SF: detachLayer from Client earlier on destruction
- When a Layer is destroyed the Layer destructor isn't called until
the next vsync refresh. However, the onRemoved() callback is called
on the next invalidate. So it's possible to submit a transaction on
the layer in between the call to onRemoved() and the destructor
being called.
- Call detachLayer() from onRemoved() instead of from the destructor
so that any transactions on a destroyed Layer will fail to get the
Layer object even if the destructor has yet to be called.
Bug 25887783
Change-Id: Ic2371f695bc91aa7120bf6506bb834ceb536420e
diff --git a/services/surfaceflinger/Layer.cpp b/services/surfaceflinger/Layer.cpp
index 2b6e0ec..d484708 100644
--- a/services/surfaceflinger/Layer.cpp
+++ b/services/surfaceflinger/Layer.cpp
@@ -147,10 +147,6 @@
}
Layer::~Layer() {
- sp<Client> c(mClientRef.promote());
- if (c != 0) {
- c->detachLayer(this);
- }
mFlinger->deleteTextureAsync(mTextureName);
mFrameTracker.logAndResetStats(mName);
}
@@ -252,6 +248,10 @@
// the layer has been remove from the current state list (and just before
// it's removed from the drawing state list)
void Layer::onRemoved() {
+ sp<Client> c(mClientRef.promote());
+ if (c != 0) {
+ c->detachLayer(this);
+ }
mSurfaceFlingerConsumer->abandon();
}