I found a fairly reliable way to reproduce this - log in and hold down CTRL-F1 which in my window manager (sawfish) starts a pterm. I was able to get a backtrace this time, having installed the debug version of the server.
AFAICS the problem is that an XKB-related bug fix doesn't take into account the possibility that you used the -kb option when invoking the server. (Turning XKB back on makes the crash go away but also breaks all my keyboard configuration.) I'm attempting a rebuild with this patch. I'll let the bug report know how it goes. ------------------------------------------------------------------------ --- xc/programs/Xserver/dix/events.c~ 2004-04-06 20:01:52.000000000 +0100 +++ xc/programs/Xserver/dix/events.c 2004-04-06 20:30:39.000000000 +0100 @@ -991,7 +991,7 @@ #ifdef XKB /* Fix for key repeating bug. */ - if (xE->u.u.type == KeyRelease) + if (xE->u.u.type == KeyRelease && device->key->xkbInfo) AccessXCancelRepeatKey(device->key->xkbInfo, xE->u.u.detail); #endif ------------------------------------------------------------------------ ttfn/rjk GNU gdb 5.3-debian Copyright 2002 Free Software Foundation, Inc. GDB is free software, covered by the GNU General Public License, and you are welcome to change it and/or distribute copies of it under certain conditions. Type "show copying" to see the conditions. There is absolutely no warranty for GDB. Type "show warranty" for details. This GDB was configured as "i386-linux"... warning: core file may not match specified executable file. Core was generated by `/usr/X11R6/bin/X -dpi 75 -nolisten tcp -kb +bs -deferglyphs all -auth /var/lib/'. Program terminated with signal 6, Aborted. Reading symbols from /usr/lib/libfreetype.so.6...done. Loaded symbols for /usr/lib/libfreetype.so.6 Reading symbols from /usr/lib/libz.so.1...done. Loaded symbols for /usr/lib/libz.so.1 Reading symbols from /lib/libm.so.6...done. Loaded symbols for /lib/libm.so.6 Reading symbols from /lib/libc.so.6...done. Loaded symbols for /lib/libc.so.6 Reading symbols from /lib/ld-linux.so.2...done. Loaded symbols for /lib/ld-linux.so.2 Reading symbols from /lib/libnss_files.so.2...done. Loaded symbols for /lib/libnss_files.so.2 #0 0x400f1571 in kill () from /lib/libc.so.6 (gdb) dir /export/sources/xfree86-4.3.0/build-tree/xc/programs/Xserver/dix Source directories searched: /export/sources/xfree86-4.3.0/build-tree/xc/programs/Xserver/dix:$cdir:$cwd (gdb) fr 9 #9 0x0848f58d in EnqueueEvent (xE=0xbffff720, device=0x8b61a28, count=1) at events.c:995 warning: Source file is more recent than executable. 995 AccessXCancelRepeatKey(device->key->xkbInfo, xE->u.u.detail); (gdb) print device->key->xkbInfo $1 = (struct _XkbSrvInfo *) 0x0 (gdb) quit