User Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0 Steps to reproduce: This link is a clickable map to create a route for traveling by snowmobile. http://fcmq.viaexplora.com/carte-motoneige/index.html#map Actual results: No longer working with Firefox or partially working only after a long time waiting...and even after waiting and waiting it still is not working properly. Expected results: Was working last year with Firefox. You click on a town a green dot appears..select another area and a red dot appears or a dot with a number inside. You move the red dot along a path and it will highlight the selected path. Only fix right now is to use Chrome !! Works fine with Chrome......

I can reproduce the issue on Nightly65.0a1 windows10. 1. zoom in several times 2. double click on a road --- a popup should be drawn 3. click [DEBUT] button in the popup --- green marker should be drawn 2. double click on another point of road --- a popup should be drawn 3. click [FIN] button in the popup --- red marker should be drawn 4. drag green marker or red marker --- these marker should move arong with road Expected Results: as above(marked ---) Avtual Results: not work well Regression window: https://hg.mozilla.org/integration/mozilla-inbound/pushloghtml?fromchange=0586b21d0709d7a6911d87324dd8f88e4aaddf36&tochange=a90bcec86dac22977b81950344ee9c11ffea7383 Regressed by: Bug 1438086 Setting javascript.options.baselinejit=false seems to fix, but it is very slow of course. :tcampbell, your bunch of patch seems to cause the regression. Can you please look into this?

Not a new regression so we won't block 64 on it. Google Maps itself still works as expected so this does not seem like a widespread problem. We can take a patch in 65.

These cases are rare and uncacheable prototype shapes are tricky to get right so simplify code instead. The impact is that accessing non-own properties of an object that mutates its prototype will have a few more shape / group guards than are strictly needed.

Pushed by tcampbell@mozilla.com: https://hg.mozilla.org/integration/autoland/rev/40e167054726 Avoid shape teleporting if any uncacheable prototypes. r=jandem

NI to make sure we don't forget approval requests.

Comment on attachment 9027283 [details] Bug 1507433 - Avoid shape teleporting if any uncacheable prototypes. [Beta/Release Uplift Approval Request] Feature/Bug causing the regression: Bug 1438086 User impact if declined: Some websites break in hard to quantify ways. In the reported page, the issue seems to stem from the use of material-components-web (10k stars on github), but it is hard to know if pages uses these components in ways that will trigger the issue. The reported issue here was that buttons had to be click multiple times and the page+browser combination appears to be flaky. Is this code covered by automated tests?: Yes Has the fix been verified in Nightly?: Yes Needs manual test from QE?: No If yes, steps to reproduce: List of other uplifts needed: None Risk to taking this patch: Low Why is the change risky/not risky? (and alternatives if risky): This change prevents an optimization from triggering in a few more edge cases. Both the slow and fast paths have been quite stable and risk of regression is very low String changes made/needed:

This is the rebase for ESR60. The only difference is { } for single-line if statements. Carrying r=jandem from https://hg.mozilla.org/mozilla-central/rev/40e167054726

Comment on attachment 9028855 [details] [diff] [review] Avoid-shape-teleporting-if-any-uncacheable (ESR60) [ESR Uplift Approval Request] If this is not a sec:{high,crit} bug, please state case for ESR consideration: Some website javascript breaks in subtle ways. User impact if declined: Fix Landed on Version: 65 Risk to taking this patch: Low Why is the change risky/not risky? (and alternatives if risky): This change prevents an optimization from triggering in a few more edge cases. Both the slow and fast paths have been quite stable and risk of regression is very low String or UUID changes made by this patch:

Comment on attachment 9028855 [details] [diff] [review] Avoid-shape-teleporting-if-any-uncacheable (ESR60) I'd like to let this at least wait for a cycle to see how it does in 65 or maybe 64. At this point in ESR we usually only take security and stability fixes. There are exceptions but even so, I'd like to have more verification of the fix and a good reason to bring it to ESR (duplicate bugs, more reports).

Reproduced the bug on Ubuntu 16.04 and Windows 10 with an affected build from 65.0a1 20181122100048. Verified the fix on 65.0a1 2018-12-03 Osx 10.14, Ubuntu 16.04 and Windows 10. Looking at STR from comment 0 and comment 1, it seems that there should be a path highlight as well, which I don't see in either Nightly 65 or in Chrome. Alice, cspm.qc@gmail.com, did the page changed or am I missing something?

Build ID 20181203093109 User Agent Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0) Gecko/20100101 Firefox/65.0 Built from https://hg.mozilla.org/mozilla-central/rev/01d0813d8203d78613fc33a3e8e32627c1300b50 It seems works for me. The route is highlighted with peach color.

Comment on attachment 9027283 [details] Bug 1507433 - Avoid shape teleporting if any uncacheable prototypes. JIT fix, verified in nightly, approved for 64.0 rc1

Thanks Alice, Seems like i was using a part of the map not on the area for which the route was supposed to work. The highlight did work when I used it right, as described in the screenshot you attached. Thanks! Based on comment 11 and comment 12, marking this issue as verified for Fx65.

https://hg.mozilla.org/releases/mozilla-release/rev/d27d733d06cf https://hg.mozilla.org/releases/mozilla-beta/rev/3adefdb368ae83b41b5464958a0437219e35264b (FIREFOX_64b_RELBRANCH)

Verified as fixed on Ubuntu 16.04x64, Osx 10.14 and Windows 10 using Firefox 64.0RC2 2018-12-05.