fix(replay): Hold frame gate across emitLastScreenshot to prevent concurrent bitmap access

emitLastScreenshot runs on the main thread, so the downstream consumer queues
its bitmap read (JPEG compress) to the executor asynchronously. Without the
gate, the next capture tick's PixelCopy.request writes into the shared
screenshot while the queued read is still in flight. CAS the gate and release
it via a fence task on the single-threaded executor (FIFO guarantees it runs
after the queued read).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: romtsn

sentry-android-replay/src/main/java/io/sentry/android/replay/screenshot/PixelCopyStrategy.kt

@@ -361,8 +361,22 @@ internal class PixelCopyStrategy(
   }
 
   override fun emitLastScreenshot() {
-    if (!frameInFlight.get() && lastCaptureSuccessful() && !screenshot.isRecycled) {
-      screenshotRecorderCallback?.onScreenshotRecorded(screenshot)
+    // Take the gate: emit runs on the main thread, so the downstream consumer queues its bitmap
+    // read (JPEG compress) to the executor asynchronously instead of running it inline. Without the
+    // gate, the next capture tick's PixelCopy.request would write into the shared screenshot while
+    // that queued read is still in flight. Hold the gate and release it via a fence task — FIFO on
+    // the single-threaded executor guarantees it runs after the queued read.
+    if (!frameInFlight.compareAndSet(false, true)) {
+      return
+    }
+    if (!lastCaptureSuccessful() || screenshot.isRecycled) {
+      finishFrame()
+      return
+    }
+    screenshotRecorderCallback?.onScreenshotRecorded(screenshot)
+    val fence = ReplayRunnable("PixelCopyStrategy.emit_fence", { finishFrame() })
+    if (executor.submit(fence) == null) {
+      finishFrame()
     }
   }
 

sentry-android-replay/src/test/java/io/sentry/android/replay/screenshot/PixelCopyStrategyTest.kt

@@ -229,6 +229,59 @@ class PixelCopyStrategyTest {
     verify(fixture.callback, times(2)).onScreenshotRecorded(any<Bitmap>())
   }
 
+  @Test
+  @Config(shadows = [DeferredWindowPixelCopyShadow::class])
+  fun `emitLastScreenshot holds the frame gate until the consumer fence runs`() {
+    // emit runs on the main thread, so the downstream consumer (JPEG compress reading the shared
+    // screenshot) is queued to the executor, not run inline. emit must hold the gate across that
+    // window and release it via a fence task queued after the consumer; otherwise the next capture
+    // tick's PixelCopy.request writes into the bitmap while the queued read is still in flight.
+    // Invariant: while the fence is still queued (gate held), a capture racing in is dropped.
+    // Without the gate (old `if (!frameInFlight.get())`) that capture proceeds -> extra frame.
+    val activity = buildActivity(SimpleActivity::class.java).setup()
+    shadowOf(Looper.getMainLooper()).idle()
+    val root = activity.get().findViewById<View>(android.R.id.content)
+    val tasks = mutableListOf<Runnable>()
+    val executor = mock<ScheduledExecutorService>()
+    whenever(executor.submit(any<Runnable>())).doAnswer {
+      tasks.add(it.arguments[0] as Runnable)
+      mock<Future<*>>()
+    }
+    val strategy = fixture.getSut(executor)
+
+    // Set up a successful last capture: capture -> queued mask task -> drain releases the gate.
+    strategy.capture(root)
+    DeferredWindowPixelCopyShadow.flush()
+    shadowOf(Looper.getMainLooper()).idle()
+    tasks.removeAll {
+      it.run()
+      true
+    }
+    verify(fixture.callback, times(1)).onScreenshotRecorded(any<Bitmap>())
+
+    // Emit takes the gate, hands the bitmap to the consumer, and queues the fence (still pending).
+    strategy.emitLastScreenshot()
+    verify(fixture.callback, times(2)).onScreenshotRecorded(any<Bitmap>())
+
+    // A capture racing in before the fence drains must be dropped (gate held), so no new frame.
+    strategy.capture(root)
+    DeferredWindowPixelCopyShadow.flush()
+    shadowOf(Looper.getMainLooper()).idle()
+    verify(fixture.callback, times(2)).onScreenshotRecorded(any<Bitmap>())
+
+    // Fence drains -> gate released -> captures resume normally.
+    tasks.removeAll {
+      it.run()
+      true
+    }
+    captureStableFrame(strategy, root)
+    tasks.removeAll {
+      it.run()
+      true
+    }
+    verify(fixture.callback, times(3)).onScreenshotRecorded(any<Bitmap>())
+  }
+
   @Test
   @Config(shadows = [DeferredWindowPixelCopyShadow::class])
   fun `close defers cleanup until PixelCopy completes`() {