Revert "HAL3: Fix a use-after-free bug"
This reverts commit 0ca5ca9cd3e6a29f49646e6ba62f40f993f42ce4.
Reason for revert: b/149995442 - This change needs to be taken along with ag/10458679 or it causes a regression in CTS. Creating revert to cherrypick into the release branch, no need to merge this revert since ag/10458679 is already merged in the dev branch.
Change-Id: I22c53b7abdb406f74724d7244310a8cd6d40f899
(cherry picked from commit 92ad0ebb48931f6fab9996d9bf526066458fdc38)
diff --git a/msm8998/QCamera2/HAL3/QCamera3Channel.cpp b/msm8998/QCamera2/HAL3/QCamera3Channel.cpp
index 04048ea..b60be86 100644
--- a/msm8998/QCamera2/HAL3/QCamera3Channel.cpp
+++ b/msm8998/QCamera2/HAL3/QCamera3Channel.cpp
@@ -4296,7 +4296,7 @@
int32_t QCamera3PicChannel::returnYuvBufferAndEncode(mm_camera_buf_def_t *frame,
buffer_handle_t *outBuffer, uint32_t frameNumber,
- std::shared_ptr<metadata_buffer_t> metadata, mm_camera_buf_def_t *metaFrame)
+ std::shared_ptr<metadata_buffer_t> metadata)
{
int32_t rc = OK;
@@ -4382,7 +4382,7 @@
metadataBuf->camera_handle = m_camHandle;
metadataBuf->ch_id = getMyHandle();
metadataBuf->num_bufs = 1;
- metadataBuf->bufs[0] = metaFrame;
+ metadataBuf->bufs[0] = (mm_camera_buf_def_t *)calloc(1, sizeof(mm_camera_buf_def_t));
metadataBuf->bufs[0]->buffer = metadata.get();
// Start processing the metadata
diff --git a/msm8998/QCamera2/HAL3/QCamera3Channel.h b/msm8998/QCamera2/HAL3/QCamera3Channel.h
index a441427..2ea7c2f 100644
--- a/msm8998/QCamera2/HAL3/QCamera3Channel.h
+++ b/msm8998/QCamera2/HAL3/QCamera3Channel.h
@@ -589,8 +589,7 @@
// Return a YUV buffer (from getYuvBufferForRequest) and request jpeg encoding.
int32_t returnYuvBufferAndEncode(mm_camera_buf_def_t *frame,
buffer_handle_t *outBuffer, uint32_t frameNumber,
- std::shared_ptr<metadata_buffer_t> metadata,
- mm_camera_buf_def_t *metaFrame);
+ std::shared_ptr<metadata_buffer_t> metadata);
// Return a YUV buffer (from getYuvBufferForRequest) without requesting jpeg encoding.
int32_t returnYuvBuffer(mm_camera_buf_def_t *frame);
diff --git a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
index 8a4b25c..5a7e3e0 100644
--- a/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
+++ b/msm8998/QCamera2/HAL3/QCamera3HWI.cpp
@@ -5861,6 +5861,7 @@
// Mark current timestamp for the new request
bufsForCurRequest.timestamp = systemTime(CLOCK_MONOTONIC);
bufsForCurRequest.av_timestamp = 0;
+ bufsForCurRequest.hdrplus = hdrPlusRequest;
if (hdrPlusRequest) {
// Save settings for this request.
@@ -16438,29 +16439,10 @@
}
if (channel == mPictureChannel) {
- android_errorWriteLog(0x534e4554, "150004253");
- // Keep a copy of outputBufferDef until the final JPEG buffer is
- // ready because the JPEG callback uses the mm_camera_buf_def_t
- // struct. The metaBufDef is stored in a shared_ptr to make sure
- // it's freed.
- std::shared_ptr<mm_camera_buf_def_t> metaBufDef =
- std::make_shared<mm_camera_buf_def_t>();
- {
- pthread_mutex_lock(&mMutex);
- for (auto& pendingBuffers : mPendingBuffersMap.mPendingBuffersInRequest) {
- if (pendingBuffers.frame_number == result->requestId) {
- pendingBuffers.mHdrplusInputBuf = outputBufferDef;
- pendingBuffers.mHdrplusInputMetaBuf = metaBufDef;
- break;
- }
- }
- pthread_mutex_unlock(&mMutex);
- }
-
// Return the buffer to pic channel for encoding.
mPictureChannel->returnYuvBufferAndEncode(outputBufferDef.get(),
frameworkOutputBuffer->buffer, result->requestId,
- halMetadata, metaBufDef.get());
+ halMetadata);
} else {
// Return the buffer to camera framework.
pthread_mutex_lock(&mMutex);
diff --git a/msm8998/QCamera2/HAL3/QCamera3HWI.h b/msm8998/QCamera2/HAL3/QCamera3HWI.h
index c5c59fe..1dddf3a 100644
--- a/msm8998/QCamera2/HAL3/QCamera3HWI.h
+++ b/msm8998/QCamera2/HAL3/QCamera3HWI.h
@@ -128,8 +128,7 @@
nsecs_t timestamp;
nsecs_t av_timestamp;
List<PendingBufferInfo> mPendingBufferList;
- std::shared_ptr<mm_camera_buf_def_t> mHdrplusInputBuf;
- std::shared_ptr<mm_camera_buf_def_t> mHdrplusInputMetaBuf;
+ bool hdrplus;
} PendingBuffersInRequest;
class PendingBuffersMap {
