Here is what to do to reproduce the segfault (I'm on gentoo-amd64, using 
xorg-6.7.99.904) 
 
Xnest :1 -ac & 
xclock -display :1 
 
Now kill xclock with ctrl-c, and Xnest segfaults.  
I've tried to trace down the problem, but I suspect either memory-corruption or 
a fault in some other lib, making it very hard to find the problem. I've got a 
backtrace: 
 
#0  0x0000000000bad7e0 in ?? () 
No symbol table info available. 
#1  0x00000000004be794 in getDrawableDamageRef (pDrawable=0xbc7760) 
    at damage.c:91 
        pScreen = 0xae3330 
        pPixmap = 0x0 
#2  0x00000000004c3483 in damagePaintWindow (pWindow=0xbc7760, 
    prgn=0x75fce78120, what=0) at damage.c:1559 
        pScreen = 0xae3330 
        pScrPriv = 0xacbff0 
#3  0x00000000005647ed in miWindowExposures (pWin=0xbc7760, 
prgn=0x75fce78120, 
    other_exposed=0x0) at miexpose.c:564 
        expRec = {extents = {x1 = -32544, y1 = -793, x2 = 117, y2 = 0}, 
  data = 0xbc77b0} 
        clientInterested = 0 
        exposures = 0x75fce78120 
#4  0x000000000046007a in MapWindow (pWin=0xbc7760, client=0xacb630) 
    at window.c:2827 
        temp = {extents = {x1 = 0, y1 = 0, x2 = 960, y2 = 768}, data = 0x0} 
        pScreen = 0xae3330 
        pParent = 0x0 
        dosave = 0 
        pLayerWin = 0xbc7760 
---Type <return> to continue, or q <return> to quit--- 
#5  0x000000000045a56b in InitRootWindow (pWin=0xbc7760) at 
window.c:511 
        pScreen = 0xae3330 
#6  0x0000000000457526 in main (argc=3, argv=0x75fce78278, 
envp=0x75fce78298) 
    at main.c:424 
        i = 0 
        j = 2 
        k = 2 
        error = 266455573 
        xauthfile = 0x75fce79255 "/home/benjamin/.Xauthority" 
        alwaysCheckForInput = {0, 1} 
 
It looks like, the pScreen->GetWindowPixmap (from damage.c:91) is broken. 
The value of GetWindowPixmap isn't always the same. The bug isn't 100% 
reproducable, but nearly 100% (I've been able to not-crash about 2 times out of 
20)