From fcfa734add63933d5799fa76b23353749b776d13 Mon Sep 17 00:00:00 2001
From: Mikhail Naganov <mnaganov@google.com>
Date: Thu, 12 Mar 2020 17:55:29 -0700
Subject: [PATCH] Visualizer: Fix race condition in setCaptureCallBack

Visualizer:setCaptureCallBack needs to make a local
copy of the CaptureThread pointer before temporarily
releasing mCaptureLock. Otherwise, mCaptureThread
can be released in the meantime from Visualizer::release

Bug: 149375271
Test: use EffectsTest app with "Multithreaded Use"
      for the Visualizer test. Repeat releasing the effect
      while capture via callback is active.
Change-Id: Iaea62a0e2f7e7a996c1554b9ed89efb67fbdfc11
Merged-In: Iaea62a0e2f7e7a996c1554b9ed89efb67fbdfc11
---
 media/jni/audioeffect/Visualizer.cpp | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/media/jni/audioeffect/Visualizer.cpp b/media/jni/audioeffect/Visualizer.cpp
index 83f3b6ed6217d..efeb3352d393f 100644
--- a/media/jni/audioeffect/Visualizer.cpp
+++ b/media/jni/audioeffect/Visualizer.cpp
@@ -120,8 +120,9 @@ status_t Visualizer::setCaptureCallBack(capture_cbk_t cbk, void* user, uint32_t
     }
 
     if (mCaptureThread != 0) {
+        sp<CaptureThread> t = mCaptureThread;
         mCaptureLock.unlock();
-        mCaptureThread->requestExitAndWait();
+        t->requestExitAndWait();
         mCaptureLock.lock();
     }