Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit dcec0bca authored by Lloyd Pique's avatar Lloyd Pique
Browse files

SF: Clear mCompositionInfo before recomputing visible layers 

Both SurfaceFlingerBE::mCompositionInfo and LayerBE::HWCInfo can hold a
shared_ptr to the same HWC2::Layer.

However the lifetime of the HWC2::Layer is only really expected to last
as long as the Layer is referenced by the visible layer list for a
display. This list might be the last thing keeping a sp<Layer> alive,
and when it is removed from the list, cleanup occurs.

The Layer dtor invokes Layer::destroyAllLayers(), which asserts that
cleanup completes succesfully. Effectively it requires that the
HWC2::Layer instance it holds is destroyed, as when it does so the
HWC2::Layer dtor invokes a callback to remove the entry from
LayerBE::HWCInfo for the display.

This fails to happen if the reference count for the shared_ptr does not
drop to zero. Clearing out mCompositionInfo before the visible layers
are recomputed fixes this.

Bug: 119629556
Test: atest CtsViewTestCases
Change-Id: I9b0ea0389fc1ba22a2a230f165689b5ee2f474ce
parent 3e7cf730

services/surfaceflinger/SurfaceFlinger.cpp

+11 −2
Original line number Diff line number Diff line
@@ -1683,8 +1683,6 @@ void SurfaceFlinger::calculateWorkingSet() { 
    mDrawingState.colorMatrixChanged = false;



    for (const auto& [token, display] : mDisplays) {

        getBE().mCompositionInfo[token].clear();



        for (auto& layer : display->getVisibleLayersSortedByZ()) {

            const auto displayId = display->getId();

            layer->getBE().compositionInfo.compositionType = layer->getCompositionType(displayId);
@@ -1968,6 +1966,17 @@ void SurfaceFlinger::rebuildLayerStacks() { 
    ATRACE_CALL();

    ALOGV("rebuildLayerStacks");



    // We need to clear these out now as these may be holding on to a

    // HWC2::Layer reference at the same time as the LayerBE::HWCInfo structure

    // also holds a reference. When the set of visible layers is recomputed,

    // some layers may be destroyed if the only thing keeping them alive was

    // that list of visible layers associated with each display. The layer

    // destruction code asserts that the HWC2::Layer is properly destroyed, but

    // that doesn't happen if SurfaceFlingerBE::mCompositionInfo keeps it alive.

    for (const auto& [token, display] : mDisplays) {

        getBE().mCompositionInfo[token].clear();

    }



    // rebuild the visible layer list per screen

    if (CC_UNLIKELY(mVisibleRegionsDirty)) {

        ATRACE_NAME("rebuildLayerStacks VR Dirty");