You should be able to reproduce with the following script (I open termite windows but you can use any program you want):
CUR=$(bspc query -D -d focused)
NEXT=$(bspc query -D -d next)
# Start floating window
bspc rule -a termite --one-shot --floating --sticky
termite &
sleep 1
# Start window on next desktop.
bspc rule -a termite --one-shot -d $NEXT
termite &
sleep 1
# Toggle back and forth
bspc desktop -f $NEXT
sleep 1
bspc desktop -f $NEXT
sleep 1
bspc desktop -f $NEXT
sleep 1
# Close the biggest window (the terminal on $NEXT). bspwm will crash once all
# windows on the desktop have been closed.
bspc window -f biggest
xdo close
I've actually reproduced the bug in several ways but this is the most reliable method.
Here are some different gdb back traces:
% print bt full
#0 0x0000000000409ed9 in stack (n=0x1743780, f=STACK_ABOVE) at stack.c:118
s = 0x17416a0
latest_tiled = 0x0
oldest_floating = 0x0
#1 0x000000000040dc93 in set_floating (n=0x1743780, value=true) at window.c:411
c = 0x17436e0
#2 0x000000000040ca6a in manage_window (m=0x1741bf0, d=0x1741e50, win=20971523) at window.c:84
loc = {monitor = 0x3e600000000, desktop = 0x40b0a4 <property_notify+53>, node = 0x1743300}
wa = 0x1743880
override_redirect = 0 '\000'
floating = true
fullscreen = false
locked = false
sticky = true
follow = false
transient = false
takes_focus = true
frame = false
private = false
manage = true
c = 0x17436e0
reply = {instance_name = 0x17439e0 "ftjerm", class_name = 0x17439e7 "Ftjerm", _reply = 0x17439c0}
n = 0x1743780
give_focus = false
values = {282734000}
#3 0x000000000040ab9a in map_request (evt=0x173fdf0) at events.c:82
e = 0x173fdf0
#4 0x000000000040aaa5 in handle_event (evt=0x173fdf0) at events.c:40
resp_type = 20 '\024'
#5 0x0000000000403cc3 in main (argc=1, argv=0x3e610da71b8) at bspwm.c:168
descriptors = {__fds_bits = {128, 0 <repeats 15 times>}}
socket_path = "/run/user/1000/bspwm-socket-c2\000\000h;\310\304\334\003\000\000ބ\251\304\334\003\000\000\000\000\000\000\000\000\000\000`o\332\020\346\003\000\000(\255\272\303\334\003\000\000\250q\273\303\334\003\000\000pp\332\020\346\003\000\000\070\365\330\003\000\000\000\000`p\332\020\346\003\000\000\310\006\313\304\334\003\000\000\000\000\000\000\000\000\000\000\350;\310\304\334\003\000\000\310I\310\304\334\003\000\000\300\034@\000\000\000\000\000x}\273\303\334\003\000\000\020\t@\000\000\000\000\000\000\000\000\000\001\000\000\000\060\b\000\000\001\000\000\000\320p\332\020\346\003\000\000\350;\310\304\334\003\000\000\000q\332\020\346\003\000\000\210"...
fifo_path = 0x0
sock_fd = 8
ret_fd = 9
dpy_fd = 7
sel = 9
n = 17
sock_address = {sun_family = 1,
sun_path = "/run/user/1000/bspwm-socket-c2\000\006\313\304\334\003\000\000`\203\251\304\334\003\000\000\000\000\000\000\000\000\000\000\360n\332\020\346\003\000\000`\321\312\304\334\003\000\000\330\321\312\304\334\003\000\000\000p\332\020\346\003\000\000\360o\332\020\346\003\000\000\270o\332\020\346\003\000\000l{\251\304\334\003"}
rsp_len = 0
msg = "desktop\000-f\000\062/Two\000\000phans\000\000jjgafhacjanaoiihapd\000--floating\000--sticky\000\000en\000\062/Eight\000\062/Nine\000\062/Ten", '\000' <repeats 8102 times>
rsp = "\000\000\000S1\nVGA1", '\000' <repeats 8181 times>
event = 0x173fdf0
opt = -1 '\377'
sp = 0x3e610da76ea "/run/user/1000/bspwm-socket-c2"
% print s->node->client
$8 = (client_t *) 0x15d0000015c
% print *s->node->client
Cannot access memory at address 0x15d0000015c
% print bt full
#0 0x0000000000406fd1 in insert_node (m=0x77fbe0, d=0x77fe40, n=0x7816e0, f=0x781780) at tree.c:145
c = 0x7817e0
p = 0x15c00000000
#1 0x000000000040ca2b in manage_window (m=0x77fbe0, d=0x77fe40, win=20971523) at window.c:80
loc = {monitor = 0x3b400000000, desktop = 0x40b0a4 <property_notify+53>, node = 0xc15691c0}
wa = 0x7812c0
override_redirect = 0 '\000'
floating = true
fullscreen = false
locked = false
sticky = false
follow = false
transient = false
takes_focus = true
frame = false
private = false
manage = true
c = 0x781780
reply = {instance_name = 0x780aa0 "ftjerm", class_name = 0x780aa7 "Ftjerm", _reply = 0x780a80}
n = 0x7816e0
give_focus = false
values = {3243676048}
#2 0x000000000040ab9a in map_request (evt=0x77dbd0) at events.c:82
e = 0x77dbd0
#3 0x000000000040aaa5 in handle_event (evt=0x77dbd0) at events.c:40
resp_type = 20 '\024'
#4 0x0000000000403cc3 in main (argc=1, argv=0x3b4c156d598) at bspwm.c:168
descriptors = {__fds_bits = {128, 0 <repeats 15 times>}}
socket_path = "/run/user/1000/bspwm-socket-c2\000\000h\233\360G\212\003\000\000\336\344\321G\212\003\000\000\000\000\000\000\000\000\000\000@\323V\301\264\003\000\000(\r\343F\212\003\000\000\250\321\343F\212\003\000\000P\324V\301\264\003\000\000\070\365\330\003\000\000\000\000@\324V\301\264\003\000\000\310f\363G\212\003\000\000\000\000\000\000\000\000\000\000\350\233\360G\212\003\000\000ȩ\360G\212\003\000\000\300\034@\000\000\000\000\000x\335\343F\212\003\000\000\020\t@\000\000\000\000\000\000\000\000\000\001\000\000\000\060\b\000\000\001\000\000\000\260\324V\301\264\003\000\000\350\233\360G\212\003\000\000\340\324V\301\264\003\000\000\210"...
fifo_path = 0x0
sock_fd = 8
ret_fd = 9
dpy_fd = 7
sel = 9
n = 17
sock_address = {sun_family = 1,
sun_path = "/run/user/1000/bspwm-socket-c2\000f\363G\212\003\000\000`\343\321G\212\003\000\000\000\000\000\000\000\000\000\000\320\322V\301\264\003\000\000`1\363G\212\003\000\000\330\061\363G\212\003\000\000\340\323V\301\264\003\000\000\320\323V\301\264\003\000\000\230\323V\301\264\003\000\000l\333\321G\212\003"}
rsp_len = 0
msg = "desktop\000-f\000\062/Two\000\000phans\000\000jjgafhacjanaoiihapd\000--floating\000--sticky\000\000en\000\062/Eight\000\062/Nine\000\062/Ten", '\000' <repeats 8102 times>
rsp = "\000\000\000S1\nVGA1", '\000' <repeats 8181 times>
event = 0x77dbd0
opt = -1 '\377'
sp = 0x3b4c156dacb "/run/user/1000/bspwm-socket-c2"
% print p
$1 = (node_t *) 0x15c00000000
% print *p
Cannot access memory at address 0x15c00000000
% bt full
#0 0x000000000040801b in next_leaf (n=0x42a4550, r=0x42a4650) at tree.c:498
p = 0x42a4550
#1 0x0000000000416d52 in ewmh_update_client_list () at ewmh.c:131
n = 0x42a4550
d = 0x42a2ad0
m = 0x42a2a50
wins = 0x38458056480
i = 1
#2 0x0000000000409077 in remove_node (m=0x42a2a50, d=0x42a2ad0, n=0x42a4550) at tree.c:894
focused = false
#3 0x000000000040b05a in unmap_notify (evt=0x42a0f80) at events.c:199
e = 0x42a0f80
loc = {monitor = 0x42a2a50, desktop = 0x42a2ad0, node = 0x42a4550}
#4 0x000000000040aac7 in handle_event (evt=0x42a0f80) at events.c:46
resp_type = 18 '\022'
#5 0x0000000000403cc3 in main (argc=1, argv=0x3845805a8f8) at bspwm.c:168
descriptors = {__fds_bits = {128, 0 <repeats 15 times>}}
socket_path = "/run/user/1000/bspwm-socket-c2\000\000h;A!i\003\000\000ބ\"!i\003\000\000\000\000\000\000\000\000\000\000\240\246\005X\204\003\000\000(\255\063 i\003\000\000\250q4 i\003\000\000\260\247\005X\204\003\000\000\070\365\330\003\000\000\000\000\240\247\005X\204\003\000\000\310\006D!i\003\000\000\000\000\000\000\000\000\000\000\350;A!i\003\000\000\310IA!i\003\000\000\300\034@\000\000\000\000\000x}4 i\003\000\000\020\t@\000\000\000\000\000\000\000\000\000\001\000\000\000\060\b\000\000\001\000\000\000\020\250\005X\204\003\000\000\350;A!i\003\000\000@\250\005X\204\003\000\000\210"...
fifo_path = 0x0
sock_fd = 8
ret_fd = 9
dpy_fd = 7
sel = 9
n = 17
sock_address = {sun_family = 1,
sun_path = "/run/user/1000/bspwm-socket-c2\000\006D!i\003\000\000`\203\"!i\003\000\000\000\000\000\000\000\000\000\000\060\246\005X\204\003\000\000`\321C!i\003\000\000\330\321C!i\003\000\000@\247\005X\204\003\000\000\060\247\005X\204\003\000\000\370\246\005X\204\003\000\000l{\"!i\003"}
rsp_len = 0
msg = "desktop\000-f\000\062/Two\000\000phans\000\000jjgafhacjanaoiihapd\000--floating\000--sticky\000\000en\000\062/Eight\000\062/Nine\000\062/Ten", '\000' <repeats 8102 times>
rsp = "\000\000\000S1\nVGA1", '\000' <repeats 8181 times>
event = 0x42a0f80
opt = -1 '\377'
sp = 0x3845805ae25 "/run/user/1000/bspwm-socket-c2"
% print p
$9 = (node_t *) 0x42a4550
% print p->parent
$10 = (node_t *) 0x0
Sticky windows can cause bspwm to segfault.
You should be able to reproduce with the following script (I open termite windows but you can use any program you want):
I've actually reproduced the bug in several ways but this is the most reliable method.
Here are some different gdb back traces: