Merge "Fix free-after-use for MediaHTTP" into nyc-dev
diff --git a/include/radio/Radio.h b/include/radio/Radio.h
index 302bf16..a4dfdd1 100644
--- a/include/radio/Radio.h
+++ b/include/radio/Radio.h
@@ -75,7 +75,7 @@
 private:
             Radio(radio_handle_t handle,
                             const sp<RadioCallback>&);
-            static const sp<IRadioService>& getRadioService();
+            static const sp<IRadioService> getRadioService();
 
             Mutex                   mLock;
             sp<IRadio>              mIRadio;
diff --git a/include/soundtrigger/SoundTrigger.h b/include/soundtrigger/SoundTrigger.h
index bf5e1de..9a05cac 100644
--- a/include/soundtrigger/SoundTrigger.h
+++ b/include/soundtrigger/SoundTrigger.h
@@ -68,7 +68,7 @@
 private:
             SoundTrigger(sound_trigger_module_handle_t module,
                             const sp<SoundTriggerCallback>&);
-            static const sp<ISoundTriggerHwService>& getSoundTriggerHwService();
+            static const sp<ISoundTriggerHwService> getSoundTriggerHwService();
 
             Mutex                               mLock;
             sp<ISoundTrigger>                   mISoundTrigger;
diff --git a/media/libstagefright/omx/OMXNodeInstance.cpp b/media/libstagefright/omx/OMXNodeInstance.cpp
index 3cb8909..d121c17 100644
--- a/media/libstagefright/omx/OMXNodeInstance.cpp
+++ b/media/libstagefright/omx/OMXNodeInstance.cpp
@@ -811,7 +811,7 @@
                 params, portIndex, false /* copyToOmx */, false /* copyFromOmx */, data);
     } else {
         buffer_meta = new BufferMeta(
-                params, portIndex, false /* copyFromOmx */, false /* copyToOmx */, NULL);
+                params, portIndex, false /* copyToOmx */, false /* copyFromOmx */, NULL);
     }
 
     OMX_BUFFERHEADERTYPE *header;
@@ -1039,7 +1039,7 @@
     }
 
     BufferMeta *bufferMeta = (BufferMeta *)(header->pAppPrivate);
-    // update backup buffer for input, codec buffer for output
+    // update backup buffer
     sp<ABuffer> data = bufferMeta->getBuffer(
             header, false /* backup */, false /* limit */);
     bufferMeta->setNativeHandle(nativeHandle);
@@ -1393,23 +1393,11 @@
     }
     BufferMeta *buffer_meta =
         static_cast<BufferMeta *>(header->pAppPrivate);
-    sp<ABuffer> backup = buffer_meta->getBuffer(header, true /* backup */, false /* limit */);
-    sp<ABuffer> codec = buffer_meta->getBuffer(header, false /* backup */, false /* limit */);
 
-    // convert incoming ANW meta buffers if component is configured for gralloc metadata mode
-    // ignore rangeOffset in this case
-    if (mMetadataType[kPortIndexInput] == kMetadataBufferTypeGrallocSource
-            && backup->capacity() >= sizeof(VideoNativeMetadata)
-            && codec->capacity() >= sizeof(VideoGrallocMetadata)
-            && ((VideoNativeMetadata *)backup->base())->eType
-                    == kMetadataBufferTypeANWBuffer) {
-        VideoNativeMetadata &backupMeta = *(VideoNativeMetadata *)backup->base();
-        VideoGrallocMetadata &codecMeta = *(VideoGrallocMetadata *)codec->base();
-        CLOG_BUFFER(emptyBuffer, "converting ANWB %p to handle %p",
-                backupMeta.pBuffer, backupMeta.pBuffer->handle);
-        codecMeta.pHandle = backupMeta.pBuffer != NULL ? backupMeta.pBuffer->handle : NULL;
-        codecMeta.eType = kMetadataBufferTypeGrallocSource;
-        header->nFilledLen = rangeLength ? sizeof(codecMeta) : 0;
+    // set up proper filled length if component is configured for gralloc metadata mode
+    // ignore rangeOffset in this case (as client may be assuming ANW meta buffers).
+    if (mMetadataType[kPortIndexInput] == kMetadataBufferTypeGrallocSource) {
+        header->nFilledLen = rangeLength ? sizeof(VideoGrallocMetadata) : 0;
         header->nOffset = 0;
     } else {
         // rangeLength and rangeOffset must be a subset of the allocated data in the buffer.
diff --git a/radio/Radio.cpp b/radio/Radio.cpp
index e3554c2..3c04fb0 100644
--- a/radio/Radio.cpp
+++ b/radio/Radio.cpp
@@ -55,7 +55,7 @@
     sp<DeathNotifier>         gDeathNotifier;
 }; // namespace anonymous
 
-const sp<IRadioService>& Radio::getRadioService()
+const sp<IRadioService> Radio::getRadioService()
 {
     Mutex::Autolock _l(gLock);
     if (gRadioService.get() == 0) {
@@ -84,7 +84,7 @@
                             uint32_t *numModules)
 {
     ALOGV("listModules()");
-    const sp<IRadioService>& service = getRadioService();
+    const sp<IRadioService> service = getRadioService();
     if (service == 0) {
         return NO_INIT;
     }
@@ -98,7 +98,7 @@
 {
     ALOGV("attach()");
     sp<Radio> radio;
-    const sp<IRadioService>& service = getRadioService();
+    const sp<IRadioService> service = getRadioService();
     if (service == 0) {
         return radio;
     }
diff --git a/soundtrigger/SoundTrigger.cpp b/soundtrigger/SoundTrigger.cpp
index 2138cb7..e959b83 100644
--- a/soundtrigger/SoundTrigger.cpp
+++ b/soundtrigger/SoundTrigger.cpp
@@ -55,7 +55,7 @@
     sp<DeathNotifier>         gDeathNotifier;
 }; // namespace anonymous
 
-const sp<ISoundTriggerHwService>& SoundTrigger::getSoundTriggerHwService()
+const sp<ISoundTriggerHwService> SoundTrigger::getSoundTriggerHwService()
 {
     Mutex::Autolock _l(gLock);
     if (gSoundTriggerHwService.get() == 0) {
@@ -84,7 +84,7 @@
                                  uint32_t *numModules)
 {
     ALOGV("listModules()");
-    const sp<ISoundTriggerHwService>& service = getSoundTriggerHwService();
+    const sp<ISoundTriggerHwService> service = getSoundTriggerHwService();
     if (service == 0) {
         return NO_INIT;
     }
@@ -96,7 +96,7 @@
 {
     ALOGV("attach()");
     sp<SoundTrigger> soundTrigger;
-    const sp<ISoundTriggerHwService>& service = getSoundTriggerHwService();
+    const sp<ISoundTriggerHwService> service = getSoundTriggerHwService();
     if (service == 0) {
         return soundTrigger;
     }
@@ -116,7 +116,7 @@
 status_t SoundTrigger::setCaptureState(bool active)
 {
     ALOGV("setCaptureState(%d)", active);
-    const sp<ISoundTriggerHwService>& service = getSoundTriggerHwService();
+    const sp<ISoundTriggerHwService> service = getSoundTriggerHwService();
     if (service == 0) {
         return NO_INIT;
     }