diff options
author | Ryan Mitchell <rtmitchell@google.com> | 2020-01-15 11:43:47 -0800 |
---|---|---|
committer | Ryan Mitchell <rtmitchell@google.com> | 2020-01-16 20:48:57 +0000 |
commit | 93320661ca9a23c7b38b3f166d0facf048f2a8a3 (patch) | |
tree | 4732841d2ecba8ac79e8fc2a87af92458f5d2f7c /tools/aapt2/java/JavaClassGenerator.cpp | |
parent | 5e0b06987666bdb15620184726bb332e186d85c1 (diff) |
Fix potential double destroy of AssetManager
Assume there is a XmlBlock [X] created by a AssetManager [A]
([A] will have mNumRefs = 2). After [A].close is called
(mNumRefs = 1) and then both [X] and [A] are going to be GCed,
if [A].finalize is called first (nativeDestroy), the later
[X].finalize will invoke [A].xmlBlockGone that triggers the
second nativeDestroy of [A] and leads to crash.
By clearing the mObject in AssetManager.finalize, the
decRefsLocked from other paths won't call nativeDestroy again.
Bug: 144028297
Test: atest android.security.cts.AssetManagerTest
Change-Id: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
Merged-In: Ia938502d2443f5a6de6a3cabdb7ce1d41d3ff6d1
Diffstat (limited to 'tools/aapt2/java/JavaClassGenerator.cpp')
0 files changed, 0 insertions, 0 deletions