From dcccda4e6ad693cfb015208d4c331cedddd0f211 Mon Sep 17 00:00:00 2001
From: Cameron Kaiser <classilla@floodgap.com>
Date: Tue, 12 Mar 2019 21:21:35 -0700
Subject: [PATCH] #546: M1518001 M1530958

---
 js/src/gc/Nursery.cpp     | 1 +
 js/src/jit/JitOptions.cpp | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/js/src/gc/Nursery.cpp b/js/src/gc/Nursery.cpp
index d95081658..187f9aef1 100644
--- a/js/src/gc/Nursery.cpp
+++ b/js/src/gc/Nursery.cpp
@@ -169,6 +169,7 @@ js::Nursery::disable()
         return;
     numActiveChunks_ = 0;
     currentEnd_ = 0;
+    position_ = 0;
     updateDecommittedRegion();
 }
 
diff --git a/js/src/jit/JitOptions.cpp b/js/src/jit/JitOptions.cpp
index dbb71f200..557b73346 100644
--- a/js/src/jit/JitOptions.cpp
+++ b/js/src/jit/JitOptions.cpp
@@ -185,7 +185,7 @@ DefaultJitOptions::DefaultJitOptions()
     }
 
     // Toggles whether unboxed plain objects can be created by the VM.
-    SET_DEFAULT(disableUnboxedObjects, false);
+    SET_DEFAULT(disableUnboxedObjects, true);
 }
 
 bool