5 files changed, 57 insertions, 3 deletions
diff --git a/js/src/jit-test/tests/warp/bug1665303.js b/js/src/jit-test/tests/warp/bug1665303.js
index b2c26e01cf..3b0bc75079 100644
--- a/js/src/jit-test/tests/warp/bug1665303.js
+++ b/js/src/jit-test/tests/warp/bug1665303.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !('oomTest' in this); --fast-warmup
+// |jit-test| --fast-warmup
 
 // Prevent slowness with --ion-eager.
 setJitCompilerOption("ion.warmup.trigger", 100);
diff --git a/js/src/jit-test/tests/warp/bug1667685.js b/js/src/jit-test/tests/warp/bug1667685.js
index 2b9e392d24..99699b88d5 100644
--- a/js/src/jit-test/tests/warp/bug1667685.js
+++ b/js/src/jit-test/tests/warp/bug1667685.js
@@ -1,4 +1,4 @@
-// |jit-test| skip-if: !('oomTest' in this); --fast-warmup
+// |jit-test| --fast-warmup
 
 // Prevent slowness with --ion-eager.
 setJitCompilerOption("ion.warmup.trigger", 100);
diff --git a/js/src/jit-test/tests/warp/bug1668197.js b/js/src/jit-test/tests/warp/bug1668197.js
index 2dcd6cb376..24e1becec0 100644
--- a/js/src/jit-test/tests/warp/bug1668197.js
+++ b/js/src/jit-test/tests/warp/bug1668197.js
@@ -1,4 +1,3 @@
-// |jit-test| skip-if: !('oomTest' in this)
 function f(x, y) {
     return ~Math.hypot(x >>> 0, 2 - x >>> 0);
 }
diff --git a/js/src/jit-test/tests/warp/bug1871089.js b/js/src/jit-test/tests/warp/bug1871089.js
new file mode 100644
index 0000000000..8abddb6574
--- /dev/null
+++ b/js/src/jit-test/tests/warp/bug1871089.js
@@ -0,0 +1,13 @@
+// |jit-test| --fast-warmup
+var i = 0;
+function a() {
+    if (i++ > 50) {
+        return;
+    }
+    function b() {
+        new a("abcdefghijklm");
+    }
+    [new b];
+}
+gczeal(4);
+a();
diff --git a/js/src/jit-test/tests/warp/trial-inline-gc-4.js b/js/src/jit-test/tests/warp/trial-inline-gc-4.js
new file mode 100644
index 0000000000..2aecd4d371
--- /dev/null
+++ b/js/src/jit-test/tests/warp/trial-inline-gc-4.js
@@ -0,0 +1,42 @@
+// 1) Trial inline f => g1 => h.
+// 2) Make f => g1 call site polymorphic by calling f => g2.
+//    This gets rid of the ICScript::inlinedChildren_ edge.
+// 3) Restore f => g1.
+// 4) Trigger a shrinking GC from f => g1 => h (h not trial-inlined; h preserves Baseline code)
+//    This purges h's inlined ICScript.
+// 5) Call f => g1 => h (trial inlined). This must not use the discarded ICScript.
+function h(i, x) {
+    if (i === 900) {
+        // Step 4.
+        gc(this, "shrinking");
+    }
+    return x + 1;
+}
+function g2(i, x) {
+    if (i === 820) {
+        // Step 3.
+        callee = g1;
+    }
+    return h(i, x) + x;
+}
+function g1(i, x) {
+    if (i === 800) {
+        // Step 2.
+        callee = g2;
+    }
+    if (i === 900) {
+        // Step 4.
+        h(i, x);
+    }
+    return h(i, x) + x;
+}
+
+var callee = g1;
+
+function f() {
+    for (var i = 0; i < 1000; i++) {
+        callee(i, i);
+        callee(i, "foo");
+    }
+}
+f();