Comment 1 for bug 1522105

It looks like the culprit is SurfaceStack::add_observer, where the mutex guarding state changes to the vector of surfaces is dropped when calling the observer. This is problematic as another thread could call SurfaceStack::remove_surface.