From 76ec382218da25fb87cab979f676d2b2cda96ee2 Mon Sep 17 00:00:00 2001
From: Steven Moreland <smoreland@google.com>
Date: Fri, 2 Apr 2021 16:26:03 +0000
Subject: [PATCH] libhwui: RenderThread: fix UAF

Thread::run uses RefBase semantics and may delete the RenderThread out
from under the client.

Bug: 184196278
Test: no longer crashes when enhanced sp<> checks are enabled
Change-Id: I9dc306c14339b7142bae5f801970600d75221eb6
---
 libs/hwui/renderthread/RenderThread.cpp | 10 +++++-----
 libs/hwui/renderthread/RenderThread.h   |  1 +
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/libs/hwui/renderthread/RenderThread.cpp b/libs/hwui/renderthread/RenderThread.cpp
index adf4aee8b931f..79b938841bc29 100644
--- a/libs/hwui/renderthread/RenderThread.cpp
+++ b/libs/hwui/renderthread/RenderThread.cpp
@@ -153,10 +153,11 @@ JVMAttachHook RenderThread::getOnStartHook() {
 }
 
 RenderThread& RenderThread::getInstance() {
-    // This is a pointer because otherwise __cxa_finalize
-    // will try to delete it like a Good Citizen but that causes us to crash
-    // because we don't want to delete the RenderThread normally.
-    static RenderThread* sInstance = new RenderThread();
+    [[clang::no_destroy]] static sp<RenderThread> sInstance = []() {
+        sp<RenderThread> thread = sp<RenderThread>::make();
+        thread->start("RenderThread");
+        return thread;
+    }();
     gHasRenderThreadInstance = true;
     return *sInstance;
 }
@@ -171,7 +172,6 @@ RenderThread::RenderThread()
         , mFunctorManager(WebViewFunctorManager::instance())
         , mGlobalProfileData(mJankDataMutex) {
     Properties::load();
-    start("RenderThread");
 }
 
 RenderThread::~RenderThread() {
diff --git a/libs/hwui/renderthread/RenderThread.h b/libs/hwui/renderthread/RenderThread.h
index a7d1ba8dafd77..9e5bce76e228f 100644
--- a/libs/hwui/renderthread/RenderThread.h
+++ b/libs/hwui/renderthread/RenderThread.h
@@ -171,6 +171,7 @@ private:
     friend class android::uirenderer::WebViewFunctor;
     friend class android::uirenderer::skiapipeline::VkFunctorDrawHandler;
     friend class android::uirenderer::VectorDrawable::Tree;
+    friend class sp<RenderThread>;
 
     RenderThread();
     virtual ~RenderThread();