Prevent crash when flushing the layers cache
Bug #6258973

When flushing the layer caches we would attempt to delete the FBOs
associate with layers in the cache. The FBO property was however not
always properly cleared when recycling layers.

Change-Id: I7dedfe391d659a0849f1e1d84df17313b2c6e2b2
diff --git a/libs/hwui/LayerCache.cpp b/libs/hwui/LayerCache.cpp
index d304b37..eea707e 100644
--- a/libs/hwui/LayerCache.cpp
+++ b/libs/hwui/LayerCache.cpp
@@ -69,10 +69,14 @@
 
 void LayerCache::deleteLayer(Layer* layer) {
     if (layer) {
-        LAYER_LOGD("Destroying layer %dx%d", layer->getWidth(), layer->getHeight());
+        GLuint fbo = layer->getFbo();
+        LAYER_LOGD("Destroying layer %dx%d, fbo %d", layer->getWidth(), layer->getHeight(), fbo);
+
         mSize -= layer->getWidth() * layer->getHeight() * 4;
-        layer->deleteFbo();
+
+        if (fbo) Caches::getInstance().fboCache.put(fbo);
         layer->deleteTexture();
+
         delete layer;
     }
 }
@@ -174,6 +178,10 @@
                     victim->layer.getHeight());
         }
 
+        layer->deferredUpdateScheduled = false;
+        layer->renderer = NULL;
+        layer->displayList = NULL;
+
         LayerEntry entry(layer);
 
         mCache.add(entry);
diff --git a/libs/hwui/LayerRenderer.cpp b/libs/hwui/LayerRenderer.cpp
index e320eb2..2a4e72b 100644
--- a/libs/hwui/LayerRenderer.cpp
+++ b/libs/hwui/LayerRenderer.cpp
@@ -309,6 +309,7 @@
         if (fbo) {
             flushLayer(layer);
             Caches::getInstance().fboCache.put(fbo);
+            layer->setFbo(0);
         }
 
         if (!Caches::getInstance().layerCache.put(layer)) {
diff --git a/libs/hwui/OpenGLRenderer.cpp b/libs/hwui/OpenGLRenderer.cpp
index eb4b83b..e4d1ba9 100644
--- a/libs/hwui/OpenGLRenderer.cpp
+++ b/libs/hwui/OpenGLRenderer.cpp
@@ -641,6 +641,7 @@
 
         // Put the FBO name back in the cache, if it doesn't fit, it will be destroyed
         mCaches.fboCache.put(current->fbo);
+        layer->setFbo(0);
     }
 
     dirtyClip();