picture: properly handle Dav1dUserData references in Dav1dPicture

src/data.c

@@ -113,6 +113,7 @@ void dav1d_data_props_copy(Dav1dDataProps *const dst,
     assert(dst != NULL);
     assert(src != NULL);
 
+    dav1d_ref_dec(&dst->user_data.ref);
     *dst = *src;
     if (dst->user_data.ref) dav1d_ref_inc(dst->user_data.ref);
 }

src/picture.c

@@ -92,10 +92,8 @@ struct pic_ctx_context {
 static void free_buffer(const uint8_t *const data, void *const user_data) {
     struct pic_ctx_context *pic_ctx = user_data;
 
-    struct Dav1dRef *user_data_ref = pic_ctx->pic.m.user_data.ref;
     pic_ctx->allocator.release_picture_callback(&pic_ctx->pic,
                                                 pic_ctx->allocator.cookie);
-    if (user_data_ref) dav1d_ref_dec(&user_data_ref);
     free(pic_ctx);
 }
 
@@ -203,6 +201,7 @@ void dav1d_picture_ref(Dav1dPicture *const dst, const Dav1dPicture *const src) {
         dav1d_ref_inc(src->ref);
         if (src->frame_hdr_ref) dav1d_ref_inc(src->frame_hdr_ref);
         if (src->seq_hdr_ref) dav1d_ref_inc(src->seq_hdr_ref);
+        if (src->m.user_data.ref) dav1d_ref_inc(src->m.user_data.ref);
     }
     *dst = *src;
 }
@@ -236,6 +235,7 @@ void dav1d_picture_unref_internal(Dav1dPicture *const p) {
         dav1d_ref_dec(&p->ref);
         dav1d_ref_dec(&p->seq_hdr_ref);
         dav1d_ref_dec(&p->frame_hdr_ref);
+        dav1d_ref_dec(&p->m.user_data.ref);
     }
     memset(p, 0, sizeof(*p));
 }