Bug 73932 – [mac] Using discard in a fragment shader results in a crash

• Component: WebGL
• Status: RESOLVED FIXED

[Sheheryar Zakaria]

Created attachment 118067 [details]
crash report

When the discard statement is present in a fragment shader for a WebGL sample, it always crashes in what seems to be the combination of Mac OS X 10.7 with the graphics card AMD Radeon HD 6750M.

This can be seen in the nightly build and the latest releases of both Safari and Google Chrome.

The crash report is attached.

[Kenneth Russell]

That's unfortunate to hear. If this is really the case then we need to file a bug with Apple right away -- I don't know how we would work around this in the ANGLE shader translator.

We did bug it to Apple months back but still occurs.

It also occurs on Firefox 10+ (but not 9) and also native OpenGL. It crashes in various underlying gl* calls e.g. even glClear if there is an active program.

I think is something about the shader compilation/validation that's broken with 10.7 and that Radeon driver. The same shaders run on everything else (other Macs and a broad range of Winodws and Linux machines). 

I narrowed it down more and it was the use of 'gl_FragCoord.w' and 'discard' in a fragment program that caused the issue - knocking out either and it was ok.

[Kenneth Russell]

Please attach a self-contained WebGL test case to this bug and I'll help you file it with Apple again, and try to get the priority raised. We'll also add it to the WebGL conformance suite so it never happens again.

[Radar WebKit Bug Importer]

<rdar://problem/11186689>

[Dean Jackson]

Yes, please attach an example. Also if possible provide details on your system, in particular GPU model and OS version. (or attach a system profile, but be aware that might include some personal info like the list of apps you have installed)

[Dean Jackson]

(In reply to comment #2)
> We did bug it to Apple months back but still occurs.

How did you report it? Email, via bugreporter.apple.com or here on bugs.webkit.org? I'd like to track it down if was the latter two.
 
> It also occurs on Firefox 10+ (but not 9) and also native OpenGL. It crashes in various underlying gl* calls e.g. even glClear if there is an active program.
> 
> I think is something about the shader compilation/validation that's broken with 10.7 and that Radeon driver. The same shaders run on everything else (other Macs and a broad range of Winodws and Linux machines). 
> 
> I narrowed it down more and it was the use of 'gl_FragCoord.w' and 'discard' in a fragment program that caused the issue - knocking out either and it was ok.

Thanks. I'd really like to get an example to see if it reproduces. It sounds like it would need a driver-level fix.

I originally filed the bug with apple on the bug reporter site.  I can't find the original bug now - it may have been with an old account.

I've created a new bug with ID 11189799 on bugreport.apple.com that references this ticket, since this has the most up to date information.  It would be great if you can can get some traction on this from Apple.

In the meantime we'll work on a reproducible.

System Information:-

  Chipset Model:	AMD Radeon HD 6750M
  Type:	GPU
  Bus:	PCIe
  PCIe Lane Width:	x16
  VRAM (Total):	512 MB
  Vendor:	ATI (0x1002)
  Device ID:	0x6741
  Revision ID:	0x0000
  ROM Revision:	113-C2950H-170
  EFI Driver Version:	01.00.544
  Displays:
iMac:
  Resolution:	1920 x 1080
  Pixel Depth:	32-Bit Color (ARGB8888)
  Main Display:	Yes
  Mirror:	Off
  Online:	Yes
  Built-In:	Yes
  Connection Type:	DisplayPort


  System Version:	Mac OS X 10.7.3 (11D50d)
  Kernel Version:	Darwin 11.3.0
  Boot Volume:	Macintosh HD
  Boot Mode:	Normal

Created attachment 135839 [details]
Use of WebGL crashes when this is run on the machine referenced in this bug.

Crash callstack:-

Process:         WebProcess [35711]
Path:            /System/Library/StagedFrameworks/Safari/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess
Identifier:      com.apple.WebProcess
Version:         7534.55 (7534.55.3)
Build Info:      WebKit2-7534055003000000~1
Code Type:       X86-64 (Native)
Parent Process:  Safari [32826]

Date/Time:       2012-04-05 17:26:59.035 +0100
OS Version:      Mac OS X 10.7.3 (11D50d)
Report Version:  9

Interval Since Last Report:          697838 sec
Crashes Since Last Report:           11
Per-App Interval Since Last Report:  7681 sec
Per-App Crashes Since Last Report:   2
Anonymous UUID:                      70D274C9-AB1C-4CBD-B851-863238E373BE

Crashed Thread:  0  Dispatch queue: com.apple.main-thread

Exception Type:  EXC_BAD_ACCESS (SIGSEGV)
Exception Codes: KERN_INVALID_ADDRESS at 0x000000000000001c

VM Regions Near 0x1c:
--> 
    __TEXT                 000000010e1fc000-000000010e1fd000 [    4K] r-x/rwx SM=COW  /System/Library/StagedFrameworks/Safari/WebKit2.framework/WebProcess.app/Contents/MacOS/WebProcess

Application Specific Information:
objc[35711]: garbage collection is OFF

Thread 0 Crashed:: Dispatch queue: com.apple.main-thread
0   com.apple.ATIRadeonX3000GLDriver	0x00000001521defd5 0x1520f7000 + 950229
1   com.apple.ATIRadeonX3000GLDriver	0x00000001521e26bb 0x1520f7000 + 964283
2   com.apple.ATIRadeonX3000GLDriver	0x0000000152195faa 0x1520f7000 + 651178
3   com.apple.ATIRadeonX3000GLDriver	0x000000015219621e 0x1520f7000 + 651806
4   com.apple.ATIRadeonX3000GLDriver	0x0000000152197e1d 0x1520f7000 + 658973
5   com.apple.ATIRadeonX3000GLDriver	0x000000015214bbe7 0x1520f7000 + 347111
6   com.apple.ATIRadeonX3000GLDriver	0x0000000152144650 0x1520f7000 + 317008
7   com.apple.ATIRadeonX3000GLDriver	0x000000015210661e 0x1520f7000 + 63006
8   com.apple.ATIRadeonX3000GLDriver	0x0000000152106f21 0x1520f7000 + 65313
9   com.apple.ATIRadeonX3000GLDriver	0x0000000152135e9c gldUpdateDispatch + 1498
10  GLEngine                      	0x0000000151ef6150 gleDoSelectiveDispatchCore + 413
11  GLEngine                      	0x0000000151e27257 glClear_Exec + 133
12  com.apple.WebCore             	0x000000010ebb18b1 WebCore::WebGLRenderingContext::clear(unsigned int) + 189
13  com.apple.WebCore             	0x000000010ebb17e9 WebCore::jsWebGLRenderingContextPrototypeFunctionClear(JSC::ExecState*) + 233
14  ???                           	0x000000010fe82218 0 + 4561838616
15  com.apple.JavaScriptCore      	0x000000010e55aeaa JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 826
16  com.apple.JavaScriptCore      	0x000000010e55ab5d JSC::call(JSC::ExecState*, JSC::JSValue, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 45
17  com.apple.WebCore             	0x000000010e9ea9cd WebCore::JSEventListener::handleEvent(WebCore::ScriptExecutionContext*, WebCore::Event*) + 879
18  com.apple.WebCore             	0x000000010e9ea5d4 WebCore::EventTarget::fireEventListeners(WebCore::Event*, WebCore::EventTargetData*, WTF::Vector<WebCore::RegisteredEventListener, 1ul>&) + 494
19  com.apple.WebCore             	0x000000010e90f083 WebCore::EventTarget::fireEventListeners(WebCore::Event*) + 85
20  com.apple.WebCore             	0x000000010e966465 WebCore::DOMWindow::dispatchEvent(WTF::PassRefPtr<WebCore::Event>, WTF::PassRefPtr<WebCore::EventTarget>) + 243
21  com.apple.WebCore             	0x000000010e9b1c05 WebCore::DOMWindow::dispatchTimedEvent(WTF::PassRefPtr<WebCore::Event>, WebCore::Document*, double*, double*) + 95
22  com.apple.WebCore             	0x000000010e9cdd25 WebCore::DOMWindow::dispatchLoadEvent() + 361
23  com.apple.WebCore             	0x000000010e95b432 WebCore::Document::implicitClose() + 332
24  com.apple.WebCore             	0x000000010e95b1ff WebCore::FrameLoader::checkCompleted() + 289
25  com.apple.WebCore             	0x000000010e95a456 WebCore::FrameLoader::finishedParsing() + 86
26  com.apple.WebCore             	0x000000010e95a31a WebCore::Document::finishedParsing() + 270
27  com.apple.WebCore             	0x000000010e912e51 WebCore::HTMLDocumentParser::prepareToStopParsing() + 167
28  com.apple.WebCore             	0x000000010e902395 WebCore::DocumentWriter::endIfNotLoadingMainResource() + 107
29  com.apple.WebCore             	0x000000010e9b6d62 WebCore::FrameLoader::finishedLoading() + 72
30  com.apple.WebCore             	0x000000010e9b6c83 WebCore::MainResourceLoader::didFinishLoading(double) + 133
31  com.apple.Foundation          	0x00007fff88ba2662 ___NSURLConnectionDidFinishLoading_block_invoke_1 + 122
32  com.apple.Foundation          	0x00007fff88ba25e2 _NSURLConnectionDidFinishLoading + 81
33  com.apple.CFNetwork           	0x00007fff83723c7e URLConnectionClient::_clientDidFinishLoading(URLConnectionClient::ClientConnectionEventQueue*) + 296
34  com.apple.CFNetwork           	0x00007fff837d3c7e URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long) + 862
35  com.apple.CFNetwork           	0x00007fff837d3e6a URLConnectionClient::ClientConnectionEventQueue::processAllEventsAndConsumePayload(XConnectionEventInfo<XClientEvent, XClientEventParams>*, long) + 1354
36  com.apple.CFNetwork           	0x00007fff836feb49 URLConnectionClient::processEvents() + 185
37  com.apple.CFNetwork           	0x00007fff836fe9ee MultiplexerSource::perform() + 212
38  com.apple.CoreFoundation      	0x00007fff8df046e1 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE0_PERFORM_FUNCTION__ + 17
39  com.apple.CoreFoundation      	0x00007fff8df03f4d __CFRunLoopDoSources0 + 253
40  com.apple.CoreFoundation      	0x00007fff8df2ad39 __CFRunLoopRun + 905
41  com.apple.CoreFoundation      	0x00007fff8df2a676 CFRunLoopRunSpecific + 230
42  com.apple.HIToolbox           	0x00007fff8a9f631f RunCurrentEventLoopInMode + 277
43  com.apple.HIToolbox           	0x00007fff8a9fd5c9 ReceiveNextEventCommon + 355
44  com.apple.HIToolbox           	0x00007fff8a9fd456 BlockUntilNextEventMatchingListInMode + 62
45  com.apple.AppKit              	0x00007fff891d8f5d _DPSNextEvent + 659
46  com.apple.AppKit              	0x00007fff891d8861 -[NSApplication nextEventMatchingMask:untilDate:inMode:dequeue:] + 135
47  com.apple.AppKit              	0x00007fff891d519d -[NSApplication run] + 470
48  com.apple.WebKit2             	0x000000010e2d66d3 WebKit::WebProcessMain(WebKit::CommandLine const&) + 553
49  com.apple.WebKit2             	0x000000010e2bccc8 WebKitMain + 272
50  com.apple.WebProcess          	0x000000010e1fce56 0x10e1fc000 + 3670
51  com.apple.WebProcess          	0x000000010e1fcd64 0x10e1fc000 + 3428

[Dean Jackson]

Thankyou!

[Kenneth Russell]

Created attachment 138476 [details]
Reduced test case

Thanks for the test case. Here is a reduced version which indicates that a combination of referencing gl_FragCoord.w, the use of exp2(), and the use of "discard" are all necessary in order to provoke the crash during useProgram(). I am adding this to the top of tree version of the WebGL conformance suite.

[Brent Fulgham]

I am not able to reproduce this on the current shipping version of Mac OS (10.9.1).  I'd like to close this bug, unless you can still reproduce this.

Please reopen with additional details if you see this on OS X 10.9.1 or newer.