Merging upstream version 126.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

3 files changed, 31 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/basic/bug1875795.js b/js/src/jit-test/tests/basic/bug1875795.js
new file mode 100644
index 0000000000..1a5b54acfe
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1875795.js
@@ -0,0 +1,7 @@
+// |jit-test| --fast-warmup; --no-threads; skip-if: !('oomTest' in this)
+oomTest(function() {
+  var o = {};
+  for (var p in this) {
+    o[p] = 1;
+  }
+});
diff --git a/js/src/jit-test/tests/basic/bug1888746.js b/js/src/jit-test/tests/basic/bug1888746.js
new file mode 100644
index 0000000000..8e6d0cd0b9
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1888746.js
@@ -0,0 +1,12 @@
+function comparator(x, y) {
+  saveStack();
+  return {valueOf: function() {
+    saveStack();
+    return x - y;
+  }};
+}
+for (let i = 0; i < 20; i++) {
+  let arr = [3, 1, 2];
+  arr.sort(comparator);
+  assertEq(arr.toString(), "1,2,3");
+}
diff --git a/js/src/jit-test/tests/basic/bug1890200.js b/js/src/jit-test/tests/basic/bug1890200.js
new file mode 100644
index 0000000000..caa97fcece
--- /dev/null
+++ b/js/src/jit-test/tests/basic/bug1890200.js
@@ -0,0 +1,12 @@
+let triggerGC = false;
+let proxy = new Proxy({}, {get: function(target, key) {
+    if (key === "sameCompartmentAs" || key === "sameZoneAs") {
+        triggerGC = true;
+        return newGlobal({newCompartment: true});
+    }
+    if (triggerGC) {
+        gc();
+        triggerGC = false;
+    }
+}});
+newGlobal(proxy);