The default bug view has changed. See this FAQ.

TI+JM: rendering glitch with WebGL demo translated from C++ to JS

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
6 years ago
6 years ago

People

(Reporter: jandem, Assigned: jandem)

Tracking

(Blocks: 1 bug, {regression})

Trunk
x86
Mac OS X
regression
Points:
---
Dependency tree / graph

Firefox Tracking Flags

(Not tracked)

Details

Attachments

(3 attachments)

(Assignee)

Description

6 years ago
+++ This bug was initially created as a clone of Bug #678939 +++

http://www.mandreel.com/demos/BenchmarkDemo.zip

This is a WebGL demo translated from C++ to JS. With TI+JM, the FPS counter on the left is rendered incorrectly. It works after disabling either JM or TI.

OS X 10.7, revision 427522c34b31, 32-bit build. Not a regression from bug 678939, I can reproduce with an older build.
(Assignee)

Comment 1

6 years ago
Created attachment 553733 [details]
Screenshot (TI disabled)
(Assignee)

Comment 2

6 years ago
Created attachment 553734 [details]
Screenshot (TI enabled)
Huh, WFM on the OS X 8/16 nightly.
(Assignee)

Comment 4

6 years ago
Can only reproduce on 32-bit (after enabling "open in 32-bit mode" on OS X). 64-bit is OK.
(Assignee)

Comment 5

6 years ago
(In reply to Brian Hackett from comment #3)
> Huh, WFM on the OS X 8/16 nightly.

See comment 4 - mid-air collision :( I also see this with a nightly build from last month (7/17). I will try a clean profile to make sure it's not related to some pref or extension..
OK, I can see the glitch on 32-bit.
(Assignee)

Comment 7

6 years ago
I'm trying to bisect this now, current regression window is 06/30 - 07/17.
(Assignee)

Comment 8

6 years ago
Created attachment 554067 [details] [diff] [review]
Patch

Regression from my TI+JM typed array patches. The problem is that convertForTypedArray (used by setelem_typed) called tempRegForData(value) twice, the second one inside a branch. This is only okay if the testInt32 between them does not quietly allocate a type register..

This allocates the type and data registers up front. I'm not entirely sure this is needed for the type register but better safe than sorry. This fixes dlmalloc (bug 679878) and should also fix this bug.
Assignee: general → jandemooij
Status: NEW → ASSIGNED
Attachment #554067 - Flags: review?(bhackett1024)
Attachment #554067 - Flags: review?(bhackett1024) → review+
(Assignee)

Updated

6 years ago
Duplicate of this bug: 679878
(Assignee)

Comment 10

6 years ago
http://hg.mozilla.org/projects/jaegermonkey/rev/79f5cea985f2

Downloaded a tinderbox build and this works fine now.
Status: ASSIGNED → RESOLVED
Last Resolved: 6 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.