Fix RenderArea use after free error
When RenderEngine is single threaded, renderScreenImpl immediately calls present instead of moving it into the returned future. This caused the unique_ptr<RenderArea> to be destroyed when renderScreenImpl returned, deleting RenderArea prematurely. We can use a shared_ptr to ensure that RenderArea is only deleted once both captureScreenCommon and present no longer need it.
Bug: 264827546
Test: atest ScreenCaptureTest
Test: go/wm-smoke
Change-Id: I8b591bec7c6ad07df9fa9b7f62495dac10a68a93
diff --git a/services/surfaceflinger/SurfaceFlinger.h b/services/surfaceflinger/SurfaceFlinger.h
index 7bb0514..2058e2f 100644
--- a/services/surfaceflinger/SurfaceFlinger.h
+++ b/services/surfaceflinger/SurfaceFlinger.h
@@ -797,7 +797,7 @@
const std::shared_ptr<renderengine::ExternalTexture>&, bool regionSampling,
bool grayscale, const sp<IScreenCaptureListener>&);
ftl::SharedFuture<FenceResult> renderScreenImpl(
- std::unique_ptr<RenderArea>, TraverseLayersFunction,
+ std::shared_ptr<const RenderArea>, TraverseLayersFunction,
const std::shared_ptr<renderengine::ExternalTexture>&, bool canCaptureBlackoutContent,
bool regionSampling, bool grayscale, ScreenCaptureResults&) EXCLUDES(mStateLock)
REQUIRES(kMainThreadContext);