If a GLXMakeCurrent request specifies an X window as its drawable, __glXGetDrawable will implicitly create a GLXWindow for it. However, the client may have already explicitly created a GLXWindow for that X window. If that happens, two __glXDrawableRes resources will be added to the window.
If the explicitly-created GLXWindow is later destroyed by the client, DrawableGone will call FreeResourceByType on the X window, but this will actually free the resource for the implicitly-created GLXWindow, since that one would be at the head of the list.
Then if the X window is destroyed after that, the resource for the explicitly-created GLXWindow will be freed. But that GLXWindow was already destroyed above. This crashes the server when it tries to call the destroyed GLXWindow's destructor. It also means the implicitly-created GLXWindow would have been leaked since the FreeResourceByType call mentioned above skips calling the destructor.
To fix this, if __glXGetDrawable is given an X window, it should check if there is already a GLXWindow associated with it, and only create an implicit one if there is not.