commit 35b5114be8da71c69fc8a1ff8fb457c912c0992f
author Randy Xu <randy.xu@intel.com> Wed Jul 05 14:18:38 2017 +0800
committer Gaurav Sarode <sgaurav@google.com> Tue Oct 03 15:48:52 2017 -0700
tree 020714c820767689d6e22f8609469c8c9a5cea8a
parent 8c6462c8c48022a4a77ab8ed218551880d2bbab9

Solve the composer service NULL pointer crash

The callback functions are set nullptr in ComposerClient::~ComposerClient()
./composer/2.1/default/ComposerClient.cpp:160:    mHal.enableCallback(false)

However, the callbacks are still used in hwc2on1adaptor, it will cause segment fault.

Bug: 64650599

Test: adb shell stop

Change-Id: I92e6a6b42418e987a7ead041f2d95c194b6a16e8
Signed-off-by: Randy Xu <randy.xu@intel.com>
Signed-off-by: Qiming Shi <qiming.shi@intel.com>
Signed-off-by: Yong Yao <yong.yao@intel.com>
Signed-off-by: Gaurav Sarode <sgaurav@google.com>

libs/hwc2on1adapter/HWC2On1Adapter.cpp

diff --git a/libs/hwc2on1adapter/HWC2On1Adapter.cpp b/libs/hwc2on1adapter/HWC2On1Adapter.cpp
index e1b9a8a..77f06bb 100644
--- a/libs/hwc2on1adapter/HWC2On1Adapter.cpp
+++ b/libs/hwc2on1adapter/HWC2On1Adapter.cpp
@@ -426,7 +426,13 @@
 
     std::unique_lock<std::recursive_timed_mutex> lock(mStateMutex);
 
-    mCallbacks[descriptor] = {callbackData, pointer};
+    if (pointer != nullptr) {
+        mCallbacks[descriptor] = {callbackData, pointer};
+    } else {
+        ALOGI("unregisterCallback(%s)", to_string(descriptor).c_str());
+        mCallbacks.erase(descriptor);
+        return Error::None;
+    }
 
     bool hasPendingInvalidate = false;
     std::vector<hwc2_display_t> displayIds;