Bug 508635

Description of problem:
I'm running KDE in dual-head mode with desktop effects enabled. Twice now, when I've pressed alt-tab (I use the "Box Switch" animation), my computer has frozen solid and I had to reboot. I got a kernel "oops" this time which I'll include at the end.

Version-Release number of selected component (if applicable):
xorg-x11-drv-intel-2.7.0-7.fc11.x86_64
kernel-2.6.29.5-191.fc11.x86_64
kdebase-workspace-4.2.90-3.fc11.x86_64 (from kde-redhat)

How reproducible:
Every time so far


Additional info:
I'll attach my Xorg.0.log and xorg.conf shortly. Here's the kernel oops:

Kernel failure message 1:
------------[ cut here ]------------
kernel BUG at drivers/gpu/drm/i915/i915_gem.c:2136!
invalid opcode: 0000 [#1] SMP 
last sysfs file: /sys/devices/pci0000:00/0000:00:1c.1/0000:0c:00.0/rfkill/rfkill0/state
CPU 0 
Modules linked in: sco bridge stp llc bnep l2cap bluetooth sunrpc nf_conntrack_netbios_ns ip6t_REJECT nf_conntrack_ipv6 ip6table_filter ip6_tables ipv6 cpufreq_ondemand acpi_cpufreq freq_table dm_multipath uinput snd_hda_codec_intelhdmi snd_hda_codec_idt arc4 ecb snd_hda_intel snd_hda_codec uvcvideo snd_hwdep sdhci_pci i2c_i801 sdhci ricoh_mmc iwlagn mmc_core iwlcore snd_pcm e1000e lib80211 dell_laptop yenta_socket pcspkr wmi videodev rsrc_nonstatic v4l1_compat v4l2_compat_ioctl32 mac80211 ata_generic pata_acpi joydev firewire_ohci snd_timer iTCO_wdt iTCO_vendor_support firewire_core snd dcdbas soundcore crc_itu_t cfg80211 snd_page_alloc i915 drm i2c_algo_bit i2c_core video output [last unloaded: microcode]
Pid: 2080, comm: X Not tainted 2.6.29.5-191.fc11.x86_64 #1 Latitude E6500                  
RIP: 0010:[<ffffffffa005f3d2>]  [<ffffffffa005f3d2>] i915_gem_object_get_fence_reg+0x221/0x61e [i915]
RSP: 0000:ffff88011a19fbe8  EFLAGS: 00013202
RAX: 0000000000098059 RBX: ffff8800d54a5240 RCX: 0000000000000010
RDX: 0000000000002a42 RSI: 0000000000098059 RDI: ffff8800d9422300
RBP: ffff88011a19fc28 R08: 0000000000000003 R09: ffff88011903d1e8
R10: 0000000000000200 R11: 0000000000000040 R12: ffff8800d9422180
R13: ffff88011903d000 R14: ffff8800d54a53c0 R15: ffff88011903c000
FS:  00007f2c1c66b7b0(0000) GS:ffffffff817b7000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2bfff36000 CR3: 0000000107981000 CR4: 00000000000406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process X (pid: 2080, threadinfo ffff88011a19e000, task ffff880110911700)
Stack:
ffff88011a19fc38 ffff88011903d1e8 ffff88011903c020 ffff8800d54a53c0
ffff88011903c020 ffff8800d54a5240 ffff8800a6c5cd10 ffff88011a19fce8
ffff88011a19fc98 ffffffffa00610d3 ffff88011a19fc68 00007f2bfff36000
Call Trace:
[<ffffffffa00610d3>] i915_gem_fault+0xc1/0x136 [i915]
[<ffffffff810b213f>] __do_fault+0x55/0x3d5
[<ffffffff812429bb>] ? agp_flush_chipset+0x1b/0x1d
[<ffffffffa005d523>] ? i915_gem_object_flush_cpu_write_domain+0x26/0x32 [i915]
[<ffffffff810b4475>] handle_mm_fault+0x349/0x7c5
[<ffffffff813ae615>] do_page_fault+0x5b5/0x9e9
[<ffffffff813ac01a>] ? unlock_kernel+0x2f/0x32
[<ffffffff810e0e27>] ? vfs_ioctl+0x76/0x87
[<ffffffff810e12bb>] ? do_vfs_ioctl+0x462/0x4a3
[<ffffffff813abab5>] ? trace_hardirqs_off_thunk+0x3a/0x6c
[<ffffffff813ac175>] page_fault+0x25/0x30
Code: ff e8 35 e9 ff ff 85 c0 0f 84 b3 fe ff ff e9 06 04 00 00 41 83 7c 24 20 00 75 10 48 8b 55 c8 48 8b 02 f7 40 70 be ff ff ff 74 04 <0f> 0b eb fe 49 8b bf 38 01 00 00 48 8b 70 38 48 85 ff 74 1a 48 
RIP  [<ffffffffa005f3d2>] i915_gem_object_get_fence_reg+0x221/0x61e [i915]
RSP <ffff88011a19fbe8>
---[ end trace 458020be7cff084f ]---