1421182 - Google map crash in OSX with Intel HD Graphics 3000

Status: RESOLVED WORKSFORME

(Core :: Graphics: CanvasWebGL, defect, P3)

Description

[Daosheng Mu[:daoshengmu]]

Although we have given a workaround patch for Bug 1413269, we still need to find the root cause for this crash. This crash only happens on the specific hardware, MBP with Intel HD Graphics 3000.

Btw, I upload an attachment for devTool: Canvas inspector. We can realize the WebGL draw calls when viewing Google map from this snapshot.

Comment 1

[Daosheng Mu[:daoshengmu]]

The attachment link, https://drive.google.com/file/d/1p4pzFDGkAM8IHcPuL746rhAIpbHcU3qK/view?usp=sharing

Comment 2

[Daosheng Mu[:daoshengmu]]

I notice Google map will send a very big number to gl.drawArrays(TRIANGLES, 52308, 3060), and it seems to exceed the vertex buffer size.

If I add a temporary condition for checking the number of `first` and `vertCount` at WebGLContext::DrawArrays() to avoid the number is bigger than 100, it would be more difficult to happen crashes. But, it still has chance to crash...

Comment 3

[Daosheng Mu[:daoshengmu]]

Adding a check for avoiding the loc is nullptr at WebGLContext::Uniform4f() of WebGLContextGL.cpp is also helpful. I don't see any crash currently.

Comment 4

[Daosheng Mu[:daoshengmu]]

I disable gl.multithreaded and here is the last draw call before crash.

WebGLContext::DrawArrays()
mode	GLenum	4
first	GLint	0
vertCount	GLsizei	6

The buffer data size is 48 and only attrib0 is enabled. Its mByteLength is 48, mBytesPerVertex is 8, and mStride is 8.

I think the number from the vertex buffer makes sense. :jgilbert do you have any thought that might be a good point to keep investigating? Thanks!

Comment 5

[Daosheng Mu[:daoshengmu]]

Attachment: OpenGL extensions viewer on HD 3000

We can see HD Graphics 3000 only implement the features until OpenGL 3.3.

Comment 6

[Kelsey Gilbert [:jgilbert]]

(In reply to Daosheng Mu[:daoshengmu] from comment #4)
> I disable gl.multithreaded and here is the last draw call before crash.
> 
> WebGLContext::DrawArrays()
> mode	GLenum	4
> first	GLint	0
> vertCount	GLsizei	6
> 
> The buffer data size is 48 and only attrib0 is enabled. Its mByteLength is
> 48, mBytesPerVertex is 8, and mStride is 8.
> 
> I think the number from the vertex buffer makes sense. :jgilbert do you have
> any thought that might be a good point to keep investigating? Thanks!

Please dump all the vertex attribs, not just the enabled one.

Comment 7

[Daosheng Mu[:daoshengmu]]

Well, it seems to the program for the draw call no.39 and no.40 at DrawArrays will use mBoundVertexArray->mAttribs[1], but its mEnabled is false. It can be sure after forcing to make mGLMaxVertexAttribs to be 1, and it will hit the assertion when calling DrawArrays().

Comment 8

[Sylvestre Ledru [:Sylvestre]]

Coyping the signature from bug 1413269 which still occur.

Comment 9

[BugBot [:suhaib / :marco/ :calixte]]

Closing because no crashes reported for 12 weeks.