Android/frameworks_base
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix potential double destroy of AssetManager

Browse Source 
Assume there is a XmlBlock [X] created by a AssetManager [A]
([A] will have mNumRefs = 2). After [A].close is called
(mNumRefs = 1) and then both [X] and [A] are going to be GCed,
if [A].finalize is called first (nativeDestroy), the later
[X].finalize will invoke [A].xmlBlockGone that triggers the
second nativeDestroy of [A] and leads to crash.

By clearing the mObject in AssetManager.finalize, the
decRefsLocked from other paths won't call nativeDestroy again.

Bug: 136721562
Bug: 144028297
Test: atest AssetManagerTest
Test: Build and install CorePerfTests
      adb shell am instrument -w -r --no-hidden-api-checks -e class \
      android.app.ResourcesPerfTest#getLayoutAndTravese,android.graphics.perftests.RenderNodePerfTest \
      com.android.perftests.core/androidx.test.runner.AndroidJUnitRunner

Change-Id: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
Merged-In: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
This commit is contained in:
Riddle Hsu
2019-07-04 16:10:08 +08:00
committed by Ryan Mitchell
parent d0715a9f07
commit 0a8a1e9d40
1 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
core/java/android/content/res/AssetManager.java
View File

@@ -1050,8 +1050,11 @@ public final class AssetManager implements AutoCloseable {
} }
} }
synchronized (this) {
if (mObject != 0) { if (mObject != 0) {
nativeDestroy(mObject); nativeDestroy(mObject);
mObject = 0;
}
} }
} }