The problem is that i915_vblank_tasklet() looks at vbl_swap->minor->master to
get a pointer to its private driver data, however, vbl_swap points to an entry
of the vbl_swaps list, and the only place where entries get added to this list
is i915_vblank_swap() and that doesn't fill the minor member of the vbl_swap
struct.

This is not really a problem as the private driver data is already available in
i915_vblank_tasklet(), so the attached patch removes the minor field from the
vbl_swap struct, and stops setting master_priv to
vbl_swap->minor->master->driver_priv, which isn't needed anways as its
already initialized and pointing to the master driver private data.

The patch also moves the initialization of sarea_priv and pitchropcpp higher as
gcc is rightfully complaining they can be used uninitialized here.

Signed-of-by: Hans de Goede <j.w.r.degoede@hhs.nl>
--- linux-2.6.24.i386/drivers/char/drm/i915_irq.c.orig	2008-04-18 12:02:05.000000000 +0200
+++ linux-2.6.24.i386/drivers/char/drm/i915_irq.c	2008-04-18 14:46:14.000000000 +0200
@@ -116,13 +116,14 @@ static void i915_vblank_tasklet(struct d
 	unsigned counter[2] = { atomic_read(&dev->vbl_received),
 				atomic_read(&dev->vbl_received2) };
 	struct drm_drawable_info *drw;
-	struct drm_i915_sarea *sarea_priv;
+	struct drm_i915_sarea *sarea_priv = master_priv->sarea_priv;
 	u32 cpp = dev_priv->cpp,  offsets[3];
 	u32 cmd = (cpp == 4) ? (XY_SRC_COPY_BLT_CMD |
 				XY_SRC_COPY_BLT_WRITE_ALPHA |
 				XY_SRC_COPY_BLT_WRITE_RGB)
 			     : XY_SRC_COPY_BLT_CMD;
-	u32 pitchropcpp;
+	u32 pitchropcpp = (sarea_priv->pitch * cpp) | (0xcc << 16) |
+				(cpp << 23) | (1 << 24);
 	RING_LOCALS;
 
 	DRM_DEBUG("\n");
@@ -147,12 +148,6 @@ static void i915_vblank_tasklet(struct d
 		if ((counter[pipe] - vbl_swap->sequence) > (1<<23))
 			continue;
 
-		master_priv = vbl_swap->minor->master->driver_priv;
-		sarea_priv = master_priv->sarea_priv;
-		
-		pitchropcpp = (sarea_priv->pitch * cpp) | (0xcc << 16) |
-			(cpp << 23) | (1 << 24);
-
 		list_del(list);
 		dev_priv->swaps_pending--;
 
--- linux-2.6.24.i386/drivers/char/drm/i915_drv.h~	2008-04-18 14:56:20.000000000 +0200
+++ linux-2.6.24.i386/drivers/char/drm/i915_drv.h	2008-04-18 14:56:20.000000000 +0200
@@ -86,7 +86,6 @@ typedef struct _drm_i915_vbl_swap {
 	unsigned int plane;
 	unsigned int sequence;
 	int flip;
-	struct drm_minor *minor;
 } drm_i915_vbl_swap_t;
 
 struct drm_i915_master_private {