surfaceflinger: fix a nullptr dereference

When the child layer latched a buffer but the fixed-size parent
layer never did (for reasons such as no buffer queued or buffer got
rejected), we could end up with p->mActiveBuffer being nullptr.

Bug: 62996512
Test: manual (I could never repro anyway)
Change-Id: Id7e4c7037633b8a37039baa6e8a306e55170b894