When run mesa demo readpix(mesa/progs/drmo/readpix.c), it aborted with output:

[root@x-q965 demos]# ./readpix 
GL_VERSION = 2.1 Mesa 7.1
GL_RENDERER = Mesa DRI Intel(R) 965Q 20061102
GL_OES_read_format supported.  Using type / format = 0x1401 / 0x1908
Loaded 194 by 188 image
readpix: ../../../../../src/mesa/drivers/dri/common/spantmp2.h:166: intelWriteRGBASpan_ARGB8888: Assertion `irb->pfMap' failed.
Aborted (core dumped)

The bug was introduced in the latest two days, we will bisect the Mesa commit later.

Below is the backtrack info:

#0  0xffffe410 in __kernel_vsyscall ()
#1  0x4694c159 in raise () from /lib/libc.so.6
#2  0x4694d6e3 in abort () from /lib/libc.so.6
#3  0x46945abd in __assert_fail () from /lib/libc.so.6
#4  0xb7a0d327 in intelWriteRGBASpan_ARGB8888 (ctx=0x8059c90, rb=0x8333ee8, 
    n=194, x=5, y=20, values=0xb1ad500c, mask=0x0)
    at ../../../../../src/mesa/drivers/dri/common/spantmp2.h:166
#5  0xb7b2cc2f in _swrast_write_rgba_span (ctx=0x8059c90, span=0xbfcf9594)
    at swrast/s_span.c:1450
#6  0xb7b22212 in draw_rgba_pixels (ctx=0x8059c90, x=5, y=20, width=194, 
    height=188, format=6407, type=5121, unpack=0x8065924, pixels=0x8334128)
    at swrast/s_drawpix.c:666
#7  0xb7b22deb in _swrast_DrawPixels (ctx=0x8059c90, x=5, y=20, width=194, 
    height=188, format=6407, type=5121, unpack=0x8065924, pixels=0x8334128)
    at swrast/s_drawpix.c:889
#8  0xb7b7fd0c in _mesa_DrawPixels (width=194, height=188, format=6407, 
    type=5121, pixels=0x8334128) at main/drawpix.c:186
#9  0xb7e3e302 in glDrawPixels (width=194, height=188, format=6407, type=5121, 
    pixels=0x8334128) at ../../../src/mesa/glapi/glapitemp.h:1370
#10 0x08049736 in Display () at readpix.c:157
#11 0xb7ee853f in processWindowWorkList (window=0x8050af8) at glut_event.c:1306
#12 0xb7ee9012 in glutMainLoop () at glut_event.c:1353
#13 0x080494e5 in main (argc=Cannot access memory at address 0x1f90
) at readpix.c:343