Closed Bug 1556690 Opened 5 years ago Closed 5 years ago

Nested loop in WebGL shader crashes the tab (windows only) with webgl.bypass-shader-validation:true

Categories

(Core :: Graphics: CanvasWebGL, defect, P3)

67 Branch
x86_64
macOS
defect

Tracking

()

RESOLVED DUPLICATE of bug 1526027

People

(Reporter: matthieu.rudelle, Unassigned)

References

Details

Crash Data

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/74.0.3729.169 Safari/537.36

Steps to reproduce:

Visit https://jsfiddle.net/mrudelle/5ve9fscx/ from a windows machine.

Tested on a Microsoft Surface and A desktop computer.

Actual results:

The tab crashes

Expected results:

A canvas showing animated colors should be displayed.

Actual User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:67.0) Gecko/20100101 Firefox/67.0

Hello Matthieu - Can you please type about:crashes in the URL bar and provide the crash report ID? Thanks!

Flags: needinfo?(matthieu.rudelle)

Hi Marcia, thanks for the quick reply! Here is the crash report ID: bp-cd551227-8a4f-4376-84d3-bc6d20190604

Flags: needinfo?(matthieu.rudelle)

Matthieu - It looks as if this is Bug 1526027, which is fixed in 68 but I guess not in 67.

Component: Untriaged → Canvas: WebGL
Product: Firefox → Core
OS: Unspecified → macOS
Priority: -- → P3
Hardware: Unspecified → x86_64
See Also: → 1526027

What's the value of "webgl.bypass-shader-validation" in about:support?

Flags: needinfo?(matthieu.rudelle)
Assignee: nobody → jgilbert
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true
Status: ASSIGNED → UNCONFIRMED
Ever confirmed: false
Status: UNCONFIRMED → ASSIGNED
Ever confirmed: true

:sylvestre, why do we even have an "ASSIGNED" state if we're enforcing ASSIGNED if assignee != null?

Assignee: jgilbert → nobody
Status: ASSIGNED → UNCONFIRMED
Ever confirmed: false
Flags: needinfo?(sledru)

This is indeed under discussions!

Flags: needinfo?(sledru)
Crash Signature: [@ mozilla::QueryProgramInfo]

:marcia You are probably right, I tried under nightly (69.0a1) and the page works as expected

:jgilbert webgl.bypass-shader-validation is set to true

Flags: needinfo?(matthieu.rudelle)

Disable that ASAP, as it opens you up to vulnerabilities on malicious websites.

Status: UNCONFIRMED → RESOLVED
Closed: 5 years ago
Resolution: --- → DUPLICATE
Summary: Nested loop in WebGL shader crashes the tab (windows only) → Nested loop in WebGL shader crashes the tab (windows only) with webgl.bypass-shader-validation:true
You need to log in before you can comment on or make changes to this bug.