drm_hwcomposer: Mitigate race condition in HwcDisplay destructor
There is a race between the main thread and vsync thread when tearing
down the HwcDisplay.
In the HwcDisplay destructor, Deinit is called, which will call
StopThread on the vsync worker, and release the VSyncWorker reference.
The main thread is holding the main lock, and the VSyncWorker thread may
be waiting on the main lock in the out_event callback.
After the HwcDisplay destructor is complete, the main thread will
eventually release the main lock. At this point, the vsync thread can
wake and will have a dangling pointer to 'this'.
This can be mitigated by:
- Explicitly set the HwcDisplay pipeline to nullptr, which will stop the
vsync thread.
- Release the main lock after setting the pipeline to nullptr and sleep,
to allow the vsync thread to complete
A more robust solution would be to provide a mechanism to ensure that
the HwcDisplay knows that the vsync thread has completed before the
HwcDisplay has been destructed.
Change-Id: I79626427a94330b15bc138dad3163d0f2d934466
Signed-off-by: Drew Davenport <ddavenport@google.com>
diff --git a/drm/DrmHwc.cpp b/drm/DrmHwc.cpp
index 6457d79..df3eb56 100644
--- a/drm/DrmHwc.cpp
+++ b/drm/DrmHwc.cpp
@@ -193,4 +193,10 @@
return writeback_count;
}
+void DrmHwc::DeinitDisplays() {
+ for (auto &pair : Displays()) {
+ pair.second->SetPipeline(nullptr);
+ }
+}
+
} // namespace android
\ No newline at end of file