Crash in circular reference of subsurface

I just had a crash with long stack of this:

#391 0x00007f59ae6643d3 in meta_wayland_surface_notify_subsurface_state_changed (surface=0x398d6c0 [MetaWaylandSurface])
    at ../src/wayland/meta-wayland-surface.c:1852
#392 0x00007f59ae65f86b in meta_wayland_subsurface_notify_subsurface_state_changed (surface_role=0x3c7e900 [MetaWaylandSubsurface])
    at ../src/wayland/meta-wayland-subsurface.c:290
#393 0x00007f59ae6643a8 in meta_wayland_surface_role_notify_subsurface_state_changed (surface_role=0x3c7e900 [MetaWaylandSubsurface])
    at ../src/wayland/meta-wayland-surface.c:1845
#394 0x00007f59ae6643d3 in meta_wayland_surface_notify_subsurface_state_changed (surface=0x398d6c0 [MetaWaylandSurface])
    at ../src/wayland/meta-wayland-surface.c:1852
#395 0x00007f59ae65f86b in meta_wayland_subsurface_notify_subsurface_state_changed (surface_role=0x3c7e900 [MetaWaylandSubsurface])
    at ../src/wayland/meta-wayland-subsurface.c:290
#396 0x00007f59ae6643a8 in meta_wayland_surface_role_notify_subsurface_state_changed (surface_role=0x3c7e900 [MetaWaylandSubsurface])

Looks like surface == surface->sub.parent - and we apparently don't guard against this atm.

See also https://bugzilla.mozilla.org/show_bug.cgi?id=1675402