xdg-shell: fix potential use-after-free

types/xdg_shell/wlr_xdg_popup.c

@@ -331,6 +331,7 @@ void create_xdg_popup(struct wlr_xdg_surface *surface,
 		wl_resource_get_version(surface->resource), id);
 	if (surface->popup->resource == NULL) {
 		free(surface->popup);
+		surface->popup = NULL;
 		wl_resource_post_no_memory(surface->resource);
 		return;
 	}

types/xdg_shell/wlr_xdg_toplevel.c

@@ -475,6 +475,7 @@ void create_xdg_toplevel(struct wlr_xdg_surface *surface,
 		wl_resource_get_version(surface->resource), id);
 	if (surface->toplevel->resource == NULL) {
 		free(surface->toplevel);
+		surface->toplevel = NULL;
 		wl_resource_post_no_memory(surface->resource);
 		return;
 	}