Since the last TM merge to trunk, I'm seeing consistent failures in the Dromaeo v8 RayTracer test. I'm seeing one of the two errors below: FAIL RayTrace 1Error: Scene rendered incorrectly FAIL RayTrace 1Vectors must be defined [Vector [5,10,-1],null] I confirmed with dmandelin that it's reproducible with a TM build from yesterday as well.
Appears to have regressed between the 8-17 and 8-18 nightlies. http://hg.mozilla.org/tracemonkey/pushloghtml?fromchange=12a9bea2d331&tochange=08381937d64f Note that it sometimes doesn't reproduce the first time through, but usually a Ctrl+Refresh does the trick.
*TM nightlies, that is
Looks like the bug first arrived with this changeset: changeset: 31579:78d111c4ab84 user: David Mandelin <firstname.lastname@example.org> date: Mon Aug 17 15:29:09 2009 -0700 summary: Bug 509599: on trace, call putArguments when returning from JS function via either return or stop, r=jorendorff
(In reply to comment #3) > Looks like the bug first arrived with this changeset: > > changeset: 31579:78d111c4ab84 > user: David Mandelin <email@example.com> > date: Mon Aug 17 15:29:09 2009 -0700 > summary: Bug 509599: on trace, call putArguments when returning from JS > function via either return or stop, r=jorendorff That's wrong. Repro is intermittent so it's easy to screw up. Still bisecting...
I think this is the real regression changeset: changeset: 31575:aa6bb02120e3 user: Andreas Gal <firstname.lastname@example.org> date: Mon Aug 17 14:50:57 2009 -0700 summary: Don't flush the code cache every time we GC (506117, r=brendan). I repro'd the issue in that changeset. I ran v8-raytrace about 25 times on the previous changeset and did not repro it in that time. Note that the error seems to occur ~10% of the time.
I guess I inherited the bug. Will talk to david to see how to reproduce it.
We should probably valgrind this. Maybe add support for NewGCThing to valgrind so it knows about GC heap allocations? CCing the usual suspects.
It's interesting that this always fails for me at http://dromaeo.com/?trace but works in http://v8.googlecode.com/svn/data/benchmarks/v5/run.html And according to Dromaeo its RayTracer test (fails) is based on the V8 RayTrace (works)
This has been WFM for awhile now.