Fix crash when reparenting layer to itself.
Currently this creates unbounded recursion and a SurfaceFlinger
crash.
Bug: 123283486
Test: Transaction_test.cpp
Change-Id: Ieae19cb3a7724de2ddb95a895328dd5b4a8d8782
diff --git a/services/surfaceflinger/Layer.cpp b/services/surfaceflinger/Layer.cpp
index e108d1e..f181220 100644
--- a/services/surfaceflinger/Layer.cpp
+++ b/services/surfaceflinger/Layer.cpp
@@ -1623,19 +1623,26 @@
return false;
}
+ sp<Layer> newParent;
+ if (newParentHandle != nullptr) {
+ auto handle = static_cast<Handle*>(newParentHandle.get());
+ newParent = handle->owner.promote();
+ if (newParent == nullptr) {
+ ALOGE("Unable to promote Layer handle");
+ return false;
+ }
+ if (newParent == this) {
+ ALOGE("Invalid attempt to reparent Layer (%s) to itself", getName().c_str());
+ return false;
+ }
+ }
+
sp<Layer> parent = getParent();
if (parent != nullptr) {
parent->removeChild(this);
}
if (newParentHandle != nullptr) {
- auto handle = static_cast<Handle*>(newParentHandle.get());
- sp<Layer> newParent = handle->owner.promote();
- if (newParent == nullptr) {
- ALOGE("Unable to promote Layer handle");
- return false;
- }
-
newParent->addChild(this);
if (!newParent->isRemovedFromCurrentState()) {
addToCurrentState();