fixing a race condition on MsgTask::destroy()
when MsgTask::destroy() happens, msg_q_unblock() triggers
the running thread to come out from blocking state. A race
condition may happen such that that thread may complete
first, causing msgTask obj to be already deleted. A next
allocation may change the value at MsgTask::mThread. Then
when control comes back to destroy(), it may try to check
mThread and call delete on it to crash the program.
mThread is a heap obj, so it is possible to delete it after
the hosting msgTask obj is deleted. We just have to keep
its value on the stack before calling msg_q_unblock().
Change-Id: If15884815eea05fbfa523ec92aa300ed21ef897c
CR-Fixed: 1091530
3 files changed
