Description of problem:

With recent Xorg/pixman update I've started to notice frequent Xorg crash.
I'm going to revert some packages back. I've already reverted Intel drivers and started to use Vesa mode - but it's still crashing:

I'm not really sure if the pixman is the faulty part here - could be, that new Xorg is pushing wrong values down the processing queue - feel free to reassign.


Here are some Xorg backtraces:


#0  combine1 (pm=<value optimized out>, ps=<value optimized out>) at pixman-sse2.c:499
499	    uint32_t s = *ps;
(gdb) bt
#0  combine1 (pm=<value optimized out>, ps=<value optimized out>) at pixman-sse2.c:499
#1  coreCombineOverUsse2 (pm=<value optimized out>, ps=<value optimized out>) at pixman-sse2.c:568
#2  fbCompositeSrc_8888x8888sse2 (pm=<value optimized out>, ps=<value optimized out>) at pixman-sse2.c:3063
#3  0x00007fdb7fd213c2 in walk_region_internal (imp=<value optimized out>, op=<value optimized out>, 
    pSrc=<value optimized out>, pMask=<value optimized out>, pDst=<value optimized out>, 
    xSrc=<value optimized out>, ySrc=0, xMask=0, yMask=0, xDst=1, yDst=1, width=16, height=3, srcRepeat=0, 
    maskRepeat=0, region=0x7fffe7effa20, compositeRect=0x7fdb7fd32490 <fbCompositeSrc_8888x8888sse2>)
    at pixman-utils.c:439
#4  0x00007fdb7fd22511 in _pixman_run_fast_path (paths=<value optimized out>, imp=<value optimized out>, 
    op=<value optimized out>, src=0x286ad50, mask=<value optimized out>, dest=<value optimized out>, 
    src_x=<value optimized out>, src_y=<value optimized out>, mask_x=1, mask_y=1, dest_x=16, dest_y=3, 
    width=<value optimized out>, height=<value optimized out>) at pixman-utils.c:681
#5  0x0000000000000000 in ?? ()
(gdb) 


ps seems to be NULL here.


Another one:

#0  fbFetch_x8r8g8b8 (image=0x380e0d0, x=70, y=<value optimized out>, width=<value optimized out>, 
    buffer=0x7fff6e332ac0, mask=0x0, mask_bits=0) at pixman-access.c:100
100		*buffer++ = READ(image, pixel++) | 0xff000000;
(gdb) bt
#0  fbFetch_x8r8g8b8 (image=0x380e0d0, x=70, y=<value optimized out>, width=<value optimized out>, 
    buffer=0x7fff6e332ac0, mask=0x0, mask_bits=0) at pixman-access.c:100
#1  0x00007f9fbe0f5c81 in bits_image_fetch_untransformed_repeat_none (image=0x380e0d0, wide=0, x=70, y=1, 
    width=23, buffer=0x7fff6e332ac0) at pixman-bits-image.c:658
#2  0x00ff00ff00000000 in ?? ()
#3  0x00ff00ff00ff00ff in ?? ()

---
#0  damageRemoveDamage (pDamage=<value optimized out>, pPrev=0x9ae0) at damage.c:1697
1697	    while (*pPrev)
(gdb) bt
#0  damageRemoveDamage (pDamage=<value optimized out>, pPrev=0x9ae0) at damage.c:1697
#1  DamageUnregister (pDamage=<value optimized out>, pPrev=0x9ae0) at damage.c:2001
#2  0x00007f465d6d42a3 in shadowRemove (pScreen=0x2350ec0, pPixmap=<value optimized out>) at shadow.c:219
#3  0x00007f465d6d4764 in shadowCloseScreen (i=0, pScreen=0x2350ec0) at shadow.c:103
#4  0x000000000049db29 in CursorCloseScreen (index=0, pScreen=0x2350ec0) at cursor.c:200
#5  0x00000000005598cc in AnimCurCloseScreen (index=0, pScreen=0x2350ec0) at animcur.c:136
#6  0x000000000042296c in main (argc=4, argv=<value optimized out>, envp=<value optimized out>) at main.c:315




Version-Release number of selected component (if applicable):
pixman-0.15.14-1.fc12.x86_64
xorg-x11-server-Xorg-1.6.99-6.20090618.fc12.x86_64

How reproducible:
just using Xorg - and it suddenly coredumps - nothing special being done - just browsing via firefox (which has been already reverted, as the latest version is highly unstable as well)

Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:
Stable Xorg as was at the beginning on June.

Additional info: