Data race in libxcb1

[Henry]

There's a data race in libxcb1_1.10-2ubuntu1_amd64 which is reproduced when running Virtualbox with 3D acceleration enabled.
This bug relates to Bug #1179617. Below is stack trace of this data race. This bug was fixed by upstream three years ago but it hasn't merged into our code. I have patched my library and Virtualbox haven't crashed since then.

Fix: https://cgit.freedesktop.org/xcb/libxcb/commit/?id=be0fe56c3bcad5124dcc6c47a2fad01acd16f71a

[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
Core was generated by `/usr/lib/virtualbox/VirtualBox --startvm Windows 10'.
Program terminated with signal SIGABRT, Aborted.
#0 0x00007f7c36b4fcc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
56 ../nptl/sysdeps/unix/sysv/linux/raise.c: No such file or directory.
(gdb) bt
#0 0x00007f7c36b4fcc9 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:56
#1 0x00007f7c36b530d8 in __GI_abort () at abort.c:89
#2 0x00007f7c36b48b86 in __assert_fail_base (fmt=0x7f7c36c99830 "%s%s%s:%u: %s%sAssertion `%s' failed.\n%n",
    assertion=assertion@entry=0x7f7c2b55a615 "!c->out.queue_len", file=file@entry=0x7f7c2b55a600 "../../src/xcb_conn.c", line=line@entry=186,
    function=function@entry=0x7f7c2b55a630 <__PRETTY_FUNCTION__.10950> "write_vec") at assert.c:92
#3 0x00007f7c36b48c32 in __GI___assert_fail (assertion=assertion@entry=0x7f7c2b55a615 "!c->out.queue_len", file=file@entry=0x7f7c2b55a600 "../../src/xcb_conn.c",
    line=line@entry=186, function=function@entry=0x7f7c2b55a630 <__PRETTY_FUNCTION__.10950> "write_vec") at assert.c:101
#4 0x00007f7c2b54ee5b in write_vec (count=0x7f7c00cd9ba4, vector=0x7f7c00cd9ba8, c=0x7f7c0835d020) at ../../src/xcb_conn.c:186
#5 _xcb_conn_wait (c=c@entry=0x7f7c0835d020, cond=cond@entry=0x7f7c0835e140, vector=vector@entry=0x7f7c00cd9ba8, count=count@entry=0x7f7c00cd9ba4)
    at ../../src/xcb_conn.c:490
#6 0x00007f7c2b54f191 in _xcb_out_send (c=c@entry=0x7f7c0835d020, vector=vector@entry=0x7f7c00cd9be0, count=count@entry=1) at ../../src/xcb_out.c:367
#7 0x00007f7c2b54f8a7 in _xcb_out_flush_to (c=0x7f7c0835d020, request=93593) at ../../src/xcb_out.c:394
#8 0x00007f7c2b54f9c8 in xcb_take_socket (c=0x7f7c0835d020, return_socket=return_socket@entry=0x7f7c2e3cf000 <return_socket>, closure=closure@entry=0x7f7c0835b9e0,
    flags=0, sent=sent@entry=0x7f7c00cd9c78) at ../../src/xcb_out.c:293
#9 0x00007f7c2e3cea38 in require_socket (dpy=0x7f7c0835b9e0) at ../../src/xcb_io.c:68
#10 0x00007f7c2e3cf259 in _XFlush (dpy=0x7f7c0835b9e0) at ../../src/xcb_io.c:511
#11 0x00007f7c2e3d1c75 in _XGetRequest (dpy=dpy@entry=0x7f7c0835b9e0, type=type@entry=43 '+', len=len@entry=4) at ../../src/XlibInt.c:1735
#12 0x00007f7c2e3cb0bb in XSync (dpy=dpy@entry=0x7f7c0835b9e0, discard=discard@entry=0) at ../../src/Sync.c:43
#13 0x00007f7c2ed380ab in dri2XcbSwapBuffers (pdraw=0x7f7bd01085a0, remainder=<optimized out>, divisor=0, target_msc=0, dpy=0x7f7c0835b9e0)
    at ../../../../src/glx/dri2_glx.c:815
#14 dri2SwapBuffers (pdraw=0x7f7bd01085a0, target_msc=0, divisor=0, remainder=<optimized out>, flush=<optimized out>) at ../../../../src/glx/dri2_glx.c:853
#15 0x00007f7bf63bac5b in ?? () from /usr/lib/virtualbox/VBoxOGLrenderspu.so
#16 0x00007f7bf63bd1ec in ?? () from /usr/lib/virtualbox/VBoxOGLrenderspu.so
#17 0x00007f7c367ce7cc in ?? () from /usr/lib/virtualbox/VBoxRT.so
#18 0x00007f7c3684980c in ?? () from /usr/lib/virtualbox/VBoxRT.so
#19 0x00007f7c370ea182 in start_thread (arg=0x7f7c00cda700) at pthread_create.c:312
#20 0x00007f7c36c1347d in clone () at ../sysdeps/unix/sysv/linux/x86_64/clone.S:111
(gdb) frame 4
#4 0x00007f7c2b54ee5b in write_vec (count=0x7f7c00cd9ba4, vector=0x7f7c00cd9ba8, c=0x7f7c0835d020) at ../../src/xcb_conn.c:186
186 assert(!c->out.queue_len);
(gdb)