Bug 36860

Forwarding this bug from Ubuntu reporter Silas S. Brown:
http://bugs.launchpad.net/ubuntu/+source/xserver-xorg-video-intel/+bug/731424

[Problem]
The Tk script shown below reliably crashes the xserver in Ubuntu.  This is due to dereferencing a null privates pointer in i965_set_picture_surface_state()

[Original Description]
I am on Ubuntu 10.10 with the default X server, and the following Python code crashes it every time:

from Tkinter import *
f=Frame()
f.option_add('*font', "-family {DejaVu Sans} -size -25 -weight normal -slant roman -underline 0 -overstrike 0")
f.pack()
text = StringVar(f)
entry = Entry(f, textvariable=text)
entry.pack()
text.set("a" * 600)  # 537 is ok; values 538 and up crash X
f.mainloop()

Unfortunately, I was not able to capture a backtrace with apport.  I'm using an Asus X58Lseries laptop which I believe is 1280 x 800 (WXGA) using an Intel GMA X3100 graphics chipset.  I have set System > Preferences > Appearance > Fonts > Details > Resolution to 160 DPI for a larger display.

#0  i965_set_picture_surface_state (intel=0x883dcd0, pixmap=0xb7103008, is_dst=1, 
    picture=<value optimized out>) at ../../src/i965_render.c:1136
        priv = 0x0
        ss = <value optimized out>
        write_domain = <value optimized out>
        read_domains = <value optimized out>
        offset = <value optimized out>
#1  0x0020fa2a in i965_bind_surfaces (dest=0xb7103008, srcX=320, srcY=48, maskX=0, maskY=0, dstX=0, 
    dstY=0, w=15, h=14) at ../../src/i965_render.c:1740
        binding_table = 0x8845f24
#2  i965_composite (dest=0xb7103008, srcX=320, srcY=48, maskX=0, maskY=0, dstX=0, dstY=0, w=15, h=14)
    at ../../src/i965_render.c:1845
        scrn = 0x8839040
        intel = 0x883dcd0
        render_state = <value optimized out>
        has_mask = 0
        src_x = {320, 320, 335}
        src_y = {48, 62, 62}
        src_w = {8.8028834e-33, 8.80539896e-33, 5.77529779e-33}
        mask_x = {0, 1.875, 4.48415509e-43}
        mask_y = {5.73971851e-42, 8.74344453e-33, 1.29830863e-39}
        mask_w = {-1.50051022, 3.02446732e-39, 0}
        is_affine = 1
#3  0x002197a0 in uxa_glyphs_via_mask (op=3 '\003', pSrc=0xa3398f8, pDst=0xa36e470, 
    maskFormat=0x9efdd88, xSrc=0, ySrc=0, nlist=3, list=0xbfc017e0, glyphs=0xa36f260)
    at ../../uxa/uxa-glyphs.c:1002
        this_atlas = 0x9f2e8e8
        src_x = 320
        glyph = 0xa326798
        src_y = 48
        priv = 0x9efe490
        screen = 0x8831588
        mask = 0xa3597c0
        y = 14
        pixmap = 0xb7103008
        dst_off_x = 196611
        n = <value optimized out>
        dst_off_y = 13
        box = {x1 = 3, y1 = 13, x2 = 9003, y2 = 27}
        component_alpha = 1
        glyph_atlas = 0x9f2e8e8
        x = 0
        height = <value optimized out>
        error = 0
#4  uxa_glyphs (op=3 '\003', pSrc=0xa3398f8, pDst=0xa36e470, maskFormat=0x9efdd88, xSrc=0, ySrc=0, 
    nlist=3, list=0xbfc017e0, glyphs=0xa36f260) at ../../uxa/uxa-glyphs.c:1157
...