Version 4.6.85.22 (cherry-pick)

src/bootstrapper.cc

Index: src/bootstrapper.cc
diff --git a/src/bootstrapper.cc b/src/bootstrapper.cc
index 32c3fcc55afdb1dc05cdb8e85a49291773fd75e0..790a80b23959a0b492a467ebc8cc4a084eaf08f2 100644
--- a/src/bootstrapper.cc
+++ b/src/bootstrapper.cc
@@ -1937,16 +1937,18 @@ void Genesis::InitializeGlobal_harmony_reflect() {
       MaybeHandle<JSObject>(), Builtins::kReflectApply);
   apply->shared()->set_internal_formal_parameter_count(3);
   apply->shared()->set_length(3);
-  apply->shared()->set_feedback_vector(
-      *TypeFeedbackVector::CreatePushAppliedArgumentsVector(isolate()));
+  Handle<TypeFeedbackVector> apply_feedback_vector =
+      TypeFeedbackVector::CreatePushAppliedArgumentsVector(isolate());
+  apply->shared()->set_feedback_vector(*apply_feedback_vector);
 
   Handle<JSFunction> construct = InstallFunction(
       builtins, "$reflectConstruct", JS_OBJECT_TYPE, JSObject::kHeaderSize,
       MaybeHandle<JSObject>(), Builtins::kReflectConstruct);
   construct->shared()->set_internal_formal_parameter_count(3);
   construct->shared()->set_length(2);
-  construct->shared()->set_feedback_vector(
-      *TypeFeedbackVector::CreatePushAppliedArgumentsVector(isolate()));
+  Handle<TypeFeedbackVector> construct_feedback_vector =
+      TypeFeedbackVector::CreatePushAppliedArgumentsVector(isolate());
+  construct->shared()->set_feedback_vector(*construct_feedback_vector);
 
   if (!FLAG_harmony_reflect) return;
 
@@ -2444,8 +2446,9 @@ bool Genesis::InstallNatives(ContextType context_type) {
     Handle<JSFunction> apply =
         InstallFunction(proto, "apply", JS_OBJECT_TYPE, JSObject::kHeaderSize,
                         MaybeHandle<JSObject>(), Builtins::kFunctionApply);
-    apply->shared()->set_feedback_vector(
-        *TypeFeedbackVector::CreatePushAppliedArgumentsVector(isolate()));
+    Handle<TypeFeedbackVector> feedback_vector =
+        TypeFeedbackVector::CreatePushAppliedArgumentsVector(isolate());
+    apply->shared()->set_feedback_vector(*feedback_vector);
 
     // Make sure that Function.prototype.call appears to be compiled.
     // The code will never be called, but inline caching for call will