Merge branch 'master' into es-modules-work

4 files changed, 29 insertions, 9 deletions

diff --git a/js/src/jit/IonBuilder.cpp b/js/src/jit/IonBuilder.cpp
index f08baf865..3d0b73f04 100644
--- a/js/src/jit/IonBuilder.cpp
+++ b/js/src/jit/IonBuilder.cpp
@@ -3823,7 +3823,7 @@ IonBuilder::improveTypesAtTypeOfCompare(MCompare* ins, bool trueBranch, MTest* t
         tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(subject->type())), alloc_->lifoAlloc());
     }
 
-    if (inputTypes->unknown())
+    if (inputTypes->unknown() || inputTypes->hasType(TypeSet::MagicArgType()))
         return true;
 
     // Note: we cannot remove the AnyObject type in the false branch,
@@ -3905,7 +3905,7 @@ IonBuilder::improveTypesAtNullOrUndefinedCompare(MCompare* ins, bool trueBranch,
         tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(subject->type())), alloc_->lifoAlloc());
     }
 
-    if (inputTypes->unknown())
+    if (inputTypes->unknown() || inputTypes->hasType(TypeSet::MagicArgType()))
         return true;
 
     TemporaryTypeSet* type;
@@ -3969,7 +3969,7 @@ IonBuilder::improveTypesAtTest(MDefinition* ins, bool trueBranch, MTest* test)
             tmp.addType(TypeSet::PrimitiveType(ValueTypeFromMIRType(subject->type())), alloc_->lifoAlloc());
         }
 
-        if (oldType->unknown())
+        if (oldType->unknown() || oldType->hasType(TypeSet::MagicArgType()))
             return true;
 
         TemporaryTypeSet* type = nullptr;
@@ -4049,7 +4049,7 @@ IonBuilder::improveTypesAtTest(MDefinition* ins, bool trueBranch, MTest* test)
     }
 
     // If ins does not have a typeset we return as we cannot optimize.
-    if (oldType->unknown())
+    if (oldType->unknown() || oldType->hasType(TypeSet::MagicArgType()))
         return true;
 
     // Decide either to set or remove.
diff --git a/js/src/jit/Sink.cpp b/js/src/jit/Sink.cpp
index b2c36fae5..2764fc1cb 100644
--- a/js/src/jit/Sink.cpp
+++ b/js/src/jit/Sink.cpp
@@ -71,8 +71,12 @@ Sink(MIRGenerator* mir, MIRGraph& graph)
             for (MUseIterator i(ins->usesBegin()), e(ins->usesEnd()); i != e; i++) {
                 hasUses = true;
                 MNode* consumerNode = (*i)->consumer();
-                if (consumerNode->isResumePoint())
+                if (consumerNode->isResumePoint()) {
+                    if (!consumerNode->toResumePoint()->isRecoverableOperand(*i)) {
+                        hasLiveUses = true;
+                    }
                     continue;
+                }
 
                 MDefinition* consumer = consumerNode->toDefinition();
                 if (consumer->isRecoveredOnBailout())
diff --git a/js/src/jsdate.cpp b/js/src/jsdate.cpp
index c6a369e2d..41722ffa9 100755
--- a/js/src/jsdate.cpp
+++ b/js/src/jsdate.cpp
@@ -21,6 +21,8 @@
 #include "mozilla/FloatingPoint.h"
 #include "mozilla/Sprintf.h"
 
+#include "nsCRT.h"
+
 #include <ctype.h>
 #include <math.h>
 #include <string.h>
@@ -958,11 +960,20 @@ ParseDate(const CharT* s, size_t length, ClippedTime* result)
     while (i < length) {
         int c = s[i];
         i++;
-        if (c <= ' ' || c == ',' || c == '-') {
-            if (c == '-' && '0' <= s[i] && s[i] <= '9')
+        
+        // Spaces, ASCII control characters, and commas are ignored.
+        if (c <= ' ' || c == ',')
+            continue;
+
+        // Dashes are delimiters if they're immediately followed by a number field.
+        // If they're not followed by a number field, they're simply ignored.
+        if (c == '-') {
+            if (i < length && nsCRT::IsAsciiDigit(s[i])) {
                 prevc = c;
+            }
             continue;
         }
+
         if (c == '(') { /* comments) */
             int depth = 1;
             while (i < length) {
@@ -977,7 +988,9 @@ ParseDate(const CharT* s, size_t length, ClippedTime* result)
             }
             continue;
         }
-        if ('0' <= c && c <= '9') {
+
+        // Parse a number field.
+        if (nsCRT::IsAsciiDigit(c)) {        
             int n = c - '0';
             while (i < length && '0' <= (c = s[i]) && c <= '9') {
                 n = n * 10 + c - '0';
diff --git a/js/src/vm/NativeObject.h b/js/src/vm/NativeObject.h
index 3a3e50244..e9c59ff7c 100644
--- a/js/src/vm/NativeObject.h
+++ b/js/src/vm/NativeObject.h
@@ -646,7 +646,10 @@ class NativeObject : public ShapedObject
     uint32_t slotSpan() const {
         if (inDictionaryMode())
             return lastProperty()->base()->slotSpan();
-        return lastProperty()->slotSpan();
+
+        // Get the class from the object group rather than the base shape to avoid a
+        // race between Shape::ensureOwnBaseShape and background sweeping.
+        return lastProperty()->slotSpan(getClass());
     }
 
     /* Whether a slot is at a fixed offset from this object. */