Go to file
Chih-Chung Chang b6aef253f4 Flush binder buffer after setting raw heap to avoid leaking a reference.
The problem was:

1. In handleShutter(), thread A in CameraService calls
   registerBuffers(IMemoryHeap) and it's received by thread B
   in system_server. [transaction 1]
2. While thread A is waiting for the reply, thread B calls
   back to thread A to get the id of the heap
   (IMemoryHeap.getHeapID). [transaction 2]
3. Thread A replies transaction 2 and is preemptied in kernel.
   Thread B gets the reply and finishes registerBuffers and send
   reply for transaction 1.
4. When thread A runs again, it gets the reply for transaction 1
   and returns to handleShutter().
5. At this point the transaction buffer for transaction 2 (which
   holds a reference to IMemoryHeap) is not freed because the
   BC_FREE_BUFFER command is kept in thread A's local command
   queue and not sent to the kernel.
6. Normally when thread A makes next transaction, the
   BC_FREE_BUFFER command will be sent together (piggyback) with
   the commands for that transaction. But in this case thread A
   is a callback thread from camera driver, so it does not make
   any binder calls afterwards, and the IMemoryHeap is never freed
   (until the next time handleShutter is called).

Change-Id: I435a258187509bdbbaf353339eb9ea577610cbd2
2010-07-02 12:56:54 +08:00
awt
camera Flush binder buffer after setting raw heap to avoid leaking a reference. 2010-07-02 12:56:54 +08:00
cmds keystore: rephrase the comment to make the usage more clear. 2010-03-17 16:31:20 +08:00
include Make static versions of libutils and libbinder. 2010-05-06 01:03:31 -07:00
libs fix [2664345] Flash: Bad flicker at the end of a pinch zoom. 2010-05-06 20:21:45 -07:00
opengl Fix Android's glEGLImageTargetRenderbufferOES() wrapper 2010-03-29 15:12:19 -07:00
vpn DO NOT MERGE 2010-03-29 18:12:24 -07:00
MODULE_LICENSE_APACHE2
NOTICE Adding PacketVideo attribution in NOTICE. 2010-05-06 14:15:47 -07:00