commit 1d3df546d5ee4dcc9e7cae6f8b8b790f741539af
author Steve Pfetsch <spfetsch@google.com> Thu Sep 29 17:16:29 2016 -0700
committer Steve Pfetsch <spfetsch@google.com> Tue Oct 18 18:36:25 2016 -0700
tree a1a723f5eda7794819643431ba5fb8742e9bece5
parent f920891b71cbd33c96e7e44231524ee0b8e83760

services: surfaceflinger: ASAN fix

Move layer removal to the main thread, while the display is on.

Bug: 30281222
Change-Id: Id9f956c1e626819734868340e7fa12abf257b702

services/surfaceflinger/SurfaceFlinger.cpp

diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index 8db071e..db52d40 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -1768,9 +1768,12 @@
 
 void SurfaceFlinger::commitTransaction()
 {
-    if (!mLayersPendingRemoval.isEmpty()) {
+    sp<const DisplayDevice> hw = getDefaultDisplayDevice();
+
+    if (!mLayersPendingRemoval.isEmpty() && hw->isDisplayOn()) {
         // Notify removed layers now that they can't be drawn from
         for (size_t i = 0; i < mLayersPendingRemoval.size(); i++) {
+            mCurrentState.layersSortedByZ.remove(mLayersPendingRemoval[i]);
             recordBufferingStats(mLayersPendingRemoval[i]->getName().string(),
                     mLayersPendingRemoval[i]->getOccupancyHistory(true));
             mLayersPendingRemoval[i]->onRemoved();
@@ -2217,14 +2220,10 @@
         return NO_ERROR;
     }
 
-    ssize_t index = mCurrentState.layersSortedByZ.remove(layer);
-    if (index >= 0) {
-        mLayersPendingRemoval.push(layer);
-        mLayersRemoved = true;
-        setTransactionFlags(eTransactionNeeded);
-        return NO_ERROR;
-    }
-    return status_t(index);
+    mLayersPendingRemoval.push(layer);
+    mLayersRemoved = true;
+    setTransactionFlags(eTransactionNeeded);
+    return NO_ERROR;
 }
 
 uint32_t SurfaceFlinger::peekTransactionFlags(uint32_t /* flags */) {