sf: avoid assumption remote binder is local

We are lucky that a test was passing a remote binder here and that I
happened to reorder elements in BpBinder, since this caused a crash,
where before, 'owner' was getting set to some random bits inside of a
BpBinder object.

Bug: 150904694
Test: move mTrackingUid around in BpBinder, then
    `atest CompositionSamplingListenerTest` passes

Change-Id: I552a669113844a6b7ceaba5a1197fd04ca7e18d5
Merged-In: I552a669113844a6b7ceaba5a1197fd04ca7e18d5
(cherry picked from commit 858c55f73a760a06ac398562a9274641239e1322)

1 files changed, 4 insertions, 3 deletions

diff --git a/services/surfaceflinger/RegionSamplingThread.cpp b/services/surfaceflinger/RegionSamplingThread.cpp
index 66906e950..8e7386df0 100644
--- a/services/surfaceflinger/RegionSamplingThread.cpp
+++ b/services/surfaceflinger/RegionSamplingThread.cpp
@@ -197,9 +197,10 @@ RegionSamplingThread::~RegionSamplingThread() {
 
 void RegionSamplingThread::addListener(const Rect& samplingArea, const sp<IBinder>& stopLayerHandle,
                                        const sp<IRegionSamplingListener>& listener) {
-    wp<Layer> stopLayer = stopLayerHandle != nullptr
-            ? static_cast<Layer::Handle*>(stopLayerHandle.get())->owner
-            : nullptr;
+    wp<Layer> stopLayer;
+    if (stopLayerHandle != nullptr && stopLayerHandle->localBinder() != nullptr) {
+        stopLayer = static_cast<Layer::Handle*>(stopLayerHandle.get())->owner;
+    }
 
     sp<IBinder> asBinder = IInterface::asBinder(listener);
     asBinder->linkToDeath(this);