audioflinger: do not use raw pointer for tracks

Commit 9da3d95 surfaced a problem caused by the use of a raw
pointer to a track in offload thread implementation.

Pointers to tracks should always be weak or strong pointers.

Bug: 11708529.
Change-Id: Ic48632532d186c9be8261f73cefdf824b9fbbd2b
diff --git a/services/audioflinger/Threads.cpp b/services/audioflinger/Threads.cpp
index de408a0..bf85b51 100644
--- a/services/audioflinger/Threads.cpp
+++ b/services/audioflinger/Threads.cpp
@@ -3936,8 +3936,7 @@
     :   DirectOutputThread(audioFlinger, output, id, device, OFFLOAD),
         mHwPaused(false),
         mFlushPending(false),
-        mPausedBytesRemaining(0),
-        mPreviousTrack(NULL)
+        mPausedBytesRemaining(0)
 {
     //FIXME: mStandby should be set to true by ThreadBase constructor
     mStandby = true;
@@ -4031,8 +4030,9 @@
             }
 
             if (last) {
-                if (mPreviousTrack != NULL) {
-                    if (track != mPreviousTrack) {
+                sp<Track> previousTrack = mPreviousTrack.promote();
+                if (previousTrack != 0) {
+                    if (track != previousTrack.get()) {
                         // Flush any data still being written from last track
                         mBytesRemaining = 0;
                         if (mPausedBytesRemaining) {
@@ -4043,13 +4043,13 @@
                             // Invalidate is a bit drastic - would be more efficient
                             // to have a flag to tell client that some of the
                             // previously written data was lost
-                            mPreviousTrack->invalidate();
+                            previousTrack->invalidate();
                         }
                         // flush data already sent to the DSP if changing audio session as audio
                         // comes from a different source. Also invalidate previous track to force a
                         // seek when resuming.
-                        if (mPreviousTrack->sessionId() != track->sessionId()) {
-                            mPreviousTrack->invalidate();
+                        if (previousTrack->sessionId() != track->sessionId()) {
+                            previousTrack->invalidate();
                             mFlushPending = true;
                         }
                     }
diff --git a/services/audioflinger/Threads.h b/services/audioflinger/Threads.h
index a0b53cb..207f1eb 100644
--- a/services/audioflinger/Threads.h
+++ b/services/audioflinger/Threads.h
@@ -762,7 +762,7 @@
     bool        mFlushPending;
     size_t      mPausedWriteLength;     // length in bytes of write interrupted by pause
     size_t      mPausedBytesRemaining;  // bytes still waiting in mixbuffer after resume
-    Track       *mPreviousTrack;         // used to detect track switch
+    wp<Track>   mPreviousTrack;         // used to detect track switch
 };
 
 class AsyncCallbackThread : public Thread {