Merge changes I4ef7c6f2,Ia8201e8a

* changes:
  Fix sanitizer in AudioFlinger threadLoop.
  Fix audioflinger in integer sanitized builds.
diff --git a/drm/mediacas/plugins/clearkey/ClearKeySessionLibrary.cpp b/drm/mediacas/plugins/clearkey/ClearKeySessionLibrary.cpp
index faea008..4b4051d 100644
--- a/drm/mediacas/plugins/clearkey/ClearKeySessionLibrary.cpp
+++ b/drm/mediacas/plugins/clearkey/ClearKeySessionLibrary.cpp
@@ -95,7 +95,7 @@
 void ClearKeySessionLibrary::destroyPlugin(CasPlugin *plugin) {
     Mutex::Autolock lock(mSessionsLock);
 
-    for (ssize_t index = mIDToSessionMap.size() - 1; index >= 0; index--) {
+    for (ssize_t index = (ssize_t)mIDToSessionMap.size() - 1; index >= 0; index--) {
         sp<ClearKeyCasSession> session = mIDToSessionMap.valueAt(index);
         if (session->getPlugin() == plugin) {
             mIDToSessionMap.removeItemsAt(index);
diff --git a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
index aae80b6..94d4516 100644
--- a/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
+++ b/media/libeffects/lvm/wrapper/Bundle/EffectBundle.cpp
@@ -198,7 +198,7 @@
                             int32_t             ioId __unused,
                             effect_handle_t  *pHandle){
     int ret = 0;
-    int sessionNo;
+    int sessionNo = -1;
     int i;
     EffectContext *pContext = NULL;
     bool newBundle = false;
@@ -218,22 +218,27 @@
         LvmGlobalBundle_init();
     }
 
-    // Find next available sessionNo
+    // Find sessionNo: if one already exists for the sessionId use it,
+    // otherwise choose the first available empty slot.
     for(i=0; i<LVM_MAX_SESSIONS; i++){
-        if((SessionIndex[i] == LVM_UNUSED_SESSION)||(SessionIndex[i] == sessionId)){
-            sessionNo       = i;
-            SessionIndex[i] = sessionId;
-            ALOGV("\tEffectCreate: Allocating SessionNo %d for SessionId %d\n", sessionNo,sessionId);
+        if (SessionIndex[i] == sessionId) {
+            sessionNo = i;
             break;
         }
+        if (sessionNo < 0 && SessionIndex[i] == LVM_UNUSED_SESSION) {
+            sessionNo = i;
+            // do not break; allow loop to continue to search for a sessionId match.
+        }
     }
-
-    if(i==LVM_MAX_SESSIONS){
+    if (sessionNo < 0) {
         ALOGV("\tLVM_ERROR : Cannot find memory to allocate for current session");
         ret = -EINVAL;
         goto exit;
     }
 
+    SessionIndex[sessionNo] = sessionId;
+    ALOGV("\tEffectCreate: Allocating sessionNo %d for sessionId %d\n", sessionNo, sessionId);
+
     pContext = new EffectContext;
 
     // If this is the first create in this session
diff --git a/media/libeffects/visualizer/EffectVisualizer.cpp b/media/libeffects/visualizer/EffectVisualizer.cpp
index 0e82339..c33f9f5 100644
--- a/media/libeffects/visualizer/EffectVisualizer.cpp
+++ b/media/libeffects/visualizer/EffectVisualizer.cpp
@@ -594,7 +594,7 @@
                     deltaSmpl = CAPTURE_BUF_SIZE;
                 }
 
-                int32_t capturePoint = pContext->mCaptureIdx - deltaSmpl;
+                int32_t capturePoint = (int32_t)pContext->mCaptureIdx - deltaSmpl;
                 // a negative capturePoint means we wrap the buffer.
                 if (capturePoint < 0) {
                     uint32_t size = -capturePoint;
diff --git a/media/libstagefright/MPEG4Extractor.cpp b/media/libstagefright/MPEG4Extractor.cpp
index 104b324..a8b6614 100644
--- a/media/libstagefright/MPEG4Extractor.cpp
+++ b/media/libstagefright/MPEG4Extractor.cpp
@@ -441,65 +441,81 @@
         return NULL;
     }
 
-    int64_t duration;
-    int32_t samplerate;
-    if (track->has_elst && mHeaderTimescale != 0 &&
-            track->meta->findInt64(kKeyDuration, &duration) &&
-            track->meta->findInt32(kKeySampleRate, &samplerate)) {
+    [=] {
+        int64_t duration;
+        int32_t samplerate;
+        if (track->has_elst && mHeaderTimescale != 0 &&
+                track->meta->findInt64(kKeyDuration, &duration) &&
+                track->meta->findInt32(kKeySampleRate, &samplerate)) {
 
-        track->has_elst = false;
+            track->has_elst = false;
 
-        if (track->elst_segment_duration > INT64_MAX) {
-            goto editlistoverflow;
+            if (track->elst_segment_duration > INT64_MAX) {
+                return;
+            }
+            int64_t segment_duration = track->elst_segment_duration;
+            int64_t media_time = track->elst_media_time;
+            int64_t halfscale = mHeaderTimescale / 2;
+            ALOGV("segment_duration = %" PRId64 ", media_time = %" PRId64
+                  ", halfscale = %" PRId64 ", timescale = %d",
+                  segment_duration,
+                  media_time,
+                  halfscale,
+                  mHeaderTimescale);
+
+            int64_t delay;
+            // delay = ((media_time * samplerate) + halfscale) / mHeaderTimescale;
+            if (__builtin_mul_overflow(media_time, samplerate, &delay) ||
+                    __builtin_add_overflow(delay, halfscale, &delay) ||
+                    (delay /= mHeaderTimescale, false) ||
+                    delay > INT32_MAX ||
+                    delay < INT32_MIN) {
+                return;
+            }
+            ALOGV("delay = %" PRId64, delay);
+            track->meta->setInt32(kKeyEncoderDelay, delay);
+
+            int64_t scaled_duration;
+            // scaled_duration = duration * mHeaderTimescale;
+            if (__builtin_mul_overflow(duration, mHeaderTimescale, &scaled_duration)) {
+                return;
+            }
+            ALOGV("scaled_duration = %" PRId64, scaled_duration);
+
+            int64_t segment_end;
+            int64_t padding;
+            // padding = scaled_duration - ((segment_duration + media_time) * 1000000);
+            if (__builtin_add_overflow(segment_duration, media_time, &segment_end) ||
+                    __builtin_mul_overflow(segment_end, 1000000, &segment_end) ||
+                    __builtin_sub_overflow(scaled_duration, segment_end, &padding)) {
+                return;
+            }
+            ALOGV("segment_end = %" PRId64 ", padding = %" PRId64, segment_end, padding);
+
+            if (padding < 0) {
+                // track duration from media header (which is what kKeyDuration is) might
+                // be slightly shorter than the segment duration, which would make the
+                // padding negative. Clamp to zero.
+                padding = 0;
+            }
+
+            int64_t paddingsamples;
+            int64_t halfscale_e6;
+            int64_t timescale_e6;
+            // paddingsamples = ((padding * samplerate) + (halfscale * 1000000))
+            //                / (mHeaderTimescale * 1000000);
+            if (__builtin_mul_overflow(padding, samplerate, &paddingsamples) ||
+                    __builtin_mul_overflow(halfscale, 1000000, &halfscale_e6) ||
+                    __builtin_mul_overflow(mHeaderTimescale, 1000000, &timescale_e6) ||
+                    __builtin_add_overflow(paddingsamples, halfscale_e6, &paddingsamples) ||
+                    (paddingsamples /= timescale_e6, false) ||
+                    paddingsamples > INT32_MAX) {
+                return;
+            }
+            ALOGV("paddingsamples = %" PRId64, paddingsamples);
+            track->meta->setInt32(kKeyEncoderPadding, paddingsamples);
         }
-        int64_t segment_duration = track->elst_segment_duration;
-        int64_t media_time = track->elst_media_time;
-        int64_t halfscale = mHeaderTimescale / 2;
-
-        int64_t delay;
-        // delay = ((media_time * samplerate) + halfscale) / mHeaderTimescale;
-        if (__builtin_mul_overflow(media_time, samplerate, &delay) ||
-                __builtin_add_overflow(delay, halfscale, &delay) ||
-                (delay /= mHeaderTimescale, false) ||
-                delay > INT32_MAX ||
-                delay < INT32_MIN) {
-            goto editlistoverflow;
-        }
-        track->meta->setInt32(kKeyEncoderDelay, delay);
-
-        int64_t scaled_duration;
-        // scaled_duration = ((duration * mHeaderTimescale) + 500000) / 1000000;
-        if (__builtin_mul_overflow(duration, mHeaderTimescale, &scaled_duration) ||
-                __builtin_add_overflow(scaled_duration, 500000, &scaled_duration)) {
-            goto editlistoverflow;
-        }
-        scaled_duration /= 1000000;
-
-        int64_t segment_end;
-        int64_t padding;
-        if (__builtin_add_overflow(segment_duration, media_time, &segment_end) ||
-                __builtin_sub_overflow(scaled_duration, segment_end, &padding)) {
-            goto editlistoverflow;
-        }
-
-        if (padding < 0) {
-            // track duration from media header (which is what kKeyDuration is) might
-            // be slightly shorter than the segment duration, which would make the
-            // padding negative. Clamp to zero.
-            padding = 0;
-        }
-
-        int64_t paddingsamples;
-        // paddingsamples = ((padding * samplerate) + halfscale) / mHeaderTimescale;
-        if (__builtin_mul_overflow(padding, samplerate, &paddingsamples) ||
-                __builtin_add_overflow(paddingsamples, halfscale, &paddingsamples) ||
-                (paddingsamples /= mHeaderTimescale, false) ||
-                paddingsamples > INT32_MAX) {
-            goto editlistoverflow;
-        }
-        track->meta->setInt32(kKeyEncoderPadding, paddingsamples);
-    }
-    editlistoverflow:
+    }();
 
     if ((flags & kIncludeExtensiveMetaData)
             && !track->includes_expensive_metadata) {
diff --git a/services/audioflinger/FastMixerDumpState.cpp b/services/audioflinger/FastMixerDumpState.cpp
index 6475f22..2e4fb8c 100644
--- a/services/audioflinger/FastMixerDumpState.cpp
+++ b/services/audioflinger/FastMixerDumpState.cpp
@@ -78,7 +78,12 @@
     uint32_t bounds = mBounds;
     uint32_t newestOpen = bounds & 0xFFFF;
     uint32_t oldestClosed = bounds >> 16;
-    uint32_t n = (newestOpen - oldestClosed) & 0xFFFF;
+
+    //uint32_t n = (newestOpen - oldestClosed) & 0xFFFF;
+    uint32_t n;
+    __builtin_sub_overflow(newestOpen, oldestClosed, &n);
+    n = n & 0xFFFF;
+
     if (n > mSamplingN) {
         ALOGE("too many samples %u", n);
         n = mSamplingN;
diff --git a/services/audioflinger/Threads.cpp b/services/audioflinger/Threads.cpp
index 5d6158c..2aa14e6 100644
--- a/services/audioflinger/Threads.cpp
+++ b/services/audioflinger/Threads.cpp
@@ -6778,7 +6778,7 @@
             recordTrack->clearSyncStartEvent();
         } else {
             // do not wait for the event for more than AudioSystem::kSyncRecordStartTimeOutMs
-            recordTrack->mFramesToDrop = -
+            recordTrack->mFramesToDrop = -(ssize_t)
                     ((AudioSystem::kSyncRecordStartTimeOutMs * recordTrack->mSampleRate) / 1000);
         }
     }
diff --git a/services/audioflinger/Tracks.cpp b/services/audioflinger/Tracks.cpp
index 0f25153..fe93367 100644
--- a/services/audioflinger/Tracks.cpp
+++ b/services/audioflinger/Tracks.cpp
@@ -1101,11 +1101,12 @@
 
 void AudioFlinger::PlaybackThread::Track::triggerEvents(AudioSystem::sync_event_t type)
 {
-    for (size_t i = 0; i < mSyncEvents.size(); i++) {
+    for (size_t i = 0; i < mSyncEvents.size();) {
         if (mSyncEvents[i]->type() == type) {
             mSyncEvents[i]->trigger();
             mSyncEvents.removeAt(i);
-            i--;
+        } else {
+            ++i;
         }
     }
 }
diff --git a/services/audiopolicy/service/AudioPolicyService.cpp b/services/audiopolicy/service/AudioPolicyService.cpp
index b417631..7af2e74 100644
--- a/services/audiopolicy/service/AudioPolicyService.cpp
+++ b/services/audiopolicy/service/AudioPolicyService.cpp
@@ -859,7 +859,7 @@
     }
 
     // check same pending commands with later time stamps and eliminate them
-    for (i = mAudioCommands.size()-1; i >= 0; i--) {
+    for (i = (ssize_t)mAudioCommands.size()-1; i >= 0; i--) {
         sp<AudioCommand> command2 = mAudioCommands[i];
         // commands are sorted by increasing time stamp: no need to scan the rest of mAudioCommands
         if (command2->mTime <= command->mTime) break;