There is a race condition in x_frame_rehighlight regarding input
redirection, triggering a null-pointer access.  This kinds of
errors are usually difficult to reproduce.  I used the following
code, while simultaneously changing focus rapidly via the
window-manager.

(defun fn (&optional parms)
  (let* ((frame (make-frame parms)))
    (sit-for 1e-100)
    (redirect-frame-focus (selected-frame) frame)
    frame))

(while t
  (let ((f1 (fn
	     '((width . 20)
	       (height . 30))))
	(f2 (fn
	     '((width . 20)
	       (height . 30)
	       (top . 400)))))
    (sleep-for (/ (float (random 1000)) 5000))
    (delete-other-frames)))

Take a look at this part of the attached back-trace.

#0  0x00000000004f9b0e in frame_highlight (f=0x132b510) at xterm.c:3204
#4  0x00000000004fa4ae in x_detect_focus_change (dpyinfo=0x15ba800, frame=0x11c7e68, 
    event=0x7fffffffb300, bufp=0x7fffffffae50) at xterm.c:3522
#14 0x00000000004ff413 in XTread_socket (...) at xterm.c:7066
#19 0x00000000005409e7 in unblock_input () at keyboard.c:7116
#20 0x0000000000503f82 in x_free_frame_resources (f=0x132b510) at xterm.c:9383
#21 0x0000000000503fbf in x_destroy_window (f=0x132b510) at xterm.c:9397
#22 0x00000000004274b7 in delete_frame (frame=20100373, force=12634498) at frame.c:1362
#23 0x000000000042784e in Fdelete_frame (frame=20100373, force=12634498) at frame.c:1495

Note that the freed frame in #20 is the same as the one about to
be highlighted in #0.  delete_frame would later execute

    f->terminal = 0;             /* Now the frame is dead.  */

but won't, since x_destroy_window has not returned yet.  But
x_free_frame_resources has executed

    f->output_data.x = NULL;

, so FRAME_LIVE_P(f) is still true, but FRAME_X_DISPLAY is no
good at this moment.  Then in x_frame_rehighlight the deleted
frame becomes the x_highlight_frame.


(gdb) p /x dpyinfo->x_focus_frame
$30 = 0x11c7e68
(gdb) p /x dpyinfo->x_highlight_frame 
$27 = 0x132b510
(gdb) pp dpyinfo->x_focus_frame.focus_frame
#<frame emacs@luca 0x132b510>
(gdb) p /x dpyinfo->x_highlight_frame.output_data.x
$36 = 0x0
(gdb) p /x dpyinfo->x_highlight_frame.terminal
$37 = 0x110e398

The second if condition is false (FRAME_LIVE_P) and
frame_highlight gets called with the halfway deleted frame, calls
FRAME_X_DISPLAY and that's the end.

-ap