Xext: composite: take the pixmap reference before AddResource() on Xinerama

When AddResource() fails it calls the type's delete function, which for
pixmaps is dixDestroyPixmap() and drops one reference.

SingleCompositeNameWindowPixmap() increments pPixmap->refcnt before
AddResource(), so a failure only drops that extra reference. The Xinerama
path in ProcCompositeNameWindowPixmap() incremented it afterwards, so a
failure dropped the window's own reference to its backing pixmap and
could free it while still in use. Take the reference first, as the
single-screen path does.

Adapted for release/25.0: the Xinerama loop on this branch uses
FOR_NSCREENS_BACKWARD(i) with newPix->info[i].id instead of walkScreenIdx;
the change is otherwise identical.

Signed-off-by: Mason Green <mason@greenm01.net>
(cherry picked from commit 6240f6551c)

composite/compext.c

@@ -761,12 +761,14 @@ ProcCompositeNameWindowPixmap(ClientPtr client)
             return BadMatch;
         }
 
+        /* take our reference first: on failure, AddResource() drops it again
+           through the pixmap delete function */
+        ++pPixmap->refcnt;
+
         if (!AddResource(newPix->info[i].id, X11_RESTYPE_PIXMAP, (void *) pPixmap)) {
             free(newPix);
             return BadAlloc;
         }
-
-        ++pPixmap->refcnt;
     }
 
     if (!AddResource(stuff->pixmap, XRT_PIXMAP, (void *) newPix))