Comment 28 for bug 597075

9a7e849 boots successfully. Marking it good which points to 9908ff7 as being the culprit. I've built two final test kernels. The first is a mainline 2.6.35-rc3 kernel with just the offending commit reverted:

http://people.canonical.com/~ogasawara/lp597075/2.6.35-rc3-9908ff7/

The second is the latest Maverick 2.6.35-6.7 kernel (which is based on mainline 2.6.35-rc3) with the offending commit reverted:

http://people.canonical.com/~ogasawara/lp597075/2.6.35-6.7-9908ff7/

Please test both and let me know your results. Thanks.

~/linux-2.6$ git bisect good
9908ff736adf261e749b4887486a32ffa209304c is the first bad commit
commit 9908ff736adf261e749b4887486a32ffa209304c
Author: Chris Wilson <email address hidden>
Date: Sat May 15 09:57:03 2010 +0100

    drm/i915: Kill dangerous pending-flip debugging

    We can, by virtue of a vblank interrupt firing in the middle of setting
    up the unpin work (i.e. after we set the unpin_work field and before we
    write to the ringbuffer) enter intel_finish_page_flip() prior to
    receiving the pending flip notification. Therefore we can expect to hit
    intel_finish_page_flip() under normal circumstances without a pending flip
    and even without installing the pending_flip_obj. This is exacerbated by
    aperture thrashing whilst binding the framebuffer

    References:

      Bug 28079 - "glresize" causes kernel panic in intel_finish_page_flip.
      https://bugs.freedesktop.org/show_bug.cgi?id=28079

    Reported-by: Nick Bowler <email address hidden>
    Signed-off-by: Chris Wilson <email address hidden>
    Cc: Jesse Barnes <email address hidden>
    Cc: <email address hidden>
    Reviewed-by: Jesse Barnes <email address hidden>
    Signed-off-by: Eric Anholt <email address hidden>

:040000 040000 8472a2b84c676e3c714e8c1f8392255b1959ae83 bd59f09180a36d398f7d0e63060851582593c14d M drivers