to
check whether the BufferLayerConsumer was abandoned before accessing the
raw pointer mLayer. If the BufferLayerConsumer was not abandoned, then
mLayer will be valid.

Test: Builds and runs. Hard to reproduce race condition
Fixes: 157535966
Fixes: 155679049
Change-Id: I8b309c9e1fe57746bceabab1deda56248087b189
parent 68904ad9

services/surfaceflinger/BufferLayerConsumer.cpp

+14 −0
Original line number Diff line number Diff line
@@ -452,6 +452,13 @@ void BufferLayerConsumer::freeBufferLocked(int slotIndex) { 
}



void BufferLayerConsumer::onDisconnect() {

    Mutex::Autolock lock(mMutex);



    if (mAbandoned) {

        // Nothing to do if we're already abandoned.

        return;

    }



    mLayer->onDisconnect();

}
@@ -486,6 +493,13 @@ void BufferLayerConsumer::onBufferAvailable(const BufferItem& item) { 


void BufferLayerConsumer::addAndGetFrameTimestamps(const NewFrameEventsEntry* newTimestamps,

                                                   FrameEventHistoryDelta* outDelta) {

    Mutex::Autolock lock(mMutex);



    if (mAbandoned) {

        // Nothing to do if we're already abandoned.

        return;

    }



    mLayer->addAndGetFrameTimestamps(newTimestamps, outDelta);

}

services/surfaceflinger/BufferLayerConsumer.h

+2 −2
Original line number Diff line number Diff line
@@ -331,8 +331,8 @@ private: 
    // construction time.

    const uint32_t mTexName;



    // The layer for this BufferLayerConsumer

    Layer* mLayer;

    // The layer for this BufferLayerConsumer. Always check mAbandoned before accessing.

    Layer* mLayer GUARDED_BY(mMutex);



    wp<ContentsChangedListener> mContentsChangedListener;