639322 - WebGL SL crash / Assertion failure: lock != NULL

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Christoph Diehl [:posidron]]

Attachment: testcase

I was trying to report this to the ANGLE project but they have no option to mark a bug as a security issue.

It looks like a out-of-bounds read error. Trying to increase the array index leads to different kind of results. 

We also get the message:

(0) : fatal error C9999: marking a sampler that is not a scalar
Cg compiler terminated due to fatal error

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack 1

Comment 2

[Christoph Diehl [:posidron]]

Attachment: callstack 2

Comment 3

[Daniel Veditz [:dveditz]]

These appear to be crashing in the OpenGL driver? Can you paste your graphics info from about:support in here? Maybe we need to block that driver?

Comment 4

[Joe Drew (not getting mail)]

This must be a crash _inside_ ANGLE; we shouldn't be using the OpenGL driver at all.

Benoit, can you look into this?

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

Regarding the lock!=null assertion, could this be the same as ANGLE bug 120, for which I already wrote a patch? Also see bug 627965.

Regarding the "C9999" bug, I filed this as Bug 636926, it looks like a Mac OpenGL bug, I don't know what to do about it (I will file a bunch of Apple bugs tomorrow).

Comment 6

[Daniel Veditz [:dveditz]]

So kind of the dupes of the other bugs, which are not marked as security problems?

Comment 7

[chris hofmann]

maybe this should get retested with mozilla-central, as an angle update has landed there.

Bug 663162 - Update ANGLE to r686 

mark as dependence if it seems to be fixed on central now.

Comment 8

[Christoph Diehl [:posidron]]

mozilla-central: fixed

Comment 9

[Benoit Jacob [:bjacob] (mostly away)]

Closing this bug based on comment 8.