Commit 78a5f7f9 authored by Georg Koppen's avatar Georg Koppen
Browse files

Bug 21795: Fix github.com crashes on Windows 

This is https://bugzilla.mozilla.org/show_bug.cgi?id=1351278
parent b848ea5e

js/src/jit/IonBuilder.cpp

+6 −1
Original line number Original line Diff line number Diff line
@@ -6592,7 +6592,12 @@ IonBuilder::jsop_funapply(uint32_t argc) 
    if (argument->type() != MIRType::MagicOptimizedArguments) {

    if (argument->type() != MIRType::MagicOptimizedArguments) {

        // Optimize fun.apply(self, array) if the length is sane and there are no holes.

        // Optimize fun.apply(self, array) if the length is sane and there are no holes.

        TemporaryTypeSet* objTypes = argument->resultTypeSet();

        TemporaryTypeSet* objTypes = argument->resultTypeSet();

        if (native && native->isNative() && native->native() == fun_apply &&

#ifdef XP_WIN

        bool opt = false;

#else

        bool opt = true;

#endif

        if (opt && native && native->isNative() && native->native() == fun_apply &&

            objTypes &&

            objTypes &&

            objTypes->getKnownClass(constraints()) == &ArrayObject::class_ &&

            objTypes->getKnownClass(constraints()) == &ArrayObject::class_ &&

            !objTypes->hasObjectFlags(constraints(), OBJECT_FLAG_LENGTH_OVERFLOW) &&

            !objTypes->hasObjectFlags(constraints(), OBJECT_FLAG_LENGTH_OVERFLOW) &&