Fixes issue #640. Hopefully. Given that I've never seen it on any of the dozens of setups I've tested on.

common/locale/en-US/messages.properties

@@ -1,5 +1,13 @@
 # TODO: normalize this debacle of Vim legacy messages
 
+error.damnYouJägermonkey = + \
+	Hallo. It looks like you've run into a problem resulting from       \
+	overzealous optimizations by the JavaScript engine. We've disabled  \
+	future use of these optimizations, but you'll need to restart your  \
+	browser in order to correct the problems they've caused. You can    \
+	re-enable them by resetting the javascript.options.methodjit.chrome \
+	preference.
+
 abbreviation.noSuch = No such abbreviation
 abbreviation.none = No abbreviations found
 

common/modules/messages.jsm

@@ -60,7 +60,10 @@ var Messages = Module("messages", {
     get: function get(value, default_) {
         for (let bundle in values(this.bundles))
             try {
-                return bundle.GetStringFromName(value);
+                let res = bundle.GetStringFromName(value);
+                if (res.slice(0, 2) == "+ ")
+                    return res.slice(2).replace(/\s+/g, " ");
+                return res;
             }
             catch (e) {}
 
@@ -73,7 +76,10 @@ var Messages = Module("messages", {
     format: function format(value, args, default_) {
         for (let bundle in values(this.bundles))
             try {
-                return bundle.formatStringFromName(value, args, args.length);
+                let res = bundle.formatStringFromName(value, args, args.length);
+                if (res.slice(0, 2) == "+ ")
+                    return res.slice(2).replace(/\s+/g, " ");
+                return res;
             }
             catch (e) {}
 

common/modules/util.jsm

@@ -428,29 +428,34 @@ var Util = Module("Util", XPCOM([Ci.nsIObserver, Ci.nsISupportsWeakReference]),
      * @returns [string] The resulting strings.
      */
     debrace: function debrace(pattern) {
-        var res = [];
+        try {
-
             if (isArray(pattern)) {
-            let rec = function rec(acc) {
+                // Jägermonkey hates us.
+                let obj = ({
+                    res: [],
+                    rec: function rec(acc) {
                         let vals;
 
                         while (isString(vals = pattern[acc.length]))
                             acc.push(vals);
 
                         if (acc.length == pattern.length)
-                    res.push(acc.join(""))
+                            this.res.push(acc.join(""))
                         else
                             for (let val in values(vals))
-                        rec(acc.concat(val));
+                                this.rec(acc.concat(val));
                     }
-            rec([]);
+                });
-            return res;
+                obj.rec([]);
+                return obj.res;
             }
 
             if (pattern.indexOf("{") == -1)
                 return [pattern];
 
-        function split(pattern, re, fn, dequote) {
+            let res = [];
+
+            let split = function split(pattern, re, fn, dequote) {
                 let end = 0, match, res = [];
                 while (match = re.exec(pattern)) {
                     end = match.index + match[0].length;
@@ -469,7 +474,7 @@ var Util = Module("Util", XPCOM([Ci.nsIObserver, Ci.nsISupportsWeakReference]),
                         null, ",{}"));
                 }, "{}");
 
-        function rec(acc) {
+            let rec = function rec(acc) {
                 if (acc.length == patterns.length)
                     res.push(array(substrings).zip(acc).flatten().join(""));
                 else
@@ -478,6 +483,13 @@ var Util = Module("Util", XPCOM([Ci.nsIObserver, Ci.nsISupportsWeakReference]),
             }
             rec([]);
             return res;
+        }
+        catch (e if e.message && ~e.message.indexOf("res is undefined")) {
+            // prefs.safeSet() would be reset on :rehash
+            prefs.set("javascript.options.methodjit.chrome", false);
+            util.dactyl.warn(_(UTF8("error.damnYouJägermonkey")));
+            return [];
+        }
     },
 
     /**