The failing assertion is in the Mesa r300 driver. The cause may lie somewhere else, e.g. in common Mesa or the X server GLX code, but let's start from the information we have. It should be useful to attach gdb to the X server process before reproducing the problem to get a full backtrace.

mesa version 7.2-0.15.fc10

Program received signal SIGABRT, Aborted.
0x00497416 in __kernel_vsyscall ()
(gdb) bt
#0  0x00497416 in __kernel_vsyscall ()
#1  0x00207460 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#2  0x00208e28 in abort () at abort.c:88
#3  0x0020040e in __assert_fail (assertion=0xe6a853 "drawable != ((void *)0)",
    file=0xe6a845 "radeon_lock.c", line=100, function=0xe6a86c "radeonGetLock")
    at assert.c:78
#4  0x00e3c1f6 in radeonGetLock (rmesa=0x91f3c70, flags=0) at radeon_lock.c:100
#5  0x00e46ebf in r300FlushCmdBuf (r300=0x91f3c70, caller=0xe6b234 "r300DestroyContext")
    at r300_cmdbuf.c:153
#6  0x00e40b41 in r300DestroyContext (driContextPriv=0x916e900) at r300_context.c:410
#7  0x00e39c9a in radeonDestroyContext (driContextPriv=0x6) at radeon_screen.c:1431
#8  0x00e36da9 in driDestroyContext (pcp=0x916e900) at ../common/dri_util.c:516
#9  0x00cb33b9 in __glXDRIcontextDestroy (baseContext=0x9319a80) at glxdri.c:299
#10 0x00ca8289 in __glXFreeContext (cx=0x9319a80) at glxext.c:149
#11 0x00ca82d7 in ContextGone (cx=0x0, id=65011713) at glxext.c:98
#12 0x0806db96 in FreeClientResources (client=0x930a9a0) at resource.c:807
#13 0x0807febf in CloseDownClient (client=0x930a9a0) at dispatch.c:3461
#14 0x08085d30 in Dispatch () at dispatch.c:465
#15 0x0806b71d in main (argc=5, argv=0xbf8fd764, envp=Cannot access memory at address 0x5a3d
) at main.c:441
(gdb) print *rmesa
$2 = {glCtx = 0x98e8388, radeonScreen = 0x8a775e8, Fallback = 0, TclFallback = 0,
  doPageFlip = 0, numClipRects = 0, pClipRects = 0x0, lastStamp = 0,
  lost_context = 0 '\0', sarea = 0x95ef0898, dri = {context = 0x916e900,
    screen = 0x8a77510, drawable = 0x0, readable = 0x0, hwContext = 3,
    hwLock = 0x95ef0000, fd = 14, drmMinor = 29}, do_usleeps = 0, do_irqs = 1,
  irqsEmitted = 0, iw = {irq_seq = -1}, swap_ust = 768826212, swap_missed_ust = 0,
  swap_count = 0, swap_missed_count = 0, state = {color = {clear = 0, rrb = 0x0},
    scissor = {rect = {x1 = 0, y1 = 0, x2 = 0, y2 = 0}, enabled = 0 '\0',
      numClipRects = 0, numAllocedClipRects = 0, pClipRects = 0x0}, depth_buffer = 0x0},
  optionCache = {info = 0x8a77748, values = 0x8fe56f0, tableSize = 5}, bufmgr = 0x93543f8}


Let me know if you need any other particular details.

Updating to mesa 7.3-2.fc11 from Fedora rawhide seems to fix it.