force command flush after releasing a reference to shared memory

After releasing a reference to a shared memory interface,
IPCThreadState::self()->flushCommands() must be called to ensure
that the corresponding reference is also cleared immediately in the
remote process. Otherwise the binder implementaiton will not
push the clear systematically causing the memory region not to be freed.

See issues 10711502 and 2801375.

Bug: 14057166.
Change-Id: If55f36f00d452d6cf00cf83bd2fba1c8f3abcb57

3 files changed, 10 insertions, 4 deletions

diff --git a/media/libmedia/AudioRecord.cpp b/media/libmedia/AudioRecord.cpp
index db61e85..50b444a 100644
--- a/media/libmedia/AudioRecord.cpp
+++ b/media/libmedia/AudioRecord.cpp
@@ -105,6 +105,8 @@ AudioRecord::~AudioRecord()
         }
         mAudioRecord->asBinder()->unlinkToDeath(mDeathNotifier, this);
         mAudioRecord.clear();
+        mCblkMemory.clear();
+        mBufferMemory.clear();
         IPCThreadState::self()->flushCommands();
         AudioSystem::releaseAudioSessionId(mSessionId, -1);
     }
@@ -546,9 +548,10 @@ status_t AudioRecord::openRecord_l(size_t epoch)
         mDeathNotifier.clear();
     }
     mAudioRecord = record;
-
     mCblkMemory = iMem;
     mBufferMemory = bufferMem;
+    IPCThreadState::self()->flushCommands();
+
     mCblk = cblk;
     // note that temp is the (possibly revised) value of frameCount
     if (temp < frameCount || (frameCount == 0 && temp == 0)) {
diff --git a/media/libmedia/AudioTrack.cpp b/media/libmedia/AudioTrack.cpp
index 7d3ecc5..fa8e5c3 100644
--- a/media/libmedia/AudioTrack.cpp
+++ b/media/libmedia/AudioTrack.cpp
@@ -174,6 +174,8 @@ AudioTrack::~AudioTrack()
         }
         mAudioTrack->asBinder()->unlinkToDeath(mDeathNotifier, this);
         mAudioTrack.clear();
+        mCblkMemory.clear();
+        mSharedBuffer.clear();
         IPCThreadState::self()->flushCommands();
         ALOGV("~AudioTrack, releasing session id from %d on behalf of %d",
                 IPCThreadState::self()->getCallingPid(), mClientPid);
@@ -1059,8 +1061,9 @@ status_t AudioTrack::createTrack_l(size_t epoch)
         mDeathNotifier.clear();
     }
     mAudioTrack = track;
-
     mCblkMemory = iMem;
+    IPCThreadState::self()->flushCommands();
+
     audio_track_cblk_t* cblk = static_cast<audio_track_cblk_t*>(iMemPointer);
     mCblk = cblk;
     // note that temp is the (possibly revised) value of frameCount
diff --git a/services/audioflinger/Tracks.cpp b/services/audioflinger/Tracks.cpp
index 4e8a058..1e906ad 100644
--- a/services/audioflinger/Tracks.cpp
+++ b/services/audioflinger/Tracks.cpp
@@ -223,6 +223,8 @@ AudioFlinger::ThreadBase::TrackBase::~TrackBase()
         // relying on the automatic clear() at end of scope.
         mClient.clear();
     }
+    // flush the binder command buffer
+    IPCThreadState::self()->flushCommands();
 }
 
 // AudioBufferProvider interface
@@ -432,8 +434,6 @@ AudioFlinger::PlaybackThread::Track::~Track()
     // This prevents that leak.
     if (mSharedBuffer != 0) {
         mSharedBuffer.clear();
-        // flush the binder command buffer
-        IPCThreadState::self()->flushCommands();
     }
 }