commit f10a87bddbe89067002dac8384311e191bb9d5f4
author Vishnu Nair <vishnun@google.com> Mon May 01 14:02:51 2023 -0700
committer Vishnu Nair <vishnun@google.com> Mon May 01 14:04:09 2023 -0700
tree 1039bfa6f78529d99e80da15f62c7a75e6f3d5f2
parent 38a3e0b7e2565a583bc4b0733efc21daebd5c31a

[sf] Fix crash caused by invalid access of mPreviouslyPresentedLayerStacks

While trying to update the release fence for layers with buffer
removed, we incorrectly accessed and updated the same data struct.

Test: presbumit
Fixes: 279397500
Change-Id: I2488da1696774669777e94e23301af6ecc2ae581

services/surfaceflinger/SurfaceFlinger.cpp

diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index c88bff5..4e0ac10 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -2874,7 +2874,10 @@
     }
 
     for (auto layer : mLayersWithBuffersRemoved) {
-        for (auto layerStack : layer->mPreviouslyPresentedLayerStacks) {
+        std::vector<ui::LayerStack> previouslyPresentedLayerStacks =
+                std::move(layer->mPreviouslyPresentedLayerStacks);
+        layer->mPreviouslyPresentedLayerStacks.clear();
+        for (auto layerStack : previouslyPresentedLayerStacks) {
             auto optDisplay = layerStackToDisplay.get(layerStack);
             if (optDisplay && !optDisplay->get()->isVirtual()) {
                 auto fence = getHwComposer().getPresentFence(optDisplay->get()->getPhysicalId());