Created attachment 54825 [details]
The Piglit case about glDrawBuffer.

I am able to reproduce the issue. Thanks for the piglit test case. I have made few changes to the attached piglit test case to clearly identify the issue:

1. Test segfaults even with a single call to glDrawBuffer(GL_FRONT_AND_BACK)
2. GL_RIGHT, GL_FRONT_RIGHT and GL_BACK_RIGHT are not allowed in case of GLUT_DOUBLE_BUFFER. They are allowed only with GLUT_STEREO, which seems not supported in piglit at the moment.Have anyone used GLUT_STEREO in piglit?

GDB backtrace:
 
Program received signal SIGSEGV, Segmentation fault.
0x0024ef13 in brw_update_renderbuffer_surface (brw=0x80c70f0, rb=0x829dd30, unit=0) at brw_wm_surface_state.c:904
904	   struct intel_region *region = irb->mt->region;
(gdb) bt
#0  0x0024ef13 in brw_update_renderbuffer_surface (brw=0x80c70f0, rb=0x829dd30, unit=0) at brw_wm_surface_state.c:904
#1  0x0024f34a in brw_update_renderbuffer_surfaces (brw=0x80c70f0) at brw_wm_surface_state.c:1000
#2  0x002332d2 in brw_upload_state (brw=0x80c70f0) at brw_state_upload.c:503
#3  0x00217434 in brw_try_draw_prims (ctx=0x80c70f0, arrays=0x812b650, prim=0xbfffedec, nr_prims=1, ib=0x0, min_index=0, max_index=3) at brw_draw.c:521
#4  0x00217714 in brw_draw_prims (ctx=0x80c70f0, arrays=0x812b650, prim=0xbfffedec, nr_prims=1, ib=0x0, index_bounds_valid=1 '\001', min_index=0, max_index=3, 
    tfb_vertcount=0x0) at brw_draw.c:605
#5  0x003907f3 in vbo_draw_arrays (ctx=0x80c70f0, mode=7, start=0, count=4, numInstances=1) at vbo/vbo_exec_array.c:600
#6  0x0039094b in vbo_exec_DrawArrays (mode=7, start=0, count=4) at vbo/vbo_exec_array.c:632
#7  0x0809491a in piglit_draw_rect (x=25, y=25, w=50, h=50) at /home/anuj/piglit/tests/util/piglit-util-gl.c:712
#8  0x0806ba0d in piglit_display () at /home/anuj/piglit/tests/texturing/drawbuffer-bug.c:56
#9  0x0806c03f in display () at /home/anuj/piglit/tests/util/piglit-framework.c:56
#10 0x4e0ae3c3 in ?? () from /usr/lib/libglut.so.3
#11 0x4e0b1dc7 in fgEnumWindows () from /usr/lib/libglut.so.3
#12 0x4e0ae86e in glutMainLoopEvent () from /usr/lib/libglut.so.3
#13 0x4e0af104 in glutMainLoop () from /usr/lib/libglut.so.3
#14 0x0806c776 in main (argc=1, argv=0xbffff234) at /home/anuj/piglit/tests/util/piglit-framework.c:294

Created attachment 55224 [details]
Piglit test case to verify color buffer modes

modified piglit testcase

Here is the patch to fix segfault in mesa: 

--- a/src/mesa/drivers/dri/intel/intel_buffers.c
+++ b/src/mesa/drivers/dri/intel/intel_buffers.c
@@ -88,7 +88,7 @@ intelDrawBuffer(struct gl_context * ctx, GLenum mode)
        intel->is_front_buffer_rendering;
 
       intel->is_front_buffer_rendering = (mode == GL_FRONT_LEFT)
-       || (mode == GL_FRONT);
+       || (mode == GL_FRONT) || (mode == GL_FRONT_AND_BACK);

This patch will posted in mesa-dev mailing list for review.

(In reply to comment #4)
> Here is the patch to fix segfault in mesa: 
> 
> --- a/src/mesa/drivers/dri/intel/intel_buffers.c
> +++ b/src/mesa/drivers/dri/intel/intel_buffers.c
> @@ -88,7 +88,7 @@ intelDrawBuffer(struct gl_context * ctx, GLenum mode)
>         intel->is_front_buffer_rendering;
> 
>        intel->is_front_buffer_rendering = (mode == GL_FRONT_LEFT)
> -       || (mode == GL_FRONT);
> +       || (mode == GL_FRONT) || (mode == GL_FRONT_AND_BACK);
> 
> This patch will posted in mesa-dev mailing list for review.

Thank Anuj,

The patch works well.

Tested-by: Sun Yi <yi.sun@intel.com>

This bug is resolved by following commit on mesa (master):

commit b82ea9b50e0adfa4d302dbd944d9b3c06bac5657
Author: Anuj Phogat <anuj.phogat@gmail.com>
Date:   Fri Jan 6 12:48:45 2012 -0800

    Enable is_front_buffer_rendering variable in case of GL_FRONT_AND_BACK
    
    Signed-off-by: Anuj Phogat <anuj.phogat@gmail.com>

Please ignore my previous comment. Here is the correct commit log
which fixes the bug:

commit c979fe3e200f42ff1fad75ebdbebe69da27e1aaa
Author: Anuj Phogat <anuj.phogat@gmail.com>
Date:   Fri Jan 6 12:48:45 2012 -0800

    Enable is_front_buffer_rendering variable in case of GL_FRONT_AND_BACK
    
    glDrawBuffer(GL_FRONT_AND_BACK) results in to segmentation fault if
    intel->is_front_buffer_rendering is not enabled with GL_FRONT_AND_BACK.
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=44153
    
    Reported-by: Yi Sun <yi.sun@intel.com>
    Signed-off-by: Anuj Phogat <anuj.phogat@gmail.com>
    Reviewed-by: Eric Anholt <eric@anholt.net>

The patch is on the upstream, verified it.