Grab lock before reparenting in SurfaceFlinger commitMirrorDisplays()

Bug: 271644537
Test: n/a
Change-Id: I45384210791bd9280f63d95e3bdaef3d299fc818
(cherry picked from commit 9cba62a07f393d852dabf20b6e4d10e67b29c8d9)
Merged-In: I45384210791bd9280f63d95e3bdaef3d299fc818

1 files changed, 8 insertions, 3 deletions

diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 6a2e3475b9..9ceb0afa20 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -7913,9 +7913,14 @@ bool SurfaceFlinger::commitMirrorDisplays(VsyncId vsyncId) {
                                          ISurfaceComposerClient::eNoColorFill,
                                          gui::LayerMetadata());
             sp<Layer> childMirror;
-            createEffectLayer(mirrorArgs, &unused, &childMirror);
-            childMirror->setClonedChild(layer->createClone());
-            childMirror->reparent(mirrorDisplay.rootHandle);
+            {
+                Mutex::Autolock lock(mStateLock);
+                createEffectLayer(mirrorArgs, &unused, &childMirror);
+                childMirror->setClonedChild(layer->createClone());
+                childMirror->reparent(mirrorDisplay.rootHandle);
+            }
+            // lock on mStateLock needs to be released before binder handle gets destroyed
+            unused.clear();
         }
     }
     return true;