From f8819552bbc46fd73bc0605ce1fb1b120bac2fa0 Mon Sep 17 00:00:00 2001
From: Mikhail Naganov <mnaganov@google.com>
Date: Sat, 11 Jul 2020 01:11:37 +0000
Subject: [PATCH] Fix arguments capture in SoundEffectsHelper

The handler created for an async call must capture arguments of
the Message by value instead of capturing the instance of
Message by reference. Since Message objects are pooled for
efficiency, a possibility exists that the instance of Message is
reused later.

Bug: 160315111
Bug: 160965418
Test: atest android.media.cts.AudioManagerTest
Change-Id: I2c81b8fa9ae6653da2e6812668395d8fcd6bc6e9
---
 .../core/java/com/android/server/audio/SoundEffectsHelper.java | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/services/core/java/com/android/server/audio/SoundEffectsHelper.java b/services/core/java/com/android/server/audio/SoundEffectsHelper.java
index 84d2ff85a914c..27d57674e0f18 100644
--- a/services/core/java/com/android/server/audio/SoundEffectsHelper.java
+++ b/services/core/java/com/android/server/audio/SoundEffectsHelper.java
@@ -441,11 +441,12 @@ class SoundEffectsHelper {
                     onUnloadSoundEffects();
                     break;
                 case MSG_PLAY_EFFECT:
+                    final int effect = msg.arg1, volume = msg.arg2;
                     onLoadSoundEffects(new OnEffectsLoadCompleteHandler() {
                         @Override
                         public void run(boolean success) {
                             if (success) {
-                                onPlaySoundEffect(msg.arg1 /*effect*/, msg.arg2 /*volume*/);
+                                onPlaySoundEffect(effect, volume);
                             }
                         }
                     });