commit a46b6d3ea608120af74ec7975427eb7f5311f720
author Ytai Ben-Tsvi <ytai@google.com> Mon Aug 31 13:29:11 2020 -0700
committer Ytai Ben-Tsvi <ytai@google.com> Mon Aug 31 13:35:04 2020 -0700
tree b106f7b2ed5a2850beea5fa0e7c69b0589489c0b
parent bc430769e79481fa2841999565742230bf314870

Fix segfault in capture state registration

Using 'this' from within the ctor of a RefBase is disallowed.

Fixes: 167242344
Test: Rerun the failed tests referenced in the bug.
Change-Id: I9737f245a2f735bdca1513beedcca93891af59b6

media/libaudioclient/AudioSystem.cpp

diff --git a/media/libaudioclient/AudioSystem.cpp b/media/libaudioclient/AudioSystem.cpp
index d918a50..2c20221 100644
--- a/media/libaudioclient/AudioSystem.cpp
+++ b/media/libaudioclient/AudioSystem.cpp
@@ -1641,16 +1641,17 @@
     CaptureStateListenerImpl(
             const sp<IAudioPolicyService>& aps,
             const sp<AudioSystem::CaptureStateListener>& listener)
-            : mAps(aps), mListener(listener) {
+            : mAps(aps), mListener(listener) {}
+
+    void init() {
         bool active;
-        status_t status = aps->registerSoundTriggerCaptureStateListener(this, &active);
+        status_t status = mAps->registerSoundTriggerCaptureStateListener(this, &active);
         if (status != NO_ERROR) {
             mListener->onServiceDied();
             return;
         }
         mListener->onStateChanged(active);
-        sp<IBinder> binder = IInterface::asBinder(aps);
-        binder->linkToDeath(this);
+        IInterface::asBinder(mAps)->linkToDeath(this);
     }
 
     binder::Status setCaptureState(bool active) override {
@@ -1683,6 +1684,7 @@
 
     Mutex::Autolock _l(gSoundTriggerCaptureStateListenerLock);
     gSoundTriggerCaptureStateListener = new CaptureStateListenerImpl(aps, listener);
+    gSoundTriggerCaptureStateListener->init();
 
     return NO_ERROR;
 }