protocol: buffer storage must not be destroyed while in use

wl_surface.attach already specifies that this causes the contents of
surfaces using the buffer to become undefined.

However, if the underlying storage is destroyed (e.g. by truncating a
memfd which leads to SIGBUS in the compostior), then it is desirable
that the compositor can treat this as a fatal client error.

This also addresses the case where a client destroys a GBM BO while the
compositor is using it. A client that is aware of this paragraph knows
that it can destroy the wl_buffer but must keep the BO alive while the
compositor is using it.

Signed-off-by: Julian Orth <ju.orth@gmail.com>

protocol/wayland.xml

@@ -487,6 +487,9 @@
 
       Note, because wl_buffer objects are created from multiple independent
       factory interfaces, the wl_buffer interface is frozen at version 1.
+
+      If the client destroys the underlying storage of a wl_buffer while the
+      compositor is using the buffer, the behavior is unspecified.
     </description>
 
     <request name="destroy" type="destructor">