From 6dc9b53abebd02ca2bf6e2deb59a90c8520a30ef Mon Sep 17 00:00:00 2001
From: Yin-Chia Yeh <yinchiayeh@google.com>
Date: Thu, 9 Feb 2017 18:43:35 -0800
Subject: [PATCH] Camera: fix open_legacy crash

If the torch callback is fired during CameraProvider
constructor, the sp will cause it being deleted
when the callback returns.

Test: fix the crash
Bug: 35216523
Change-Id: I133d866ed603d6c7e549b57d20a911af7a7e0698
---
 camera/provider/2.4/default/CameraProvider.cpp | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/camera/provider/2.4/default/CameraProvider.cpp b/camera/provider/2.4/default/CameraProvider.cpp
index f1a66a815f..a5a02b462f 100644
--- a/camera/provider/2.4/default/CameraProvider.cpp
+++ b/camera/provider/2.4/default/CameraProvider.cpp
@@ -51,8 +51,7 @@ void CameraProvider::sCameraDeviceStatusChange(
         const struct camera_module_callbacks* callbacks,
         int camera_id,
         int new_status) {
-    ALOGI("%s++", __FUNCTION__);
-    sp<CameraProvider> cp = const_cast<CameraProvider*>(
+    CameraProvider* cp = const_cast<CameraProvider*>(
             static_cast<const CameraProvider*>(callbacks));
 
     if (cp == nullptr) {
@@ -60,7 +59,7 @@ void CameraProvider::sCameraDeviceStatusChange(
         return;
     }
 
-    ALOGI("%s resolved provider %p", __FUNCTION__, cp.get());
+    ALOGI("%s resolved provider %p", __FUNCTION__, cp);
 
     Mutex::Autolock _l(cp->mCbLock);
     char cameraId[kMaxCameraIdLen];
@@ -76,15 +75,13 @@ void CameraProvider::sCameraDeviceStatusChange(
             }
         }
     }
-    ALOGI("%s--", __FUNCTION__);
 }
 
 void CameraProvider::sTorchModeStatusChange(
         const struct camera_module_callbacks* callbacks,
         const char* camera_id,
         int new_status) {
-    ALOGI("%s++", __FUNCTION__);
-    sp<CameraProvider> cp = const_cast<CameraProvider*>(
+    CameraProvider* cp = const_cast<CameraProvider*>(
             static_cast<const CameraProvider*>(callbacks));
 
     if (cp == nullptr) {
@@ -92,7 +89,7 @@ void CameraProvider::sTorchModeStatusChange(
         return;
     }
 
-    ALOGI("%s resolved provider %p", __FUNCTION__, cp.get());
+    ALOGI("%s resolved provider %p", __FUNCTION__, cp);
 
     Mutex::Autolock _l(cp->mCbLock);
     if (cp->mCallbacks != nullptr) {
@@ -105,7 +102,6 @@ void CameraProvider::sTorchModeStatusChange(
             }
         }
     }
-    ALOGI("%s--", __FUNCTION__);
 }
 
 Status CameraProvider::getHidlStatus(int status) {