commit 550c32b7b8062d723f568a49113ce739de90f120
author Steven Moreland <smoreland@google.com> Wed Mar 11 17:48:31 2020 -0700
committer Anis Assi <anisassi@google.com> Thu Apr 09 13:47:19 2020 -0700
tree b35f1abda22d47c6396860d6d34a8b05070021c2
parent 4f1169eb0b3da347fa28483d66745a497462a2bb

sf: avoid assumption remote binder is local

We are lucky that a test was passing a remote binder here and that I
happened to reorder elements in BpBinder, since this caused a crash,
where before, 'owner' was getting set to some random bits inside of a
BpBinder object.

Bug: 150904694
Test: move mTrackingUid around in BpBinder, then
    `atest CompositionSamplingListenerTest` passes

Change-Id: I552a669113844a6b7ceaba5a1197fd04ca7e18d5
Merged-In: I552a669113844a6b7ceaba5a1197fd04ca7e18d5
(cherry picked from commit 858c55f73a760a06ac398562a9274641239e1322)
(cherry picked from commit 4271f564399e35186473ccd2d70b45bb5038c97a)

services/surfaceflinger/RegionSamplingThread.cpp

diff --git a/services/surfaceflinger/RegionSamplingThread.cpp b/services/surfaceflinger/RegionSamplingThread.cpp
index 66906e9..8e7386d 100644
--- a/services/surfaceflinger/RegionSamplingThread.cpp
+++ b/services/surfaceflinger/RegionSamplingThread.cpp
@@ -197,9 +197,10 @@
 
 void RegionSamplingThread::addListener(const Rect& samplingArea, const sp<IBinder>& stopLayerHandle,
                                        const sp<IRegionSamplingListener>& listener) {
-    wp<Layer> stopLayer = stopLayerHandle != nullptr
-            ? static_cast<Layer::Handle*>(stopLayerHandle.get())->owner
-            : nullptr;
+    wp<Layer> stopLayer;
+    if (stopLayerHandle != nullptr && stopLayerHandle->localBinder() != nullptr) {
+        stopLayer = static_cast<Layer::Handle*>(stopLayerHandle.get())->owner;
+    }
 
     sp<IBinder> asBinder = IInterface::asBinder(listener);
     asBinder->linkToDeath(this);