commit 9c8714daaf6a402abd85557e9b652c86f0df86e4
author Eino-Ville Talvala <etalvala@google.com> Wed Jun 19 14:23:22 2013 -0700
committer Android Git Automerger <android-git-automerger@android.com> Wed Jun 19 14:23:22 2013 -0700
tree 8c4cbae229dba31d55e0454f0f83da6aa7ab1e6e
parent bda5d1f2a34f9b7ded0bc0441be4856e78ec066c
parent e6478de72a8ae1d3abb3e8c20898977c45354a4f

am e6478de7: Camera2/3: Avoid shutdown race in callback processor.

* commit 'e6478de72a8ae1d3abb3e8c20898977c45354a4f':
  Camera2/3: Avoid shutdown race in callback processor.

services/camera/libcameraservice/camera2/CallbackProcessor.cpp

diff --git a/services/camera/libcameraservice/camera2/CallbackProcessor.cpp b/services/camera/libcameraservice/camera2/CallbackProcessor.cpp
index 4987ab6..98673ff 100644
--- a/services/camera/libcameraservice/camera2/CallbackProcessor.cpp
+++ b/services/camera/libcameraservice/camera2/CallbackProcessor.cpp
@@ -365,6 +365,9 @@
 
         ALOGV("%s: Freeing buffer", __FUNCTION__);
         mCallbackConsumer->unlockBuffer(imgBuffer);
+
+        // mCallbackHeap may get freed up once input mutex is released
+        callbackHeap = mCallbackHeap;
     }
 
     // Call outside parameter lock to allow re-entrancy from notification
@@ -375,7 +378,7 @@
             ALOGV("%s: Camera %d: Invoking client data callback",
                     __FUNCTION__, mId);
             l.mRemoteCallback->dataCallback(CAMERA_MSG_PREVIEW_FRAME,
-                    mCallbackHeap->mBuffers[heapIdx], NULL);
+                    callbackHeap->mBuffers[heapIdx], NULL);
         }
     }