1997070 - Calling `array<f32>()` without a size crashes WebGPU on Windows

Status: NEW

(Core :: Graphics: WebGPU, defect, P1)

Description

[brandmairstefan]

Attachment: crash-reproduction.html

User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0

Steps to reproduce:

I created a compute shader with the following code. There's also a index.html file attached which does the whole setup

@compute @workgroup_size(1)
        fn main() {
          let a = array<f32>(); // pretty sure this is invalid
        }

Actual results:

I then started a fresh Firefox, and opened the index.html.
The entire Firefox window flashed white for a moment. Then it got back under control and seemingly accepted the shader.

Reloading it repeats the same behavior. If I reload it often enough, I end up getting

Uncaught (in promise) DOMException: WebGPU is disabled by blocklist

Expected results:

It should have reject the shader.

And Firefox definitely shouldn't have flashed white.

Comment 1

[brandmairstefan]

Attachment: about:support

Comment 2

[Mayank Bansal]

https://crash-stats.mozilla.org/report/index/46de9328-a407-4cf3-b864-2bbd10251029

Comment 3

[Erich Gubler [:ErichDonGubler] (he/him)]

This doesn't reproduce for me on macOS, but it does for Windows. Looking at the crash that's taking down the GPU process on Windows (which causes the symptoms you're noting with the screen blanking out), it seems that there's some validation not being done by our shader compiler for this problem. Yikes!

Filed wgpu#8442, since this is reproducible upstream using naga-cli.

Comment 4

[Timothy Nikkel (:tnikkel)]

Can you set severity please? Thank you.

Comment 5

[Erich Gubler [:ErichDonGubler] (he/him)]

wgpu#8442 has been prioritized as P1 and assigned to me, so I'll update here accordingly.