[Webkit-unassigned] [Bug 52831] New: Crash in glDrawArrays with NaCl crystal model

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=52831

           Summary: Crash in glDrawArrays with NaCl crystal model
           Product: WebKit
           Version: 528+ (Nightly build)
          Platform: All
               URL: http://www.ibiblio.org/e-notes/webgl/models/NaClb5.htm
                    l
        OS/Version: All
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebGL
        AssignedTo: webkit-unassigned at lists.webkit.org
        ReportedBy: kbr at google.com
                CC: cmarrin at apple.com, zmo at google.com


The NaCl crystal model in the link above is causing WebKit's WebGL implementation to crash in glDrawArrays, at least on an NVIDIA GeForce 8600M GT. In Safari the stack trace is as follows:

Thread 0 Crashed:  Dispatch queue: com.apple.main-thread
0   com.apple.GeForceGLDriver         0x00000002000c24b9 glrCompExecuteKernel + 643065
1   GLEngine                          0x000000011902ca70 glDrawArrays_ACC_Exec + 882
2   com.apple.WebCore                 0x00000001018685a1 WebCore::WebGLRenderingContext::drawArrays(unsigned int, int, int, int&) + 289
3   com.apple.WebCore                 0x00000001014bb969 WebCore::jsWebGLRenderingContextPrototypeFunctionDrawArrays(JSC::ExecState*) + 569
4   ???                               0x00004afef92001b8 0 + 82458961772984
5   com.apple.JavaScriptCore          0x00000001007d891c JSC::Interpreter::executeCall(JSC::ExecState*, JSC::JSObject*, JSC::CallType, JSC::CallData const&, JSC::JSValue, JSC::ArgList const&) + 780
6   ???                               0x000000000000000a 0 + 10
7   ???                               0x00000001188cf320 0 + 4706857760
8   com.apple.JavaScriptCore          0x000000010083a440 JSC::JSFunction::~JSFunction() + 0
9   ???                               0x9090909090909090 0 + 10416984888683040912

I assume the application is doing something illegal and the WebGL layer isn't catching it before handing the call down to OpenGL.

In Chromium it looks like the GPU process crashes and restarts.

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.