fix [2152536] ANR in browser
A window is created and the browser is about to render into it the
very first time, at that point it does an IPC to SF to request a new
buffer. Meanwhile, the window manager removes that window from the
list and the shared memory block it uses is marked as invalid.
However, at that point, another window is created and is given the
same index (that just go freed), but a different identity and resets
the "invalid" bit in the shared block. When we go back to the buffer
allocation code, we're stuck because the surface we're allocating for
is gone and we don't detect it's invalid because the invalid bit has
been reset.
It is not sufficient to check for the invalid bit, I should
also check that identities match.
diff --git a/libs/surfaceflinger/Layer.cpp b/libs/surfaceflinger/Layer.cpp
index eb0614f..0258cee 100644
--- a/libs/surfaceflinger/Layer.cpp
+++ b/libs/surfaceflinger/Layer.cpp
@@ -133,7 +133,7 @@
void Layer::reloadTexture(const Region& dirty)
{
Mutex::Autolock _l(mLock);
- sp<GraphicBuffer> buffer(getFrontBuffer());
+ sp<GraphicBuffer> buffer(getFrontBufferLocked());
if (LIKELY((mFlags & DisplayHardware::DIRECT_TEXTURE) &&
(buffer->usage & GRALLOC_USAGE_HW_TEXTURE))) {
int index = mFrontBufferIndex;
@@ -194,7 +194,7 @@
}
}
} else {
- for (int i=0 ; i<NUM_BUFFERS ; i++)
+ for (size_t i=0 ; i<NUM_BUFFERS ; i++)
mTextures[i].image = EGL_NO_IMAGE_KHR;
GGLSurface t;
diff --git a/libs/surfaceflinger/Layer.h b/libs/surfaceflinger/Layer.h
index 6f59241..702c51a 100644
--- a/libs/surfaceflinger/Layer.h
+++ b/libs/surfaceflinger/Layer.h
@@ -80,7 +80,7 @@
inline PixelFormat pixelFormat() const { return mFormat; }
private:
- inline sp<GraphicBuffer> getFrontBuffer() {
+ inline sp<GraphicBuffer> getFrontBufferLocked() {
return mBuffers[mFrontBufferIndex];
}
diff --git a/libs/surfaceflinger/LayerBlur.cpp b/libs/surfaceflinger/LayerBlur.cpp
index 0ef663f..744f2e9 100644
--- a/libs/surfaceflinger/LayerBlur.cpp
+++ b/libs/surfaceflinger/LayerBlur.cpp
@@ -189,8 +189,8 @@
} else {
GLuint tw = 1 << (31 - clz(w));
GLuint th = 1 << (31 - clz(h));
- if (tw < w) tw <<= 1;
- if (th < h) th <<= 1;
+ if (tw < GLuint(w)) tw <<= 1;
+ if (th < GLuint(h)) th <<= 1;
glTexImage2D(GL_TEXTURE_2D, 0, mReadFormat, tw, th, 0,
mReadFormat, mReadType, NULL);
glTexSubImage2D(GL_TEXTURE_2D, 0, 0, 0, w, h,
diff --git a/libs/ui/SharedBufferStack.cpp b/libs/ui/SharedBufferStack.cpp
index 47c596c..b460757 100644
--- a/libs/ui/SharedBufferStack.cpp
+++ b/libs/ui/SharedBufferStack.cpp
@@ -97,10 +97,10 @@
// ----------------------------------------------------------------------------
SharedBufferBase::SharedBufferBase(SharedClient* sharedClient,
- int surface, int num)
+ int surface, int num, int32_t identity)
: mSharedClient(sharedClient),
mSharedStack(sharedClient->surfaces + surface),
- mNumBuffers(num)
+ mNumBuffers(num), mIdentity(identity)
{
}
@@ -248,8 +248,8 @@
// ============================================================================
SharedBufferClient::SharedBufferClient(SharedClient* sharedClient,
- int surface, int num)
- : SharedBufferBase(sharedClient, surface, num), tail(0)
+ int surface, int num, int32_t identity)
+ : SharedBufferBase(sharedClient, surface, num, identity), tail(0)
{
tail = computeTail();
}
@@ -353,7 +353,7 @@
SharedBufferServer::SharedBufferServer(SharedClient* sharedClient,
int surface, int num, int32_t identity)
- : SharedBufferBase(sharedClient, surface, num)
+ : SharedBufferBase(sharedClient, surface, num, identity)
{
mSharedStack->init(identity);
mSharedStack->head = num-1;
diff --git a/libs/ui/Surface.cpp b/libs/ui/Surface.cpp
index 7822533..2d83a8c 100644
--- a/libs/ui/Surface.cpp
+++ b/libs/ui/Surface.cpp
@@ -314,7 +314,7 @@
mWidth(surface->mWidth), mHeight(surface->mHeight)
{
mSharedBufferClient = new SharedBufferClient(
- mClient->mControl, mToken, 2);
+ mClient->mControl, mToken, 2, mIdentity);
init();
}
@@ -336,7 +336,7 @@
mClient = SurfaceComposerClient::clientForConnection(clientBinder);
mSharedBufferClient = new SharedBufferClient(
- mClient->mControl, mToken, 2);
+ mClient->mControl, mToken, 2, mIdentity);
}
init();