SurfaceFlinger: Forward pending buffer release to children.

When releasing the pending buffer because we are removed from the current
state we also need to do so for the children (quite simply, as they are
also removed from the current state).

Bug: 62536731
Bug: 111373437
Bug: 111297488
Test: Transaction_test.cpp
Change-Id: I9a5675241f9980b1d00c19643197f9c1e31cd5f4
diff --git a/services/surfaceflinger/SurfaceFlinger.cpp b/services/surfaceflinger/SurfaceFlinger.cpp
index dec08fd..c15bdb2 100644
--- a/services/surfaceflinger/SurfaceFlinger.cpp
+++ b/services/surfaceflinger/SurfaceFlinger.cpp
@@ -2736,7 +2736,11 @@
             // abandon the buffer queue.
             if (l->isRemovedFromCurrentState()) {
                 l->destroyAllHwcLayers();
-                l->releasePendingBuffer(systemTime());
+                // destroyAllHwcLayers traverses to children, but releasePendingBuffer
+                // doesn't in other scenarios. So we have to traverse explicitly here.
+                l->traverseInZOrder(LayerVector::StateSet::Drawing, [&](Layer* child) {
+                    child->releasePendingBuffer(systemTime());
+                });
             }
         }
         mLayersPendingRemoval.clear();