1062355 - Crash in d3dcompiler, nested-functions-should-not-crash.html test of WebGL Conformance Test

Status: VERIFIED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Alice0775 White]

This bug was filed from the Socorro interface and is 
report bp-7507e59b-2f31-433d-b146-49ba52140903.
=============================================================

Steps To Reproduce:
1. Open https://www.khronos.org/registry/webgl/sdk/tests/webgl-conformance-tests.html
2. Find "conformance/glsl/bugs/nested-functions-should-not-crash.html"
3. Click [run] of conformance/glsl/bugs/nested-functions-should-not-crash.html

Actual Results:
Browser crashes.

Comment 1

[Arthur K. (he/him)]

I also tried against FF34.0b8 and used d3dcompiler_47.dll (renamed to d3dcompiler_46.dll, placed in the Firefox folder). https://crash-stats.mozilla.com/report/index/bp-648ce59d-09fb-4fa8-8d8b-324a02141111

Comment 2

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/message/reply/question/etc.)]

It still crashing on - https://www.khronos.org/registry/webgl/sdk/tests/conformance/glsl/bugs/nested-functions-should-not-crash.html?webglVersion=1

Crash report:
https://crash-stats.mozilla.com/report/index/38663276-0b9e-4f13-a9a5-2391b2141204
https://crash-stats.mozilla.com/report/index/6949b0ed-f156-4a81-8e50-d4ea22141204
https://crash-stats.mozilla.com/report/index/29d9c47b-80d4-44dc-b034-1189b2141204
https://crash-stats.mozilla.com/report/index/a96becae-2bb0-4cb3-aacc-658e72141204

Comment 3

[u480271]

Attachment: Enable SH_LIMIT_CALL_STACK_DEPTH

Enable ANGLE compiler option to enable limiting call stack depth
checks in the transpiler.

Chromium Issue 238837 - https://code.google.com/p/chromium/issues/detail?id=238837:
"This test causes a stack overflow in various GPU drivers."

Comment 4

[u480271]

https://tbpl.mozilla.org/?tree=Try&rev=847eac7df8c6

Comment 5

[u480271]

https://hg.mozilla.org/integration/mozilla-inbound/rev/0fe752f786b3

Comment 6

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/0fe752f786b3

Comment 7

[u480271]

Comment on attachment 8533003 [details] [diff] [review]
Enable SH_LIMIT_CALL_STACK_DEPTH

Approval Request Comment
[Feature/regressing bug #]: Bug 1062355
[User impact if declined]: Ill-formed WebGLSL can crash Firefox by causing the stack to be exhausted.
[Describe test coverage new/current, TBPL]: Tested against WebGL Conformance suite as well as https://www.khronos.org/registry/webgl/sdk/tests/conformance/glsl/bugs/nested-functions-should-not-crash.html
[Risks and why]: Low. Replace crash with WebGL error when compiling ill-formed source.
[String/UUID change made/needed]:

Comment 8

[Ryan VanderMeulen [:RyanVM]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/1bc888409400
https://hg.mozilla.org/releases/mozilla-beta/rev/b044a73a2d5f

Comment 9

[Virtual_ManPL [:Virtual] 🇵🇱 - (please needinfo? me - so I will see your comment/message/reply/question/etc.)]

I can verified that this bug is fixed.