[Mesa-dev] [Bug 98172] Concurrent call to glClientWaitSync results in segfault in one of the waiters.

[bugzilla-daemon at freedesktop.org]

https://bugs.freedesktop.org/show_bug.cgi?id=98172

--- Comment #42 from Suzuki, Shinji <shinji.suzuki at gmail.com> ---
Sorry for the clutter. Timeout is not handled in the previous attempt.
(The use of the shared completion flag seems to have potential synchronization
problem because a waiter can see a successful wait as a result of unsuccessful
call to fence_finish() if another thread comes and completes a successful
fence_finish() call after the first thread completes unsuccessful
fence_finish() but before returns.)

static void st_client_wait_sync(struct gl_context *ctx,
                                struct gl_sync_object *obj,
                                GLbitfield flags, GLuint64 timeout)
{
   struct pipe_screen *screen = st_context(ctx)->pipe->screen;
   struct st_sync_object *so = (struct st_sync_object*)obj;
   struct pipe_fence_handle *fence = NULL;

   /* We don't care about GL_SYNC_FLUSH_COMMANDS_BIT, because flush is          
    * already called when creating a fence.                                     
    */

   /* Duplicate the reference so that the fence object is guaranteed to         
    * be alive at least until associated 'unref' below is executed.             
    * This is important because multiple threads have to execute                
    * fence_finish() concurrently even if they target same fence object         
    * in order to deal with potentially different time-out settings.            
    */
   screen->fence_reference(screen, &fence, so->fence);

   if (fence) {
      if(screen->fence_finish(screen, fence, timeout)) {
         so->b.StatusFlag = GL_TRUE;
         if( p_atomic_cmpxchg(&so->fence, fence, NULL) == fence ) {
            /* Get done with 'so->object'. This is a 'unref' op.                
             * Borrow the value in 'fence' since so->fence is already           
             * set to NULL by the cmpxchg above.                                
             */
            struct pipe_fence_handle * fence_copy = fence;
            screen->fence_reference(screen, &fence_copy, NULL);
         }
      }
   } // fence==0 means the fence has already reached                            
   screen->fence_reference(screen, &fence, NULL);
}

-- 
You are receiving this mail because:
You are the QA Contact for the bug.
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.freedesktop.org/archives/mesa-dev/attachments/20161022/23332088/attachment.html>