Check whether channel has been removed before sending cancelation.

When a gesture monitor pilfers pointers we synthesize cancelation
events for all currently active windows. It's possible, however, that a
window may have been removed between the beginning of the touch stream
and now, so we have to check whether the corresponding channel still
exists.

Bug: 145891806
Test: atest InputDispatcher_test.cpp
Change-Id: If16191b02bbb35886171c402b9bb74f547bdf94a
diff --git a/services/inputflinger/dispatcher/InputDispatcher.cpp b/services/inputflinger/dispatcher/InputDispatcher.cpp
index dcb3ebc..5a49b5e 100644
--- a/services/inputflinger/dispatcher/InputDispatcher.cpp
+++ b/services/inputflinger/dispatcher/InputDispatcher.cpp
@@ -4115,7 +4115,9 @@
         options.displayId = displayId;
         for (const TouchedWindow& window : state.windows) {
             sp<InputChannel> channel = getInputChannelLocked(window.windowHandle->getToken());
-            synthesizeCancelationEventsForInputChannelLocked(channel, options);
+            if (channel != nullptr) {
+                synthesizeCancelationEventsForInputChannelLocked(channel, options);
+            }
         }
         // Then clear the current touch state so we stop dispatching to them as well.
         state.filterNonMonitors();