commit eaed9f519e6550d717017996c988feb2b4faa0d2
author Wonsik Kim <wonsik@google.com> Tue Jun 18 17:25:02 2019 -0700
committer Wonsik Kim <wonsik@google.com> Wed Jun 19 10:44:36 2019 -0700
tree 27ccd6968b072f2be748bd3877262cff28cbaabc
parent 692a68133bfcfab7730e791d961e5454399191ca

media: keep JMediaCodec::mCodec reference until destruction

Releasing mCodec prematurely at release() sometimes causes double
free on MediaCodec objects.

Bug: 134770912
Test: atest CtsMediaTestCases:MediaCodecTest#testAsyncRelease (20 times)
Change-Id: Ieb265c9c4d74bd6bd3b34f0a713c8fa7dd2dedd1

media/jni/android_media_MediaCodec.cpp

diff --git a/media/jni/android_media_MediaCodec.cpp b/media/jni/android_media_MediaCodec.cpp
index 150b6f9..8d420e2 100644
--- a/media/jni/android_media_MediaCodec.cpp
+++ b/media/jni/android_media_MediaCodec.cpp
@@ -211,21 +211,22 @@
 }
 
 void JMediaCodec::release() {
-    if (mCodec != NULL) {
-        mCodec->release();
-        mCodec.clear();
-        mInitStatus = NO_INIT;
-    }
+    std::call_once(mReleaseFlag, [this] {
+        if (mCodec != NULL) {
+            mCodec->release();
+            mInitStatus = NO_INIT;
+        }
 
-    if (mLooper != NULL) {
-        mLooper->unregisterHandler(id());
-        mLooper->stop();
-        mLooper.clear();
-    }
+        if (mLooper != NULL) {
+            mLooper->unregisterHandler(id());
+            mLooper->stop();
+            mLooper.clear();
+        }
+    });
 }
 
 JMediaCodec::~JMediaCodec() {
-    if (mCodec != NULL || mLooper != NULL) {
+    if (mLooper != NULL) {
         /* MediaCodec and looper should have been released explicitly already
          * in setMediaCodec() (see comments in setMediaCodec()).
          *