860847 - for loops in shaders can access negative indices of uniform arrays

Status: RESOLVED DUPLICATE of bug 837213

(Core :: Graphics: CanvasWebGL, defect)

Description

[miaubiz]

Attachment: repro case

on osx, a shader such as:

   uniform vec4 x[1];
  for (int ii = -1000; ii < -999; ++ii) {
          c += x[ii];
        }
gl_FragColor = vec4(c.r, c.g, c.b, c.a);

will display random colors.

attached is a file that will on my MacBookPro 8.2 with ATI Radeon HD 6770M OpenGL Engine (2.1 ATI-1.6.37) display random colors, and then read out the values of those colors and print them to console.log

Comment 1

[Daniel Veditz [:dveditz]]

Should ANGLE be filtering out code with negative array indices?

If you can read x[-999] can you also read x[999] from a 1-byte array?

Why go through the loop only once? Can you read arbitrary bytes this way?

Comment 2

[Daniel Veditz [:dveditz]]

I don't actually see the bug, I get what look like expected errors:

[10:35:45.545] Error: WebGL: linkProgram failed, with this log:
(22,13): error X3504: literal loop terminated early due to out of bounds array access
(19,6): warning X3557: loop only executes for 0 iteration(s), forcing loop to unroll

Warning: D3D shader compilation failed with default flags. Retrying with avoid flow control.
(22,13): error X3504: literal loop terminated early due to out of bounds array access
(19,6): warning X3557: loop only executes for 0 iteration(s), forcing loop to unroll

Warning: D3D shader compilation failed with avoid flow control flags. Retrying with prefer flow control.
(22,13): error X3504: literal loop terminated early due to out of bounds array access
(19,6): warning X3557: loop only executes for 0 iteration(s), forcing loop to unroll

Warning: D3D shader compilation failed with prefer flow control flags.
 @ https://bug860847.bugzilla.mozilla.org/attachment.cgi?id=736405&t=lrxSkcA8uq:139

Comment 3

[Benoit Jacob [:bjacob] (mostly away)]

Daniel: I suspect that the errors you're getting come from Windows' D3DCompiler.dll while the bug reported here is on Mac.

Once bug 837213 lands, we will be checking for this kind of issues in the ANGLE shader compiler which we use everywhere to validate shaders before we pass them on to the system's shader compiler.

Let's just fix 837213, which Jeff Gilbert is already working on.

Please CC Jeff, not me, for WebGL security bugs from now on.

Comment 4

[David Bolter [:davidb] (NeedInfo me for attention)]

Jeff should we close this as a dupe of bug 837213?

Comment 5

[Kelsey Gilbert [:jgilbert]]

(In reply to David Bolter [:davidb] from comment #4)
> Jeff should we close this as a dupe of bug 837213?

Not until we can be sure it's fixed with the update. Let's leave this as blocked by the ANGLE update.

Comment 6

[Milan Sreckovic [:milan] (needinfo for best results)]

This works for me on the trunk, with the latest angle and the array bounds clamped - can somebody verify?

Comment 7

[miaubiz]

it works for me now.