wpebackend-fdo: fix stale buffer export on commit without attach

Surface::shmBuffer/dmabufBuffer were set at attach and never cleared;
a commit without a fresh attach (frame-callback pacing) re-exported
the previous - potentially dangling - buffer pointer, handing the
embedder garbage buffer metadata. Consume the attached state at commit
and export nothing without a buffer, in both ImplSHM and ImplEGL
(upstream-ready patch with the full story). PKG_RELEASE 5.

Patchset already proposed upstream:
Igalia/WPEBackend-fdo#206

Assisted-By: Claude Opus + Fable

Signed-off-by: Mirko Vogt <mirko-openwrt@nanl.de>

Author: mirko

libs/wpebackend-fdo/Makefile

@@ -2,7 +2,7 @@ include $(TOPDIR)/rules.mk
 
 PKG_NAME:=wpebackend-fdo
 PKG_VERSION:=1.16.1
-PKG_RELEASE:=1
+PKG_RELEASE:=5
 
 PKG_SOURCE:=$(PKG_NAME)-$(PKG_VERSION).tar.xz
 PKG_SOURCE_URL:=https://wpewebkit.org/releases

libs/wpebackend-fdo/patches/001-shm-do-not-export-stale-buffer-on-commit-without-attach.patch

@@ -0,0 +1,68 @@
+From: Mirko Vogt <foss@mirko.in>
+Subject: [PATCH] ws: do not export a stale buffer on a commit without attach
+
+Surface::shmBuffer (and, in the EGL implementation, also dmabufBuffer)
+is set at wl_surface.attach and was never cleared: a commit without a
+fresh attach - e.g. one issued only for frame-callback pacing -
+re-exported the previous buffer pointer. Once the client had destroyed
+that buffer after its release, the embedder received a dangling
+wl_shm_buffer whose metadata reads as garbage (observed as negative
+width/stride crashing cog's drm renderer copy loop).
+
+Consume the attached buffer state at commit and export nothing when no
+buffer was attached. Apply to both ImplSHM and ImplEGL - the code is
+duplicated between ws-shm.cpp and ws-egl.cpp.
+
+Signed-off-by: Mirko Vogt <foss@mirko.in>
+---
+--- a/src/ws-shm.cpp
++++ b/src/ws-shm.cpp
+@@ -47,8 +47,19 @@
+     struct wl_resource* bufferResource = surface.bufferResource;
+     surface.bufferResource = nullptr;
+ 
+-    if (surface.shmBuffer)
+-        surface.apiClient->exportShmBuffer(bufferResource, surface.shmBuffer);
++    // Consume the buffer state: it belongs to the buffer attached for THIS
++    // commit. Leaving it set would re-export a stale - and, once the client
++    // destroyed the released buffer, dangling - pointer on a commit that
++    // did not attach a new buffer (e.g. a commit issued only for
++    // frame-callback pacing), handing the embedder garbage metadata.
++    struct wl_shm_buffer* shmBuffer = surface.shmBuffer;
++    surface.shmBuffer = nullptr;
++
++    if (!bufferResource)
++        return;
++
++    if (shmBuffer)
++        surface.apiClient->exportShmBuffer(bufferResource, shmBuffer);
+     else
+         surface.apiClient->exportBufferResource(bufferResource);
+ }
+--- a/src/ws-egl.cpp
++++ b/src/ws-egl.cpp
+@@ -102,10 +102,20 @@
+     struct wl_resource* bufferResource = surface.bufferResource;
+     surface.bufferResource = nullptr;
+ 
+-    if (surface.dmabufBuffer)
+-        surface.apiClient->exportLinuxDmabuf(surface.dmabufBuffer);
+-    else if (surface.shmBuffer)
+-        surface.apiClient->exportShmBuffer(bufferResource, surface.shmBuffer);
++    // Consume the buffer state (see ws-shm.cpp): stale dmabuf/shm pointers
++    // must never be re-exported on a commit without a fresh attach.
++    const struct linux_dmabuf_buffer* dmabufBuffer = surface.dmabufBuffer;
++    surface.dmabufBuffer = nullptr;
++    struct wl_shm_buffer* shmBuffer = surface.shmBuffer;
++    surface.shmBuffer = nullptr;
++
++    if (!bufferResource)
++        return;
++
++    if (dmabufBuffer)
++        surface.apiClient->exportLinuxDmabuf(dmabufBuffer);
++    else if (shmBuffer)
++        surface.apiClient->exportShmBuffer(bufferResource, shmBuffer);
+     else
+         surface.apiClient->exportBufferResource(bufferResource);
+ }