PS: the about 2..3 weeks old Firefox Nightly on the same machine worked until I updated to the latest version, which then also crashes on the demos. May be a recent ANGLE update?

I'll also write an FF ticket...

Link to Firefox ticket: https://bugzilla.mozilla.org/show_bug.cgi?id=1313875

Raising to P1 -- this could be a serious regression. We don't test on very new hardware in house. I suspect it's probably ANGLE related so Jamie, Geoff, could you please triage this?

Floh, do you have any crash IDs in about:crashes?

Here are a few crash id's with new tests, one of those should be the WebGL crash:

Crash ID 2173c0d8-568c-40ee-b618-08b61d0aadbe
Crash ID cb74e207-3063-4f1b-85b3-483d187aa5c0
Crash ID ccfaad51-99c6-4b9b-8b8f-3ae7a7b651ba

It's a bit hard to associate since one or two crash reports are created by just starting Canary (even though Canary seems to appear just fine apart from the WebGL2 demos).

Another thing that could be related: I had bought an Oculus Rift recently, and its software is installed on this machine. But: Firefox Nightly was running the demos fine before I updated it. I didn't have a chance to check that on Canary, which seems to auto-update itself(?)

Since the crash happens even with the most simple demo (the Clear sample, which does nothing more than clearing the default framebuffer) I think the problem is in the common init code, the only GL operations apart from creating the WebGL context are:

- a global VAO object is created
- two 4 MByte uniform buffers are created (glGenBuffer() -> glBindBuffer() and a glBufferData(GL_UNIFORM_BUFFER, 4096*1024*1024, nullptr, GL_STREAM_DRAW)

...plus checking some extensions and implementation constants.

My guess would be the uniform buffer stuff...

...someone attached a helpful crashreport link to the FF ticket which points to a memcpy failure when called from ANGLE's d3d11 rx::Buffer11::setData(unsigned int, void const*, unsigned int, unsigned int) function:

https://crash-stats.mozilla.com/report/index/473f5b64-129c-4ea5-92de-f8fda2161029

Can reproduce trivially with Canary. Looking..

I have a fix, will need to make a test before landing.

For now, the workaround is to keep uniform buffers <= GL_MAX_UNIFORM_BLOCK_SIZE. Which is a sensible restriction to use with ANGLE in any case.

Note that if you're using a very large buffer to represent multiple uniform blocks, this is something we emulate on some windows configurations internally, so it wouldn't hurt to split it up in the worst case.

This is a different issue, similar problem.

Got it. Sorry to disturb all of you...

Jamie, yes, I'm thinking about rewriting my GLES3 uniform buffer code to use smaller buffers (on the other hand leaving the beaten path catches bugs like this ;)

The idea to use the big per-frame uniform buffer was to make it behave like in my Metal and D3D12 rendering backends, but I haven't seen the hoped-for speedups on any GL4/GLES3 platform so far. The lack of glMapBuffer in WebGL2, and the required uniform block alignment of (usually) 256 bytes leads to a lot of waste when copying the data over to GL, and since under the hood the data might be split up again anyway it probably adds additional overhead. But even with glMapBuffer available I'm not seeing speedups with the one big buffer vs the
old granular glUniform approach, at least for trivial shaders.

Cheers, and thanks for looking into this,
-Floh.

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/d89792f42b28c3d7ed822a4f3319ce2ebe73a11b

commit d89792f42b28c3d7ed822a4f3319ce2ebe73a11b
Author: Jamie Madill <jmadill@chromium.org>
Date: Mon Oct 31 02:41:53 2016

Buffer11: Keep system memory storage for large UBOs.

The system memory storage is needed to back UBOs larger than the max
constant buffer size in D3D11 Windows 7. Because readback from UBOs
can be tricky, the system memory storage keeps the canonical copy of
the data in this case.

We can also extend this to add a workaround to fix the outstanding
failure cases of UBOs on Intel.

BUG= chromium:660670 

Change-Id: Ia3119d3064d10c4262def4c5a967972b4de2d10f
Reviewed-on: https://chromium-review.googlesource.com/405367
Reviewed-by: Geoff Lang <geofflang@chromium.org>
Reviewed-by: Jamie Madill <jmadill@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>

[modify] https://crrev.com/d89792f42b28c3d7ed822a4f3319ce2ebe73a11b/src/libANGLE/renderer/d3d/d3d11/Buffer11.cpp
[modify] https://crrev.com/d89792f42b28c3d7ed822a4f3319ce2ebe73a11b/src/libANGLE/renderer/d3d/d3d11/Buffer11.h
[modify] https://crrev.com/d89792f42b28c3d7ed822a4f3319ce2ebe73a11b/src/tests/gl_tests/UniformBufferTest.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/5a8e6fdfe6fc127842878381cd15844d9ce3411d

commit 5a8e6fdfe6fc127842878381cd15844d9ce3411d
Author: jmadill <jmadill@chromium.org>
Date: Mon Oct 31 22:20:35 2016

Roll ANGLE 705a919..60e6edf

https://chromium.googlesource.com/angle/angle.git/+log/705a919..60e6edf

BUG= chromium:655534 , chromium:659472 , chromium:660670 

TBR=kbr@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2470533002
Cr-Commit-Position: refs/heads/master@{#428839}

[modify] https://crrev.com/5a8e6fdfe6fc127842878381cd15844d9ce3411d/DEPS

This should be fixed now, and the fix should be propagated to Canary.

Thanks Jamie for the quick fix!

P.S. Was a WebGL 2.0 conformance test added for this to prevent regressions?

Ken, WebGL test added: https://github.com/KhronosGroup/WebGL/pull/2174

The following revision refers to this bug:
  https://chromium.googlesource.com/angle/angle/+/e018e98ca2e15b8db7a0488511d1b05fb4b8925b

commit e018e98ca2e15b8db7a0488511d1b05fb4b8925b
Author: Jamie Madill <jmadill@chromium.org>
Date: Thu Nov 24 22:25:39 2016

Add test for large UBO readback.

BUG= chromium:660670 

Change-Id: I51c7e93f071041663f6b9a39ee75c0cca2264015
Reviewed-on: https://chromium-review.googlesource.com/414447
Reviewed-by: Corentin Wallez <cwallez@chromium.org>
Commit-Queue: Jamie Madill <jmadill@chromium.org>

[modify] https://crrev.com/e018e98ca2e15b8db7a0488511d1b05fb4b8925b/src/tests/gl_tests/UniformBufferTest.cpp

The following revision refers to this bug:
  https://chromium.googlesource.com/chromium/src.git/+/efbf5d225196eef3f8d90bd30e7a66b3c4c7b9ec

commit efbf5d225196eef3f8d90bd30e7a66b3c4c7b9ec
Author: jmadill <jmadill@chromium.org>
Date: Mon Nov 28 17:32:50 2016

Roll ANGLE 133a2ec..f1a2aef

https://chromium.googlesource.com/angle/angle.git/+log/133a2ec..f1a2aef

BUG= chromium:660670 , chromium:661857 

TBR=geofflang@chromium.org

TEST=bots

CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.win:win_optional_gpu_tests_rel;master.tryserver.chromium.mac:mac_optional_gpu_tests_rel;master.tryserver.chromium.linux:linux_optional_gpu_tests_rel;master.tryserver.chromium.android:android_optional_gpu_tests_rel

Review-Url: https://codereview.chromium.org/2536733002
Cr-Commit-Position: refs/heads/master@{#434677}

[modify] https://crrev.com/efbf5d225196eef3f8d90bd30e7a66b3c4c7b9ec/DEPS