Fix deadlock in camera destruction after client app's crash

* why deadlock happened: when an app (CTS camera test) crashes while using
  camera, its binder is closed and reference counter is decreased. If camera
  is inside callback, sp<Client> inside callback will hold the Client instance,
  and Client instance is destroyed when the callback ends as sp<Client> to hold
  it no longer exists. The destructor of Client instance tries to clean up
  camera H/W which tries to stop threads created by camera HAL including the
  thread context where the callback is running. This causes deadlock where the
  callback thread itself is waiting for itself to terminate.
  Note that the deadlock will not happen if camera callback is not active. In
  that case, closing of binder will force the destruction of Client instance,
  and the destruction happens in binder thread.

* Fix: Forces Client descruction in binder thread
- remove sp<Client> from callbacks to prevent destruction in callback context
- add client lock to allow callback to use raw pointer safely. This prevents
  the destructor from deleting the instance while callback is using it.
- add status change inside destructor with client lock to safely destroy Client

Bug: 6214383
Change-Id: Ic6d6396d4d95ce9e72a16ec2480ae65c100fe806

0 files changed, 0 insertions, 0 deletions