<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW --- - [IVB/HSW ppgtt bisected] When run nightly piglit testing causes X no responsive" href="https://bugs.freedesktop.org/show_bug.cgi?id=73383#c17">Comment # 17</a> on <a class="bz_bug_link bz_status_NEW " title="NEW --- - [IVB/HSW ppgtt bisected] When run nightly piglit testing causes X no responsive" href="https://bugs.freedesktop.org/show_bug.cgi?id=73383">bug 73383</a> from <a class="email" href="mailto:chris@chris-wilson.co.uk" title="Chris Wilson <chris@chris-wilson.co.uk>"> Chris Wilson</a> <pre>Right, this is just the garbage reference counting of vm. On this path, i915_gem_evict_vm() does not hold a reference to the object it is trying to unbind, so indeed runs afoul of not just that object, but any object in the list (including the next pointer) being freed. See the safeguards i915_gem_evict_something() and __i915_gem_shrink() have in place for exactly this reason. The choice is either to rewrite i915_gem_evict_vm() along the same lines, drop the recursion from unbind() (patch on the list <a href="http://patchwork.freedesktop.org/patch/18896/">http://patchwork.freedesktop.org/patch/18896/</a>) or fix the reference counting of vm (which is not that difficult and cleans up a chunk of code and concepts).</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the QA Contact for the bug.</li> <li>You are on the CC list for the bug.</li> </ul> </body> </html>