diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2017-06-20 20:15:29 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2017-06-20 20:15:30 +0000 |
| commit | 1b02b6329e7a2e3ed60b2209abec1f70c33c3d18 (patch) | |
| tree | 072b1bc544c3a05b7a10141949589aaf32bc19c6 | |
| parent | a17b14eb92f6c21a9cea97ed0ca30df74da9fc29 (diff) | |
| parent | fae51c438827ae0a55c1b83c0e9be348254bfbd4 (diff) | |
| download | native-1b02b6329e7a2e3ed60b2209abec1f70c33c3d18.tar.gz | |
Merge "surfaceflinger: fix a potential child layer leak" into oc-dev
| -rw-r--r-- | services/surfaceflinger/SurfaceFlinger.cpp | 4 | ||||
| -rw-r--r-- | services/surfaceflinger/SurfaceFlinger_hwc1.cpp | 16 |
2 files changed, 17 insertions, 3 deletions
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp index 6174185969..29e7bd6792 100644 --- a/services/surfaceflinger/SurfaceFlinger.cpp +++ b/services/surfaceflinger/SurfaceFlinger.cpp @@ -2689,8 +2689,6 @@ status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer, bool topLevelOnly) return NO_ERROR; } - index = p->removeChild(layer); - sp<Layer> ancestor = p; while (ancestor->getParent() != nullptr) { ancestor = ancestor->getParent(); @@ -2699,6 +2697,8 @@ status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer, bool topLevelOnly) ALOGE("removeLayer called with a layer whose parent has been removed"); return NAME_NOT_FOUND; } + + index = p->removeChild(layer); } else { index = mCurrentState.layersSortedByZ.remove(layer); } diff --git a/services/surfaceflinger/SurfaceFlinger_hwc1.cpp b/services/surfaceflinger/SurfaceFlinger_hwc1.cpp index 3d421d2154..0904fab4aa 100644 --- a/services/surfaceflinger/SurfaceFlinger_hwc1.cpp +++ b/services/surfaceflinger/SurfaceFlinger_hwc1.cpp @@ -2326,8 +2326,13 @@ status_t SurfaceFlinger::addClientLayer(const sp<Client>& client, if (parent == nullptr) { mCurrentState.layersSortedByZ.add(lbc); } else { + if (mCurrentState.layersSortedByZ.indexOf(parent) < 0) { + ALOGE("addClientLayer called with a removed parent"); + return NAME_NOT_FOUND; + } parent->addChild(lbc); } + mGraphicBufferProducerList.add(IInterface::asBinder(gbc)); mLayersAdded = true; mNumLayers++; @@ -2349,6 +2354,15 @@ status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer, bool topLevelOnly) return NO_ERROR; } + sp<Layer> ancestor = p; + while (ancestor->getParent() != nullptr) { + ancestor = ancestor->getParent(); + } + if (mCurrentState.layersSortedByZ.indexOf(ancestor) < 0) { + ALOGE("removeLayer called with a layer whose parent has been removed"); + return NAME_NOT_FOUND; + } + index = p->removeChild(layer); } else { index = mCurrentState.layersSortedByZ.remove(layer); @@ -2370,7 +2384,7 @@ status_t SurfaceFlinger::removeLayer(const sp<Layer>& layer, bool topLevelOnly) mLayersPendingRemoval.add(layer); mLayersRemoved = true; - mNumLayers--; + mNumLayers -= 1 + layer->getChildrenCount(); setTransactionFlags(eTransactionNeeded); return NO_ERROR; } |