BQ: Fix segfault in dump()

When dequeueBuffer() is called we put the slot in mActiveBuffers, then
don't hold the BufferQueue lock while allocation occurs. So a slot
might be in mActiveBuffers but not have a buffer attached yet. Prevent
the dump function from segfaulting in this case.

Bug 27128710

Change-Id: Ie1480c0f9b2544554fc3281045e55ad30605e6ec

diff --git a/libs/gui/BufferQueueCore.cpp b/libs/gui/BufferQueueCore.cpp
index 052de3d..ba34eb6 100644 (file)
--- a/libs/gui/BufferQueueCore.cpp
+++ b/libs/gui/BufferQueueCore.cpp
@@ -130,11 +130,18 @@ void BufferQueueCore::dump(String8& result, const char* prefix) const {
 
     for (int s : mActiveBuffers) {
         const sp<GraphicBuffer>& buffer(mSlots[s].mGraphicBuffer);
-        result.appendFormat("%s%s[%02d:%p] state=%-8s, %p [%4ux%4u:%4u,%3X]\n",
-                prefix, (mSlots[s].mBufferState.isAcquired()) ? ">" : " ", s,
-                buffer.get(), mSlots[s].mBufferState.string(), buffer->handle,
-                buffer->width, buffer->height, buffer->stride, buffer->format);
-
+        // A dequeued buffer might be null if it's still being allocated
+        if (buffer.get()) {
+            result.appendFormat("%s%s[%02d:%p] state=%-8s, %p "
+                    "[%4ux%4u:%4u,%3X]\n", prefix,
+                    (mSlots[s].mBufferState.isAcquired()) ? ">" : " ", s,
+                    buffer.get(), mSlots[s].mBufferState.string(),
+                    buffer->handle, buffer->width, buffer->height,
+                    buffer->stride, buffer->format);
+        } else {
+            result.appendFormat("%s [%02d:%p] state=%-8s\n", prefix, s,
+                    buffer.get(), mSlots[s].mBufferState.string());
+        }
     }
     for (int s : mFreeBuffers) {
         const sp<GraphicBuffer>& buffer(mSlots[s].mGraphicBuffer);