Created attachment 442501 [details]
Output of rpm -qa

I enabled core dumps underneath gdm, so that I can actually capture some helpful information. This is still happening several times a day. Is there any info I can provide that will help track it down? Probably related is pretty regular display corruption while scrolling, but it's transient.

(gdb) list *0x00007fec8bb10098
0x7fec8bb10098 is in DrawableGone (glxext.c:133).
128	
129	    /* If this drawable was created using glx 1.3 drawable
130	     * constructors, we added it as a glx drawable resource under both
131	     * its glx drawable ID and it X drawable ID.  Remove the other
132	     * resource now so we don't a callback for freed memory. */
133	    if (glxPriv->drawId != glxPriv->pDraw->id) {
134		if (xid == glxPriv->drawId)
135		    FreeResourceByType(glxPriv->pDraw->id, __glXDrawableRes, TRUE);
136		else
137		    FreeResourceByType(glxPriv->drawId, __glXDrawableRes, TRUE);

(gdb) up 9
#9  0x00007fec8bb10098 in DrawableGone (glxPriv=0x4b6c250, xid=20971521)
    at glxext.c:133
133	    if (glxPriv->drawId != glxPriv->pDraw->id) {
(gdb) print glxPriv
$1 = (__GLXdrawable *) 0x4b6c250
(gdb) print glxPriv->pDraw
$2 = (DrawablePtr) 0x41


Full trace:
#0  0x00007fec8cc75ce5 in raise (sig=<optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
        resultvar = 0
        pid = <optimized out>
        selftid = 2461
#1  0x00007fec8cc771fb in abort () at abort.c:92
        save_stage = 2
        act = {__sigaction_handler = {sa_handler = 0, sa_sigaction = 0}, 
          sa_mask = {__val = {0, 140653950696352, 140653980424592, 0, 0, 0, 0, 
              4294967295, 0, 0, 5752208, 8179968, 0, 79067408, 8295576, 0}}, 
          sa_flags = -1905532460, sa_restorer = 0x1}
        sigs = {__val = {32, 0 <repeats 15 times>}}
#2  0x0000000000467ebe in OsAbort () at utils.c:1263
No locals.
#3  0x00000000004738dc in ddxGiveUp () at xf86Init.c:953
        i = <optimized out>
#4  0x000000000046487d in AbortServer () at log.c:424
No locals.
#5  0x0000000000464a85 in FatalError (
    f=0x57c590 "Caught signal %d (%s). Server aborting\n") at log.c:552
        args = {{gp_offset = 24, fp_offset = 48, 
            overflow_arg_area = 0x7fff30247fe0, 
            reg_save_area = 0x7fff30247f20}}
        beenhere = 1
#6  0x0000000000465aae in OsSigHandler (sip=<optimized out>, signo=11, 
    unused=<optimized out>) at osinit.c:156
No locals.
#7  OsSigHandler (signo=11, sip=<optimized out>, unused=<optimized out>)
    at osinit.c:118
No locals.
#8  <signal handler called>
No symbol table info available.
#9  0x00007fec8bb10098 in DrawableGone (glxPriv=0x4b6c250, xid=20971521)
    at glxext.c:133
        c = <optimized out>
        next = <optimized out>
#10 0x000000000044ff7c in FreeClientResources (client=0x4b67910)
    at resource.c:859
        rtype = <optimized out>
        resources = <optimized out>
        this = 0x4166700
        j = <optimized out>
#11 0x000000000043241a in CloseDownClient (client=0x4b67910) at dispatch.c:3490
        really_close_down = <optimized out>
#12 0x00000000004326a3 in ProcKillClient (client=0xbaf560) at dispatch.c:3271
        stuff = <optimized out>
        killclient = 0x4b67910
        rc = <optimized out>
#13 0x0000000000432f49 in Dispatch () at dispatch.c:432
        clientReady = 0xb58350
        result = <optimized out>
        client = 0xbaf560
        nready = 0
        icheck = 0x7e8770
        start_tick = 1286680
#14 0x00000000004271de in main (argc=11, argv=<optimized out>, 
    envp=<optimized out>) at main.c:291
        i = <optimized out>
        alwaysCheckForInput = {0, 1}

This appears to be a dup.

*** This bug has been marked as a duplicate of bug 701199 ***