Merging upstream version 125.0.1.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

18 files changed, 69 insertions, 21 deletions

diff --git a/js/src/jit-test/tests/ion/array-push-multiple-frozen.js b/js/src/jit-test/tests/ion/array-push-multiple-frozen.js
index 271f6cb07a..da2c7a9262 100644
--- a/js/src/jit-test/tests/ion/array-push-multiple-frozen.js
+++ b/js/src/jit-test/tests/ion/array-push-multiple-frozen.js
@@ -1,4 +1,4 @@
-// |jit-test| --no-threads; skip-if: !('oomAtAllocation' in this)
+// |jit-test| --no-threads
 
 // This test case check's Ion ability to recover from an allocation failure in
 // the inlining of Array.prototype.push, when given multiple arguments. Note,
diff --git a/js/src/jit-test/tests/ion/array-push-multiple-with-funapply.js b/js/src/jit-test/tests/ion/array-push-multiple-with-funapply.js
index b09fa9c440..0d3f174d9d 100644
--- a/js/src/jit-test/tests/ion/array-push-multiple-with-funapply.js
+++ b/js/src/jit-test/tests/ion/array-push-multiple-with-funapply.js
@@ -1,4 +1,4 @@
-// |jit-test| --no-threads; skip-if: !('oomAtAllocation' in this)
+// |jit-test| --no-threads
 
 // This test case check's Ion ability to inline Array.prototype.push, when
 // fun.apply is used and inlined with the set of arguments of the current
diff --git a/js/src/jit-test/tests/ion/array-push-multiple.js b/js/src/jit-test/tests/ion/array-push-multiple.js
index 19c1a93e70..8287d07c94 100644
--- a/js/src/jit-test/tests/ion/array-push-multiple.js
+++ b/js/src/jit-test/tests/ion/array-push-multiple.js
@@ -1,4 +1,4 @@
-// |jit-test| --no-threads; skip-if: !('oomAtAllocation' in this)
+// |jit-test| --no-threads
 
 // This test case check's Ion ability to recover from an allocation failure in
 // the inlining of Array.prototype.push, when given multiple arguments. Note,
diff --git a/js/src/jit-test/tests/ion/bailout-oom-01.js b/js/src/jit-test/tests/ion/bailout-oom-01.js
index b56b323774..0408f44e98 100644
--- a/js/src/jit-test/tests/ion/bailout-oom-01.js
+++ b/js/src/jit-test/tests/ion/bailout-oom-01.js
@@ -1,4 +1,4 @@
-// |jit-test| --no-threads; --fast-warmup; skip-if: !('oomTest' in this)
+// |jit-test| --no-threads; --fast-warmup
 
 setJitCompilerOption("ion.warmup.trigger", 20);
 gczeal(0);
diff --git a/js/src/jit-test/tests/ion/bug1207413.js b/js/src/jit-test/tests/ion/bug1207413.js
index aedb8ece30..e2d5652b33 100644
--- a/js/src/jit-test/tests/ion/bug1207413.js
+++ b/js/src/jit-test/tests/ion/bug1207413.js
@@ -1,5 +1,3 @@
-// |jit-test| skip-if: !('oomAfterAllocations' in this)
-
 function first(a) {
     return a[0];
 }
diff --git a/js/src/jit-test/tests/ion/bug1216157.js b/js/src/jit-test/tests/ion/bug1216157.js
index 1ec9497e40..01a654502b 100644
--- a/js/src/jit-test/tests/ion/bug1216157.js
+++ b/js/src/jit-test/tests/ion/bug1216157.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !('oomAfterAllocations' in this); allow-oom
+// |jit-test| allow-oom
 
 gcslice(0); // Start IGC, but don't mark anything.
 function f(str) {
diff --git a/js/src/jit-test/tests/ion/bug1233331.js b/js/src/jit-test/tests/ion/bug1233331.js
index 11b8faafd1..b181dfb856 100644
--- a/js/src/jit-test/tests/ion/bug1233331.js
+++ b/js/src/jit-test/tests/ion/bug1233331.js
@@ -1,5 +1,3 @@
-// |jit-test| skip-if: !('oomTest' in this)
-
 x = 0;
 try {
     a;
diff --git a/js/src/jit-test/tests/ion/bug1240521.js b/js/src/jit-test/tests/ion/bug1240521.js
index 5955705b7a..3160be7a7d 100644
--- a/js/src/jit-test/tests/ion/bug1240521.js
+++ b/js/src/jit-test/tests/ion/bug1240521.js
@@ -1,4 +1,4 @@
-// |jit-test| allow-oom; skip-if: !('oomAfterAllocations' in this)
+// |jit-test| allow-oom
 
 var egc = 138;
 function SwitchTest(value) {
diff --git a/js/src/jit-test/tests/ion/bug1269756.js b/js/src/jit-test/tests/ion/bug1269756.js
index 659805f16c..1e201f18a4 100644
--- a/js/src/jit-test/tests/ion/bug1269756.js
+++ b/js/src/jit-test/tests/ion/bug1269756.js
@@ -1,5 +1,3 @@
-// |jit-test| skip-if: !('oomTest' in this)
-
 oomTest(function() {
     m = parseModule(`while (x && NaN) prototype; let x`);
     moduleLink(m);
diff --git a/js/src/jit-test/tests/ion/bug1284491.js b/js/src/jit-test/tests/ion/bug1284491.js
index eb8f15619b..f061536bb1 100644
--- a/js/src/jit-test/tests/ion/bug1284491.js
+++ b/js/src/jit-test/tests/ion/bug1284491.js
@@ -1,5 +1,3 @@
-// |jit-test| skip-if: !('oomTest' in this)
-
 loadFile(`
   function SwitchTest(){
     switch(value) {
diff --git a/js/src/jit-test/tests/ion/bug1394505.js b/js/src/jit-test/tests/ion/bug1394505.js
index 84979c046c..49c24d7ec6 100644
--- a/js/src/jit-test/tests/ion/bug1394505.js
+++ b/js/src/jit-test/tests/ion/bug1394505.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: helperThreadCount() === 0 || !('oomTest' in this)
+// |jit-test| skip-if: helperThreadCount() === 0
 
 for (let j = 0; j < 50; j++) {
     if (j === 1)
diff --git a/js/src/jit-test/tests/ion/bug1479394.js b/js/src/jit-test/tests/ion/bug1479394.js
index ef33e35b20..7123a280d9 100644
--- a/js/src/jit-test/tests/ion/bug1479394.js
+++ b/js/src/jit-test/tests/ion/bug1479394.js
@@ -1,4 +1,3 @@
-// |jit-test| skip-if: !('stackTest' in this)
 var dbgGlobal = newGlobal({newCompartment: true});
 var dbg = new dbgGlobal.Debugger(this);
 function f1() {
diff --git a/js/src/jit-test/tests/ion/bug1492574.js b/js/src/jit-test/tests/ion/bug1492574.js
index c1ce0c000a..070d69eaf7 100644
--- a/js/src/jit-test/tests/ion/bug1492574.js
+++ b/js/src/jit-test/tests/ion/bug1492574.js
@@ -1,5 +1,3 @@
-// |jit-test| skip-if: !('oomTest' in this)
-
 function foo() {}
 function foooooooooooooooooooooooooooooooo() {}
 function fn(s) {
diff --git a/js/src/jit-test/tests/ion/bug1568397.js b/js/src/jit-test/tests/ion/bug1568397.js
index c03bb0283d..68fd83a226 100644
--- a/js/src/jit-test/tests/ion/bug1568397.js
+++ b/js/src/jit-test/tests/ion/bug1568397.js
@@ -1,4 +1,4 @@
-// |jit-test| error:TypeError: can't access property
+// |jit-test| --setpref=property_error_message_fix=true; error:TypeError: can't access property "x"
 let obj = {x: 1};
 obj.x = 1.1;
 
diff --git a/js/src/jit-test/tests/ion/bug1877357.js b/js/src/jit-test/tests/ion/bug1877357.js
new file mode 100644
index 0000000000..b1e0d9c686
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1877357.js
@@ -0,0 +1,17 @@
+function f(x) {
+  let y = x | 0;
+  z = 1;
+  Function((x | 0 ? 1 : 9999999999) ? (z ? y : 9999999999) : 1);
+}
+f(1);
+f(1);
+f(1);
+f(1);
+f(1);
+f(1);
+f(1);
+f(1);
+f(9999999999);
+f(1);
+f();
+f(9007199254740993);
diff --git a/js/src/jit-test/tests/ion/bug1877709.js b/js/src/jit-test/tests/ion/bug1877709.js
new file mode 100644
index 0000000000..1dac277a90
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1877709.js
@@ -0,0 +1,22 @@
+function testMathyFunction (f, inputs) {
+  var results = [];
+    for (var j = 0; j < inputs.length; ++j)
+      for (var k = 0; k < inputs.length; ++k)
+        results.push(f(inputs[j], inputs[k]));
+}
+mathy1=(function(stdlib,foreign,heap){
+  ff = foreign.ff;
+  Float32ArrayView = new stdlib.Float32Array(heap);
+  Uint32ArrayView = new stdlib.Uint32Array(heap);
+  function f(d0) {
+    var i2=0;
+    var i4;
+    i2=Float32ArrayView[2];
+    i4=i2;
+    ff(2,0) ? f : 6;
+    Uint32ArrayView[!!d0] + [...[eval]]
+    return i4 ? 1 : 0;
+  }
+return f
+})(this,{ ff:(Function('')) },new SharedArrayBuffer(40));
+testMathyFunction(mathy1,[Math.N,Number.M,(2),Number.M])
diff --git a/js/src/jit-test/tests/ion/dce-with-rinstructions.js b/js/src/jit-test/tests/ion/dce-with-rinstructions.js
index 481a1279ec..5fd530fde4 100644
--- a/js/src/jit-test/tests/ion/dce-with-rinstructions.js
+++ b/js/src/jit-test/tests/ion/dce-with-rinstructions.js
@@ -1983,6 +1983,26 @@ function rnantozero_negzero(i) {
     return i;
 }
 
+let uceFault_ratomicsislockfree_true = eval(`(${uceFault})`.replace('uceFault', 'uceFault_ratomicsislockfree_true'));
+function ratomicsislockfree_true(i) {
+    var x = [1, 2, 4, 8][i & 3];
+    var y = Atomics.isLockFree(x);
+    if (uceFault_ratomicsislockfree_true(i) || uceFault_ratomicsislockfree_true(i))
+        assertEq(y, true);
+    assertRecoveredOnBailout(y, true);
+    return i;
+}
+
+let uceFault_ratomicsislockfree_false = eval(`(${uceFault})`.replace('uceFault', 'uceFault_ratomicsislockfree_false'));
+function ratomicsislockfree_false(i) {
+    var x = [-1, 0, 3, 1000][i & 3];
+    var y = Atomics.isLockFree(x);
+    if (uceFault_ratomicsislockfree_false(i) || uceFault_ratomicsislockfree_false(i))
+        assertEq(y, false);
+    assertRecoveredOnBailout(y, true);
+    return i;
+}
+
 for (j = 100 - max; j < 100; j++) {
     with({}){} // Do not Ion-compile this loop.
     let i = j < 2 ? (Math.abs(j) % 50) + 2 : j;
@@ -2184,6 +2204,8 @@ for (j = 100 - max; j < 100; j++) {
     rnantozero_nan(i);
     rnantozero_poszero(i);
     rnantozero_negzero(i);
+    ratomicsislockfree_true(i);
+    ratomicsislockfree_false(i);
 }
 
 // Test that we can refer multiple time to the same recover instruction, as well
diff --git a/js/src/jit-test/tests/ion/scalar-replacement-oom.js b/js/src/jit-test/tests/ion/scalar-replacement-oom.js
index 32a3a2e5d5..19d0b026e7 100644
--- a/js/src/jit-test/tests/ion/scalar-replacement-oom.js
+++ b/js/src/jit-test/tests/ion/scalar-replacement-oom.js
@@ -1,5 +1,3 @@
-// |jit-test| skip-if: !('oomAtAllocation' in this)
-
 var lfcode = new Array();
 function k(a, f_arg, b, c) {
     for (var i = 0; i < 5; ++i) {