Camera2: Don't promote weak IBinder ptrs to strong ones

The Binder driver does not support promoting weak pointers into strong
pointers. Occassionally the system would lock up when trying to do this
(when closing the camera app).

Bug: 7289040
Change-Id: I8bc0b5c48616bf0b7f4eed1878ad4994ee635871

1 files changed, 12 insertions, 10 deletions

diff --git a/services/camera/libcameraservice/CameraService.cpp b/services/camera/libcameraservice/CameraService.cpp
index 4d48d8d..6fbd6ed 100644
--- a/services/camera/libcameraservice/CameraService.cpp
+++ b/services/camera/libcameraservice/CameraService.cpp
@@ -227,7 +227,7 @@ void CameraService::removeClient(const sp<ICameraClient>& cameraClient) {
     Mutex::Autolock lock(mServiceLock);
 
     int outIndex;
-    sp<Client> client = findClientUnsafe(cameraClient, outIndex);
+    sp<Client> client = findClientUnsafe(cameraClient->asBinder(), outIndex);
 
     if (client != 0) {
         // Found our camera, clear and leave.
@@ -241,7 +241,7 @@ void CameraService::removeClient(const sp<ICameraClient>& cameraClient) {
 }
 
 sp<CameraService::Client> CameraService::findClientUnsafe(
-                        const sp<ICameraClient>& cameraClient, int& outIndex) {
+                        const wp<IBinder>& cameraClient, int& outIndex) {
     sp<Client> client;
 
     for (int i = 0; i < mNumberOfCameras; i++) {
@@ -260,7 +260,7 @@ sp<CameraService::Client> CameraService::findClientUnsafe(
             continue;
         }
 
-        if (cameraClient->asBinder() == client->getCameraClient()->asBinder()) {
+        if (cameraClient == client->getCameraClient()->asBinder()) {
             // Found our camera
             outIndex = i;
             return client;
@@ -281,8 +281,8 @@ Mutex* CameraService::getClientLockById(int cameraId) {
     return &mClientLock[cameraId];
 }
 
-/*virtual*/sp<CameraService::Client> CameraService::getClientByRemote(
-                                const sp<ICameraClient>& cameraClient) {
+sp<CameraService::Client> CameraService::getClientByRemote(
+                                const wp<IBinder>& cameraClient) {
 
     // Declare this before the lock to make absolutely sure the
     // destructor won't be called with the lock held.
@@ -557,18 +557,20 @@ status_t CameraService::dump(int fd, const Vector<String16>& args) {
 /*virtual*/void CameraService::binderDied(
     const wp<IBinder> &who) {
 
+    /**
+      * While tempting to promote the wp<IBinder> into a sp,
+      * it's actually not supported by the binder driver
+      */
+
     ALOGV("java clients' binder died");
 
-    sp<IBinder> whoStrong = who.promote();
+    sp<Client> cameraClient = getClientByRemote(who);
 
-    if (whoStrong == 0) {
+    if (cameraClient == 0) {
         ALOGV("java clients' binder death already cleaned up (normal case)");
         return;
     }
 
-    sp<ICameraClient> iCamClient = interface_cast<ICameraClient>(whoStrong);
-
-    sp<Client> cameraClient = getClientByRemote(iCamClient);
     ALOGW("Disconnecting camera client %p since the binder for it "
           "died (this pid %d)", cameraClient.get(), getCallingPid());