Comment 6 for bug 1560900

It appears that the session mediator is destroyed before the "complete" functor on LL422-429 is invoked. The session mediator report shows "connection dropped without disconnect" just before getting the segfault. (It also reports this in all the successful runs.)

The fix in -r 3385 ought to be fixing that - ~SessionMediator() calls "shell->close_session(session)" which (indirectly) calls ms::SessionManager::close_session() and that calls "scene_session->force_requests_to_complete()" after which there should be no more callbacks and deletion should proceed.

Or not... BufferQueue::give_buffer_to_client() pulls the completion from pending before releasing a lock. That means that force_requests_to_complete() can get the lock and run before the completion is called.