similar to: [Bug 75279] XCloseDisplay() takes one minute around nouveau_dri.so, freezing Firefox startup

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #9 from Frederic Bezies <fredbezies at gmail.com> --- glxtest output : [fred at fredo-arch ~]$ ./glxtest VENDOR nouveau RENDERER Gallium 0.4 on NVA8 VERSION 3.0 Mesa 10.0.3 TFP TRUE Not a single hang. Will try seeing on full mozilla code if there is still a hang or not. -- You are receiving this mail because: You are the

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #11 from Frederic Bezies <fredbezies at gmail.com> --- (In reply to comment #10) > Emil tried the glxtest program earlier and didn't get a hang either. So at > least that's consistent. (I'm adding you to the CC list, hope that's OK, if > not, feel free to remove yourself.) I don't mind. I wanted to

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #29 from Frederic Bezies <fredbezies at gmail.com> --- Looks like a NouVeau is triggered by Mozilla Firefox trunk code. I opened a bug on mozilla bugtracker, https://bugzilla.mozilla.org/show_bug.cgi?id=978439 Even if I find a "dirty workaround", valgrind logs are showing a NouVeau driver bug. I will attach both

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #30 from Frederic Bezies <fredbezies at gmail.com> --- Created attachment 95188 --> https://bugs.freedesktop.org/attachment.cgi?id=95188&action=edit Valgrind log for glxtest Here is the valgrind log for Glx test -- You are receiving this mail because: You are the assignee for the bug. -------------- next part

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #3 from Benoit Jacob <bjacob at mozilla.com> --- Created attachment 94465 --> https://bugs.freedesktop.org/attachment.cgi?id=94465&action=edit Stand-alone version of the glxtest program Here you go. build like this: c++ glxtest.cpp -o glxtest -ldl -lX11 run like this: ./glxtest Example output: VENDOR

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #5 from Ilia Mirkin <imirkin at alum.mit.edu> --- (In reply to comment #4) > I have also asked the original reporter to share his glxinfo output and > details about his setup. You might want to CC yourself on the mozilla bug. Might be easier to get the original reporter onto this one... Can you confirm that the

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #37 from Ilia Mirkin <imirkin at alum.mit.edu> --- (In reply to comment #36) > Can you reproduce yourself by running the attached glxtest program in > valgrind? Oh, I'm sure (can't right now, will try tonight). But I doubt it's the source of the bug. The glxtest program doesn't appear to hang. Memory is

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #7 from Frederic Bezies <fredbezies at gmail.com> --- I'm the reporter on mozilla bugzilla tracker. Some technical infos on my computer. Using archlinux, 64 bits. Software versions ? Kernel upgraded less than an hour ago. [fred at fredo-arch ~]$ pacman -Si mesa | grep Version Version : 10.0.3-1 [fred at

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #8 from Frederic Bezies <fredbezies at gmail.com> --- Created attachment 94479 --> https://bugs.freedesktop.org/attachment.cgi?id=94479&action=edit glxinfo for my hardware. -- You are receiving this mail because: You are the assignee for the bug. -------------- next part -------------- An HTML attachment was

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #32 from Benoit Jacob <bjacob at mozilla.com> --- ...note that the log attached by Frederic in comment 30 also has a stack to where this pointer was free'd --- we have a use-after-free bug here! This was obtained by Frederic by running the glxtest program attached in comment 2 here, in valgrind: valgrind

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #38 from Benoit Jacob <bjacob at mozilla.com> --- I wasn't clear enough in comment 34, let me explain better :-) The Mozilla change that exposed this, https://bugzilla.mozilla.org/show_bug.cgi?id=860254, is exactly about having memory overwritten immediately on free(). So this is _exactly_ what is happening here :-) The

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #19 from Benoit Jacob <bjacob at mozilla.com> --- A duplicate Mozilla bug has a stack with symbols: https://bugzilla.mozilla.org/show_bug.cgi?id=975512#c1 #0 0x0000003f3a2da007 in sched_yield () from /lib64/libc.so.6 #1 0x00007f1e003bb1d1 in nouveau_fence_wait () from /usr/lib64/dri/nouveau_dri.so #2 0x00007f1e0039d635

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #13 from Benoit Jacob <bjacob at mozilla.com> --- The work-around that works for us, and that we're considering landing, is to avoid calling XCloseDisplay and, in this case, just calling XSync to handle any pending errors in glxtest. Digging in the Gecko codebase, I found at least another instance where we avoid calling

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #21 from Benoit Jacob <bjacob at mozilla.com> --- - Are you guys using multi-threaded gl ? Not here. We could be if Frederic was 1) using non-default preferences such as layers.acceleration.force-enabled and 2) viewing specific Web pages (e.g. using WebGL). But here we are talking about a startup hang occurring before this

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #31 from Frederic Bezies <fredbezies at gmail.com> --- Created attachment 95189 --> https://bugs.freedesktop.org/attachment.cgi?id=95189&action=edit Valgrind log with debug symbols for Mozilla Firefox trunk code. And log for mozilla Firefox trunk code. Always the same beginning : Invalid read of size 4 at

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #2 from Emil Velikov <emil.l.velikov at gmail.com> --- If you can hack out the glxtest into a separate program that would ease all of use alot. Cheers -- You are receiving this mail because: You are the assignee for the bug. -------------- next part -------------- An HTML attachment was scrubbed... URL:

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #20 from Emil Velikov <emil.l.velikov at gmail.com> --- Hi Benoit IMHO the stack trace does not indicate where the problem occurs, just that there is one. - Are you guys using multi-threaded gl ? - Considering that the problem is not available with a standalone glxtest app, do you have a link to a FF build that one can test

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #36 from Benoit Jacob <bjacob at mozilla.com> --- Can you reproduce yourself by running the attached glxtest program in valgrind? -- You are receiving this mail because: You are the assignee for the bug. -------------- next part -------------- An HTML attachment was scrubbed... URL:

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #15 from Frederic Bezies <fredbezies at gmail.com> --- (In reply to comment #14) > Frederic, would you be able to use top to identify the program using 100% > cpu, attach a debugger (gdb attach <pid>) while hanging, and get a stack > trace, please? Already done in mozilla bugzilla bug report. Adding this log

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #16 from Frederic Bezies <fredbezies at gmail.com> --- Created attachment 94625 --> https://bugs.freedesktop.org/attachment.cgi?id=94625&action=edit log asked for in comment #14. It is a copy of the log I produced on mozilla bugzilla report. -- You are receiving this mail because: You are the assignee for the bug.