BufferIterator holds a safe_ptr to their buffer instead of a raw pointer

src/buffer.hh

@@ -75,7 +75,7 @@ public:
 private:
     ByteCount offset() const;
 
-    const Buffer* m_buffer;
+    safe_ptr<const Buffer> m_buffer;
     BufferCoord   m_coord;
     friend class Buffer;
 };