Bug 709203

Description of problem:
i915 driver crashes when running Fedora 15 guest in VirtualBox on a Fedora 14 host.

Version-Release number of selected component (if applicable):
Fedora 14. kernel - 2.6.35.13-91

How reproducible:
Have a Fedora 14 installation on an Intel Graphics chip(preferably one which uses the i 915 driver - although I suspect it happens for other intel drivers too)
Run Fedora 15 guest in VirtualBox on the above host. Install GA in guest. 
After the guest boots up and the Gnome Shell UI is displayed, Click on "Activities". VirtualBox crashes.

Steps to Reproduce:
1. Install Fedora 14 on a machine with Intel Graphics Chip.(preferably i915 driver)
2. Install VirtualBox on the above machine.
3. Create a Fedora 15 VM with 3D *disabled* and 128MB of Video Memory. Boot the VM. Install the guest additions via the Gnome 3 fallback mode that is shown.
4. Shut down the guest. *Enable* 3D and boot the guest again. Gnome Shell UI
should appear this time. Click on "Activities". VirtualBox aborts.
  
Actual results:
VirtualBox aborts.

Expected results:
Gnome Shell should work.

Additional info:
The backtrace for the crash is posted below. I contacted VirtualBox devs who pointed out that Frame 7 is a harmless call. Even if the coordinates are not correct and there is no GL context active, the driver should not crash.

The result of this bug is that a lot of users with Intel Drivers wont
be able to try out Fedora 15 VMs.

Please do let me know if you need any further information.

<backtrace>

#0  0x062bc37f in copy_array_to_vbo_array (brw=<value optimized out>,
element=0xa5914f8, dst_stride=32)
    at /usr/include/bits/string3.h:52
#1  0x062bc9f0 in brw_prepare_vertices (brw=0xa579250) at
brw_draw_upload.c:434
#2  0x062c82d4 in brw_validate_state (brw=0xa579250) at brw_state_upload.c:397
#3  0x062bbce3 in brw_try_draw_prims (ctx=0xa579250, arrays=0xa5a6a04,
prim=0xb69feccc, nr_prims=1, ib=0x0,
    index_bounds_valid=1 '\001', min_index=0, max_index=3) at brw_draw.c:370
#4  brw_draw_prims (ctx=0xa579250, arrays=0xa5a6a04, prim=0xb69feccc,
nr_prims=1, ib=0x0, index_bounds_valid=
    1 '\001', min_index=0, max_index=3) at brw_draw.c:455
#5  0x06374616 in vbo_exec_DrawArrays (mode=6, start=0, count=4) at
vbo/vbo_exec_array.c:526
#6  0x063cdbfb in _mesa_meta_BlitFramebuffer (ctx=0xa579250, srcX0=0,
srcY0=773, srcX1=87, srcY1=811, dstX0=0, dstY0=
    773, dstX1=87, dstY1=811, mask=<value optimized out>, filter=9728) at
drivers/common/meta.c:1334
#7  0x0631e654 in _mesa_BlitFramebufferEXT (srcX0=0, srcY0=773, srcX1=87,
srcY1=811, dstX0=0, dstY0=773, dstX1=87,
    dstY1=811, mask=16384, filter=9728) at main/fbobject.c:2323
#8  0x0073de03 in gl_dispatch_stub_795 (srcX0=0, srcY0=773, srcX1=87,
srcY1=811, dstX0=0, dstY0=773, dstX1=87, dstY1=
    811, mask=16384, filter=9728) at ../../../src/mapi/glapi/glapitemp.h:5569

</backtrace>


Also heres an excerpt from 'lspci -v'

<snip>

00:02.0 VGA compatible controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07) (prog-if 00 [VGA controll
er])
        Subsystem: Lenovo Device 20e4
        Flags: bus master, fast devsel, latency 0, IRQ 48
        Memory at f4400000 (64-bit, non-prefetchable) [size=4M]
        Memory at d0000000 (64-bit, prefetchable) [size=256M]
        I/O ports at 1800 [size=8]
        Expansion ROM at <unassigned> [disabled]
        Capabilities: [90] MSI: Enable+ Count=1/1 Maskable- 64bit-
        Capabilities: [d0] Power Management version 3
        Kernel driver in use: i915
        Kernel modules: i915

00:02.1 Display controller: Intel Corporation Mobile 4 Series Chipset Integrated Graphics Controller (rev 07)
        Subsystem: Lenovo Device 20e4
        Flags: bus master, fast devsel, latency 0
        Memory at f4200000 (64-bit, non-prefetchable) [size=1M]
        Capabilities: [d0] Power Management version 3

<snip>