Assert failure in WebGLContext::AssertCachedState in WebGL demo

RESOLVED FIXED in Firefox 43

Status

()

Core
Canvas: WebGL
RESOLVED FIXED
3 years ago
3 years ago

People

(Reporter: q1, Assigned: jerry)

Tracking

39 Branch
mozilla43
Points:
---

Firefox Tracking Flags

(firefox43 fixed)

Details

(Whiteboard: [gfx-noted])

Attachments

(1 attachment, 1 obsolete attachment)

(Reporter)

Description

3 years ago
There is a completely-reproducible assert failure in 39.0 debug (my build with no modifications) in WebGLContext::AssertCachedState (dom\canvas\WebGLContextUtils.cpp) at line 1128:

   MOZ_ASSERT(IsCacheCorrect(mDepthClearValue, depthClearValue));

when playing the demo https://www.khronos.org/registry/webgl/sdk/demos/webkit/ManyPlanetsDeep.html . Just open that page and wait a few seconds.

At failure, mDepthClearValue == 1.0 and depthClearValue == 10000.0, and the call stack is:

>	xul.dll!mozilla::WebGLContext::AssertCachedState() Line 1128	C++
 	xul.dll!mozilla::WebGLContext::ForceClearFramebufferWithDefaultValues(bool fakeNoAlpha, unsigned int mask, const bool * colorAttachmentsMask) Line 1334	C++
 	xul.dll!mozilla::WebGLContext::ClearScreen() Line 1312	C++
 	xul.dll!mozilla::WebGLContext::ClearBackbufferIfNeeded() Line 974	C++
 	xul.dll!mozilla::WebGLContext::Clear(unsigned int mask) Line 44	C++
 	xul.dll!mozilla::dom::WebGLRenderingContextBinding::clear(JSContext * cx, JS::Handle<JSObject *> obj, mozilla::WebGLContext * self, const JSJitMethodCallArgs & args) Line 9435	C++
 	xul.dll!mozilla::dom::GenericBindingMethod(JSContext * cx, unsigned int argc, JS::Value * vp) Line 2501	C++
 	xul.dll!js::CallJSNative(JSContext * cx, bool (JSContext *, unsigned int, JS::Value *) * native, const JS::CallArgs & args) Line 235	C++
 	xul.dll!js::Invoke(JSContext * cx, JS::CallArgs args, js::MaybeConstruct construct) Line 470	C++
 	xul.dll!js::Invoke(JSContext * cx, const JS::Value & thisv, const JS::Value & fval, unsigned int argc, const JS::Value * argv, JS::MutableHandle<JS::Value> rval) Line 526	C++
 	xul.dll!js::jit::DoCallFallback(JSContext * cx, js::jit::BaselineFrame * frame, js::jit::ICCall_Fallback * stub_, unsigned int argc, JS::Value * vp, JS::MutableHandle<JS::Value> res) Line 9653	C++
 	05fb4a6c()	Unknown
 	[Frames below may be incorrect and/or missing]	
 	155fc058()	Unknown
 	05fb0bfa()	Unknown
 	xul.dll!EnterBaseline(JSContext * cx, js::jit::EnterJitData & data) Line 125	C++
 	xul.dll!js::jit::EnterBaselineMethod(JSContext * cx, js::RunState & state) Line 156	C++
 	xul.dll!Interpret(JSContext * cx, js::RunState & state) Line 2634	C++
 	xul.dll!js::RunScript(JSContext * cx, js::RunState & state) Line 420	C++
 	xul.dll!js::Invoke(JSContext * cx, JS::CallArgs args, js::MaybeConstruct construct) Line 489	C++
 	xul.dll!js::Invoke(JSContext * cx, const JS::Value & thisv, const JS::Value & fval, unsigned int argc, const JS::Value * argv, JS::MutableHandle<JS::Value> rval) Line 526	C++
 	xul.dll!JS::Call(JSContext * cx, JS::Handle<JS::Value> thisv, JS::Handle<JS::Value> fval, const JS::HandleValueArray & args, JS::MutableHandle<JS::Value> rval) Line 4331	C++
 	xul.dll!mozilla::dom::FrameRequestCallback::Call(JSContext * cx, JS::Handle<JS::Value> aThisVal, double time, mozilla::ErrorResult & aRv) Line 651	C++
 	xul.dll!mozilla::dom::FrameRequestCallback::Call(double time, mozilla::ErrorResult & aRv, mozilla::dom::CallbackObject::ExceptionHandling aExceptionHandling, JSCompartment * aCompartment) Line 528	C++
 	xul.dll!nsRefreshDriver::Tick(__int64 aNowEpoch, mozilla::TimeStamp aNowTime) Line 1580	C++
 	xul.dll!mozilla::RefreshDriverTimer::TickDriver(nsRefreshDriver * driver, __int64 jsnow, mozilla::TimeStamp now) Line 199	C++
 	xul.dll!mozilla::RefreshDriverTimer::Tick(__int64 jsnow, mozilla::TimeStamp now) Line 189	C++
 	xul.dll!mozilla::RefreshDriverTimer::Tick() Line 167	C++
 	xul.dll!mozilla::RefreshDriverTimer::TimerTick(nsITimer * aTimer, void * aClosure) Line 213	C++
 	xul.dll!nsTimerImpl::Fire() Line 631	C++
 	xul.dll!nsTimerEvent::Run() Line 729	C++
 	xul.dll!nsThread::ProcessNextEvent(bool aMayWait, bool * aResult) Line 855	C++
 	xul.dll!NS_ProcessNextEvent(nsIThread * aThread, bool aMayWait) Line 265	C++
 	xul.dll!mozilla::ipc::MessagePump::Run(base::MessagePump::Delegate * aDelegate) Line 99	C++
 	xul.dll!MessageLoop::RunInternal() Line 234	C++
 	xul.dll!MessageLoop::RunHandler() Line 227	C++
 	xul.dll!MessageLoop::Run() Line 201	C++
 	xul.dll!nsBaseAppShell::Run() Line 166	C++
 	xul.dll!nsAppShell::Run() Line 178	C++
 	xul.dll!nsAppStartup::Run() Line 281	C++
 	xul.dll!XREMain::XRE_mainRun() Line 4170	C++
 	xul.dll!XREMain::XRE_main(int argc, char * * argv, const nsXREAppData * aAppData) Line 4250	C++
 	xul.dll!XRE_main(int argc, char * * argv, const nsXREAppData * aAppData, unsigned int aFlags) Line 4469	C++
 	firefox.exe!do_main(int argc, char * * argv, nsIFile * xreDirectory) Line 294	C++
 	firefox.exe!NS_internal_main(int argc, char * * argv) Line 688	C++
 	firefox.exe!wmain(int argc, wchar_t * * argv) Line 131	C++
 	firefox.exe!__tmainCRTStartup() Line 255	C
 	kernel32.dll!@BaseThreadInitThunk@12()	Unknown
 	ntdll.dll!___RtlUserThreadStart@8()	Unknown
 	ntdll.dll!__RtlUserThreadStart@8()	Unknown

https://bugzilla.mozilla.org/show_bug.cgi?id=864044 and bugs named therein seem related.
(Reporter)

Comment 1

3 years ago
The "Earth and Mars" demo at https://www.khronos.org/registry/webgl/sdk/demos/webkit/Earth.html fails the same way.
Dan, can you check this bug?
Flags: needinfo?(dglastonbury)

Updated

3 years ago
Whiteboard: [gfx-noted]
I've tried to reproduce this locally and have been unable to. I've code reviewed the setting of mDepthClearValue and this situation would only occur if gl context has had glClearDepth called to set depth to 10000 before WebGLContext::InitAndValidateGL().

q1, can you copy the Graphics section from about:support into the bug?
Flags: needinfo?(dglastonbury) → needinfo?(q1)
Hi,
Which platform did you use for testing?
I also build a debug version for 39 codebase and put some debug message for this checking, but I don't see the assert and my trap message.
(Reporter)

Comment 5

3 years ago
My platform is Win7 SP1 x64, but using FF 39.0 debug x86. I just reproduced the crash again. Here is my about:support page:

Application Basics
------------------

Name: Firefox
Version: 39.0
Build ID: 20150713195703
Update Channel: default
User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:39.0) Gecko/20100101 Firefox/39.0
Multiprocess Windows: 0/1 (default: false)

Crash Reports for the Last 3 Days
---------------------------------

This application has not been configured to display crash reports.

Extensions
----------

Graphics
--------

Adapter Description: NVIDIA GeForce GT 610
Adapter Drivers: nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
Adapter RAM: 1024
Asynchronous Pan/Zoom: none
ClearType Parameters: Gamma: 2200 Pixel Structure: R
Device ID: 0x104a
Direct2D Enabled: true
DirectWrite Enabled: true (6.2.9200.16492)
Driver Date: 6-17-2015
Driver Version: 10.18.13.5330
GPU #2 Active: false
GPU Accelerated Windows: 1/1 Direct3D 11 (OMTC)
Subsys ID: 104a196e
Vendor ID: 0x10de
WebGL Renderer: Google Inc. -- ANGLE (NVIDIA GeForce GT 610 Direct3D11 vs_5_0 ps_5_0)
windowLayerManagerRemote: true
AzureCanvasBackend: direct2d 1.1
AzureContentBackend: direct2d 1.1
AzureFallbackCanvasBackend: cairo
AzureSkiaAccelerated: 0

Important Modified Preferences
------------------------------

accessibility.typeaheadfind.flashBar: 0
browser.cache.disk.capacity: 358400
browser.cache.disk.filesystem_reported: 1
browser.cache.disk.smart_size.first_run: false
browser.cache.disk.smart_size.use_old_max: false
browser.cache.frecency_experiment: 4
browser.download.importedFromSqlite: true
browser.fixup.alternate.enabled: false
browser.places.smartBookmarksVersion: 7
browser.search.searchEnginesURL:
browser.search.suggest.enabled: false
browser.search.update: false
browser.sessionstore.upgradeBackup.latestBuildID: 20150713124221
browser.startup.homepage_override.buildID: 20150713124221
browser.startup.homepage_override.mstone: 39.0
browser.tabs.drawInTitlebar: false
dom.apps.reset-permissions: true
dom.ipc.plugins.flash.subprocess.crashreporter.enabled: false
dom.ipc.plugins.reportCrashURL: false
dom.mozApps.signed_apps_installable_from:
dom.mozApps.used: true
extensions.lastAppVersion: 39.0
font.internaluseonly.changed: false
general.autoScroll: false
gfx.direct3d.last_used_feature_level_idx: 0
gfx.font_rendering.directwrite.enabled: true
keyword.enabled: false
media.gmp-eme-adobe.lastUpdate: 1437847251
media.gmp-eme-adobe.version: 12
media.gmp-gmpopenh264.lastUpdate: 1436723975
media.gmp-gmpopenh264.version: 1.4
media.gmp-manager.buildID: 20150713124221
media.gmp-manager.lastCheck: 1438283452
media.gmp-manager.url:
media.webrtc.debug.aec_log_dir: [redacted]
media.webrtc.debug.log_file: [redacted]
network.cookie.prefsMigrated: true
network.predictor.cleaned-up: true
places.database.lastMaintenance: 1437937750
places.history.expiration.transient_current_max_pages: 104858
plugin.disable_full_page_plugin_for_types: application/pdf
plugin.importedState: true
plugins.update.url:
privacy.cpd.offlineApps: true
privacy.cpd.siteSettings: true
privacy.donottrackheader.enabled: true
privacy.sanitize.migrateFx3Prefs: true
privacy.sanitize.timeSpan: 0
security.OCSP.enabled: 0
security.ssl.errorReporting.url:
storage.vacuum.last.index: 1
storage.vacuum.last.places.sqlite: 1437175863

Important Locked Preferences
----------------------------

JavaScript
----------

Incremental GC: true

Accessibility
-------------

Activated: false
Prevent Accessibility: 0

Library Versions
----------------

NSPR
Expected minimum version: 4.10.8
Version in use: 4.10.8

NSS
Expected minimum version: 3.19.2 Basic ECC
Version in use: 3.19.2 Basic ECC

NSSSMIME
Expected minimum version: 3.19.2 Basic ECC
Version in use: 3.19.2 Basic ECC

NSSSSL
Expected minimum version: 3.19.2 Basic ECC
Version in use: 3.19.2 Basic ECC

NSSUTIL
Expected minimum version: 3.19.2
Version in use: 3.19.2

Experimental Features
---------------------
Flags: needinfo?(q1)
Hi Dan,

I don't see the clamp code when we set a big value for "DepthClearValue" in angle.
https://hg.mozilla.org/mozilla-central/annotate/9673c75864beafca2f6c8b117b98503128bf2e56/gfx/angle/src/libGLESv2/libGLESv2.cpp#l679

The spec says the value should be [0,1].
Flags: needinfo?(dglastonbury)
Created attachment 8649124 [details] [diff] [review]
clamp gl ClearDepth() value to [0,1].

The value should be clamped to the range [0,1].
https://www.khronos.org/opengles/sdk/docs/man/xhtml/glClearDepthf.xml

The sample call gl.clearDepth(10000.0). We clamp the value to [0,1] and set to the cached depth member, but we still set the non-clamped value into the gl context. Angle also saves the big value without clamping. Then we hit the assert between 10000.0 and 1.0.
Attachment #8649124 - Flags: review?(jgilbert)
Attachment #8649124 - Flags: review?(dglastonbury)
(Assignee)

Updated

3 years ago
Assignee: nobody → hshih
Status: NEW → ASSIGNED
Flags: needinfo?(dglastonbury)
Created attachment 8649147 [details] [diff] [review]
clamp gl ClearDepth() value to [0,1]. v2

update patch comment
Attachment #8649124 - Attachment is obsolete: true
Attachment #8649124 - Flags: review?(jgilbert)
Attachment #8649124 - Flags: review?(dglastonbury)
Attachment #8649147 - Flags: review?(jgilbert)
Attachment #8649147 - Flags: review?(dglastonbury)
Comment on attachment 8649147 [details] [diff] [review]
clamp gl ClearDepth() value to [0,1]. v2

Review of attachment 8649147 [details] [diff] [review]:
-----------------------------------------------------------------

Thanks!
Attachment #8649147 - Flags: review?(jgilbert)
Attachment #8649147 - Flags: review?(dglastonbury)
Attachment #8649147 - Flags: review+
q1, could you please check whether this patch work?
Flags: needinfo?(q1)
Please land the attachment 8649147 [details] [diff] [review] to m-c.

wait for the try result
https://treeherder.mozilla.org/#/jobs?repo=try&revision=82b0f3302777
Keywords: checkin-needed
(Reporter)

Comment 14

3 years ago
I'll check this tomorrow, though I see it's already been committed.
Flags: needinfo?(q1)
(Reporter)

Comment 15

3 years ago
This patch fixes the reported problems in a debug build of 40.0.
https://hg.mozilla.org/mozilla-central/rev/212e4073f3e0
Status: ASSIGNED → RESOLVED
Last Resolved: 3 years ago
status-firefox43: --- → fixed
Resolution: --- → FIXED
Target Milestone: --- → mozilla43
You need to log in before you can comment on or make changes to this bug.