diff --git a/js/src/builtin/Map.js b/js/src/builtin/Map.js index 700ce1a05f45..7a75a1a0e200 100644 --- a/js/src/builtin/Map.js +++ b/js/src/builtin/Map.js @@ -75,8 +75,8 @@ function MapIteratorNext() { var O = this; // Steps 2-3. - if (!IsObject(O) || !IsMapIterator(O)) - return callFunction(CallMapIteratorMethodIfWrapped, O, "MapIteratorNext"); + if (!IsObject(O) || (O = GuardToMapIterator(O)) === null) + return callFunction(CallMapIteratorMethodIfWrapped, this, "MapIteratorNext"); // Steps 4-5 (implemented in _GetNextMapEntryForIterator). // Steps 8-9 (omitted). @@ -95,7 +95,7 @@ function MapIteratorNext() { // Steps 10.b-c (omitted). // Step 6. - var itemKind = UnsafeGetInt32FromReservedSlot(this, ITERATOR_SLOT_ITEM_KIND); + var itemKind = UnsafeGetInt32FromReservedSlot(O, ITERATOR_SLOT_ITEM_KIND); var result; if (itemKind === ITEM_KIND_KEY) { diff --git a/js/src/jit/MCallOptimize.cpp b/js/src/jit/MCallOptimize.cpp index cbc881c6c499..bbe1a4786642 100644 --- a/js/src/jit/MCallOptimize.cpp +++ b/js/src/jit/MCallOptimize.cpp @@ -321,8 +321,8 @@ IonBuilder::inlineNativeCall(CallInfo& callInfo, JSFunction* target) return inlineSubstringKernel(callInfo); case InlinableNative::IntrinsicGuardToArrayIterator: return inlineGuardToClass(callInfo, &ArrayIteratorObject::class_); - case InlinableNative::IntrinsicIsMapIterator: - return inlineHasClass(callInfo, &MapIteratorObject::class_); + case InlinableNative::IntrinsicGuardToMapIterator: + return inlineGuardToClass(callInfo, &MapIteratorObject::class_); case InlinableNative::IntrinsicIsSetIterator: return inlineHasClass(callInfo, &SetIteratorObject::class_); case InlinableNative::IntrinsicGuardToStringIterator: diff --git a/js/src/vm/SelfHosting.cpp b/js/src/vm/SelfHosting.cpp index cf43bb29be07..8f3b96a9f456 100644 --- a/js/src/vm/SelfHosting.cpp +++ b/js/src/vm/SelfHosting.cpp @@ -2377,9 +2377,9 @@ static const JSFunctionSpec intrinsic_functions[] = { JS_INLINABLE_FN("GuardToArrayIterator", intrinsic_GuardToBuiltin, 1,0, IntrinsicGuardToArrayIterator), - JS_INLINABLE_FN("IsMapIterator", - intrinsic_IsInstanceOfBuiltin, 1,0, - IntrinsicIsMapIterator), + JS_INLINABLE_FN("GuardToMapIterator", + intrinsic_GuardToBuiltin, 1,0, + IntrinsicGuardToMapIterator), JS_INLINABLE_FN("IsSetIterator", intrinsic_IsInstanceOfBuiltin, 1,0, IntrinsicIsSetIterator),