Fix leakage of ASurfaceTransactionCallback

The callback needs to set to null when thread renderer is destroyed.

Bug: 187419942
Bug: 186869429
Test: blaze test --test_strategy=local --test_arg=--device_broker_type=LOCAL_ADB_SERVER //javatests/com/google/android/testing/elizabot/internal/sanity/subscriptionleak:SubscriptionLeakTest_generic_phone_google_31_x86
Change-Id: Ic80c58f102ee5f21830542030021828f6231cc37
diff --git a/core/java/android/view/ViewRootImpl.java b/core/java/android/view/ViewRootImpl.java
index 0958f3f..58f6d13 100644
--- a/core/java/android/view/ViewRootImpl.java
+++ b/core/java/android/view/ViewRootImpl.java
@@ -1355,6 +1355,11 @@
         }
     }
 
+    /**
+     * Register a callback to be executed when Webview overlay needs to merge a transaction.
+     * This callback will be executed on RenderThread worker thread, and released inside native code
+     * when CanvasContext is destroyed.
+     */
     private void addASurfaceTransactionCallback() {
         HardwareRenderer.ASurfaceTransactionCallback callback = (nativeTransactionObj,
                                                                  nativeSurfaceControlObj,
@@ -7707,6 +7712,7 @@
                 }
             }
             if (mAttachInfo.mThreadedRenderer != null) {
+                addASurfaceTransactionCallback();
                 mAttachInfo.mThreadedRenderer.setSurfaceControl(mSurfaceControl);
             }
         } else {
diff --git a/libs/hwui/renderthread/CanvasContext.cpp b/libs/hwui/renderthread/CanvasContext.cpp
index bba2207..718887b 100644
--- a/libs/hwui/renderthread/CanvasContext.cpp
+++ b/libs/hwui/renderthread/CanvasContext.cpp
@@ -195,6 +195,10 @@
 
     auto funcs = mRenderThread.getASurfaceControlFunctions();
 
+    if (surfaceControl == nullptr) {
+        setASurfaceTransactionCallback(nullptr);
+    }
+
     if (mSurfaceControl != nullptr) {
         funcs.unregisterListenerFunc(this, &onSurfaceStatsAvailable);
         funcs.releaseFunc(mSurfaceControl);