Set NO_MDUPDATE when building NSS as NSS makes silly assumptions w/o checking with the compiler if you don't.

security/manager/Makefile.in

@@ -85,6 +85,7 @@ ifndef MOZ_NSS_AUTOCONF
 DEFAULT_GMAKE_FLAGS = -j1 $(OPT_GMAKE_FLAGS)
 DEFAULT_GMAKE_FLAGS += SOURCE_MDHEADERS_DIR=$(MOZ_BUILD_ROOT)/dist/include/nspr
 DEFAULT_GMAKE_FLAGS += MOZILLA_CLIENT=1
+DEFAULT_GMAKE_FLAGS += NO_MDUPDATE=1
 CORECONF_INSTALL     = $(DIST)/$(CORECONF_OBJDIR)
 SUBMAKEFILES = ssl/Makefile pki/Makefile
 else