Fix setPositionListener race condition

Fixes: 131625115
Test: atest android.view.cts.SystemGestureExclusionRectsTest android.view.cts.SurfaceViewSyncTest android.uirendering.cts.testclasses.SurfaceViewTests

Change-Id: Ia357ff6fa5d5fe1e152abc23bbd6d8051cfd7aa7
diff --git a/libs/hwui/RenderNode.cpp b/libs/hwui/RenderNode.cpp
index e0ed3e4..b73347b 100644
--- a/libs/hwui/RenderNode.cpp
+++ b/libs/hwui/RenderNode.cpp
@@ -264,6 +264,12 @@
 }
 
 void RenderNode::pushStagingPropertiesChanges(TreeInfo& info) {
+    if (mPositionListenerDirty) {
+        mPositionListener = std::move(mStagingPositionListener);
+        mStagingPositionListener = nullptr;
+        mPositionListenerDirty = false;
+    }
+
     // Push the animators first so that setupStartValueIfNecessary() is called
     // before properties() is trampled by stagingProperties(), as they are
     // required by some animators.
diff --git a/libs/hwui/RenderNode.h b/libs/hwui/RenderNode.h
index 23e7a0e..c6db7f1 100644
--- a/libs/hwui/RenderNode.h
+++ b/libs/hwui/RenderNode.h
@@ -188,11 +188,9 @@
         virtual void onPositionLost(RenderNode& node, const TreeInfo* info) = 0;
     };
 
-    // Note this is not thread safe, this needs to be called
-    // before the RenderNode is used for drawing.
-    // RenderNode takes ownership of the pointer
     ANDROID_API void setPositionListener(PositionListener* listener) {
-        mPositionListener = listener;
+        mStagingPositionListener = listener;
+        mPositionListenerDirty = true;
     }
 
     // This is only modified in MODE_FULL, so it can be safely accessed
@@ -275,6 +273,8 @@
     // mDisplayList, not mStagingDisplayList.
     uint32_t mParentCount;
 
+    bool mPositionListenerDirty = false;
+    sp<PositionListener> mStagingPositionListener;
     sp<PositionListener> mPositionListener;
 
     UsageHint mUsageHint = UsageHint::Unknown;