689810 - MESA Assertion failure / Hang with software rendering on Linux

Status: RESOLVED INCOMPLETE

(Core :: Graphics: CanvasWebGL, defect)

Description

[Christian Holler (:decoder)]

Attachment: Test case for browser

The attached HTML testcase crashes my nightly Firefox debug build with software rendering (MESA) instantly with an assertion "tnl/t_draw.c:288: bind_inputs: Assertion `inputs[i]->BufferObj->Pointer' failed". In optimized build, this does not crash always, but rather freezes. The last few lines with MOZ_GL_DEBUG_VERBOSE are:

JavaScript warning: file:///home/decoder/LangFuzz/firefox/testMesaAssert/testcase.html, line 149: WebGL: drawArrays: bound vertex attribute buffers do not have sufficient size for given first and count
[gl:0x3a93870] > void mozilla::gl::GLContext::fUseProgram(GLuint)
[gl:0x3a93870] < void mozilla::gl::GLContext::fUseProgram(GLuint) [0x0000]
[gl:0x3a93870] > void mozilla::gl::GLContext::fUniformMatrix4fv(GLint, GLsizei, realGLboolean, const GLfloat*)
[gl:0x3a93870] < void mozilla::gl::GLContext::fUniformMatrix4fv(GLint, GLsizei, realGLboolean, const GLfloat*) [0x0000]
[gl:0x3a93870] > void mozilla::gl::GLContext::fGetIntegerv(GLenum, GLint*)
[gl:0x3a93870] < void mozilla::gl::GLContext::fGetIntegerv(GLenum, GLint*) [0x0000]
[gl:0x3a93870] > void mozilla::gl::GLContext::fDrawArrays(GLenum, GLint, GLsizei)
firefox: tnl/t_draw.c:288: bind_inputs: Assertion `inputs[i]->BufferObj->Pointer' failed.


I assume this is a problem within the MESA library itself, is that correct?

Comment 1

[Benoit Jacob [:bjacob] (mostly away)]

This is very possibly a Mesa bug, at least I can't reproduce any crash here on NVIDIA, but the testcase is tricky enough that I can't rule out the possibility of a bug on our side. It would help greatly if you could minimize your testcase. Here I get the following JS warnings (in the JS/web console, with webgl.verbose=true) :


Warning: WebGL: bufferData: usage: invalid enum value 0x0
Source File: file:///home/bjacob/Downloads/testMesaAssert/testcase.html
Line: 93

Warning: WebGL: drawArrays: bound vertex attribute buffers do not have sufficient size for given first and count
Source File: file:///home/bjacob/Downloads/testMesaAssert/testcase.html
Line: 149

Warning: WebGL: drawArrays: bound vertex attribute buffers do not have sufficient size for given first and count
Source File: file:///home/bjacob/Downloads/testMesaAssert/testcase.html
Line: 149

The first warning is about this line of code:

  gl.bufferData(
      gl.ARRAY_BUFFER,
      new Float32Array([ 0,0, 1,0, 0,1,
                         0,1, 1,0, 1,1]),
      Number.STATIC_DRAW);

Here Number.STATIC_DRAW is 0, which is not a valid value for the 'usage' parameter, so this bufferData call is rejected, and this probably relates to the Mesa assertion you're getting.

This means that as a first step to minimize your testcase, you could remove probably remove this bufferData call.

Now I'm not crashing on NVIDIA because drawArrays correctly figures that the bound buffer is not big enough (see other JS warnings above) but if for some reason we have a bug making our check go wrong on your system, that would explain this crash (and wouldn't be a Mesa bug).

Comment 2

[Christian Holler (:decoder)]

Attachment: Test case for browser

Here's an automatically minimized and inlined version of the original testcase. Let me know if this is sufficiently small or if I shall try to compress it further :)

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

If you comment out this line:

    gl.enableVertexAttribArray(1);

does the crash still occur?

Note that your testcase relies on undefined behavior: createProgram doesn't actually use its "attribs" parameter. It should probably use it to bind these attribs to specific locations 0 and 1, using webgl.bindAttribLocation.

My guess is that Mesa has a bug that we've also observed on Mac, whereby it crashes when some vertex attrib array is enabled and is too small for the draw-operation, but is not used by the current program (here the current program does not use texCoord0). This is legal as long as it's not used, but we've seen at least the Mac OpenGL libraries crash on that so we have a work-around. We could use that work-around on Mesa, but it does slow things down so we'd rather not to unless it's confirm to affect more than one system.

The Mac bug is bug 631420. The testcase we have for it is
https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/conformance/gl-vertex-attrib-zero-issues.html

Can you check if this crashes Mesa?

Comment 4

[Christian Holler (:decoder)]

(In reply to Benoit Jacob [:bjacob] from comment #3)
> If you comment out this line:
> 
>     gl.enableVertexAttribArray(1);
> 
> does the crash still occur?

The test is one-minimal with respect to lines, so removing a single line will make the crash disappear, including this line.


> Note that your testcase relies on undefined behavior: createProgram doesn't
> actually use its "attribs" parameter. It should probably use it to bind
> these attribs to specific locations 0 and 1, using webgl.bindAttribLocation.

Ok. The test is a random permutation, the semantics often don't make sense at all.

> The Mac bug is bug 631420. The testcase we have for it is
> https://cvs.khronos.org/svn/repos/registry/trunk/public/webgl/sdk/tests/
> conformance/gl-vertex-attrib-zero-issues.html
> 
> Can you check if this crashes Mesa?

I loaded this test and it hangs. This might be the same bug, but maybe it doesn't manifest as a crash without the changes the fuzzer made. My fuzzer actually used the khronos test suite as a basis for mutations, so this specific test might have gone into the testcase.

Comment 5

[Christian Holler (:decoder)]

Hm. I just reran the gl-vertex-attrib-zero-issues test again and it passes on MESA now. Maybe the behavior is not deterministic.

Comment 6

[Benoit Jacob [:bjacob] (mostly away)]

OK. So it seems that Mesa does have a problem similar to bug 631420 but it's not 100% reproducible, and in the worst case it hangs or asserts but isn't a security vulnerability beyond just DOS (content can crash the browser).

For this reason I think that we can take our time to investigate this with Mesa developers, we don't need to respond immediately to this (by enabling the work-around, that makes the bug harder to debug).

Can you file a bug at freedesktop.org / Mesa ?

Again, your testcase would benefit from relying only on well-defined behavior by adding bindAttribLocation calls. Let me know if you need help with that.

Comment 7

[Benoit Jacob [:bjacob] (mostly away)]

Oh -- i'm stupid, the Mac issue was specific to vertex attrib 0 and your testcase tickles vertex attrib 1. So the work-around we have in place for Mac is not readily usable here, and it's not surprising that the Mac testcase doesn't crash Mesa.

If we have to emulate all enabled-but-not-used attributes it's going to be a nightmare. I hope we can get this fixed in Mesa and live with the bug in the meanwhile.

Comment 8

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: improved test case

This is cleaned up a bit, and should have well-defined behavior (uses bindAttribLocation)

Comment 9

[Benoit Jacob [:bjacob] (mostly away)]

Attachment: improved test case

cleaner yet.