Fix leakage of ASurfaceTransactionCallback

The callback needs to set to null when thread renderer is destroyed.

Bug: 187419942
Bug: 186869429
Test: blaze test --test_strategy=local --test_arg=--device_broker_type=LOCAL_ADB_SERVER //javatests/com/google/android/testing/elizabot/internal/sanity/subscriptionleak:SubscriptionLeakTest_generic_phone_google_31_x86
Change-Id: Ic80c58f102ee5f21830542030021828f6231cc37

core/java/android/view/ViewRootImpl.java

@@ -1355,6 +1355,11 @@ public final class ViewRootImpl implements ViewParent,
         }
     }
 
+    /**
+     * Register a callback to be executed when Webview overlay needs to merge a transaction.
+     * This callback will be executed on RenderThread worker thread, and released inside native code
+     * when CanvasContext is destroyed.
+     */
     private void addASurfaceTransactionCallback() {
         HardwareRenderer.ASurfaceTransactionCallback callback = (nativeTransactionObj,
                                                                  nativeSurfaceControlObj,
@@ -7707,6 +7712,7 @@ public final class ViewRootImpl implements ViewParent,
                 }
             }
             if (mAttachInfo.mThreadedRenderer != null) {
+                addASurfaceTransactionCallback();
                 mAttachInfo.mThreadedRenderer.setSurfaceControl(mSurfaceControl);
             }
         } else {

libs/hwui/renderthread/CanvasContext.cpp

@@ -195,6 +195,10 @@ void CanvasContext::setSurfaceControl(ASurfaceControl* surfaceControl) {
 
     auto funcs = mRenderThread.getASurfaceControlFunctions();
 
+    if (surfaceControl == nullptr) {
+        setASurfaceTransactionCallback(nullptr);
+    }
+
     if (mSurfaceControl != nullptr) {
         funcs.unregisterListenerFunc(this, &onSurfaceStatsAvailable);
         funcs.releaseFunc(mSurfaceControl);