commit 8e82b8d99e9ffb73bf3bb3c7c6aaa956e2228a41
author Alec Mouri <alecmouri@google.com> Mon Mar 09 16:11:00 2020 -0700
committer Alec Mouri <alecmouri@google.com> Mon Mar 09 17:33:22 2020 -0700
tree b00fa5b79f5fabcdde8e082c9c98d084296f186a
parent 1c7bc86a9b1bdf16b240a96d083102127f036325

[RenderEngine] Fix use-after-move error

GLESREnderEngine::waitFence takes ownership of the file descriptor, so
callers must dup it first. Otherwise, this results in a use-after-free
error on devices that do not support EGL_ANDROID_native_fence_sync.

Bug: 150954608
Test: WITH_TIDY=1 m -j
Change-Id: I7e6d88c0f282a317fd8e603dccb918f3d5bc0fcc

libs/renderengine/gl/GLESRenderEngine.cpp

diff --git a/libs/renderengine/gl/GLESRenderEngine.cpp b/libs/renderengine/gl/GLESRenderEngine.cpp
index e11b59f..0551829 100644
--- a/libs/renderengine/gl/GLESRenderEngine.cpp
+++ b/libs/renderengine/gl/GLESRenderEngine.cpp
@@ -973,9 +973,13 @@
         return NO_ERROR;
     }
 
-    if (bufferFence.get() >= 0 && !waitFence(std::move(bufferFence))) {
-        ATRACE_NAME("Waiting before draw");
-        sync_wait(bufferFence.get(), -1);
+    if (bufferFence.get() >= 0) {
+        // Duplicate the fence for passing to waitFence.
+        base::unique_fd bufferFenceDup(dup(bufferFence.get()));
+        if (bufferFenceDup < 0 || !waitFence(std::move(bufferFenceDup))) {
+            ATRACE_NAME("Waiting before draw");
+            sync_wait(bufferFence.get(), -1);
+        }
     }
 
     if (buffer == nullptr) {