commit fd67e2869611a961893a868fa0891cf4ded173eb Author: Georg Koppen gk@torproject.org Date: Wed Apr 12 11:15:40 2017 +0000

Bug 21795: Fix github.com crashes on Windows

This is https://bugzilla.mozilla.org/show_bug.cgi?id=1351278 --- js/src/jit/IonBuilder.cpp | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp index 9e70e24..34520b3 100644 --- a/js/src/jit/IonBuilder.cpp +++ b/js/src/jit/IonBuilder.cpp @@ -6366,7 +6366,12 @@ IonBuilder::jsop_funapply(uint32_t argc) if (argument->type() != MIRType_MagicOptimizedArguments) { // Optimize fun.apply(self, array) if the length is sane and there are no holes. TemporaryTypeSet* objTypes = argument->resultTypeSet(); - if (native && native->isNative() && native->native() == fun_apply && +#ifdef XP_WIN + bool opt = false; +#else + bool opt = true; +#endif + if (opt && native && native->isNative() && native->native() == fun_apply && objTypes && objTypes->getKnownClass(constraints()) == &ArrayObject::class_ && !objTypes->hasObjectFlags(constraints(), OBJECT_FLAG_LENGTH_OVERFLOW) &&