double free or corruption (fasttop) in nouveau_bo_del

Submitted by Yury Semikhatsky

Assigned to Nouveau Project

Link to original bug (#111793)

Description

Created attachment 145484
assertion in nouveau_pushbuf_data at ../nouveau/pushbuf.c:723

This happens all the time when I'm trying to load cnn.com in WebKit minibrowser. More details about the scenario can be found at https://bugs.webkit.org/show_bug.cgi?id=200437

There is either segfault or assertion failure everytime I load the site. Attaching a couple of core dumps to the bug.

Attachment 145484, "assertion in nouveau_pushbuf_data at ../nouveau/pushbuf.c:723":
backtrace-assert-kref.txt