| commit | 090c08ff2a7525c830b4edfd1a79aa8ee3893c60 | [log] [tgz] |
|---|---|---|
| author | Christopher Tate <ctate@google.com> | Tue May 19 18:16:58 2015 -0700 |
| committer | Christopher Tate <ctate@google.com> | Tue May 19 18:34:20 2015 -0700 |
| tree | b28bcf24ec7209362c2fcd29b4204e0ba09d4022 | |
| parent | f7a9aaa12eb25bbd163fbc02c4fa638889dd67c2 [diff] |
Close race condition in binderDied() It was possible for a binderDied() call to occur while the death recipient list containing the object was being iterated, in which case we could invalidate an object reference out from under the iteration, causing a VM abort. We now interlock the binderDied() deref operation with the list's locking semantics to prevent this. Bug 15831054 Change-Id: If0027d3ac4da1153284a425dd9b2819a203481ab