commit d3f301ccb9431a70c0489e9954e45add600919be
author Mikhail Naganov <mnaganov@google.com> Mon Mar 11 08:58:03 2019 -0700
committer Mikhail Naganov <mnaganov@google.com> Mon Mar 11 08:58:03 2019 -0700
tree 0a25a32ea71bf729d572d7d5d6e4339248b3e2ec
parent 0428b8e5a53c3c37e0f76decc7a8f32854488062

audioflinger: Fix crash on patch creation attempt

The code for clearing software patch connections was missing
a check for a null track pointer.

Bug: 126789266
Bug: 128269566
Test: see repro steps in b/128269566
Change-Id: Ice6887622d5fa2fa3198ce15146bff3cb05f7451

services/audioflinger/PatchPanel.cpp

diff --git a/services/audioflinger/PatchPanel.cpp b/services/audioflinger/PatchPanel.cpp
index 13243b8..a210a6d 100644
--- a/services/audioflinger/PatchPanel.cpp
+++ b/services/audioflinger/PatchPanel.cpp
@@ -543,7 +543,7 @@
             __func__, mRecord.handle(), mPlayback.handle());
     mRecord.stopTrack();
     mPlayback.stopTrack();
-    mRecord.track()->clearPeerProxy(); // mRecord stop is synchronous. Break PeerProxy sp<> cycle.
+    mRecord.clearTrackPeer(); // mRecord stop is synchronous. Break PeerProxy sp<> cycle.
     mRecord.closeConnections(panel);
     mPlayback.closeConnections(panel);
 }

services/audioflinger/PatchPanel.h

diff --git a/services/audioflinger/PatchPanel.h b/services/audioflinger/PatchPanel.h
index aba2cc2..181e27c 100644
--- a/services/audioflinger/PatchPanel.h
+++ b/services/audioflinger/PatchPanel.h
@@ -128,6 +128,7 @@
             mThread->addPatchTrack(mTrack);
             mTrack->setPeerProxy(peer, true /* holdReference */);
         }
+        void clearTrackPeer() { if (mTrack) mTrack->clearPeerProxy(); }
         void stopTrack() { if (mTrack) mTrack->stop(); }
 
         void swap(Endpoint &other) noexcept {