audioflinger: fix race condition in SyncEvent callback

Now that the SyncEvent callback is implemented by the
RecordTrack instead of the RecordThread, there is a possibility
that the callback is called after the track deletion.

SyncEvent callback now uses a weak pointer instead of
a raw pointer as cookie. This allows the callback implementer to
acquire a strong reference on the object pointed to by the cookie.

Bug: 13114128.
Change-Id: Id61b8f06044ed1e52c6f7e7c666cdede68340de2

1 files changed, 5 insertions, 2 deletions

diff --git a/services/audioflinger/Threads.cpp b/services/audioflinger/Threads.cpp
index 33c1178..9145a0e 100644
--- a/services/audioflinger/Threads.cpp
+++ b/services/audioflinger/Threads.cpp
@@ -5095,8 +5095,11 @@ void AudioFlinger::RecordThread::syncStartEventCallback(const wp<SyncEvent>& eve
     sp<SyncEvent> strongEvent = event.promote();
 
     if (strongEvent != 0) {
-        RecordTrack *recordTrack = (RecordTrack *)strongEvent->cookie();
-        recordTrack->handleSyncStartEvent(strongEvent);
+        sp<RefBase> ptr = strongEvent->cookie().promote();
+        if (ptr != 0) {
+            RecordTrack *recordTrack = (RecordTrack *)ptr.get();
+            recordTrack->handleSyncStartEvent(strongEvent);
+        }
     }
 }