primary selection: destroy devices before manager

Since device_destroy() calls wl_list_remove() on the device's link,
the manager must still be valid. However if the manager is destroyed
before the seat as the wl_display destroy handlers are called, devices
listening for the seat to be destroyed will access free'd memory in
wl_list_remove().

types/wlr_primary_selection_v1.c

@@ -452,6 +452,12 @@ static void primary_selection_device_manager_bind(struct wl_client *client,
 static void handle_display_destroy(struct wl_listener *listener, void *data) {
 	struct wlr_primary_selection_v1_device_manager *manager =
 		wl_container_of(listener, manager, display_destroy);
+
+	struct wlr_primary_selection_v1_device *device, *tmp;
+	wl_list_for_each_safe(device, tmp, &manager->devices, link) {
+		device_destroy(device);
+	}
+
 	wlr_signal_emit_safe(&manager->events.destroy, manager);
 	wl_list_remove(&manager->display_destroy.link);
 	wl_global_destroy(manager->global);