Hmm, there's a second, rarer (~40000 repeats) crash after the first fix:

(gdb) info threads
  Id   Target Id         Frame 
  3    Thread 0x7f71fa2d1700 (LWP 17905) 0x00007f71fe274a77 in sched_yield () at ../sysdeps/unix/syscall-template.S:81
  2    Thread 0x7f7200cdc7c0 (LWP 30386) 0x00007f71fe55c8ed in pthread_join (threadid=140127513684432, thread_return=0x0) at pthread_join.c:90
* 1    Thread 0x7f71faad2700 (LWP 17904) 0x0000000000000000 in ?? ()
(gdb) bt
#0  0x0000000000000000 in ?? ()
#1  0x00007f71fed2b94f in google::protobuf::MessageLite::ParseFromString(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&) () from /usr/lib/x86_64-linux-gnu/libprotobuf-lite.so.9
#2  0x00007f71fff7a7ec in mir::client::rpc::MirProtobufRpcChannel::on_data_available (this=0x1e6b470)
    at /home/alan/display_server/mir2/src/client/rpc/mir_protobuf_rpc_channel.cpp:386
#3  0x00007f71fff72597 in mir::client::rpc::TransportObservers::<lambda(auto:1)>::operator()<std::shared_ptr<mir::client::rpc::StreamTransport::Observer> >(std::shared_ptr<mir::client::rpc::StreamTransport::Observer>) const (__closure=0x7f71faad1b10, observer=warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
std::shared_ptr (count 3, weak 0) 0x1e6b480)
    at /home/alan/display_server/mir2/src/client/rpc/stream_socket_transport.cpp:40
#4  0x00007f71fff7362e in std::_Function_handler<void(const std::shared_ptr<mir::client::rpc::StreamTransport::Observer>&), mir::client::rpc::TransportObservers::on_data_available()::<lambda(auto:1)> >::_M_invoke(const std::_Any_data &, const std::shared_ptr<mir::client::rpc::StreamTransport::Observer> &)
    (__functor=..., __args#0=warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
std::shared_ptr (count 3, weak 0) 0x1e6b480) at /usr/include/c++/5/functional:1871
#5  0x00007f71fff74f09 in std::function<void (std::shared_ptr<mir::client::rpc::StreamTransport::Observer> const&)>::operator()(std::shared_ptr<mir::client::rpc::StreamTransport::Observer> const&) const (this=0x7f71faad1b10, __args#0=warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
warning: RTTI symbol not found for class 'std::_Sp_counted_deleter<mir::client::rpc::MirProtobufRpcChannel*, mir::client::rpc::MirProtobufRpcChannel::MirProtobufRpcChannel(std::unique_ptr<mir::client::rpc::StreamTransport, std::default_delete<mir::client::rpc::StreamTransport> >, std::shared_ptr<mir::client::SurfaceMap> const&, std::shared_ptr<mir::client::DisplayConfiguration> const&, std::shared_ptr<mir::client::rpc::RpcReport> const&, std::shared_ptr<mir::client::AtomicCallback<MirLifecycleState> > const&, std::shared_ptr<mir::client::AtomicCallback<int> > const&, std::shared_ptr<mir::client::EventSink> const&)::NullDeleter, std::allocator<void>, (__gnu_cxx::_Lock_policy)2>'
std::shared_ptr (count 3, weak 0) 0x1e6b480)
    at /usr/include/c++/5/functional:2271
#6  0x00007f71fff74189 in mir::ThreadSafeList<std::shared_ptr<mir::client::rpc::StreamTransport::Observer> >::for_each(std::function<void (std::shared_ptr<mir::client::rpc::StreamTransport::Observer> const&)> const&) (this=0x1e6b380, f=...)
    at /home/alan/display_server/mir2/src/include/common/mir/thread_safe_list.h:80
#7  0x00007f71fff725e2 in mir::client::rpc::TransportObservers::on_data_available (this=0x1e6b378)
    at /home/alan/display_server/mir2/src/client/rpc/stream_socket_transport.cpp:40
#8  0x00007f71fff731c2 in mir::client::rpc::StreamSocketTransport::dispatch (this=0x1e6b360, events=1)
    at /home/alan/display_server/mir2/src/client/rpc/stream_socket_transport.cpp:208
#9  0x00007f71ff7ece82 in mir::dispatch::MultiplexingDispatchable::dispatch (this=0x1e6b610, events=1)
    at /home/alan/display_server/mir2/src/common/dispatch/multiplexing_dispatchable.cpp:210
#10 0x00007f71fff7abe5 in mir::client::rpc::MirProtobufRpcChannel::dispatch (this=0x1e6b470, events=1)
    at /home/alan/display_server/mir2/src/client/rpc/mir_protobuf_rpc_channel.cpp:434
#11 0x00007f71ff7ece82 in mir::dispatch::MultiplexingDispatchable::dispatch (this=0x1e6bcb0, events=1)
    at /home/alan/display_server/mir2/src/common/dispatch/multiplexing_dispatchable.cpp:210
#12 0x00007f71ff7f001e in (anonymous namespace)::dispatch_loop(const std::__cxx11::string &, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::Dispatchable>, const std::function<void()> &) (name="RPC Thread", 
    thread_register=std::shared_ptr (count 4, weak 0) 0x1e6bb60, dispatcher=std::shared_ptr (count 2, weak 0) 0x1e6bcb0, exception_handler=...)
    at /home/alan/display_server/mir2/src/common/dispatch/threaded_dispatcher.cpp:211
#13 0x00007f71ff7fc00b in std::_Bind_simple<void (*(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::MultiplexingDispatchable>, std::function<void ()>))(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::Dispatchable>, std::function<void ()> const&)>::_M_invoke<0ul, 1ul, 2ul, 3ul>(std::_Index_tuple<0ul, 1ul, 2ul, 3ul>)
    (this=0x1e685f8) at /usr/include/c++/5/functional:1531
#14 0x00007f71ff7fbb2c in std::_Bind_simple<void (*(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::MultiplexingDispatchable>, std::function<void ()>))(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::Dispatchable>, std::function<void ()> const&)>::operator()() (this=0x1e685f8) at /usr/include/c++/5/functional:1520
#15 0x00007f71ff7fb3da in std::thread::_Impl<std::_Bind_simple<void (*(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> >, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::MultiplexingDispatchable>, std::function<void ()>))(std::__cxx11::basic_string<char, std::char_traits<char>, std::allocator<char> > const&, std::shared_ptr<mir::dispatch::ThreadedDispatcher::ThreadShutdownRequestHandler>, std::shared_ptr<mir::dispatch::Dispatchable>, std::function<void ()> const&)> >::_M_run() (this=0x1e685e0)
    at /usr/include/c++/5/thread:115
#16 0x00007f71fea42030 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#17 0x00007f71fe55b6aa in start_thread (arg=0x7f71faad2700) at pthread_create.c:333
#18 0x00007f71fe290eed in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:109