similar to: [Bug 75279] XCloseDisplay() takes one minute around nouveau_dri.so, freezing Firefox startup

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #29 from Frederic Bezies <fredbezies at gmail.com> --- Looks like a NouVeau is triggered by Mozilla Firefox trunk code. I opened a bug on mozilla bugtracker, https://bugzilla.mozilla.org/show_bug.cgi?id=978439 Even if I find a "dirty workaround", valgrind logs are showing a NouVeau driver bug. I will attach both

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #9 from Frederic Bezies <fredbezies at gmail.com> --- glxtest output : [fred at fredo-arch ~]$ ./glxtest VENDOR nouveau RENDERER Gallium 0.4 on NVA8 VERSION 3.0 Mesa 10.0.3 TFP TRUE Not a single hang. Will try seeing on full mozilla code if there is still a hang or not. -- You are receiving this mail because: You are the

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #11 from Frederic Bezies <fredbezies at gmail.com> --- (In reply to comment #10) > Emil tried the glxtest program earlier and didn't get a hang either. So at > least that's consistent. (I'm adding you to the CC list, hope that's OK, if > not, feel free to remove yourself.) I don't mind. I wanted to

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #31 from Frederic Bezies <fredbezies at gmail.com> --- Created attachment 95189 --> https://bugs.freedesktop.org/attachment.cgi?id=95189&action=edit Valgrind log with debug symbols for Mozilla Firefox trunk code. And log for mozilla Firefox trunk code. Always the same beginning : Invalid read of size 4 at

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #7 from Frederic Bezies <fredbezies at gmail.com> --- I'm the reporter on mozilla bugzilla tracker. Some technical infos on my computer. Using archlinux, 64 bits. Software versions ? Kernel upgraded less than an hour ago. [fred at fredo-arch ~]$ pacman -Si mesa | grep Version Version : 10.0.3-1 [fred at

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #8 from Frederic Bezies <fredbezies at gmail.com> --- Created attachment 94479 --> https://bugs.freedesktop.org/attachment.cgi?id=94479&action=edit glxinfo for my hardware. -- You are receiving this mail because: You are the assignee for the bug. -------------- next part -------------- An HTML attachment was

https://bugs.freedesktop.org/show_bug.cgi?id=75279 Ilia Mirkin <imirkin at alum.mit.edu> changed: What |Removed |Added ---------------------------------------------------------------------------- CC| |fredbezies at gmail.com --- Comment #10 from Ilia Mirkin <imirkin at alum.mit.edu> --- Emil tried the

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #15 from Frederic Bezies <fredbezies at gmail.com> --- (In reply to comment #14) > Frederic, would you be able to use top to identify the program using 100% > cpu, attach a debugger (gdb attach <pid>) while hanging, and get a stack > trace, please? Already done in mozilla bugzilla bug report. Adding this log

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #16 from Frederic Bezies <fredbezies at gmail.com> --- Created attachment 94625 --> https://bugs.freedesktop.org/attachment.cgi?id=94625&action=edit log asked for in comment #14. It is a copy of the log I produced on mozilla bugzilla report. -- You are receiving this mail because: You are the assignee for the bug.

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #18 from Frederic Bezies <fredbezies at gmail.com> --- (In reply to comment #17) > > Thread 1 (Thread 0x7f2d032c2740 (LWP 3445)): > > #0 0x00007f2d02ebfa8d in read () from /usr/lib/libpthread.so.0 > > #1 0x00007f2cfd97264a in mozilla::widget::GfxInfo::GetData() () > > from

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #22 from Frederic Bezies <fredbezies at gmail.com> --- (In reply to comment #21) [...] > Frederic, can you say if you have any force-enabled prefs set in > about:config? None. All options are set with their default values. -- You are receiving this mail because: You are the assignee for the bug. -------------- next

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #23 from Frederic Bezies <fredbezies at gmail.com> --- Don't know if it is related, but I'm facing a plugin container hang and nouveau seems to be guilty in some way. Got this thread with gdb : Thread 1 (Thread 0x7f4dd7b37940 (LWP 2961)): #0 0x00007f4dd2294337 in sched_yield () from /usr/lib/libc.so.6 #1

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #26 from Frederic Bezies <fredbezies at gmail.com> --- (In reply to comment #24) [...] > > Seems to be stuck at the same spot with identical call stack, minus the > state tracker bits. > > The memory access message looks interesting, shame there is no indication of > what nouveau was doing to provoke this.

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #43 from Frederic Bezies <fredbezies at gmail.com> --- Bug is fixed for good. Archlinux upgraded to Mesa 10.1.1 today, and after rebuilding firefox, no more freeze problem with nouveau. Thanks for the fix. -- You are receiving this mail because: You are the assignee for the bug. -------------- next part -------------- An HTML

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #28 from Frederic Bezies <fredbezies at gmail.com> --- Some progress with debug packages. But I think I'll need xf86-video-nouveau debug package too. At least, here is the log : (gdb) bt full #0 0x00007f364503a337 in sched_yield () from /usr/lib/libc.so.6 No symbol table info available. #1 0x00007f3632d0e411 in

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #32 from Benoit Jacob <bjacob at mozilla.com> --- ...note that the log attached by Frederic in comment 30 also has a stack to where this pointer was free'd --- we have a use-after-free bug here! This was obtained by Frederic by running the glxtest program attached in comment 2 here, in valgrind: valgrind

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #37 from Ilia Mirkin <imirkin at alum.mit.edu> --- (In reply to comment #36) > Can you reproduce yourself by running the attached glxtest program in > valgrind? Oh, I'm sure (can't right now, will try tonight). But I doubt it's the source of the bug. The glxtest program doesn't appear to hang. Memory is

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #38 from Benoit Jacob <bjacob at mozilla.com> --- I wasn't clear enough in comment 34, let me explain better :-) The Mozilla change that exposed this, https://bugzilla.mozilla.org/show_bug.cgi?id=860254, is exactly about having memory overwritten immediately on free(). So this is _exactly_ what is happening here :-) The

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #3 from Benoit Jacob <bjacob at mozilla.com> --- Created attachment 94465 --> https://bugs.freedesktop.org/attachment.cgi?id=94465&action=edit Stand-alone version of the glxtest program Here you go. build like this: c++ glxtest.cpp -o glxtest -ldl -lX11 run like this: ./glxtest Example output: VENDOR

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #36 from Benoit Jacob <bjacob at mozilla.com> --- Can you reproduce yourself by running the attached glxtest program in valgrind? -- You are receiving this mail because: You are the assignee for the bug. -------------- next part -------------- An HTML attachment was scrubbed... URL: