[tor-commits] [tor-browser/tor-browser-52.0.2esr-7.0-2] Bug 21795: Fix github.com crashes on Windows

[gk at torproject.org]

commit c90a0868540a9771cc10bdc1cf91b8f6a8f37603
Author: Georg Koppen <gk at torproject.org>
Date:   Thu Apr 13 16:14:00 2017 +0000

    Bug 21795: Fix github.com crashes on Windows
    
    This is https://bugzilla.mozilla.org/show_bug.cgi?id=1351278
---
 js/src/jit/IonBuilder.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 0413b11..1d3377b 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6592,7 +6592,12 @@ IonBuilder::jsop_funapply(uint32_t argc)
     if (argument->type() != MIRType::MagicOptimizedArguments) {
         // Optimize fun.apply(self, array) if the length is sane and there are no holes.
         TemporaryTypeSet* objTypes = argument->resultTypeSet();
-        if (native && native->isNative() && native->native() == fun_apply &&
+#ifdef XP_WIN
+        bool opt = false;
+#else
+        bool opt = true;
+#endif
+        if (opt && native && native->isNative() && native->native() == fun_apply &&
             objTypes &&
             objTypes->getKnownClass(constraints()) == &ArrayObject::class_ &&
             !objTypes->hasObjectFlags(constraints(), OBJECT_FLAG_LENGTH_OVERFLOW) &&