Bug reported by Joseph Nahmias on the Debian BTS a while ago. Occurs with 2.2.0 and 2.2.1.

We initially thought it was bug#13756 but it got closed as wontfix because the submitter was using intelfb, while Joe reproduces this one without any framebuffer console (/proc/fb empty).

He just runs torus-trooper and the server crashes with the backtrace below.

#0  0xffffe410 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb7ce7ef5 in raise () from /lib/i686/cmov/libc.so.6
No symbol table info available.
#2  0xb7ce9871 in abort () from /lib/i686/cmov/libc.so.6
No symbol table info available.
#3  0x081bb42b in FatalError (f=0xb7b0b55c "lockup\n") at ../../os/log.c:554
        args = 0xbfd514a4 "x▒\001"
        beenhere = 1
#4  0xb7adeabc in I830WaitLpRing (pScrn=0x82185c0, n=131064, timeout_millis=0)
    at ../../src/i830_accel.c:150
        pI830 = (I830Ptr) 0x8219ee0
        ring = (I830RingBuffer *) 0x8205b00
        iters = 681527
        start = 694354
        last_head = 3368
#5  0xb7aded2d in I830Sync (pScrn=0x82185c0) at ../../src/i830_accel.c:201
        outring = 6
        pI830 = (I830Ptr) 0x8219ee0
        __FUNCTION__ = "I830Sync"
#6  0xb7aeb080 in i830_stop_ring (pScrn=0x82185c0, flush=<value optimized out>)
    at ../../src/i830_driver.c:1775
        temp = <value optimized out>
#7  0xb7aeb13b in I830LeaveVT (scrnIndex=0, flags=0)
    at ../../src/i830_driver.c:3093
        pScrn = (ScrnInfoPtr) 0x82185c0
        pI830 = (I830Ptr) 0x8219ee0
#8  0x080d83cd in xf86XVLeaveVT (index=0, flags=0)
    at ../../../../hw/xfree86/common/xf86xv.c:1278
        pxvs = (XvScreenPtr) 0x822b958
        pAdaptor = (XvAdaptorPtr) 0x822be80
        pPriv = (XvPortRecPrivatePtr) 0x8257a88
        i = 1
        j = 16
#9  0xb7b7daef in glxDRILeaveVT (index=0, flags=0)
    at ../../../GL/glx/glxdri.c:993
No locals.
#10 0x080a888d in AbortDDX () at ../../../../hw/xfree86/common/xf86Init.c:1112
        i = 1
#11 0x081bae98 in AbortServer () at ../../os/log.c:406
No locals.
#12 0x081bb416 in FatalError (f=0xb7b0b55c "lockup\n") at ../../os/log.c:552
        args = 0xbfd51604 "\200▒\001"
        beenhere = 1
#13 0xb7adeabc in I830WaitLpRing (pScrn=0x82185c0, n=131064, timeout_millis=0)
    at ../../src/i830_accel.c:150
        pI830 = (I830Ptr) 0x8219ee0
        ring = (I830RingBuffer *) 0x8205b00
        iters = 681222
        start = 691424
        last_head = 3368
#14 0xb7aded2d in I830Sync (pScrn=0x82185c0) at ../../src/i830_accel.c:201
        outring = 6
        pI830 = (I830Ptr) 0x8219ee0
        __FUNCTION__ = "I830Sync"
#15 0xb7afe49a in I830EXASync (pScreen=0x8225440, marker=0)
    at ../../src/i830_exa.c:154
No locals.
#16 0xb7971762 in exaWaitSync (pScreen=0xe4a) at ../../exa/exa.c:806
        pExaScr = (ExaScreenPrivPtr) 0x8228300
#17 0xb79720f2 in exaPrepareAccess (pDrawable=0x828d4a8, index=0)
    at ../../exa/exa.c:352
        pPixmap = (PixmapPtr) 0x825b1b8
#18 0xb79728ee in exaImageGlyphBlt (pDrawable=0x828d4a8, pGC=0x83e7a98, x=2,
    y=430, nglyph=1, ppciInit=0xbfd517d0, pglyphBase=0x0)
    at ../../exa/exa_accel.c:974
        pPriv = (FbGCPrivPtr) 0x83e7afc
        ppci = <value optimized out>
        pci = <value optimized out>
        pglyph = <value optimized out>
        gWidth = <value optimized out>
        gHeight = <value optimized out>
        opaque = 0
        n = <value optimized out>
        gx = <value optimized out>
        gy = <value optimized out>
        glyph = (void (*)(FbBits *, FbStride, int, FbStip *, FbBits, int,
    int)) 0xb79826e0 <fbGlyph32>
        dst = <value optimized out>
        dstStride = <value optimized out>
        dstBpp = <value optimized out>
        dstXoff = <value optimized out>
        dstYoff = <value optimized out>
        depthMask = <value optimized out>
        pPixmap = (PixmapPtr) 0x825b1b8
        pixmaps = {{as_dst = 1, as_src = 1, pPix = 0x825b1b8}}
        xBack = 455
        widthBack = 9
        yBack = 602
        heightBack = 18
#19 0x08170610 in damageText (pDrawable=0x828d4a8, pGC=0x83e7a98, x=2, y=430,
    count=1, chars=0x8340d60 "", fontEncoding=TwoD16Bit, textType=3)
    at ../../../miext/damage/damage.c:1418
        info = <value optimized out>
        i = 1
        n = 1
        w = 0
        imageblt = 1
#20 0x08170711 in damageImageText16 (pDrawable=0x828d4a8, pGC=0x83e7a98, x=2,
    y=430, count=1, chars=0x8340d60) at ../../../miext/damage/damage.c:1499
        pGCPriv = (DamageGCPrivPtr) 0x83e7b20
        oldFuncs = (GCFuncs *) 0x81e0b40
#21 0x0808fcbd in doImageText (client=0x8372ce0, c=0xbfd518a0)
    at ../../dix/dixfonts.c:1552
        err = <value optimized out>
        lgerr = <value optimized out>
        fpe = <value optimized out>
#22 0x0808fe74 in ImageText (client=0x8372ce0, pDraw=0x828d4a8, pGC=0xe4a,
    nChars=1, data=0x8340d60 "", xorg=2, yorg=430, reqType=6, did=10485786)
    at ../../dix/dixfonts.c:1603
        local_closure = {client = 0x8372ce0, pDraw = 0x828d4a8,
  pGC = 0x83e7a98, nChars = 1 '\001', data = 0x8340d60 "", xorg = 2,
  yorg = 430, reqType = 77 'M', imageText = 0x8170680 <damageImageText16>,
  itemSize = 2, did = 10485786, slept = 0}
#23 0x0808a587 in ProcImageText16 (client=0x8372ce0)
    at ../../dix/dispatch.c:2453
        err = 0
        pDraw = (DrawablePtr) 0x6
        pGC = (GC *) 0xe4a
#24 0x0814d8ee in XaceCatchDispatchProc (client=0x8372ce0)
    at ../../Xext/xace.c:281
        major = 77
#25 0x0808d1ef in Dispatch () at ../../dix/dispatch.c:502
        result = <value optimized out>
        client = (ClientPtr) 0x8372ce0
        nready = 0
        start_tick = 26940
#26 0x0807470b in main (argc=8, argv=0xbfd51e94, envp=Cannot access memory at address 0xe52
) at ../../dix/main.c:452
        pScreen = <value optimized out>
        i = 1
        error = 136148076
        xauthfile = <value optimized out>
        alwaysCheckForInput = {0, 1}