Merge "Fix FilterClientCallbackImpl race condition" into main

1 files changed, 19 insertions, 7 deletions

diff --git a/media/jni/android_media_tv_Tuner.cpp b/media/jni/android_media_tv_Tuner.cpp
index 2fe069af638a..bf330dab266c 100644
--- a/media/jni/android_media_tv_Tuner.cpp
+++ b/media/jni/android_media_tv_Tuner.cpp
@@ -701,6 +701,9 @@ void FilterClientCallbackImpl::getMediaEvent(const jobjectArray& arr, const int
 
     // Protect mFilterClient from being set to null.
     android::Mutex::Autolock autoLock(mLock);
+    if (mFilterClient == nullptr) {
+        return;
+    }
     uint64_t avSharedMemSize = mFilterClient->getAvSharedHandleInfo().size;
     if (mediaEvent.avMemory.fds.size() > 0 || mediaEvent.avDataId != 0 ||
         (dataLength > 0 && (dataLength + offset) < avSharedMemSize)) {
@@ -868,10 +871,18 @@ void FilterClientCallbackImpl::getRestartEvent(const jobjectArray& arr, const in
 void FilterClientCallbackImpl::onFilterEvent(const vector<DemuxFilterEvent> &events) {
     ALOGV("FilterClientCallbackImpl::onFilterEvent");
     JNIEnv *env = AndroidRuntime::getJNIEnv();
+
     ScopedLocalRef<jobjectArray> array(env);
 
     if (!events.empty()) {
         array.reset(env->NewObjectArray(events.size(), mEventClass, nullptr));
+        if (env->IsSameObject(array.get(), nullptr)) {
+            // It can happen when FilterClientCallbackImpl release the resource
+            // in another thread.
+            ALOGE("FilterClientCallbackImpl::onFilterEvent:"
+                  "Unable to create object array of filter events. Ignoring callback.");
+            return;
+        }
     }
 
     for (int i = 0, arraySize = 0; i < events.size(); i++) {
@@ -1070,14 +1081,15 @@ FilterClientCallbackImpl::FilterClientCallbackImpl() {
 
 FilterClientCallbackImpl::~FilterClientCallbackImpl() {
     JNIEnv *env = AndroidRuntime::getJNIEnv();
-    {
-        android::Mutex::Autolock autoLock(mLock);
-        if (mFilterObj != nullptr) {
-            env->DeleteWeakGlobalRef(mFilterObj);
-            mFilterObj = nullptr;
-        }
-        mFilterClient = nullptr;
+
+    android::Mutex::Autolock autoLock(mLock);
+
+    if (mFilterObj != nullptr) {
+        env->DeleteWeakGlobalRef(mFilterObj);
+        mFilterObj = nullptr;
     }
+    mFilterClient = nullptr;
+
     env->DeleteGlobalRef(mEventClass);
     env->DeleteGlobalRef(mSectionEventClass);
     env->DeleteGlobalRef(mMediaEventClass);