gimp is able to kill Xserver with Intel driver

[Lukas Hejtmanek]

Hello,

using gimp, I'm able to reproduce the following segfault of the xserver:
Core was generated by `/usr/bin/X11/X -nolisten tcp'.
Program terminated with signal 11, Segmentation fault.
[New process 4181]
#0  0x0000000000433d32 in dixLookupPrivate (privates=0x1d386c0, key=0x7da880)
    at ../../dix/privates.c:79
79	../../dix/privates.c: No such file or directory.
	in ../../dix/privates.c
(gdb) where
#0  0x0000000000433d32 in dixLookupPrivate (privates=0x1d386c0, key=0x7da880)
    at ../../dix/privates.c:79
#1  0x00000000004cf2b4 in miDCPutUpCursor (pDev=0xc65d60, pScreen=0x9d0340, 
    pCursor=0x2a9032900000001, x=-42829, y=-26929, source=0, mask=16777215)
    at ../../mi/midispcur.c:449
#2  0x00000000004def6e in miSpriteRestoreCursor (pDev=0xc65d60, 
    pScreen=0x9d0340) at ../../mi/misprite.c:1025
#3  0x00000000004df4a6 in miSpriteBlockHandler (i=<value optimized out>, 
    blockData=0x0, pTimeout=0x0, pReadmask=0x1) at ../../mi/misprite.c:525
#4  0x00007f3e6a83aae7 in I830BlockHandler (i=<value optimized out>, 
    blockData=0x0, pTimeout=0x7fff762f9d28, pReadmask=0xffff58b3)
    at i830_driver.c:2632
#5  0x0000000000533ba8 in AnimCurScreenBlockHandler (screenNum=0, 
    blockData=0x0, pTimeout=0x7fff762f9d28, pReadmask=0x7daca0)
    at ../../render/animcur.c:222
#6  0x00000000004febce in compBlockHandler (i=0, blockData=0x0, 
    pTimeout=0x7fff762f9d28, pReadmask=0x7daca0)
    at ../../composite/compinit.c:158
#7  0x0000000000451290 in BlockHandler (pTimeout=0x7fff762f9d28, 
    pReadmask=0x7daca0) at ../../dix/dixutils.c:384
#8  0x00000000004eca51 in WaitForSomething (pClientsReady=0xcf2950)
    at ../../os/WaitFor.c:215
#9  0x000000000044d5a0 in Dispatch () at ../../dix/dispatch.c:367
---Type <return> to continue, or q <return> to quit---
#10 0x00000000004332bd in main (argc=3, argv=0x7fff762f9f08, 
    envp=<value optimized out>) at ../../dix/main.c:383
(gdb)

-- 
Lukáš Hejtmánek