)]}' { "commit": "91d9b9cbd5a618bbdcc765ea6644cc23e7062984", "tree": "d680b1a74252543225d7ab8bfb0f97074ca3eaa6", "parents": [ "92b6e5a73239656b910d1575660c5f77dc1fc70e" ], "author": { "name": "Gray Mackall", "email": "34871572+gmackall@users.noreply.github.com", "time": "Mon Oct 12 21:05:17 2026 +0000" }, "committer": { "name": "GitHub", "email": "noreply@github.com", "time": "Mon Oct 12 21:05:17 2026 +0000" }, "message": "[Android] Fix use-after-free of SurfaceControl.Transaction in HCPP (#192969)\n\nFixes a native `SIGABRT` in `SurfaceComposerClient::Transaction` that we\nwere seeing with HCPP under heavy platform view churn.\n\n`createTransaction()` was adding the transaction to\n`pendingRasterTransactions` before handing it back to native, but\n`AHBSwapchainImplVK::Present()` keeps writing into it after that\n(`setBuffer`, `setOnComplete`). So the platform thread could merge or\nclose it mid-write. Separately, nothing was holding a reference to the\nJava object (`ASurfaceTransaction_fromJava` doesn\u0027t take one), so it\ncould also just get GC\u0027d out from under us.\n\nThis splits creation from publication. Native now gets an unpublished\ntransaction, holds a global ref to it while writing, and calls\n`publishTransaction` from `SurfaceTransaction::Apply()` after its last\nwrite. If publishing fails for whatever reason (`FlutterJNI` is gone,\nJava throws), we apply the transaction natively instead of dropping it,\nso the completion callback still fires and we don\u0027t leak the buffer. I\ndon\u0027t think those paths are reachable today, but they\u0027re easy to just\nhandle.\n\nOn a stress test that cycles ~2,900 `SurfaceView`s per run on a low-core\nemulator, this went from 24 aborts in 100 runs to 0 in 75.\n\nIt\u0027s a little awkward that the NDK only goes one direction here: there\u0027s\n`ASurfaceTransaction_fromJava`, but no `toJava`. If we could create the\ntransaction natively and hand it to Java at the end, most of this\nwouldn\u0027t be needed, might be feedback that is worth filing.\n\n---------\n\nCo-authored-by: Gray Mackall \u003cmackall@google.com\u003e", "tree_diff": [ { "type": "modify", "old_id": "0e1b0352964d4ddd08ccd7fc09de357877c11c83", "old_mode": 33188, "old_path": "engine/src/flutter/impeller/toolkit/android/surface_transaction.cc", "new_id": "4e41b9e5d81ed253d6ecf77dee1da1bc5345c5bd", "new_mode": 33188, "new_path": "engine/src/flutter/impeller/toolkit/android/surface_transaction.cc" }, { "type": "modify", "old_id": "e2b037a64207d9a07d5bbbf39a483819c6e33e57", "old_mode": 33188, "old_path": "engine/src/flutter/impeller/toolkit/android/surface_transaction.h", "new_id": "6c52b0bcfe5692502a93326ee0c97da38e722193", "new_mode": 33188, "new_path": "engine/src/flutter/impeller/toolkit/android/surface_transaction.h" }, { "type": "modify", "old_id": "5487801003e0ce7021b1672ddcd766d2fac7f0a5", "old_mode": 33188, "old_path": "engine/src/flutter/impeller/toolkit/android/toolkit_android_unittests.cc", "new_id": "07dbb3c156afc7c1a1904d3b6e82e1470be4efc1", "new_mode": 33188, "new_path": "engine/src/flutter/impeller/toolkit/android/toolkit_android_unittests.cc" }, { "type": "modify", "old_id": "05121a8052239ec2429f696afa57294461aa1563", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/BUILD.gn", "new_id": "f4d41d4d73d2854cda3528ef90411a12b3eb67f3", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/BUILD.gn" }, { "type": "modify", "old_id": "40ba8bde0b780d7146f584f874014c9052725449", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/android_shell_holder_unittests.cc", "new_id": "26cda75d72a0393a4755cfebb6ec96d44a390e5c", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/android_shell_holder_unittests.cc" }, { "type": "modify", "old_id": "b01a8466ada0d14e06ac2346e31cd9d53126aa49", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/android_surface_vk_impeller.cc", "new_id": "e24bb6e65592c512088c9fe3e2500356b7a7bd35", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/android_surface_vk_impeller.cc" }, { "type": "modify", "old_id": "7cf4d4f8f920ffdc9bfbd01e18722a7c25cb5375", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/io/flutter/embedding/engine/FlutterJNI.java", "new_id": "9eca371752dd1b67e0087b1f7ded4df7e99fc9d7", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/io/flutter/embedding/engine/FlutterJNI.java" }, { "type": "modify", "old_id": "924814eec15a8af3f2eb7f7a725a1b5e8da3f89e", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/io/flutter/plugin/platform/PlatformViewsController2.java", "new_id": "ee76d020bd49e3da8211cd82b0c88cb9a08ac61a", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/io/flutter/plugin/platform/PlatformViewsController2.java" }, { "type": "modify", "old_id": "2030aa00f9cd0988a3519b818d509f15f69cdf44", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/jni/jni_mock.h", "new_id": "d99456f265092d0b5d60d53adbd01fcb2ac7e644", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/jni/jni_mock.h" }, { "type": "modify", "old_id": "69a597802d8419886923bbb88618a62b7d707a6e", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/jni/mock_jni_env.h", "new_id": "d43c522670e72ff036fbdfc6d1cd508367e43ee6", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/jni/mock_jni_env.h" }, { "type": "modify", "old_id": "133a69ab10c94a441f9b89cc16cbe8783d180ca9", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/jni/platform_view_android_jni.h", "new_id": "d24ec89716cd75d53749e9f0f5df196ccae6593a", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/jni/platform_view_android_jni.h" }, { "type": "modify", "old_id": "ff26fcfb92423694dc04bfa7da05f532ddd2f565", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/platform_view_android_jni_impl.cc", "new_id": "eeaa908341b93465102900b90ff0c4b8cb61c6f9", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/platform_view_android_jni_impl.cc" }, { "type": "modify", "old_id": "530b6e23e06c7e896dc26dd1c3b4fdb8cb0aec0d", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/platform_view_android_jni_impl.h", "new_id": "7fbe4b48afcdf5dc2a306b8b9b088bd29c1ab09e", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/platform_view_android_jni_impl.h" }, { "type": "modify", "old_id": "1ef91ef0664e95dc386c10c2e22c687f458da262", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/platform_view_android_jni_impl_unittests.cc", "new_id": "3ba8e1360a6a1691066bd0882028e627feed1a01", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/platform_view_android_jni_impl_unittests.cc" }, { "type": "modify", "old_id": "ac06b44b6dd735fe27beb812c574e10b265af066", "old_mode": 33188, "old_path": "engine/src/flutter/shell/platform/android/test/io/flutter/plugin/platform/PlatformViewsController2Test.java", "new_id": "dcd15bc9536250185c308771a78ec83778287ed0", "new_mode": 33188, "new_path": "engine/src/flutter/shell/platform/android/test/io/flutter/plugin/platform/PlatformViewsController2Test.java" } ] }