Fix removal of IME target.

In the case that the IME target is removed while it is still
the IME target we will trigger a layer assignment before
updating WindowManagerService#mInputMethodTarget. In general in
the new hierarchy model we assume that containers always have SurfaceControl's
but this is only true while they are attached to the hierarchy. Since the
IME target may stick around otherwise until it's cleared we need
to check if it has a surface before using it in this way.

Bug: 69669036
Test: go/wm-smoke
Change-Id: I296549aba45368ee5e88f6e1224024e6105207dd
diff --git a/services/core/java/com/android/server/wm/DisplayContent.java b/services/core/java/com/android/server/wm/DisplayContent.java
index 17312b2..c625633 100644
--- a/services/core/java/com/android/server/wm/DisplayContent.java
+++ b/services/core/java/com/android/server/wm/DisplayContent.java
@@ -3865,12 +3865,25 @@
         mAboveAppWindowsContainers.assignLayer(t, 2);
 
         WindowState imeTarget = mService.mInputMethodTarget;
-        if (imeTarget == null || imeTarget.inSplitScreenWindowingMode()) {
-            // In split-screen windowing mode we can't layer the
-            // IME relative to the IME target because it needs to
-            // go over the docked divider, so instead we place it on top
-            // of everything and use relative layering of windows which need
-            // to go above it (see special logic in WindowState#assignLayer)
+
+        // A brief summary of IME layer assignment:
+        //
+        // In case we have no IME target but we have an IME we are typically in
+        // a transition state and keeping the IME on top of everything except overlays
+        // seems to work best.
+        //
+        // In split-screen windowing mode we can't layer the
+        // IME relative to the IME target because it needs to
+        // go over the docked divider, so instead we place it on top
+        // of everything and use relative layering of windows which need
+        // to go above it (see special logic in WindowState#assignLayer)
+        //
+        // There is a third case, where the IME target has no SurfaceControl, for
+        // example if Layer assignment were triggered due to removal of the
+        // IME target while it was still the IME target.
+        if (imeTarget == null ||
+                imeTarget.inSplitScreenWindowingMode() ||
+                imeTarget.getSurfaceControl() == null) {
             mImeWindowsContainers.assignLayer(t, 3);
         } else {
             t.setRelativeLayer(mImeWindowsContainers.getSurfaceControl(),