ADHOC/replicant-frameworks_native
3
0
Fork 0
Code Issues 7 Pull Requests Releases Wiki Activity

GraphicProducerWrapper may return false transact status

Browse Source 
GraphicProducerWrapper(GPW) changed how the methods of
BpGraphicBufferProducer(BpGBP) are executed.
First, "fake" BpGBP is created. Its remote is GPW. The GPW has
wrapped the real BpGBP.
All the method calls to the fake BpGPB will be intercepted by
the GPW inside it when the methods run into remote()->transact().
Then the GPW will invoke the transact() of the real BpGBP. And
Everything runs well except that the GPW forgets to store the
transact status and always return NO_ERROR to the fake BpGBP.

It would be disastrous if the binder call of the IGBP failed and
the out parameter "reply" of transact() was in unkown state.
E.g. the queueBuffer() in the fake BpGBP will try to operate on
the "reply". This will crash the SurfaceFlinger.

Change-Id: I01b31f64e1fc92804da3f16c1fb1420dcfb3b855
Signed-off-by: bdeng3X <bingx.deng@intel.com>
Signed-off-by: Guobin Zhang <guobin.zhang@intel.com>
This commit is contained in:
bdeng3X 2014-03-20 09:15:34 +08:00 committed by Guobin Zhang
parent b1a8c01637
commit c2633ce19b
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
services/surfaceflinger/SurfaceFlinger.cpp
View File

@ -2639,7 +2639,7 @@ class GraphicProducerWrapper : public BBinder, public MessageHandler {
looper->sendMessage(this, Message(MSG_API_CALL));
barrier.wait();
}
return NO_ERROR;
return result;
}
/*
@ -2649,7 +2649,7 @@ class GraphicProducerWrapper : public BBinder, public MessageHandler {
virtual void handleMessage(const Message& message) {
android_atomic_release_load(&memoryBarrier);
if (message.what == MSG_API_CALL) {
impl->asBinder()->transact(code, data[0], reply);
result = impl->asBinder()->transact(code, data[0], reply);
barrier.open();
} else if (message.what == MSG_EXIT) {
exitRequested = true;