SF: Fix HWComposer destruction order

The DisplayData vector was being destroyed before the HWC2::Device, but
HWC2::Layer destruction calls back into HWComposer::destroyLayer, which
looks up DisplayData for the display being destroyed.

Bug: 74619554
Test: dvr_display-test
Change-Id: I6260ae16b0896f8992db8ebde63ad4bfc0a0d532
diff --git a/services/surfaceflinger/DisplayHardware/HWComposer.h b/services/surfaceflinger/DisplayHardware/HWComposer.h
index 4777ca9..5aa7185 100644
--- a/services/surfaceflinger/DisplayHardware/HWComposer.h
+++ b/services/surfaceflinger/DisplayHardware/HWComposer.h
@@ -215,9 +215,13 @@
         HWC2::Error presentError;
     };
 
-    std::unique_ptr<HWC2::Device>   mHwcDevice;
     std::vector<DisplayData> mDisplayData{HWC_NUM_PHYSICAL_DISPLAY_TYPES};
-    std::set<size_t>                mFreeDisplaySlots;
+
+    // This must be destroyed before mDisplayData, because destructor may call back into HWComposer
+    // and look up DisplayData.
+    std::unique_ptr<HWC2::Device> mHwcDevice;
+
+    std::set<size_t> mFreeDisplaySlots;
     std::unordered_map<hwc2_display_t, int32_t> mHwcDisplaySlots;
     // protect mDisplayData from races between prepare and dump
     mutable Mutex mDisplayLock;