Camera: StreamSplitter: Return overwritten buffer to input

For Async buffer queue, if a pending buffer is overwritten by an
incoming buffer, onBufferReleased callback isn't called. But the stream
splitter depends on the onBufferReleased to return buffer to input.

Fix the problem by checking the bufferReplaced flag in
QueueBufferOutput.

Test: Camera CTS
Bug: 33777818
Change-Id: I270c7bae7873797ae9b050782828b5a124d3eff9
diff --git a/services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp b/services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp
index 07f9491..c9f43aa 100644
--- a/services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp
+++ b/services/camera/libcameraservice/device3/Camera3StreamSplitter.cpp
@@ -322,6 +322,13 @@
                         "queueing buffer to output failed (%d)", status);
             }
 
+            // If the queued buffer replaces a pending buffer in the async
+            // queue, no onBufferReleased is called by the buffer queue.
+            // Proactively trigger the callback to avoid buffer loss.
+            if (queueOutput.bufferReplaced) {
+                onBufferReleasedByOutputLocked(mOutputs[id]);
+            }
+
             ALOGV("queued buffer %#" PRIx64 " to output %p",
                     bufferItem.mGraphicBuffer->getId(), mOutputs[id].get());
         }
@@ -335,6 +342,12 @@
     ATRACE_CALL();
     Mutex::Autolock lock(mMutex);
 
+    onBufferReleasedByOutputLocked(from);
+}
+
+void Camera3StreamSplitter::onBufferReleasedByOutputLocked(
+        const sp<IGraphicBufferProducer>& from) {
+
     sp<GraphicBuffer> buffer;
     sp<Fence> fence;
     status_t status = from->detachNextBuffer(&buffer, &fence);