<html>
<head>
<base href="https://bugs.freedesktop.org/" />
</head>
<body>
<p>
<div>
<b><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - XCloseDisplay() takes one minute around nouveau_dri.so, freezing Firefox startup"
href="https://bugs.freedesktop.org/show_bug.cgi?id=75279#c40">Comment # 40</a>
on <a class="bz_bug_link
bz_status_NEW "
title="NEW --- - XCloseDisplay() takes one minute around nouveau_dri.so, freezing Firefox startup"
href="https://bugs.freedesktop.org/show_bug.cgi?id=75279">bug 75279</a>
from <span class="vcard"><a class="email" href="mailto:imirkin@alum.mit.edu" title="Ilia Mirkin <imirkin@alum.mit.edu>"> <span class="fn">Ilia Mirkin</span></a>
</span></b>
<pre>OK, so I'm obviously able to reproduce the use-after-free. Like I said, this
logic is fairly subtle. I think the problem is that there's an implicit
assumption that the fence has an external ref before someone waits on it. In
the case of the current screen fence, that's not necessarily the case. I think
the proper fix is to add a fence ref in the destructor around the wait. I'm
going to think a bit more on this.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are the assignee for the bug.</li>
</ul>
</body>
</html>