fix [4093196] Device lock up - log spam with SharedBufferStack: waitForCondition(LockCondition) timed out
a memory corruption happned when the buffer pool was resized
(like when playing a video or using camera) and there was
no current active buffer. In this case, the faulty code
would index into an array at position -1 which corrupted
24 bytes of data.
also improved region validation code (ifdef'ed out by default)
Bug: 4093196
Change-Id: I915c581d131148959d720e00e3892e9186ab733d
diff --git a/include/utils/Vector.h b/include/utils/Vector.h
index ec851bd..6fd307f 100644
--- a/include/utils/Vector.h
+++ b/include/utils/Vector.h
@@ -162,6 +162,9 @@
inline status_t sort(compar_t cmp);
inline status_t sort(compar_r_t cmp, void* state);
+ // for debugging only
+ inline size_t getItemSize() const { return itemSize(); }
+
protected:
virtual void do_construct(void* storage, size_t num) const;
virtual void do_destroy(void* storage, size_t num) const;
diff --git a/libs/ui/Region.cpp b/libs/ui/Region.cpp
index 1994f6a..a060a5f 100644
--- a/libs/ui/Region.cpp
+++ b/libs/ui/Region.cpp
@@ -56,6 +56,9 @@
Region::Region(const Region& rhs)
: mBounds(rhs.mBounds), mStorage(rhs.mStorage)
{
+#if VALIDATE_REGIONS
+ validate(rhs, "rhs copy-ctor");
+#endif
}
Region::Region(const Rect& rhs)
@@ -76,7 +79,8 @@
Region& Region::operator = (const Region& rhs)
{
#if VALIDATE_REGIONS
- validate(rhs, "operator=");
+ validate(*this, "this->operator=");
+ validate(rhs, "rhs.operator=");
#endif
mBounds = rhs.mBounds;
mStorage = rhs.mStorage;
@@ -366,6 +370,12 @@
const Region& lhs,
const Region& rhs, int dx, int dy)
{
+#if VALIDATE_REGIONS
+ validate(lhs, "boolean_operation (before): lhs");
+ validate(rhs, "boolean_operation (before): rhs");
+ validate(dst, "boolean_operation (before): dst");
+#endif
+
size_t lhs_count;
Rect const * const lhs_rects = lhs.getArray(&lhs_count);
diff --git a/services/surfaceflinger/Layer.cpp b/services/surfaceflinger/Layer.cpp
index 1297363..cd24478 100644
--- a/services/surfaceflinger/Layer.cpp
+++ b/services/surfaceflinger/Layer.cpp
@@ -858,11 +858,13 @@
Mutex::Autolock _l(mLock);
if (size < mNumBuffers) {
- // Move the active texture into slot 0
- BufferData activeBufferData = mBufferData[mActiveBufferIndex];
- mBufferData[mActiveBufferIndex] = mBufferData[0];
- mBufferData[0] = activeBufferData;
- mActiveBufferIndex = 0;
+ // If there is an active texture, move it into slot 0 if needed
+ if (mActiveBufferIndex > 0) {
+ BufferData activeBufferData = mBufferData[mActiveBufferIndex];
+ mBufferData[mActiveBufferIndex] = mBufferData[0];
+ mBufferData[0] = activeBufferData;
+ mActiveBufferIndex = 0;
+ }
// Free the buffers that are no longer needed.
for (size_t i = size; i < mNumBuffers; i++) {