1354997 - OOM @ libglesv2 while compiling WebGL shader

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect, P3)

Description

[Aral Yaman]

Attachment: Crash.html

User Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Build ID: 20170409123541

Steps to reproduce:

Open Crash.html

Wait ~ 1min -> the tab is going to crash because of out of memory.


Actual results:

Passing a struct to a bool constructor causes the issue:

precision mediump float ; 
struct my_struct { float f ; }; 
my_struct a = my_struct (1.0 ); 
void main ( void ) 
{
	bool test = bool(a);
} 


Expected results:

No crash see Chrome

Comment 1

[Timothy Nikkel (:tnikkel)]

No problems seem to happen on Mac. So might be Windows specific. Something in angle maybe?

Comment 2

[Timothy Nikkel (:tnikkel)]

Angle was recently (two days ago) updated on nightly (bug 1347866). We should re-check to see if it still happens after the update.

Comment 3

[Michael Leu[:Lenzak](UTC+8)]

This issue still happens in the latest nightly build, I will take a look into it.

Comment 4

[Michael Leu[:Lenzak](UTC+8)]

This OOM is caused by a infinitely expanding intermediate shader string in ANGLE, so I think it is an ANGLE bug.

There must be some commit in ANGLE trunk fix this problem.

Comment 5

[Michael Leu[:Lenzak](UTC+8)]

OK, I think ANGLE does not fix this problem even in their master branch.

It seems that chromium has some kind of "bail out" mechanism in JavaScript, so this faulty shader code doesn't even reach ANGLE.

Comment 6

[Michael Leu[:Lenzak](UTC+8)]

I wrote a simple c++ program feeding the shader code directly to ANGLE translator and it crashes even in ANGLE master branch.

So we can confirm ANGLE cannot handle this case properly.

I have submit an issue in crbug.

https://bugs.chromium.org/p/angleproject/issues/detail?id=2036

Comment 7

[Michael Leu[:Lenzak](UTC+8)]

Attachment: Bug 1354997 - Disallow structs as scalar/vector constructor arguments (Cherry-picked from ANGLE project Issue 2036);

Review commit: https://reviewboard.mozilla.org/r/142652/diff/#index_header
See other reviews: https://reviewboard.mozilla.org/r/142652/

Comment 8

[Kelsey Gilbert [:jgilbert]]

Comment on attachment 8871140 [details]
Bug 1354997 - Disallow structs as scalar/vector constructor arguments (Cherry-picked from ANGLE project Issue 2036);

https://reviewboard.mozilla.org/r/142652/#review147188

Comment 9

[Michael Leu[:Lenzak](UTC+8)]

It seems that Google's fix for this bug will break some of the webgl conformance tests.
According to the issue owner there, passing a struct into a boolean constructor in ESSL is not explicitly disallowed in the spec, and they decide to blacklist this situation, which leads to failures to some edge case test.
https://treeherder.mozilla.org/#/jobs?repo=try&revision=bb54518a3de7

Maybe we should have some discussion about the spec to make it clear?

Comment 10

[Michael Leu[:Lenzak](UTC+8)]

Updating ANGLE can fix this crash.

Comment 11

[Michael Leu[:Lenzak](UTC+8)]

It has been fixed after ANGLE is updated.