Venus: destroy the device's object mutex after the objects that lock it

Bionic aborts on locking a destroyed mutex ("pthread_mutex_lock called on a destroyed mutex",
Tab S9 FE G68, Pixel 9a), so a client that exited holding objects took the render worker down.
From BattleTempest's DroidDeck-Pixel (kevinbryant551-ux/DroidDeck-Pixel, GPL-3.0).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tools/venus/ci-build.sh

@@ -79,6 +79,7 @@ git clone -q --depth 1 -b v1.4.365 https://github.com/KhronosGroup/Vulkan-Header
 git clone -q --depth 1 -b virglrenderer-1.3.0 https://gitlab.freedesktop.org/virgl/virglrenderer.git
 git -C virglrenderer apply "$REPO/tools/venus/virglrenderer-android.patch"
 git -C virglrenderer apply "$REPO/tools/venus/virglrenderer-destroy-unknown-pipeline.patch"
+git -C virglrenderer apply "$REPO/tools/venus/virglrenderer-destroy-mutex-after-objects.patch"
 cat > compat/log/log.h <<'EOC'
 #pragma once
 #include <android/log.h>

tools/venus/virglrenderer-destroy-mutex-after-objects.patch

@@ -0,0 +1,30 @@
+venus: destroy a device's object mutex after the objects that lock it
+
+From BattleTempest's DroidDeck-Pixel (kevinbryant551-ux/DroidDeck-Pixel, GPL-3.0),
+tools/venus/patches/0103-destroy-object-mutex-after-objects.patch. Bionic aborts on locking a
+destroyed mutex ("pthread_mutex_lock called on a destroyed mutex", seen on a Tab S9 FE G68
+and a Pixel 9a), so a client that exited holding objects took the render worker down.
+
+diff --git a/src/venus/vkr_device.c b/src/venus/vkr_device.c
+index 9144180..7b7c904 100644
+--- a/src/venus/vkr_device.c
++++ b/src/venus/vkr_device.c
+@@ -324,13 +324,16 @@ vkr_device_destroy(struct vkr_context *ctx, struct vkr_device *dev, bool destroy
+          vkr_log("vkDeviceWaitIdle(%p) failed(%d)", dev, (int32_t)result);
+    }
+ 
+-   mtx_destroy(&dev->object_mutex);
+-
++   /* The leftover objects are removed under object_mutex: destroy it after them. glibc lets a
++    * destroyed mutex be locked; bionic aborts ("pthread_mutex_lock called on a destroyed mutex"),
++    * so every client that exited holding objects took its render worker down. */
+    if (!list_is_empty(&dev->objects)) {
+       list_for_each_entry_safe (struct vkr_object, obj, &dev->objects, track_head)
+          vkr_device_object_destroy(ctx, dev, obj);
+    }
+ 
++   mtx_destroy(&dev->object_mutex);
++
+    list_for_each_entry_safe (struct vkr_queue, queue, &dev->queues, base.track_head)
+       vkr_queue_destroy(ctx, queue);
+