Nouveau - Sep 2019 - [Bug 111793] New: double free or corruption (fasttop) in nouveau_bo_del

https://bugs.freedesktop.org/show_bug.cgi?id=111793

            Bug ID: 111793
           Summary: double free or corruption (fasttop) in nouveau_bo_del
           Product: xorg
           Version: unspecified
          Hardware: x86-64 (AMD64)
                OS: Linux (All)
            Status: NEW
          Severity: not set
          Priority: not set
         Component: Driver/nouveau
          Assignee: nouveau at lists.freedesktop.org
          Reporter: yurys at chromium.org
        QA Contact: xorg-team at lists.x.org

Created attachment 145484
  --> https://bugs.freedesktop.org/attachment.cgi?id=145484&action=edit
double free or corruption (fasttop)

This happens all the time when I'm trying to load cnn.com in WebKit
minibrowser. More details about the scenario can be found at
https://bugs.webkit.org/show_bug.cgi?id=200437

There is either segfault or assertion failure everytime I load the site.
Attaching a couple of core dumps to the bug.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20190923/595ee56d/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=111793

--- Comment #1 from Yury Semikhatsky <yurys at chromium.org> ---
Created attachment 145485
  --> https://bugs.freedesktop.org/attachment.cgi?id=145485&action=edit
dmesg output

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20190923/87b16a81/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=111793

Yury Semikhatsky <yurys at chromium.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
 Attachment #145484|double free or corruption   |assertion in
        description|(fasttop)                   |nouveau_pushbuf_data at
                   |                            |../nouveau/pushbuf.c:723

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20190923/00fa4051/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=111793

--- Comment #2 from Yury Semikhatsky <yurys at chromium.org> ---
Created attachment 145486
  --> https://bugs.freedesktop.org/attachment.cgi?id=145486&action=edit
double free or corruption (fasttop)

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20190923/53cd9e25/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=111793

--- Comment #3 from Karol Herbst <karolherbst at gmail.com> ---
this is probably a multithreading bug inside mesa. We are aware of the
situation, just fixing it might take a while as it requires bigger rework. We
are on it though. Just limited in time sadly.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20190924/0af7d299/attachment-0001.html>

https://bugs.freedesktop.org/show_bug.cgi?id=111793

--- Comment #4 from Yury Semikhatsky <yurys at chromium.org> ---
Thanks for your response. Let me know if you need help with testing the fix
with the WebKit scenarios.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20190924/916eb342/attachment.html>

https://bugs.freedesktop.org/show_bug.cgi?id=111793

Martin Peres <martin.peres at free.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |MOVED

--- Comment #5 from Martin Peres <martin.peres at free.fr> ---
-- GitLab Migration Automatic Message --

This bug has been migrated to freedesktop.org's GitLab instance and has been
closed from further activity.

You can subscribe and participate further through the new bug through this link
to our GitLab instance:
https://gitlab.freedesktop.org/xorg/driver/xf86-video-nouveau/issues/504.

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://lists.freedesktop.org/archives/nouveau/attachments/20191204/5407e767/attachment-0001.html>