Last Comment Bug 688478 - [regression] mozilla addon builder broken due to platform regression
: [regression] mozilla addon builder broken due to platform regression
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
-- normal (vote)
: mozilla9
Assigned To: Brian Hackett (:bhackett)
: Jason Orendorff [:jorendorff]
: 688731 (view as bug list)
Depends on:
Blocks: infer-regress
  Show dependency treegraph
Reported: 2011-09-22 08:23 PDT by Louis-Rémi BABE
Modified: 2011-12-15 16:38 PST (History)
8 users (show)
See Also:
Crash Signature:
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---

patch (4.13 KB, patch)
2011-09-23 11:47 PDT, Brian Hackett (:bhackett)
dvander: review+
Details | Diff | Splinter Review

Description User image Louis-Rémi BABE 2011-09-22 08:23:41 PDT
the addon builder is broken in nightlies for a few days now, see for example.

With KWierso, we've identified the changeset to be

Here's a screenshot of the problem as it appears on Ubuntu Linux:
Comment 1 User image Boris Zbarsky [:bz] (still a bit busy) 2011-09-22 08:56:58 PDT
Does turning off type inference fix things?
Comment 2 User image Wes Kocher (:KWierso) 2011-09-22 10:05:18 PDT
(In reply to Boris Zbarsky (:bz) from comment #1)
> Does turning off type inference fix things?

Yes, setting javascript.options.typeinference to false and then restarting Firefox lets Builder correctly load the code editor.
Comment 3 User image Brian Hackett (:bhackett) 2011-09-23 11:47:54 PDT
Created attachment 562121 [details] [diff] [review]

Regression from bug 557358.

When setting up a CALLPROP IC which can invoke a getter, the state was synced in the wrong place --- before the shape check, but after the type check.  CALLPROP ICs can relink the type check to a stub when handling strings, and on a String.prototype shape mismatch that stub will patch to the slow path used by the shape check.  The latter assumes the state is synced, but that may not hold when the input is a string, and the stub reads a stale value off the stack (causing typeOf() in the mootools library to take the wrong path and fail to initialize a class correctly).  The fix does the syncing before both checks, as well as for a similar case in GETPROP (not sure if the same issue happens there).
Comment 4 User image Brian Hackett (:bhackett) 2011-09-23 11:51:15 PDT
*** Bug 688731 has been marked as a duplicate of this bug. ***
Comment 5 User image Brian Hackett (:bhackett) 2011-09-24 14:16:34 PDT
Comment 6 User image Ed Morley [:emorley] 2011-09-25 06:23:41 PDT
Comment 7 User image Wes Kocher (:KWierso) 2011-09-26 10:22:45 PDT
Verified fixed on today's Nightly build.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110926 Firefox/9.0a1
Comment 8 User image christian 2011-12-15 16:38:50 PST
Looks like by date this was fixed in time for Fx9. Please email if that is not the case.

Note You need to log in before you can comment on or make changes to this bug.