commit 12dbbaa3051839915b73bee1600bca4d90c317d0
author George Burgess IV <gbiv@google.com> Tue Aug 22 17:16:09 2017 -0700
committer George Burgess IV <gbiv@google.com> Tue Sep 05 16:06:34 2017 -0700
tree 7f46ef079b5d27d7e7fcfd623408bc512dec60fe
parent b8629f45c928d9dffe1ba7f2b7845895f26931d1

Fix static analyzer complaint about use-after-free.

The analyzer can't prove that that `mRSC` must point to the `rsc`
parameter passed into zeroAllUserRef in ObjectBase::remove(), so it
thinks that we're picking the freshly-deleted pointer back up.

Bug: 27101951
Test: mma. Use-after-free warning is gone.
Change-Id: I89ee079a0b684ca742905a02101037b15928a8f8

rsObjectBase.cpp

diff --git a/rsObjectBase.cpp b/rsObjectBase.cpp
index 70158e6..714cf80 100644
--- a/rsObjectBase.cpp
+++ b/rsObjectBase.cpp
@@ -236,6 +236,13 @@
     while (o) {
         //ALOGE("o %p", o);
         if (o->zeroUserRef()) {
+#ifdef __clang_analyzer__
+            // Assure the static analyzer that we updated mObjHead. Otherwise,
+            // it complains about a use-after-free here. Needed for b/27101951.
+            if (o == rsc->mObjHead) {
+                abort();
+            }
+#endif
             // deleted the object and possibly others, restart from head.
             o = rsc->mObjHead;
             //ALOGE("o head %p", o);