[Webkit-unassigned] [Bug 234926] New: Dynamic indexing into a fixed-size uniform array with GLSL makes the Safari tab hang

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=234926

            Bug ID: 234926
           Summary: Dynamic indexing into a fixed-size uniform array with
                    GLSL makes the Safari tab hang
           Product: WebKit
           Version: Safari 15
          Hardware: Mac (Apple Silicon)
                OS: macOS 12
            Status: NEW
          Severity: Normal
          Priority: P2
         Component: WebGL
          Assignee: webkit-unassigned at lists.webkit.org
          Reporter: robert.swain at gmail.com
                CC: dino at apple.com, kbr at google.com, kkinnunen at apple.com

I am running on a 2021 16" M1 Max MacBook Pro, with Safari 15.2 (same behaviour with technology preview 137) with the default browser configuration (i.e. none of the experimental features were changed.) This same issue does _not_ occur on an Intel x86_64 MacBook Pro with the exact same code.

The GLSL code I want to execute is:
```
struct ClusterOffsetsAndCounts {
    uvec4 data[1024];
};

uniform ClusterOffsetsAndCounts_block_3Fragment { ClusterOffsetsAndCounts _group_0_binding_8_fs; };

ClusterOffsetAndCount unpack_offset_and_count(uint cluster_index) {
    ClusterOffsetAndCount output_;
    uint offset_and_count = _group_0_binding_8_fs.data[(cluster_index >> 2u)][(cluster_index & ((1u << 2u) - 1u))];
    output_.offset = ((offset_and_count >> 8u) & ((1u << 24u) - 1u));
    output_.offset = 0u;
    output_.count = (offset_and_count & ((1u << 8u) - 1u));
    output_.count = 0u;
    ClusterOffsetAndCount _e68 = output_;
    return _e68;
}
```

The code may look a bit strangely-written because it is parsed from WGSL by the Rust naga library, which then converts it to the above GLSL when the target platform is WebGL2.

Through repeated testing, I have managed to isolate that the problematic line of code is:

```
uint offset_and_count = _group_0_binding_8_fs.data[(cluster_index >> 2u)][(cluster_index & ((1u << 2u) - 1u))];
```

If I use constants to index into the array and uvec4 components, it works fine. i.e. this works fine:
```
uint offset_and_count = _group_0_binding_8_fs.data[0u][0u];
```

If I use a variable containing a constant value for the first index into the array, it also works fine. i.e. this works fine:
```
uint item_index = 0u;
uint offset_and_count = _group_0_binding_8_fs.data[item_index][0u];
```

However, if I use a variable containing an index that is dynamically calculated, the page just kind of hangs, nothing is ever displayed in the canvas, and if I go into the developer tools to inspect the GLSL program source it just never loads. It seems like the WebGL2 stuff just gets stuck. i.e. this does not work:
```
uint item_index = cluster_index / 4u; // I first suspected bitwise operators were the problem so I tried switching to division and modulo instead
uint offset_and_count = _group_0_binding_8_fs.data[item_index][0u];
```

In my mind, that this only happens on an M1 running macOS, and not on Intel, suggests that the Intel iGPU/AMD Radeon drivers have no problem with dynamic indexing into fixed-size uniform arrays, and that the M1 GPU drivers do. I don't know if dynamic indexing into fixed-size uniform arrays _should_ be supported here, but it works in Firefox 95.0.2 and Chrome 97.0.4692.71 and I thought all three browsers were using ANGLE to support WebGL2 but leverage Metal for rendering on macOS. I'd be interested to understand where the problem lies. :)

I thought it could be possibly related to this issue: https://bugs.webkit.org/show_bug.cgi?id=214393

-- 
You are receiving this mail because:
You are the assignee for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.webkit.org/pipermail/webkit-unassigned/attachments/20220106/07d2cf76/attachment.htm>