System environment:
-- chipset: GM45
-- system architecture: i686
-- xserver-xorg-video-intel: 2:2.8.1-1ubuntu1
-- xserver-common: 2:1.6.3-1ubuntu6
-- mesa: 57d16c4cc37689710f951cb13981e2efc160cd23 (master)
-- libdrm: 2.4.13-1ubuntu1
-- kernel version: 2.6.31-10-generic
-- Linux distribution: Ubuntu 9.10
-- Machine model: Dell Latitude E6400

Run piglit test fp-fragment-position.

(gdb) bt
#0  0x00000000 in ?? ()
#1  0x0105b192 in _swrast_read_rgba_span (ctx=0x806c9b0, rb=0x83ad590, n=1, x=20, y=20, dstType=5126, rgba=0xb7d92008) at swrast/s_span.c:1583
#2  0x01059b16 in read_rgba_pixels (ctx=<value optimized out>, x=<value optimized out>, y=20, width=1, height=1, format=6408, type=5126, 
    pixels=0xbffff0e4, packing=0xbfffef90) at swrast/s_readpix.c:422
#3  0x0105a66a in _swrast_ReadPixels (ctx=0x806c9b0, x=20, y=20, width=1, height=1, format=6408, type=5126, packing=0x80798d4, pixels=0xbffff0e4)
    at swrast/s_readpix.c:605
#4  0x00f3044f in intelReadPixels (ctx=0x806c9b0, x=20, y=20, width=1, height=1, format=6408, type=5126, pack=0x80798d4, pixels=0xbffff0e4)
    at intel_pixel_read.c:314
#5  0x00fd1db3 in _mesa_ReadPixels (x=20, y=20, width=1, height=1, format=6408, type=5126, pixels=0xbffff0e4) at main/readpix.c:208
#6  0x0804a103 in DoTest ()
#7  0x0804a2ae in Redisplay ()
#8  0x001955bb in ?? () from /usr/lib/libglut.so.3
#9  0x08059df0 in ?? ()
#10 0x00000000 in ?? ()
(gdb) frame 1
#1  0x0105b192 in _swrast_read_rgba_span (ctx=0x806c9b0, rb=0x83ad590, n=1, x=20, y=20, dstType=5126, rgba=0xb7d92008) at swrast/s_span.c:1583
1583	         rb->GetRow(ctx, rb, length, x + skip, y, temp);
(gdb) print rb->GetRow
$1 = (void (*)(GLcontext *, struct gl_renderbuffer *, GLuint, GLint, GLint, void *)) 0


36dd53a3cded9d003ec418732b7fc93c1476aa9b is first bad commit
commit 36dd53a3cded9d003ec418732b7fc93c1476aa9b
Author: Eric Anholt <eric@anholt.net>
Date:   Thu Sep 10 09:26:38 2009 -0700

    intel: Don't forget to map the depth read buffer in spans.
    
    This broke BlitFramebufferEXT(GL_DEPTH_BUFFER_BIT).

:040000 040000 549d8f39d7717322b09dc656a5129f46162471f3 53fb80a11730f3ecfdf03231418e8dee0f7e984b M	src
bisect run success