fuzz fix

mozilla-release/patches/1437842-00-61a1.patch

@@ -3,7 +3,7 @@
 # Date 1523035465 14400
 #      Fri Apr 06 13:24:25 2018 -0400
 # Node ID 3574187cbf667733e0105a48da473f6667c5eaf0
-# Parent  1f41571f4d7e03850b78e8fba3d1b638ec592fcb
+# Parent  49e1712f3460698eb195c72639c8ca096822507f
 Bug 1437842: [Part 0] Convert IsStringIterator to GuardToStringIterator r=jandem
 
 Lays out the ground work
@@ -64,7 +64,7 @@ diff --git a/js/src/builtin/String.js b/js/src/builtin/String.js
 diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 --- a/js/src/jit/CodeGenerator.cpp
 +++ b/js/src/jit/CodeGenerator.cpp
-@@ -12085,16 +12085,43 @@ CodeGenerator::visitHasClass(LHasClass* 
+@@ -12149,16 +12149,43 @@ CodeGenerator::visitHasClass(LHasClass* 
  {
      Register lhs = ToRegister(ins->lhs());
      Register output = ToRegister(ins->output());
@@ -111,7 +111,7 @@ diff --git a/js/src/jit/CodeGenerator.cpp b/js/src/jit/CodeGenerator.cpp
 diff --git a/js/src/jit/CodeGenerator.h b/js/src/jit/CodeGenerator.h
 --- a/js/src/jit/CodeGenerator.h
 +++ b/js/src/jit/CodeGenerator.h
-@@ -389,16 +389,17 @@ class CodeGenerator final : public CodeG
+@@ -391,16 +391,17 @@ class CodeGenerator final : public CodeG
      void visitIsConstructor(LIsConstructor* lir);
      void visitOutOfLineIsConstructor(OutOfLineIsConstructor* ool);
      void visitIsArrayO(LIsArrayO* lir);
@@ -153,7 +153,7 @@ diff --git a/js/src/jit/InlinableNatives.h b/js/src/jit/InlinableNatives.h
 diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
 --- a/js/src/jit/IonBuilder.h
 +++ b/js/src/jit/IonBuilder.h
-@@ -782,16 +782,17 @@ class IonBuilder
+@@ -790,16 +790,17 @@ class IonBuilder
      InliningResult inlineIsWrappedArrayConstructor(CallInfo& callInfo);
      InliningResult inlineToInteger(CallInfo& callInfo);
      InliningResult inlineToString(CallInfo& callInfo);
@@ -174,7 +174,7 @@ diff --git a/js/src/jit/IonBuilder.h b/js/src/jit/IonBuilder.h
 diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
 --- a/js/src/jit/Lowering.cpp
 +++ b/js/src/jit/Lowering.cpp
-@@ -4408,16 +4408,26 @@ void
+@@ -4441,16 +4441,26 @@ void
  LIRGenerator::visitHasClass(MHasClass* ins)
  {
      MOZ_ASSERT(ins->object()->type() == MIRType::Object);
@@ -204,9 +204,9 @@ diff --git a/js/src/jit/Lowering.cpp b/js/src/jit/Lowering.cpp
 diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
 --- a/js/src/jit/Lowering.h
 +++ b/js/src/jit/Lowering.h
-@@ -294,16 +294,17 @@ class LIRGenerator : public LIRGenerator
+@@ -296,16 +296,17 @@ class LIRGenerator : public LIRGenerator
      void visitInstanceOf(MInstanceOf* ins);
-     void visitCallInstanceOf(MCallInstanceOf* ins);
+     void visitInstanceOfCache(MInstanceOfCache* ins);
      void visitIsCallable(MIsCallable* ins);
      void visitIsConstructor(MIsConstructor* ins);
      void visitIsArray(MIsArray* ins);
@@ -225,7 +225,7 @@ diff --git a/js/src/jit/Lowering.h b/js/src/jit/Lowering.h
 diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
 --- a/js/src/jit/MCallOptimize.cpp
 +++ b/js/src/jit/MCallOptimize.cpp
-@@ -325,16 +325,18 @@ IonBuilder::inlineNativeCall(CallInfo& c
+@@ -324,16 +324,18 @@ IonBuilder::inlineNativeCall(CallInfo& c
        case InlinableNative::IntrinsicIsArrayIterator:
          return inlineHasClass(callInfo, &ArrayIteratorObject::class_);
        case InlinableNative::IntrinsicIsMapIterator:
@@ -244,7 +244,7 @@ diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
          return inlineIsPackedArray(callInfo);
  
        // Map intrinsics.
-@@ -2529,16 +2531,47 @@ IonBuilder::inlineHasClass(CallInfo& cal
+@@ -2528,16 +2530,47 @@ IonBuilder::inlineHasClass(CallInfo& cal
          }
      }
  
@@ -295,7 +295,7 @@ diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp
 diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
 --- a/js/src/jit/MIR.h
 +++ b/js/src/jit/MIR.h
-@@ -13556,16 +13556,58 @@ class MHasClass
+@@ -13676,16 +13676,58 @@ class MHasClass
          if (!ins->isHasClass())
              return false;
          if (getClass() != ins->toHasClass()->getClass())
@@ -357,7 +357,7 @@ diff --git a/js/src/jit/MIR.h b/js/src/jit/MIR.h
 diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
 --- a/js/src/jit/MOpcodes.h
 +++ b/js/src/jit/MOpcodes.h
-@@ -279,16 +279,17 @@ namespace jit {
+@@ -281,16 +281,17 @@ namespace jit {
      _(GetDOMMember)                                                         \
      _(SetDOMProperty)                                                       \
      _(IsConstructor)                                                        \
@@ -378,7 +378,7 @@ diff --git a/js/src/jit/MOpcodes.h b/js/src/jit/MOpcodes.h
 diff --git a/js/src/jit/shared/LIR-shared.h b/js/src/jit/shared/LIR-shared.h
 --- a/js/src/jit/shared/LIR-shared.h
 +++ b/js/src/jit/shared/LIR-shared.h
-@@ -8148,16 +8148,39 @@ class LHasClass : public LInstructionHel
+@@ -8191,16 +8191,39 @@ class LHasClass : public LInstructionHel
      const LAllocation* lhs() {
          return getOperand(0);
      }
@@ -421,7 +421,7 @@ diff --git a/js/src/jit/shared/LIR-shared.h b/js/src/jit/shared/LIR-shared.h
 diff --git a/js/src/jit/shared/LOpcodes-shared.h b/js/src/jit/shared/LOpcodes-shared.h
 --- a/js/src/jit/shared/LOpcodes-shared.h
 +++ b/js/src/jit/shared/LOpcodes-shared.h
-@@ -394,16 +394,17 @@
+@@ -396,16 +396,17 @@
      _(IsCallableV)                  \
      _(IsConstructor)                \
      _(IsArrayO)                     \
@@ -475,7 +475,7 @@ diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp
   * content code changed the named binding on the global object.
   *
   * This intrinsic shouldn't be called directly. Instead, the
-@@ -2332,16 +2348,19 @@ static const JSFunctionSpec intrinsic_fu
+@@ -2333,16 +2349,19 @@ static const JSFunctionSpec intrinsic_fu
                      intrinsic_IsInstanceOfBuiltin<MapIteratorObject>,   1,0,
                      IntrinsicIsMapIterator),
      JS_INLINABLE_FN("IsSetIterator",