Segfault when attached buffer is destroyed

The following sequence of requests causes weston to segfault:

[ 880017.849]  -> wl_display@1.get_registry(new id wl_registry@2)
[ 880017.873]  -> wl_display@1.sync(new id wl_callback@3)
[ 880017.957] wl_display@1.delete_id(3)
[ 880017.973] wl_registry@2.global(1, "wl_compositor", 5)
[ 880017.989] wl_registry@2.global(2, "wl_subcompositor", 1)
[ 880017.993] wl_registry@2.global(3, "wp_viewporter", 1)
[ 880017.996] wl_registry@2.global(4, "zxdg_output_manager_v1", 2)
[ 880018.000] wl_registry@2.global(5, "wp_presentation", 1)
[ 880018.004] wl_registry@2.global(6, "wp_single_pixel_buffer_manager_v1", 1)
[ 880018.010] wl_registry@2.global(7, "wp_tearing_control_manager_v1", 1)
[ 880018.013] wl_registry@2.global(8, "zwp_relative_pointer_manager_v1", 1)
[ 880018.017] wl_registry@2.global(9, "zwp_pointer_constraints_v1", 1)
[ 880018.022] wl_registry@2.global(10, "zwp_input_timestamps_manager_v1", 1)
[ 880018.026] wl_registry@2.global(11, "weston_capture_v1", 1)
[ 880018.030] wl_registry@2.global(12, "wl_data_device_manager", 3)
[ 880018.033] wl_registry@2.global(13, "wl_shm", 1)
[ 880018.036] wl_registry@2.global(14, "wl_drm", 2)
[ 880018.040] wl_registry@2.global(15, "wl_seat", 7)
[ 880018.043] wl_registry@2.global(16, "zwp_linux_dmabuf_v1", 4)
[ 880018.047] wl_registry@2.global(17, "weston_direct_display_v1", 1)
[ 880018.053] wl_registry@2.global(18, "zwp_linux_explicit_synchronization_v1", 2)
[ 880018.056] wl_registry@2.global(19, "weston_content_protection", 1)
[ 880018.060] wl_registry@2.global(20, "wl_output", 4)
[ 880018.063] wl_registry@2.global(21, "wl_output", 4)
[ 880018.068] wl_registry@2.global(22, "zwp_input_panel_v1", 1)
[ 880018.072] wl_registry@2.global(23, "zwp_input_method_v1", 1)
[ 880018.075] wl_registry@2.global(24, "zwp_text_input_manager_v1", 1)
[ 880018.078] wl_registry@2.global(25, "xdg_wm_base", 5)
[ 880018.082] wl_registry@2.global(26, "weston_desktop_shell", 1)
[ 880018.085] wl_callback@3.done(310)
[ 880018.119]  -> wl_registry@2.bind(1, "wl_compositor", 4, new id [unknown]@3)
[ 880018.133]  -> wl_registry@2.bind(2, "wl_subcompositor", 1, new id [unknown]@4)
[ 880018.142]  -> wl_registry@2.bind(3, "wp_viewporter", 1, new id [unknown]@5)
[ 880018.164]  -> wl_registry@2.bind(13, "wl_shm", 1, new id [unknown]@6)
[ 880018.173]  -> wl_registry@2.bind(15, "wl_seat", 1, new id [unknown]@7)
[ 880018.190]  -> wl_registry@2.bind(25, "xdg_wm_base", 1, new id [unknown]@8)
[ 880018.202]  -> wl_compositor@3.create_surface(new id wl_surface@9)
[ 880018.214]  -> wp_viewporter@5.get_viewport(new id wp_viewport@10, wl_surface@9)
[ 880018.220]  -> wl_compositor@3.create_surface(new id wl_surface@11)
[ 880018.226]  -> wp_viewporter@5.get_viewport(new id wp_viewport@12, wl_surface@11)
[ 880018.234]  -> wl_subcompositor@4.get_subsurface(new id wl_subsurface@13, wl_surface@11, wl_surface@9)
[ 880018.241]  -> wl_subsurface@13.set_sync()
[ 880018.248]  -> xdg_wm_base@8.get_xdg_surface(new id xdg_surface@14, wl_surface@9)
[ 880018.256]  -> xdg_surface@14.get_toplevel(new id xdg_toplevel@15)
[ 880018.279]  -> wl_shm@6.create_pool(new id wl_shm_pool@16, fd 5, 4)
[ 880018.296]  -> wl_shm_pool@16.create_buffer(new id wl_buffer@17, 0, 1, 1, 4, 0)
[ 880018.308]  -> wl_surface@11.attach(wl_buffer@17, 0, 0)
[ 880018.315]  -> wp_viewport@12.set_destination(10, 10)
[ 880018.319]  -> wl_surface@11.commit()
[ 880018.323]  -> wl_surface@9.commit()
[ 880018.335]  -> wl_shm@6.create_pool(new id wl_shm_pool@18, fd 6, 4)
[ 880018.343]  -> wl_shm_pool@18.create_buffer(new id wl_buffer@19, 0, 1, 1, 4, 0)
[ 880018.425] wl_shm@6.format(0)
[ 880018.431] wl_shm@6.format(1)
[ 880018.434] wl_shm@6.format(909199186)
[ 880018.437] wl_shm@6.format(842093913)
[ 880018.440] wl_shm@6.format(875713881)
[ 880018.443] wl_shm@6.format(842094158)
[ 880018.446] wl_shm@6.format(1448695129)
[ 880018.449] wl_shm@6.format(1448434008)
[ 880018.452] wl_shm@6.format(875708993)
[ 880018.455] wl_shm@6.format(808665665)
[ 880018.458] wl_shm@6.format(808665688)
[ 880018.461] wl_shm@6.format(1211384385)
[ 880018.463] wl_shm@6.format(1211384408)
[ 880018.466] wl_shm@6.format(942948929)
[ 880018.469] wl_shm@6.format(942948952)
[ 880018.472] wl_seat@7.capabilities(3)
[ 880018.482] xdg_toplevel@15.configure(0, 0, array[0])
[ 880018.486] xdg_surface@14.configure(311)
[ 880018.501]  -> wl_seat@7.get_keyboard(new id wl_keyboard@20)
[ 880018.508]  -> xdg_surface@14.ack_configure(311)
[ 880018.512]  -> wl_surface@9.attach(wl_buffer@19, 0, 0)
[ 880018.516]  -> wp_viewport@10.set_destination(100, 100)
[ 880018.519]  -> wl_surface@9.commit()
[ 880018.629] wl_keyboard@20.keymap(1, fd 4, 64754)
[ 880018.640] wl_keyboard@20.enter(313, wl_surface@9, array[4])
[ 880018.644] wl_keyboard@20.modifiers(313, 0, 0, 0, 0)
[ 880018.648] xdg_toplevel@15.configure(0, 0, array[4])
[ 880018.651] xdg_surface@14.configure(315)
[ 880018.677]  -> xdg_surface@14.ack_configure(315)
[ 880018.683]  -> wl_surface@9.attach(wl_buffer@19, 0, 0)
[ 880018.688]  -> wp_viewport@10.set_destination(100, 100)
[ 880018.691]  -> wl_surface@9.commit()
[ 880087.471] wl_keyboard@20.key(316, 250890568, 28, 0)
[ 880871.523] wl_keyboard@20.key(317, 250891352, 57, 1)
[ 880871.554]  -> wl_surface@9.attach(wl_buffer@17, 0, 0)
[ 880871.564]  -> wl_buffer@17.destroy()
[ 880871.572]  -> wl_surface@9.commit()

The critical sub-sequence is

[ 880018.202]  -> wl_compositor@3.create_surface(new id wl_surface@9)
[ 880018.220]  -> wl_compositor@3.create_surface(new id wl_surface@11)
[ 880018.234]  -> wl_subcompositor@4.get_subsurface(new id wl_subsurface@13, wl_surface@11, wl_surface@9)
[ 880018.308]  -> wl_surface@11.attach(wl_buffer@17, 0, 0)
[ 880018.319]  -> wl_surface@11.commit()
[ 880018.512]  -> wl_surface@9.attach(wl_buffer@19, 0, 0)
[ 880018.519]  -> wl_surface@9.commit()
[ 880871.554]  -> wl_surface@9.attach(wl_buffer@17, 0, 0)
[ 880871.564]  -> wl_buffer@17.destroy()
[ 880871.572]  -> wl_surface@9.commit()

Possibly the same as #776.