Call InputEventReceiver.dispose from the right thread

TaskPositioner attaches the InputEventReceiver to the animation thread.
This CL makes it to dispose the receiver in the same thread to avoid
race conditions.

This CL also makes InputEventReceiver.finalize call dispose from the
right thread.

Bug: 122054478
Fix: 122096091
Test: 1. Make a task enter free-form mode.
      2. Drag and drop the task.
      3. Check if InputEventReceiver.dispose and finishInputEvent are
         executed in the same thread.

Change-Id: I2f8831e7fccca4f96562f2abe4962811339d02e9

core/java/android/view/InputEventReceiver.java

@@ -25,6 +25,7 @@ import android.util.SparseIntArray;
 
 import dalvik.system.CloseGuard;
 
+import java.lang.ref.Reference;
 import java.lang.ref.WeakReference;
 
 /**
@@ -86,6 +87,7 @@ public abstract class InputEventReceiver {
 
     /**
      * Disposes the receiver.
+     * Must be called on the same Looper thread to which the receiver is attached.
      */
     public void dispose() {
         dispose(false);
@@ -109,6 +111,7 @@ public abstract class InputEventReceiver {
             mInputChannel = null;
         }
         mMessageQueue = null;
+        Reference.reachabilityFence(this);
     }
 
     /**

services/core/java/com/android/server/wm/TaskPositioningController.java

@@ -198,7 +198,9 @@ class TaskPositioningController {
     }
 
     void finishTaskPositioning() {
-        mHandler.post(() -> {
+        // TaskPositioner attaches the InputEventReceiver to the animation thread. We need to
+        // dispose the receiver on the same thread to avoid race conditions.
+        mService.mAnimationHandler.post(() -> {
             if (DEBUG_TASK_POSITIONING) Slog.d(TAG_WM, "finishPositioning");
 
             synchronized (mService.mGlobalLock) {