tag 2a276374485da37c5f2827cb7e5de70ec6e09839
tagger The Android Open Source Project <initial-contribution@android.com> Mon Apr 06 16:37:29 2020 -0700
object b7a2a333232ae9ba60797918f75d9f50a3a856f0

Android 8.1.0 Release 75 (6197208)

commit b7a2a333232ae9ba60797918f75d9f50a3a856f0
author Ryan Mitchell <rtmitchell@google.com> Wed Jan 15 11:43:47 2020 -0800
committer Anis Assi <anisassi@google.com> Thu Feb 06 15:17:36 2020 -0800
tree 2a46f84224b82b7f5ff22d074aeb7b0d7f07b256
parent 35c455959054dc61237d2fe20a5d4ace6103393d

Fix potential double destroy of AssetManager

Assume there is a XmlBlock [X] created by a AssetManager [A]
([A] will have mNumRefs = 2). After [A].close is called
(mNumRefs = 1) and then both [X] and [A] are going to be GCed,
if [A].finalize is called first (nativeDestroy), the later
[X].finalize will invoke [A].xmlBlockGone that triggers the
second nativeDestroy of [A] and leads to crash.

By clearing the mObject in AssetManager.finalize, the
decRefsLocked from other paths won't call nativeDestroy again.

Bug: 144028297
Test: atest android.security.cts.AssetManagerTest

Change-Id: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
Merged-In: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
(cherry picked from commit 93320661ca9a23c7b38b3f166d0facf048f2a8a3)