CCodec: alter input surface start/release sequence

Bug: 116174324
Test: bug repro steps
Change-Id: I5904aad162788bfe3f0de8c8becefac2d53aaf71
(cherry picked from commit 9a38a9ccc0924633bdf35abbd5cba77c61836f3f)
diff --git a/media/sfplugin/CCodec.cpp b/media/sfplugin/CCodec.cpp
index ae6beaa..4ade391 100644
--- a/media/sfplugin/CCodec.cpp
+++ b/media/sfplugin/CCodec.cpp
@@ -1016,7 +1016,7 @@
         ALOGD("ISConfig: no configuration");
     }
 
-    return surface->start();
+    return OK;
 }
 
 void CCodec::initiateSetInputSurface(const sp<PersistentSurface> &surface) {
@@ -1103,12 +1103,20 @@
     }
     sp<AMessage> inputFormat;
     sp<AMessage> outputFormat;
+    status_t err2 = OK;
     {
         Mutexed<Config>::Locked config(mConfig);
         inputFormat = config->mInputFormat;
         outputFormat = config->mOutputFormat;
+        if (config->mInputSurface) {
+            err2 = config->mInputSurface->start();
+        }
     }
-    status_t err2 = mChannel->start(inputFormat, outputFormat);
+    if (err2 != OK) {
+        mCallback->onError(err2, ACTION_CODE_FATAL);
+        return;
+    }
+    err2 = mChannel->start(inputFormat, outputFormat);
     if (err2 != OK) {
         mCallback->onError(err2, ACTION_CODE_FATAL);
         return;
@@ -1182,6 +1190,13 @@
         mCallback->onError(UNKNOWN_ERROR, ACTION_CODE_FATAL);
     }
 
+    // NOTE: ACodec releases GBS only at stop(), counter-intuitively.
+    {
+        Mutexed<Config>::Locked config(mConfig);
+        if (config->mInputSurface) {
+            config->mInputSurface->disconnect();
+        }
+    }
     {
         Mutexed<State>::Locked state(mState);
         if (state->get() == STOPPING) {
diff --git a/media/sfplugin/CCodecBufferChannel.cpp b/media/sfplugin/CCodecBufferChannel.cpp
index f4b407f..ea8f015 100644
--- a/media/sfplugin/CCodecBufferChannel.cpp
+++ b/media/sfplugin/CCodecBufferChannel.cpp
@@ -2256,7 +2256,6 @@
     mSync.stop();
     mFirstValidFrameIndex = mFrameIndex.load();
     if (mInputSurface != nullptr) {
-        mInputSurface->disconnect();
         mInputSurface.reset();
     }
 }