commit a820af964671ff076cf1007097e284c1375393b9
author Adithya Srinivasan <adsrini@google.com> Fri Nov 01 13:55:17 2019 -0700
committer Adithya Srinivasan <adsrini@google.com> Fri Nov 01 13:58:57 2019 -0700
tree 1e27b0c38fbe412f6a9cff81f5988d444642ab33
parent 0355ecabae2c5e26eedc94150df66ae8a80dd64f

Fix the call the onFrameDequeued inside dequeueBuffer

Having a separate mutex lock for calling onFrameDequeued at the end of
the dequeueBuffer function seems to be problematic since there is a
chance that the buffer can be acquired before obtaining this lock
resulting in a null pointer dereference. Moving the call inside the
existing auto-lock scoped blocks in this CL.

Test: CtsCameraTestCases:MultiViewTest#testSharedSurfaceYUVImageReaderSwitch on blueline and crosshatch
Bug: 143542027
Change-Id: If9e4b36ca2c54337eb0e5a6647773db20e43a6a3

libs/gui/BufferQueueProducer.cpp

diff --git a/libs/gui/BufferQueueProducer.cpp b/libs/gui/BufferQueueProducer.cpp
index 09c74de..a307d04 100644
--- a/libs/gui/BufferQueueProducer.cpp
+++ b/libs/gui/BufferQueueProducer.cpp
@@ -512,6 +512,12 @@
             mCore->mSharedBufferSlot = found;
             mSlots[found].mBufferState.mShared = true;
         }
+
+        if (!(returnFlags & BUFFER_NEEDS_REALLOCATION)) {
+            if (mCore->mConsumerListener != nullptr) {
+                mCore->mConsumerListener->onFrameDequeued(mSlots[*outSlot].mGraphicBuffer->getId());
+            }
+        }
     } // Autolock scope
 
     if (returnFlags & BUFFER_NEEDS_REALLOCATION) {
@@ -528,6 +534,10 @@
             if (error == NO_ERROR && !mCore->mIsAbandoned) {
                 graphicBuffer->setGenerationNumber(mCore->mGenerationNumber);
                 mSlots[*outSlot].mGraphicBuffer = graphicBuffer;
+                if (mCore->mConsumerListener != nullptr) {
+                    mCore->mConsumerListener->onFrameDequeued(
+                            mSlots[*outSlot].mGraphicBuffer->getId());
+                }
             }
 
             mCore->mIsAllocating = false;
@@ -580,11 +590,6 @@
     }
     addAndGetFrameTimestamps(nullptr, outTimestamps);
 
-    { // Autolock scope
-        std::lock_guard<std::mutex> lock(mCore->mMutex);
-        mCore->mConsumerListener->onFrameDequeued(mSlots[*outSlot].mGraphicBuffer->getId());
-    }
-
     return returnFlags;
 }