commit 799a0d81b8142452c80fbbc305e2a7e7adf3537a
author Marissa Wall <marissaw@google.com> Thu Jul 11 13:32:46 2019 -0700
committer android-build-merger <android-build-merger@google.com> Thu Jul 11 13:32:46 2019 -0700
tree 4da6eb381462b26c65e05bc32f9f4641b05a0437
parent e0eed55e69d68abd9693485c635ad4942f414c00
parent 7879cacc5a7fc2b66c9de3ebbf0488ab60ef54b4

Merge "blast: fix leak on BufferStateLayer death" into qt-dev am: 6990af63ff am: f5d22cff90
am: 7879cacc5a

Change-Id: I79fe602bf5e27608b343e926e098a6e73326ad3a

services/surfaceflinger/TransactionCompletedThread.cpp

diff --git a/services/surfaceflinger/TransactionCompletedThread.cpp b/services/surfaceflinger/TransactionCompletedThread.cpp
index 0806f2a..c519f8d 100644
--- a/services/surfaceflinger/TransactionCompletedThread.cpp
+++ b/services/surfaceflinger/TransactionCompletedThread.cpp
@@ -228,8 +228,14 @@
     }
 
     transactionStats->latchTime = handle->latchTime;
-    transactionStats->surfaceStats.emplace_back(handle->surfaceControl, handle->acquireTime,
-                                                handle->previousReleaseFence);
+    // If the layer has already been destroyed, don't add the SurfaceControl to the callback.
+    // The client side keeps a sp<> to the SurfaceControl so if the SurfaceControl has been
+    // destroyed the client side is dead and there won't be anyone to send the callback to.
+    sp<IBinder> surfaceControl = handle->surfaceControl.promote();
+    if (surfaceControl) {
+        transactionStats->surfaceStats.emplace_back(surfaceControl, handle->acquireTime,
+                                                    handle->previousReleaseFence);
+    }
     return NO_ERROR;
 }
 

services/surfaceflinger/TransactionCompletedThread.h

diff --git a/services/surfaceflinger/TransactionCompletedThread.h b/services/surfaceflinger/TransactionCompletedThread.h
index b821350..e255e50 100644
--- a/services/surfaceflinger/TransactionCompletedThread.h
+++ b/services/surfaceflinger/TransactionCompletedThread.h
@@ -72,7 +72,7 @@
 
     sp<ITransactionCompletedListener> listener;
     std::vector<CallbackId> callbackIds;
-    sp<IBinder> surfaceControl;
+    wp<IBinder> surfaceControl;
 
     bool releasePreviousBuffer = false;
     sp<Fence> previousReleaseFence;