the crash is on "free(block);" in free_block()

the full bt

0xb8005430 in __kernel_vsyscall ()
(gdb) bt full
#0  0xb8005430 in __kernel_vsyscall ()
No symbol table info available.
#1  0xb7be16d0 in raise () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#2  0xb7be3098 in abort () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#3  0xb7c1f24d in ?? () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#4  0xb7c25604 in ?? () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#5  0xb7c275b6 in free () from /lib/tls/i686/cmov/libc.so.6
No symbol table info available.
#6  0xb7862e25 in free_block (bufmgr_fake=0x93730f0, block=0xcc956c8)
    at ../../../libdrm/intel/intel_bufmgr_fake.c:473
	bo_fake = (drm_intel_bo_fake *) 0x937cac0
#7  0xb7863dd7 in drm_intel_fake_bo_unreference_locked (bo=0x937cac0)
    at ../../../libdrm/intel/intel_bufmgr_fake.c:875
	bufmgr_fake = (drm_intel_bufmgr_fake *) 0x93730f0
	bo_fake = (drm_intel_bo_fake *) 0x937cac0
	i = 154652032
	__PRETTY_FUNCTION__ = "drm_intel_fake_bo_unreference_locked"
#8  0xb7863e0a in drm_intel_fake_bo_unreference_locked (bo=0x937cd80)
    at ../../../libdrm/intel/intel_bufmgr_fake.c:879
---Type <return> to continue, or q <return> to quit---
	bufmgr_fake = (drm_intel_bufmgr_fake *) 0x93730f0
	bo_fake = (drm_intel_bo_fake *) 0x937cd80
	i = 0
	__PRETTY_FUNCTION__ = "drm_intel_fake_bo_unreference_locked"
#9  0xb7863e98 in drm_intel_fake_bo_unreference (bo=0x937cd80)
    at ../../../libdrm/intel/intel_bufmgr_fake.c:894
	bufmgr_fake = (drm_intel_bufmgr_fake *) 0x93730f0
#10 0xb7862417 in drm_intel_bo_unreference (bo=0x937cd80)
    at ../../../libdrm/intel/intel_bufmgr.c:73
No locals.
#11 0xb78d81dc in gen4_render_state_cleanup (pScrn=0x9326d80)
    at ../../src/i965_render.c:1727
	render_state = (struct gen4_render_state *) 0x937c240
	i = 0
#12 0xb78ab65d in I830LeaveVT (scrnIndex=0, flags=0)
    at ../../src/i830_driver.c:3624
	pScrn = (ScrnInfoPtr) 0x9326d80
	pI830 = (I830Ptr) 0x93273e0
#13 0x080de1da in xf86XVLeaveVT (index=0, flags=0)
    at ../../../../hw/xfree86/common/xf86xv.c:1269
	pxvs = (XvScreenPtr) 0xc9ec648
	pAdaptor = (XvAdaptorPtr) 0xc9ed4ac
	pPriv = (XvPortRecPrivatePtr) 0xc9ee640
---Type <return> to continue, or q <return> to quit---
	i = 2
	j = 1
#14 0x080c8277 in xf86Wakeup (blockData=0x0, err=-1, pReadmask=0x81f72c0)
    at ../../../../hw/xfree86/common/xf86Events.c:551
	devicesWithInput = {fds_bits = {1, 213397752, -1208852492, 
    -1081994872, -1209026216, 213397752, -1208852492, -1081994872, 
    -1209028076, 11259375, -1081994876, 0, -1208937201, 213397752, 
    -1208852492, -1081994824, -1209019522, 11259375, 7, 0, -1209018673, 
    136208372, 128, 0, 136250328, 136278720, 1, -1081994792, 134921617, 
    213397752, 0, 0}}
	pInfo = <value optimized out>
#15 0x08091322 in WakeupHandler (result=-1, pReadmask=0x81f72c0)
    at ../../dix/dixutils.c:418
	i = 0
#16 0x081329eb in WaitForSomething (pClientsReady=0xcb82530)
    at ../../os/WaitFor.c:231
	i = -1
	waittime = {tv_sec = 583, tv_usec = 350643}
	wt = (struct timeval *) 0xbf821460
	timeout = <value optimized out>
	clientsReadable = {fds_bits = {0 <repeats 32 times>}}
	clientsWritable = {fds_bits = {135506185, 136208372, -1211995020, 
    -1081994344, 1, -1081994220, -1211555332, 1, -1081994220, 26, 213786208, 
---Type <return> to continue, or q <return> to quit---
    136208372, 213372264, 32, -1081994312, 135512702, 26, -1081994220, 1, 
    -1211019276, -1211014848, 136208372, -1081994280, 135508671, 213372264, 
    -1081994220, 1, -1211014848, -1211014848, 214883424, -1081994184, 
    135492194}}
	curclient = <value optimized out>
	selecterr = 4
	nready = <value optimized out>
	devicesReadable = {fds_bits = {154612528, 214883424, 154322128, 
    134813313, 32, 154322128, 213360568, -1211014848, -1211014848, 214883424, 
    -1211995020, 213360696, 88, 213790832, 213790824, 136208372, 136238592, 
    64, -1211995020, -1210924908, 136208372, 0, -1081994392, 135506213, 1, 
    -1081994412, -1211995020, -1211014848, 0, 32988, 743239423, 136208372}}
	now = 32988743
	someReady = 0
#17 0x0808d2be in Dispatch () at ../../dix/dispatch.c:367
	result = 136277280
	client = (ClientPtr) 0xcb7ae80
	nready = -1
	start_tick = 1300
#18 0x080722ed in main (argc=10, argv=0xbf8215b4, envp=Cannot access memory at address 0x6160
)
    at ../../dix/main.c:397
	i = <value optimized out>
	alwaysCheckForInput = {0, 1}


the gdb value

(gdb) p *pI830
$1 = {MMIOBase = 0xb77e1000 '�' <repeats 200 times>..., 
  GTTBase = 0xb7761000 "\001", FbBase = 0xa7742000 " ", cpp = 4, 
  entityPrivate = 0x0, init = 0, bufferOffset = 8564736, FbMemBox = {x1 = 0, 
    y1 = 0, x2 = 2944, y2 = 2840}, FbMemBox2 = {x1 = 0, y1 = 0, x2 = 0, 
    y2 = 0}, CacheLines = -1, FbMapSize = 268435456, GTTMapSize = 524288, 
  memory_list = 0x932c730, bo_list = 0x0, stolen_size = 7860224, 
  gtt_acquired = 0, front_buffer = 0x932d1f0, front_buffer_2 = 0x0, 
  compressed_front_buffer = 0x0, compressed_ll_buffer = 0x0, 
  cursor_mem = 0x932d0e0, cursor_mem_classic = {0x0, 0x0}, cursor_mem_argb = {
    0x0, 0x0}, xaa_scratch = 0x0, xaa_scratch_2 = 0x0, 
  exa_offscreen = 0x932d258, fake_bufmgr_mem = 0x932d140, LpRing = 0x932baf0, 
  ring_emitting = 0, ring_used = 16, ring_next = 9632, bufmgr = 0x93730f0, 
  batch_ptr = 0x0, batch_used = 0, batch_emit_start = 0, batch_emitting = 0, 
  batch_bo = 0xcb763f0, in_batch_atomic = 0, batch_atomic_limit = 800, 
  overlay_regs = 0x932d1a0, XvMCEnabled = 0, shadowReq = {
    majorversion = 0 '\0', minorversion = 0 '\0', patchlevel = 0, 
    abiclass = 0x0, abiversion = 0, moduleclass = 0x0}, rotation = 1, 
  PointerMoved = 0x80f74a0 <xf86RandR12PointerMoved>, 
  CreateScreenResources = 0xb7879170 <exaCreateScreenResources>, 
  power_context = 0x9372fd0, back_buffer = 0x0, depth_buffer = 0x0, 
  textures = 0x0, memory_manager = 0x0, hw_status = 0x0, TexGranularity = 0, 
  drmMinor = 0, allocate_classic_textures = 0, can_resize = 0, 
  want_vblank_interrupts = 0, need_mi_flush = 0, NeedRingBufferLow = 0, 
---Type <return> to continue, or q <return> to quit---
  tiling = 1, fb_compression = 0, backPitch = 0, CursorNeedsPhysical = 0, 
  DGAModes = 0x0, numDGAModes = 0, DGAactive = 0, DGAViewportStatus = 0, 
  Chipset = 0, LinearAddr = 3758096384, MMIOAddr = 4271898624, ioBase = 0, 
  pEnt = 0x93273b8, PciInfo = 0x93256c8, variant = 0 '\0', BR = {
    0 <repeats 13 times>, 63700992, 0, 0, 15723495, 0, 0, 0}, 
  ScanlineColorExpandBuffers = 0x0, NumScanlineColorExpandBuffers = 0, 
  nextColorExpandBuf = 0, fence_used = {0 <repeats 16 times>}, 
  accel = ACCEL_EXA, SWCursor = 0, AccelInfoRec = 0x0, saved_composite = 0, 
  xaa_check_composite = 0, xaa_prepare_composite = 0, xaa_composite = 0, 
  xaa_done_composite = 0, CloseScreen = 0x80f9d90 <xf86CursorCloseScreen>, 
  batch_flush_notify = 0xb78d8250 <i965_batch_flush_notify>, 
  EXADriverPtr = 0x9373c90, uxa_driver = 0x0, need_flush = 0, need_sync = 0, 
  pSrcPixmap = 0xa66e9008, accel_pixmap_pitch_alignment = 64, 
  accel_pixmap_offset_alignment = 8, accel_max_x = 8192, accel_max_y = 8192, 
  writeControl = 0xb78b0620 <I830WriteControlMMIO>, 
  readControl = 0xb78b0660 <I830ReadControlMMIO>, 
  writeStandard = 0xb78b0680 <I830WriteStandardMMIO>, 
  readStandard = 0xb78b06a0 <I830ReadStandardMMIO>, XvDisabled = 0, 
  XvEnabled = 1, XvPreferOverlay = 0, colorKey = 66046, adaptor = 0xc9ecf70, 
  BlockHandler = 0x8124e70 <miSpriteBlockHandler>, overlayOn = 0x932ad40, 
  video = {gen4_vs_bo = 0x0, gen4_sf_bo = 0x0, gen4_wm_packed_bo = 0x0, 
    gen4_wm_planar_bo = 0x0, gen4_cc_bo = 0x0, gen4_cc_vp_bo = 0x0, 
    gen4_sampler_bo = 0x0, gen4_sip_kernel_bo = 0x0}, scale_units = {{1, 1}, {
---Type <return> to continue, or q <return> to quit---
      67, 22}}, transform = {0x0, 0x0}, coord_adjust = 0, mapstate = {0, 0, 0, 
    0, 0, 0}, samplerstate = {0, 0, 0, 0, 0, 0}, i915_render_state = {op = 0, 
    pSrcPicture = 0x0, pMaskPicture = 0x0, pDstPicture = 0x0, pSrc = 0x0, 
    pMask = 0x0, pDst = 0x0, dst_format = 0, is_nearest = 0, needs_emit = 0}, 
  gen4_render_state = 0x937c240, directRenderingType = DRI_NONE, 
  directRenderingOpen = 0, LockHeld = 0, pDRIInfo = 0x0, drmSubFD = 0, 
  numVisualConfigs = 0, pVisualConfigs = 0x0, pVisualConfigsPriv = 0x0, 
  buffer_map = 0, ring_map = 0, deviceName = '\0' <repeats 63 times>, 
  Options = 0x9329188, lvds_24_bit_mode = 0, lvds_use_ssc = 1, 
  lvds_ssc_freq = 100, lvds_dither = 1, lvds_fixed_mode = 0x932ac30, 
  skip_panel_detect = 0, tv_present = 1, StolenOnly = 0, preinit = 0, 
  starting = 0, closing = 0, suspended = 0, leaving = 1, xoffset = 896, 
  yoffset = 727, SaveGeneration = 1, devicesTimer = 0x0, ddc2 = 1, 
  backlight_control_method = BCM_COMBO, saveDSPARB = 11048, 
  saveDSPACNTR = 1476395008, saveDSPBCNTR = 3640656896, savePIPEACONF = 0, 
  savePIPEBCONF = 3221225472, savePIPEASRC = 83821567, 
  savePIPEBSRC = 94307203, saveFPA0 = 134664, saveFPA1 = 200968, 
  saveDPLL_A = 335678464, saveDPLL_A_MD = 0, saveHTOTAL_A = 112133375, 
  saveHBLANK_A = 112133375, saveHSYNC_A = 97977687, saveVTOTAL_A = 72287231, 
  saveVBLANK_A = 72287231, saveVSYNC_A = 67699714, saveBCLRPAT_A = 0, 
  saveDSPASTRIDE = 5120, saveDSPASIZE = 0, saveDSPAPOS = 0, saveDSPABASE = 0, 
  saveDSPASURF = 75538432, saveDSPATILEOFF = 0, saveFPB0 = 199433, 
  saveFPB1 = 200968, saveDPLL_B = 2567072768, saveDPLL_B_MD = 0, 
---Type <return> to continue, or q <return> to quit---
  saveHTOTAL_B = 127862175, saveHBLANK_B = 127862175, saveHSYNC_B = 104793583, 
  saveVTOTAL_B = 60621699, saveVBLANK_B = 60621699, saveVSYNC_B = 59507590, 
  saveBCLRPAT_B = 0, saveDSPBSTRIDE = 11776, saveDSPBSIZE = 0, 
  saveDSPBPOS = 0, saveDSPBBASE = 0, saveDSPBSURF = 41545728, 
  saveDSPBTILEOFF = 0, saveVCLK_DIVISOR_VGA0 = 200968, 
  saveVCLK_DIVISOR_VGA1 = 201734, saveVCLK_POST_DIV = 131074, 
  saveVGACNTRL = 2730754190, saveCURSOR_A_CONTROL = 67108903, 
  saveCURSOR_A_BASE = 75104256, saveCURSOR_A_POSITION = 28312128, 
  saveCURSOR_B_CONTROL = 268435456, saveCURSOR_B_BASE = 75124736, 
  saveCURSOR_B_POSITION = 30146575, saveADPA = 3096, saveLVDS = 3257959228, 
  saveDVOA = 0, saveDVOB = 0, saveDVOC = 0, savePP_ON = 19664895, 
  savePP_OFF = 16386000, savePP_CONTROL = 3, savePP_DIVISOR = 4095751, 
  savePFIT_CONTROL = 0, savePaletteA = {0 <repeats 256 times>}, 
  savePaletteB = {0, 168, 43008, 43176, 11010048, 11010216, 11031552, 
    11053224, 5526612, 5526780, 5569620, 5569788, 16536660, 16536828, 
    16579668, 16579836, 1052688, 1118481, 1184274, 1250067, 1315860, 1381653, 
    1447446, 1513239, 1579032, 1644825, 1710618, 1776411, 1842204, 1907997, 
    1973790, 2039583, 2105376, 2171169, 2236962, 2302755, 2368548, 2434341, 
    2500134, 2565927, 2631720, 2697513, 2763306, 2829099, 2894892, 2960685, 
    3026478, 3092271, 3158064, 3223857, 3289650, 3355443, 3421236, 3487029, 
    3552822, 3618615, 3684408, 3750201, 3815994, 3881787, 3947580, 4013373, 
    4079166, 4144959, 4210752, 4276545, 4342338, 4408131, 4473924, 4539717, 
    4605510, 4671303, 4737096, 4802889, 4868682, 4934475, 5000268, 5066061, 
---Type <return> to continue, or q <return> to quit---
    5131854, 5197647, 5263440, 5329233, 5395026, 5460819, 5526612, 5592405, 
    5658198, 5723991, 5789784, 5855577, 5921370, 5987163, 6052956, 6118749, 
    6184542, 6250335, 6316128, 6381921, 6447714, 6513507, 6579300, 6645093, 
    6710886, 6776679, 6842472, 6908265, 6974058, 7039851, 7105644, 7171437, 
    7237230, 7303023, 7368816, 7434609, 7500402, 7566195, 7631988, 7697781, 
    7763574, 7829367, 7895160, 7960953, 8026746, 8092539, 8158332, 8224125, 
    8289918, 8355711, 8421504, 8487297, 8553090, 8618883, 8684676, 8750469, 
    8816262, 8882055, 8947848, 9013641, 9079434, 9145227, 9211020, 9276813, 
    9342606, 9408399, 9474192, 9539985, 9605778, 9671571, 9737364, 9803157, 
    9868950, 9934743, 10000536, 10066329, 10132122, 10197915, 10263708, 
    10329501, 10395294, 10461087, 10526880, 10592673, 10658466, 10724259, 
    10790052, 10855845, 10921638, 10987431, 11053224, 11119017, 11184810, 
    11250603, 11316396, 11382189, 11447982, 11513775, 11579568, 11645361, 
    11711154, 11776947, 11842740, 11908533, 11974326, 12040119, 12105912, 
    12171705, 12237498, 12303291, 12369084, 12434877, 12500670, 12566463, 
    12632256, 12698049, 12763842, 12829635, 12895428, 12961221, 13027014, 
    13092807...}, saveSWF = {18876416, 1024, 0, 50528256, 3263299584, 527, 
    0 <repeats 11 times>}, saveBLC_PWM_CTL = 65602536, 
  saveBLC_PWM_CTL2 = 3758096384, saveFBC_CFB_BASE = 0, saveFBC_LL_BASE = 0, 
  saveFBC_CONTROL2 = 0, saveFBC_CONTROL = 0, saveFBC_FENCE_OFF = 0, 
  saveRENCLK_GATE_D1 = 536870912, saveRENCLK_GATE_D2 = 0, 
  saveDSPCLK_GATE_D = 0, saveRAMCLK_GATE_D = 0, savePWRCTXA = 1, 
  last_3d = 0x932c6e0, use_drm_mode = 0, kernel_exec_fencing = 0, 
---Type <return> to continue, or q <return> to quit---
  debug_modes = 0, quirk_flag = 0, force_sdvo_detect = 0, fallback_debug = 0}