1131965 - Crash during WebGL Conformance Tests - /conformance/glsl/bugs/undefined-index-should-not-crash.html

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Toady]

User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:35.0) Gecko/20100101 Firefox/35.0 Cyberfox/35.0.2
Build ID: 20150210180115

Steps to reproduce:

While testing bug 1090518 using https://www.khronos.org/registry/webgl/sdk/tests/webgl-conformance-tests.html

Was able to produce a crash when https://www.khronos.org/registry/webgl/sdk/tests/conformance/glsl/bugs/undefined-index-should-not-crash.html test was run.
 


Actual results:

Crashreporter appeared after Firefox crashed.


Expected results:

Not have crashed

Reports

latest release 35.0.1
https://crash-stats.mozilla.com/report/index/fa5057bf-4198-4292-a19d-40bf82150209
https://crash-stats.mozilla.com/report/index/5b1a6bf5-b831-472f-be88-376092150210
https://crash-stats.mozilla.com/report/index/1d091c3e-a810-4c0e-acd2-d02b02150210

latest release 35.0.1 (Different hardware/Computer)
https://crash-stats.mozilla.com/report/index/bp-a0bf582f-925c-452d-a716-f628f2150211

latest release 35.0.1 Linux
https://crash-stats.mozilla.com/report/index/1787efdb-ed4d-4699-9253-f37c02150211

latest beta 36.0b8
https://crash-stats.mozilla.com/report/index/d5959c0e-4c27-480c-b787-747822150211
https://crash-stats.mozilla.com/report/index/0e977245-c0e3-472f-9d03-187272150211
https://crash-stats.mozilla.com/report/index/52ab8a71-0297-4a31-aab4-4331b2150211

latest aurora 37.0a2
https://crash-stats.mozilla.com/report/index/9b556207-2c31-402b-8d96-03fe32150211

latest nightly 38.0a1 (2015-02-10)
https://crash-stats.mozilla.com/report/index/75e97e35-f145-4e7a-af28-ab7b52150211

latest nightly 38.0a1 (2015-02-10) e10s enabled (This one showed tab crash notification)
https://crash-stats.mozilla.com/report/index/0df3c8c9-30c5-47b4-b8e6-07e542150211

About:support data

Application Basics
------------------

Name: Firefox
Version: 36.0
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:36.0) Gecko/20100101 Firefox/36.0
Multiprocess Windows: 0/1

Crash Reports for the Last 3 Days
---------------------------------

Report ID: bp-52ab8a71-0297-4a31-aab4-4331b2150211
Submitted: 7 minutes ago

Report ID: bp-0e977245-c0e3-472f-9d03-187272150211
Submitted: 11 minutes ago

Report ID: bp-d5959c0e-4c27-480c-b787-747822150211
Submitted: 20 minutes ago

Report ID: bp-1d091c3e-a810-4c0e-acd2-d02b02150210
Submitted: 19 hours ago

Report ID: bp-5b1a6bf5-b831-472f-be88-376092150210
Submitted: 21 hours ago

Report ID: bp-fa5057bf-4198-4292-a19d-40bf82150209
Submitted: 2 days ago

All Crash Reports

Extensions
----------

Graphics
--------

Adapter Description: NVIDIA GeForce GTX 670
Adapter Drivers: nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
Adapter RAM: 2048
Device ID: 0x1189
Direct2D Enabled: true
DirectWrite Enabled: true (6.2.9200.16492)
Driver Date: 2-5-2015
Driver Version: 9.18.13.4752
GPU #2 Active: false
GPU Accelerated Windows: 1/1 Direct3D 11 (OMTC)
Subsys ID: 00000000
Vendor ID: 0x10de
WebGL Renderer: Google Inc. -- ANGLE (NVIDIA GeForce GTX 670 Direct3D9Ex vs_3_0 ps_3_0)
windowLayerManagerRemote: true
AzureCanvasBackend: direct2d 1.1
AzureContentBackend: direct2d 1.1
AzureFallbackCanvasBackend: cairo
AzureSkiaAccelerated: 0

Important Modified Preferences
------------------------------

browser.cache.disk.capacity: 358400
browser.cache.disk.smart_size.first_run: false
browser.cache.frecency_experiment: 4
browser.places.smartBookmarksVersion: 7
browser.sessionstore.upgradeBackup.latestBuildID: 20150209164123
browser.startup.homepage_override.buildID: 20150209164123
browser.startup.homepage_override.mstone: 36.0
extensions.lastAppVersion: 36.0
gfx.direct3d.last_used_feature_level_idx: 0
media.gmp-gmpopenh264.lastUpdate: 1423647371
media.gmp-gmpopenh264.version: 1.3
media.gmp-manager.lastCheck: 1423647370
network.cookie.prefsMigrated: true
places.history.expiration.transient_current_max_pages: 104858
plugin.disable_full_page_plugin_for_types: application/pdf
plugin.importedState: true
privacy.sanitize.migrateFx3Prefs: true
storage.vacuum.last.index: 0

Important Locked Preferences
----------------------------

JavaScript
----------

Incremental GC: true

Accessibility
-------------

Activated: false
Prevent Accessibility: 0

Library Versions
----------------

NSPR
Expected minimum version: 4.10.7
Version in use: 4.10.7

NSS
Expected minimum version: 3.17.4 Basic ECC
Version in use: 3.17.4 Basic ECC

NSSSMIME
Expected minimum version: 3.17.4 Basic ECC
Version in use: 3.17.4 Basic ECC

NSSSSL
Expected minimum version: 3.17.4 Basic ECC
Version in use: 3.17.4 Basic ECC

NSSUTIL
Expected minimum version: 3.17.4
Version in use: 3.17.4

Experimental Features
---------------------

Name: Plugin Video Usage Metrics
ID: [e-mail]
Description: A measurement experiment to determine which video sites use plugins and are most popular, so that Mozilla can prioritize and fix common video problems.
Active: true
End Date: 1424649600000
Homepage:

Comment 1

[u480271]

This is a bug in the Angle shader transpiler: BUG=angle:857

    Fix a translator crash with index expressions.

    This crash happened with certain bad shaders which used temporary
    values as array (or other) index expresisons.

    Fixes the crash covered in the WebGL test
    "conformance/bugs/undefined-index-should-not-crash"

We'll need to pull a new version of Angle.

Comment 2

[Jeff Muizelaar [:jrmuizel]]

(In reply to Dan Glastonbury :djg :kamidphish from comment #1)
> This is a bug in the Angle shader transpiler: BUG=angle:857
> 
>     Fix a translator crash with index expressions.
> 
>     This crash happened with certain bad shaders which used temporary
>     values as array (or other) index expresisons.
> 
>     Fixes the crash covered in the WebGL test
>     "conformance/bugs/undefined-index-should-not-crash"
> 
> We'll need to pull a new version of Angle.

Which version do we need?

Comment 3

[Toady]

Can't the patch just be applied.

gfx\angle\src\compiler\translator\ParseContext.cpp

https://chromium-review.googlesource.com/#/c/237460/4/src/compiler/translator/ParseContext.cpp

In a local test build the patch applies and builds with out error and the bug is resolved.

Comment 4

[u480271]

It could be, but we regularly do pull more recent versions of Angle from Google.

Comment 5

[Toady]

I see https://bugzilla.mozilla.org/show_bug.cgi?id=1128264 was an update to ANGLE to chromium/2214
However the issue is still present in nightly build(2015-02-14)
Vendor=Mozilla
Name=Firefox
RemotingName=firefox
CodeName=Nightly
Version=38.0a1
BuildID=20150214030238
SourceRepository=https://hg.mozilla.org/mozilla-central
SourceStamp=a7c177546ca0
ID={ec8030f7-c20a-464f-9b0e-13a3a9e97384}

The above update to angle has not included the patch for this particular bug but the patch appears in chromium/2269 and higher https://chromium.googlesource.com/angle/angle/+/chromium/2269

Comment 6

[Toady]

Attachment: Bug 1131965.jpg

Comment 7

[Toady]

Any updates on this.

Comment 8

[Luke]

This test is still crashing FF 39.0a1 (2015-02-24) Nightly.

Comment 9

[Toady]

(In reply to Luke from comment #8)
> This test is still crashing FF 39.0a1 (2015-02-24) Nightly.

Yes, Angle ether needs updating to chromium/2269 or the patch applied.
The patch likely the easiest of the 2

Comment 10

[Toady]

Created a pull request on git https://github.com/mozilla/gecko-dev/pull/56
With the above patch, I would use mercurial however i need to learn it.

Comment 11

[Luke]

Besides crashing the conformance test, the build of ANGLE firefox is using causes multiple real world games/demos to render incorrectly. These can easibly be reproduced by comparing the D3D11 to the D3D9 backend. Chrome has fixed most of them, but firefox is still using an old build. Here is an example of pow() broken in D3D11 ANGLE backend that's already been fixed in Chrome:

http://esenthel.com/?id=live_demo

Comment 12

[Jeff Muizelaar [:jrmuizel]]

(In reply to Luke from comment #11)
> Besides crashing the conformance test, the build of ANGLE firefox is using
> causes multiple real world games/demos to render incorrectly. These can
> easibly be reproduced by comparing the D3D11 to the D3D9 backend. Chrome has
> fixed most of them, but firefox is still using an old build. Here is an
> example of pow() broken in D3D11 ANGLE backend that's already been fixed in
> Chrome:
> 
> http://esenthel.com/?id=live_demo

Do you have other examples of things that are broken?

Comment 13

[Jeff Muizelaar [:jrmuizel]]

(In reply to Luke from comment #11)
> Besides crashing the conformance test, the build of ANGLE firefox is using
> causes multiple real world games/demos to render incorrectly. These can
> easibly be reproduced by comparing the D3D11 to the D3D9 backend. Chrome has
> fixed most of them, but firefox is still using an old build. Here is an
> example of pow() broken in D3D11 ANGLE backend that's already been fixed in
> Chrome:
> 
> http://esenthel.com/?id=live_demo

I tried this content in Nightly and it seemed to work fine. Can you describe what's broken or give a reduced test case?

Comment 14

[Jeff Muizelaar [:jrmuizel]]

I cherrypicked the fix from ANGLE:

https://hg.mozilla.org/integration/mozilla-inbound/rev/9f47df83a8f6

Comment 15

[Toady]

Attachment: bug-1131965.patch

Unfortunately "contributions cannot be accepted via PR" so the submission on git was rejected.

I have tried to learn the Mozilla mercurial system so i have exported the patch from mercurial and attached it, Now i don't know what i need to do to submit it for review\integration or how to create Mozilla LDAP account to push the patch to central.

Hopefully this is suffice to resolve the issue.

Comment 16

[Jeff Muizelaar [:jrmuizel]]

(In reply to Toady from comment #15)
> Created attachment 8575324 [details] [diff] [review]
> bug-1131965.patch
> 
> Unfortunately "contributions cannot be accepted via PR" so the submission on
> git was rejected.
> 
> I have tried to learn the Mozilla mercurial system so i have exported the
> patch from mercurial and attached it, Now i don't know what i need to do to
> submit it for review\integration or how to create Mozilla LDAP account to
> push the patch to central.
> 
> Hopefully this is suffice to resolve the issue.

I've already landed the fix. It should show up in Nightly in the next day or two.

Comment 18

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

https://hg.mozilla.org/mozilla-central/rev/9f47df83a8f6

Comment 19

[Toady]

(In reply to Jeff Muizelaar [:jrmuizel] from comment #16)
> (In reply to Toady from comment #15)
> > Created attachment 8575324 [details] [diff] [review]
> > bug-1131965.patch
> > 
> > Unfortunately "contributions cannot be accepted via PR" so the submission on
> > git was rejected.
> > 
> > I have tried to learn the Mozilla mercurial system so i have exported the
> > patch from mercurial and attached it, Now i don't know what i need to do to
> > submit it for review\integration or how to create Mozilla LDAP account to
> > push the patch to central.
> > 
> > Hopefully this is suffice to resolve the issue.
> 
> I've already landed the fix. It should show up in Nightly in the next day or
> two.

Ha ha i guess i should have refreshed the page before posting.

Comment 20

[Luke]

:jrmuizel
Yes, I noticed several issues with Chrome's old D3D11 implementation that have been fixed but are still remaining in Firefox. I was holding off until the next sync. But if you'd like or that's not going to happen soon, I can file them.

Comment 21

[Jeff Muizelaar [:jrmuizel]]

Yes, please file them. D3D11 is about to ship in FF37 and I'd like to avoid regressions.

Comment 22

[Toady]

Any chance this will be uplifted to the latest 38.0 beta so it can land in the next release of Firefox?