If remain-on-exit is set, both the error callback and a SIGCHLD could

destroy the same pane (because the first one doesn't remove it from the
list of panes), causing the pane bufferevent to be freed twice. So don't
free it if the fd has already been set to -1, from Romain Francoise.

server-fn.c

@@ -325,9 +325,11 @@ server_destroy_pane(struct window_pane *wp)
 {
 	struct window	*w = wp->window;
 
-	close(wp->fd);
-	bufferevent_free(wp->event);
-	wp->fd = -1;
+	if (wp->fd != -1) {
+		close(wp->fd);
+		bufferevent_free(wp->event);
+		wp->fd = -1;
+	}
 
 	if (options_get_number(&w->options, "remain-on-exit"))
 		return;