https://bugs.freedesktop.org/show_bug.cgi?id=75279

--- Comment #34 from Benoit Jacob <bjacob-4eJtQOnFJqFBDgjK7y7TUQ@public.gmane.org> ---
Also, here's the story of how that caused Firefox to keep spinning here. The
mozilla change that made this bug noticeable (by having Firefox stuck for a
minute there) was https://bugzilla.mozilla.org/show_bug.cgi?id=860254 . Before
that, this use-after-free read was being lucky enough to read the data that was
still present in memory even after the free(), so fence->state still had the
expected value; but after that mozilla-side change, our memory allocator
started immediately poisoning free'd memory, so fence->state had a totally
wrong value, causing this loop here to spin indefinitely.

-- 
You are receiving this mail because:
You are the assignee for the bug.