Fix black screen upon awake (reused after free)
Under a specific timing, the state of the HWC can be left populated
with "old" layers. If a Refresh Message comes before the WM sends
a Transaction resetting the layer, the old layers are sent to the
HWC. These old layers features buffer_handle which had been freed,
resulting in a frame never signaling and a locked screen due to
backpressure triggering constantly.
Detailed explanation:
When the device power off is pressed, the WM plays the fadeout
animation, set the layer "fadeOut" to displayId -1 and calls
setPowerMode(Off). This sequence of events leads to a state where
no layers are deemed visible in surface flinger but the HWC2 still
has one.
Upon awakening the device, if a Refresh message is received before
the WM has the time to reset fadeOut layer displayId to its original
value, the HWC2 will use its last known state.
Sequence of events (with and without crash):
Put device to sleep.
Awake device.
PowerOn
Refresh <- crash
Put device to sleep.
Awake device.
PowerOn
Transac
Refresh <- Ok
Bug: 35712353
Test: AUPT (100 cycles sleep/awake without black screen lock)
Change-Id: If9177ccc0627f3b733030ed5e462dc465e63e963
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 842ff0b..bff8f5f 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -1582,6 +1582,9 @@
layer->setHwcLayer(displayDevice->getHwcDisplayId(),
nullptr);
}
+ } else {
+ layer->setHwcLayer(displayDevice->getHwcDisplayId(),
+ nullptr);
}
});
}