Fix TextureView calling eglCreateImage with a destructed buffer

Fix an issue with hardware buffer passed from the SurfaceTexture
being destroyed before an SkImage is created. This CL is matched
by a change in frameworks/base I4d121f087fc842ce317745e7b7e2656f80a52b7d.

Test: Ran TextureView CTS tests and a few apps that use TextureView.
Test: Fix verified by partner Mediatek
Bug: 160930384
Bug: 152781833
Bug: 153045874
Bug: 156047948
Bug: 160514803
Bug: 155545635
Bug: 155171712
Change-Id: I2e025e683052168546f2e271a20a857b1e556b64
(cherry picked from commit 0702f1d077bab79c76a4889d7859abbaabf06b81)

libs/nativedisplay/include/surfacetexture/surface_texture_platform.h

@@ -79,6 +79,8 @@ typedef int (*ASurfaceTexture_fenceWait)(int fence, void* fencePassThroughHandle
 
 /**
  * ASurfaceTexture_dequeueBuffer returns the next available AHardwareBuffer.
+ * The caller gets ownership of the buffer and need to release it with
+ * AHardwareBuffer_release.
  */
 AHardwareBuffer* ASurfaceTexture_dequeueBuffer(ASurfaceTexture* st, int* outSlotid,
                                                android_dataspace* outDataspace,

libs/nativedisplay/surfacetexture/surface_texture.cpp

@@ -208,7 +208,15 @@ AHardwareBuffer* ASurfaceTexture_dequeueBuffer(ASurfaceTexture* st, int* outSlot
             *outNewContent = true;
         }
     } while (buffer.get() && (!queueEmpty));
-    return reinterpret_cast<AHardwareBuffer*>(buffer.get());
+    AHardwareBuffer* result = nullptr;
+    if (buffer.get()) {
+      result = buffer->toAHardwareBuffer();
+      // add a reference to keep the hardware buffer alive, even if
+      // BufferQueueProducer is disconnected. This is needed, because
+      // sp reference is destroyed at the end of this function.
+      AHardwareBuffer_acquire(result);
+    }
+    return result;
 }
 
 } // namespace android