<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - XCloseDisplay() takes one minute around nouveau_dri.so, freezing Firefox startup"
href="https://bugs.freedesktop.org/show_bug.cgi?id=75279#c34">Comment # 34</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW --- - XCloseDisplay() takes one minute around nouveau_dri.so, freezing Firefox startup"
href="https://bugs.freedesktop.org/show_bug.cgi?id=75279">bug 75279</a>
from <span class="vcard"><a class="email" href="mailto:bjacob@mozilla.com" title="Benoit Jacob <bjacob@mozilla.com>"> <span class="fn">Benoit Jacob</span></a>
</span></b>
<pre>Also, here's the story of how that caused Firefox to keep spinning here. The
mozilla change that made this bug noticeable (by having Firefox stuck for a
minute there) was <a href="https://bugzilla.mozilla.org/show_bug.cgi?id=860254">https://bugzilla.mozilla.org/show_bug.cgi?id=860254</a> . Before
that, this use-after-free read was being lucky enough to read the data that was
still present in memory even after the free(), so fence->state still had the
expected value; but after that mozilla-side change, our memory allocator
started immediately poisoning free'd memory, so fence->state had a totally
wrong value, causing this loop here to spin indefinitely.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>