fix a crasher in SurfaceTexture::updateTexImage()

we now make sure to drain the buffer queue on disconnect.
this happens only when in synchrnous mode. in async mode
we clear all buffers except the head of the queue.

for extra safety we also catch the null pointer
in updateTexImage (which should  never happen) and return
an error.

Bug: 5111008

Change-Id: I5174a6ecbb0de641c6510ef56a611cbb4e9e1f59

1 files changed, 18 insertions, 4 deletions

diff --git a/include/gui/SurfaceTexture.h b/include/gui/SurfaceTexture.h
index 71d818c..a6fb12e 100644
--- a/include/gui/SurfaceTexture.h
+++ b/include/gui/SurfaceTexture.h
@@ -208,13 +208,27 @@ public:
 
 protected:
 
-    // freeAllBuffers frees the resources (both GraphicBuffer and EGLImage) for
-    // all slots.
+    // freeBufferLocked frees the resources (both GraphicBuffer and EGLImage)
+    // for the given slot.
+    void freeBufferLocked(int index);
+
+    // freeAllBuffersLocked frees the resources (both GraphicBuffer and
+    // EGLImage) for all slots.
     void freeAllBuffersLocked();
 
+    // freeAllBuffersExceptHeadLocked frees the resources (both GraphicBuffer
+    // and EGLImage) for all slots except the head of mQueue
+    void freeAllBuffersExceptHeadLocked();
+
     // drainQueueLocked drains the buffer queue if we're in synchronous mode
-    // returns immediately otherwise.
-    void drainQueueLocked();
+    // returns immediately otherwise. return NO_INIT if SurfaceTexture
+    // became abandoned or disconnected during this call.
+    status_t drainQueueLocked();
+
+    // drainQueueAndFreeBuffersLocked drains the buffer queue if we're in
+    // synchronous mode and free all buffers. In asynchronous mode, all buffers
+    // are freed except the current buffer.
+    status_t drainQueueAndFreeBuffersLocked();
 
     static bool isExternalFormat(uint32_t format);