[SurfaceFlinger] Callback to renderengine when erasing BLAST buffers

Otherwise we may leak if BufferStateLayer is destroyed first.

Bug: 137514000
Test: Over 61 hours, ran: while [ true ]; do am start -n \
com.android.chrome/com.google.android.apps.chrome.Main \
http://m.youtube.com; sleep 10; input tap 740 740 ; sleep 10; input \
keyevent HOME; sleep 0.5; am force-stop com.android.chrome; sleep 0.5; \
done
Test: Over >30 minutes: while [ true ]; do am start -n \
com.android.chrome/com.google.android.apps.chrome.Main \
http://m.youtube.com; sleep 10; input tap 740 740; \
sleep 1; content insert --uri content://settings/system --bind \
name:s:user_rotation --bind value:i:1; sleep 4; content insert --uri \
content://settings/system --bind name:s:user_rotation --bind value:i:0; \
sleep 5; input keyevent HOME; sleep 0.5; \
am force-stop com.android.chrome; sleep 0.5; done
Test: CtsViewTestCases:ASurfaceControlTest
Test: CtsViewTestCases:SurfaceControlTest
Test: Transaction_test

Change-Id: I743eb8bd9887d17e08b6f1b8e8ec5874359df175
diff --git a/services/surfaceflinger/BufferStateLayer.cpp b/services/surfaceflinger/BufferStateLayer.cpp
index 2abc1a7..63a07c3 100644
--- a/services/surfaceflinger/BufferStateLayer.cpp
+++ b/services/surfaceflinger/BufferStateLayer.cpp
@@ -51,6 +51,16 @@
     mCurrentState.dataspace = ui::Dataspace::V0_SRGB;
 }
 
+BufferStateLayer::~BufferStateLayer() {
+    if (mActiveBuffer != nullptr) {
+        // Ensure that mActiveBuffer is uncached from RenderEngine here, as
+        // RenderEngine may have been using the buffer as an external texture
+        // after the client uncached the buffer.
+        auto& engine(mFlinger->getRenderEngine());
+        engine.unbindExternalTextureBuffer(mActiveBuffer->getId());
+    }
+}
+
 // -----------------------------------------------------------------------
 // Interface implementation for Layer
 // -----------------------------------------------------------------------
@@ -610,10 +620,6 @@
     }
 }
 
-void BufferStateLayer::bufferErased(const client_cache_t& clientCacheId) {
-    mFlinger->getRenderEngine().unbindExternalTextureBuffer(clientCacheId.id);
-}
-
 void BufferStateLayer::HwcSlotGenerator::bufferErased(const client_cache_t& clientCacheId) {
     std::lock_guard lock(mMutex);
     if (!clientCacheId.isValid()) {