Bug 1185757 - Fix manual manipulation of StackPointer for JSOP_IN. r=efaust

js/src/jit/BaselineIC.cpp

@@ -5732,7 +5732,7 @@ ICInNativeDoesNotExistCompiler::generateStubCode(MacroAssembler& masm)
         masm.loadPtr(Address(ICStubReg, shapeOffset), scratch);
         masm.branchTestObjShape(Assembler::NotEqual, protoReg, scratch, &failurePopR0Scratch);
     }
-    masm.addPtr(Imm32(sizeof(size_t)), StackPointer);
+    masm.addToStackPtr(Imm32(sizeof(size_t)));
 
     // Shape and type checks succeeded, ok to proceed.
     masm.moveValue(BooleanValue(false), R0);

js/src/jit/SharedIC.h

@@ -1019,6 +1019,8 @@ class ICStubCompiler
 #elif defined(JS_CODEGEN_MIPS)
         MOZ_ASSERT(!regs.has(ICTailCallReg));
         MOZ_ASSERT(!regs.has(BaselineSecondScratchReg));
+#elif defined(JS_CODEGEN_ARM64)
+        MOZ_ASSERT(!regs.has(ICTailCallReg));
 #endif
         regs.take(BaselineFrameReg);
         regs.take(ICStubReg);