pixmap: have slave pixmap take a reference on master pixmap

Since the free routines free the master pixmap then the slave, we should
be taking a reference when we bind them together.

Fixes a use-after-free when resizing a primed gears.

Signed-off-by: Dave Airlie <airlied@redhat.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>

dix/pixmap.c

@@ -148,6 +148,10 @@ PixmapPtr PixmapShareToSlave(PixmapPtr pixmap, ScreenPtr slave)
                               pixmap->drawable.height, depth, 0,
                               pixmap->devKind, NULL);
 
+    /* have the slave pixmap take a reference on the master pixmap
+       later we destroy them both at the same time */
+    pixmap->refcnt++;
+
     spix->master_pixmap = pixmap;
 
     ret = slave->SetSharedPixmapBacking(spix, handle);