Don't keep dead window with borrowed app token visible

If the window was add by a client using another client's app token,
we don't want to keep the dead window around for this case since
this funcationality is meant for 'real' apps.

Bug: 28467642
Change-Id: Ie4fdd9f90b122439a2fbcc60085ebfdb562d5c6d

services/core/java/com/android/server/wm/WindowState.java

@@ -1781,6 +1781,12 @@ final class WindowState implements WindowManagerPolicy.WindowState {
             return false;
         }
 
+        if (mAttrs.token != mClient.asBinder()) {
+            // The window was add by a client using another client's app token. We don't want to
+            // keep the dead window around for this case since this is meant for 'real' apps.
+            return false;
+        }
+
         if (mAttrs.type == TYPE_APPLICATION_STARTING) {
             // We don't keep starting windows since they were added by the window manager before
             // the app even launched.