From b2aada6e8481575304f50594d715b8eeac1b54be Mon Sep 17 00:00:00 2001
From: Colin Cross <ccross@android.com>
Date: Tue, 22 Jul 2014 15:55:08 -0700
Subject: [PATCH 1/3] crash if getNativeBuffer() called on NULL GraphicBuffer

If getNativeBuffer() is called on a NULL GraphicBuffer the
static_cast of this from GraphicBuffer* to ANativeWindowBuffer*
will return a small pointer like (ANativeWindowBuffer*)0x10.
This value can propagate past NULL checks until it causes a crash
far away from the original NULL pointer.  Crash immediately
instead.

Change-Id: Id614b9eb1484108b3c3c733545309844c4b87532
---
 libs/ui/GraphicBuffer.cpp | 1 +
 1 file changed, 1 insertion(+)

diff --git a/libs/ui/GraphicBuffer.cpp b/libs/ui/GraphicBuffer.cpp
index e21dc53ca..9b0bd601c 100644
--- a/libs/ui/GraphicBuffer.cpp
+++ b/libs/ui/GraphicBuffer.cpp
@@ -126,6 +126,7 @@ void GraphicBuffer::dumpAllocationsToSystemLog()
 
 ANativeWindowBuffer* GraphicBuffer::getNativeBuffer() const
 {
+    LOG_ALWAYS_FATAL_IF(this == NULL, "getNativeBuffer() called on NULL GraphicBuffer");
     return static_cast<ANativeWindowBuffer*>(
             const_cast<GraphicBuffer*>(this));
 }

From 86262fcdb4e55bd8e07367d39ed4ff6cba043c3e Mon Sep 17 00:00:00 2001
From: Michael Lentine <mlentine@google.com>
Date: Fri, 8 Aug 2014 10:30:44 -0700
Subject: [PATCH 2/3] Revert "Modify EGL to disconnect the window when the
 surface gets destroyed."

This reverts commit 843cbb241da60ada234918a30cfe9a01a1e04187.
---
 libs/gui/BufferQueueProducer.cpp | 4 ++--
 opengl/libs/EGL/eglApi.cpp       | 9 ---------
 2 files changed, 2 insertions(+), 11 deletions(-)

diff --git a/libs/gui/BufferQueueProducer.cpp b/libs/gui/BufferQueueProducer.cpp
index cbca3acd2..a53775fa7 100644
--- a/libs/gui/BufferQueueProducer.cpp
+++ b/libs/gui/BufferQueueProducer.cpp
@@ -830,8 +830,8 @@ status_t BufferQueueProducer::disconnect(int api) {
                     mCore->mSidebandStream.clear();
                     mCore->mDequeueCondition.broadcast();
                     listener = mCore->mConsumerListener;
-                } else if (mCore->mConnectedApi != BufferQueueCore::NO_CONNECTED_API) {
-                    BQ_LOGE("disconnect(P): still connected to another API "
+                } else {
+                    BQ_LOGE("disconnect(P): connected to another API "
                             "(cur=%d req=%d)", mCore->mConnectedApi, api);
                     status = BAD_VALUE;
                 }
diff --git a/opengl/libs/EGL/eglApi.cpp b/opengl/libs/EGL/eglApi.cpp
index 99c01b7e9..6e77e457b 100644
--- a/opengl/libs/EGL/eglApi.cpp
+++ b/opengl/libs/EGL/eglApi.cpp
@@ -572,15 +572,6 @@ EGLBoolean eglDestroySurface(EGLDisplay dpy, EGLSurface surface)
         return setError(EGL_BAD_SURFACE, EGL_FALSE);
 
     egl_surface_t * const s = get_surface(surface);
-    ANativeWindow* window = s->win.get();
-    if (window) {
-        int result = native_window_api_disconnect(window, NATIVE_WINDOW_API_EGL);
-        if (result != OK) {
-            ALOGE("eglDestroySurface: native_window_api_disconnect (win=%p) "
-                  "failed (%#x)",
-                  window, result);
-        }
-    }
     EGLBoolean result = s->cnx->egl.eglDestroySurface(dp->disp.dpy, s->surface);
     if (result == EGL_TRUE) {
         _s.terminate();

From b0780bfd9361257ca7def75aaccb1411e6b77265 Mon Sep 17 00:00:00 2001
From: Brian Carlstrom <bdc@google.com>
Date: Fri, 8 Aug 2014 00:52:22 -0700
Subject: [PATCH 3/3] Use set_sched_policy to put dexopt operations in
 SP_BACKGROUND cgroup

Bug: 15927194

(cherry picked from commit 0378aaf257aee92539d30543914a50c4481c6a18)

Change-Id: I462b5ac256c4d091ed4023cf4b97dd6a4abcaa5f
---
 cmds/installd/commands.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/cmds/installd/commands.c b/cmds/installd/commands.c
index bd721c892..f05ce617a 100644
--- a/cmds/installd/commands.c
+++ b/cmds/installd/commands.c
@@ -17,6 +17,7 @@
 #include <inttypes.h>
 #include <sys/capability.h>
 #include "installd.h"
+#include <cutils/sched_policy.h>
 #include <diskusage/dirsize.h>
 #include <selinux/android.h>
 
@@ -950,6 +951,10 @@ int dexopt(const char *apk_path, uid_t uid, int is_public,
             ALOGE("capset failed: %s\n", strerror(errno));
             exit(66);
         }
+        if (set_sched_policy(0, SP_BACKGROUND) < 0) {
+            ALOGE("set_sched_policy failed: %s\n", strerror(errno));
+            exit(70);
+        }
         if (flock(out_fd, LOCK_EX | LOCK_NB) != 0) {
             ALOGE("flock(%s) failed: %s\n", out_path, strerror(errno));
             exit(67);