X crashes during gesture

This is a crash in the X11 server. It looks like a crash we used to see years ago in older versions of the x.org X11 server. What OS and release are you running? What version of x.org do you have installed?

System is Arch, up to date (but the issue has been present since I first installed touchegg a few months ago).

$ uname -r
3.17.1-1-ARCH

$ Xorg -version

X.Org X Server 1.16.1
Release Date: 2014-09-21
X Protocol Version 11, Revision 0
Build Operating System: Linux 3.16.1-1-ARCH x86_64
Current Operating System: Linux arrow 3.17.1-1-ARCH #1 SMP PREEMPT Wed Oct 15 15:04:35 CEST 2014 x86_64
Kernel command line: BOOT_IMAGE=/boot/vmlinuz-linux root=UUID=d8f6031b-ec59-4a37-9757-6bc2a519b0b7 rw quiet
Build Date: 21 September 2014 10:53:13AM

$ pacman -Q geis grail frame
    geis 2.2.16-1
    grail 3.1.0-1
    frame 2.5.0-1

Any clues? Bug still present and leading to Xorg crash with the following:

$ uname -r
3.18.6-1-ARCH

$ Xorg -version
X.Org X Server 1.17.1
Release Date: 2015-02-10
X Protocol Version 11, Revision 0
Build Operating System: Linux 3.18.6-1-ARCH x86_64
[...]

$ pacman -Q geis grail frame
geis 2.2.16-1
grail 3.1.0-1
frame 2.5.0-1

I noticed a similar behaviour. I have an application which uses xmessage with buttons. So everytime I press a button in the window, it opens a new window with xmessage with different text and buttons. If I use the touchscreen to press the buttons, it sometimes (rarely) happens that xorg chrashes. The crash only happens if I have touchegg running in the background. I get the following reports:

in syslog:
org.a11y.atspi.Registry[1112]: XIO: fatal IO error 11 (Resource temporarily unavailable) on X server ":0"

in Xorg.o.log:
Segmentation fault at address 0x...
Fatal server error:
Caught signal 11 (Segmentation fault). Server aborting

in touchegg:
touchegg: Fatal IO error: client killed

I was able to reproduce the crash reliably by using the following script:
#!/bin/bash
while :
do
xmessage -center "test bla bla bla" -buttons "" &
testpid=$!
sleep 0.1
kill $testpid
done

If I now start touching around in the area of the appearing test window (only normal single taps and/or swipes, no gestures) the xorg crashes immediately. If I kill touchegg before doing this, no crashes appear.

Ubuntu 16.04 LTS
Xorg Version 1.18.3
Intel Atom Processor E3827

I executed the following steps, maybe this helps:

1. attach gdb to xfwm4
2. set breakpoint on _exit
3. continue
4. provoke crash
5. dump stack

(gdb) bt
#0 0xb6ae56e8 in _exit () at ../sysdeps/unix/sysv/linux/i386/_exit.S:24
#1 0xb6a6392a in __run_exit_handlers (status=1, listp=0xb6be73dc <__exit_funcs>, run_list_atexit=true) at exit.c:97
#2 0xb6a639cf in __GI_exit (status=1) at exit.c:104
#3 0xb718c537 in gdk_x_io_error (display=0x80d60c00) at /build/gtk+2.0-LJ3oCC/gtk+2.0-2.24.30/gdk/x11/gdkmain-x11.c:544
#4 0xb6cbf2ed in _XIOError (dpy=0x80d60c00) at ../../src/XlibInt.c:1464
#5 0xb6cbd362 in _XReply (dpy=0x80d60c00, rep=0xbffb8c4c, extra=0, discard=1) at ../../src/xcb_io.c:708
#6 0xb6ca3670 in _XGetWindowAttributes (dpy=0x80d60c00, w=20971564, attr=0x80dedb7c) at ../../src/GetWAttrs.c:114
#7 0xb6ca37c8 in XGetWindowAttributes (dpy=0x80d60c00, w=20971564, attr=0x80dedb7c) at ../../src/GetWAttrs.c:149
#8 0x8011031d in add_win (display_info=0x80d95370, id=20971564, c=0x0) at compositor.c:2143
#9 0x801125a5 in compositorHandleEvent (ev=0xbffb8f4c, display_info=0x80d95370) at compositor.c:2747
#10 0x801125a5 in compositorHandleEvent (display_info=0x80d95370, ev=0xbffb8f4c) at compositor.c:3227
#11 0x80117931 in xfwm4_event_filter (ev=0xbffb8f4c, display_info=0x80d95370) at events.c:2283
#12 0x80117931 in xfwm4_event_filter (xevent=0xbffb8f4c, data=0x80d95370) at events.c:2297
#13 0x80116069 in eventXfwmFilter (gdk_xevent=0xbffb8f4c, event=0x80de58c0, data=0x80ddcd38) at event_filter.c:158
#14 0xb71822c4 in gdk_event_apply_filters (xevent=xevent@entry=0xbffb8f4c, event=event@entry=0x80de58c0, window=window@entry=0x0)
    at /build/gtk+2.0-LJ3oCC/gtk+2.0-2.24.30/gdk/x11/gdkevents-x11.c:371
#15 0xb71835cc in gdk_event_translate (display=display@entry=0x80d6c0a0 [GdkDisplayX11], event=event@entry=0x80de58c0, xevent=xevent@entry=0xbffb8f4c, return_exposes=0) at /build/gtk+2.0
-LJ3oCC/gtk+2.0-2.24.30/gdk/x11/gdkevents-x11.c:969
#16 0xb7184ec9 in _gdk_events_queue (display=0x80d6c0a0 [GdkDisplayX11]) at /build/gtk+2.0-LJ3oCC/gtk+2.0-2.24.30/gdk/x11/gdkevents-x11.c:2358
#17 0xb7184f7e in gdk_event_dispatch (source=0x80d73688, callback=0x0, user_data=0x0)
    at /build/gtk+2.0-LJ3oCC/gtk+2.0-2.24.30/gdk/x11/gdkevents-x11.c:2419
#18 0xb6e23e29 in g_main_context_dispatch (context=0x80d73758) at /build/glib2.0-Spm2To/glib2.0-2.48.0/./glib/gmain.c:3154
#19 0xb6e23e29 in g_main_context_dispatch (context=0x80d73758) at /build/glib2.0-Spm2To/glib2.0-2.48.0/./glib/gmain.c:3769
#20 0xb6e240c9 in g_main_context_iterate (context=0x80d73758, block=block@entry=1, dispatch=dispatch@entry=1, self=<optimized out>)
    at /build/glib2.0-Spm2To/glib2.0-2.48.0/./glib/gmain.c:3840
#21 0xb6e24479 in g_main_loop_run (loop=0x80dc5350) at /build/glib2.0-Spm2To/glib2.0-2.48.0/./glib/gmain.c:4034
#22 0xb7310485 in IA__gtk_main () at /build/gtk+2.0-LJ3oCC/gtk+2.0-2.24.30/gtk/gtkmain.c:1282
#23 0x80106d05 in main (argc=1, argv=0xbffb92a4) at main.c:693