在 SurfaceFlinger::applyTransactionState() 遍历 ComposerState 向量，调用该函数。

uint32_t SurfaceFlinger::setClientStateLocked(
        const FrameTimelineInfo& frameTimelineInfo, const ComposerState& composerState,
        int64_t desiredPresentTime, bool isAutoTimestamp, int64_t postTime, uint32_t permissions,
        std::unordered_set<ListenerCallbacks, ListenerCallbacksHash>& outListenerCallbacks) {
    const layer_state_t& s = composerState.state;
    const bool privileged = permissions & Permission::ACCESS_SURFACE_FLINGER;

    std::vector<ListenerCallbacks> filteredListeners;
    for (auto& listener : s.listeners) {
        // Starts a registration but separates the callback ids according to callback type. This
        // allows the callback invoker to send on latch callbacks earlier.
        // note that startRegistration will not re-register if the listener has
        // already be registered for a prior surface control

        ListenerCallbacks onCommitCallbacks = listener.filter(CallbackId::Type::ON_COMMIT);
        if (!onCommitCallbacks.callbackIds.empty()) {
            mTransactionCallbackInvoker.startRegistration(onCommitCallbacks);
            filteredListeners.push_back(onCommitCallbacks);
            outListenerCallbacks.insert(onCommitCallbacks);
        }

        ListenerCallbacks onCompleteCallbacks = listener.filter(CallbackId::Type::ON_COMPLETE);
        if (!onCompleteCallbacks.callbackIds.empty()) {
            mTransactionCallbackInvoker.startRegistration(onCompleteCallbacks);
            filteredListeners.push_back(onCompleteCallbacks);
            outListenerCallbacks.insert(onCompleteCallbacks);
        }
    }

• s.listeners 是在 Transaction::apply() 中设置的。
• 调用 ListenerCallbacks::filter() 返回 onCommitCallbacks，它只包含 ON_COMMIT 类型 CallbackId 的 ListenerCallbacks。
• 调用 TransactionCallbackInvoker::startRegistration() 写到 TransactionCallbackInvoker 中。
• 写入 filteredListeners，下面会遍历新建 CallbackHandle。
• 写入 outListenerCallbacks，该函数结束后在上一个函数中用于调用 TransactionCallbackInvoker::endRegistration()。
• 同样的操作过滤 ON_COMMIT 类型的 callback。

    std::vector<sp<CallbackHandle>> callbackHandles;
    if ((what & layer_state_t::eHasListenerCallbacksChanged) && (!filteredListeners.empty())) {
        for (auto& [listener, callbackIds] : filteredListeners) {
            callbackHandles.emplace_back(new CallbackHandle(listener, callbackIds, s.surface));
        }
    }

• 如果 filteredListeners 非空，遍历并新建 CallbackHandle 写入一个向量 callbackHandles。

    if (layer->setTransactionCompletedListeners(callbackHandles)) flags |= eTraversalNeeded;
    // Do not put anything that updates layer state or modifies flags after
    // setTransactionCompletedListener
    return flags;
}

• 调用 BufferStateLayer::setTransactionCompletedListeners() 更新 CallbackHandle 成员，返回当前 layer 是否要显示。如果要显示，设置 eTraversalNeeded。