mir_demo_server_shell crashes with --display-config=sidebyside

Running: bin/mir_demo_server_shell --display-config=sidebyside

Seems to (sometimes, now most of the time) crash with:
#0 0x00007f6ef8f81037 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007f6ef8f84698 in __GI_abort () at abort.c:90
#2 0x00007f6ef8fbe5ab in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7f6ef90d1860 "*** Error in `%s': %s: 0x%s ***\n") at ../sysdeps/unix/sysv/linux/libc_fatal.c:199
#3 0x00007f6ef8fcaa46 in malloc_printerr (ptr=0x7f6ed80046b0, str=0x7f6ef90d1a28 "double free or corruption (fasttop)", action=3) at malloc.c:4902
#4 _int_free (av=<optimised out>, p=0x7f6ed80046a0, have_lock=0) at malloc.c:3758
#5 0x00007f6ef4a439fc in _mesa_symbol_table_dtor () from /usr/lib/x86_64-linux-gnu/libdricore9.2.0-devel.so.1
#6 0x00007f6ef49e660d in glsl_symbol_table::~glsl_symbol_table() () from /usr/lib/x86_64-linux-gnu/libdricore9.2.0-devel.so.1
#7 0x00007f6ef49f7b73 in link_shaders(gl_context*, gl_shader_program*) () from /usr/lib/x86_64-linux-gnu/libdricore9.2.0-devel.so.1
#8 0x00007f6ef4a31a1b in _mesa_glsl_link_shader () from /usr/lib/x86_64-linux-gnu/libdricore9.2.0-devel.so.1
#9 0x00007f6ef48f209e in ?? () from /usr/lib/x86_64-linux-gnu/libdricore9.2.0-devel.so.1
#10 0x00007f6efa11ad94 in mir::compositor::GLRenderer::Resources::setup (this=0x7f6ee0000e08, display_area=...) at /home/dan/bzr/mir/trunk/src/server/compositor/gl_renderer.cpp:178
#11 0x00007f6efa11b322 in mir::compositor::GLRenderer::GLRenderer (this=0x7f6ee0000e00, display_area=...) at /home/dan/bzr/mir/trunk/src/server/compositor/gl_renderer.cpp:239
#12 0x00007f6efa11c38b in mir::compositor::GLRendererFactory::create_renderer_for (this=0x24cdfb8, rect=...) at /home/dan/bzr/mir/trunk/src/server/compositor/gl_renderer_factory.cpp:29
#13 0x00007f6efa10dc3c in mir::compositor::DefaultDisplayBufferCompositorFactory::create_compositor_for (this=0x24c3478, display_buffer=...) at /home/dan/bzr/mir/trunk/src/server/compositor/default_display_buffer_compositor_factory.cpp:43
#14 0x00007f6efa11da46 in mir::compositor::CompositingFunctor::operator() (this=0x2643080) at /home/dan/bzr/mir/trunk/src/server/compositor/multi_threaded_compositor.cpp:77
#15 0x00007f6efa120cb9 in std::__invoke<mir::compositor::CompositingFunctor> (__f=...) at /usr/include/c++/4.8/functional:234
#16 0x00007f6efa120c8e in std::reference_wrapper<mir::compositor::CompositingFunctor>::operator()<>() const (this=0x25c8330) at /usr/include/c++/4.8/functional:467
#17 0x00007f6efa120c28 in std::_Bind_simple<std::reference_wrapper<mir::compositor::CompositingFunctor> ()>::_M_invoke<>(std::_Index_tuple<>) (this=0x25c8330) at /usr/include/c++/4.8/functional:1732
#18 0x00007f6efa120b75 in std::_Bind_simple<std::reference_wrapper<mir::compositor::CompositingFunctor> ()>::operator()() (this=0x25c8330) at /usr/include/c++/4.8/functional:1720
#19 0x00007f6efa120b0e in std::thread::_Impl<std::_Bind_simple<std::reference_wrapper<mir::compositor::CompositingFunctor> ()> >::_M_run() (this=0x25c8318) at /usr/include/c++/4.8/thread:115
#20 0x00007f6ef95d9c80 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#21 0x00007f6ef9833f8e in start_thread (arg=0x7f6ee7f34700) at pthread_create.c:311
#22 0x00007f6ef9043e1d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113

Unfortunately it's a bit of a Heisenbug and doesn't happen under Valgrind or MALLOC_CHECK_.