commit db1e864daf162007341d6715094330c13bf5482f
author Yin-Chia Yeh <yinchiayeh@google.com> Fri Jul 14 15:19:30 2017 -0700
committer Yin-Chia Yeh <yinchiayeh@google.com> Fri Jul 14 15:37:50 2017 -0700
tree 76789003760a648ef9951ea15148029b2ef905e1
parent 7bb115f1033fd7ef5e3556fc384aac475d16cce7

Camera: fix bufferFreed callback object lifecycle issue

Make sure the callback object won't be freed in the middle
of callback execution.

Test: CTS + stress test
Bug: 63683767
Change-Id: I6fb1b754cadb3d499c1c246687d2f60d444d00bb

services/camera/libcameraservice/device3/Camera3InputStream.cpp

diff --git a/services/camera/libcameraservice/device3/Camera3InputStream.cpp b/services/camera/libcameraservice/device3/Camera3InputStream.cpp
index 4eb15ad..35096eb 100644
--- a/services/camera/libcameraservice/device3/Camera3InputStream.cpp
+++ b/services/camera/libcameraservice/device3/Camera3InputStream.cpp
@@ -293,8 +293,9 @@
 void Camera3InputStream::onBufferFreed(const wp<GraphicBuffer>& gb) {
     const sp<GraphicBuffer> buffer = gb.promote();
     if (buffer != nullptr) {
-        if (mBufferFreedListener != nullptr) {
-            mBufferFreedListener->onBufferFreed(mId, buffer->handle);
+        sp<Camera3StreamBufferFreedListener> callback = mBufferFreedListener.promote();
+        if (callback != nullptr) {
+            callback->onBufferFreed(mId, buffer->handle);
         }
     } else {
         ALOGE("%s: GraphicBuffer is freed before onBufferFreed callback finishes!", __FUNCTION__);