The default bug view has changed. See this FAQ.

IonMonkey: Crash during WebGL tests on Mochitest-1

RESOLVED FIXED

Status

()

Core
JavaScript Engine
RESOLVED FIXED
5 years ago
5 years ago

People

(Reporter: dvander, Assigned: efaust)

Tracking

Firefox Tracking Flags

(Not tracked)

Details

(Whiteboard: [ion:p1], URL)

Attachments

(1 attachment)

(Reporter)

Description

5 years ago
PROCESS-CRASH | /tests/content/canvas/test/webgl/test_webgl_conformance_test_suite.html | application crashed (minidump found)

Stack makes it look like some bogus pointer is being treated as a GC object. It's not clear what is causing this yet.
(Reporter)

Updated

5 years ago
OS: Linux → All
Hardware: x86_64 → All
(Assignee)

Comment 1

5 years ago
Created attachment 652019 [details] [diff] [review]
Fix

The problem was that visitCallDOMNative was generating jitcode that passed the address of a value containing a JSObject into a function that expected a HandleObject.
Assignee: general → efaust
Status: NEW → ASSIGNED
Attachment #652019 - Flags: review?(dvander)
(Reporter)

Updated

5 years ago
Attachment #652019 - Flags: review?(dvander) → review+
(Assignee)

Comment 2

5 years ago
https://hg.mozilla.org/projects/ionmonkey/rev/e7751b77a660
Status: ASSIGNED → RESOLVED
Last Resolved: 5 years ago
Resolution: --- → FIXED
You need to log in before you can comment on or make changes to this bug.