From ff265e61777677ce256add37108bef5dae87a42e Mon Sep 17 00:00:00 2001
From: chaviw <chaviw@google.com>
Date: Tue, 9 Feb 2021 14:47:07 -0800
Subject: [PATCH] Remove SurfaceSession.nativeKill

SurfaceSession.nativeKill would call SurfaceComposerClient.dispose. This
was unsafe since it would only clear the ISurfaceComposerClient binder
object, but the SurfaceComposerClient object could still be around.
Instead, when calling SurfaceSession.kill, just remove the Java
reference, but allow the dtor of SurfaceComposerClient to handle
disposing the binder object.

Test: Force app to restart while in a sync transaction. No longer shows
an error
Fixes: 179459565

Change-Id: I322e7f3bd4e7efb3d85d1afe3c4704283f58a985
---
 core/java/android/view/SurfaceSession.java | 15 +++++++--------
 core/jni/android_view_SurfaceSession.cpp   |  7 -------
 2 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/core/java/android/view/SurfaceSession.java b/core/java/android/view/SurfaceSession.java
index cbc0479a4c079..20f05981e9620 100644
--- a/core/java/android/view/SurfaceSession.java
+++ b/core/java/android/view/SurfaceSession.java
@@ -32,7 +32,6 @@ public final class SurfaceSession {
 
     private static native long nativeCreate();
     private static native void nativeDestroy(long ptr);
-    private static native void nativeKill(long ptr);
 
     /** Create a new connection with the surface flinger. */
     @UnsupportedAppUsage
@@ -44,22 +43,22 @@ public final class SurfaceSession {
     @Override
     protected void finalize() throws Throwable {
         try {
-            if (mNativeClient != 0) {
-                nativeDestroy(mNativeClient);
-            }
+            kill();
         } finally {
             super.finalize();
         }
     }
 
     /**
-     * Forcibly detach native resources associated with this object.
-     * Unlike destroy(), after this call any surfaces that were created
-     * from the session will no longer work.
+     * Remove the reference to the native Session object. The native object may still exist if
+     * there are other references to it, but it cannot be accessed from this Java object anymore.
      */
     @UnsupportedAppUsage
     public void kill() {
-        nativeKill(mNativeClient);
+        if (mNativeClient != 0) {
+            nativeDestroy(mNativeClient);
+            mNativeClient = 0;
+        }
     }
 }
 
diff --git a/core/jni/android_view_SurfaceSession.cpp b/core/jni/android_view_SurfaceSession.cpp
index 191f748d80bf9..0aac07d17cdce 100644
--- a/core/jni/android_view_SurfaceSession.cpp
+++ b/core/jni/android_view_SurfaceSession.cpp
@@ -51,19 +51,12 @@ static void nativeDestroy(JNIEnv* env, jclass clazz, jlong ptr) {
     client->decStrong((void*)nativeCreate);
 }
 
-static void nativeKill(JNIEnv* env, jclass clazz, jlong ptr) {
-    SurfaceComposerClient* client = reinterpret_cast<SurfaceComposerClient*>(ptr);
-    client->dispose();
-}
-
 static const JNINativeMethod gMethods[] = {
     /* name, signature, funcPtr */
     { "nativeCreate", "()J",
             (void*)nativeCreate },
     { "nativeDestroy", "(J)V",
             (void*)nativeDestroy },
-    { "nativeKill", "(J)V",
-            (void*)nativeKill }
 };
 
 int register_android_view_SurfaceSession(JNIEnv* env) {