Created attachment 10257 [details]
Xorg.0.log after ctrl-alt-backspace

They also get corrupted if quit the session with ctrl-alt-backspace.

Created attachment 10258 [details]
xorg.conf (Debian sid/lenny)

I have exactly the same problem with a SuperSavage chipset (IBM ThinkPad T23) and Debian testing since xorg was updated to 7.2. There's no special need to add my xorg.0.log and xorg.conf because they are quite identical to those that are already presenred here - unless you really need it.

My configuration:
SuperSavage, linux 2.6.18, xorg-server 1.3, savage 2.1.2

the drm.ko and savage.ko modules are already broken on 2.6.18 kernel with xorg above 7.0, but I use a git recompiled version that worked correctly with 7.1.

Another problem that came with this vesion is that X crashes when a program try to change the screen resolution, like fullscreen games. In this case, the X server is entierly restarted and the virtual consoles are also broken.
I don't know if it is another bug, but it seems to be related anyway.

I'm here for a little correction: I discovered that the X crash when changing screen resolution doesn't always brake the virtual consoles, so I think it is really another bug. Sorry  for the flood...

I think it is related / a consequence that the X server starts up on a new VT each time (vt7, vt8, vt9, vt10...).

Created attachment 10494 [details]
gdb session when X server crashes at shutdown

I think the gdb output indicates some stale psav pointers.

Created attachment 10495 [details]
another gdb session

This trace was with NoTrapSignal, which avoided the second segfault which came when the server aborted. I also printed more variables.

Some more instances of this in https://bugs.launchpad.net/bugs/123134 and its duplicates.

This could be related to bug #11354.

This is my analysis from looking at the source:

SavageCloseScreen() first calls SAVAGEDRICloseScreen() which zeroes out these variables:
   psav->ShadowVirtual = NULL;
   psav->ShadowPhysical = 0;

Then later it calls SavageWriteMode() ->  SavageGEReset() which through:
        if (!from_timeout)
            psav->WaitIdleEmpty(psav);

calls ShadowWait which fatally tries to access psav->ShadowVirtual

But I am not sure which steps are wrong and should be fixed...

Small correction: Given the uninitialized value of r at the time of crash, the calling line in SavageGEReset() is rather this one (I have to trace on the machine when I get to it to confirm):

    } else
        psav->WaitIdleEmpty(psav);

Created attachment 10613 [details] [review]
workaround: checks for valid ShadowVirtual

This is a workaround, that keeps the server from crashing and borking the consoles. It returns from ShadowWait if there is no ShadowVirtual pointer. 
But I think ShadowWait should not have been called in the first place.

thanks for tracking this down.  fixed.
7832dcd82046238d5accb55468c65241f0edc6d0

*** Bug 11496 has been marked as a duplicate of this bug. ***