tree b28bcf24ec7209362c2fcd29b4204e0ba09d4022
parent f7a9aaa12eb25bbd163fbc02c4fa638889dd67c2
author Christopher Tate <ctate@google.com> 1432084618 -0700
committer Christopher Tate <ctate@google.com> 1432085660 -0700

Close race condition in binderDied()

It was possible for a binderDied() call to occur while the death
recipient list containing the object was being iterated, in which
case we could invalidate an object reference out from under the
iteration, causing a VM abort.  We now interlock the binderDied()
deref operation with the list's locking semantics to prevent this.

Bug 15831054

Change-Id: If0027d3ac4da1153284a425dd9b2819a203481ab