5 files changed, 121 insertions, 1 deletions
diff --git a/js/src/jit-test/tests/ion/bug1608256.js b/js/src/jit-test/tests/ion/bug1608256.js
index 4445a41157..0929f9d3f6 100644
--- a/js/src/jit-test/tests/ion/bug1608256.js
+++ b/js/src/jit-test/tests/ion/bug1608256.js
@@ -1,4 +1,4 @@
-// |jit-test| --no-threads; --baseline-warmup-threshold=1; --ion-full-warmup-threshold=1
+// |jit-test| --no-threads; --baseline-warmup-threshold=1
 function g(obj, v) {
     obj.prop = v;
 }
diff --git a/js/src/jit-test/tests/ion/bug1894456-1.js b/js/src/jit-test/tests/ion/bug1894456-1.js
new file mode 100644
index 0000000000..2b8f3e0afe
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1894456-1.js
@@ -0,0 +1,6 @@
+var f32 = new Float32Array(1);
+for (var i = 0; i < 50; i++) {
+  if (f32[0] != null) {
+  }
+  try {} catch {}
+}
diff --git a/js/src/jit-test/tests/ion/bug1894456-2.js b/js/src/jit-test/tests/ion/bug1894456-2.js
new file mode 100644
index 0000000000..20b019738d
--- /dev/null
+++ b/js/src/jit-test/tests/ion/bug1894456-2.js
@@ -0,0 +1,6 @@
+var f32 = new Float32Array(1);
+for (var i = 0; i < 50; i++) {
+  if (f32[0] != undefined) {
+  }
+  try {} catch {}
+}
diff --git a/js/src/jit-test/tests/ion/depended-on-bit-1.js b/js/src/jit-test/tests/ion/depended-on-bit-1.js
new file mode 100644
index 0000000000..418e7accaa
--- /dev/null
+++ b/js/src/jit-test/tests/ion/depended-on-bit-1.js
@@ -0,0 +1,52 @@
+var dependedOnStrings = [];
+
+var length = 50;
+
+function getSubstr(src, i) {
+  return src.substring(i, i + 50);
+}
+
+function checkProp(o, prop) {
+  return o[prop];
+}
+
+var substrs = [];
+var objs = [];
+
+with({})
+for (var i = 0; i < 1000; i++) {
+  var pieces = [];
+  for (var j = 0; j < 99; j++) {
+    pieces.push("a");
+    pieces.push(Math.floor(Math.random() * 10));
+  }
+  dependedOnStrings.push(pieces.join(""));
+}
+
+for (var i = 0; i < 1000; i++) {
+  // Create a bunch of substrings depending on strings in dependedOnStrings
+  substrs.push(getSubstr(dependedOnStrings[i], (i * 2) % 50));
+  objs.push({});
+}
+
+for (var i = 0; i < 1000; i++) {
+  // Use the depended on strings as keys to get them replaced with
+  // JSAtomRefStrings
+  checkProp(objs[i], dependedOnStrings[i]);
+}
+
+// Use a bunch of memory to try to ensure that we overwrite the buffers
+// that could have erroneously been freed
+for (var i = 0; i < 1000; i++) {
+  var pieces = [];
+  for (var j = 0; j < 99; j++) {
+    pieces.push("b");
+    pieces.push(Math.floor(Math.random() * 10));
+  }
+  dependedOnStrings.push(pieces.join(""));
+}
+
+// Ensure the buffers were not in fact freed
+for (var i = 0; i < 1000; i++) {
+  assertEq(substrs[i].startsWith("a"), true);
+}
diff --git a/js/src/jit-test/tests/ion/depended-on-bit-2.js b/js/src/jit-test/tests/ion/depended-on-bit-2.js
new file mode 100644
index 0000000000..d4090df949
--- /dev/null
+++ b/js/src/jit-test/tests/ion/depended-on-bit-2.js
@@ -0,0 +1,56 @@
+var dependedOnStrings = [];
+
+var length = 50;
+var reg = /q[a0-9]{50}/;
+
+function getSubstr(src, i) {
+  return reg.exec(src)[0];
+}
+
+function checkProp(o, prop) {
+  return o[prop];
+}
+
+var substrs = [];
+var objs = [];
+
+with({})
+for (var i = 0; i < 1000; i++) {
+  var pieces = [];
+  for (var j = 0; j < 99; j++) {
+    if (j == (i * 2) % 50) {
+      pieces.push("q");
+    }
+    pieces.push("a");
+    pieces.push(Math.floor(Math.random() * 10));
+  }
+  dependedOnStrings.push(pieces.join(""));
+}
+
+for (var i = 0; i < 1000; i++) {
+  // Create a bunch of substrings depending on strings in dependedOnStrings
+  substrs.push(getSubstr(dependedOnStrings[i], (i * 2) % 50));
+  objs.push({});
+}
+
+for (var i = 0; i < 1000; i++) {
+  // Use the depended on strings as keys to get them replaced with
+  // JSAtomRefStrings
+  checkProp(objs[i], dependedOnStrings[i]);
+}
+
+// Use a bunch of memory to try to ensure that we overwrite the buffers
+// that could have erroneously been freed
+for (var i = 0; i < 1000; i++) {
+  var pieces = [];
+  for (var j = 0; j < 99; j++) {
+    pieces.push("b");
+    pieces.push(Math.floor(Math.random() * 10));
+  }
+  dependedOnStrings.push(pieces.join(""));
+}
+
+// Ensure the buffers were not in fact freed
+for (var i = 0; i < 1000; i++) {
+  assertEq(substrs[i].startsWith("qa"), true);
+}