Adding upstream version 86.0.1.upstream/86.0.1upstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

24 files changed, 372 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/jaeger/loops/bug651155.js b/js/src/jit-test/tests/jaeger/loops/bug651155.js
new file mode 100644
index 0000000000..37c16fff19
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/bug651155.js
@@ -0,0 +1,6 @@
+ForIn_2();
+function ForIn_2( object ) {
+  PropertyArray=new Array;
+  var PropertyArray = 'Do not assert: !cx->throwing';
+  for ( i in object ) PropertyArray.length-1;
+}
diff --git a/js/src/jit-test/tests/jaeger/loops/bug654393.js b/js/src/jit-test/tests/jaeger/loops/bug654393.js
new file mode 100644
index 0000000000..e603392a40
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/bug654393.js
@@ -0,0 +1,12 @@
+var VERSION = "ECMA_2";
+DoWhile(
+    new DoWhileObject(false, false, false, VERSION)
+);
+function DoWhileObject( out1, out2, out3, in1 ) {
+    this.breakIn = in1
+}
+function DoWhile(object) {
+    do {
+        if (object.breakIn) {}
+    } while(false);
+}
diff --git a/js/src/jit-test/tests/jaeger/loops/bug655854.js b/js/src/jit-test/tests/jaeger/loops/bug655854.js
new file mode 100644
index 0000000000..81c7194314
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/bug655854.js
@@ -0,0 +1,8 @@
+
+function foo(a, b, c) {
+  var res = 0;
+  for (var b = 0; b < c; b++)
+    res += a[b];
+  return res;
+}
+assertEq(foo([1,2,3], 0, 10), NaN);
diff --git a/js/src/jit-test/tests/jaeger/loops/bug658290.js b/js/src/jit-test/tests/jaeger/loops/bug658290.js
new file mode 100644
index 0000000000..cfb42066af
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/bug658290.js
@@ -0,0 +1,8 @@
+var SECTION = "15.4.5.2-2";
+addCase(new Array, 0, Math, Math.pow(2, SECTION));
+var arg = "", i = 0;
+var a = eval("new Array(" + arg + ")");
+addCase(a, i, +i + 1, Math.pow(2, 12) + i + 1, true);
+function addCase(object, old_len, set_len, new_len, checkitems) {
+    for (var i = old_len; i < new_len; i++) if (object[i] != 0) {}
+}
diff --git a/js/src/jit-test/tests/jaeger/loops/bug659452.js b/js/src/jit-test/tests/jaeger/loops/bug659452.js
new file mode 100644
index 0000000000..6cc3f4d465
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/bug659452.js
@@ -0,0 +1,5 @@
+test();
+function test() {
+    var t = function () { return function printStatus() {}; };
+    for (var j = 0; j < 10; j++) t["-1"]
+}
diff --git a/js/src/jit-test/tests/jaeger/loops/bug668643.js b/js/src/jit-test/tests/jaeger/loops/bug668643.js
new file mode 100644
index 0000000000..fe41c7ffc7
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/bug668643.js
@@ -0,0 +1,12 @@
+
+function foo(a,n) {
+  var x = {a:[]};
+  for (var i = 0; i < n; ) {
+    a[i];
+    x.a[i];
+    a[++i];
+  }
+}
+var a = [1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0];
+var n = a.length;
+foo(a,n);
diff --git a/js/src/jit-test/tests/jaeger/loops/bug671814.js b/js/src/jit-test/tests/jaeger/loops/bug671814.js
new file mode 100644
index 0000000000..69b581f772
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/bug671814.js
@@ -0,0 +1,12 @@
+var ta = Int8Array([]);
+function Int8Array(summary) {
+    summary.length;
+}
+function test() {
+    ctors = [ Int8Array ]
+    for (var i = 0; i < 10; i++) {
+        ctor = ctors[0]
+        b = ctor(0)
+    }
+}
+test();
diff --git a/js/src/jit-test/tests/jaeger/loops/bug680809.js b/js/src/jit-test/tests/jaeger/loops/bug680809.js
new file mode 100644
index 0000000000..22bcbf3c46
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/bug680809.js
@@ -0,0 +1,8 @@
+function f0(p0) {
+    var v0;
+    v0 = 1.7;
+    loop0: while (v0) {
+        v0 = p0;
+    }
+}
+f0(0);
diff --git a/js/src/jit-test/tests/jaeger/loops/bug684621.js b/js/src/jit-test/tests/jaeger/loops/bug684621.js
new file mode 100644
index 0000000000..9ca13bc7f4
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/bug684621.js
@@ -0,0 +1,15 @@
+function runRichards() {
+    queue = new Packet;
+    Packet(queue, ID_DEVICE_A, KIND_DEVICE);
+    new Packet;
+}
+var ID_DEVICE_A = 4;
+var KIND_DEVICE = 0;
+Packet = function (queue) {
+    this.link = null
+    if (queue == null) return;
+    var peek, next = queue;
+    while ((peek = next.link) != null)
+    ID_HANDLER_B
+};
+runRichards()
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-01.js b/js/src/jit-test/tests/jaeger/loops/hoist-01.js
new file mode 100644
index 0000000000..0c0f12357a
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-01.js
@@ -0,0 +1,35 @@
+function foo(x, n) {
+  for (var i = 0; i < n; i++)
+    x[i] = i;
+  var q = 0;
+  for (var i = 0; i < 10; i++) {
+    for (var j = 0; j < n; j++)
+      q += x[j];
+  }
+  return q;
+}
+
+var a = foo([], 100);
+assertEq(a, 49500);
+
+function basic1(x) {
+  var q = 0;
+  for (var i = 0; i < 4; i++)
+    q += x[i];
+  return q;
+}
+
+var b = basic1([1,2,3,4]);
+assertEq(b, 10);
+
+ARRAY = [1,2,3,4];
+
+function basic2() {
+  var q = 0;
+  for (var i = 0; i < 4; i++)
+    q += ARRAY[i];
+  return q;
+}
+
+var c = basic2();
+assertEq(c, 10);
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-02.js b/js/src/jit-test/tests/jaeger/loops/hoist-02.js
new file mode 100644
index 0000000000..79c3f11952
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-02.js
@@ -0,0 +1,12 @@
+function foo(x, n) {
+  var a = 0;
+  for (var i = 0; i < n; i++)
+    a += x[3];
+  return a;
+}
+
+var a = foo([1,2,3,4], 100);
+assertEq(a, 400);
+
+var b = foo([1,2], 100);
+assertEq(b, NaN);
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-03.js b/js/src/jit-test/tests/jaeger/loops/hoist-03.js
new file mode 100644
index 0000000000..c5c2ba6190
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-03.js
@@ -0,0 +1,12 @@
+function foo(x, j, n) {
+  var a = 0;
+  for (var i = 0; i < n; i++)
+    a += x[j];
+  return a;
+}
+
+var a = foo([1,2,3,4], 3, 100);
+assertEq(a, 400);
+
+var b = foo([1,2,3,4], 5, 100);
+assertEq(b, NaN);
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-04.js b/js/src/jit-test/tests/jaeger/loops/hoist-04.js
new file mode 100644
index 0000000000..f17bd7f737
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-04.js
@@ -0,0 +1,18 @@
+function bar(x, i) {
+  if (i == 50)
+    x.length = 0;
+}
+
+function foo(x, j, n) {
+  var a = 0;
+  for (var i = 0; i < n; i++) {
+    var q = x[j];
+    bar(x, i);
+    if (typeof q == 'undefined')
+      a++;
+  }
+  return a;
+}
+
+var a = foo([1,2,3,4], 3, 100);
+assertEq(a, 49);
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-05.js b/js/src/jit-test/tests/jaeger/loops/hoist-05.js
new file mode 100644
index 0000000000..b99b07893b
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-05.js
@@ -0,0 +1,19 @@
+function bar(x, i) {
+  if (i == 50)
+    foo.arguments[1] = 20;
+}
+
+function foo(x, j, n) {
+  var a = 0;
+  arguments;
+  for (var i = 0; i < n; i++) {
+    var q = x[j];
+    bar(x, i);
+    if (typeof q == 'undefined')
+      a++;
+  }
+  return a;
+}
+
+var a = foo([1,2,3,4], 3, 100);
+assertEq(a, 0);
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-06.js b/js/src/jit-test/tests/jaeger/loops/hoist-06.js
new file mode 100644
index 0000000000..fc2919cda2
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-06.js
@@ -0,0 +1,14 @@
+
+function foo(x, n, y) {
+  var q = 0;
+  for (var j = 0; j < n; j++) {
+    if (x[j] < y)
+      q++;
+  }
+  assertEq(q, 1);
+}
+
+var x = [1,2,3,4,5];
+var y = { valueOf: function() { x.length = 0; return 6; } };
+
+var a = foo(x, 5, y);
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-07.js b/js/src/jit-test/tests/jaeger/loops/hoist-07.js
new file mode 100644
index 0000000000..a409f70559
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-07.js
@@ -0,0 +1,17 @@
+
+var res = 0;
+
+function foo(x, n, y) {
+  for (var j = 0; j < n; j++) {
+    x[j];
+    y.f;
+  }
+}
+
+var x = [1,2,3,4,5];
+var y = {};
+Object.defineProperty(y, 'f', {get:function() { res++; x.length = 2; }});
+
+var a = foo(x, 5, y);
+
+assertEq(res, 5);
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-08.js b/js/src/jit-test/tests/jaeger/loops/hoist-08.js
new file mode 100644
index 0000000000..a695dd1a76
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-08.js
@@ -0,0 +1,7 @@
+
+function foo(x,n) {
+  for (var i = -5; i < n; i++) {
+    x[i] = 10;
+  }
+}
+foo([1,2,3,4,5],5);
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-09.js b/js/src/jit-test/tests/jaeger/loops/hoist-09.js
new file mode 100644
index 0000000000..1b398c7c26
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-09.js
@@ -0,0 +1,11 @@
+
+function foo(x, y) {
+  for (var i = 0; i < x.length; i++) {
+    x[i];
+    if (i < 20)
+      y[i + 1] = 0;
+  }
+}
+
+var q = Array(1,2,3,4,5);
+foo(q, []);
diff --git a/js/src/jit-test/tests/jaeger/loops/hoist-10.js b/js/src/jit-test/tests/jaeger/loops/hoist-10.js
new file mode 100644
index 0000000000..43a3084c9d
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/hoist-10.js
@@ -0,0 +1,39 @@
+function foo1(x, n) {
+  var i = 0;
+  while (--n >= 0) {
+    x[i++] = 0;
+  }
+}
+foo1([1,2,3,4,5],5);
+
+function foo2(x, n) {
+  var i = 0;
+  while (--n >= 0) {
+    x[i++] = 0;
+  }
+}
+foo2([1,2,3,4,5],6);
+
+function foo3(x, n) {
+  var i = 0;
+  while (n-- >= 0) {
+    x[i++] = 0;
+  }
+}
+foo3([1,2,3,4,5],5);
+
+function foo4(x, n) {
+  var i = 0;
+  while (--n >= 0) {
+    x[++i] = 0;
+  }
+}
+foo4([1,2,3,4,5],5);
+
+function foo5(x, n) {
+  var i = 0;
+  while (--n >= 0) {
+    x[++i] = 0;
+  }
+}
+foo5([1,2,3,4,5,6],5);
diff --git a/js/src/jit-test/tests/jaeger/loops/integer-1.js b/js/src/jit-test/tests/jaeger/loops/integer-1.js
new file mode 100644
index 0000000000..f0ef122f3c
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/integer-1.js
@@ -0,0 +1,7 @@
+function foo(x) {
+  for (var i = 0x7ffffff0; i <= x; i++) {
+    var y = i;
+  }
+  return y;
+}
+assertEq(foo(0x7fffffff), 0x7fffffff);
diff --git a/js/src/jit-test/tests/jaeger/loops/integer-2.js b/js/src/jit-test/tests/jaeger/loops/integer-2.js
new file mode 100644
index 0000000000..129c92f1fe
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/integer-2.js
@@ -0,0 +1,10 @@
+function foo(x, y, z, a) {
+  for (var i = 0x7fff; i < 0xffff; i++) {
+    var y = ((x + y) + (z + a[0])) | 0;
+  }
+  return y;
+}
+assertEq(foo(0x7fffffff, 0x7fffffff, 0x7fffffff, [0x7fffffff]), 2147385343);
+
+var q = [0x7fffffff];
+assertEq(eval("foo(0x7fffffff, 0x7fffffff, {valueOf:function() {q[0] = 'e4'; return 0;}}, q)"), 438048096);
diff --git a/js/src/jit-test/tests/jaeger/loops/integer-3.js b/js/src/jit-test/tests/jaeger/loops/integer-3.js
new file mode 100644
index 0000000000..26c7b76a8f
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/integer-3.js
@@ -0,0 +1,7 @@
+function foo(x) {
+  for (var i = 0x7ffffff0; i <= x; i++) {
+    var y = (i % -2147483648);
+  }
+  return y + 5;
+}
+assertEq(foo(0x7fffffff), 0x7fffffff + 5);
diff --git a/js/src/jit-test/tests/jaeger/loops/multiply-by-int32min.js b/js/src/jit-test/tests/jaeger/loops/multiply-by-int32min.js
new file mode 100644
index 0000000000..bc692f1480
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/multiply-by-int32min.js
@@ -0,0 +1,59 @@
+function foo()
+{
+  // Range analysis incorrectly computes a range for the multiplication.  Once
+  // that incorrect range is computed, the goal is to compute a new value whose
+  // range analysis *thinks* is in int32_t range, but which goes past it using
+  // JS semantics.
+  //
+  // On the final iteration, in JS semantics, the multiplication produces 0, and
+  // the next addition 0x7fffffff.  Adding any positive integer to that goes
+  // past int32_t range: here, (0x7fffffff + 5) or 2147483652.
+  //
+  // Range analysis instead thinks the multiplication produces a value in the
+  // range [INT32_MIN, INT32_MIN], and the next addition a value in the range
+  // [-1, -1].  Adding any positive value to that doesn't overflow int32_t range
+  // but *does* overflow the actual range in JS semantics.  Thus omitting
+  // overflow checks produces the value 0x80000004, which interpreting as signed
+  // is (INT32_MIN + 4) or -2147483644.
+  //
+  // For this test to trigger the bug it was supposed to trigger:
+  //
+  //   * 0x7fffffff must be the LHS, not RHS, of the addition in the loop, and
+  //   * i must not be incremented using ++
+  //
+  // The first is required because JM LoopState doesn't treat *both* V + mul and
+  // mul + V as not overflowing, when V is known to be int32_t -- only V + mul.
+  // (JM pessimally assumes V's type might change before it's evaluated.  This
+  // obviously can't happen if V is a constant, but JM's puny little mind
+  // doesn't detect this possibility now.)
+  //
+  // The second is required because JM LoopState only ignores integer overflow
+  // on multiplications if the enclosing loop is a "constrainedLoop" (the name
+  // of the relevant field).  Loops become unconstrained when unhandled ops are
+  // found in the loop.  Increment operators generate a DUP op, which is not
+  // presently a handled op, causing the loop to become unconstrained.
+  for (var i = 0; i < 15; i = i + 1) {
+    var y = (0x7fffffff + ((i & 1) * -2147483648)) + 5;
+  }
+  return y;
+}
+assertEq(foo(), (0x7fffffff + ((14 & 1) * -2147483648)) + 5);
+
+function bar()
+{
+  // Variation on the theme of the above test with -1 as the other half of the
+  // INT32_MIN multiplication, which *should* result in -INT32_MIN on multiply
+  // (exceeding int32_t range).
+  //
+  // Here, range analysis again thinks the range of the multiplication is
+  // INT32_MIN.  We'd overflow-check except that adding zero (on the LHS, see
+  // above) prevents overflow checking, so range analysis thinks the range is
+  // [INT32_MIN, INT32_MIN] when -INT32_MIN is actually possible.  This direct
+  // result of the multiplication is already out of int32_t range, so no need to
+  // add anything to bias it outside int32_t range to get a wrong result.
+  for (var i = 0; i < 17; i = i + 1) {
+    var y = (0 + ((-1 + (i & 1)) * -2147483648));
+  }
+  return y;
+}
+assertEq(bar(), (0 + ((-1 + (16 & 1)) * -2147483648)));
diff --git a/js/src/jit-test/tests/jaeger/loops/property-1.js b/js/src/jit-test/tests/jaeger/loops/property-1.js
new file mode 100644
index 0000000000..81a6b3c360
--- /dev/null
+++ b/js/src/jit-test/tests/jaeger/loops/property-1.js
@@ -0,0 +1,19 @@
+
+function foo(x, y) {
+  var res = 0;
+  for (var i = 0; i < 10; i++) {
+    res += x.f + y[i];
+  }
+  return res;
+}
+
+var x = {f:0};
+var y = Array(10);
+for (var i = 0; i < 10; i++) {
+  if (i == 5)
+    Object.defineProperty(Object.prototype, 5, {get: function() { x.f = 10; return 5}});
+  else
+    y[i] = i;
+}
+
+assertEq(foo(x, y), 85);