On the latest emacs-26 and master branches, calling the function
frame-list-z-order crashes a daemon Emacs via segfault:

1. ./src/emacs -Q --daemon=<name>
2. ./lib-src/emacsclient --socket-name=<name> --create-frame
3. cd src
4. gdb -p <PID of step (1)>
5. Issue 'continue' in gdb
6. Evaluating (frame-list-z-order) in the emacsclient frame gives the
   following output in gdb:

Thread 1 "emacs" received signal SIGSEGV, Segmentation fault.
0x0000000000565112 in x_frame_list_z_order (dpy=0x33018f0, window=227) at xfns.c:5306
5306		    if (XFRAME (frame)->output_data.x->parent_desc == children[i]

Issuing 'set logging on' followed by 'bt full' in gdb at this point
gives the attached backtrace.

A quick step-through of x_frame_list_z_order indicates that the members
of the struct XFRAME (frame)->output_data are initialised to NULL for
the initial daemon frame F1.

Some information gathered by report-emacs-bug follows my signature.
Please let me know if I can provide any further information.

Thanks,

-- 
Basil

In GNU Emacs 26.1 (build 2, x86_64-pc-linux-gnu, X toolkit, Xaw3d scroll bars)
 of 2018-05-06 built on thunk
Repository revision: 91a68b5f61db50344c6a5df497f55370d54a7b15
Windowing system distributor 'The X.Org Foundation', version 11.0.11906000
System Description:	Debian GNU/Linux testing (buster)

Configured using:
 'configure 'CC=ccache gcc' 'CFLAGS=-O0 -g3 -ggdb -gdwarf-4 -pipe'
 --config-cache --prefix=/home/blc/.local --program-suffix=26
 --enable-checking=yes,glyphs --enable-check-lisp-object-type
 --with-mailutils --with-x-toolkit=lucid --with-modules
 --with-file-notification=yes --with-x'

Configured features:
XAW3D XPM JPEG TIFF GIF PNG RSVG IMAGEMAGICK SOUND GPM DBUS GSETTINGS
NOTIFY ACL LIBSELINUX GNUTLS LIBXML2 FREETYPE M17N_FLT LIBOTF XFT ZLIB
TOOLKIT_SCROLL_BARS LUCID X11 MODULES THREADS LIBSYSTEMD LCMS2

Important settings:
  value of $LANG: en_IE.UTF-8
  locale-coding-system: utf-8-unix