SurfaceFlinger: Fix a typo.

This change makes Layer skip its cleanup of its old shared memory region
when the UserClient object that owned the memory has been freed.

Bug: 3429357
Change-Id: I9e4d8eb190f6914dc043674b9bb8dd28e959901b

services/surfaceflinger/Layer.cpp

@@ -809,7 +809,7 @@ status_t Layer::ClientRef::setToken(const sp<UserClient>& uc,
 
     { // scope for strong mUserClient reference
         sp<UserClient> userClient(mUserClient.promote());
-        if (mUserClient != 0 && mControlBlock != 0) {
+        if (userClient != 0 && mControlBlock != 0) {
             mControlBlock->setStatus(NO_INIT);
         }
     }