<html> <head> <base href="https://bugs.freedesktop.org/" /> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW --- - XCloseDisplay() takes one minute around nouveau_dri.so, freezing Firefox startup" href="https://bugs.freedesktop.org/show_bug.cgi?id=75279#c33">Comment # 33</a> on <a class="bz_bug_link bz_status_NEW " title="NEW --- - XCloseDisplay() takes one minute around nouveau_dri.so, freezing Firefox startup" href="https://bugs.freedesktop.org/show_bug.cgi?id=75279">bug 75279</a> from <a class="email" href="mailto:bjacob@mozilla.com" title="Benoit Jacob <bjacob@mozilla.com>"> Benoit Jacob</a> <pre>The stack to the free() points to line 203 here, while the stack to where the free'd data is subsequently used points to line 205 here: <a href="http://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nouveau_fence.c?id=ce6dd69697ae62d9336bbd4f5808bc4d75cdcc04#n203">http://cgit.freedesktop.org/mesa/mesa/tree/src/gallium/drivers/nouveau/nouveau_fence.c?id=ce6dd69697ae62d9336bbd4f5808bc4d75cdcc04#n203</a> if (fence == screen->fence.current) nouveau_fence_next(screen); do { nouveau_fence_update(screen, FALSE); // <--- free here! if (fence->state == NOUVEAU_FENCE_STATE_SIGNALLED) // <-- use-after-free return TRUE; So it seems like nouveau_fence_update (which was apparently inlined) destroys the fence object... do you need to call nouveau_fence_ref() to keep it alive?</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> </ul> </body> </html>