diff --git a/js/src/jit/CompactBuffer.h b/js/src/jit/CompactBuffer.h
index 780ff4f99..1beacc306 100644
--- a/js/src/jit/CompactBuffer.h
+++ b/js/src/jit/CompactBuffer.h
@@ -143,6 +143,13 @@ class CompactBufferWriter
             original >>= 7;
         } while (original);
     }
+    void writeUnsigned64(uint64_t value) {
+        do {
+            uint8_t byte = ((value & 0x7F) << 1) | (value > 0x7F);
+            writeByte(byte);
+            value >>= 7;
+        } while (value);
+    }
     void writeSigned(int32_t v) {
         bool isNegative = v < 0;
         uint32_t value = isNegative ? -v : v;
diff --git a/js/src/jit/IonTypes.h b/js/src/jit/IonTypes.h
index 95e6aaf45..fa581f20f 100644
--- a/js/src/jit/IonTypes.h
+++ b/js/src/jit/IonTypes.h
@@ -20,7 +20,7 @@
 namespace js {
 namespace jit {
 
-typedef uint32_t RecoverOffset;
+typedef uint64_t RecoverOffset;
 typedef uint32_t SnapshotOffset;
 typedef uint32_t BailoutId;
 
@@ -32,8 +32,8 @@ static const uint32_t MAX_BUFFER_SIZE = (1 << 30) - 1;
 // Maximum number of scripted arg slots.
 static const uint32_t SNAPSHOT_MAX_NARGS = 127;
 
-static const SnapshotOffset INVALID_RECOVER_OFFSET = uint32_t(-1);
-static const SnapshotOffset INVALID_SNAPSHOT_OFFSET = uint32_t(-1);
+static const RecoverOffset INVALID_RECOVER_OFFSET = RecoverOffset(-1);
+static const RecoverOffset INVALID_SNAPSHOT_OFFSET = SnapshotOffset(-1);
 
 // Different kinds of bailouts. When extending this enum, make sure to check
 // the bits reserved for bailout kinds in Bailouts.h
diff --git a/js/src/jit/Snapshots.cpp b/js/src/jit/Snapshots.cpp
index 96fb82306..9ebf559fa 100644
--- a/js/src/jit/Snapshots.cpp
+++ b/js/src/jit/Snapshots.cpp
@@ -51,7 +51,7 @@ using namespace js::jit;
 //
 // Snapshot header:
 //
-//   [vwu] bits ((n+1)-31]: recover instruction offset
+//   [vwu] bits ((n+1),63]: recover instruction offset
 //         bits [0,n): bailout kind (n = SNAPSHOT_BAILOUTKIND_BITS)
 //
 // Snapshot body, repeated "frame count" times, from oldest frame to newest frame.
@@ -497,16 +497,16 @@ SnapshotReader::SnapshotReader(const uint8_t* snapshots, uint32_t offset,
 }
 
 #define COMPUTE_SHIFT_AFTER_(name) (name ## _BITS + name ##_SHIFT)
-#define COMPUTE_MASK_(name) ((uint32_t(1 << name ## _BITS) - 1) << name ##_SHIFT)
+#define COMPUTE_MASK_(name) (((uint64_t(1) << name##_BITS) - 1) << name##_SHIFT)
 
 // Details of snapshot header packing.
 static const uint32_t SNAPSHOT_BAILOUTKIND_SHIFT = 0;
 static const uint32_t SNAPSHOT_BAILOUTKIND_BITS = 6;
-static const uint32_t SNAPSHOT_BAILOUTKIND_MASK = COMPUTE_MASK_(SNAPSHOT_BAILOUTKIND);
+static const uint64_t SNAPSHOT_BAILOUTKIND_MASK = COMPUTE_MASK_(SNAPSHOT_BAILOUTKIND);
 
 static const uint32_t SNAPSHOT_ROFFSET_SHIFT = COMPUTE_SHIFT_AFTER_(SNAPSHOT_BAILOUTKIND);
-static const uint32_t SNAPSHOT_ROFFSET_BITS = 32 - SNAPSHOT_ROFFSET_SHIFT;
-static const uint32_t SNAPSHOT_ROFFSET_MASK = COMPUTE_MASK_(SNAPSHOT_ROFFSET);
+static const uint32_t SNAPSHOT_ROFFSET_BITS = 64 - SNAPSHOT_ROFFSET_SHIFT;
+static const uint64_t SNAPSHOT_ROFFSET_MASK = COMPUTE_MASK_(SNAPSHOT_ROFFSET);
 
 // Details of recover header packing.
 static const uint32_t RECOVER_RESUMEAFTER_SHIFT = 0;
@@ -523,7 +523,7 @@ static const uint32_t RECOVER_RINSCOUNT_MASK = COMPUTE_MASK_(RECOVER_RINSCOUNT);
 void
 SnapshotReader::readSnapshotHeader()
 {
-    uint32_t bits = reader_.readUnsigned();
+    uint64_t bits = reader_.readUnsigned();
 
     bailoutKind_ = BailoutKind((bits & SNAPSHOT_BAILOUTKIND_MASK) >> SNAPSHOT_BAILOUTKIND_SHIFT);
     recoverOffset_ = (bits & SNAPSHOT_ROFFSET_MASK) >> SNAPSHOT_ROFFSET_SHIFT;
@@ -627,16 +627,16 @@ SnapshotWriter::startSnapshot(RecoverOffset recoverOffset, BailoutKind kind)
     lastStart_ = writer_.length();
     allocWritten_ = 0;
 
-    JitSpew(JitSpew_IonSnapshots, "starting snapshot with recover offset %u, bailout kind %u",
+    JitSpew(JitSpew_IonSnapshots, "starting snapshot with recover offset %" PRIu64 ", bailout kind %u",
             recoverOffset, kind);
 
-    MOZ_ASSERT(uint32_t(kind) < (1 << SNAPSHOT_BAILOUTKIND_BITS));
-    MOZ_ASSERT(recoverOffset < (1 << SNAPSHOT_ROFFSET_BITS));
-    uint32_t bits =
-        (uint32_t(kind) << SNAPSHOT_BAILOUTKIND_SHIFT) |
+    MOZ_ASSERT(uint64_t(kind) < (uint64_t(1) << SNAPSHOT_BAILOUTKIND_BITS));
+    MOZ_ASSERT(recoverOffset < (RecoverOffset(1) << SNAPSHOT_ROFFSET_BITS));
+    uint64_t bits =
+        (uint64_t(kind) << SNAPSHOT_BAILOUTKIND_SHIFT) |
         (recoverOffset << SNAPSHOT_ROFFSET_SHIFT);
 
-    writer_.writeUnsigned(bits);
+    writer_.writeUnsigned64(bits);
     return lastStart_;
 }
 
diff --git a/js/src/jit/Snapshots.h b/js/src/jit/Snapshots.h
index 2a3d7e652..220467a9a 100644
--- a/js/src/jit/Snapshots.h
+++ b/js/src/jit/Snapshots.h
@@ -428,7 +428,7 @@ class RecoverWriter
     uint32_t instructionsWritten_;
 
   public:
-    SnapshotOffset startRecover(uint32_t instructionCount, bool resumeAfter);
+    RecoverOffset startRecover(uint32_t instructionCount, bool resumeAfter);
 
     void writeInstruction(const MNode* rp);