compositor: Don't repaint outputs being destroyed

Set a flag when an output is being destroyed and use that to avoid
repainting. This allows functions that schedule an output repaint to
be called when the output is being destroyed without causing the
compositor to crash.
diff --git a/src/compositor.c b/src/compositor.c
index e4eb56d..ed6548c 100644
--- a/src/compositor.c
+++ b/src/compositor.c
@@ -1759,6 +1759,9 @@
 	pixman_region32_t output_damage;
 	int r;
 
+	if (output->destroying)
+		return 0;
+
 	/* Rebuild the surface list and update surface transforms up front. */
 	weston_compositor_build_view_list(ec);
 
@@ -3105,6 +3108,8 @@
 WL_EXPORT void
 weston_output_destroy(struct weston_output *output)
 {
+	output->destroying = 1;
+
 	weston_compositor_remove_output(output->compositor, output);
 	wl_list_remove(&output->link);