diff options
author | 2017-03-02 13:23:16 -0800 | |
---|---|---|
committer | 2017-03-02 13:30:15 -0800 | |
commit | fc29f7acd1352efa97269b5f3856eb879d5cfd53 (patch) | |
tree | bca5e58917a15e5f3ee37aed0dd3823c8e941c80 /libs/hwui/FrameBuilder.cpp | |
parent | d632305e376c899f6d5cbcaa441350c310b9fe44 (diff) |
Fix potential use-after-free in LayerUpdateQueue
Change-Id: I090af2191576175b165a9db574a80123c16f0778
Fixes: 26548204
Test: Builds & hwui unit tests pass
Diffstat (limited to 'libs/hwui/FrameBuilder.cpp')
-rw-r--r-- | libs/hwui/FrameBuilder.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/libs/hwui/FrameBuilder.cpp b/libs/hwui/FrameBuilder.cpp index 35ff635930ab..1b57e290c198 100644 --- a/libs/hwui/FrameBuilder.cpp +++ b/libs/hwui/FrameBuilder.cpp @@ -78,7 +78,7 @@ void FrameBuilder::deferLayers(const LayerUpdateQueue& layers) { // Render all layers to be updated, in order. Defer in reverse order, so that they'll be // updated in the order they're passed in (mLayerBuilders are issued to Renderer in reverse) for (int i = layers.entries().size() - 1; i >= 0; i--) { - RenderNode* layerNode = layers.entries()[i].renderNode; + RenderNode* layerNode = layers.entries()[i].renderNode.get(); // only schedule repaint if node still on layer - possible it may have been // removed during a dropped frame, but layers may still remain scheduled so // as not to lose info on what portion is damaged |