688478 - [regression] mozilla addon builder broken due to platform regression

Status: VERIFIED FIXED

(Core :: JavaScript Engine, defect)

Description

[Louis-Rémi BABE]

the addon builder is broken in nightlies for a few days now, see https://builder.addons.mozilla.org/addon/1014660/latest/ for example.

With KWierso, we've identified the changeset to be http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ea2f892d9439&tochange=648d084ca28e

Here's a screenshot of the problem as it appears on Ubuntu Linux: http://i.imgur.com/FEJMn.png

Comment 1

[Boris Zbarsky [:bzbarsky]]

Does turning off type inference fix things?

Comment 2

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

(In reply to Boris Zbarsky (:bz) from comment #1)
> Does turning off type inference fix things?

Yes, setting javascript.options.typeinference to false and then restarting Firefox lets Builder correctly load the code editor.

Comment 3

[Brian Hackett [Laid off!]]

Attachment: patch

Regression from bug 557358.

When setting up a CALLPROP IC which can invoke a getter, the state was synced in the wrong place --- before the shape check, but after the type check.  CALLPROP ICs can relink the type check to a stub when handling strings, and on a String.prototype shape mismatch that stub will patch to the slow path used by the shape check.  The latter assumes the state is synced, but that may not hold when the input is a string, and the stub reads a stale value off the stack (causing typeOf() in the mootools library to take the wrong path and fail to initialize a class correctly).  The fix does the syncing before both checks, as well as for a similar case in GETPROP (not sure if the same issue happens there).

Comment 5

[Brian Hackett [Laid off!]]

https://hg.mozilla.org/integration/mozilla-inbound/rev/7fa8649917d1

Comment 6

[Ed Morley [:emorley]]

https://hg.mozilla.org/mozilla-central/rev/7fa8649917d1

Comment 7

[Wes Kocher (:KWierso) (Not reading bugmail; email directly if needed)]

Verified fixed on today's Nightly build.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110926 Firefox/9.0a1

Comment 8

[LegNeato]

Looks like by date this was fixed in time for Fx9. Please email [e-mail] if that is not the case.