fix a memory corruption where a SF Client could be used after it's been destroyed
diff --git a/libs/surfaceflinger/LayerBase.h b/libs/surfaceflinger/LayerBase.h
index 509dedd..b5265d2 100644
--- a/libs/surfaceflinger/LayerBase.h
+++ b/libs/surfaceflinger/LayerBase.h
@@ -297,11 +297,11 @@
     virtual uint32_t getTypeInfo() const { return typeInfo; }
 
     LayerBaseClient(SurfaceFlinger* flinger, DisplayID display, 
-            Client* client, int32_t i);
+            const sp<Client>& client, int32_t i);
     virtual ~LayerBaseClient();
     virtual void onFirstRef();
 
-    Client*             const client;
+    wp<Client>          client;
     layer_cblk_t*       const lcblk;
 
     inline  uint32_t    getIdentity() const { return mIdentity; }