[tbb-commits] [tor-browser/tor-browser-45.8.0esr-6.5-2] Bug 21795: Fix github.com crashes on Windows

[gk at torproject.org]

commit fd67e2869611a961893a868fa0891cf4ded173eb
Author: Georg Koppen <gk at torproject.org>
Date:   Wed Apr 12 11:15:40 2017 +0000

    Bug 21795: Fix github.com crashes on Windows
    
    This is https://bugzilla.mozilla.org/show_bug.cgi?id=1351278
---
 js/src/jit/IonBuilder.cpp | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index 9e70e24..34520b3 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -6366,7 +6366,12 @@ IonBuilder::jsop_funapply(uint32_t argc)
     if (argument->type() != MIRType_MagicOptimizedArguments) {
         // Optimize fun.apply(self, array) if the length is sane and there are no holes.
         TemporaryTypeSet* objTypes = argument->resultTypeSet();
-        if (native && native->isNative() && native->native() == fun_apply &&
+#ifdef XP_WIN
+        bool opt = false;
+#else
+        bool opt = true;
+#endif
+        if (opt && native && native->isNative() && native->native() == fun_apply &&
             objTypes &&
             objTypes->getKnownClass(constraints()) == &ArrayObject::class_ &&
             !objTypes->hasObjectFlags(constraints(), OBJECT_FLAG_LENGTH_OVERFLOW) &&