Originally Posted by AaronP
I'm trying to determine whose bug it is, exactly. The xf86* functions are indeed in the core X server. Your backtrace indicates that the X server is receiving a rendering request from a client trying to render a filled rectangle to a window. Since the server isn't on the VT, that rendering should have been clipped away but instead it's calling into the driver to perform the rendering with a non-NULL clip region. If the GC had been properly revalidated, the driver would have called down to the software rendering library (libwfb) immediately but it's crashing somewhere instead, probably trying to access the screen's video memory which was freed during the VT switch.
I'll see if I can reproduce the problem with some directed testing, but I'm on vacation right now so it'll be a while until I can get to it.
@AaronP: I still have the debug enabled X running. Please let me know if you need any more information or debug info. This still happens with latest beta drivers.