gdk/wayland: Handle disorderly tablet/pad disconnects

If the tablet gets removed/freed while there are pad events in flight,
we leave a dangling pointer from the pad to the tablet, which may
lead to invalid reads/writes when handling the pad event(s).

Fixes: https://gitlab.gnome.org/GNOME/gtk/-/issues/2748

gdk/wayland/gdkdevice-wayland.c

@@ -2816,6 +2816,14 @@ _gdk_wayland_seat_remove_tablet (GdkWaylandSeat       *seat,
 
   zwp_tablet_v2_destroy (tablet->wp_tablet);
 
+  while (tablet->pads)
+    {
+      GdkWaylandTabletPadData *pad = tablet->pads->data;
+
+      pad->current_tablet = NULL;
+      tablet->pads = g_list_remove (tablet->pads, pad);
+    }
+
   device_manager->devices =
     g_list_remove (device_manager->devices, tablet->master);
   device_manager->devices =