similar to: [Bug 75279] XCloseDisplay() takes one minute around nouveau_dri.so, freezing Firefox startup

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #33 from Benoit Jacob <bjacob at mozilla.com> --- The stack to the free() points to line 203 here, while the stack to where the free'd data is subsequently used points to line 205 here: http://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nouveau_fence.c?id=ce6dd69697ae62d9336bbd4f5808bc4d75cdcc04#n203

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #29 from Frederic Bezies <fredbezies at gmail.com> --- Looks like a NouVeau is triggered by Mozilla Firefox trunk code. I opened a bug on mozilla bugtracker, https://bugzilla.mozilla.org/show_bug.cgi?id=978439 Even if I find a "dirty workaround", valgrind logs are showing a NouVeau driver bug. I will attach both

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #31 from Frederic Bezies <fredbezies at gmail.com> --- Created attachment 95189 --> https://bugs.freedesktop.org/attachment.cgi?id=95189&action=edit Valgrind log with debug symbols for Mozilla Firefox trunk code. And log for mozilla Firefox trunk code. Always the same beginning : Invalid read of size 4 at

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #30 from Frederic Bezies <fredbezies at gmail.com> --- Created attachment 95188 --> https://bugs.freedesktop.org/attachment.cgi?id=95188&action=edit Valgrind log for glxtest Here is the valgrind log for Glx test -- You are receiving this mail because: You are the assignee for the bug. -------------- next part

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #32 from Benoit Jacob <bjacob at mozilla.com> --- ...note that the log attached by Frederic in comment 30 also has a stack to where this pointer was free'd --- we have a use-after-free bug here! This was obtained by Frederic by running the glxtest program attached in comment 2 here, in valgrind: valgrind

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #34 from Benoit Jacob <bjacob at mozilla.com> --- Also, here's the story of how that caused Firefox to keep spinning here. The mozilla change that made this bug noticeable (by having Firefox stuck for a minute there) was https://bugzilla.mozilla.org/show_bug.cgi?id=860254 . Before that, this use-after-free read was being

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #36 from Benoit Jacob <bjacob at mozilla.com> --- Can you reproduce yourself by running the attached glxtest program in valgrind? -- You are receiving this mail because: You are the assignee for the bug. -------------- next part -------------- An HTML attachment was scrubbed... URL:

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #37 from Ilia Mirkin <imirkin at alum.mit.edu> --- (In reply to comment #36) > Can you reproduce yourself by running the attached glxtest program in > valgrind? Oh, I'm sure (can't right now, will try tonight). But I doubt it's the source of the bug. The glxtest program doesn't appear to hang. Memory is

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #38 from Benoit Jacob <bjacob at mozilla.com> --- I wasn't clear enough in comment 34, let me explain better :-) The Mozilla change that exposed this, https://bugzilla.mozilla.org/show_bug.cgi?id=860254, is exactly about having memory overwritten immediately on free(). So this is _exactly_ what is happening here :-) The

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #39 from Ilia Mirkin <imirkin at alum.mit.edu> --- (In reply to comment #38) > I wasn't clear enough in comment 34, let me explain better :-) > > The Mozilla change that exposed this, > https://bugzilla.mozilla.org/show_bug.cgi?id=860254, is exactly about having > memory overwritten immediately on free(). So

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #19 from Benoit Jacob <bjacob at mozilla.com> --- A duplicate Mozilla bug has a stack with symbols: https://bugzilla.mozilla.org/show_bug.cgi?id=975512#c1 #0 0x0000003f3a2da007 in sched_yield () from /lib64/libc.so.6 #1 0x00007f1e003bb1d1 in nouveau_fence_wait () from /usr/lib64/dri/nouveau_dri.so #2 0x00007f1e0039d635

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #13 from Benoit Jacob <bjacob at mozilla.com> --- The work-around that works for us, and that we're considering landing, is to avoid calling XCloseDisplay and, in this case, just calling XSync to handle any pending errors in glxtest. Digging in the Gecko codebase, I found at least another instance where we avoid calling

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #21 from Benoit Jacob <bjacob at mozilla.com> --- - Are you guys using multi-threaded gl ? Not here. We could be if Frederic was 1) using non-default preferences such as layers.acceleration.force-enabled and 2) viewing specific Web pages (e.g. using WebGL). But here we are talking about a startup hang occurring before this

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #25 from Emil Velikov <emil.l.velikov at gmail.com> --- (In reply to comment #21) [snip] > Sure. You need a Nightly build, but not a current one since we have landed a > work-around (avoiding to call XCloseDisplay here). This one, from Feb. 20, > should reproduce: > >

https://bugs.freedesktop.org/show_bug.cgi?id=75279 Emil Velikov <emil.l.velikov at gmail.com> changed: What |Removed |Added ---------------------------------------------------------------------------- Assignee|dri-devel at lists.freedesktop |nouveau at lists.freedesktop.o |.org |rg QA Contact|

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #1 from Emil Velikov <emil.l.velikov at gmail.com> --- Hi Benoit Jacob Can you attach the output of glxinfo and dmesg after you've come across this issue ? Do you have a link to a build we can reuse ? -Emil -- You are receiving this mail because: You are the assignee for the bug. -------------- next part --------------

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #2 from Emil Velikov <emil.l.velikov at gmail.com> --- If you can hack out the glxtest into a separate program that would ease all of use alot. Cheers -- You are receiving this mail because: You are the assignee for the bug. -------------- next part -------------- An HTML attachment was scrubbed... URL:

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #3 from Benoit Jacob <bjacob at mozilla.com> --- Created attachment 94465 --> https://bugs.freedesktop.org/attachment.cgi?id=94465&action=edit Stand-alone version of the glxtest program Here you go. build like this: c++ glxtest.cpp -o glxtest -ldl -lX11 run like this: ./glxtest Example output: VENDOR

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #4 from Benoit Jacob <bjacob at mozilla.com> --- I have also asked the original reporter to share his glxinfo output and details about his setup. You might want to CC yourself on the mozilla bug. -- You are receiving this mail because: You are the assignee for the bug. -------------- next part -------------- An HTML attachment

https://bugs.freedesktop.org/show_bug.cgi?id=75279 --- Comment #5 from Ilia Mirkin <imirkin at alum.mit.edu> --- (In reply to comment #4) > I have also asked the original reporter to share his glxinfo output and > details about his setup. You might want to CC yourself on the mozilla bug. Might be easier to get the original reporter onto this one... Can you confirm that the