commit 0decf3038b992bd3a2758c8dba3d0a16d09247ff
author Marissa Wall <marissaw@google.com> Thu Jul 11 13:10:44 2019 -0700
committer android-build-merger <android-build-merger@google.com> Thu Jul 11 13:10:44 2019 -0700
tree 75ceb06336d3e2251177f3c674e756d03db82257
parent 621a6ca15ad9448a71f941252e6ec10228e2f4e8
parent 6990af63ff06297ffa0373daa32a196c29d99b95

Merge "blast: fix leak on BufferStateLayer death" into qt-dev
am: 6990af63ff

Change-Id: I46fa4328214c20c5c907df83378dc93466178e19

services/surfaceflinger/TransactionCompletedThread.cpp

diff --git a/services/surfaceflinger/TransactionCompletedThread.cpp b/services/surfaceflinger/TransactionCompletedThread.cpp
index 5cf8eb1..fd466de 100644
--- a/services/surfaceflinger/TransactionCompletedThread.cpp
+++ b/services/surfaceflinger/TransactionCompletedThread.cpp
@@ -197,8 +197,14 @@
     }
 
     transactionStats->latchTime = handle->latchTime;
-    transactionStats->surfaceStats.emplace_back(handle->surfaceControl, handle->acquireTime,
-                                                handle->previousReleaseFence);
+    // If the layer has already been destroyed, don't add the SurfaceControl to the callback.
+    // The client side keeps a sp<> to the SurfaceControl so if the SurfaceControl has been
+    // destroyed the client side is dead and there won't be anyone to send the callback to.
+    sp<IBinder> surfaceControl = handle->surfaceControl.promote();
+    if (surfaceControl) {
+        transactionStats->surfaceStats.emplace_back(surfaceControl, handle->acquireTime,
+                                                    handle->previousReleaseFence);
+    }
     return NO_ERROR;
 }
 

services/surfaceflinger/TransactionCompletedThread.h

diff --git a/services/surfaceflinger/TransactionCompletedThread.h b/services/surfaceflinger/TransactionCompletedThread.h
index 21e2678..e849f71 100644
--- a/services/surfaceflinger/TransactionCompletedThread.h
+++ b/services/surfaceflinger/TransactionCompletedThread.h
@@ -49,7 +49,7 @@
 
     sp<ITransactionCompletedListener> listener;
     std::vector<CallbackId> callbackIds;
-    sp<IBinder> surfaceControl;
+    wp<IBinder> surfaceControl;
 
     bool releasePreviousBuffer = false;
     sp<Fence> previousReleaseFence;