Surface: Release references to BlastBufferQueue and SurfaceControl on Surface#destroy
SurfaceView clients may hold on to surface references. In S this means
they would extend the lifetime of the SurfaceControl resulting in
"leaking" buffers until the references are cleared or the app is
terminated.
Fix this by calling a new destroy function on Surface which will
explicitly remove references to the SurfaceControl and BBQ it holds.
This is safe because SurfaceView controls the lifecycle of the Surface
and knows when the Surface will become invalid. Once invalid, the Surface
cannot become valid again.
Test: repro steps in bug
Bug: 198133921
Change-Id: I88fe98fa275dd76e20a5403c24bd2cb3bee5346d
Merged-In: I88fe98fa275dd76e20a5403c24bd2cb3bee5346d
diff --git a/libs/gui/BLASTBufferQueue.cpp b/libs/gui/BLASTBufferQueue.cpp
index d860f30..94e1ae1 100644
--- a/libs/gui/BLASTBufferQueue.cpp
+++ b/libs/gui/BLASTBufferQueue.cpp
@@ -630,7 +630,10 @@
class BBQSurface : public Surface {
private:
+ std::mutex mMutex;
sp<BLASTBufferQueue> mBbq;
+ bool mDestroyed = false;
+
public:
BBQSurface(const sp<IGraphicBufferProducer>& igbp, bool controlledByApp,
const sp<IBinder>& scHandle, const sp<BLASTBufferQueue>& bbq)
@@ -650,6 +653,10 @@
status_t setFrameRate(float frameRate, int8_t compatibility,
int8_t changeFrameRateStrategy) override {
+ std::unique_lock _lock{mMutex};
+ if (mDestroyed) {
+ return DEAD_OBJECT;
+ }
if (!ValidateFrameRate(frameRate, compatibility, changeFrameRateStrategy,
"BBQSurface::setFrameRate")) {
return BAD_VALUE;
@@ -658,8 +665,20 @@
}
status_t setFrameTimelineInfo(const FrameTimelineInfo& frameTimelineInfo) override {
+ std::unique_lock _lock{mMutex};
+ if (mDestroyed) {
+ return DEAD_OBJECT;
+ }
return mBbq->setFrameTimelineInfo(frameTimelineInfo);
}
+
+ void destroy() override {
+ Surface::destroy();
+
+ std::unique_lock _lock{mMutex};
+ mDestroyed = true;
+ mBbq = nullptr;
+ }
};
// TODO: Can we coalesce this with frame updates? Need to confirm