the addon builder is broken in nightlies for a few days now, see https://builder.addons.mozilla.org/addon/1014660/latest/ for example.
With KWierso, we've identified the changeset to be http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ea2f892d9439&tochange=648d084ca28e
Here's a screenshot of the problem as it appears on Ubuntu Linux: http://i.imgur.com/FEJMn.png
Does turning off type inference fix things?
(In reply to Boris Zbarsky (:bz) from comment #1)
> Does turning off type inference fix things?
Created attachment 562121 [details] [diff] [review]
Regression from bug 557358.
When setting up a CALLPROP IC which can invoke a getter, the state was synced in the wrong place --- before the shape check, but after the type check. CALLPROP ICs can relink the type check to a stub when handling strings, and on a String.prototype shape mismatch that stub will patch to the slow path used by the shape check. The latter assumes the state is synced, but that may not hold when the input is a string, and the stub reads a stale value off the stack (causing typeOf() in the mootools library to take the wrong path and fail to initialize a class correctly). The fix does the syncing before both checks, as well as for a similar case in GETPROP (not sure if the same issue happens there).
*** Bug 688731 has been marked as a duplicate of this bug. ***
Verified fixed on today's Nightly build.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110926 Firefox/9.0a1
Looks like by date this was fixed in time for Fx9. Please email email@example.com if that is not the case.