commit c90a0868540a9771cc10bdc1cf91b8f6a8f37603 Author: Georg Koppen gk@torproject.org Date: Thu Apr 13 16:14:00 2017 +0000

Bug 21795: Fix github.com crashes on Windows

This is https://bugzilla.mozilla.org/show_bug.cgi?id=1351278 --- js/src/jit/IonBuilder.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index 0413b11..1d3377b 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -6592,7 +6592,12 @@ IonBuilder::jsop_funapply(uint32_t argc) if (argument->type() != MIRType::MagicOptimizedArguments) { // Optimize fun.apply(self, array) if the length is sane and there are no holes. TemporaryTypeSet* objTypes = argument->resultTypeSet(); - if (native && native->isNative() && native->native() == fun_apply && +#ifdef XP_WIN + bool opt = false; +#else + bool opt = true; +#endif + if (opt && native && native->isNative() && native->native() == fun_apply && objTypes && objTypes->getKnownClass(constraints()) == &ArrayObject::class_ && !objTypes->hasObjectFlags(constraints(), OBJECT_FLAG_LENGTH_OVERFLOW) &&