Unregister onFrameAvailable callbacks when a TextureEntry is released.

Otherwise the callbacks may be called after FlutterNativeView is destroyed and is null.

Also defensively check for whether the texture is already released in the callback because the callback may be called from another thread by a stale reference (see the comment).

This closes flutter/flutter#20951.

Author: nichtverstehen

shell/platform/android/io/flutter/view/FlutterView.java

@@ -997,6 +997,14 @@ final class SurfaceTextureRegistryEntry implements TextureRegistry.SurfaceTextur
             this.surfaceTexture.setOnFrameAvailableListener(new SurfaceTexture.OnFrameAvailableListener() {
                 @Override
                 public void onFrameAvailable(SurfaceTexture texture) {
+                    // NB: This callback may be called on an arbitrary thread.
+                    if (SurfaceTextureRegistryEntry.this.surfaceTexture.isReleased()) { // isReleased is synchronized in JNI code.
+                        // Even though we make sure to unregister the callback before releasing,
+                        // SurfaceTexture has a data race when accessing the callback, so the callback may
+                        // still be called by a stale reference after surfaceTexture.isRelease() and mNativeView==null.
+                        // See b/113099095.
+                        return;
+                    }
                     nativeMarkTextureFrameAvailable(mNativeView.get(), SurfaceTextureRegistryEntry.this.id);
                 }
             });
@@ -1019,6 +1027,9 @@ public void release() {
             }
             released = true;
             nativeUnregisterTexture(mNativeView.get(), id);
+            // Otherwise onFrameAvailableListener might be called after mNativeView==null
+            // (https://github.com/flutter/flutter/issues/20951). See also the check in onFrameAvailable.
+            surfaceTexture.setOnFrameAvailableListener(null);
             surfaceTexture.release();
         }
     }