protocol: buffer storage must not be destroyed while in use
wl_surface.attach already specifies that this causes the contents of surfaces using the buffer to become undefined.
However, if the underlying storage is destroyed (e.g. by truncating a memfd which leads to SIGBUS in the compostior), then it is desirable that the compositor can treat this as a fatal client error.
This also addresses the case where a client destroys a GBM BO while the compositor is using it. A client that is aware of this paragraph knows that it can destroy the wl_buffer but must keep the BO alive while the compositor is using it.
Signed-off-by: Julian Orth ju.orth@gmail.com