1323363 - Crash in webgl2 conformance test deqp/functional/gles3/texturespecification/teximage2d_pbo_params.html

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Michael Leu[:Lenzak](UTC+8)]

Test Platform:
Windows 10 with Intel HD4000

Step to Reproduce:
Go to this website
https://www.khronos.org/registry/webgl/sdk/tests/deqp/functional/gles3/texturespecification/texsubimage2d_pbo_params.html?webglVersion=2&quiet=0

Comment 1

[Michael Leu[:Lenzak](UTC+8)]

Here is crash stack, the crash point seems to be in driver dll file.

ig7icd32.dll!5866c4a0()	Unknown
[Frames below may be incorrect and/or missing, no symbols loaded for ig7icd32.dll]	
[External Code]	
xul.dll!mozilla::gl::GLContext::fTexSubImage2D(unsigned int target, int level, int xoffset, int yoffset, int width, int height, unsigned int format, unsigned int type, const void * pixels) Line 1645	C++
xul.dll!mozilla::DoTexSubImage(mozilla::gl::GLContext * gl, StrongGLenum<TexImageTargetDetails> target, int level, int xOffset, int yOffset, int zOffset, int width, int height, int depth, const mozilla::webgl::PackingInfo & pi, const void * data) Line 833	C++
xul.dll!mozilla::webgl::DoTexOrSubImage(bool isSubImage, mozilla::gl::GLContext * gl, StrongGLenum<TexImageTargetDetails> target, int level, const mozilla::webgl::DriverUnpackInfo * dui, int xOffset, int yOffset, int zOffset, int width, int height, int depth, const void * data) Line 402	C++
xul.dll!mozilla::webgl::TexUnpackBytes::TexOrSubImage(bool isSubImage, bool needsRespec, const char * funcName, mozilla::WebGLTexture * tex, StrongGLenum<TexImageTargetDetails> target, int level, const mozilla::webgl::DriverUnpackInfo * dui, int xOffset, int yOffset, int zOffset, unsigned int * const out_error) Line 478	C++
xul.dll!mozilla::WebGLTexture::TexSubImage(const char * funcName, StrongGLenum<TexImageTargetDetails> target, int level, int xOffset, int yOffset, int zOffset, const mozilla::webgl::PackingInfo & pi, const mozilla::webgl::TexUnpackBlob * blob) Line 1332	C++
xul.dll!mozilla::WebGLTexture::TexSubImage(const char * funcName, StrongGLenum<TexImageTargetDetails> target, int level, int xOffset, int yOffset, int zOffset, int width, int height, int depth, const mozilla::webgl::PackingInfo & pi, const mozilla::TexImageSource & src) Line 448	C++
xul.dll!mozilla::WebGLContext::TexSubImage(const char * funcName, unsigned char funcDims, unsigned int rawTarget, int level, int xOffset, int yOffset, int zOffset, int width, int height, int depth, unsigned int unpackFormat, unsigned int unpackType, const mozilla::TexImageSource & src) Line 415	C++
xul.dll!mozilla::WebGLContext::TexSubImage2D(unsigned int target, int level, int xOffset, int yOffset, int width, int height, unsigned int unpackFormat, unsigned int unpackType, const mozilla::TexImageSource & src) Line 1180	C++
xul.dll!mozilla::WebGLContext::TexSubImage2D<__int64>(unsigned int target, int level, int xOffset, int yOffset, int width, int height, unsigned int unpackFormat, unsigned int unpackType, const __int64 & anySrc, mozilla::ErrorResult & out_error) Line 1157	C++
xul.dll!mozilla::dom::WebGL2RenderingContextBinding::texSubImage2D(JSContext * cx, JS::Handle<JSObject *> obj, mozilla::WebGL2Context * self, const JSJitMethodCallArgs & args) Line 2032	C++
xul.dll!mozilla::dom::GenericBindingMethod(JSContext * cx, unsigned int argc, JS::Value * vp) Line 2886	C++
xul.dll!js::CallJSNative(JSContext * cx, bool(*)(JSContext *, unsigned int, JS::Value *) native, const JS::CallArgs & args) Line 239	C++
xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct) Line 457	C++
xul.dll!InternalCall(JSContext * cx, const js::AnyInvokeArgs & args) Line 502	C++
xul.dll!js::Call(JSContext * cx, JS::Handle<JS::Value> fval, JS::Handle<JS::Value> thisv, const js::AnyInvokeArgs & args, JS::MutableHandle<JS::Value> rval) Line 521	C++
xul.dll!js::fun_apply(JSContext * cx, unsigned int argc, JS::Value * vp) Line 1223	C++
xul.dll!js::CallJSNative(JSContext * cx, bool(*)(JSContext *, unsigned int, JS::Value *) native, const JS::CallArgs & args) Line 239	C++
xul.dll!js::InternalCallOrConstruct(JSContext * cx, const JS::CallArgs & args, js::MaybeConstruct construct) Line 457	C++
xul.dll!InternalCall(JSContext * cx, const js::AnyInvokeArgs & args) Line 502	C++
xul.dll!js::CallFromStack(JSContext * cx, const JS::CallArgs & args) Line 508	C++
xul.dll!js::jit::DoCallFallback(JSContext * cx, js::jit::BaselineFrame * frame, js::jit::ICCall_Fallback * stub_, unsigned int argc, JS::Value * vp, JS::MutableHandle<JS::Value> res) Line 4733	C++
[External Code]

Comment 2

[Michael Leu[:Lenzak](UTC+8)]

Latest Chromium is OK, maybe they have some workaround code to prevent the crash.

Comment 3

[Kelsey Gilbert [:jgilbert]]

We're probably doing validation different than the driver.
It's worth looking at what we're asking the driver to do here exactly. (unpack param state, buffer length, and texImage args)

Comment 4

[Kelsey Gilbert [:jgilbert]]

Attachment: Bug 1323363 - Fix non-paranoid PBO uploads. -

Review commit: https://reviewboard.mozilla.org/r/98706/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/98706/

Comment 5

[Ethan Lin[:ethlin]]

Comment on attachment 8818765 [details]
Bug 1323363 - Fix non-paranoid PBO uploads. -

https://reviewboard.mozilla.org/r/98706/#review99226

Comment 6

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/mozilla-inbound/rev/9555007ca062
Fix non-paranoid PBO uploads. - r=ethlin

Comment 7

[Phil Ringnalda (:philor)]

https://hg.mozilla.org/mozilla-central/rev/9555007ca062

Comment 10

[Kelsey Gilbert [:jgilbert]]

Comment on attachment 8818765 [details]
Bug 1323363 - Fix non-paranoid PBO uploads. -

Approval Request Comment
[Feature/Bug causing the regression]: webgl2
[User impact if declined]:
[Is this code covered by automated tests?]:
[Has the fix been verified in Nightly?]:
[Needs manual test from QE? If yes, steps to reproduce]: 
[List of other uplifts needed for the feature/fix]:
[Is the change risky?]:
[Why is the change risky/not risky?]:
[String changes made/needed]:

Comment 12

[Gerry Chang [:gchang]]

Comment on attachment 8818765 [details]
Bug 1323363 - Fix non-paranoid PBO uploads. -

Fix a WebGL 2 related issue. Beta51+ and Aurora52+. Should be in 51 beta 10.

Comment 13

[Kelsey Gilbert [:jgilbert]]

https://hg.mozilla.org/releases/mozilla-aurora/rev/ec19c00b96f9

Comment 14

[Kelsey Gilbert [:jgilbert]]

https://hg.mozilla.org/releases/mozilla-beta/rev/7b34556d03c7