1525857 - Crash in [@ mozilla::QueryProgramInfo]

Status: RESOLVED DUPLICATE of bug 1526027

(Core :: Graphics: CanvasWebGL, defect, P1)

Description

[Calixte Denizet (:calixte)]

This bug is for crash report bp-ac2ac3bb-a795-4d52-a0e5-91f290190206.

Top 10 frames of crashing thread:

0 libxul.so mozilla::QueryProgramInfo dom/canvas/WebGLProgram.cpp:477
1 libxul.so mozilla::WebGLProgram::LinkAndUpdate dom/canvas/WebGLProgram.cpp:1517
2 libxul.so mozilla::WebGLProgram::LinkProgram dom/canvas/WebGLProgram.cpp:1226
3 libxul.so mozilla::WebGLContext::LinkProgram dom/canvas/WebGLContextGL.cpp:980
4 libxul.so mozilla::dom::WebGLRenderingContext_Binding::linkProgram dom/bindings/WebGLRenderingContextBinding.cpp:18000
5 libxul.so bool mozilla::dom::binding_detail::GenericMethod<mozilla::dom::binding_detail::NormalThisPolicy, mozilla::dom::binding_detail::ThrowExceptions> dom/bindings/BindingUtils.cpp:3138
6 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:441
7 libxul.so Interpret js/src/vm/Interpreter.cpp:588
8 libxul.so js::RunScript js/src/vm/Interpreter.cpp:421
9 libxul.so js::InternalCallOrConstruct js/src/vm/Interpreter.cpp:561

There are 4 crashes (from 1 installation) in nightly 67 with buildid 20190206095431. In analyzing the backtrace, the regression may have been introduced by patch [1] to fix bug 1290774.

[1] https://hg.mozilla.org/mozilla-central/rev?node=c5f938f57394

Comment 1

[Kelsey Gilbert [:jgilbert]]

Looks like the ShaderValidator's handle is invalid, though it would make more sense if the ShaderValidator was null there.

That should only happen when the user sets webgl.bypass-shader-validation=true, though.

Comment 2

[Kelsey Gilbert [:jgilbert]]

We should really just remove the option to bypass too, since it mostly doesn't work, and is unsupported.

Comment 4

[Neha Kochar [:neha]]

Jeff, is this on track to get fixed in 67?

Comment 5

[Kelsey Gilbert [:jgilbert]]

Yes.

Comment 6

[Pascal Chevrel:pascalc]

100 crashes on Nightly over the last week, tracking for 67.

Comment 7

[Kelsey Gilbert [:jgilbert]]

Attachment: Bug 1525857 - Add release asserts for pre-crash cases.

Comment 8

[Pulsebot]

Pushed by [e-mail]:
https://hg.mozilla.org/integration/autoland/rev/b36c070f066b
Add release asserts for pre-crash cases. r=lsalzman

Comment 9

[Stefan Hindli [:stefan_hindli]]

https://hg.mozilla.org/mozilla-central/rev/b36c070f066b

Comment 10

[Neha Kochar [:neha]]

Stephan, this was pushed to central 8 days ago but not marked resolved. Checking in to see if that was intentional?

Comment 11

[Kelsey Gilbert [:jgilbert]]

leave-open keyword was deliberate.

Comment 12

[Pascal Chevrel:pascalc]

The spike on 67 was dealt with the patch in comment #9. Untracking and marking as fixed-optional for 67 given that we are back to one or two crashes a week on Nightly since then.

Comment 13

[Neha Kochar [:neha]]

Bulk change for all regression bugs with status-firefox67 as 'fix-optional' to be marked 'affected' for status-firefox68.

Comment 14

[Andrew McCreight [:mccr8]]

Lots of crashes with this signature from a single installation on the 3-20 Nightly. The crash reason is MOZ_RELEASE_ASSERT(fragShader->Validator()).

For example: bp-bd6d808b-fe10-4629-a41f-5548e0190320

Comment 15

[Marcia Knous [:marcia]]

Only one recent crash in 68 nightly, in the 4-28 build.

Comment 16

[Kelsey Gilbert [:jgilbert]]

(In reply to Andrew McCreight [:mccr8] from comment #14)

Lots of crashes with this signature from a single installation on the 3-20 Nightly. The crash reason is MOZ_RELEASE_ASSERT(fragShader->Validator()).

For example: bp-bd6d808b-fe10-4629-a41f-5548e0190320

Awesome, this is bug 1526027.