xwayland: Hold cursor buffer until released

The cursor code would destroy the buffer as soon as the cursor is
unrealized on X11 side.

Yet, the Wayland compositor may still be using the buffer as long as a
released callback has not been received.

Increase the reference counter on the pixmap to hold a reference on the
pixmap when attaching it to the surface and use the new pixmap release
callback mechanism to release that reference when the buffer is
released.

Signed-off-by: Olivier Fourdan <ofourdan@redhat.com>
Acked-by: Martin Peres <martin.peres@mupuf.org>
Reviewed-by: Michel Dänzer <mdaenzer@redhat.com>

hw/xwayland/xwayland-cursor.c

@@ -34,6 +34,7 @@
 
 #include "xwayland-cursor.h"
 #include "xwayland-input.h"
+#include "xwayland-pixmap.h"
 #include "xwayland-screen.h"
 #include "xwayland-shm.h"
 #include "xwayland-types.h"
@@ -135,6 +136,13 @@ static const struct wl_callback_listener frame_listener = {
     frame_callback
 };
 
+static void
+xwl_cursor_buffer_release_callback(void *data)
+{
+    /* drop the reference we took in set_cursor */
+    xwl_shm_destroy_pixmap(data);
+}
+
 static void
 xwl_cursor_copy_bits_to_pixmap(CursorPtr cursor, PixmapPtr pixmap)
 {
@@ -161,6 +169,12 @@ xwl_cursor_attach_pixmap(struct xwl_seat *xwl_seat,
     xwl_cursor->frame_cb = wl_surface_frame(xwl_cursor->surface);
     wl_callback_add_listener(xwl_cursor->frame_cb, &frame_listener, xwl_cursor);
 
+    /* Hold a reference on the pixmap until it's released by the compositor */
+    pixmap->refcnt++;
+    xwl_pixmap_set_buffer_release_cb(pixmap,
+                                     xwl_cursor_buffer_release_callback,
+                                     pixmap);
+
     wl_surface_commit(xwl_cursor->surface);
 }