System monitor crashes X when menu clicked if BackingStore option used - compUnredirectWindow+0x7b

I have a reproducible bug that crashes X11 whenever I click on a menu (file for example) in gnome-system-monitor in Intrepid. X11 completely crashes with the following stack trace:

It also randomly occurs when using gnome-system-monitor, but I'm not sure if that is a different bug or not. I am running Nvidia's restricted drivers, but it occurs with them turned off as well. I have tried reinstalling every package using aptitude and removing all obsolete and autoremovable packages, after a restart I was able to click on the file menu once, afterwards the bug returned.

[backtrace]
#0 miPaintWindow (pWin=0x92cef28, prgn=0x92e1f54, what=1) at ../../mi/miexpose.c:640
        pScreen = <value optimized out>
        gcval = {{val = 3, ptr = 0x3}, {val = 0, ptr = 0x0}, {val = 0, ptr = 0x0}, {val = 154017576, ptr = 0x92e1f28}, {
    val = 3217980920, ptr = 0xbfce7df8}}
        gcmask = <value optimized out>
        pGC = (GCPtr) 0x9121d40
        i = 153661950
        pbox = (BoxPtr) 0xb7d31178
        prect = (xRectangle *) 0x67f12e90
        numRects = 154018256
        draw_x_off = <value optimized out>
        draw_y_off = <value optimized out>
        tile_x_off = <value optimized out>
        tile_y_off = <value optimized out>
        fill = <value optimized out>
        drawable = (DrawablePtr) 0x9309330
#1 0x08128ab5 in miHandleValidateExposures (pWin=0x9121f00) at ../../mi/miwindow.c:454
        pChild = (WindowPtr) 0x92cef28
        val = (ValidatePtr) 0x92e1f48
        WindowExposures = (WindowExposuresProcPtr) 0x80d8450 <xf86XVWindowExposures>
#2 0x08076e28 in UnmapWindow (pWin=0x92dd8d0, fromConfigure=0) at ../../dix/window.c:3062
        pParent = <value optimized out>
        event = {u = {u = {type = 136 '\210', detail = 126 '~', sequenceNumber = 49102}, keyButtonPointer = {
      pad00 = 3217981064, time = 3083105366, root = 3084063040, event = 153999832, child = 153999824, rootX = 32756,
      rootY = 2077, eventX = -9752, eventY = 2349, state = 208, sameScreen = 0 '\0', pad1 = 0 '\0'}, enterLeave = {
      pad00 = 3217981064, time = 3083105366, root = 3084063040, event = 153999832, child = 153999824, rootX = 32756,
      rootY = 2077, eventX = -9752, eventY = 2349, state = 208, mode = 0 '\0', flags = 0 '\0'}, focus = {
      pad00 = 3217981064, window = 3083105366, mode = 64 '@', pad1 = 17 '\021', pad2 = 211 'Ó', pad3 = 183 '·'}, expose = {
      pad00 = 3217981064, window = 3083105366, x = 4416, y = 47059, width = 55768, height = 2349, count = 55760,
      pad2 = 2349}, graphicsExposure = {pad00 = 3217981064, drawable = 3083105366, x = 4416, y = 47059, width = 55768,
      height = 2349, minorEvent = 55760, count = 2349, majorEvent = 244 'ô', pad1 = 127 '\177', pad2 = 29 '\035',
      pad3 = 8 '\b'}, noExposure = {pad00 = 3217981064, drawable = 3083105366, minorEvent = 4416, majorEvent = 211 'Ó',
      bpad = 183 '·'}, visibility = {pad00 = 3217981064, window = 3083105366, state = 64 '@', pad1 = 17 '\021',
      pad2 = 211 'Ó', pad3 = 183 '·'}, createNotify = {pad00 = 3217981064, parent = 3083105366, window = 3084063040,
      x = -9768, y = 2349, width = 55760, height = 2349, borderWidth = 32756, override = 29 '\035', bpad = 8 '\b'},
    destroyNotify = {pad00 = 3217981064, event = 3083105366, window = 3084063040}, unmapNotify = {pad00 = 3217981064,
      event = 3083105366, window = 3084063040, fromConfigure = 216 'Ø', pad1 = 217 'Ù', pad2 = 45 '-', pad3 = 9 '\t'},
    mapNotify = {pad00 = 3217981064, event = 3083105366, window = 3084063040, override = 216 'Ø', pad1 = 217 'Ù',
      pad2 = 45 '-', pad3 = 9 '\t'}, mapRequest = {pad00 = 3217981064, parent = 3083105366, window = 3084063040},
    reparent = {pad00 = 3217981064, event = 3083105366, window = 3084063040, parent = 153999832, x = -9776, y = 2349,
      override = 244 'ô', pad1 = 127 '\177', pad2 = 29 '\035', pad3 = 8 '\b'}, configureNotify = {pad00 = 3217981064,
      event = 3083105366, window = 3084063040, aboveSibling = 153999832, x = -9776, y = 2349, width = 32756, height = 2077,
      borderWidth = 55784, override = 45 '-', bpad = 9 '\t'}, configureRequest = {pad00 = 3217981064, parent = 3083105366,
      window = 3084063040, sibling = 153999832, x = -9776, y = 2349, width = 32756, height = 2077, borderWidth = 55784,
      valueMask = 2349, pad1 = 208}, gravity = {pad00 = 3217981064, event = 3083105366, window = 3084063040, x = -9768,
      y = 2349, pad1 = 153999824, pad2 = 136151028, pad3 = 153999848, pad4 = 208}, resizeRequest = {pad00 = 3217981064,
      window = 3083105366, width = 4416, height = 47059}, circulate = {pad00 = 3217981064, event = 3083105366,
      window = 3084063040, parent = 153999832, place = 208 'Ð', pad1 = 217 'Ù', pad2 = 45 '-', pad3 = 9 '\t'}, property = {
      pad00 = 3217981064, window = 3083105366, atom = 3084063040, time = 153999832, state = 208 'Ð', pad1 = 217 'Ù',
      pad2 = 2349}, selectionClear = {pad00 = 3217981064, time = 3083105366, window = 3084063040, atom = 153999832},
    selectionRequest = {pad00 = 3217981064, time = 3083105366, owner = 3084063040, requestor = 153999832,
      selection = 153999824, target = 136151028, property = 153999848}, selectionNotify = {pad00 = 3217981064,
      time = 3083105366, requestor = 3084063040, selection = 153999832, target = 153999824, property = 136151028},
    colormap = {pad00 = 3217981064, window = 3083105366, colormap = 3084063040, new = 216 'Ø', state = 217 'Ù',
      pad1 = 45 '-', pad2 = 9 '\t'}, mappingNotify = {pad00 = 3217981064, request = 86 'V', firstKeyCode = 116 't',
      count = 196 'Ä', pad1 = 183 '·'}, clientMessage = {pad00 = 3217981064, window = 3083105366, u = {l = {
          type = 3084063040, longs0 = 153999832, longs1 = 153999824, longs2 = 136151028, longs3 = 153999848, longs4 = 208},
        s = {type = 3084063040, shorts0 = -9768, shorts1 = 2349, shorts2 = -9776, shorts3 = 2349, shorts4 = 32756,
          shorts5 = 2077, shorts6 = -9752, shorts7 = 2349, shorts8 = 208, shorts9 = 0}, b = {type = 3084063040,
          bytes = "ØÙ-\tÐÙ-\tô\177\035\bèÙ-\tÐ\000\000"}}}}}
        wasRealized = 1
        pScreen = (ScreenPtr) 0x90c3c08
        pLayerWin = (WindowPtr) 0x92dd8d0