commit 38c55b3007da5fcc91c4aff9001dfa469b4955b0
author Emilian Peev <epeev@google.com> Mon Mar 27 16:09:39 2017 +0100
committer Emilian Peev <epeev@google.com> Mon Mar 27 18:15:44 2017 +0100
tree f797bf2f40c31624f51cda329d7a34537ea9ffd0
parent ebe52e9ff8002d85bb54dfa4440ca3ea0e257bb5

QCamera2: HAL3: Use List object to hold timeout indexes

Issue:

QCameraQueue object assumes that it hold buffer pointers
and during flush to destructor does a deep free which
is harmful when holding integer values

Fix:

Moved the timeout indexes to be held in a generic list
object instead

CRs-Fixed: 1087232
Bug: 35103768
Test: No regression during camera/camera2 CTS tests
Change-Id: I22de40d1b855bcf85226190834d6dc7129c9c065

camera/QCamera2/HAL3/QCamera3Stream.cpp

diff --git a/camera/QCamera2/HAL3/QCamera3Stream.cpp b/camera/QCamera2/HAL3/QCamera3Stream.cpp
index 9274d7e..8906e89 100644
--- a/camera/QCamera2/HAL3/QCamera3Stream.cpp
+++ b/camera/QCamera2/HAL3/QCamera3Stream.cpp
@@ -246,7 +246,6 @@
         mDataCB(NULL),
         mUserData(NULL),
         mDataQ(releaseFrameData, this),
-        mTimeoutFrameQ(NULL, this),
         mStreamInfoBuf(NULL),
         mStreamBufs(NULL),
         mBufDefs(NULL),
@@ -467,7 +466,7 @@
     int32_t rc = 0;
 
     mDataQ.init();
-    mTimeoutFrameQ.init();
+    mTimeoutFrameQ.clear();
     if (mBatchSize)
         mFreeBatchBufQ.init();
     rc = mProcTh.launch(dataProcRoutine, this);
@@ -508,19 +507,15 @@
 {
     LOGD("E\n");
     int32_t rc;
-    if (mTimeoutFrameQ.enqueue((void *)bufIdx)) {
-        rc = mProcTh.sendCmd(CAMERA_CMD_TYPE_TIMEOUT, FALSE, FALSE);
-    } else {
-        LOGD("Stream thread is not active, no ops here");
-        rc = NO_ERROR;
+    {
+        Mutex::Autolock lock(mTimeoutFrameQLock);
+        mTimeoutFrameQ.push_back(bufIdx);
     }
+    rc = mProcTh.sendCmd(CAMERA_CMD_TYPE_TIMEOUT, FALSE, FALSE);
     LOGD("X\n");
     return rc;
 }
 
-
-
-
 /*===========================================================================
  * FUNCTION   : processDataNotify
  *
@@ -621,7 +616,18 @@
         switch (cmd) {
         case CAMERA_CMD_TYPE_TIMEOUT:
             {
-                int32_t bufIdx = (int32_t)(pme->mTimeoutFrameQ.dequeue());
+                int32_t bufIdx;
+                {
+                    Mutex::Autolock lock(pme->mTimeoutFrameQLock);
+                    if (pme->mTimeoutFrameQ.size()) {
+                        auto itr = pme->mTimeoutFrameQ.begin();
+                        bufIdx = *itr;
+                        itr = pme->mTimeoutFrameQ.erase(itr);
+                    } else {
+                        LOGE("Timeout command received but Q is empty");
+                        break;
+                    }
+                }
                 pme->cancelBuffer(bufIdx);
                 break;
             }
@@ -647,7 +653,7 @@
             LOGH("Exit");
             /* flush data buf queue */
             pme->mDataQ.flush();
-            pme->mTimeoutFrameQ.flush();
+            pme->mTimeoutFrameQ.clear();
             pme->flushFreeBatchBufQ();
             running = 0;
             break;

camera/QCamera2/HAL3/QCamera3Stream.h

diff --git a/camera/QCamera2/HAL3/QCamera3Stream.h b/camera/QCamera2/HAL3/QCamera3Stream.h
index e99dc89..f4e1346 100644
--- a/camera/QCamera2/HAL3/QCamera3Stream.h
+++ b/camera/QCamera2/HAL3/QCamera3Stream.h
@@ -112,7 +112,10 @@
     void *mUserData;
 
     QCameraQueue     mDataQ;
-    QCameraQueue     mTimeoutFrameQ;
+
+    List<int32_t> mTimeoutFrameQ;
+    Mutex mTimeoutFrameQLock;
+
     QCameraCmdThread mProcTh; // thread for dataCB
 
     QCamera3HeapMemory *mStreamInfoBuf;