| commit | ca1002f49e0f817229b04ec93b675861e8bfcb83 | [log] [tgz] |
|---|---|---|
| author | Christopher Tate <ctate@google.com> | Tue May 19 18:16:58 2015 -0700 |
| committer | The Android Automerger <android-build@google.com> | Thu May 21 15:19:08 2015 -0700 |
| tree | 7c85139b1b6b50507f065ceeff1d129d8953e309 | |
| parent | 48b1bd2dffc03b13039f9f2935bcad3d14cdb2b2 [diff] |
Close race condition in binderDied() It was possible for a binderDied() call to occur while the death recipient list containing the object was being iterated, in which case we could invalidate an object reference out from under the iteration, causing a VM abort. We now interlock the binderDied() deref operation with the list's locking semantics to prevent this. Bug 15831054 Change-Id: If0027d3ac4da1153284a425dd9b2819a203481ab