Calling M-x instantly segfaults with my current Emacs configuration and
set of installed packages.  It seems to happen only under emacsclient,
not emacs.

Among many other things, my configuration remaps
execute-extended-command to counsel-M-x from the Counsel package, and
sets read-extended-command-predicate to
command-completion-default-include-p.

Here's how I reproduce the segfault:

0. cd src
1. gdb ./emacs
2. r --fg-daemon=blc
3. emacsclient -s blc -c
4. M-x

Here's the GDB session: