sensorservice: switch to use sp<> in sensor list

* Switch to use smart pointer in SensorList to avoid object
  life cycle issue.
* Refactor HardwareSensor and various virtual sensor class.
* Change active virtual sensor map into a set of handles.

Change-Id: I674d5eb5c0038179f9ef1b6f0d576b8b605649ec

18 files changed, 279 insertions, 320 deletions

diff --git a/libs/gui/Sensor.cpp b/libs/gui/Sensor.cpp
index 4b9a2abe96..0340d6bd6f 100644
--- a/libs/gui/Sensor.cpp
+++ b/libs/gui/Sensor.cpp
@@ -272,6 +272,11 @@ Sensor::Sensor(struct sensor_t const* hwSensor, int halVersion)
         break;
     }
 
+    // Set DYNAMIC_SENSOR_MASK and ADDITIONAL_INFO_MASK flag here. Compatible with HAL 1_3.
+    if (halVersion >= SENSORS_DEVICE_API_VERSION_1_3) {
+        mFlags |= (hwSensor->flags & (DYNAMIC_SENSOR_MASK | ADDITIONAL_INFO_MASK));
+    }
+
     // Set DATA_INJECTION flag here. Defined in HAL 1_4.
     if (halVersion >= SENSORS_DEVICE_API_VERSION_1_4) {
         mFlags |= (hwSensor->flags & DATA_INJECTION_MASK);
diff --git a/services/sensorservice/CorrectedGyroSensor.cpp b/services/sensorservice/CorrectedGyroSensor.cpp
index 788def9c5b..005af18b2c 100644
--- a/services/sensorservice/CorrectedGyroSensor.cpp
+++ b/services/sensorservice/CorrectedGyroSensor.cpp
@@ -30,9 +30,7 @@ namespace android {
 // ---------------------------------------------------------------------------
 
 CorrectedGyroSensor::CorrectedGyroSensor(sensor_t const* list, size_t count)
-    : mSensorDevice(SensorDevice::getInstance()),
-      mSensorFusion(SensorFusion::getInstance())
-{
+    : VirtualSensor() {
     for (size_t i=0 ; i<count ; i++) {
         if (list[i].type == SENSOR_TYPE_GYROSCOPE) {
             mGyro = Sensor(list + i);
@@ -40,17 +38,18 @@ CorrectedGyroSensor::CorrectedGyroSensor(sensor_t const* list, size_t count)
         }
     }
 
-    sensor_t hwSensor;
-    hwSensor.name       = "Corrected Gyroscope Sensor";
-    hwSensor.vendor     = "AOSP";
-    hwSensor.version    = 1;
-    hwSensor.handle     = '_cgy';
-    hwSensor.type       = SENSOR_TYPE_GYROSCOPE;
-    hwSensor.maxRange   = mGyro.getMaxValue();
-    hwSensor.resolution = mGyro.getResolution();
-    hwSensor.power      = mSensorFusion.getPowerUsage();
-    hwSensor.minDelay   = mGyro.getMinDelay();
-    mSensor = Sensor(&hwSensor);
+    const sensor_t sensor = {
+            .name       = "Corrected Gyroscope Sensor",
+            .vendor     = "AOSP",
+            .version    = 1,
+            .handle     = '_cgy',
+            .type       = SENSOR_TYPE_GYROSCOPE,
+            .maxRange   = mGyro.getMaxValue(),
+            .resolution = mGyro.getResolution(),
+            .power      = mSensorFusion.getPowerUsage(),
+            .minDelay   = mGyro.getMinDelay(),
+    };
+    mSensor = Sensor(&sensor);
 }
 
 bool CorrectedGyroSensor::process(sensors_event_t* outEvent,
@@ -78,10 +77,6 @@ status_t CorrectedGyroSensor::setDelay(void* ident, int /*handle*/, int64_t ns)
     return mSensorFusion.setDelay(FUSION_9AXIS, ident, ns);
 }
 
-const Sensor& CorrectedGyroSensor::getSensor() const {
-    return mSensor;
-}
-
 // ---------------------------------------------------------------------------
 }; // namespace android
 
diff --git a/services/sensorservice/CorrectedGyroSensor.h b/services/sensorservice/CorrectedGyroSensor.h
index 3419a8ad84..68acd43fd9 100644
--- a/services/sensorservice/CorrectedGyroSensor.h
+++ b/services/sensorservice/CorrectedGyroSensor.h
@@ -31,19 +31,14 @@ namespace android {
 class SensorDevice;
 class SensorFusion;
 
-class CorrectedGyroSensor : public SensorInterface {
-    SensorDevice& mSensorDevice;
-    SensorFusion& mSensorFusion;
+class CorrectedGyroSensor : public VirtualSensor {
     Sensor mGyro;
-    Sensor mSensor;
 
 public:
     CorrectedGyroSensor(sensor_t const* list, size_t count);
     virtual bool process(sensors_event_t* outEvent, const sensors_event_t& event) override;
     virtual status_t activate(void* ident, bool enabled) override;
     virtual status_t setDelay(void* ident, int handle, int64_t ns) override;
-    virtual const Sensor& getSensor() const override;
-    virtual bool isVirtual() const override { return true; }
 };
 
 // ---------------------------------------------------------------------------
diff --git a/services/sensorservice/GravitySensor.cpp b/services/sensorservice/GravitySensor.cpp
index 0e80f1617a..9d8add169f 100644
--- a/services/sensorservice/GravitySensor.cpp
+++ b/services/sensorservice/GravitySensor.cpp
@@ -29,10 +29,7 @@
 namespace android {
 // ---------------------------------------------------------------------------
 
-GravitySensor::GravitySensor(sensor_t const* list, size_t count)
-    : mSensorDevice(SensorDevice::getInstance()),
-      mSensorFusion(SensorFusion::getInstance())
-{
+GravitySensor::GravitySensor(sensor_t const* list, size_t count) {
     for (size_t i=0 ; i<count ; i++) {
         if (list[i].type == SENSOR_TYPE_ACCELEROMETER) {
             mAccelerometer = Sensor(list + i);
@@ -40,17 +37,18 @@ GravitySensor::GravitySensor(sensor_t const* list, size_t count)
         }
     }
 
-    sensor_t hwSensor;
-    hwSensor.name       = "Gravity Sensor";
-    hwSensor.vendor     = "AOSP";
-    hwSensor.version    = 3;
-    hwSensor.handle     = '_grv';
-    hwSensor.type       = SENSOR_TYPE_GRAVITY;
-    hwSensor.maxRange   = GRAVITY_EARTH * 2;
-    hwSensor.resolution = mAccelerometer.getResolution();
-    hwSensor.power      = mSensorFusion.getPowerUsage();
-    hwSensor.minDelay   = mSensorFusion.getMinDelay();
-    mSensor = Sensor(&hwSensor);
+    const sensor_t sensor = {
+        .name       = "Gravity Sensor",
+        .vendor     = "AOSP",
+        .version    = 3,
+        .handle     = '_grv',
+        .type       = SENSOR_TYPE_GRAVITY,
+        .maxRange   = GRAVITY_EARTH * 2,
+        .resolution = mAccelerometer.getResolution(),
+        .power      = mSensorFusion.getPowerUsage(),
+        .minDelay   = mSensorFusion.getMinDelay(),
+    };
+    mSensor = Sensor(&sensor);
 }
 
 bool GravitySensor::process(sensors_event_t* outEvent,
@@ -85,10 +83,6 @@ status_t GravitySensor::setDelay(void* ident, int /*handle*/, int64_t ns) {
     return mSensorFusion.setDelay(FUSION_NOMAG, ident, ns);
 }
 
-const Sensor& GravitySensor::getSensor() const {
-    return mSensor;
-}
-
 // ---------------------------------------------------------------------------
 }; // namespace android
 
diff --git a/services/sensorservice/GravitySensor.h b/services/sensorservice/GravitySensor.h
index f9c0a991df..8e33a73a78 100644
--- a/services/sensorservice/GravitySensor.h
+++ b/services/sensorservice/GravitySensor.h
@@ -31,19 +31,14 @@ namespace android {
 class SensorDevice;
 class SensorFusion;
 
-class GravitySensor : public SensorInterface {
-    SensorDevice& mSensorDevice;
-    SensorFusion& mSensorFusion;
+class GravitySensor : public VirtualSensor {
     Sensor mAccelerometer;
-    Sensor mSensor;
 
 public:
     GravitySensor(sensor_t const* list, size_t count);
     virtual bool process(sensors_event_t* outEvent, const sensors_event_t& event) override;
     virtual status_t activate(void* ident, bool enabled) override;
     virtual status_t setDelay(void* ident, int handle, int64_t ns) override;
-    virtual const Sensor& getSensor() const override;
-    virtual bool isVirtual() const override { return true; }
 };
 
 // ---------------------------------------------------------------------------
diff --git a/services/sensorservice/LinearAccelerationSensor.cpp b/services/sensorservice/LinearAccelerationSensor.cpp
index 04beceda55..d1cd732499 100644
--- a/services/sensorservice/LinearAccelerationSensor.cpp
+++ b/services/sensorservice/LinearAccelerationSensor.cpp
@@ -29,22 +29,21 @@
 namespace android {
 // ---------------------------------------------------------------------------
 
-LinearAccelerationSensor::LinearAccelerationSensor(sensor_t const* list, size_t count)
-    : mSensorDevice(SensorDevice::getInstance()),
-      mGravitySensor(list, count)
-{
+LinearAccelerationSensor::LinearAccelerationSensor(sensor_t const* list, size_t count) :
+        mGravitySensor(list, count) {
     const Sensor &gsensor = mGravitySensor.getSensor();
-    sensor_t hwSensor;
-    hwSensor.name       = "Linear Acceleration Sensor";
-    hwSensor.vendor     = "AOSP";
-    hwSensor.version    = gsensor.getVersion();
-    hwSensor.handle     = '_lin';
-    hwSensor.type       = SENSOR_TYPE_LINEAR_ACCELERATION;
-    hwSensor.maxRange   = gsensor.getMaxValue();
-    hwSensor.resolution = gsensor.getResolution();
-    hwSensor.power      = gsensor.getPowerUsage();
-    hwSensor.minDelay   = gsensor.getMinDelay();
-    mSensor = Sensor(&hwSensor);
+    const sensor_t sensor = {
+        .name       = "Linear Acceleration Sensor",
+        .vendor     = "AOSP",
+        .version    = gsensor.getVersion(),
+        .handle     = '_lin',
+        .type       = SENSOR_TYPE_LINEAR_ACCELERATION,
+        .maxRange   = gsensor.getMaxValue(),
+        .resolution = gsensor.getResolution(),
+        .power      = gsensor.getPowerUsage(),
+        .minDelay   = gsensor.getMinDelay(),
+    };
+    mSensor = Sensor(&sensor);
 }
 
 bool LinearAccelerationSensor::process(sensors_event_t* outEvent,
@@ -70,10 +69,6 @@ status_t LinearAccelerationSensor::setDelay(void* ident, int handle, int64_t ns)
     return mGravitySensor.setDelay(ident, handle, ns);
 }
 
-const Sensor& LinearAccelerationSensor::getSensor() const {
-    return mSensor;
-}
-
 // ---------------------------------------------------------------------------
 }; // namespace android
 
diff --git a/services/sensorservice/LinearAccelerationSensor.h b/services/sensorservice/LinearAccelerationSensor.h
index 6b8027b166..428baa6995 100644
--- a/services/sensorservice/LinearAccelerationSensor.h
+++ b/services/sensorservice/LinearAccelerationSensor.h
@@ -32,10 +32,8 @@ namespace android {
 class SensorDevice;
 class SensorFusion;
 
-class LinearAccelerationSensor : public SensorInterface {
-    SensorDevice& mSensorDevice;
+class LinearAccelerationSensor : public VirtualSensor {
     GravitySensor mGravitySensor;
-    Sensor mSensor;
 
     virtual bool process(sensors_event_t* outEvent,
             const sensors_event_t& event);
@@ -43,8 +41,6 @@ public:
     LinearAccelerationSensor(sensor_t const* list, size_t count);
     virtual status_t activate(void* ident, bool enabled) override;
     virtual status_t setDelay(void* ident, int handle, int64_t ns) override;
-    virtual const Sensor& getSensor() const override;
-    virtual bool isVirtual() const override { return true; }
 };
 
 // ---------------------------------------------------------------------------
diff --git a/services/sensorservice/OrientationSensor.cpp b/services/sensorservice/OrientationSensor.cpp
index 20b49be284..ea5dbc9044 100644
--- a/services/sensorservice/OrientationSensor.cpp
+++ b/services/sensorservice/OrientationSensor.cpp
@@ -29,24 +29,19 @@
 namespace android {
 // ---------------------------------------------------------------------------
 
-OrientationSensor::OrientationSensor()
-    : mSensorDevice(SensorDevice::getInstance()),
-      mSensorFusion(SensorFusion::getInstance())
-{
-    // FIXME: instead of using the SensorFusion code, we should use
-    // the SENSOR_TYPE_ROTATION_VECTOR instead. This way we could use the
-    // HAL's implementation.
-    sensor_t hwSensor;
-    hwSensor.name       = "Orientation Sensor";
-    hwSensor.vendor     = "AOSP";
-    hwSensor.version    = 1;
-    hwSensor.handle     = '_ypr';
-    hwSensor.type       = SENSOR_TYPE_ORIENTATION;
-    hwSensor.maxRange   = 360.0f;
-    hwSensor.resolution = 1.0f/256.0f; // FIXME: real value here
-    hwSensor.power      = mSensorFusion.getPowerUsage();
-    hwSensor.minDelay   = mSensorFusion.getMinDelay();
-    mSensor = Sensor(&hwSensor);
+OrientationSensor::OrientationSensor() {
+    const sensor_t sensor = {
+        .name       = "Orientation Sensor",
+        .vendor     = "AOSP",
+        .version    = 1,
+        .handle     = '_ypr',
+        .type       = SENSOR_TYPE_ORIENTATION,
+        .maxRange   = 360.0f,
+        .resolution = 1.0f/256.0f, // FIXME: real value here
+        .power      = mSensorFusion.getPowerUsage(),
+        .minDelay   = mSensorFusion.getMinDelay(),
+    };
+    mSensor = Sensor(&sensor);
 }
 
 bool OrientationSensor::process(sensors_event_t* outEvent,
@@ -84,10 +79,6 @@ status_t OrientationSensor::setDelay(void* ident, int /*handle*/, int64_t ns) {
     return mSensorFusion.setDelay(FUSION_9AXIS, ident, ns);
 }
 
-const Sensor& OrientationSensor::getSensor() const {
-    return mSensor;
-}
-
 // ---------------------------------------------------------------------------
 }; // namespace android
 
diff --git a/services/sensorservice/OrientationSensor.h b/services/sensorservice/OrientationSensor.h
index 644a774b19..30ff226364 100644
--- a/services/sensorservice/OrientationSensor.h
+++ b/services/sensorservice/OrientationSensor.h
@@ -31,18 +31,12 @@ namespace android {
 class SensorDevice;
 class SensorFusion;
 
-class OrientationSensor : public SensorInterface {
-    SensorDevice& mSensorDevice;
-    SensorFusion& mSensorFusion;
-    Sensor mSensor;
-
+class OrientationSensor : public VirtualSensor {
 public:
     OrientationSensor();
     virtual bool process(sensors_event_t* outEvent, const sensors_event_t& event) override;
     virtual status_t activate(void* ident, bool enabled) override;
     virtual status_t setDelay(void* ident, int handle, int64_t ns) override;
-    virtual const Sensor& getSensor() const override;
-    virtual bool isVirtual() const override { return true; }
 };
 
 // ---------------------------------------------------------------------------
diff --git a/services/sensorservice/RotationVectorSensor.cpp b/services/sensorservice/RotationVectorSensor.cpp
index 5a40ef98cb..7b00f4d98d 100644
--- a/services/sensorservice/RotationVectorSensor.cpp
+++ b/services/sensorservice/RotationVectorSensor.cpp
@@ -27,22 +27,20 @@
 namespace android {
 // ---------------------------------------------------------------------------
 
-RotationVectorSensor::RotationVectorSensor(int mode)
-    : mSensorDevice(SensorDevice::getInstance()),
-      mSensorFusion(SensorFusion::getInstance()),
-      mMode(mode)
-{
-    sensor_t hwSensor;
-    hwSensor.name       = getSensorName();
-    hwSensor.vendor     = "AOSP";
-    hwSensor.version    = 3;
-    hwSensor.handle     = getSensorToken();
-    hwSensor.type       = getSensorType();
-    hwSensor.maxRange   = 1;
-    hwSensor.resolution = 1.0f / (1<<24);
-    hwSensor.power      = mSensorFusion.getPowerUsage();
-    hwSensor.minDelay   = mSensorFusion.getMinDelay();
-    mSensor = Sensor(&hwSensor);
+RotationVectorSensor::RotationVectorSensor(int mode) :
+      mMode(mode) {
+    const sensor_t sensor = {
+        .name       = getSensorName(),
+        .vendor     = "AOSP",
+        .version    = 3,
+        .handle     = getSensorToken(),
+        .type       = getSensorType(),
+        .maxRange   = 1,
+        .resolution = 1.0f / (1<<24),
+        .power      = mSensorFusion.getPowerUsage(),
+        .minDelay   = mSensorFusion.getMinDelay(),
+    };
+    mSensor = Sensor(&sensor);
 }
 
 bool RotationVectorSensor::process(sensors_event_t* outEvent,
@@ -72,10 +70,6 @@ status_t RotationVectorSensor::setDelay(void* ident, int /*handle*/, int64_t ns)
     return mSensorFusion.setDelay(mMode, ident, ns);
 }
 
-const Sensor& RotationVectorSensor::getSensor() const {
-    return mSensor;
-}
-
 int RotationVectorSensor::getSensorType() const {
     switch(mMode) {
         case FUSION_9AXIS:
@@ -120,21 +114,19 @@ int RotationVectorSensor::getSensorToken() const {
 
 // ---------------------------------------------------------------------------
 
-GyroDriftSensor::GyroDriftSensor()
-    : mSensorDevice(SensorDevice::getInstance()),
-      mSensorFusion(SensorFusion::getInstance())
-{
-    sensor_t hwSensor;
-    hwSensor.name       = "Gyroscope Bias (debug)";
-    hwSensor.vendor     = "AOSP";
-    hwSensor.version    = 1;
-    hwSensor.handle     = '_gbs';
-    hwSensor.type       = SENSOR_TYPE_ACCELEROMETER;
-    hwSensor.maxRange   = 1;
-    hwSensor.resolution = 1.0f / (1<<24);
-    hwSensor.power      = mSensorFusion.getPowerUsage();
-    hwSensor.minDelay   = mSensorFusion.getMinDelay();
-    mSensor = Sensor(&hwSensor);
+GyroDriftSensor::GyroDriftSensor() {
+    const sensor_t sensor = {
+        .name       = "Gyroscope Bias (debug)",
+        .vendor     = "AOSP",
+        .version    = 1,
+        .handle     = '_gbs',
+        .type       = SENSOR_TYPE_ACCELEROMETER,
+        .maxRange   = 1,
+        .resolution = 1.0f / (1<<24),
+        .power      = mSensorFusion.getPowerUsage(),
+        .minDelay   = mSensorFusion.getMinDelay(),
+    };
+    mSensor = Sensor(&sensor);
 }
 
 bool GyroDriftSensor::process(sensors_event_t* outEvent,
@@ -163,10 +155,6 @@ status_t GyroDriftSensor::setDelay(void* ident, int /*handle*/, int64_t ns) {
     return mSensorFusion.setDelay(FUSION_9AXIS, ident, ns);
 }
 
-const Sensor& GyroDriftSensor::getSensor() const {
-    return mSensor;
-}
-
 // ---------------------------------------------------------------------------
 }; // namespace android
 
diff --git a/services/sensorservice/RotationVectorSensor.h b/services/sensorservice/RotationVectorSensor.h
index 5dba0d50f2..3cc224888b 100644
--- a/services/sensorservice/RotationVectorSensor.h
+++ b/services/sensorservice/RotationVectorSensor.h
@@ -32,23 +32,18 @@
 namespace android {
 // ---------------------------------------------------------------------------
 
-class RotationVectorSensor : public SensorInterface {
-    SensorDevice& mSensorDevice;
-    SensorFusion& mSensorFusion;
-    int mMode;
-    Sensor mSensor;
-
-    int getSensorType() const;
-    const char* getSensorName() const ;
-    int getSensorToken() const ;
-
+class RotationVectorSensor : public VirtualSensor {
 public:
     RotationVectorSensor(int mode = FUSION_9AXIS);
     virtual bool process(sensors_event_t* outEvent, const sensors_event_t& event) override;
     virtual status_t activate(void* ident, bool enabled) override;
     virtual status_t setDelay(void* ident, int handle, int64_t ns) override;
-    virtual const Sensor& getSensor() const override;
-    virtual bool isVirtual() const override { return true; }
+
+protected:
+    const int mMode;
+    int getSensorType() const;
+    const char* getSensorName() const ;
+    int getSensorToken() const ;
 };
 
 class GameRotationVectorSensor : public RotationVectorSensor {
@@ -61,18 +56,12 @@ public:
     GeoMagRotationVectorSensor() : RotationVectorSensor(FUSION_NOGYRO) {}
 };
 
-class GyroDriftSensor : public SensorInterface {
-    SensorDevice& mSensorDevice;
-    SensorFusion& mSensorFusion;
-    Sensor mSensor;
-
+class GyroDriftSensor : public VirtualSensor {
 public:
     GyroDriftSensor();
     virtual bool process(sensors_event_t* outEvent, const sensors_event_t& event) override;
     virtual status_t activate(void* ident, bool enabled) override;
     virtual status_t setDelay(void* ident, int handle, int64_t ns) override;
-    virtual const Sensor& getSensor() const override;
-    virtual bool isVirtual() const override { return true; }
 };
 
 // ---------------------------------------------------------------------------
diff --git a/services/sensorservice/SensorEventConnection.cpp b/services/sensorservice/SensorEventConnection.cpp
index ca26535a79..c1e1badf32 100644
--- a/services/sensorservice/SensorEventConnection.cpp
+++ b/services/sensorservice/SensorEventConnection.cpp
@@ -21,6 +21,7 @@
 
 #include "vec.h"
 #include "SensorEventConnection.h"
+#include "SensorDevice.h"
 
 namespace android {
 
@@ -88,15 +89,14 @@ void SensorService::SensorEventConnection::dump(String8& result) {
 
 bool SensorService::SensorEventConnection::addSensor(int32_t handle) {
     Mutex::Autolock _l(mConnectionLock);
-    if (!canAccessSensor(mService->getSensorFromHandle(handle),
-            "Tried adding", mOpPackageName)) {
+    sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
+    if (si == nullptr ||
+        !canAccessSensor(si->getSensor(), "Tried adding", mOpPackageName) ||
+        mSensorInfo.indexOfKey(handle) >= 0) {
         return false;
     }
-    if (mSensorInfo.indexOfKey(handle) < 0) {
-        mSensorInfo.add(handle, FlushInfo());
-        return true;
-    }
-    return false;
+    mSensorInfo.add(handle, FlushInfo());
+    return true;
 }
 
 bool SensorService::SensorEventConnection::removeSensor(int32_t handle) {
@@ -121,7 +121,8 @@ bool SensorService::SensorEventConnection::hasOneShotSensors() const {
     Mutex::Autolock _l(mConnectionLock);
     for (size_t i = 0; i < mSensorInfo.size(); ++i) {
         const int handle = mSensorInfo.keyAt(i);
-        if (mService->getSensorFromHandle(handle).getReportingMode() == AREPORTING_MODE_ONE_SHOT) {
+        sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
+        if (si != nullptr && si->getSensor().getReportingMode() == AREPORTING_MODE_ONE_SHOT) {
             return true;
         }
     }
@@ -164,9 +165,9 @@ void SensorService::SensorEventConnection::updateLooperRegistrationLocked(
     if (mDataInjectionMode) looper_flags |= ALOOPER_EVENT_INPUT;
     for (size_t i = 0; i < mSensorInfo.size(); ++i) {
         const int handle = mSensorInfo.keyAt(i);
-        if (mService->getSensorFromHandle(handle).isWakeUpSensor()) {
+        sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
+        if (si != nullptr && si->getSensor().isWakeUpSensor()) {
             looper_flags |= ALOOPER_EVENT_INPUT;
-            break;
         }
     }
 
@@ -385,11 +386,16 @@ void SensorService::SensorEventConnection::sendPendingFlushEventsLocked() {
     // Loop through all the sensors for this connection and check if there are any pending
     // flush complete events to be sent.
     for (size_t i = 0; i < mSensorInfo.size(); ++i) {
+        const int handle = mSensorInfo.keyAt(i);
+        sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(handle);
+        if (si == nullptr) {
+            continue;
+        }
+
         FlushInfo& flushInfo = mSensorInfo.editValueAt(i);
         while (flushInfo.mPendingFlushEventsToSend > 0) {
-            const int sensor_handle = mSensorInfo.keyAt(i);
-            flushCompleteEvent.meta_data.sensor = sensor_handle;
-            bool wakeUpSensor = mService->getSensorFromHandle(sensor_handle).isWakeUpSensor();
+            flushCompleteEvent.meta_data.sensor = handle;
+            bool wakeUpSensor = si->getSensor().isWakeUpSensor();
             if (wakeUpSensor) {
                ++mWakeLockRefCount;
                flushCompleteEvent.flags |= WAKE_UP_SENSOR_EVENT_NEEDS_ACK;
@@ -544,37 +550,41 @@ int SensorService::SensorEventConnection::handleEvent(int fd, int events, void*
         unsigned char buf[sizeof(sensors_event_t)];
         ssize_t numBytesRead = ::recv(fd, buf, sizeof(buf), MSG_DONTWAIT);
         {
-           Mutex::Autolock _l(mConnectionLock);
-           if (numBytesRead == sizeof(sensors_event_t)) {
-               if (!mDataInjectionMode) {
-                   ALOGE("Data injected in normal mode, dropping event"
-                         "package=%s uid=%d", mPackageName.string(), mUid);
-                   // Unregister call backs.
-                   return 0;
-               }
-               SensorDevice& dev(SensorDevice::getInstance());
-               sensors_event_t sensor_event;
-               memset(&sensor_event, 0, sizeof(sensor_event));
-               memcpy(&sensor_event, buf, sizeof(sensors_event_t));
-               Sensor sensor = mService->getSensorFromHandle(sensor_event.sensor);
-               sensor_event.type = sensor.getType();
-               dev.injectSensorData(&sensor_event);
+            Mutex::Autolock _l(mConnectionLock);
+            if (numBytesRead == sizeof(sensors_event_t)) {
+                if (!mDataInjectionMode) {
+                    ALOGE("Data injected in normal mode, dropping event"
+                          "package=%s uid=%d", mPackageName.string(), mUid);
+                    // Unregister call backs.
+                    return 0;
+                }
+                sensors_event_t sensor_event;
+                memcpy(&sensor_event, buf, sizeof(sensors_event_t));
+                sp<SensorInterface> si =
+                        mService->getSensorInterfaceFromHandle(sensor_event.sensor);
+                if (si == nullptr) {
+                    return 1;
+                }
+
+                SensorDevice& dev(SensorDevice::getInstance());
+                sensor_event.type = si->getSensor().getType();
+                dev.injectSensorData(&sensor_event);
 #if DEBUG_CONNECTIONS
-               ++mEventsReceived;
+                ++mEventsReceived;
 #endif
-           } else if (numBytesRead == sizeof(uint32_t)) {
-               uint32_t numAcks = 0;
-               memcpy(&numAcks, buf, numBytesRead);
-               // Sanity check to ensure  there are no read errors in recv, numAcks is always
-               // within the range and not zero. If any of the above don't hold reset
-               // mWakeLockRefCount to zero.
-               if (numAcks > 0 && numAcks < mWakeLockRefCount) {
-                   mWakeLockRefCount -= numAcks;
-               } else {
-                   mWakeLockRefCount = 0;
-               }
+            } else if (numBytesRead == sizeof(uint32_t)) {
+                uint32_t numAcks = 0;
+                memcpy(&numAcks, buf, numBytesRead);
+                // Sanity check to ensure  there are no read errors in recv, numAcks is always
+                // within the range and not zero. If any of the above don't hold reset
+                // mWakeLockRefCount to zero.
+                if (numAcks > 0 && numAcks < mWakeLockRefCount) {
+                    mWakeLockRefCount -= numAcks;
+                } else {
+                    mWakeLockRefCount = 0;
+                }
 #if DEBUG_CONNECTIONS
-               mTotalAcksReceived += numAcks;
+                mTotalAcksReceived += numAcks;
 #endif
            } else {
                // Read error, reset wakelock refcount.
@@ -601,7 +611,11 @@ int SensorService::SensorEventConnection::computeMaxCacheSizeLocked() const {
     size_t fifoWakeUpSensors = 0;
     size_t fifoNonWakeUpSensors = 0;
     for (size_t i = 0; i < mSensorInfo.size(); ++i) {
-        const Sensor& sensor = mService->getSensorFromHandle(mSensorInfo.keyAt(i));
+        sp<SensorInterface> si = mService->getSensorInterfaceFromHandle(mSensorInfo.keyAt(i));
+        if (si == nullptr) {
+            continue;
+        }
+        const Sensor& sensor = si->getSensor();
         if (sensor.getFifoReservedEventCount() == sensor.getFifoMaxEventCount()) {
             // Each sensor has a reserved fifo. Sum up the fifo sizes for all wake up sensors and
             // non wake_up sensors.
diff --git a/services/sensorservice/SensorInterface.cpp b/services/sensorservice/SensorInterface.cpp
index bb2a8a255d..cb2422934a 100644
--- a/services/sensorservice/SensorInterface.cpp
+++ b/services/sensorservice/SensorInterface.cpp
@@ -14,24 +14,30 @@
  * limitations under the License.
  */
 
+#include "SensorInterface.h"
+#include "SensorDevice.h"
+#include "SensorFusion.h"
+
 #include <stdint.h>
 #include <sys/types.h>
 
-#include "SensorInterface.h"
-
 namespace android {
 // ---------------------------------------------------------------------------
 
-SensorInterface::~SensorInterface()
-{
+namespace {
+const sensor_t DUMMY_SENSOR = {
+        .name = "", .vendor = "", .stringType = "", .requiredPermission = ""};
+} //unnamed namespace
+
+BaseSensor::BaseSensor(const sensor_t& sensor) :
+        mSensorDevice(SensorDevice::getInstance()),
+        mSensor(&sensor, mSensorDevice.getHalDeviceVersion()) {
 }
 
 // ---------------------------------------------------------------------------
 
-HardwareSensor::HardwareSensor(const sensor_t& sensor)
-    : mSensorDevice(SensorDevice::getInstance()),
-      mSensor(&sensor, mSensorDevice.getHalDeviceVersion())
-{
+HardwareSensor::HardwareSensor(const sensor_t& sensor):
+        BaseSensor(sensor) {
 }
 
 HardwareSensor::~HardwareSensor() {
@@ -65,10 +71,9 @@ void HardwareSensor::autoDisable(void *ident, int handle) {
     mSensorDevice.autoDisable(ident, handle);
 }
 
-const Sensor& HardwareSensor::getSensor() const {
-    return mSensor;
+VirtualSensor::VirtualSensor() :
+        BaseSensor(DUMMY_SENSOR), mSensorFusion(SensorFusion::getInstance()) {
 }
 
-
 // ---------------------------------------------------------------------------
 }; // namespace android
diff --git a/services/sensorservice/SensorInterface.h b/services/sensorservice/SensorInterface.h
index 06cca75c7c..d1cee41e84 100644
--- a/services/sensorservice/SensorInterface.h
+++ b/services/sensorservice/SensorInterface.h
@@ -17,52 +17,61 @@
 #ifndef ANDROID_SENSOR_INTERFACE_H
 #define ANDROID_SENSOR_INTERFACE_H
 
-#include <stdint.h>
-#include <sys/types.h>
-
 #include <gui/Sensor.h>
-
-#include "SensorDevice.h"
+#include <utils/RefBase.h>
 
 // ---------------------------------------------------------------------------
 
 namespace android {
 // ---------------------------------------------------------------------------
+class SensorDevice;
+class SensorFusion;
 
-class SensorInterface {
+class SensorInterface : public VirtualLightRefBase {
 public:
-    virtual ~SensorInterface();
+    virtual ~SensorInterface() {}
 
     virtual bool process(sensors_event_t* outEvent, const sensors_event_t& event) = 0;
 
     virtual status_t activate(void* ident, bool enabled) = 0;
     virtual status_t setDelay(void* ident, int handle, int64_t ns) = 0;
+    virtual status_t batch(void* ident, int handle, int /*flags*/, int64_t samplingPeriodNs,
+                           int64_t maxBatchReportLatencyNs) = 0;
+
+    virtual status_t flush(void* /*ident*/, int /*handle*/) = 0;
+
+    virtual const Sensor& getSensor() const = 0;
+    virtual bool isVirtual() const = 0;
+    virtual void autoDisable(void* /*ident*/, int /*handle*/) = 0;
+};
+
+class BaseSensor : public SensorInterface {
+public:
+    BaseSensor(const sensor_t& sensor);
 
     // Not all sensors need to support batching.
-    virtual status_t batch(void* ident, int handle, int /*flags*/, int64_t samplingPeriodNs,
-                           int64_t maxBatchReportLatencyNs) {
+    virtual status_t batch(void* ident, int handle, int, int64_t samplingPeriodNs,
+                           int64_t maxBatchReportLatencyNs) override {
         if (maxBatchReportLatencyNs == 0) {
             return setDelay(ident, handle, samplingPeriodNs);
         }
         return -EINVAL;
     }
 
-    virtual status_t flush(void* /*ident*/, int /*handle*/) {
+    virtual status_t flush(void* /*ident*/, int /*handle*/) override {
         return -EINVAL;
     }
 
-    virtual const Sensor& getSensor() const = 0;
-    virtual bool isVirtual() const = 0;
-    virtual void autoDisable(void* /*ident*/, int /*handle*/) { }
+    virtual const Sensor& getSensor() const override { return mSensor; }
+    virtual void autoDisable(void* /*ident*/, int /*handle*/) override { }
+protected:
+    SensorDevice& mSensorDevice;
+    Sensor mSensor;
 };
 
 // ---------------------------------------------------------------------------
 
-class HardwareSensor : public SensorInterface
-{
-    SensorDevice& mSensorDevice;
-    Sensor mSensor;
-
+class HardwareSensor : public BaseSensor {
 public:
     HardwareSensor(const sensor_t& sensor);
 
@@ -76,11 +85,19 @@ public:
                            int64_t maxBatchReportLatencyNs) override;
     virtual status_t setDelay(void* ident, int handle, int64_t ns) override;
     virtual status_t flush(void* ident, int handle) override;
-    virtual const Sensor& getSensor() const override;
     virtual bool isVirtual() const override { return false; }
     virtual void autoDisable(void *ident, int handle) override;
 };
 
+class VirtualSensor : public BaseSensor
+{
+public:
+    VirtualSensor();
+    virtual bool isVirtual() const override { return true; }
+protected:
+    SensorFusion& mSensorFusion;
+};
+
 
 // ---------------------------------------------------------------------------
 }; // namespace android
diff --git a/services/sensorservice/SensorList.cpp b/services/sensorservice/SensorList.cpp
index f28acd2267..c23e21fb99 100644
--- a/services/sensorservice/SensorList.cpp
+++ b/services/sensorservice/SensorList.cpp
@@ -41,7 +41,6 @@ bool SensorList::remove(int handle) {
     std::lock_guard<std::mutex> lk(mLock);
     auto entry = mHandleMap.find(handle);
     if (entry != mHandleMap.end()) {
-        mRecycle.push_back(entry->second.si);
         mHandleMap.erase(entry);
         return true;
     }
@@ -54,14 +53,9 @@ String8 SensorList::getName(int handle) const {
             mNonSensor.getName());
 }
 
-const Sensor& SensorList::get(int handle) const {
-    return getOne<const Sensor&>(
-            handle, [] (const Entry& e) -> const Sensor& {return e.si->getSensor();}, mNonSensor);
-}
-
-SensorInterface* SensorList::getInterface(int handle) const {
-    return getOne<SensorInterface *>(
-            handle, [] (const Entry& e) -> SensorInterface* {return e.si;}, nullptr);
+sp<SensorInterface> SensorList::getInterface(int handle) const {
+    return getOne<sp<SensorInterface>>(
+            handle, [] (const Entry& e) -> sp<SensorInterface> {return e.si;}, nullptr);
 }
 
 
@@ -182,15 +176,6 @@ std::string SensorList::dump() const {
 }
 
 SensorList::~SensorList() {
-    // from this point on no one should access anything in SensorList
-    mLock.lock();
-    for (auto i : mRecycle) {
-        delete i;
-    }
-    for (auto&& i : mHandleMap) {
-        delete i.second.si;
-    }
-    // the lock will eventually get destructed, there is no guarantee after that.
 }
 
 } // namespace SensorServiceUtil
diff --git a/services/sensorservice/SensorList.h b/services/sensorservice/SensorList.h
index 3fe73cc6c2..ffde619ff2 100644
--- a/services/sensorservice/SensorList.h
+++ b/services/sensorservice/SensorList.h
@@ -46,6 +46,9 @@ public:
     // After SensorInterface * is added into SensorList, it can be assumed that SensorList own the
     // object it pointed to and the object should not be released elsewhere.
     bool add(int handle, SensorInterface* si, bool isForDebug = false, bool isVirtual = false);
+
+    // After a handle is removed, the object that SensorInterface * pointing to may get deleted if
+    // no more sp<> of the same object exist.
     bool remove(int handle);
 
     inline bool hasAnySensor() const { return mHandleMap.size() > 0;}
@@ -57,8 +60,7 @@ public:
     const Vector<Sensor> getVirtualSensors() const;
 
     String8 getName(int handle) const;
-    const Sensor& get(int handle) const;
-    SensorInterface* getInterface(int handle) const;
+    sp<SensorInterface> getInterface(int handle) const;
     bool isNewHandle(int handle) const;
 
     // Iterate through Sensor in sensor list and perform operation f on each Sensor object.
@@ -80,8 +82,7 @@ public:
     virtual ~SensorList();
 private:
     struct Entry {
-        //TODO: use sp<> here
-        SensorInterface * const si;
+        sp<SensorInterface> si;
         const bool isForDebug;
         const bool isVirtual;
         Entry(SensorInterface* si_, bool debug_, bool virtual_) :
@@ -108,7 +109,6 @@ private:
     mutable std::mutex mLock;
     std::map<int, Entry> mHandleMap;
     std::unordered_set<int> mUsedHandle;
-    std::vector<SensorInterface *> mRecycle;
 };
 
 template <typename TF>
diff --git a/services/sensorservice/SensorService.cpp b/services/sensorservice/SensorService.cpp
index f334e29950..b7a8740cea 100644
--- a/services/sensorservice/SensorService.cpp
+++ b/services/sensorservice/SensorService.cpp
@@ -33,6 +33,7 @@
 #include "OrientationSensor.h"
 #include "RotationVectorSensor.h"
 #include "SensorFusion.h"
+#include "SensorInterface.h"
 
 #include "SensorService.h"
 #include "SensorEventConnection.h"
@@ -141,8 +142,8 @@ void SensorService::onFirstRef() {
                                !needLinearAcceleration, true);
 
                 // virtual debugging sensors are not for user
-                registerSensor( new CorrectedGyroSensor(list, count), false, true);
-                registerSensor( new GyroDriftSensor(), false, true);
+                registerSensor( new CorrectedGyroSensor(list, count), true, true);
+                registerSensor( new GyroDriftSensor(), true, true);
             }
 
             if (hasAccel && hasGyro) {
@@ -408,10 +409,10 @@ void SensorService::cleanupAutoDisabledSensorLocked(const sp<SensorEventConnecti
             handle = buffer[i].meta_data.sensor;
         }
         if (connection->hasSensor(handle)) {
-            SensorInterface* si = mSensors.getInterface(handle);
+            sp<SensorInterface> si = getSensorInterfaceFromHandle(handle);
             // If this buffer has an event from a one_shot sensor and this connection is registered
             // for this particular one_shot sensor, try cleaning up the connection.
-            if (si != NULL &&
+            if (si != nullptr &&
                 si->getSensor().getReportingMode() == AREPORTING_MODE_ONE_SHOT) {
                 si->autoDisable(connection.get(), handle);
                 cleanupWithoutDisableLocked(connection, handle);
@@ -477,8 +478,7 @@ bool SensorService::threadLoop() {
         // handle virtual sensors
         if (count && vcount) {
             sensors_event_t const * const event = mSensorEventBuffer;
-            const size_t activeVirtualSensorCount = mActiveVirtualSensors.size();
-            if (activeVirtualSensorCount) {
+            if (!mActiveVirtualSensors.empty()) {
                 size_t k = 0;
                 SensorFusion& fusion(SensorFusion::getInstance());
                 if (fusion.isEnabled()) {
@@ -487,7 +487,7 @@ bool SensorService::threadLoop() {
                     }
                 }
                 for (size_t i=0 ; i<size_t(count) && k<minBufferSize ; i++) {
-                    for (size_t j=0 ; j<activeVirtualSensorCount ; j++) {
+                    for (int handle : mActiveVirtualSensors) {
                         if (count + k >= minBufferSize) {
                             ALOGE("buffer too small to hold all events: "
                                     "count=%zd, k=%zu, size=%zu",
@@ -495,7 +495,12 @@ bool SensorService::threadLoop() {
                             break;
                         }
                         sensors_event_t out;
-                        SensorInterface* si = mActiveVirtualSensors.valueAt(j);
+                        sp<SensorInterface> si = mSensors.getInterface(handle);
+                        if (si == nullptr) {
+                            ALOGE("handle %d is not an valid virtual sensor", handle);
+                            continue;
+                        }
+
                         if (si->process(&out, event[i])) {
                             mSensorEventBuffer[count + k] = out;
                             k++;
@@ -698,8 +703,8 @@ String8 SensorService::getSensorName(int handle) const {
 }
 
 bool SensorService::isVirtualSensor(int handle) const {
-    SensorInterface* sensor = getSensorInterfaceFromHandle(handle);
-    return sensor != NULL && sensor->isVirtual();
+    sp<SensorInterface> sensor = getSensorInterfaceFromHandle(handle);
+    return sensor != nullptr && sensor->isVirtual();
 }
 
 bool SensorService::isWakeUpSensorEvent(const sensors_event_t& event) const {
@@ -707,8 +712,8 @@ bool SensorService::isWakeUpSensorEvent(const sensors_event_t& event) const {
     if (event.type == SENSOR_TYPE_META_DATA) {
         handle = event.meta_data.sensor;
     }
-    SensorInterface* sensor = getSensorInterfaceFromHandle(handle);
-    return sensor != NULL && sensor->getSensor().isWakeUpSensor();
+    sp<SensorInterface> sensor = getSensorInterfaceFromHandle(handle);
+    return sensor != nullptr && sensor->getSensor().isWakeUpSensor();
 }
 
 Vector<Sensor> SensorService::getSensorList(const String16& opPackageName) {
@@ -735,14 +740,15 @@ Vector<Sensor> SensorService::getDynamicSensorList(const String16& opPackageName
     Vector<Sensor> accessibleSensorList;
     mSensors.forEachSensor(
             [&opPackageName, &accessibleSensorList] (const Sensor& sensor) -> bool {
-                if (sensor.isDynamicSensor() &&
-                        canAccessSensor(sensor, "getDynamicSensorList", opPackageName)) {
-                    accessibleSensorList.add(sensor);
-                } else {
-                    ALOGI("Skipped sensor %s because it requires permission %s and app op %" PRId32,
-                          sensor.getName().string(),
-                          sensor.getRequiredPermission().string(),
-                          sensor.getRequiredAppOp());
+                if (sensor.isDynamicSensor()) {
+                    if (canAccessSensor(sensor, "getDynamicSensorList", opPackageName)) {
+                        accessibleSensorList.add(sensor);
+                    } else {
+                        ALOGI("Skipped sensor %s because it requires permission %s and app op %" PRId32,
+                              sensor.getName().string(),
+                              sensor.getRequiredPermission().string(),
+                              sensor.getRequiredAppOp());
+                    }
                 }
                 return true;
             });
@@ -805,10 +811,11 @@ void SensorService::cleanupConnection(SensorEventConnection* c) {
         int handle = mActiveSensors.keyAt(i);
         if (c->hasSensor(handle)) {
             ALOGD_IF(DEBUG_CONNECTIONS, "%zu: disabling handle=0x%08x", i, handle);
-            SensorInterface* sensor = getSensorInterfaceFromHandle(handle);
-            ALOGE_IF(!sensor, "mSensorMap[handle=0x%08x] is null!", handle);
-            if (sensor) {
+            sp<SensorInterface> sensor = getSensorInterfaceFromHandle(handle);
+            if (sensor != nullptr) {
                 sensor->activate(c, false);
+            } else {
+                ALOGE("sensor interface of handle=0x%08x is null!", handle);
             }
             c->removeSensor(handle);
         }
@@ -821,7 +828,7 @@ void SensorService::cleanupConnection(SensorEventConnection* c) {
         if (rec && rec->removeConnection(connection)) {
             ALOGD_IF(DEBUG_CONNECTIONS, "... and it was the last connection");
             mActiveSensors.removeItemsAt(i, 1);
-            mActiveVirtualSensors.removeItem(handle);
+            mActiveVirtualSensors.erase(handle);
             delete rec;
             size--;
         } else {
@@ -836,13 +843,10 @@ void SensorService::cleanupConnection(SensorEventConnection* c) {
     }
 }
 
-SensorInterface* SensorService::getSensorInterfaceFromHandle(int handle) const {
+sp<SensorInterface> SensorService::getSensorInterfaceFromHandle(int handle) const {
     return mSensors.getInterface(handle);
 }
 
-const Sensor& SensorService::getSensorFromHandle(int handle) const {
-    return mSensors.get(handle);
-}
 
 status_t SensorService::enable(const sp<SensorEventConnection>& connection,
         int handle, nsecs_t samplingPeriodNs, nsecs_t maxBatchReportLatencyNs, int reservedFlags,
@@ -850,12 +854,9 @@ status_t SensorService::enable(const sp<SensorEventConnection>& connection,
     if (mInitCheck != NO_ERROR)
         return mInitCheck;
 
-    SensorInterface* sensor = getSensorInterfaceFromHandle(handle);
-    if (sensor == NULL) {
-        return BAD_VALUE;
-    }
-
-    if (!canAccessSensor(sensor->getSensor(), "Tried enabling", opPackageName)) {
+    sp<SensorInterface> sensor = getSensorInterfaceFromHandle(handle);
+    if (sensor == nullptr ||
+        !canAccessSensor(sensor->getSensor(), "Tried enabling", opPackageName)) {
         return BAD_VALUE;
     }
 
@@ -870,7 +871,7 @@ status_t SensorService::enable(const sp<SensorEventConnection>& connection,
         rec = new SensorRecord(connection);
         mActiveSensors.add(handle, rec);
         if (sensor->isVirtual()) {
-            mActiveVirtualSensors.add(handle, sensor);
+            mActiveVirtualSensors.emplace(handle);
         }
     } else {
         if (rec->addConnection(connection)) {
@@ -983,8 +984,8 @@ status_t SensorService::disable(const sp<SensorEventConnection>& connection, int
     Mutex::Autolock _l(mLock);
     status_t err = cleanupWithoutDisableLocked(connection, handle);
     if (err == NO_ERROR) {
-        SensorInterface* sensor = getSensorInterfaceFromHandle(handle);
-        err = sensor ? sensor->activate(connection.get(), false) : status_t(BAD_VALUE);
+        sp<SensorInterface> sensor = getSensorInterfaceFromHandle(handle);
+        err = sensor != nullptr ? sensor->activate(connection.get(), false) : status_t(BAD_VALUE);
 
     }
     if (err == NO_ERROR) {
@@ -1024,7 +1025,7 @@ status_t SensorService::cleanupWithoutDisableLocked(
         // see if this sensor becomes inactive
         if (rec->removeConnection(connection)) {
             mActiveSensors.removeItem(handle);
-            mActiveVirtualSensors.removeItem(handle);
+            mActiveVirtualSensors.erase(handle);
             delete rec;
         }
         return NO_ERROR;
@@ -1037,11 +1038,9 @@ status_t SensorService::setEventRate(const sp<SensorEventConnection>& connection
     if (mInitCheck != NO_ERROR)
         return mInitCheck;
 
-    SensorInterface* sensor = getSensorInterfaceFromHandle(handle);
-    if (!sensor)
-        return BAD_VALUE;
-
-    if (!canAccessSensor(sensor->getSensor(), "Tried configuring", opPackageName)) {
+    sp<SensorInterface> sensor = getSensorInterfaceFromHandle(handle);
+    if (sensor == nullptr ||
+        !canAccessSensor(sensor->getSensor(), "Tried configuring", opPackageName)) {
         return BAD_VALUE;
     }
 
@@ -1066,7 +1065,10 @@ status_t SensorService::flushSensor(const sp<SensorEventConnection>& connection,
     // Loop through all sensors for this connection and call flush on each of them.
     for (size_t i = 0; i < connection->mSensorInfo.size(); ++i) {
         const int handle = connection->mSensorInfo.keyAt(i);
-        SensorInterface* sensor = getSensorInterfaceFromHandle(handle);
+        sp<SensorInterface> sensor = getSensorInterfaceFromHandle(handle);
+        if (sensor == nullptr) {
+            continue;
+        }
         if (sensor->getSensor().getReportingMode() == AREPORTING_MODE_ONE_SHOT) {
             ALOGE("flush called on a one-shot sensor");
             err = INVALID_OPERATION;
diff --git a/services/sensorservice/SensorService.h b/services/sensorservice/SensorService.h
index e53533940c..6473edbd6f 100644
--- a/services/sensorservice/SensorService.h
+++ b/services/sensorservice/SensorService.h
@@ -17,27 +17,25 @@
 #ifndef ANDROID_SENSOR_SERVICE_H
 #define ANDROID_SENSOR_SERVICE_H
 
-#include <stdint.h>
-#include <sys/types.h>
-
-#include <utils/Vector.h>
-#include <utils/SortedVector.h>
-#include <utils/KeyedVector.h>
-#include <utils/threads.h>
-#include <utils/AndroidThreads.h>
-#include <utils/RefBase.h>
-#include <utils/Looper.h>
-#include <utils/String8.h>
+#include "SensorList.h"
 
 #include <binder/BinderService.h>
-
-#include <gui/Sensor.h>
-#include <gui/BitTube.h>
+#include <cutils/compiler.h>
 #include <gui/ISensorServer.h>
 #include <gui/ISensorEventConnection.h>
+#include <gui/Sensor.h>
 
-#include "SensorInterface.h"
-#include "SensorList.h"
+#include <utils/AndroidThreads.h>
+#include <utils/KeyedVector.h>
+#include <utils/Looper.h>
+#include <utils/SortedVector.h>
+#include <utils/String8.h>
+#include <utils/Vector.h>
+#include <utils/threads.h>
+
+#include <stdint.h>
+#include <sys/types.h>
+#include <unordered_set>
 
 #if __clang__
 // Clang warns about SensorEventConnection::dump hiding BBinder::dump. The cause isn't fixable
@@ -57,6 +55,7 @@
 
 namespace android {
 // ---------------------------------------------------------------------------
+class SensorInterface;
 
 class SensorService :
         public BinderService<SensorService>,
@@ -138,7 +137,6 @@ private:
     };
 
     static const char* WAKE_LOCK_NAME;
-
     static char const* getServiceName() ANDROID_API { return "sensorservice"; }
     SensorService() ANDROID_API;
     virtual ~SensorService();
@@ -160,8 +158,7 @@ private:
     static int getNumEventsForSensorType(int sensor_event_type);
     String8 getSensorName(int handle) const;
     bool isVirtualSensor(int handle) const;
-    SensorInterface* getSensorInterfaceFromHandle(int handle) const;
-    const Sensor& getSensorFromHandle(int handle) const;
+    sp<SensorInterface> getSensorInterfaceFromHandle(int handle) const;
     bool isWakeUpSensor(int type) const;
     void recordLastValueLocked(sensors_event_t const* buffer, size_t count);
     static void sortEventBuffer(sensors_event_t* buffer, size_t count);
@@ -216,12 +213,14 @@ private:
 
     // Socket buffersize used to initialize BitTube. This size depends on whether batching is
     // supported or not.
-    uint32_t mSocketBufferSize; sp<Looper> mLooper; sp<SensorEventAckReceiver> mAckReceiver;
+    uint32_t mSocketBufferSize;
+    sp<Looper> mLooper;
+    sp<SensorEventAckReceiver> mAckReceiver;
 
     // protected by mLock
     mutable Mutex mLock;
     DefaultKeyedVector<int, SensorRecord*> mActiveSensors;
-    DefaultKeyedVector<int, SensorInterface*> mActiveVirtualSensors;
+    std::unordered_set<int> mActiveVirtualSensors;
     SortedVector< wp<SensorEventConnection> > mActiveConnections;
     bool mWakeLockAcquired;
     sensors_event_t *mSensorEventBuffer, *mSensorEventScratch;