mir_demo_standalone_render_surfaces crashes in glDrawArrays

render_surfaces crashes in glDrawArrays. Verified with development-branch revision 1106.

(gdb) bt
#0 __memcpy_ssse3_back ()
    at ../sysdeps/x86_64/multiarch/memcpy-ssse3-back.S:2274
#1 0x00007ff380ef661d in memcpy (__len=48, __src=0x0, __dest=<optimised out>)
    at /usr/include/x86_64-linux-gnu/bits/string3.h:51
#2 intel_upload_data (brw=brw@entry=0x21a6ef0, ptr=ptr@entry=0x0,
    size=size@entry=48, align=align@entry=12,
    return_bo=return_bo@entry=0x21beb48,
    return_offset=return_offset@entry=0x21beb50)
    at ../../../../../../../src/mesa/drivers/dri/i965/intel_buffer_objects.c:486
#3 0x00007ff380f177fe in copy_array_to_vbo_array (brw=brw@entry=0x21a6ef0,
    min=min@entry=0, max=max@entry=3, buffer=0x21beb48, dst_stride=12,
    element=0x21be9c8)
    at ../../../../../../../src/mesa/drivers/dri/i965/brw_draw_upload.c:383
#4 0x00007ff380f17b34 in brw_prepare_vertices (brw=brw@entry=0x21a6ef0)
    at ../../../../../../../src/mesa/drivers/dri/i965/brw_draw_upload.c:570
#5 0x00007ff380f18216 in brw_emit_vertices (brw=0x21a6ef0)
    at ../../../../../../../src/mesa/drivers/dri/i965/brw_draw_upload.c:595
#6 0x00007ff380f596da in brw_upload_state (brw=brw@entry=0x21a6ef0)
    at ../../../../../../../src/mesa/drivers/dri/i965/brw_state_upload.c:513
#7 0x00007ff380f16cc6 in brw_try_draw_prims (max_index=<optimised out>,
    min_index=<optimised out>, ib=<optimised out>, nr_prims=<optimised out>,
    prim=<optimised out>, arrays=<optimised out>, ctx=0x21a6ef0)
    at ../../../../../../../src/mesa/drivers/dri/i965/brw_draw.c:445
#8 brw_draw_prims (ctx=0x21a6ef0, prim=<optimised out>,
    nr_prims=<optimised out>, ib=<optimised out>,
    index_bounds_valid=<optimised out>, min_index=0, max_index=3,
    tfb_vertcount=0x0)
    at ../../../../../../../src/mesa/drivers/dri/i965/brw_draw.c:530
#9 0x00007ff380a40974 in vbo_draw_arrays (ctx=0x21a6ef0, mode=5, start=0,
    count=4, numInstances=1, baseInstance=0)
    at ../../../../../src/mesa/vbo/vbo_exec_array.c:660
#10 0x00007ff386aedc16 in mir::compositor::GLRenderer::render(std::function<void (std::shared_ptr<void> const&)>, mir::compositor::CompositingCriteria const&, mir::surfaces::BufferStream&) (this=0x7ff374000e00, save_resource=..., criteria=
    ..., stream=...)
    at /home/dan/bzr/mir/dev/src/server/compositor/gl_renderer.cpp:276
#11 0x00007ff386aecdf6 in mir::compositor::RenderingOperator::operator() (
    this=0x7ff37af6bc80, info=..., stream=...)
    at /home/dan/bzr/mir/dev/src/server/compositor/rendering_operator.cpp:38
#12 0x00007ff386b4c71f in mir::surfaces::SurfaceStack::for_each_if (
    this=0x22ef768, filter=..., op=...)
    at /home/dan/bzr/mir/dev/src/server/surfaces/surface_stack.cpp:64
#13 0x00007ff386ae5d40 in mir::compositor::DefaultDisplayBufferCompositor::composite (this=0x7ff3740cc780)
    at /home/dan/bzr/mir/dev/src/server/compositor/default_display_buffer_compositor.cpp:133
#14 0x000000000045ccf4 in (anonymous namespace)::RenderSurfacesServerConfiguration::RenderSurfacesDisplayBufferCompositor::composite (this=0x7ff37401be80)
    at /home/dan/bzr/mir/dev/examples/render_surfaces.cpp:336
#15 0x00007ff386af0269 in mir::compositor::CompositingFunctor::operator() (
    this=0x22e8c30)
    at /home/dan/bzr/mir/dev/src/server/compositor/multi_threaded_compositor.cpp:94
#16 0x00007ff386af35bd in std::__invoke<mir::compositor::CompositingFunctor> (
    __f=...) at /usr/include/c++/4.8/functional:234
#17 0x00007ff386af3592 in std::reference_wrapper<mir::compositor::CompositingFunctor>::operator()<>() const (this=0x2279800)
    at /usr/include/c++/4.8/functional:467
#18 0x00007ff386af352c in std::_Bind_simple<std::reference_wrapper<mir::compositor::CompositingFunctor> ()>::_M_invoke<>(std::_Index_tuple<>) (this=0x2279800)
    at /usr/include/c++/4.8/functional:1732
#19 0x00007ff386af3479 in std::_Bind_simple<std::reference_wrapper<mir::compositor::CompositingFunctor> ()>::operator()() (this=0x2279800)
    at /usr/include/c++/4.8/functional:1720
#20 0x00007ff386af3412 in std::thread::_Impl<std::_Bind_simple<std::reference_wr---Type <return> to continue, or q <return> to quit---
apper<mir::compositor::CompositingFunctor> ()> >::_M_run() (this=0x22797e8)
    at /usr/include/c++/4.8/thread:115
#21 0x00007ff385b40770 in ?? () from /usr/lib/x86_64-linux-gnu/libstdc++.so.6
#22 0x00007ff385fa2f6e in start_thread (arg=0x7ff37af6c700)
    at pthread_create.c:311
#23 0x00007ff3852a7ecd in clone ()
    at ../sysdeps/unix/sysv/linux/x86_64/clone.S:113