libmedia: ensure mCaptureThread exit within Visualizer destructor

If mCaptureThread doesn't exit when Visualizer instance gets destroyed,
recycled member variables with random value such as danger pointer will
be accessed again and causes crash.

Thread which is created within Visualizer instance lifecycle should be
terminated before or within destructor.

CRs-Fixed: 688546
authored-by: wjiang@codeaurora.org
cherry-pick from CAF commit: 4823e3d6b8c60faa4d8fee5d58728eb70e56abf2

Bug: 18159501
Change-Id: Ie0b12ae8a3b9735b6ecbac0353781b8358cad644

1 files changed, 12 insertions, 7 deletions

diff --git a/media/libmedia/Visualizer.cpp b/media/libmedia/Visualizer.cpp
index c146b8d..f91e3e4 100644
--- a/media/libmedia/Visualizer.cpp
+++ b/media/libmedia/Visualizer.cpp
@@ -52,6 +52,13 @@ Visualizer::Visualizer (int32_t priority,
 
 Visualizer::~Visualizer()
 {
+    ALOGV("Visualizer::~Visualizer()");
+    if (mCaptureThread != NULL) {
+        mCaptureThread->requestExitAndWait();
+        mCaptureThread.clear();
+    }
+    mCaptureCallBack = NULL;
+    mCaptureFlags = 0;
 }
 
 status_t Visualizer::setEnabled(bool enabled)
@@ -102,20 +109,18 @@ status_t Visualizer::setCaptureCallBack(capture_cbk_t cbk, void* user, uint32_t
         return INVALID_OPERATION;
     }
 
-    sp<CaptureThread> t = mCaptureThread;
-    if (t != 0) {
-        t->mLock.lock();
+    if (mCaptureThread != 0) {
+        mCaptureLock.unlock();
+        mCaptureThread->requestExitAndWait();
+        mCaptureLock.lock();
     }
+
     mCaptureThread.clear();
     mCaptureCallBack = cbk;
     mCaptureCbkUser = user;
     mCaptureFlags = flags;
     mCaptureRate = rate;
 
-    if (t != 0) {
-        t->mLock.unlock();
-    }
-
     if (cbk != NULL) {
         mCaptureThread = new CaptureThread(*this, rate, ((flags & CAPTURE_CALL_JAVA) != 0));
     }