EmuGL: refcount ColorBuffers on the host
The gralloc API assumes system-wide reference counting of gralloc buffers. The host-GL accelerated gralloc maps buffers to host-side ColorBuffer objects, but was destroying them unconditionally in gralloc_free(), ignoring any additional references from gralloc_register_buffer(). This affected the SurfaceTexture gralloc buffers used by the Browser/WebView. For some reason these buffers are actually allocated by SurfaceFlinger and passed back to the WebView through Binder. But since SurfaceFlinger doesn't actually need the buffer for anything, sometime after the WebView has called gralloc_register_buffer() SurfaceFlinger calls gralloc_free() on it. This caused the host ColorBuffer to be destroyed long before the WebView is done using it. Change-Id: I33dbee887a48a6907041cf19e9f38a1f6c983eff
This commit is contained in:
@@ -279,8 +279,8 @@ static int gralloc_free(alloc_device_t* dev,
|
||||
|
||||
if (cb->hostHandle != 0) {
|
||||
DEFINE_AND_VALIDATE_HOST_CONNECTION;
|
||||
D("Destroying host ColorBuffer 0x%x\n", cb->hostHandle);
|
||||
rcEnc->rcDestroyColorBuffer(rcEnc, cb->hostHandle);
|
||||
D("Closing host ColorBuffer 0x%x\n", cb->hostHandle);
|
||||
rcEnc->rcCloseColorBuffer(rcEnc, cb->hostHandle);
|
||||
}
|
||||
|
||||
//
|
||||
@@ -440,6 +440,12 @@ static int gralloc_register_buffer(gralloc_module_t const* module,
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (cb->hostHandle != 0) {
|
||||
DEFINE_AND_VALIDATE_HOST_CONNECTION;
|
||||
D("Opening host ColorBuffer 0x%x\n", cb->hostHandle);
|
||||
rcEnc->rcOpenColorBuffer(rcEnc, cb->hostHandle);
|
||||
}
|
||||
|
||||
//
|
||||
// if the color buffer has ashmem region and it is not mapped in this
|
||||
// process map it now.
|
||||
@@ -471,6 +477,12 @@ static int gralloc_unregister_buffer(gralloc_module_t const* module,
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (cb->hostHandle != 0) {
|
||||
DEFINE_AND_VALIDATE_HOST_CONNECTION;
|
||||
D("Closing host ColorBuffer 0x%x\n", cb->hostHandle);
|
||||
rcEnc->rcCloseColorBuffer(rcEnc, cb->hostHandle);
|
||||
}
|
||||
|
||||
//
|
||||
// unmap ashmem region if it was previously mapped in this process
|
||||
// (through register_buffer)
|
||||
|
||||
Reference in New Issue
Block a user