3 files changed, 97 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/fuses/cross-realm.js b/js/src/jit-test/tests/fuses/cross-realm.js
new file mode 100644
index 0000000000..0b9c6541b9
--- /dev/null
+++ b/js/src/jit-test/tests/fuses/cross-realm.js
@@ -0,0 +1,57 @@
+// |jit-test|
+
+function f(x) {
+    let [a, b, c] = x;
+    return a + b + c;
+}
+
+function intact(name) {
+    let state = getFuseState();
+    if (!(name in state)) {
+        throw "No such fuse " + name;
+    }
+    return state[name].intact
+}
+
+let didIt = false;
+([])[Symbol.iterator]().__proto__['return'] = () => { didIt = true; return { done: true, value: undefined } };
+assertEq(intact("ArrayIteratorPrototypeHasNoReturnProperty"), false);
+
+assertEq(f([1, 2, 3, 0]), 6);
+assertEq(didIt, true);
+
+didIt = false;
+g = newGlobal();
+g.evaluate(f.toString());
+// Passing in an array from this realm should mean that the return is triggered.
+g.long = [1, 2, 3, 0];
+g.evaluate("assertEq(f(long),6)")
+g.evaluate(intact.toString());
+// ensure fuse isn't popped inside g.
+g.evaluate(`assertEq(intact("ArrayIteratorPrototypeHasNoReturnProperty"), true)`)
+assertEq(didIt, true);
+
+didIt = false;
+g = newGlobal();
+g.evaluate(f.toString());
+// Passing in an array from this realm should mean that the return is triggered.
+g.long = [1, 2, 3, 0];
+
+// Warm up this global's f.
+g.evaluate(`
+for (let i = 0; i < 100; i++) {
+    assertEq(f([1, 2, 3, 0]), 6);
+}
+`);
+
+assertEq(didIt, false);
+g.evaluate("assertEq(f(long), 6)");
+assertEq(didIt, true);
+
+delete Array.prototype[Symbol.iterator]
+let success = false;
+try { f([1, 2, 3, 4]); success = true } catch (e) { }
+assertEq(success, false);
+
+try { g.evaluate("assertEq(f(long), 6)"); success = true } catch (e) { }
+assertEq(success, false);
diff --git a/js/src/jit-test/tests/fuses/htmldda-1.js b/js/src/jit-test/tests/fuses/htmldda-1.js
new file mode 100644
index 0000000000..f64e7efb44
--- /dev/null
+++ b/js/src/jit-test/tests/fuses/htmldda-1.js
@@ -0,0 +1,29 @@
+function f(x, y, z, a, b, c) {
+  let sum = 0;
+  sum += x == undefined ? 1 : 0;
+  sum += y == undefined ? 1 : 0;
+  sum += z == undefined ? 1 : 0;
+  sum += a == undefined ? 1 : 0;
+  sum += b == undefined ? 1 : 0;
+  sum += c == undefined ? 1 : 0;
+  return sum;
+}
+
+let iters = 500;
+function test(x) {
+  let count = 0;
+  let [y, z, a, b, c] = [{}, {}, {}, {}, {}];
+  for (let i = 0; i < iters; i++) {
+    count += f(x, y, z, a, b, c) ? 1 : 0;
+  }
+  return count;
+}
+
+let count = test({});
+assertEq(count, 0);
+
+// pop fuse, and run test again.
+x = createIsHTMLDDA();
+count = test(x);
+
+assertEq(count, iters);
diff --git a/js/src/jit-test/tests/fuses/popped-getiter.js b/js/src/jit-test/tests/fuses/popped-getiter.js
new file mode 100644
index 0000000000..05964585ea
--- /dev/null
+++ b/js/src/jit-test/tests/fuses/popped-getiter.js
@@ -0,0 +1,11 @@
+// This will pop the getiter fuse.
+Array.prototype[Symbol.iterator] = Array.prototype[Symbol.iterator];
+
+function f() {
+    [] = []
+}
+
+// We should nevertheless be able to pass this loop without crashing.
+for (let i = 0; i < 100; i++) {
+    f();
+}