It was possible for the sibling surface to be already destroyed in meta_wayland_transaction_add_placement_surfaces, in which case g_object_ref would return NULL for it, and meta_wayland_transaction_commit would then crash dereferencing a NULL surface pointer. Closes: #3462 Part-of: <!3725>