646825 - [ANGLE] crash [@ gl::VertexDataConverter<float, gl::WidenRule<int, 2>, gl::ConversionRule<int, 0, int>, gl::DefaultVertexValues<float, int> >::convertArray(float const*, unsigned int, unsigned int, float*)]with Google Labs' Body Map

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Robert Kaiser]

This bug was filed from the Socorro interface and is 
report bp-8a45c98b-589b-481f-99c1-f042b2110330 .
============================================================= 

Since 2011-03-29, but really on 2011-03-03, we see a rise in crashes with that signature, the comments in https://crash-stats.mozilla.com/report/list?signature=gl%3A%3AVertexDataConverter%3Cfloat%2C%20gl%3A%3AWidenRule%3Cint%2C%202%3E%2C%20gl%3A%3AConversionRule%3Cint%2C%200%2C%20int%3E%2C%20gl%3A%3ADefaultVertexValues%3Cfloat%2C%20int%3E%20%3E%3A%3AconvertArray%28float%20const%2A%2C%20unsigned%20int%2C%20unsigned%20int%2C%20float%2A%29 seem to almost all point to Google Labs' Body Map and http://bodybrowser.googlelabs.com/body.html# and as I heard this launched in the last days, the rise seems to correspond.

There was a small amount of crashes with this signature around before, 2-20 crashes per day when we still processed all crash reports. On 2011-03-30, we have 61 crashes with only 10% of all crashes being processed by the Socorro system (so in reality we probably have ~600), making this #186 on this day's topcrash list for 4.0* versions.

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

This is a ANGLE bug. This code didn't change recently in ANGLE so I'll assume that it's still present in upstream.

Comment 2

[Benoit Jacob [:bjacob] (mostly away)]

Filed ANGLE bug 139:
http://code.google.com/p/angleproject/issues/detail?id=139

Comment 3

[Daniel Veditz [:dveditz]]

Chris Evans says this looks like a Windows-specific buffer overflow in the ANGLE code. If there's an ANGLE fix for this in time would be great to pick it up in time for Firefox 6 (although it's late in the game).

Comment 4

[Daniel Veditz [:dveditz]]

A reduced testcase would be great for debugging and verification. The bodybrowser site code could change over time (and in fact is likely to if this is a common crash).

Comment 5

[Daniel Veditz [:dveditz]]

This crash is fixed in ANGLE r702 according to the two angleproject bugs.

Comment 6

[Daniel Veditz [:dveditz]]

That patch looks appropriate to take during the Fx6 beta period
https://code.google.com/p/angleproject/source/detail?r=702

Comment 7

[Benoit Jacob [:bjacob] (mostly away)]

OK, will do tomorrow. Worried I might forget. Ping me if I do.

Comment 8

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: angle r702

Tryserver:
http://hg.mozilla.org/try/rev/3cd4da06cf08

Comment 9

[Benoit Jacob [:bjacob] (mostly away)]

Landed on central:
http://hg.mozilla.org/mozilla-central/rev/85b0cc81a189

Comment 10

[LegNeato]

Comment on attachment 548223 [details] [diff] [review]
angle r702

Approved for beta and aurora. Please land asap

Comment 11

[Benoit Jacob [:bjacob] (mostly away)]

Landed on Aurora and Beta:
http://hg.mozilla.org/releases/mozilla-aurora/rev/46cd7e3ccedd
http://hg.mozilla.org/releases/mozilla-beta/rev/4621648305dc

Comment 12

[Johnny Stenback (:jst)]

Marking fixed for branches!

Comment 13

[u279076]

As per the testcase-wanted keyword, is there something QA can do to verify this bug fix?