Since it had checked that pDraw is not NULL, it makes me wonder if it is a corrupted memory issue. A race condition is another possibility, particularly when in the middle of destroying objects. Unfortunately it looks like a lot of variables have been optimized out. It would be nice to know what is going on with the r300_dri.so calls but I'm not sure that would buy much more info than we know so far.
Hmm, interesting, unfortunately you're right it's not enough information yet, but it does prove this to be a mesa bug rather than -ati. Refiling.
Looking in the code, it seems to be crashing around these lines:
if (drawable- >base.pDraw == NULL)
return GL_FALSE;
pScreen = drawable- >base.pDraw- >pScreen; // <-- crash
Since it had checked that pDraw is not NULL, it makes me wonder if it is a corrupted memory issue. A race condition is another possibility, particularly when in the middle of destroying objects. Unfortunately it looks like a lot of variables have been optimized out. It would be nice to know what is going on with the r300_dri.so calls but I'm not sure that would buy much more info than we know so far.