Merging upstream version 127.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

2 files changed, 35 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/wasm/regress/bug1866545.js b/js/src/jit-test/tests/wasm/regress/bug1866545.js
new file mode 100644
index 0000000000..6c6a92c0ab
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/bug1866545.js
@@ -0,0 +1,25 @@
+// Tests stack alignment during tail calls (in Ion).
+
+var ins = wasmEvalText(`
+  (module
+    (func $trap
+        (param $i i32) (param $arr i32)
+        unreachable
+    )
+    (func $second
+      (return_call $trap
+        (i32.const 33)
+        (i32.const 66)
+      )
+    )
+    (func (export "test")
+        (call $second)
+    )
+  )
+`);
+
+assertErrorMessage(
+    () => ins.exports.test(),
+    WebAssembly.RuntimeError,
+    "unreachable executed",
+);
diff --git a/js/src/jit-test/tests/wasm/regress/bug1891658.js b/js/src/jit-test/tests/wasm/regress/bug1891658.js
new file mode 100644
index 0000000000..304ea0f5ea
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/bug1891658.js
@@ -0,0 +1,10 @@
+// Tests OOM during wasmLosslessInvoke.
+
+var ins = wasmEvalText('(module (func (export "f")(result i32) i32.const 1))');
+
+oomAtAllocation(1);
+try {
+  wasmLosslessInvoke(ins.exports.f);
+} catch (e) {
+  assertEq(e, "out of memory");
+}