Interestingly, I'm not getting any XFCE-related crashes when I use gnome-boxes rather than QEMU. The process that is crashing is actually X.

I got a backtrace from it:

(gdb) bt -full
#0  __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)
    at ./nptl/pthread_kill.c:44
        tid = <optimized out>
        ret = 0
        pd = <optimized out>
        old_mask = {__val = {0}}
        ret = <optimized out>
        pd = <optimized out>
        old_mask = <optimized out>
        ret = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
        resultvar = <optimized out>
        resultvar = <optimized out>
        __arg3 = <optimized out>
        __arg2 = <optimized out>
        __arg1 = <optimized out>
        _a3 = <optimized out>
        _a2 = <optimized out>
        _a1 = <optimized out>
        __futex = <optimized out>
        resultvar = <optimized out>
        __arg3 = <optimized out>
        __arg2 = <optimized out>
        __arg1 = <optimized out>
        _a3 = <optimized out>
        _a2 = <optimized out>
        _a1 = <optimized out>
        __futex = <optimized out>
        __private = <optimized out>
        __oldval = <optimized out>
#1  __pthread_kill_internal (signo=6, threadid=<optimized out>)
    at ./nptl/pthread_kill.c:78
No locals.
#2  __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
    at ./nptl/pthread_kill.c:89
No locals.
#3  0x00007f39b123c406 in __GI_raise (sig=sig@entry=6)
    at ../sysdeps/posix/raise.c:26
        ret = <optimized out>
#4  0x00007f39b122287c in __GI_abort () at ./stdlib/abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, 
          sa_mask = {__val = {0 <repeats 16 times>}}, sa_flags = 67108868, 
          sa_restorer = 0x7f39b123c4b0 <__restore_rt>}
#5  0x0000558075c86b60 in OsAbort () at ../../../../os/utils.c:1352
No locals.
#6  0x0000558075c8c319 in AbortServer () at ../../../../os/log.c:879
No locals.
#7  0x0000558075c8d359 in FatalError (
    f=f@entry=0x558075cbee90 "Caught signal %d (%s). Server aborting\n")
    at ../../../../os/log.c:1017
        args = {{gp_offset = 24, fp_offset = 48, 
            overflow_arg_area = 0x7ffd9edeb5a0, 
            reg_save_area = 0x7ffd9edeb4d0}}
        args2 = {{gp_offset = 8, fp_offset = 48, 
            overflow_arg_area = 0x7ffd9edeb5a0, 
            reg_save_area = 0x7ffd9edeb4d0}}
        beenhere = 1
#8  0x0000558075c83ddc in OsSigHandler (unused=<optimized out>, 
    sip=<optimized out>, signo=6) at ../../../../os/osinit.c:156
No locals.
#9  OsSigHandler (signo=6, sip=<optimized out>, unused=<optimized out>)
    at ../../../../os/osinit.c:110
No locals.
#10 <signal handler called>
No locals.
#11 __pthread_kill_implementation (no_tid=0, signo=6, threadid=<optimized out>)
    at ./nptl/pthread_kill.c:44
        tid = <optimized out>
        ret = 0
        pd = <optimized out>
        old_mask = {__val = {139885759425152}}
        ret = <optimized out>
        pd = <optimized out>
        old_mask = <optimized out>
        ret = <optimized out>
        tid = <optimized out>
        ret = <optimized out>
        resultvar = <optimized out>
        resultvar = <optimized out>
        __arg3 = <optimized out>
        __arg2 = <optimized out>
        __arg1 = <optimized out>
        _a3 = <optimized out>
        _a2 = <optimized out>
        _a1 = <optimized out>
        __futex = <optimized out>
        resultvar = <optimized out>
        __arg3 = <optimized out>
        __arg2 = <optimized out>
        __arg1 = <optimized out>
        _a3 = <optimized out>
        _a2 = <optimized out>
        _a1 = <optimized out>
        __futex = <optimized out>
        __private = <optimized out>
        __oldval = <optimized out>
#12 __pthread_kill_internal (signo=6, threadid=<optimized out>)
    at ./nptl/pthread_kill.c:78
No locals.
#13 __GI___pthread_kill (threadid=<optimized out>, signo=signo@entry=6)
    at ./nptl/pthread_kill.c:89
No locals.
#14 0x00007f39b123c406 in __GI_raise (sig=sig@entry=6)
    at ../sysdeps/posix/raise.c:26
        ret = <optimized out>
#15 0x00007f39b122287c in __GI_abort () at ./stdlib/abort.c:79
        save_stage = 1
        act = {__sigaction_handler = {sa_handler = 0x20, sa_sigaction = 0x20}, 
          sa_mask = {__val = {94010244971792, 110, 0, 139885763323770, 0, 
              49245412224, 0, 140727268852584, 15975794021409362944, 5, 
              18446744073709550696, 11, 94010220322512, 122, 94010220302986, 
              94010220853328}}, sa_flags = -1322649741, 
          sa_restorer = 0x7f39b13b677a <_nl_C_name>}
#16 0x00007f39b122279b in __assert_fail_base (
    fmt=0x7f39b13b9f68 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n", 
    assertion=assertion@entry=0x558075c9528a "key->initialized", 
    file=file@entry=0x558075c99ed0 "../../../../../../include/privates.h", 
    line=line@entry=122, 
    function=function@entry=0x558075cb9580 <__PRETTY_FUNCTION__.7> "dixGetPrivateAddr") at ./assert/assert.c:92
        str = 0x55807741bd10 "\273\2238/\205U"
        total = 4096
#17 0x00007f39b1233b86 in __assert_fail (
    assertion=assertion@entry=0x558075c9528a "key->initialized", 
    file=file@entry=0x558075c99ed0 "../../../../../../include/privates.h", 
    line=line@entry=122, 
    function=function@entry=0x558075cb9580 <__PRETTY_FUNCTION__.7> "dixGetPrivateAddr") at ./assert/assert.c:101
No locals.
#18 0x0000558075c3ba25 in dixGetPrivateAddr (
    key=0x558075d57020 <dri2ClientPrivateKeyRec>, privates=0x71)
    at ../../../../../../include/privates.h:122
        __PRETTY_FUNCTION__ = "dixGetPrivateAddr"
#19 0x0000558075c3dd25 in dixGetPrivateAddr (key=<optimized out>, 
    privates=<optimized out>) at ../../../../../../include/privates.h:167
        __PRETTY_FUNCTION__ = "dixGetPrivateAddr"
#20 dixLookupPrivate (key=<optimized out>, privates=<optimized out>)
    at ../../../../../../include/privates.h:165
No locals.
#21 DRI2Authenticate (client=client@entry=0x558077415b80, 
    pScreen=<optimized out>, magic=1)
    at ../../../../../../hw/xfree86/dri2/dri2.c:1365
        ds = <optimized out>
        dri2_client = <optimized out>
        primescreen = <optimized out>
#22 0x0000558075c3eaab in ProcDRI2Authenticate (client=0x558077415b80)
    at ../../../../../../hw/xfree86/dri2/dri2ext.c:156
        stuff = 0x5580774347b0
        rep = {type = 0 '\000', pad1 = 0 '\000', sequenceNumber = 0, 
          length = 0, authenticated = 2000771968, pad2 = 21888, 
          pad3 = 1976678512, pad4 = 21888, pad5 = 1976679392, pad6 = 21888}
        pDraw = 0x5580763743a0
        status = 0
#23 ProcDRI2Dispatch (client=0x558077415b80)
    at ../../../../../../hw/xfree86/dri2/dri2ext.c:609
        stuff = 0x5580774347b0
#24 0x0000558075b0cef4 in Dispatch () at ../../../../dix/dispatch.c:550
        result = <optimized out>
        client = 0x558077415b80
        start_tick = 60
#25 0x0000558075b10f3c in dix_main (argc=11, argv=<optimized out>, 
    envp=<optimized out>) at ../../../../dix/main.c:272
        i = <optimized out>
        alwaysCheckForInput = {0, 1}
#26 0x00007f39b1223a90 in __libc_start_call_main (
    main=main@entry=0x558075afa020 <main>, argc=argc@entry=11, 
    argv=argv@entry=0x7ffd9edec698)
    at ../sysdeps/nptl/libc_start_call_main.h:58
        self = <optimized out>
        result = <optimized out>
        unwind_buf = {cancel_jmp_buf = {{jmp_buf = {140727268853400, 
                -7547088934788218713, 0, 140727268853496, 94010220794264, 
                139885770768384, 7545894580288012455, 7579620698683130023}, 
              mask_was_saved = 0}}, priv = {pad = {0x0, 0x0, 0x7ffd9edec698, 
              0x7ffd9edec698}, data = {prev = 0x0, cleanup = 0x0, 
              canceltype = -1629567336}}}
        not_first_call = <optimized out>
#27 0x00007f39b1223b49 in __libc_start_main_impl (main=0x558075afa020 <main>, 
    argc=11, argv=0x7ffd9edec698, init=<optimized out>, fini=<optimized out>, 
    rtld_fini=<optimized out>, stack_end=0x7ffd9edec688)
    at ../csu/libc-start.c:360
No locals.
#28 0x0000558075afa055 in _start ()
No symbol table info available.