1025676 - WebGL crash on linux due to shader using unary multiply assign

Status: NEW

(Core :: Graphics: CanvasWebGL, defect, P3)

Description

[Florian Bösch]

Visiting this URL: http://codeflow.org/issues/driver-bug/nvidia-linux-337.25.html crashes Firefox with the nvidia driver 337.25.

The cause for the crash is this shader line:

  bar *= rot;

If this is substituted for:

  bar = bar * rot;

It does not crash.

Machine information:

## Nvidia driver info (cat /proc/driver/nvidia/version) ##
NVRM version: NVIDIA UNIX x86_64 Kernel Module  337.25  Tue May 27 11:05:28 PDT 2014
GCC version:  gcc version 4.9.0 20140521 (prerelease) (GCC) 

## GPU info (glxinfo | grep -i "opengl renderer string") ##
OpenGL renderer string: GeForce GTX 660/PCIe/SSE2

## CPU info (cat /proc/cpuinfo | grep -i "model name" | head -1) ##
model name  : Intel(R) Core(TM) i7 CPU         920  @ 2.67GHz

## distribution info (lsb_release -a) ##
LSB Version:    1.4
Distributor ID: Arch
Description:    Arch Linux
Release:    rolling
Codename:   n/a

## Kernel info (uname -r) ##
3.14.6-1-ARCH

The behavior is present on both Google chrome and Firefox 30. But it was not present at an earlier nvidia driver version (334.21).

Chrome ticket: https://code.google.com/p/chromium/issues/detail?id=384847

It is likely that this is a new bug in the driver, for which there is no Angle workaround yet.

Comment 1

[Florian Bösch]

Behavior not present on a different machine with a different nvidia driver:

Machine Info:

## Nvidia driver info (cat /proc/driver/nvidia/version) ##
NVRM version: NVIDIA UNIX x86_64 Kernel Module  331.20  Wed Oct 30 17:43:35 PDT 2013
GCC version:  gcc version 4.7.3 (Ubuntu/Linaro 4.7.3-1ubuntu1) 

## GPU info (glxinfo | grep -i "opengl renderer string") ##
OpenGL renderer string: GeForce GTX 780/PCIe/SSE2

## CPU info (cat /proc/cpuinfo | grep -i "model name" | head -1) ##
model name	: Intel(R) Core(TM) i7-4770S CPU @ 3.10GHz

## distribution info (lsb_release -a) ##
No LSB modules are available.
Distributor ID:	Ubuntu
Description:	Ubuntu 13.04
Release:	13.04
Codename:	raring

## Kernel info (uname -r) ##
3.8.0-35-generic

Comment 2

[manuel.bua]

I can confirm this behavior on my ArchLinux/64 machine with the latest drivers (337.25)
I also filed a bug at the nVidia bug tracker:
#646071 http://nvidia-submit.custhelp.com/app/account/questions/detail/i_id/646071

It looks like the bug report is private, but you devs may be able to get in touch with the nvidia guys and the bug report i already filed.

Some more information from my part:

## Nvidia driver info (cat /proc/driver/nvidia/version) ##
NVRM version: NVIDIA UNIX x86_64 Kernel Module 337.25 Tue May 27 11:05:28 PDT 2014
GCC version: gcc version 4.9.0 20140521 (prerelease) (GCC) 

## GPU info (glxinfo | grep -i "opengl renderer string") ##
OpenGL renderer string: GeForce GTX 660/PCIe/SSE2

## CPU info (cat /proc/cpuinfo | grep -i "model name" | head -1) ##
model name : Intel(R) Core(TM) i7 CPU 920 @ 2.67GHz

## distribution info (lsb_release -a) ##
LSB Version: 1.4
Distributor ID: Arch
Description: Arch Linux
Release: rolling
Codename: n/a

## Kernel info (uname -r) ##
3.14.6-1-ARCH

Comment 3

[manuel.bua]

FYI, nVidia told me they acknowledge it's a driver issue and the fix is on their tree:  the fixed driver will be released as part of the next 340 driver iteration (they told me the one after 340.17), on the July, 10, so probably you won't need to work around it in ANGLE.

Comment 4

[Milan Sreckovic [:milan] (needinfo for best results)]

On Windows (fwiw), I'm good with 332.76 and 337.88, but that's with a Quadro, rather than a GeForce card...

Comment 5

[Kelsey Gilbert [:jgilbert]]

Does not repro on "4.4.0 NVIDIA 331.38".

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

I can get it to crash with 337.25 (ubuntu 12.04, quadro 600)

Comment 7

[Milan Sreckovic [:milan] (needinfo for best results)]

Part of the stack:
Program received signal SIGSEGV, Segmentation fault.
#0  0x00007fffbef49c19 in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#1  0x00007fffbef24ea6 in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#2  0x00007fffbef490fa in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#3  0x00007fffbef24ea6 in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#4  0x00007fffbef4851d in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#5  0x00007fffbeed5e6f in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#6  0x00007fffbeed6b01 in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#7  0x00007fffbeedc9a5 in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#8  0x00007fffbeedd01b in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#9  0x00007fffbf6b2589 in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#10 0x00007fffbf6bf8af in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#11 0x00007fffbf69a08b in ?? () from /usr/lib/libnvidia-glcore.so.337.25
#12 0x00007fffef1f148e in mozilla::gl::GLContext::fLinkProgram (this=0x7fffd2d05000, program=1)
    at /home/milan/Repos/mozilla-central/gfx/gl/GLContext.h:1367
#13 0x00007ffff05e969c in mozilla::WebGLContext::LinkProgram (this=0x7fffc7c0b000, program=0x7fffcb169690)
    at /home/milan/Repos/mozilla-central/content/canvas/src/WebGLContextGL.cpp:1936
#14 0x00007fffefb38efe in mozilla::dom::WebGLRenderingContextBinding::linkProgram (cx=0x7fffd4945b70, obj=
    (JSObject * const) 0x7fffc9abcfd0 [object WebGLRenderingContext], self=0x7fffc7c0b000, args=...)
    at /home/milan/Repos/mozilla-central/obj-x86_64-unknown-linux-gnu/dom/bindings/WebGLRenderingContextBinding.cpp:11137
#15 0x00007fffefbfe528 in mozilla::dom::GenericBindingMethod (cx=0x7fffd4945b70, argc=1, vp=0x7fffe01300c8)
    at /home/milan/Repos/mozilla-central/dom/bindings/BindingUtils.cpp:2348
#16 0x00007ffff285d4ff in js::CallJSNative (cx=0x7fffd4945b70, native=
    0x7fffefbfe2d0 <mozilla::dom::GenericBindingMethod(JSContext*, unsigned int, JS::Value*)>, args=...)
    at /home/milan/Repos/mozilla-central/js/src/jscntxtinlines.h:241

Comment 8

[Florian Bösch]

(In reply to Milan Sreckovic [:milan] from comment #6)
> I can get it to crash with 337.25 (ubuntu 12.04, quadro 600)

Can you please confirm the crash with your configuration with this conformance test? http://www.khronos.org/registry/webgl/sdk/tests/conformance/glsl/bugs/multiplication-assignment.html

Comment 9

[Milan Sreckovic [:milan] (needinfo for best results)]

Confirmed.