SEGFAULT with `client_system` and `WAYLAND_DEBUG=1` using object in argument after calling `.destroy()`

[ids1024]

Reproduction:

• Modify wayland-client/examples/simple_window.rs to add buffer.destroy() before surface.attach(...)
• Run with WAYLAND_DEBUG=1 cargo run --example simple_window --features wayland-backend/client_system
  Result:

[...]
[4191435.215]  -> wl_buffer@7.destroy()
[4191435.228]  -> wl_surface@4.attach(Segmentation fault (core dumped)

Presumably this issue is not specific surface.attach this call, but it happens to be where I've seen it.