Commen=
t # 12
on bug 65968<=
/a>
from Andreas Ringlstetter=
It's a bug in PA itself, not in Mesa.
The root cause is a race condition on the shared buffer which is used to
transfer the rendered HTML UI from the Coherent host process back to PA.
There is a missing mutex inside PA when the buffer gets reallocated as a re=
sult
of a window resize event. Effectively, this results in a use-after-free by =
the
render thread of the PA process.
The faster the realloc, the lower the chance of this bug occurring.
It's also subject to possibly missing protections against use after free
conditions on previously shared buffers. And also to the memory allocation
strategy, as a reuse of the same memory region without a clear leads to the
most visible effect.
Unfortunately, various Mesa drivers so not wipe the video memory after a bu=
ffer
was returned to the global pool!