Last Comment Bug 639811 - [ANGLE] Very simple shader crashes Minefield [@ TParseContext::constructorErrorCheck(int, TIntermNode*, TFunction&, TOperator, TType*) ]
: [ANGLE] Very simple shader crashes Minefield [@ TParseContext::constructorErr...
Status: RESOLVED FIXED
[sg:dos null-deref]
: crash, testcase
Product: Core
Classification: Components
Component: Canvas: WebGL (show other bugs)
: unspecified
: x86 All
: -- normal (vote)
: ---
Assigned To: Benoit Jacob [:bjacob] (mostly away)
:
Mentors:
http://dl.dropbox.com/u/7054348/shade...
: 639918 (view as bug list)
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2011-03-08 06:17 PST by Bobby Richter
Modified: 2011-06-13 10:01 PDT (History)
9 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
.x+


Attachments
minimal testcase (908 bytes, text/html)
2011-03-08 06:59 PST, Benoit Jacob [:bjacob] (mostly away)
no flags Details
check for null (1.04 KB, patch)
2011-03-08 07:25 PST, Benoit Jacob [:bjacob] (mostly away)
no flags Details | Diff | Review

Description Bobby Richter 2011-03-08 06:17:28 PST
User-Agent:       Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b13pre) Gecko/20110303 Firefox/4.0b13pre
Build Identifier: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0b13pre) Gecko/20110303 Firefox/4.0b13pre

Browser crashes when creating this shader:

Vertex Shader:
'void main(void) { mat3(); gl_Position = vec4(1.0); }';

Fragment Shader:
'void main(void) { gl_FragColor = vec4(1.0); }';

From testing, the focal point seems to be that 'mat3()' in the vertex shader. Also occurs with mat4(), vec3(), etc., as long as no args are supplied.

Also happens in Chrome 9.0.597.107.


Reproducible: Always

Steps to Reproduce:
1. Go to http://dl.dropbox.com/u/7054348/shader_crash_test.html
2. Watch browser crash.



https://crash-stats.mozilla.com/report/index/fe3eef61-aa2d-4cb8-9447-154662110308
Comment 1 Charles J. Cliffe 2011-03-08 06:24:07 PST
I can confirm here on OSX 10.6.6 as well:


Minefield 4.0b13pre (2011-03-03) - Crashed

WebKit 5.0.3 (6533.19.4, r80210) - Crashed

Chrome 9.0.597.107 - Works, no crash


GPU: 
 Chipset Model:	NVIDIA GeForce GT 330M
  Type:	GPU
  Bus:	PCIe
  PCIe Lane Width:	x16
  VRAM (Total):	512 MB
  Vendor:	NVIDIA (0x10de)
Comment 2 Benoit Jacob [:bjacob] (mostly away) 2011-03-08 06:28:55 PST
Forwarded to ANGLE:
http://code.google.com/p/angleproject/issues/detail?id=123
Comment 3 Benoit Jacob [:bjacob] (mostly away) 2011-03-08 06:51:52 PST
Trivial null-pointer deref, making patch, not yet fixed upstream.
Comment 4 Benoit Jacob [:bjacob] (mostly away) 2011-03-08 06:59:39 PST
Created attachment 517730 [details]
minimal testcase
Comment 5 Benoit Jacob [:bjacob] (mostly away) 2011-03-08 07:25:23 PST
Created attachment 517736 [details] [diff] [review]
check for null

This fixes the crash and does not cause a regression in the test suite.
Comment 6 Benoit Jacob [:bjacob] (mostly away) 2011-03-08 07:28:43 PST
tryserver:
http://tbpl.mozilla.org/?tree=MozillaTry&rev=c4ab93489884
Comment 7 Benoit Jacob [:bjacob] (mostly away) 2011-03-08 08:09:23 PST
Requesting .x+ blocker
Comment 8 juan becerra [:juanb] 2011-03-08 11:52:21 PST
*** Bug 639918 has been marked as a duplicate of this bug. ***
Comment 9 chris hofmann 2011-03-08 12:16:51 PST
when do we think this might have regressed, or is it a long standing bug?

I don't see any crashes until mar7 showing up on trunk builds from mar3
         TParseContext::constructorErrorCheck.int,.TIntermNode...TFunction.,.TOperator,.TType..
date     total    breakdown by build
         crashes  count build, count build, ...

20110301   
20110302   
20110303   
20110304   
20110305   
20110306   
20110307 6  	3 4.0b13pre2011030312, 
        		3 4.0b13pre2011030303,
Comment 10 Benoit Jacob [:bjacob] (mostly away) 2011-03-08 12:31:51 PST
(In reply to comment #9)
> when do we think this might have regressed, or is it a long standing bug?

This is a long-standing bug.

> 
> I don't see any crashes until mar7 showing up on trunk builds from mar3

Probably because you have to use a rather unusual construct in a shader in order to trigger the bug.
Comment 11 Benoit Jacob [:bjacob] (mostly away) 2011-03-09 10:32:41 PST
Comment on attachment 517736 [details] [diff] [review]
check for null

Patch has been checked in upstream. So this bug will be fixed the next time that we sync our ANGLE copy.
Comment 12 Benoit Jacob [:bjacob] (mostly away) 2011-05-25 12:09:42 PDT
We're now using ANGLE r653, so this should be fixed.

Note You need to log in before you can comment on or make changes to this bug.