From b1c196880fe68373f1c70c2f4588bcdf36446a87 Mon Sep 17 00:00:00 2001
From: Jon Coppeard <jcoppeard@mozilla.com>
Date: Tue, 22 Sep 2015 05:40:00 -0700
Subject: [PATCH] Bug 1206485 - "Boot loop after first boot on some devices
 (Xperia M2, ...)" [r=terrence f=lissyx+mozillians]

---
 js/src/frontend/Parser.cpp | 3 ++-
 js/src/jsfun.h             | 9 +++++++--
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/js/src/frontend/Parser.cpp b/js/src/frontend/Parser.cpp
index 45c4cc62c53a..946288c8ce08 100644
--- a/js/src/frontend/Parser.cpp
+++ b/js/src/frontend/Parser.cpp
@@ -54,6 +54,7 @@ JSFunction::AutoParseUsingFunctionBox::AutoParseUsingFunctionBox(ExclusiveContex
   : fun_(cx, funbox->function()),
     oldEnv_(cx, fun_->environment())
 {
+    fun_->unsetEnvironment();
     fun_->setFunctionBox(funbox);
     funbox->computeAllowSyntax(fun_);
     funbox->computeInWith(fun_);
@@ -62,7 +63,7 @@ JSFunction::AutoParseUsingFunctionBox::AutoParseUsingFunctionBox(ExclusiveContex
 JSFunction::AutoParseUsingFunctionBox::~AutoParseUsingFunctionBox()
 {
     fun_->unsetFunctionBox();
-    fun_->setEnvironment(oldEnv_);
+    fun_->initEnvironment(oldEnv_);
 }
 
 namespace js {
diff --git a/js/src/jsfun.h b/js/src/jsfun.h
index a629743a0d8d..36cb10b8b591 100644
--- a/js/src/jsfun.h
+++ b/js/src/jsfun.h
@@ -319,17 +319,22 @@ class JSFunction : public js::NativeObject
 
     void setEnvironment(JSObject* obj) {
         MOZ_ASSERT(isInterpreted() && !isBeingParsed());
-        *(js::HeapPtrObject*)&u.i.env_ = obj;
+        *reinterpret_cast<js::HeapPtrObject*>(&u.i.env_) = obj;
     }
 
     void initEnvironment(JSObject* obj) {
         MOZ_ASSERT(isInterpreted() && !isBeingParsed());
-        ((js::HeapPtrObject*)&u.i.env_)->init(obj);
+        reinterpret_cast<js::HeapPtrObject*>(&u.i.env_)->init(obj);
+    }
+
+    void unsetEnvironment() {
+        setEnvironment(nullptr);
     }
 
   private:
     void setFunctionBox(js::frontend::FunctionBox* funbox) {
         MOZ_ASSERT(isInterpreted());
+        MOZ_ASSERT_IF(!isBeingParsed(), !environment());
         flags_ |= BEING_PARSED;
         u.i.funbox_ = funbox;
     }