Camera3: return cancelled buffers to buffer manager

When a buffer is cancelled, it is considered as a free buffer and need to be
returned to buffer manamager for buffer reuse. This will also make the prepare
work.

Also fix the buffer removal bug.

Bug: 25088440
Change-Id: I0e3da44c76008406ee19541366da7a962c355949
diff --git a/services/camera/libcameraservice/device3/Camera3BufferManager.cpp b/services/camera/libcameraservice/device3/Camera3BufferManager.cpp
index b2a3076..6d79167 100644
--- a/services/camera/libcameraservice/device3/Camera3BufferManager.cpp
+++ b/services/camera/libcameraservice/device3/Camera3BufferManager.cpp
@@ -362,11 +362,12 @@
     while (i != bufferList.end()) {
         ssize_t idx = i->indexOfKey(streamId);
         if (idx != NAME_NOT_FOUND) {
+            ALOGV("%s: Remove a buffer for stream %d, free buffer total count: %zu",
+                    __FUNCTION__, streamId, bufferList.size());
             i->removeItem(streamId);
             if (i->isEmpty()) {
                 i = bufferList.erase(i);
             }
-            break;
         } else {
             i++;
         }
diff --git a/services/camera/libcameraservice/device3/Camera3OutputStream.cpp b/services/camera/libcameraservice/device3/Camera3OutputStream.cpp
index e42d839..4e79029 100644
--- a/services/camera/libcameraservice/device3/Camera3OutputStream.cpp
+++ b/services/camera/libcameraservice/device3/Camera3OutputStream.cpp
@@ -220,6 +220,11 @@
             ALOGE("%s: Stream %d: Error cancelling buffer to native window:"
                   " %s (%d)", __FUNCTION__, mId, strerror(-res), res);
         }
+
+        if (mUseBufferManager) {
+            // Return this buffer back to buffer manager.
+            mBufferReleasedListener->onBufferReleased();
+        }
     } else {
         if (mTraceFirstBuffer && (stream_type == CAMERA3_STREAM_OUTPUT)) {
             {