597946 - WebGL - GL driver crashes when fragment shader contains bad #ifdef and ANGLE is used

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Satoshi Ueyama]

User-Agent:       Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b7pre) Gecko/20100919 Firefox/4.0b7pre
Build Identifier: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:2.0b7pre) Gecko/20100919 Firefox/4.0b7pre

Browser freezes when JS program tries to compile a bad fragment shader like this:
---------------
#ifdef GL_ES
---------------This code misses a closing #endif.

Reproducible: Always

Steps to Reproduce:
1. Enable WebGL
2. Open http://gyu.que.jp/private/badshader.html

Actual Results:  
Browser freezes.

Expected Results:  
An alert window is displayed.

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

This is really funny:
 - with the ANGLE shader validator/translator turned on (default), I confirm the crash. It's the graphics driver that's crashing, not Firefox. This means that the ANGLE translator is doing 2 bad things: failing to validate the shader, AND generating a bad shader as output.
 - with the ANGLE shader validator/translator turned off, here I get the expected result ... which means that my NVIDIA driver is doing a fine job by itself.

Forwarding this bug to the ANGLE project. Thanks for a great test case.

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

http://code.google.com/p/angleproject/issues/detail?id=40

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

Bug still exists as of today. Still waiting on upstream bug (comment 2) to be fixed.

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: testcase

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: fix angle preprocessor: was freezing on bad ifdef

This is the same patch that I attached to angle bug 40 upstream. A second patch is coming for the Mozilla bits.

This fixes the bug for me: the test case no longer freezes, and gives the expected shader compilation errors.

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: mozilla cosmetics

Comment 7

[Benoit Jacob [:bjacob] (mostly away)]

Notice wrt the 'mozilla cosmetics' bug that it exposes a Bugzilla patch viewer bug. Use raw text view.

Comment 8

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 497023 [details] [diff] [review]
fix angle preprocessor: was freezing on bad ifdef

maybe something like while (token && token != '\n'), assuming that scan returns null on no more tokens?  I guess it doesn't matter, it's a compilation error no matter what, so doesn't matter if later errors are busted/ignored.

Comment 9

[Vladimir Vukicevic [:vlad] [:vladv] (needinfo me, slow to respond)]

Comment on attachment 497024 [details] [diff] [review]
mozilla cosmetics

No need for review on these bits, just check them in with the right patch.

Comment 10

[Benoit Jacob [:bjacob] (mostly away)]

http://hg.mozilla.org/mozilla-central/rev/e3a920cbbce9