Last Comment Bug 657556 - crash in WebGL uniform setters when no program is bound (and the uniform object isn't bound to a program either)
: crash in WebGL uniform setters when no program is bound (and the uniform obje...
Status: RESOLVED FIXED
:
Product: Core
Classification: Components
Component: Canvas: WebGL (show other bugs)
: Trunk
: x86_64 All
: -- critical (vote)
: ---
Assigned To: Benoit Jacob [:bjacob] (mostly away)
:
: Milan Sreckovic [:milan]
Mentors:
Depends on:
Blocks: 658170
  Show dependency treegraph
 
Reported: 2011-05-17 00:27 PDT by Christoph Diehl [:posidron]
Modified: 2011-06-11 00:36 PDT (History)
1 user (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---


Attachments
testcase (7.82 KB, application/zip)
2011-05-17 00:27 PDT, Christoph Diehl [:posidron]
no flags Details
callstack.txt (20.89 KB, text/plain)
2011-05-17 00:28 PDT, Christoph Diehl [:posidron]
no flags Details
check for null program in OBTAIN_UNIFORM_LOCATION (1.76 KB, patch)
2011-05-18 07:22 PDT, Benoit Jacob [:bjacob] (mostly away)
cdiehl: review+
Details | Diff | Splinter Review

Description Christoph Diehl [:posidron] 2011-05-17 00:27:40 PDT
Created attachment 532884 [details]
testcase

Environment:

OpenGL renderer string: NVIDIA GeForce GT 330M OpenGL Engine
OpenGL version string: 2.1 NVIDIA-1.6.26

and 

OpenGL renderer string: ATI Radeon HD 6750M OpenGL Engine
OpenGL version string: 2.1 ATI-1.6.32
Comment 1 Christoph Diehl [:posidron] 2011-05-17 00:28:54 PDT
Created attachment 532886 [details]
callstack.txt
Comment 2 Benoit Jacob [:bjacob] (mostly away) 2011-05-18 06:41:47 PDT
Confirmed in linux.
Just before the crash, there's a NS_ASSERTION about dereferencing a null refptr. This is surely the real cause of the crash. Running with XPCOM_DEBUG_BREAK=abort to get it to crash, I get this stack:

#0  0x00007ffff2bd5165 in *__GI_raise (sig=<value optimized out>)
    at ../nptl/sysdeps/unix/sysv/linux/raise.c:64
#1  0x00007ffff2bd7f70 in *__GI_abort () at abort.c:92
#2  0x00007ffff3f0e331 in mozalloc_abort (
    msg=0x7fffffff90a0 "###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../../dist/include/nsAutoPtr.h, line 1117")
    at /home/bjacob/mozilla-central/memory/mozalloc/mozalloc_abort.cpp:75
#3  0x00007ffff61bc3bf in Abort (
    aMsg=0x7fffffff90a0 "###!!! ASSERTION: You can't dereference a NULL nsRefPtr with operator->().: 'mRawPtr != 0', file ../../../dist/include/nsAutoPtr.h, line 1117")
    at /home/bjacob/mozilla-central/xpcom/base/nsDebugImpl.cpp:388
#4  0x00007ffff61bc38d in NS_DebugBreak_P (aSeverity=1, 
    aStr=0x7ffff6b2fe78 "You can't dereference a NULL nsRefPtr with operator->().", 
    aExpr=0x7ffff6b2fe01 "mRawPtr != 0", 
    aFile=0x7ffff6b2fe50 "../../../dist/include/nsAutoPtr.h", aLine=1117)
    at /home/bjacob/mozilla-central/xpcom/base/nsDebugImpl.cpp:375
#5  0x00007ffff52022b7 in nsRefPtr<mozilla::WebGLProgram>::operator-> (this=0x18f1968)
    at ../../../dist/include/nsAutoPtr.h:1117
#6  0x00007ffff51e6b53 in mozilla::WebGLContext::Uniform3i (this=0x18f18a0, ploc=0x1c071a0, a1=0, 
    a2=-1, a3=0) at /home/bjacob/mozilla-central/content/canvas/src/WebGLContextGL.cpp:3621
#7  0x00007ffff5a9bc0a in nsIDOMWebGLRenderingContext_Uniform3i (cx=0x1395990, argc=4, 
    vp=0x7fffe29c8208) at /home/bjacob/build/firefox/js/src/xpconnect/src/dom_quickstubs.cpp:33114
#8  0x00007ffff666e4aa in js::CallJSNative (cx=0x1395990, 
    native=0x7ffff5a9ba1e <nsIDOMWebGLRenderingContext_Uniform3i>, argc=4, vp=0x7fffe29c8208)
    at /home/bjacob/mozilla-central/js/src/jscntxtinlines.h:277
#9  0x00007ffff68447c1 in CallCompiler::generateNativeStub (this=0x7fffffff9e40)
    at /home/bjacob/mozilla-central/js/src/methodjit/MonoIC.cpp:808
#10 0x00007ffff6840b28 in js::mjit::ic::NativeCall (f=..., ic=0x1c5b8a8)
Comment 3 Benoit Jacob [:bjacob] (mostly away) 2011-05-18 07:22:27 PDT
Created attachment 533274 [details] [diff] [review]
check for null program in OBTAIN_UNIFORM_LOCATION

The testcase consisted in calling uniform3i() with no bound program object, and on a uniform object that was not bound to a program object.

We had this code (in the OBTAIN_UNIFORM_LOCATION macro):

    if (mCurrentProgram != location_object->Program())
        return ErrorInvalidOperation(...

This was not enough to check for null mCurrentProgram as the present testcase had location_object->Program() == null. So the fix is add a check specifically for null mCurrentProgram.
Comment 4 Benoit Jacob [:bjacob] (mostly away) 2011-05-18 07:25:19 PDT
Note: apparently, the way that the testcase managed to produce a uniform not bound to a program was to delete the program first.
Comment 5 Christoph Diehl [:posidron] 2011-05-18 10:04:08 PDT
Comment on attachment 533274 [details] [diff] [review]
check for null program in OBTAIN_UNIFORM_LOCATION

Patch reviewed, applied and tested. Fixed.
Comment 6 Benoit Jacob [:bjacob] (mostly away) 2011-05-20 21:00:18 PDT
http://hg.mozilla.org/mozilla-central/rev/d22050685463
Comment 7 Benoit Jacob [:bjacob] (mostly away) 2011-05-26 11:40:25 PDT
Pushed to Beta:
http://hg.mozilla.org/releases/mozilla-beta/rev/eba2dce26189

The fix was already on Aurora, as the Central->Aurora merge happened since I landed on Central.
Comment 8 Benoit Jacob [:bjacob] (mostly away) 2011-05-26 11:40:55 PDT
Ooops --- wrong comment. Sorry, please ignore comment 7.

Note You need to log in before you can comment on or make changes to this bug.