Repeatable? Now since you have assertions enabled, I can be reasonably sure that the requested fill was entirely within bounds... That only leaves the recent bug such as 5f3ee21a307, but you already have that commit. Leaning towards we violated some assumption made by pixman.

(In reply to comment #1)
> Repeatable?

Occasionally. Using wine and Mp3Tag.

I don't suppose there is any chance of capturing this within a full-debug run? I expect the timings will mask the issue. :|

Ah, actually that particular path wasn't asserting the box was entirely within bounds before calling pixman.

commit 32010ed86bb8f28d3b02e1e54a592d79b92b2b98
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Wed Jan 22 16:26:14 2014 +0000

    sna: Assert that the fill box is within bounds
    
    References: https://bugs.freedesktop.org/show_bug.cgi?id=73811
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Perhaps see if that catches the fault first?

Another subtle bug in move-to-cpu fixed. Do you still occasionally hit this bug or the new assertions?

Ok, had an idea for the cause here which would be fixed by:

commit 4d1a2ef9553c663bb97b56adde6f6b41241ff528
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Thu Feb 6 08:29:20 2014 +0000

    sna: Reset composite offsets when reusing freed pixmaps
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=74550
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

(In reply to comment #5)
> Another subtle bug in move-to-cpu fixed. Do you still occasionally hit this
> bug or the new assertions?

I hit no more assertions in the past days. And I update the driver usually when I reboot (once a week). For the record, I'm now running 2.99.909-11-gde73c5fd1cd4 for 2 days.

I feel confident that this will turn out to be the invalid pixmap->screen_x|y left around in the freed pixmap cache.

Got one of the introduced asserts with 2.99.910-49-g0b92b12:

#3  0x00007f6ab08fb6c2 in __GI___assert_fail (assertion=assertion@entry=0x7f6aac9e3a10 "box->x2 <= op->dst.pixmap->drawable.width", file=file@entry=0x7f6aac9e3821 "sna_blt.c", line=line@entry=967, function=function@entry=0x7f6aac9e4090 <__PRETTY_FUNCTION__.23865> "blt_composite_fill_boxes__cpu") at assert.c:101
#4  0x00007f6aac901fb6 in blt_composite_fill_boxes__cpu (sna=<optimized out>, op=0x7fff5cae7950, box=0x1d1f150, n=<optimized out>) at sna_blt.c:967
#5  0x00007f6aac90ecdc in sna_composite (op=<optimized out>, src=<optimized out>, mask=0x0, dst=0x1d708b0, src_x=<optimized out>, src_y=<optimized out>, mask_x=0, mask_y=0, dst_x=-9, dst_y=-9, width=348, height=111) at sna_composite.c:731
#6  0x0000000000511eb2 in damageComposite (op=<optimized out>, pSrc=0x1d31910, pMask=0x0, pDst=0x1d708b0, xSrc=<optimized out>, ySrc=<optimized out>, xMask=0, yMask=0, xDst=-9, yDst=-9, width=348, height=111) at damage.c:563
#7  0x00000000004c8ee2 in compWindowUpdateAutomatic (pWin=<optimized out>) at compwindow.c:682
#8  compPaintWindowToParent (pWin=0x1c5d650) at compwindow.c:706
#9  compPaintChildrenToWindow (pWin=pWin@entry=0x1d6d040) at compwindow.c:721
#10 0x00000000004c8d6d in compPaintWindowToParent (pWin=0x1d6d040) at compwindow.c:700
#11 compPaintChildrenToWindow (pWin=0xb7b6d0) at compwindow.c:721
#12 0x00000000004c93dd in compScreenUpdate (pScreen=0xb49a80) at compalloc.c:54
#13 compBlockHandler (pScreen=0xb49a80, pTimeout=0x7fff5cae7da8, pReadmask=0x81e160 <LastSelectMask>) at compalloc.c:63
#14 0x0000000000440c84 in BlockHandler (pTimeout=pTimeout@entry=0x7fff5cae7da8, pReadmask=pReadmask@entry=0x81e160 <LastSelectMask>) at dixutils.c:387
#15 0x0000000000582fe4 in WaitForSomething (pClientsReady=pClientsReady@entry=0xe435e0) at WaitFor.c:210
#16 0x000000000043c991 in Dispatch () at dispatch.c:361
#17 0x000000000042c1ba in main (argc=7, argv=0x7fff5cae81b8, envp=<optimized out>) at main.c:298

Aha!

commit 75cff26ebad33aca7ade7aa5a650235a7d42e47c
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Sat Feb 22 10:05:41 2014 +0000

    sna: Apply the dst offset for pixman fills
    
    Along one of the sw blt paths we failed to apply the offset for
    Composite redirection.
    
    Reported-by: Jiri Slaby <jirislaby@gmail.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=73811
    Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>

Thanks.