Last Comment Bug 688478 - [regression] mozilla addon builder broken due to platform regression
: [regression] mozilla addon builder broken due to platform regression
Status: VERIFIED FIXED
:
Product: Core
Classification: Components
Component: JavaScript Engine (show other bugs)
: Trunk
: All All
: -- normal (vote)
: mozilla9
Assigned To: Brian Hackett (:bhackett)
:
Mentors:
: 688731 (view as bug list)
Depends on:
Blocks: infer-regress
  Show dependency treegraph
 
Reported: 2011-09-22 08:23 PDT by Louis-Rémi BABE
Modified: 2011-12-15 16:38 PST (History)
8 users (show)
See Also:
Crash Signature:
(edit)
QA Whiteboard:
Iteration: ---
Points: ---
Has Regression Range: ---
Has STR: ---
+


Attachments
patch (4.13 KB, patch)
2011-09-23 11:47 PDT, Brian Hackett (:bhackett)
dvander: review+
Details | Diff | Review

Description Louis-Rémi BABE 2011-09-22 08:23:41 PDT
the addon builder is broken in nightlies for a few days now, see https://builder.addons.mozilla.org/addon/1014660/latest/ for example.

With KWierso, we've identified the changeset to be http://hg.mozilla.org/mozilla-central/pushloghtml?fromchange=ea2f892d9439&tochange=648d084ca28e

Here's a screenshot of the problem as it appears on Ubuntu Linux: http://i.imgur.com/FEJMn.png
Comment 1 Boris Zbarsky [:bz] 2011-09-22 08:56:58 PDT
Does turning off type inference fix things?
Comment 2 Wes Kocher (:KWierso) 2011-09-22 10:05:18 PDT
(In reply to Boris Zbarsky (:bz) from comment #1)
> Does turning off type inference fix things?

Yes, setting javascript.options.typeinference to false and then restarting Firefox lets Builder correctly load the code editor.
Comment 3 Brian Hackett (:bhackett) 2011-09-23 11:47:54 PDT
Created attachment 562121 [details] [diff] [review]
patch

Regression from bug 557358.

When setting up a CALLPROP IC which can invoke a getter, the state was synced in the wrong place --- before the shape check, but after the type check.  CALLPROP ICs can relink the type check to a stub when handling strings, and on a String.prototype shape mismatch that stub will patch to the slow path used by the shape check.  The latter assumes the state is synced, but that may not hold when the input is a string, and the stub reads a stale value off the stack (causing typeOf() in the mootools library to take the wrong path and fail to initialize a class correctly).  The fix does the syncing before both checks, as well as for a similar case in GETPROP (not sure if the same issue happens there).
Comment 4 Brian Hackett (:bhackett) 2011-09-23 11:51:15 PDT
*** Bug 688731 has been marked as a duplicate of this bug. ***
Comment 5 Brian Hackett (:bhackett) 2011-09-24 14:16:34 PDT
https://hg.mozilla.org/integration/mozilla-inbound/rev/7fa8649917d1
Comment 6 Ed Morley [:emorley] 2011-09-25 06:23:41 PDT
https://hg.mozilla.org/mozilla-central/rev/7fa8649917d1
Comment 7 Wes Kocher (:KWierso) 2011-09-26 10:22:45 PDT
Verified fixed on today's Nightly build.
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:9.0a1) Gecko/20110926 Firefox/9.0a1
Comment 8 christian 2011-12-15 16:38:50 PST
Looks like by date this was fixed in time for Fx9. Please email release-drivers@mozilla.org if that is not the case.

Note You need to log in before you can comment on or make changes to this bug.