Description of problem:
mutter crashes when typing into a textbox in firefox and completion popup appears.

Version-Release number of selected component (if applicable):
Hw is Thinkpad T510 (intel hw), running gnome-shell 2.91.90 from F15
$ lspci | grep -i vga
00:02.0 VGA compatible controller: Intel Corporation Core Processor Integrated Graphics Controller (rev 02)

[    45.735] (II) Loading /usr/lib64/xorg/modules/drivers/intel_drv.so
[    45.768] (II) Module intel: vendor="X.Org Foundation"
[    45.768]    compiled for 1.9.99.1, module version = 2.14.0
[    45.981] (==) intel(0): VideoRam: 262144 KB
[    45.981] (II) intel(0): [DRI2] Setup complete
[    45.981] (II) intel(0): [DRI2]   DRI driver: i965

How reproducible:
100%

Steps to Reproduce:
1. open firefox, open a form with a history.
2. type a letter that leads to the completion options dropdown appearing
  
Actual results:
mutter crashes


Expected results:
no crash, just appearance of the dropdown.

Additional info:


Recorded gdb session:

Continuing.
[New Thread 0x7f75e96ff700 (LWP 18735)]
[New Thread 0x7f75be504700 (LWP 18736)]
[New Thread 0x7f75b6bff700 (LWP 18737)]
[New Thread 0x7f75b61f8700 (LWP 18738)]
[New Thread 0x7f75b57ff700 (LWP 18739)]
[Thread 0x7f75bed05700 (LWP 18677) exited]
[Thread 0x7f75e96ff700 (LWP 18735) exited]
[Thread 0x7f75be504700 (LWP 18736) exited]
[Thread 0x7f75b6bff700 (LWP 18737) exited]
[Thread 0x7f75b57ff700 (LWP 18739) exited]

Program received signal SIGABRT, Aborted.
0x00000035bf236285 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
64	  return INLINE_SYSCALL (tgkill, 3, pid, selftid, sig);
#0  0x00000035bf236285 in raise (sig=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00000035bf237b9b in abort () at abort.c:92
#2  0x00000035bf22ebdd in __assert_fail (assertion=0x7f75f9c7abcb "!texImage->Data", file=<optimized out>, line=726, function=<optimized out>) at assert.c:81
#3  0x00007f75f9a5f269 in intelSetTexBuffer2 (pDRICtx=<optimized out>, target=3553, texture_format=<optimized out>, dPriv=<optimized out>) at intel_tex_image.c:726
#4  0x00000030798f6336 in _cogl_texture_pixmap_x11_update_glx_texture (needs_mipmap=<optimized out>, tex_pixmap=0x3a22e70) at winsys/cogl-texture-pixmap-x11.c:1038
#5  _cogl_texture_pixmap_x11_update (tex_pixmap=0x3a22e70, needs_mipmap=<optimized out>) at winsys/cogl-texture-pixmap-x11.c:1087
#6  0x00000030798f6b2b in _cogl_texture_pixmap_x11_pre_paint (tex=<optimized out>, flags=0) at winsys/cogl-texture-pixmap-x11.c:1289
#7  0x00000030798d8488 in _cogl_pipeline_layer_pre_paint (layer=0x38a9500) at ./cogl-pipeline.c:5666
#8  0x00000030798c76f3 in _cogl_rectangles_validate_layer_cb (pipeline=0x389c480, layer_index=0, user_data=0x7fff8d916e10) at ./cogl-primitives.c:618
#9  0x00000030798d68f6 in cogl_pipeline_foreach_layer (pipeline=0x389c480, callback=0x30798c76c0 <_cogl_rectangles_validate_layer_cb>, user_data=0x7fff8d916e10) at ./cogl-pipeline.c:761
#10 0x00000030798c7572 in _cogl_rectangles_with_multitexture_coords (rects=0x7fff8d916e80, n_rects=1) at ./cogl-primitives.c:734
#11 0x00000030798c7c0b in cogl_rectangle_with_multitexture_coords (x_1=<optimized out>, y_1=<optimized out>, x_2=<optimized out>, y_2=<optimized out>, user_tex_coords=<optimized out>, 
    user_tex_coords_len=<optimized out>) at ./cogl-primitives.c:895
#12 0x000000000042aad6 in meta_shaped_texture_paint (actor=<optimized out>) at compositor/meta-shaped-texture.c:427
#13 0x00000035c1a0e229 in g_closure_invoke (closure=0x2875dd0, return_value=0x0, n_param_values=1, param_values=0x2cc5a60, invocation_hint=0x7fff8d917070) at gclosure.c:767
#14 0x00000035c1a1ecfd in signal_emit_unlocked_R (node=<optimized out>, detail=0, instance=0x2e16b40, emission_return=0x0, instance_and_params=0x2cc5a60) at gsignal.c:3290
#15 0x00000035c1a288ea in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=<optimized out>) at gsignal.c:2983
#16 0x00000035c1a28a92 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3040
#17 0x000000307984cd77 in clutter_actor_paint (self=0x2e16b40 [MetaShapedTexture]) at ./clutter-actor.c:2694
#18 0x00000035bee3e317 in g_list_foreach (list=<optimized out>, func=0x307984cae0 <clutter_actor_paint>, user_data=0x0) at glist.c:938
#19 0x00000030798768f2 in clutter_group_real_paint (actor=0x2e1ab40 [MetaWindowActor]) at ./clutter-group.c:281
#20 0x000000000042c91f in meta_window_actor_paint (actor=0x2e1ab40 [MetaWindowActor]) at compositor/meta-window-actor.c:712
#21 0x00000035c1a0e229 in g_closure_invoke (closure=0x2875dd0, return_value=0x0, n_param_values=1, param_values=0x2cacd40, invocation_hint=0x7fff8d9177f0) at gclosure.c:767
#22 0x00000035c1a1ecfd in signal_emit_unlocked_R (node=<optimized out>, detail=0, instance=0x2e1ab40, emission_return=0x0, instance_and_params=0x2cacd40) at gsignal.c:3290
#23 0x00000035c1a288ea in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=<optimized out>) at gsignal.c:2983
#24 0x00000035c1a28a92 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3040
#25 0x000000307984cd77 in clutter_actor_paint (self=0x2e1ab40 [MetaWindowActor]) at ./clutter-actor.c:2694
#26 0x00000035bee3e317 in g_list_foreach (list=<optimized out>, func=0x307984cae0 <clutter_actor_paint>, user_data=0x0) at glist.c:938
#27 0x00000030798768f2 in clutter_group_real_paint (actor=0x287e010 [MetaWindowGroup]) at ./clutter-group.c:281
#28 0x000000000042f010 in meta_window_group_paint (actor=0x287e010 [MetaWindowGroup]) at compositor/meta-window-group.c:191
#29 0x00000035c1a0e229 in g_closure_invoke (closure=0x2875dd0, return_value=0x0, n_param_values=1, param_values=0x2c976a0, invocation_hint=0x7fff8d917fe0) at gclosure.c:767
#30 0x00000035c1a1ecfd in signal_emit_unlocked_R (node=<optimized out>, detail=0, instance=0x287e010, emission_return=0x0, instance_and_params=0x2c976a0) at gsignal.c:3290
#31 0x00000035c1a288ea in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=<optimized out>) at gsignal.c:2983
#32 0x00000035c1a28a92 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3040
#33 0x000000307984cd77 in clutter_actor_paint (self=0x287e010 [MetaWindowGroup]) at ./clutter-actor.c:2694
#34 0x00000035bee3e317 in g_list_foreach (list=<optimized out>, func=0x307984cae0 <clutter_actor_paint>, user_data=0x0) at glist.c:938
#35 0x00000030798768f2 in clutter_group_real_paint (actor=0x2864a80 [ClutterGroup]) at ./clutter-group.c:281
#36 0x00000035c1a0e229 in g_closure_invoke (closure=0x2875dd0, return_value=0x0, n_param_values=1, param_values=0x38bec40, invocation_hint=0x7fff8d9186f0) at gclosure.c:767
#37 0x00000035c1a1ecfd in signal_emit_unlocked_R (node=<optimized out>, detail=0, instance=0x2864a80, emission_return=0x0, instance_and_params=0x38bec40) at gsignal.c:3290
#38 0x00000035c1a288ea in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=<optimized out>) at gsignal.c:2983
#39 0x00000035c1a28a92 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3040
#40 0x000000307984cd77 in clutter_actor_paint (self=0x2864a80 [ClutterGroup]) at ./clutter-actor.c:2694
#41 0x00000035bee3e317 in g_list_foreach (list=<optimized out>, func=0x307984cae0 <clutter_actor_paint>, user_data=0x0) at glist.c:938
#42 0x00000030798768f2 in clutter_group_real_paint (actor=0x287a040 [ClutterStage]) at ./clutter-group.c:281
#43 0x0000003079896401 in clutter_stage_paint (self=0x287a040 [ClutterStage]) at ./clutter-stage.c:454
#44 0x00000035c1a0e2de in g_closure_invoke (closure=0x2875dd0, return_value=0x0, n_param_values=1, param_values=0x2cad000, invocation_hint=0x7fff8d918e30) at gclosure.c:767
#45 0x00000035c1a1ecfd in signal_emit_unlocked_R (node=<optimized out>, detail=0, instance=0x287a040, emission_return=0x0, instance_and_params=0x2cad000) at gsignal.c:3290
#46 0x00000035c1a288ea in g_signal_emit_valist (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>, var_args=<optimized out>) at gsignal.c:2983
#47 0x00000035c1a28a92 in g_signal_emit (instance=<optimized out>, signal_id=<optimized out>, detail=<optimized out>) at gsignal.c:3040
#48 0x000000307984cd77 in clutter_actor_paint (self=0x287a040 [ClutterStage]) at ./clutter-actor.c:2694
#49 0x000000307989a419 in _clutter_stage_do_paint (stage=0x287a040 [ClutterStage], clip=<optimized out>) at ./clutter-stage.c:393
#50 0x000000307983c044 in clutter_stage_glx_redraw (stage_window=0x27ebcc0) at glx/clutter-stage-glx.c:432
#51 clutter_stage_glx_redraw (stage_window=0x27ebcc0) at glx/clutter-stage-glx.c:365
#52 0x0000003079899fa8 in clutter_stage_do_redraw (stage=0x287a040 [ClutterStage]) at ./clutter-stage.c:833
#53 _clutter_stage_do_update (stage=0x287a040 [ClutterStage]) at ./clutter-stage.c:886
#54 0x0000003079881710 in clutter_clock_dispatch (source=<optimized out>, callback=<optimized out>, user_data=<optimized out>) at ./clutter-master-clock.c:384
#55 0x00000035bee42a9d in g_main_dispatch (context=0x2415eb0) at gmain.c:2440
#56 g_main_context_dispatch (context=0x2415eb0) at gmain.c:3013
#57 0x00000035bee43278 in g_main_context_iterate (context=0x2415eb0, block=<optimized out>, dispatch=1, self=<optimized out>) at gmain.c:3091
#58 0x00000035bee438ba in g_main_loop_run (loop=0x241d3c0) at gmain.c:3299
#59 0x0000000000421859 in main (argc=1, argv=0x7fff8d919d38) at core/main.c:707
#1  0x00000035bf237b9b in abort () at abort.c:92
92	      raise (SIGABRT);
#2  0x00000035bf22ebdd in __assert_fail (assertion=0x7f75f9c7abcb "!texImage->Data", file=<optimized out>, line=726, function=<optimized out>) at assert.c:81
81	  abort ();
#3  0x00007f75f9a5f269 in intelSetTexBuffer2 (pDRICtx=<optimized out>, target=3553, texture_format=<optimized out>, dPriv=<optimized out>) at intel_tex_image.c:726
726	      assert(!texImage->Data);
fb = 0x5
intel = 0x24a9c60
ctx = 0x24a9c60
intelObj = 0x38b1c00
intelImage = 0x3088270
mt = 0x33b16e0
rb = 0x2a88710
texObj = 0x38b1c00
texImage = 0x3088270
texFormat = MESA_FORMAT_XRGB8888
__PRETTY_FUNCTION__ = "intelSetTexBuffer2"
$1 = {InternalFormat = 6407, _BaseFormat = 6407, TexFormat = 5, Border = 0, Width = 276, Height = 24, Depth = 1, Width2 = 276, Height2 = 24, Depth2 = 1, WidthLog2 = 8, HeightLog2 = 4, DepthLog2 = 0, 
  MaxLog2 = 8, WidthScale = 276, HeightScale = 24, DepthScale = 1, IsClientData = 0 '\000', _IsPowerOfTwo = 0 '\000', TexObject = 0x38b1c00, FetchTexelc = 0x7f75f9c460a0 <fetch_texel_float_to_chan>, 
  FetchTexelf = 0x7f75f9c41f50 <fetch_texel_2d_f_xrgb8888>, RowStride = 384, ImageOffsets = 0x35fdff0, Data = 0x3be1400, DriverData = 0x0}
A debugging session is active.

	Inferior 1 [process 18668] will be detached.

Quit anyway? (y or n) Detaching from program: /usr/bin/mutter, process 18668