679666 - TI+JM: rendering glitch with WebGL demo translated from C++ to JS

Status: RESOLVED FIXED

(Core :: JavaScript Engine, defect)

Description

[Jan de Mooij [:jandem]]

+++ This bug was initially created as a clone of Bug #678939 +++

http://www.mandreel.com/demos/BenchmarkDemo.zip

This is a WebGL demo translated from C++ to JS. With TI+JM, the FPS counter on the left is rendered incorrectly. It works after disabling either JM or TI.

OS X 10.7, revision 427522c34b31, 32-bit build. Not a regression from bug 678939, I can reproduce with an older build.

Comment 1

[Jan de Mooij [:jandem]]

Attachment: Screenshot (TI disabled)

Comment 2

[Jan de Mooij [:jandem]]

Attachment: Screenshot (TI enabled)

Comment 3

[Brian Hackett [Laid off!]]

Huh, WFM on the OS X 8/16 nightly.

Comment 4

[Jan de Mooij [:jandem]]

Can only reproduce on 32-bit (after enabling "open in 32-bit mode" on OS X). 64-bit is OK.

Comment 5

[Jan de Mooij [:jandem]]

(In reply to Brian Hackett from comment #3)
> Huh, WFM on the OS X 8/16 nightly.

See comment 4 - mid-air collision :( I also see this with a nightly build from last month (7/17). I will try a clean profile to make sure it's not related to some pref or extension..

Comment 6

[Brian Hackett [Laid off!]]

OK, I can see the glitch on 32-bit.

Comment 7

[Jan de Mooij [:jandem]]

I'm trying to bisect this now, current regression window is 06/30 - 07/17.

Comment 8

[Jan de Mooij [:jandem]]

Attachment: Patch

Regression from my TI+JM typed array patches. The problem is that convertForTypedArray (used by setelem_typed) called tempRegForData(value) twice, the second one inside a branch. This is only okay if the testInt32 between them does not quietly allocate a type register..

This allocates the type and data registers up front. I'm not entirely sure this is needed for the type register but better safe than sorry. This fixes dlmalloc (bug 679878) and should also fix this bug.

Comment 10

[Jan de Mooij [:jandem]]

http://hg.mozilla.org/projects/jaegermonkey/rev/79f5cea985f2

Downloaded a tinderbox build and this works fine now.