commit b7cd675e76ea4e4ed62832dfcdf69e3fd93b0bca
author James Dong <jdong@google.com> Mon Feb 22 09:44:05 2010 -0800
committer James Dong <jdong@google.com> Mon Feb 22 09:49:30 2010 -0800
tree 74e11ea39a202852aca6a3f5c54f4ebddf0e512d
parent f6246226b35c35dd8d60997ab480babf12c2f91e

Fix a media server crash due to a race condition in the Camera MIO

The problem was that the pmemInfo can be changed from both the OpenCore omx proxy thread and the callback thread, and thus needs to be protected.

bug - 2374541

android/author/android_camera_input.cpp

diff --git a/android/author/android_camera_input.cpp b/android/author/android_camera_input.cpp
index c442452..379b708 100644
--- a/android/author/android_camera_input.cpp
+++ b/android/author/android_camera_input.cpp
@@ -92,6 +92,11 @@
 #endif
         mCamera->releaseRecordingFrame(data.iFrameBuffer);
     }
+    if(pPmemInfo)
+    {
+        delete pPmemInfo;
+        pPmemInfo = NULL;
+    }
     iFrameQueueMutex.Unlock();
 }
 
@@ -117,11 +122,6 @@
     }
     iFrameQueueMutex.Close();
     mListener.clear();
-    if(pPmemInfo)
-    {
-        delete pPmemInfo;
-        pPmemInfo = NULL;
-    }
 }
 
 PVMFStatus AndroidCameraInput::connect(PvmiMIOSession& aSession,
@@ -733,6 +733,9 @@
 
     // dequeue frame buffers and write to peer
     if (NULL != iPeer) {
+        if (iState != STATE_STARTED) {
+            ReleaseQueuedFrames();
+        }
         iFrameQueueMutex.Lock();
         while (!iFrameQueue.empty()) {
             AndroidCameraInputMediaData data = iFrameQueue[0];
@@ -1028,14 +1031,9 @@
     iDataEventCounter = 0;
     iWriteState = EWriteOK;
     if (mCamera != NULL) {
-    mCamera->setListener(NULL);
-    mCamera->stopRecording();
-    ReleaseQueuedFrames();
-    if(pPmemInfo)
-    {
-        delete pPmemInfo;
-        pPmemInfo = NULL;
-    }
+        mCamera->setListener(NULL);
+        mCamera->stopRecording();
+        ReleaseQueuedFrames();
     }
     iState = STATE_STOPPED;
     return PVMFSuccess;
@@ -1217,7 +1215,11 @@
     data.iXferHeader.flags = 0;
     data.iXferHeader.duration = 0;
     data.iXferHeader.stream_id = 0;
+    data.iFrameSize = size;
+    data.iFrameBuffer = frame;
 
+    // lock muteddx and queue frame buffer
+    iFrameQueueMutex.Lock();
     {//compose private data
         //could size be zero?
         if(NULL == pPmemInfo)
@@ -1228,6 +1230,7 @@
             if(NULL == pPmemInfo)
             {
                 LOGE("Failed to allocate the camera pmem info buffer array. iCalculateNoOfCameraPreviewBuffer %d",iCalculateNoOfCameraPreviewBuffer);
+                iFrameQueueMutex.Unlock();
                 return PVMFFailure;
             }
         }
@@ -1239,16 +1242,11 @@
         LOGV("struct size %d, pmem_info - %x, &pmem_info[iIndex] - %x, iIndex =%d, pmem_info.pmem_fd = %d, pmem_info.offset = %d", sizeof(CAMERA_PMEM_INFO), pPmemInfo, &pPmemInfo[iIndex], iIndex, pPmemInfo[iIndex].pmem_fd, pPmemInfo[iIndex].offset );
     }
 
-    data.iFrameBuffer = frame;
-    data.iFrameSize = size;
-
-    // lock mutex and queue frame buffer
-    iFrameQueueMutex.Lock();
     iFrameQueue.push_back(data);
     iFrameQueueMutex.Unlock();
     RunIfNotReady();
 
-    return PVMFSuccess; 
+    return PVMFSuccess;
 }
 
 // camera callback interface