Merging upstream version 126.0.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

6 files changed, 135 insertions, 1 deletions

diff --git a/js/src/jit-test/tests/wasm/directiveless/bug1877358.js b/js/src/jit-test/tests/wasm/directiveless/bug1877358.js
index 10cb54398a..8d512efcfe 100644
--- a/js/src/jit-test/tests/wasm/directiveless/bug1877358.js
+++ b/js/src/jit-test/tests/wasm/directiveless/bug1877358.js
@@ -1,4 +1,4 @@
-// |jit-test| -P wasm_exceptions=false; include:wasm.js
+// |jit-test| include:wasm.js
 
 let {test} = wasmEvalText(`(module
 	(func $m (import "" "m"))
diff --git a/js/src/jit-test/tests/wasm/gc/casting.js b/js/src/jit-test/tests/wasm/gc/casting.js
index a71a589db8..3b550e6415 100644
--- a/js/src/jit-test/tests/wasm/gc/casting.js
+++ b/js/src/jit-test/tests/wasm/gc/casting.js
@@ -114,3 +114,72 @@ function testAllCasts(types) {
   }
 }
 testAllCasts(TYPES);
+
+// Test that combinations of ref.test and ref.cast compile correctly.
+// (These can be optimized together.)
+{
+  const { make, test1, test2, test3, test4 } = wasmEvalText(`(module
+    (type $a (array i32))
+    (func (export "make") (param i32) (result anyref)
+      local.get 0
+      local.get 0
+      array.new_fixed $a 2
+    )
+    (func (export "test1") (param anyref) (result i32)
+      (if (ref.test (ref $a) (local.get 0))
+        (then
+          (ref.cast (ref $a) (local.get 0))
+          (array.get $a (i32.const 0))
+          return
+        )
+      )
+      i32.const -1
+    )
+    (func (export "test2") (param anyref) (result i32)
+      (if (ref.test (ref $a) (local.get 0))
+        (then)
+        (else
+          (ref.cast (ref $a) (local.get 0))
+          (array.get $a (i32.const 0))
+          return
+        )
+      )
+      i32.const -1
+    )
+    (func (export "test3") (param anyref) (result i32)
+      (if (ref.test (ref $a) (local.get 0))
+        (then
+          (if (ref.test (ref $a) (local.get 0))
+            (then)
+            (else
+              (ref.cast (ref $a) (local.get 0))
+              (array.get $a (i32.const 0))
+              return
+            )
+          )
+        )
+      )
+      i32.const -1
+    )
+    (func (export "test4") (param anyref) (result i32)
+      (if (ref.test (ref $a) (local.get 0))
+        (then
+          (if (ref.test (ref $a) (local.get 0))
+            (then
+              local.get 0
+              ref.cast (ref $a)
+              ref.cast (ref $a)
+              (array.get $a (i32.const 0))
+              return
+            )
+          )
+        )
+      )
+      i32.const -1
+    )
+  )`).exports;
+  assertEq(test1(make(99)), 99);
+  assertEq(test2(make(99)), -1);
+  assertEq(test3(make(99)), -1);
+  assertEq(test4(make(99)), 99);
+}
diff --git a/js/src/jit-test/tests/wasm/gc/i31ref.js b/js/src/jit-test/tests/wasm/gc/i31ref.js
index 65f2fccc3f..298447e848 100644
--- a/js/src/jit-test/tests/wasm/gc/i31ref.js
+++ b/js/src/jit-test/tests/wasm/gc/i31ref.js
@@ -149,6 +149,24 @@ for (const {input, expected} of bigI32Tests) {
   assertEq(getElem(), expected);
 }
 
+// Test that (ref.i31 (i32 const value)) optimization is correct
+for (let value of WasmI31refValues) {
+  let {compare} = wasmEvalText(`(module
+  (func $innerCompare (param i32) (param i31ref) (result i32)
+    (ref.eq
+      (ref.i31 local.get 0)
+      local.get 1
+    )
+  )
+  (func (export "compare") (result i32)
+    i32.const ${value}
+    (ref.i31 i32.const ${value})
+    call $innerCompare
+  )
+)`).exports;
+  assertEq(compare(value), 1);
+}
+
 const { i31GetU_null, i31GetS_null } = wasmEvalText(`(module
   (func (export "i31GetU_null") (result i32)
     ref.null i31
diff --git a/js/src/jit-test/tests/wasm/regress/bug1886870.js b/js/src/jit-test/tests/wasm/regress/bug1886870.js
new file mode 100644
index 0000000000..a4947bd91a
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/bug1886870.js
@@ -0,0 +1,8 @@
+// Check proper handling of OOM after toQuotedString().
+
+oomTest(function () {
+  new WebAssembly.Instance(
+    new WebAssembly.Module(wasmTextToBinary('(import "m" "f" (func $f))')),
+    {}
+  );
+});
diff --git a/js/src/jit-test/tests/wasm/regress/bug1887535.js b/js/src/jit-test/tests/wasm/regress/bug1887535.js
new file mode 100644
index 0000000000..e2793831bf
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/bug1887535.js
@@ -0,0 +1,25 @@
+// |jit-test| slow;
+
+// Tests the exception handling works during stack overflow.
+const v1 = newGlobal({sameZoneAs: this});
+class C2 {
+    static { }
+}
+
+function f() { v1.constructor; }
+
+const { test } = wasmEvalText(`
+(module
+    (import "" "f" (func $f))
+    (export "test" (func $f))
+)`, { "": { f, },}).exports;
+
+
+function f4() {
+    try {
+       f4();
+    } catch(_) {
+       test(); test();
+    }
+}
+f4();
diff --git a/js/src/jit-test/tests/wasm/regress/bug1887596.js b/js/src/jit-test/tests/wasm/regress/bug1887596.js
new file mode 100644
index 0000000000..8ff579fc35
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/bug1887596.js
@@ -0,0 +1,14 @@
+const t = `
+    (module
+        (func $f (result f32)
+            f32.const 1.25
+        )
+        (table (export "table") 10 funcref)
+        (elem (i32.const 0) $f)
+    )`;
+const i = new WebAssembly.Instance(new WebAssembly.Module(wasmTextToBinary(t)));
+const f = i.exports.table.get(0);
+
+// These FP equality comparisons are safe because 1.25 is representable exactly.
+assertEq(1.25, f());
+assertEq(1.25, this.wasmLosslessInvoke(f).value);