Postpone destroying leash until after cancel callback.

Currently we may end up releasing the leash (via Transaction#remove)
before setting mCancelled on the animation. This means if another frame
executes we could attempt to use a released surface. Here we cancel before
releasing the surface, careful not to disturb other logic.

Bug: 124112773
Test: Fixes them allegedly
Change-Id: I920a1c8f891a5cdc53b1d55298f661abc91b3259

services/core/java/com/android/server/wm/SurfaceAnimator.java

@@ -251,7 +251,7 @@ class SurfaceAnimator {
         if (DEBUG_ANIM) Slog.i(TAG, "Cancelling animation restarting=" + restarting);
         final SurfaceControl leash = mLeash;
         final AnimationAdapter animation = mAnimation;
-        reset(t, forwardCancel);
+        reset(t, false);
         if (animation != null) {
             if (!mAnimationStartDelayed && forwardCancel) {
                 animation.onAnimationCancelled(leash);
@@ -260,6 +260,12 @@ class SurfaceAnimator {
                 mAnimationFinishedCallback.run();
             }
         }
+
+        if (forwardCancel && leash != null) {
+            t.remove(leash);
+            mService.scheduleAnimationLocked();
+        }
+
         if (!restarting) {
             mAnimationStartDelayed = false;
         }