I would say the implication is that drawable_gc_flags() is choosing the wrong hint then. Can you please try:

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index 3d8392f..14817a5 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -4097,9 +4097,7 @@ fallback:
 	if (!sna_gc_move_to_cpu(gc, drawable, &region))
 		goto out;
 	if (!sna_drawable_move_region_to_cpu(drawable, &region,
-					      format == XYPixmap ?
-					      MOVE_READ | MOVE_WRITE :
-					      drawable_gc_flags(drawable, gc, false)))
+					     MOVE_READ | MOVE_WRITE))
 		goto out_gc;

That patch helps, and unlike the revert, doesn't seem to add other problems so far. Thanks!

Ok, let me just scratch my head a bit to find the mistake in calling drawable_gc_flags() here... Just in case the bug runs a bit deeper. Thanks

Do you mind quickly testing:

diff --git a/src/sna/sna_accel.c b/src/sna/sna_accel.c
index 3d8392f..3973c9d 100644
--- a/src/sna/sna_accel.c
+++ b/src/sna/sna_accel.c
@@ -2338,7 +2338,7 @@ drawable_gc_flags(DrawablePtr draw, GCPtr gc, bool partial)
 		return MOVE_READ | MOVE_WRITE;
 	}
 
-	if (fb_gc(gc)->and) {
+	if (fb_gc(gc)->and | fb_gc(gc)->bgand) {
 		DBG(("%s: read due to rrop %d:%x\n",
 		     __FUNCTION__, gc->alu, (unsigned)fb_gc(gc)->and));
 		return MOVE_READ | MOVE_WRITE;

Works as well.

Thanks a lot,

commit 8bbfa88a8691f6c1b2903090c3cd3159126ef563
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Tue Oct 9 17:26:39 2012 +0100

    sna: Also check the bg rrop for reads when deciding upon fallback placement
    
    Reported-and-tested-by: chr.ohm@gmx.net
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=55810
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Hopefully that will also fix a few other spurious errors.