698963 - ANGLE crash in TIntermConstantUnion::getUnionArrayPointer with this=null, called from yyparse

Status: RESOLVED FIXED

(Core :: Graphics: CanvasWebGL, defect)

Description

[Christian Holler (:decoder)]

Attachment: Test case for browser

This bug was filed from the Socorro interface and is 
report bp-7be0b0c7-4025-4d2a-9c1d-7e4682111101 .
============================================================= 

The attached WebGL testcase crashes Firefox Nightly (tested with mesa llvmpipe software rendering).

The test might require MOZ_GL_DEBUG=1.

Marking this s-s until triaged and rated.

Note: If this is a bug in llvmpipe/mesa rather than in our own code or third party libs, let me know so I can file to Mesa instead.

Comment 1

[Christoph Diehl [:posidron]]

Attachment: callstack

Looks like a null-pointer-dereference on MacOS

Comment 2

[Christoph Diehl [:posidron]]

Please file ANGLE bugs also at http://code.google.com/p/angleproject/ then they get fixed faster.

Comment 3

[Christoph Diehl [:posidron]]

Attachment: testcase (reduced)

The problem is:

uniform mat4 foo; 
foo[--vec4()[3]];

Comment 4

[Benoit Jacob [:bjacob] (mostly away)]

Indeed, this is a null deref, so not particular security sensitive by itself. I agree with comment 2, this is a ANGLE bug so should be filed there. The crash occurs in glslang_tab.cpp which is Bison-generated code, so it's not clear to me how to fix it.

Comment 5

[Benoit Jacob [:bjacob] (mostly away)]

Please first remove security status on this bug, that will make it much easier to forward and share its attachments.

Comment 6

[Christian Holler (:decoder)]

Removed s-s per comment 4. I'm not yet very familiar with triaging WebGL bugs so I didn't know if this was ANGLE or not.

Comment 7

[Benoit Jacob [:bjacob] (mostly away)]

It wasn't obvious from your initial report, as crash-stats didn't show a useful stack, but it was clear from comment 1's call stack.

Comment 8

[Benoit Jacob [:bjacob] (mostly away)]

Filed http://code.google.com/p/angleproject/issues/detail?id=238

Comment 9

[Kelsey Gilbert [:jgilbert]]

This should has been fixed in one of the ANGLE updates.
I'll try out the testcase.

Comment 10

[Kelsey Gilbert [:jgilbert]]

This must have been fixed by an ANGLE update.