Comment 8 for bug 1203273

This is on a thinkpad T410 with Intel HD Graphics 5700MHD.

Since updating again to xorg-x11-drv-intel-2.21.12-1.fc18.x86_64 (.8 was also showing this same bug, 2.20 was not) on Fedora 18 I can reliably reproduce a segfault by min/maxing windows of some specific apps (sometimes also occurs under other conditions). This is with SNA enabled.

Xorg log backtrace seems bogus:

[220957.400] (EE)
[220957.400] (EE) Backtrace:
[220957.425] (EE) 0: /usr/bin/X (OsLookupColor+0x139) [0x472509]
[220957.427] (EE) 1: /lib64/libpthread.so.0 (__restore_rt+0x0) [0x3d9d00efff]
[220957.435] (EE) 2: /usr/lib64/xorg/modules/drivers/intel_drv.so (_init+0x2cad6) [0x7f6737f4ed96]
[220957.440] (EE) 3: /usr/lib64/xorg/modules/drivers/intel_drv.so (_init+0x4befe) [0x7f6737f8d30e]
[220957.441] (EE) 4: /usr/bin/X (BlockHandler+0x44) [0x43d9c4]
[220957.442] (EE) 5: /usr/bin/X (WaitForSomething+0x114) [0x469e84]
[220957.442] (EE) 6: /usr/bin/X (SendErrorToClient+0xe1) [0x4395d1]
[220957.443] (EE) 7: /usr/bin/X (_init+0x3a7a) [0x42b98a]
[220957.446] (EE) 8: /lib64/libc.so.6 (__libc_start_main+0xf5) [0x3d9c821a05]
[220957.447] (EE) 9: /usr/bin/X (_start+0x29) [0x428621]
[220957.447] (EE)
[220957.447] (EE) Segmentation fault at address 0x26
[220957.447]
Fatal server error:
[220957.448] Caught signal 11 (Segmentation fault). Server aborting
[220957.448]
[220957.448] (EE)

gdb backtrace shows:
Program received signal SIGSEGV, Segmentation fault.
has_offload_slaves (sna=0x7f6736c30000) at sna_accel.c:14700
14700 ScreenPtr screen = sna->scrn->pScreen;
(gdb) bt
#0 has_offload_slaves (sna=0x7f6736c30000) at sna_accel.c:14700
#1 0x00007f6737f416ee in stop_flush (scanout=0x10d7ab0, sna=0x7f6736c30000)
    at sna_accel.c:14763
#2 sna_accel_flush (sna=0x7f6736c30000) at sna_accel.c:14985
#3 sna_accel_block_handler (sna=0x7f6736c30000, tv=0x7fffda2846d8)
    at sna_accel.c:15425
#4 0x000000000043d9c4 in BlockHandler (
    pTimeout=pTimeout@entry=0x7fffda2846d8,
    pReadmask=pReadmask@entry=0x81c340 <LastSelectMask>) at dixutils.c:387
#5 0x0000000000469e84 in WaitForSomething (
    pClientsReady=pClientsReady@entry=0x133fa20) at WaitFor.c:210
#6 0x0000000000439581 in Dispatch () at dispatch.c:357
#7 0x00000000004282da in main (argc=9, argv=0x7fffda284ae8,
    envp=<optimized out>) at main.c:298