Merge "Fix a race-condtion in SurfaceFlinger that could lead to a crash."
This commit is contained in:
commit
e4b117ad45
@ -1094,15 +1094,15 @@ status_t SurfaceFlinger::addLayer_l(const sp<LayerBase>& layer)
|
||||
ssize_t SurfaceFlinger::addClientLayer(const sp<Client>& client,
|
||||
const sp<LayerBaseClient>& lbc)
|
||||
{
|
||||
Mutex::Autolock _l(mStateLock);
|
||||
|
||||
// attach this layer to the client
|
||||
ssize_t name = client->attachLayer(lbc);
|
||||
size_t name = client->attachLayer(lbc);
|
||||
|
||||
Mutex::Autolock _l(mStateLock);
|
||||
|
||||
// add this layer to the current state list
|
||||
addLayer_l(lbc);
|
||||
|
||||
return name;
|
||||
return ssize_t(name);
|
||||
}
|
||||
|
||||
status_t SurfaceFlinger::removeLayer(const sp<LayerBase>& layer)
|
||||
@ -2381,15 +2381,17 @@ status_t Client::initCheck() const {
|
||||
return NO_ERROR;
|
||||
}
|
||||
|
||||
ssize_t Client::attachLayer(const sp<LayerBaseClient>& layer)
|
||||
size_t Client::attachLayer(const sp<LayerBaseClient>& layer)
|
||||
{
|
||||
int32_t name = android_atomic_inc(&mNameGenerator);
|
||||
Mutex::Autolock _l(mLock);
|
||||
size_t name = mNameGenerator++;
|
||||
mLayers.add(name, layer);
|
||||
return name;
|
||||
}
|
||||
|
||||
void Client::detachLayer(const LayerBaseClient* layer)
|
||||
{
|
||||
Mutex::Autolock _l(mLock);
|
||||
// we do a linear search here, because this doesn't happen often
|
||||
const size_t count = mLayers.size();
|
||||
for (size_t i=0 ; i<count ; i++) {
|
||||
@ -2399,9 +2401,11 @@ void Client::detachLayer(const LayerBaseClient* layer)
|
||||
}
|
||||
}
|
||||
}
|
||||
sp<LayerBaseClient> Client::getLayerUser(int32_t i) const {
|
||||
sp<LayerBaseClient> Client::getLayerUser(int32_t i) const
|
||||
{
|
||||
Mutex::Autolock _l(mLock);
|
||||
sp<LayerBaseClient> lbc;
|
||||
const wp<LayerBaseClient>& layer(mLayers.valueFor(i));
|
||||
wp<LayerBaseClient> layer(mLayers.valueFor(i));
|
||||
if (layer != 0) {
|
||||
lbc = layer.promote();
|
||||
LOGE_IF(lbc==0, "getLayerUser(name=%d) is dead", int(i));
|
||||
|
@ -65,7 +65,7 @@ public:
|
||||
status_t initCheck() const;
|
||||
|
||||
// protected by SurfaceFlinger::mStateLock
|
||||
ssize_t attachLayer(const sp<LayerBaseClient>& layer);
|
||||
size_t attachLayer(const sp<LayerBaseClient>& layer);
|
||||
void detachLayer(const LayerBaseClient* layer);
|
||||
sp<LayerBaseClient> getLayerUser(int32_t i) const;
|
||||
|
||||
@ -81,9 +81,15 @@ private:
|
||||
virtual status_t destroySurface(SurfaceID surfaceId);
|
||||
virtual status_t setState(int32_t count, const layer_state_t* states);
|
||||
|
||||
DefaultKeyedVector< size_t, wp<LayerBaseClient> > mLayers;
|
||||
// constant
|
||||
sp<SurfaceFlinger> mFlinger;
|
||||
int32_t mNameGenerator;
|
||||
|
||||
// protected by mLock
|
||||
DefaultKeyedVector< size_t, wp<LayerBaseClient> > mLayers;
|
||||
size_t mNameGenerator;
|
||||
|
||||
// thread-safe
|
||||
mutable Mutex mLock;
|
||||
};
|
||||
|
||||
class UserClient : public BnSurfaceComposerClient
|
||||
|
Loading…
Reference in New Issue
Block a user