Created attachment 45651 [details]
Dmesg output

I have seen this bug in kernels 2.6.38, 2.6.37 and NOT 2.6.36. Every time I quit the Xserver using the Xfce session manager, the message printed on the console it returns to is:

EIP: [<e168ef557>] r128_driver_irq_handler +0x15/0x50 [r128] SS:ESP 0068:df007fac
CR2: 00000000e08c8044
--- [ end trace 632129fdd65eae19 ] ---
Kernel panic - not syncing: Fatal exception in interrupt
Pid: 0, comm: swapper tainted: G D 2.6.38-ARCH #1
Call trace:

*some calls including r128_driver_irq_handler and other IRQ functions*

And I have to reboot with Alt+SysRq+REISUB. This only happens when I quit X using the functions in the Xfce session manager. The return to the console will be fine if I use Ctrl+Alt+Backspace, "sudo killall X", or Ctrl+Alt+F1 followed by Ctrl+C. I admit that this is vague information but I simply cannot get an answer our of the Xfce developers as to what function is being used.

From the look I had at the xfce4-session source code I would guess that the logout is being done with libICE. I know it is not being done with Hal, Consolekit or the XKillClient Xlib function. I will update this bug report as soon as I know which function causes this and have a testcase ready. If you think it will lead to a fix I would be willing to use a pencil and paper to write out the exact call trace in the kernel panic (which I have no way of copying or pasting).