Remove ping_timer when destroying wlr_wl_shell_surface

rootston/wl_shell.c

@@ -56,7 +56,7 @@ void handle_wl_shell_surface(struct wl_listener *listener, void *data) {
 	struct wlr_wl_shell_surface *surface = data;
 	wlr_log(L_DEBUG, "new shell surface: title=%s, class=%s",
 		surface->title, surface->class);
-	wlr_wl_shell_surface_ping(surface); // TODO: segfaults
+	wlr_wl_shell_surface_ping(surface);
 
 	struct roots_wl_shell_surface *roots_surface =
 		calloc(1, sizeof(struct roots_wl_shell_surface));

types/wlr_wl_shell.c

@@ -262,6 +262,7 @@ static void wl_shell_surface_destroy(struct wlr_wl_shell_surface *surface) {
 	wl_resource_set_user_data(surface->resource, NULL);
 	wl_list_remove(&surface->link);
 	wl_list_remove(&surface->surface_destroy_listener.link);
+	wl_event_source_remove(surface->ping_timer);
 	free(surface->transient_state);
 	free(surface->popup_state);
 	free(surface->title);