Visualizer: Fix race condition in setCaptureCallBack

Visualizer:setCaptureCallBack needs to make a local
copy of the CaptureThread pointer before temporarily
releasing mCaptureLock. Otherwise, mCaptureThread
can be released in the meantime from Visualizer::release

Bug: 149375271
Test: use EffectsTest app with "Multithreaded Use"
      for the Visualizer test. Repeat releasing the effect
      while capture via callback is active.
Change-Id: Iaea62a0e2f7e7a996c1554b9ed89efb67fbdfc11

1 files changed, 2 insertions, 1 deletions

diff --git a/media/jni/audioeffect/Visualizer.cpp b/media/jni/audioeffect/Visualizer.cpp
index 83f3b6ed6217..efeb3352d393 100644
--- a/media/jni/audioeffect/Visualizer.cpp
+++ b/media/jni/audioeffect/Visualizer.cpp
@@ -120,8 +120,9 @@ status_t Visualizer::setCaptureCallBack(capture_cbk_t cbk, void* user, uint32_t
     }
 
     if (mCaptureThread != 0) {
+        sp<CaptureThread> t = mCaptureThread;
         mCaptureLock.unlock();
-        mCaptureThread->requestExitAndWait();
+        t->requestExitAndWait();
         mCaptureLock.lock();
     }