diff options
| author | 2024-08-22 15:00:50 -0500 | |
|---|---|---|
| committer | 2024-08-22 15:00:50 -0500 | |
| commit | 1a37b731c88f79f81c4add642b2a06b06d38ea2d (patch) | |
| tree | aa8edbd58683216204584b59ffb6db57488965f7 | |
| parent | 04e70e42877cb7c69c8c06a43d2d1ecfb05859c7 (diff) | |
Fix transactionCallbackThunk lifetime issue
TestBLASTBufferQueue overrides transactionCallback but BLASTBufferQueue::transactionCallback can trigger the destruction of BLASTBufferQueue, causing native crashes. This CL fixes the issue by moving the decStrong call after transactionCallback has completed.
Bug: 294133380
Flag: EXEMPT bugfix
Test: BLASTBufferQueueTest
Change-Id: Ia2344ed6d14e89026f464b32c95c76b3a96a19d0
| -rw-r--r-- | libs/gui/BLASTBufferQueue.cpp | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/libs/gui/BLASTBufferQueue.cpp b/libs/gui/BLASTBufferQueue.cpp index f065ffa611..1fb59fd8e0 100644 --- a/libs/gui/BLASTBufferQueue.cpp +++ b/libs/gui/BLASTBufferQueue.cpp @@ -356,8 +356,9 @@ static void transactionCallbackThunk(void* context, nsecs_t latchTime, if (context == nullptr) { return; } - sp<BLASTBufferQueue> bq = static_cast<BLASTBufferQueue*>(context); + auto bq = static_cast<BLASTBufferQueue*>(context); bq->transactionCallback(latchTime, presentFence, stats); + bq->decStrong((void*)transactionCallbackThunk); } void BLASTBufferQueue::transactionCallback(nsecs_t /*latchTime*/, const sp<Fence>& /*presentFence*/, @@ -413,8 +414,6 @@ void BLASTBufferQueue::transactionCallback(nsecs_t /*latchTime*/, const sp<Fence BQA_LOGE("No matching SurfaceControls found: mSurfaceControlsWithPendingCallback was " "empty."); } - - decStrong((void*)transactionCallbackThunk); } } |