don't return a freed client for a surface whose toplevel is gone

A client can destroy its xdg_toplevel and keep the xdg_surface. wlroots
keeps the role but sets toplevel to NULL, and xdg_surface->data still
points to the Client freed by destroynotify(), so e.g. a popup created on
that surface made toplevel_from_wlr_surface() read freed memory.

client.h

@@ -98,6 +98,8 @@ toplevel_from_wlr_surface(struct wlr_surface *s, Client **pc, LayerSurface **pl)
 			xdg_surface = tmp_xdg_surface;
 			break;
 		case WLR_XDG_SURFACE_ROLE_TOPLEVEL:
+			if (!xdg_surface->toplevel)
+				return -1;
 			c = xdg_surface->data;
 			type = c->type;
 			goto end;