Merge "libbinder_ndk: fix UB memory access for race" am: 91e66f9ba1 am: 71f6077f39
am: 1bcfd63f7c

Change-Id: I862b154dfee3db4405ac55f1a2d1d1ee0e57c19e
diff --git a/libs/binder/ndk/ibinder_internal.h b/libs/binder/ndk/ibinder_internal.h
index 0dd795a..202d6d2 100644
--- a/libs/binder/ndk/ibinder_internal.h
+++ b/libs/binder/ndk/ibinder_internal.h
@@ -133,7 +133,7 @@
     // binderDied receipt only gives us information about the IBinder.
     struct TransferDeathRecipient : ::android::IBinder::DeathRecipient {
         TransferDeathRecipient(const ::android::wp<::android::IBinder>& who, void* cookie,
-                               const AIBinder_DeathRecipient_onBinderDied& onDied)
+                               const AIBinder_DeathRecipient_onBinderDied onDied)
             : mWho(who), mCookie(cookie), mOnDied(onDied) {}
 
         void binderDied(const ::android::wp<::android::IBinder>& who) override;
@@ -144,7 +144,7 @@
        private:
         ::android::wp<::android::IBinder> mWho;
         void* mCookie;
-        const AIBinder_DeathRecipient_onBinderDied& mOnDied;
+        const AIBinder_DeathRecipient_onBinderDied mOnDied;
     };
 
     explicit AIBinder_DeathRecipient(AIBinder_DeathRecipient_onBinderDied onDied);