Whenever an exception happens in VR session code, we cancel the entire session. Alongside that, we removed the "surface" item used to draw into an offscreen context. But this may still be stored as active surface, leading to a use-after-free when deactivating this active surface, for example.