Prevent crash when flushing the layers cache

Bug #6258973

When flushing the layer caches we would attempt to delete the FBOs
associate with layers in the cache. The FBO property was however not
always properly cleared when recycling layers.

Change-Id: I7dedfe391d659a0849f1e1d84df17313b2c6e2b2

3 files changed, 12 insertions, 2 deletions

diff --git a/libs/hwui/LayerCache.cpp b/libs/hwui/LayerCache.cpp
index d304b37..eea707e 100644
--- a/libs/hwui/LayerCache.cpp
+++ b/libs/hwui/LayerCache.cpp
@@ -69,10 +69,14 @@ void LayerCache::setMaxSize(uint32_t maxSize) {
 
 void LayerCache::deleteLayer(Layer* layer) {
     if (layer) {
-        LAYER_LOGD("Destroying layer %dx%d", layer->getWidth(), layer->getHeight());
+        GLuint fbo = layer->getFbo();
+        LAYER_LOGD("Destroying layer %dx%d, fbo %d", layer->getWidth(), layer->getHeight(), fbo);
+
         mSize -= layer->getWidth() * layer->getHeight() * 4;
-        layer->deleteFbo();
+
+        if (fbo) Caches::getInstance().fboCache.put(fbo);
         layer->deleteTexture();
+
         delete layer;
     }
 }
@@ -174,6 +178,10 @@ bool LayerCache::put(Layer* layer) {
                     victim->layer.getHeight());
         }
 
+        layer->deferredUpdateScheduled = false;
+        layer->renderer = NULL;
+        layer->displayList = NULL;
+
         LayerEntry entry(layer);
 
         mCache.add(entry);
diff --git a/libs/hwui/LayerRenderer.cpp b/libs/hwui/LayerRenderer.cpp
index e320eb2..2a4e72b 100644
--- a/libs/hwui/LayerRenderer.cpp
+++ b/libs/hwui/LayerRenderer.cpp
@@ -309,6 +309,7 @@ void LayerRenderer::destroyLayer(Layer* layer) {
         if (fbo) {
             flushLayer(layer);
             Caches::getInstance().fboCache.put(fbo);
+            layer->setFbo(0);
         }
 
         if (!Caches::getInstance().layerCache.put(layer)) {
diff --git a/libs/hwui/OpenGLRenderer.cpp b/libs/hwui/OpenGLRenderer.cpp
index eb4b83b..e4d1ba9 100644
--- a/libs/hwui/OpenGLRenderer.cpp
+++ b/libs/hwui/OpenGLRenderer.cpp
@@ -641,6 +641,7 @@ void OpenGLRenderer::composeLayer(sp<Snapshot> current, sp<Snapshot> previous) {
 
         // Put the FBO name back in the cache, if it doesn't fit, it will be destroyed
         mCaches.fboCache.put(current->fbo);
+        layer->setFbo(0);
     }
 
     dirtyClip();