lock: fix crash on output destroy

Closes: swaywm#7120

sway/lock.c

@@ -15,6 +15,7 @@ struct sway_session_lock_surface {
 	struct wl_listener surface_commit;
 	struct wl_listener output_mode;
 	struct wl_listener output_commit;
+	struct wl_listener output_destroy;
 };
 
 static void set_lock_focused_surface(struct wlr_surface *focused) {
@@ -28,6 +29,9 @@ static void set_lock_focused_surface(struct wlr_surface *focused) {
 
 static void handle_surface_map(struct wl_listener *listener, void *data) {
 	struct sway_session_lock_surface *surf = wl_container_of(listener, surf, map);
+	if (surf->output == NULL) {
+		return;
+	}
 	if (server.session_lock.focused == NULL) {
 		set_lock_focused_surface(surf->surface);
 	}
@@ -36,6 +40,9 @@ static void handle_surface_map(struct wl_listener *listener, void *data) {
 
 static void handle_surface_commit(struct wl_listener *listener, void *data) {
 	struct sway_session_lock_surface *surf = wl_container_of(listener, surf, surface_commit);
+	if (surf->output == NULL) {
+		return;
+	}
 	output_damage_surface(surf->output, 0, 0, surf->surface, false);
 }
 
@@ -79,10 +86,19 @@ static void handle_surface_destroy(struct wl_listener *listener, void *data) {
 	wl_list_remove(&surf->surface_commit.link);
 	wl_list_remove(&surf->output_mode.link);
 	wl_list_remove(&surf->output_commit.link);
-	output_damage_whole(surf->output);
+	wl_list_remove(&surf->output_destroy.link);
+	if (surf->output != NULL) {
+		output_damage_whole(surf->output);
+	}
 	free(surf);
 }
 
+static void handle_output_destroy(struct wl_listener *listener, void *data) {
+	struct sway_session_lock_surface *surf =
+		wl_container_of(listener, surf, output_destroy);
+	surf->output = NULL;
+}
+
 static void handle_new_surface(struct wl_listener *listener, void *data) {
 	struct wlr_session_lock_surface_v1 *lock_surface = data;
 	struct sway_session_lock_surface *surf = calloc(1, sizeof(*surf));
@@ -108,6 +124,8 @@ static void handle_new_surface(struct wl_listener *listener, void *data) {
 	wl_signal_add(&output->wlr_output->events.mode, &surf->output_mode);
 	surf->output_commit.notify = handle_output_commit;
 	wl_signal_add(&output->wlr_output->events.commit, &surf->output_commit);
+	surf->output_destroy.notify = handle_output_destroy;
+	wl_signal_add(&output->node.events.destroy, &surf->output_destroy);
 }
 
 static void handle_unlock(struct wl_listener *listener, void *data) {