Prevent crash when flushing the layers cache

Bug #6258973

When flushing the layer caches we would attempt to delete the FBOs
associate with layers in the cache. The FBO property was however not
always properly cleared when recycling layers.

Change-Id: I7dedfe391d659a0849f1e1d84df17313b2c6e2b2

3 files changed, 12 insertions, 2 deletions

diff --git a/libs/hwui/LayerCache.cpp b/libs/hwui/LayerCache.cpp
index d304b374850e..eea707edb457 100644
--- a/libs/hwui/LayerCache.cpp
+++ b/libs/hwui/LayerCache.cpp
@@ -69,10 +69,14 @@ void LayerCache::setMaxSize(uint32_t maxSize) {
 
 void LayerCache::deleteLayer(Layer* layer) {
     if (layer) {
-        LAYER_LOGD("Destroying layer %dx%d", layer->getWidth(), layer->getHeight());
+        GLuint fbo = layer->getFbo();
+        LAYER_LOGD("Destroying layer %dx%d, fbo %d", layer->getWidth(), layer->getHeight(), fbo);
+
         mSize -= layer->getWidth() * layer->getHeight() * 4;
-        layer->deleteFbo();
+
+        if (fbo) Caches::getInstance().fboCache.put(fbo);
         layer->deleteTexture();
+
         delete layer;
     }
 }
@@ -174,6 +178,10 @@ bool LayerCache::put(Layer* layer) {
                     victim->layer.getHeight());
         }
 
+        layer->deferredUpdateScheduled = false;
+        layer->renderer = NULL;
+        layer->displayList = NULL;
+
         LayerEntry entry(layer);
 
         mCache.add(entry);
diff --git a/libs/hwui/LayerRenderer.cpp b/libs/hwui/LayerRenderer.cpp
index e320eb2e0047..2a4e72be0e31 100644
--- a/libs/hwui/LayerRenderer.cpp
+++ b/libs/hwui/LayerRenderer.cpp
@@ -309,6 +309,7 @@ void LayerRenderer::destroyLayer(Layer* layer) {
         if (fbo) {
             flushLayer(layer);
             Caches::getInstance().fboCache.put(fbo);
+            layer->setFbo(0);
         }
 
         if (!Caches::getInstance().layerCache.put(layer)) {
diff --git a/libs/hwui/OpenGLRenderer.cpp b/libs/hwui/OpenGLRenderer.cpp
index eb4b83bfb017..e4d1ba90d090 100644
--- a/libs/hwui/OpenGLRenderer.cpp
+++ b/libs/hwui/OpenGLRenderer.cpp
@@ -641,6 +641,7 @@ void OpenGLRenderer::composeLayer(sp<Snapshot> current, sp<Snapshot> previous) {
 
         // Put the FBO name back in the cache, if it doesn't fit, it will be destroyed
         mCaches.fboCache.put(current->fbo);
+        layer->setFbo(0);
     }
 
     dirtyClip();