Adding upstream version 115.7.0esr.upstream/115.7.0esr

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

75 files changed, 2379 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/baseline/accessor-ic-shape-replacement.js b/js/src/jit-test/tests/baseline/accessor-ic-shape-replacement.js
new file mode 100644
index 0000000000..7ddf007858
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/accessor-ic-shape-replacement.js
@@ -0,0 +1,55 @@
+// Make sure we properly update the getter when we update the holder
+// shape in the getter IC.
+function f(obj) {
+    var x;
+    for (var i = 0; i < 20; ++i) {
+	x = obj.foo;
+    }
+    return x;
+}
+
+var proto = {};
+var obj1 = Object.create(proto);
+var obj2 = Object.create(proto);
+obj2.bar = "5";
+Object.defineProperty(proto, "foo",
+		      { get: function() { return 1; }, configurable: true });
+assertEq(f(obj1), 1);
+assertEq(f(obj2), 1);
+
+Object.defineProperty(proto, "foo",
+		      { get: function() { return 2; }, configurable: true });
+assertEq(f(obj1), 2);
+assertEq(f(obj2), 2);
+
+// Make sure we properly update the setter when we update the holder
+// shape in the setter IC.
+function g(obj) {
+    var x;
+    for (var i = 0; i < 20; ++i) {
+	obj.foo = i;
+    }
+    return x;
+}
+
+var proto = {};
+var obj1 = Object.create(proto);
+var obj2 = Object.create(proto);
+var sideEffect;
+obj2.bar = "5";
+Object.defineProperty(proto, "foo",
+		      { set: function() { sideEffect = 1; }, configurable: true });
+g(obj1);
+assertEq(sideEffect, 1);
+sideEffect = undefined;
+g(obj2);
+assertEq(sideEffect, 1);
+sideEffect = undefined;
+
+Object.defineProperty(proto, "foo",
+		      { set: function() { sideEffect = 2; }, configurable: true });
+g(obj1);
+assertEq(sideEffect, 2);
+sideEffect = undefined;
+g(obj2);
+assertEq(sideEffect, 2);
diff --git a/js/src/jit-test/tests/baseline/arraySubclassPropertyLookup.js b/js/src/jit-test/tests/baseline/arraySubclassPropertyLookup.js
new file mode 100644
index 0000000000..62b339f54f
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/arraySubclassPropertyLookup.js
@@ -0,0 +1,17 @@
+function f(v, expected) {
+  assertEq(v.prop, expected);
+};
+
+class SubArrayA extends Array {
+}
+class SubArrayB extends Array {
+}
+SubArrayA.prototype.prop = "A";
+SubArrayB.prototype.prop = "B";
+
+var a = new SubArrayA();
+var b = new SubArrayB();
+for (let i = 0; i < 10; i++) {
+  f(a, "A");
+  f(b, "B");
+}
diff --git a/js/src/jit-test/tests/baseline/bug1024444.js b/js/src/jit-test/tests/baseline/bug1024444.js
new file mode 100644
index 0000000000..7ebd93dcdc
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1024444.js
@@ -0,0 +1,7 @@
+function f(x) {
+    x = eval("a = arguments.callee.arguments; 10");
+}
+for (var i=0; i<5; i++) {
+    f(5);
+    assertEq(a[0], 10);
+}
diff --git a/js/src/jit-test/tests/baseline/bug1054330.js b/js/src/jit-test/tests/baseline/bug1054330.js
new file mode 100644
index 0000000000..eddc6e9adf
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1054330.js
@@ -0,0 +1,50 @@
+function testSplit1() {
+    function split(s, sep) {
+        return s.split(sep);
+    }
+    for (var i=0; i<10; i++) {
+        var arr = split("a,,b", ",");
+        assertEq(arr.length, 3);
+        assertEq(arr[0], "a");
+        assertEq(arr[1], "");
+        assertEq(arr[2], "b");
+    }
+
+    // Now pass a different separator to the stub.
+    var arr = split("a,,b.c", ".");
+    assertEq(arr.length, 2);
+    assertEq(arr[0], "a,,b");
+    assertEq(arr[1], "c");
+}
+
+function testSplit2() {
+    function split(s, sep) {
+        return s.split(sep);
+    }
+    for (var i=0; i<10; i++) {
+        var arr = split("0101", 0);
+        assertEq(arr.length, 3);
+        assertEq(arr[0], "");
+        assertEq(arr[1], "1");
+        assertEq(arr[2], "1");
+    }
+
+    // Now pass a different separator to the stub.
+    var arr = split("0101", 1);
+    assertEq(arr.length, 3);
+    assertEq(arr[0], "0");
+    assertEq(arr[1], "0");
+    assertEq(arr[2], "");
+}
+
+function testSplit3() {
+    for (var i=0; i<100; i++) {
+        var arr = "a|b|c".split("|");
+        arr.push("d");
+        assertEq(arr.length, 4);
+    }
+}
+
+testSplit1();
+testSplit2();
+testSplit3();
diff --git a/js/src/jit-test/tests/baseline/bug1063878.js b/js/src/jit-test/tests/baseline/bug1063878.js
new file mode 100644
index 0000000000..1a569ec2fe
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1063878.js
@@ -0,0 +1,24 @@
+function getx() {
+    return x;
+}
+function gety() {
+    return y;
+}
+function getz() {
+    return z;
+}
+
+function main() {
+    var proto = Object.getPrototypeOf(this);
+    Object.defineProperty(proto, "x", { value: 5});
+    // not-scripted getter
+    Object.defineProperty(proto, "y", { get: String });
+    // scripted getter
+    Object.defineProperty(proto, "z", { get: function () { return 7;} });
+    for (var i=0; i<20; i++) {
+        assertEq(getx(), 5);
+        assertEq(gety(), "");
+	assertEq(getz(), 7);
+    }
+}
+main();
diff --git a/js/src/jit-test/tests/baseline/bug1095870.js b/js/src/jit-test/tests/baseline/bug1095870.js
new file mode 100644
index 0000000000..97a93bda1c
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1095870.js
@@ -0,0 +1,4 @@
+// |jit-test| --ion-eager;
+for (var j = 0; j < 2; j++) {
+    (false).__proto__ = 0
+}
diff --git a/js/src/jit-test/tests/baseline/bug1182866.js b/js/src/jit-test/tests/baseline/bug1182866.js
new file mode 100644
index 0000000000..7628367c7e
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1182866.js
@@ -0,0 +1,18 @@
+// |jit-test| error: ReferenceError
+
+with(7) {
+    function f() {
+        if (i == 15) {
+            g();
+        }
+        const x = 42;
+        function g() {
+            eval("");
+            return x;
+        }
+        return g;
+    }
+}
+for (var i = 0; i < 99; i++) {
+    assertEq(f()(), 42);
+}
diff --git a/js/src/jit-test/tests/baseline/bug1209585.js b/js/src/jit-test/tests/baseline/bug1209585.js
new file mode 100644
index 0000000000..6873fe37d5
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1209585.js
@@ -0,0 +1,38 @@
+// |jit-test| skip-if: helperThreadCount() === 0 || !('oomAtAllocation' in this)
+
+if ("gczeal" in this)
+    gczeal(0);
+
+eval("g=function() {}")
+var lfGlobal = newGlobal();
+for (lfLocal in this) {
+    if (!(lfLocal in lfGlobal)) {
+        lfGlobal[lfLocal] = this[lfLocal];
+    }
+}
+lfGlobal.offThreadCompileToStencil(`
+if (!("oomAtAllocation" in this && "resetOOMFailure" in this))
+    gczeal(0);
+function oomTest(f) {
+    var i = 1;
+    do {
+        try {
+            oomAtAllocation(i);
+            f();
+            more = resetOOMFailure();
+        } catch (e) {
+            more = resetOOMFailure();
+        }
+        i++;
+    } while(more);
+}
+var g = newGlobal();
+oomTest(function() { new revocable(); });
+`);
+try {
+    var stencil = lfGlobal.finishOffThreadStencil();
+    lfGlobal.evalStencil(stencil);
+} catch(e) {
+    // This can happen if we OOM while bailing out in Ion.
+    assertEq(e, "out of memory");
+}
diff --git a/js/src/jit-test/tests/baseline/bug1216140.js b/js/src/jit-test/tests/baseline/bug1216140.js
new file mode 100644
index 0000000000..9aede5c026
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1216140.js
@@ -0,0 +1,6 @@
+function newFunc(x) { return Function(x)(); }
+newFunc(` 
+  var BUGNUMBER = 8[ anonymous = true ]--;
+  () => BUGNUMBER;
+`);
+
diff --git a/js/src/jit-test/tests/baseline/bug1238815.js b/js/src/jit-test/tests/baseline/bug1238815.js
new file mode 100644
index 0000000000..3d4ee3faeb
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1238815.js
@@ -0,0 +1,15 @@
+// This program crashes the ARM code generator because the machine code is
+// longer than the 32MB range of ARM branch instructions.
+//
+// Baseline should not attempt to compile the script.
+
+i = 1;
+function test(s) {
+    return eval("line0 = Error.lineNumber\ndebugger\n" + s);
+}
+function repeat(s) {
+        return Array(65 << 13).join(s)
+}
+long_expr = repeat(" + i")
+long_throw_stmt = long_expr;
+test(long_throw_stmt);
diff --git a/js/src/jit-test/tests/baseline/bug1258301.js b/js/src/jit-test/tests/baseline/bug1258301.js
new file mode 100644
index 0000000000..ce510a0e0b
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1258301.js
@@ -0,0 +1,5 @@
+x = new WeakMap;
+x.__proto__ = null;
+for (var i = 0; i < 3; i++)
+    x.someprop;
+gc();
diff --git a/js/src/jit-test/tests/baseline/bug1344334.js b/js/src/jit-test/tests/baseline/bug1344334.js
new file mode 100644
index 0000000000..8245148833
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1344334.js
@@ -0,0 +1,13 @@
+// |jit-test| skip-if: !('oomTest' in this)
+
+function f(s) {
+    s + "x";
+    s.indexOf("y") === 0;
+    oomTest(new Function(s));
+}
+var s = `
+    class TestClass { constructor() {} }
+    for (var fun of hasPrototype) {}
+`;
+if (s.length)
+    f(s);
diff --git a/js/src/jit-test/tests/baseline/bug1349298.js b/js/src/jit-test/tests/baseline/bug1349298.js
new file mode 100644
index 0000000000..826b60f813
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1349298.js
@@ -0,0 +1,2 @@
+for (var i=0; i<40; i++)
+    assertEq(typeof createIsHTMLDDA(), "undefined");
diff --git a/js/src/jit-test/tests/baseline/bug1368626.js b/js/src/jit-test/tests/baseline/bug1368626.js
new file mode 100644
index 0000000000..637c98efbb
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1368626.js
@@ -0,0 +1,19 @@
+var sandbox = evalcx("lazy");
+
+// Ensure we can't change the "lazy" property of the sandbox to an accessor,
+// because that'd allow to execute arbitrary side-effects when calling the
+// resolve hook of the sandbox.
+var err;
+try {
+    Object.defineProperty(sandbox, "lazy", {
+        get() {
+            Object.defineProperty(sandbox, "foo", { value: 0 });
+        }
+    });
+} catch (e) {
+    err = e;
+}
+assertEq(err instanceof TypeError, true);
+
+// Don't assert here.
+sandbox.foo = 1;
diff --git a/js/src/jit-test/tests/baseline/bug1416727.js b/js/src/jit-test/tests/baseline/bug1416727.js
new file mode 100644
index 0000000000..a407da740d
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1416727.js
@@ -0,0 +1,20 @@
+// |jit-test| allow-overrecursed
+g = newGlobal({newCompartment: true})
+g.parent = this
+g.eval("new Debugger(parent).onExceptionUnwind = function(){}");
+var depth = 0;
+function test() {
+    if (++depth > 50)
+        return;
+    function f(n) {
+        if (n != 0) {
+            f(n - 1);
+            return;
+        }
+        try {
+            test();
+        } finally {}
+    }
+    f(80);
+}
+test();
diff --git a/js/src/jit-test/tests/baseline/bug1463375.js b/js/src/jit-test/tests/baseline/bug1463375.js
new file mode 100644
index 0000000000..8b9030b7fc
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1463375.js
@@ -0,0 +1,5 @@
+// |jit-test| allow-overrecursed
+function f() {
+   f.apply(null, new Array(20000));
+}
+f()
diff --git a/js/src/jit-test/tests/baseline/bug1491337.js b/js/src/jit-test/tests/baseline/bug1491337.js
new file mode 100644
index 0000000000..107507155f
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1491337.js
@@ -0,0 +1,18 @@
+// |jit-test| skip-if: !('oomTest' in this)
+
+oomTest(new Function(`
+  let kJSEmbeddingMaxTypes = 1000000;
+  let kJSEmbeddingMaxFunctions = 1000000;
+  let kJSEmbeddingMaxImports = 100000;
+  const known_failures = {};
+  function test(func, description) {
+    known_failures[description]
+  }
+  function testLimit(name, min, limit, gen) {
+    test(() => {}, \`Validate \${name} mininum\`);
+    test(() => {}, \`Async compile \${name} over limit\`);
+  }
+  testLimit("types", 1, kJSEmbeddingMaxTypes, (builder, count) => {});
+  testLimit("functions", 1, kJSEmbeddingMaxFunctions, (builder, count) => {});
+  testLimit("imports", 1, kJSEmbeddingMaxImports, (builder, count) => {});
+`));
diff --git a/js/src/jit-test/tests/baseline/bug1491350.js b/js/src/jit-test/tests/baseline/bug1491350.js
new file mode 100644
index 0000000000..697a39c50c
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1491350.js
@@ -0,0 +1,10 @@
+// |jit-test| skip-if: !('oomTest' in this)
+
+oomTest(new Function(`
+  var a = ['p', 'q', 'r', 's', 't'];
+  var o = {p:1, q:2, r:3, s:4, t:5};
+  for (var i in o)
+    delete o[i];
+  for (var i of a)
+    o.hasOwnProperty(undefined + this, false);
+`));
diff --git a/js/src/jit-test/tests/baseline/bug1602390.js b/js/src/jit-test/tests/baseline/bug1602390.js
new file mode 100644
index 0000000000..365c13955a
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1602390.js
@@ -0,0 +1,7 @@
+// |jit-test| --ion-osr=off; error:InternalError
+function f() {
+    while (true) {
+        var r = f();
+    }
+}
+f();
diff --git a/js/src/jit-test/tests/baseline/bug1660465.js b/js/src/jit-test/tests/baseline/bug1660465.js
new file mode 100644
index 0000000000..75d203b09a
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug1660465.js
@@ -0,0 +1,9 @@
+// |jit-test| skip-if: helperThreadCount() === 0
+var src = "function foo() {}"
+src += "foo(";
+for (var i = 0; i < 50000; i++) {
+    src += i + ",";
+}
+src += "1);\n"
+
+evalInWorker(src);
diff --git a/js/src/jit-test/tests/baseline/bug836742.js b/js/src/jit-test/tests/baseline/bug836742.js
new file mode 100644
index 0000000000..b8e3761c12
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug836742.js
@@ -0,0 +1,33 @@
+// Ensure the correct frame is passed to exception unwind hooks.
+var g = newGlobal({newCompartment: true});
+g.debuggeeGlobal = this;
+g.eval("(" + function () {
+    frames = [];
+    var dbg = Debugger(debuggeeGlobal);
+    dbg.onEnterFrame = function(frame) {
+	frames.push(frame);
+    };
+    dbg.onExceptionUnwind = function(frame) {
+	assertEq(frames.indexOf(frame), frames.length - 1);
+	frames.pop();
+	assertEq(frame, dbg.getNewestFrame());
+    }
+} + ")()");
+
+function f(n) {
+    debugger;
+    n--;
+    if (n > 0) {
+        f(n);
+    } else {
+	assertEq(g.frames.length, 10);
+        throw "fit";
+    }
+}
+try {
+    f(10);
+    assertEq(0, 1);
+} catch (e) {
+    assertEq(e, "fit");
+}
+assertEq(g.frames.length, 0);
diff --git a/js/src/jit-test/tests/baseline/bug840984.js b/js/src/jit-test/tests/baseline/bug840984.js
new file mode 100644
index 0000000000..410c3a8a4d
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug840984.js
@@ -0,0 +1,17 @@
+function foo() {
+    x = null;
+}
+function f() {
+    for (var i=0; i<99; i++) {
+	x = null;
+	if (i >= 97) {
+	    gc();
+	    gc();
+	    foo();
+	}
+	x = {};
+	if (i >= 97)
+	    foo();
+    }
+}
+f();
diff --git a/js/src/jit-test/tests/baseline/bug841718.js b/js/src/jit-test/tests/baseline/bug841718.js
new file mode 100644
index 0000000000..d8abc66fed
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug841718.js
@@ -0,0 +1,17 @@
+// Don't assert in the decompiler.
+function f() {
+    var o = null;
+
+    try {
+	delete o.prop;
+    } catch(e) {}
+
+    try {
+	delete o[1];
+    } catch(e) {}
+
+    try {
+	o[{}]++;
+    } catch(e) {}
+}
+f();
diff --git a/js/src/jit-test/tests/baseline/bug842313.js b/js/src/jit-test/tests/baseline/bug842313.js
new file mode 100644
index 0000000000..251d86f9fa
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug842313.js
@@ -0,0 +1,7 @@
+function concat(v, index, array) {}
+var strings = ['hello', 'Array', 'WORLD'];
+try {
+    strings.forEach();
+} catch(e) {
+    strings.forEach(concat);
+}
diff --git a/js/src/jit-test/tests/baseline/bug842316.js b/js/src/jit-test/tests/baseline/bug842316.js
new file mode 100644
index 0000000000..028f5ead71
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug842316.js
@@ -0,0 +1,9 @@
+DoWhile( new DoWhileObject( false, true, true, true ) );
+function DoWhileObject( out1, out2, out3, in1 ) {}
+function DoWhile( object ) {
+    if ( object.breakOutOne ) {}
+  innie:
+    do {
+	if ( object.breakOutThree ) {}
+    } while ( false );
+}
diff --git a/js/src/jit-test/tests/baseline/bug842317.js b/js/src/jit-test/tests/baseline/bug842317.js
new file mode 100644
index 0000000000..2092664297
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug842317.js
@@ -0,0 +1,12 @@
+gczeal(2);
+function A(a) { this.a = a; }
+function B(b) { this.b = b; }
+function C(c) { this.c = c; }
+function makeArray(n) {
+    var classes = [A, B, C];
+    var arr = [];
+    for (var i = 0; i < n; i++) {
+        arr.push(new classes[i % 3](i % 3));
+    }
+}
+var arr = makeArray(30000);
diff --git a/js/src/jit-test/tests/baseline/bug842429.js b/js/src/jit-test/tests/baseline/bug842429.js
new file mode 100644
index 0000000000..50434c42a2
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug842429.js
@@ -0,0 +1,11 @@
+function* gen() {
+    try {
+	yield 3;
+    } finally {
+	quit();
+    }
+}
+try {
+    for (var i of gen())
+	foo();
+} catch (e) {}
diff --git a/js/src/jit-test/tests/baseline/bug842430.js b/js/src/jit-test/tests/baseline/bug842430.js
new file mode 100644
index 0000000000..6d3aa5ffd0
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug842430.js
@@ -0,0 +1,5 @@
+test();
+function test() {
+    ({}).abstract;
+}
+test();
diff --git a/js/src/jit-test/tests/baseline/bug842431-1.js b/js/src/jit-test/tests/baseline/bug842431-1.js
new file mode 100644
index 0000000000..2c17b9b060
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug842431-1.js
@@ -0,0 +1,14 @@
+// |jit-test| error:123
+var g = newGlobal({newCompartment: true});
+g.eval('function f() { var y; debugger; }');
+
+var dbg = new Debugger(g);
+
+dbg.onDebuggerStatement = function handleDebugger(frame) {
+    frame.onPop = function(c) {
+	this.eval('y = 33');
+	return {throw: 123};
+    }
+};
+
+g.f();
diff --git a/js/src/jit-test/tests/baseline/bug842431-2.js b/js/src/jit-test/tests/baseline/bug842431-2.js
new file mode 100644
index 0000000000..ddfed1b749
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug842431-2.js
@@ -0,0 +1,25 @@
+// |jit-test|
+
+// If a frame's onPop handler throws, we should not call the
+// onExceptionUnwind hook for that frame.
+var g = newGlobal({newCompartment: true});
+var dbg = new Debugger(g);
+
+g.eval('function f() { var y; debugger; }');
+
+dbg.onExceptionUnwind = function() {
+    assertEq(0, 1);
+};
+
+dbg.onDebuggerStatement = function handleDebugger(frame) {
+    frame.onPop = function(c) {
+	return {throw: 555};
+    }
+};
+
+try {
+    g.f();
+    assertEq(0, 2);
+} catch(e) {
+    assertEq(e.toString().includes("555"), true);
+}
diff --git a/js/src/jit-test/tests/baseline/bug842431-3.js b/js/src/jit-test/tests/baseline/bug842431-3.js
new file mode 100644
index 0000000000..fedd151a13
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug842431-3.js
@@ -0,0 +1,24 @@
+// |jit-test|
+
+// If an exception unwind hook performs a forced return, and this calls an
+// onPop handler that throws, the exception should not be handled in the
+// current frame but propagated to the caller.
+var g = newGlobal({newCompartment: true});
+var dbg = new Debugger(g);
+
+g.eval('function f() { try { var y; throw 123; } catch(e) { assertEq(0, 1); } }');
+
+dbg.onExceptionUnwind = function(frame) {
+    frame.onPop = function() {
+	return {throw: 321};
+    }
+
+    return {return: 11};
+};
+
+try {
+    g.f();
+    assertEq(0, 1);
+} catch(e) {
+    assertEq(e.toString().includes("321"), true);
+}
diff --git a/js/src/jit-test/tests/baseline/bug842432.js b/js/src/jit-test/tests/baseline/bug842432.js
new file mode 100644
index 0000000000..f23198fafd
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug842432.js
@@ -0,0 +1,13 @@
+// |jit-test| error: fff is not
+var g = newGlobal({newCompartment: true});
+var dbg = new Debugger(g);
+
+g.eval('function f(n) { if (n > 0) f(n-1); }');
+
+dbg.onEnterFrame = function(frame) {
+    frame.onPop = function() {
+        fff();
+    };
+};
+
+g.f(5);
diff --git a/js/src/jit-test/tests/baseline/bug843429.js b/js/src/jit-test/tests/baseline/bug843429.js
new file mode 100644
index 0000000000..e161714a02
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug843429.js
@@ -0,0 +1,6 @@
+(function () {
+    const x = [] = [];
+    (function () {
+	String(x);
+    })();
+})();
diff --git a/js/src/jit-test/tests/baseline/bug843886.js b/js/src/jit-test/tests/baseline/bug843886.js
new file mode 100644
index 0000000000..ffe627c397
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug843886.js
@@ -0,0 +1,3 @@
+// |jit-test| error: TypeError
+__proto__["__noSuchMethod__"] = __proto__;
+''.t();
diff --git a/js/src/jit-test/tests/baseline/bug844383.js b/js/src/jit-test/tests/baseline/bug844383.js
new file mode 100644
index 0000000000..9adb6a33a0
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug844383.js
@@ -0,0 +1,22 @@
+s = newGlobal()
+try {
+    evalcx("\
+        function g() {\
+            h()\
+        }\
+        for (p in this) {\
+            function h(h) {\
+                ''instanceof 5\
+            }\
+        }\
+        h.valueOf=g;\
+        h==9\
+    ", s)
+} catch (e) {}
+try {
+    evalcx("throw h", s)
+} catch (e) {
+    try {
+	"" + e
+    } catch(e) {}
+}
diff --git a/js/src/jit-test/tests/baseline/bug844467.js b/js/src/jit-test/tests/baseline/bug844467.js
new file mode 100644
index 0000000000..b4ab4a8835
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug844467.js
@@ -0,0 +1,9 @@
+function test() {
+    var f;
+    function gen() {
+	f = function(){}
+    }
+    for (var i in gen()) {}
+    arguments[arguments.length - 1];
+}
+test();
diff --git a/js/src/jit-test/tests/baseline/bug844470.js b/js/src/jit-test/tests/baseline/bug844470.js
new file mode 100644
index 0000000000..60ff939a4d
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug844470.js
@@ -0,0 +1,9 @@
+// |jit-test| --blinterp-eager
+// See bug 1702259 for rationale for the above jit-test line.
+function f() {
+    var s='';
+    for (var i=0; i < 20000; i++)
+	s += 'x' + i + '=' + i + ';\n';
+    return s;
+}
+eval(f());
diff --git a/js/src/jit-test/tests/baseline/bug844828.js b/js/src/jit-test/tests/baseline/bug844828.js
new file mode 100644
index 0000000000..a9f3234533
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug844828.js
@@ -0,0 +1,9 @@
+gczeal(2);
+eval("\
+for (var z = 0; z < 50; z++) {\
+    try { (function()  {\
+            h\
+        })()\
+    } catch(e) {}\
+}\
+");
diff --git a/js/src/jit-test/tests/baseline/bug845331.js b/js/src/jit-test/tests/baseline/bug845331.js
new file mode 100644
index 0000000000..fd5182a988
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug845331.js
@@ -0,0 +1,9 @@
+function TestCase(n, d, e, a) {};
+function reportCompare (expected, actual) {
+    var testcase = new TestCase("unknown-test-name", null, expected, actual);
+}
+reportCompare();
+var b = eval(String((TestCase)));
+reportCompare(true, true);
+expect = actual = ''
+reportCompare(expect, actual);
diff --git a/js/src/jit-test/tests/baseline/bug847410.js b/js/src/jit-test/tests/baseline/bug847410.js
new file mode 100644
index 0000000000..052f218e03
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug847410.js
@@ -0,0 +1,5 @@
+function h(code) {
+    f = eval("(function(){" + code + "})")
+}
+h("")
+h("debugger;")
diff --git a/js/src/jit-test/tests/baseline/bug847425.js b/js/src/jit-test/tests/baseline/bug847425.js
new file mode 100644
index 0000000000..34197135b6
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug847425.js
@@ -0,0 +1,16 @@
+// |jit-test| allow-oom; allow-unhandlable-oom; skip-if: getBuildConfiguration()['android']
+// Disabled on Android due to harness problems (Bug 1532654)
+
+gcparam("maxBytes", gcparam("gcBytes") + 4*1024);
+var max = 400;
+function f(b) {
+    if (b) {
+        f(b - 1);
+    } else {
+        g = {
+            apply:function(x,y) {            }
+        };
+    }
+    g.apply(null, arguments);
+}
+f(max - 1);
diff --git a/js/src/jit-test/tests/baseline/bug847446.js b/js/src/jit-test/tests/baseline/bug847446.js
new file mode 100644
index 0000000000..c54a375363
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug847446.js
@@ -0,0 +1,22 @@
+// |jit-test| error: ReferenceError
+var k = 0;
+function test() {
+    function* gen()  {
+	try {
+	    try {
+		yield 1;
+	    } finally {
+		if (k++ < 60)
+		    actual += "Inner finally";
+	    }
+	} finally { }
+    }
+    try {
+	var g = gen();
+	assertEq(g.next().value, 1);
+	g.next();
+    } catch (e) {
+	throw e;
+    }
+}
+test();
diff --git a/js/src/jit-test/tests/baseline/bug847484.js b/js/src/jit-test/tests/baseline/bug847484.js
new file mode 100644
index 0000000000..7e271c34bd
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug847484.js
@@ -0,0 +1,14 @@
+function TestCase(n, d) {}
+function reportCompare() {
+    new TestCase;
+}
+Object.defineProperty(Object.prototype, "name", {});
+reportCompare();
+try {
+    function TestCase( n, d ) {
+	this.name = n;
+	this.description = d;
+    }
+    reportCompare();
+    reportCompare();
+} catch(exc3) { assertEq(0, 1); }
diff --git a/js/src/jit-test/tests/baseline/bug847678.js b/js/src/jit-test/tests/baseline/bug847678.js
new file mode 100644
index 0000000000..80ecebfdf0
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug847678.js
@@ -0,0 +1,7 @@
+// |jit-test| error: TypeError
+s = newGlobal();
+function g(c) {
+    evalcx(c, s)
+}
+g("[eval]=(function(){})")
+g("while(eval());")
diff --git a/js/src/jit-test/tests/baseline/bug848743-1.js b/js/src/jit-test/tests/baseline/bug848743-1.js
new file mode 100644
index 0000000000..08bf75fc9e
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug848743-1.js
@@ -0,0 +1,42 @@
+function A() {};
+A.prototype = [];
+
+function B() {};
+B.prototype = new A();
+
+function C() {};
+C.prototype = new B();
+
+function D() {};
+D.prototype = new C();
+
+function E() {};
+E.prototype = new D();
+
+function f() {
+    var o = new B();
+    for (var i=0; i<10; i++)
+	o[i] = i;
+
+    var expected = '{"0":0,"1":1,"2":2,"3":3,"4":4,"5":5,"6":6,"7":7,"8":8,"9":9}';
+    assertEq(JSON.stringify(o), expected);
+
+    var o = new A();
+    for (var i=0; i<10; i++)
+	o[i] = i;
+
+    assertEq(JSON.stringify(o), expected);
+
+    var o = new D();
+    for (var i=0; i<10; i++)
+	o[i] = i;
+
+    assertEq(JSON.stringify(o), expected);
+
+    var o = new E();
+    for (var i=0; i<10; i++)
+	o[i] = i;
+
+    assertEq(JSON.stringify(o), expected);
+}
+f();
diff --git a/js/src/jit-test/tests/baseline/bug848743-2.js b/js/src/jit-test/tests/baseline/bug848743-2.js
new file mode 100644
index 0000000000..b985c6068e
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug848743-2.js
@@ -0,0 +1,14 @@
+var gTestcases = new Array();
+var gTc = gTestcases.length;
+var setterCalled = false;
+function TestCase() {
+    gTestcases[gTc++] = this;
+}
+for(var i = 0; i < 13; ++i) {
+    var testcase = new TestCase();
+}
+Array.prototype.__defineSetter__(32, function() { setterCalled = true; });
+for(var i = 0; i < 20; ++i) {
+    var testcase = new TestCase();
+}
+assertEq(setterCalled, true);
diff --git a/js/src/jit-test/tests/baseline/bug852175.js b/js/src/jit-test/tests/baseline/bug852175.js
new file mode 100644
index 0000000000..ccfc0680d9
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug852175.js
@@ -0,0 +1,5 @@
+// |jit-test| error: InternalError
+var g = newGlobal({newCompartment: true});
+var dbg = new Debugger(g);
+g.eval("function f(n) { if (n == 0) debugger; else f(n - 1); }");
+g.f("function f() { debugger; }");
diff --git a/js/src/jit-test/tests/baseline/bug852801.js b/js/src/jit-test/tests/baseline/bug852801.js
new file mode 100644
index 0000000000..771c4f55bd
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug852801.js
@@ -0,0 +1,106 @@
+// |jit-test| allow-oom; allow-unhandlable-oom
+var STATUS = "STATUS: ";
+var callStack = new Array();
+function startTest() { }
+function TestCase(n, d, e, a) {
+    this.name = n;
+}
+TestCase.prototype.dump = function () {};
+TestCase.prototype.testPassed = (function TestCase_testPassed() { return this.passed; });
+TestCase.prototype.testFailed = (function TestCase_testFailed() { return !this.passed; });
+function printStatus (msg) {
+    var lines = msg.split ("\n");
+    for (var i=0; i<lines.length; i++)
+	print (STATUS + lines[i]);
+}
+function printBugNumber (num) {}
+function toPrinted(value) {
+    return function escapeString (str) {};
+}
+function reportCompare (expected, actual, description) {
+    var actual_t = typeof actual;
+    var output = "";
+    printStatus (
+	"Expected value '"
+	    + toPrinted(expected)
+	    + toPrinted(actual)
+    );
+    var testcase = new TestCase("unknown-test-name", description, expected, actual);
+    testcase.reason = output;
+    if (typeof document != "object" ||      !document.location.href.match(/jsreftest.html/)) {
+	if (testcase.passed)    {    }
+    }
+    return testcase.passed;
+}
+function reportMatch (expectedRegExp, actual, description) {}
+function enterFunc (funcName) {
+    return function BigO(data) {
+        function LinearRegression(data)   {  }
+    };
+}
+function compareSource(expect, actual, summary) {}
+function optionsInit() {
+    var optionNames = options().split(',');
+}
+function optionsClear() {}
+function optionsPush() {}
+optionsInit();
+optionsClear();
+function getTestCaseResult(expected, actual) {
+    return function test() {
+        for ( gTc=0; gTc < gTestcases.length; gTc++ ) {}
+    };
+}
+var lfcode = new Array();
+lfcode.push("4");
+lfcode.push("gcparam(\"maxBytes\", gcparam(\"gcBytes\") + 1024);");
+lfcode.push("");
+lfcode.push("\
+var UBound = 0;\n\
+var BUGNUMBER = 74474;\n\
+var actual = '';\n\
+var actualvalues = [ ];\n\
+var expectedvalues = [ ];\n\
+addThis();\n\
+addThis();\n\
+tryThis(1);\n\
+function tryThis(x)\n\
+{ return addThis(); }\n\
+test();\n\
+function addThis() {\n\
+actualvalues[UBound] = actual;\n\
+UBound++;\n\
+}\n\
+function test() {\n\
+enterFunc ('test');\n\
+printBugNumber(BUGNUMBER);\n\
+for (var i = 0; i < UBound; i++)\n\
+reportCompare(expectedvalues[i], actualvalues[i], getStatus(i));\n\
+}\n\
+function getStatus(i) {}\n\
+");
+delete Debugger;
+while (true) {
+    var file = lfcode.shift(); if (file == undefined) { break; }
+    if (file == "evaluate") {
+    } else {
+        loadFile(file)
+    }
+}
+function loadFile(lfVarx) {
+    try {
+        if (lfVarx.substr(-3) != ".js" && lfVarx.length != 1) {
+            switch (lfRunTypeId) {
+            case 3: function newFunc(x) { new Function(x)(); }; newFunc(lfVarx); break;
+            case 4: eval("(function() { " + lfVarx + " })();"); break;
+            }
+        } else if (!isNaN(lfVarx)) {
+            lfRunTypeId = parseInt(lfVarx);
+            switch (lfRunTypeId) {
+            case 3: function newFunc(x) { new Function(x)(); }; newFunc(lfVarx); break;
+            }
+	}
+    } catch (lfVare) {
+        if (lfVare instanceof SyntaxError) {        }
+    }
+}
diff --git a/js/src/jit-test/tests/baseline/bug857580.js b/js/src/jit-test/tests/baseline/bug857580.js
new file mode 100644
index 0000000000..cfb987a019
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug857580.js
@@ -0,0 +1,13 @@
+gczeal(2,10);
+var g = newGlobal({newCompartment: true});
+var dbg = new Debugger(g);
+dbg.onNewScript = function(script) {
+    fscript = script.getChildScripts()[0];
+}
+g.eval("function f(x) { arguments[0] = 3; return x }");
+fscript.setBreakpoint(0, {hit:function(frame) {
+    assertEq(frame.eval('x').return, 1);
+    gc();
+    return {return:42};
+}});
+assertEq(g.f(1), 42);
diff --git a/js/src/jit-test/tests/baseline/bug877589.js b/js/src/jit-test/tests/baseline/bug877589.js
new file mode 100644
index 0000000000..33619e5242
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug877589.js
@@ -0,0 +1,7 @@
+function x() {
+    [1];
+}
+Array.prototype.__proto__ = {};
+x();
+Array.prototype.__proto__ = null;
+x();
diff --git a/js/src/jit-test/tests/baseline/bug881461.js b/js/src/jit-test/tests/baseline/bug881461.js
new file mode 100644
index 0000000000..becca13012
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug881461.js
@@ -0,0 +1,2 @@
+z = new Proxy({__proto__: (function(){})}, {});
+({__proto__: z, set c(a) {}});
diff --git a/js/src/jit-test/tests/baseline/bug892787-1.js b/js/src/jit-test/tests/baseline/bug892787-1.js
new file mode 100644
index 0000000000..9afb3b4333
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug892787-1.js
@@ -0,0 +1,18 @@
+// Constructing calls must throw if !callee->isInterpretedConstructor().
+[0].some(Function.prototype)
+function f() {
+    new Function.prototype
+}
+function g() {
+    var count = 0;
+    for (var i=0; i<3; i++) {
+	try {
+            f();
+	} catch (e) {
+	    assertEq(e.message.includes("is not a constructor"), true);
+	    count++;
+	}
+    }
+    assertEq(count, 3);
+}
+g();
diff --git a/js/src/jit-test/tests/baseline/bug892787-2.js b/js/src/jit-test/tests/baseline/bug892787-2.js
new file mode 100644
index 0000000000..51381684f5
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug892787-2.js
@@ -0,0 +1,36 @@
+// Constructing calls should throw if !callee->isInterpretedConstructor().
+// This tests the polymorphic call path.
+
+for (var i=0; i<20; i++)
+    Function.prototype();
+
+var funs = [
+    function() { return 1; },
+    function() { return 2; },
+    function() { return 3; },
+    function() { return 4; },
+    function() { return 5; },
+    function() { return 6; },
+    function() { return 7; },
+    function() { return 8; },
+    function() { return 9; },
+    function() { return 10; },
+    Function.prototype
+];
+
+function f(callee) {
+    new callee;
+}
+function g() {
+    var c = 0;
+    for (var i=0; i<50; i++) {
+	try {
+	    f(funs[i % funs.length]);
+	} catch (e) {
+	    assertEq(e.message.includes("not a constructor"), true);
+	    c++;
+	}
+    }
+    assertEq(c, 4);
+}
+g();
diff --git a/js/src/jit-test/tests/baseline/bug916039.js b/js/src/jit-test/tests/baseline/bug916039.js
new file mode 100644
index 0000000000..f35d31ceb0
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug916039.js
@@ -0,0 +1,4 @@
+(function() {
+    "use strict";
+    assertEq(eval("this"), undefined);
+})();
diff --git a/js/src/jit-test/tests/baseline/bug934427.js b/js/src/jit-test/tests/baseline/bug934427.js
new file mode 100644
index 0000000000..0be2118b72
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug934427.js
@@ -0,0 +1,13 @@
+// |jit-test| error: InternalError
+
+function f(){
+  var j;
+  f(0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
+      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
+      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
+      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
+      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
+      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,
+      0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9);
+}
+f()
diff --git a/js/src/jit-test/tests/baseline/bug938130.js b/js/src/jit-test/tests/baseline/bug938130.js
new file mode 100644
index 0000000000..5f0ecbe7e3
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug938130.js
@@ -0,0 +1,7 @@
+// |jit-test| error: TypeError
+
+function f() {    }
+function g() {    }
+var x = [f,f,f,undefined,g];
+for (var i = 0; i < 5; ++i)
+  y = x[i]("x");
diff --git a/js/src/jit-test/tests/baseline/bug940972.js b/js/src/jit-test/tests/baseline/bug940972.js
new file mode 100644
index 0000000000..21def56812
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/bug940972.js
@@ -0,0 +1,5 @@
+setJitCompilerOption("baseline.warmup.trigger", 0);
+var arr = new Uint8ClampedArray(1);
+for (var i = 0; i < 2; ++i)
+    arr[0] = 4294967296;
+assertEq(arr[0], 255);
diff --git a/js/src/jit-test/tests/baseline/callee.js b/js/src/jit-test/tests/baseline/callee.js
new file mode 100644
index 0000000000..328574dcc9
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/callee.js
@@ -0,0 +1,5 @@
+ff = (function g() {
+    for (var i=0; i<15; i++) {}
+    return g;
+});
+assertEq(ff(), ff);
diff --git a/js/src/jit-test/tests/baseline/classConstructor-AnyScripted.js b/js/src/jit-test/tests/baseline/classConstructor-AnyScripted.js
new file mode 100644
index 0000000000..763a8bb7d9
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/classConstructor-AnyScripted.js
@@ -0,0 +1,24 @@
+function test(fun) {
+    fun();
+}
+
+// Generate a CallAnyScripted stub in test()
+for (let i = 0; i < 20; i++) {
+    test(function() { /* wheeee */ });
+}
+
+class foo {
+    constructor() { }
+}
+
+// Compile foo()
+for (let i = 0; i < 11; i++)
+    new foo();
+
+try {
+    test(foo);
+    throw new Error("Invoking a class constructor without new must throw");
+} catch (e) {
+    if (!(e instanceof TypeError))
+        throw e;
+}
diff --git a/js/src/jit-test/tests/baseline/eval-newtarget-osr.js b/js/src/jit-test/tests/baseline/eval-newtarget-osr.js
new file mode 100644
index 0000000000..48bbdba805
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/eval-newtarget-osr.js
@@ -0,0 +1,5 @@
+function f(expected) {
+    eval("for (var i = 0; i < 30; i++) assertEq(new.target, expected)");
+}
+new f(f);
+f(undefined);
diff --git a/js/src/jit-test/tests/baseline/funcall-array.js b/js/src/jit-test/tests/baseline/funcall-array.js
new file mode 100644
index 0000000000..f2f8563f19
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/funcall-array.js
@@ -0,0 +1,70 @@
+
+var emptyArray = [];
+var denseArray = [1, 2, 3, 4];
+var sparseArray = [1,,2,,3,,4];
+var bigArray = new Array();
+for (var i = 0; i < 128; i++) {
+    bigArray.push(i);
+}
+var nonArray = {0:1, 1:2, 2:3, 3:4, length:2};
+var indexedGetterArray = new Array();
+Object.defineProperty(indexedGetterArray, '2', {get:function () { return 51; }});
+
+var ARRAYS = [emptyArray, denseArray, sparseArray, bigArray, nonArray, indexedGetterArray];
+
+var targetFun = function (a, b, c, d) {
+    if (a === undefined)
+        a = 0;
+    if (b === undefined)
+        b = 0;
+    if (c === undefined)
+        c = 0;
+    if (d === undefined)
+        d = 0;
+    this.count += arguments.length + a + b + c + d;
+}
+
+var PERMUTATIONS = ARRAYS.length * ARRAYS.length;
+function arrayPermutation(num) {
+    var idx1 = num % ARRAYS.length;
+    var idx2 = ((num / ARRAYS.length)|0) % ARRAYS.length;
+    var resultArray = [];
+    resultArray.push(ARRAYS[idx1]);
+    resultArray.push(ARRAYS[idx2]);
+    return resultArray;
+}
+var EXPECTED_RESULTS = {
+    0:0, 1:280, 2:200, 3:2680, 4:100, 5:1080, 6:280, 7:560, 8:480, 9:2960,
+    10:380, 11:1360, 12:200, 13:480, 14:400, 15:2880, 16:300, 17:1280, 18:2680,
+    19:2960, 20:2880, 21:5360, 22:2780, 23:3760, 24:100, 25:380, 26:300, 27:2780,
+    28:200, 29:1180, 30:1080, 31:1360, 32:1280, 33:3760, 34:1180, 35:2160
+};
+
+var callerNo = 0;
+function generateCaller() {
+    var fn;
+
+    // Salt eval-string with callerNo to make sure eval caching doesn't take effect.
+    var s = "function caller" + callerNo + "(fn, thisObj, arrays) {" +
+            "  for (var i = 0; i < arrays.length; i++) {" +
+            "    fn.apply(thisObj, arrays[i]);" +
+            "  }" +
+            "}" +
+            "fn = caller" + callerNo + ";";
+    eval(s);
+    return fn;
+};
+
+function main() {
+    for (var i = 0; i < PERMUTATIONS; i++) {
+        var obj = {count:0};
+        var arrs = arrayPermutation(i);
+        var fn = generateCaller(arrs.length);
+        // Loop 20 times so baseline compiler has chance to kick in and compile the scripts.
+        for (var j = 0; j < 20; j++)
+            fn(targetFun, obj, arrs);
+        assertEq(obj.count, EXPECTED_RESULTS[i]);
+    }
+}
+
+main();
diff --git a/js/src/jit-test/tests/baseline/funcall.js b/js/src/jit-test/tests/baseline/funcall.js
new file mode 100644
index 0000000000..a57e0ce97b
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/funcall.js
@@ -0,0 +1,54 @@
+function test1() {
+    var f = function() { return 1; };
+
+    for (var i=0; i<25; i++) {
+	f.call();
+	if (i > 20)
+	    f = Math.abs;
+   }
+}
+test1();
+
+var origCall = Function.prototype.call;
+
+function test2() {
+    var f = function() { return 1; };
+    var c = 0;
+    for (var i=0; i<25; i++) {
+	f.call();
+	if (i > 20)
+	    Function.prototype.call = function() { c++; };
+    }
+    assertEq(c, 3);
+}
+test2();
+Function.prototype.call = origCall;
+
+function test3() {
+    var f = function() { return 1; };
+    for (var i=0; i<25; i++) {
+	f.call();
+	if (i > 20)
+	    Function.prototype.call = undefined;
+    }
+}
+try {
+    test3();
+    assertEq(0, 1);
+} catch(e) {}
+
+Function.prototype.call = origCall;
+
+function test4() {
+    var f = function(a, b, c) {
+	assertEq(arguments.length, 1);
+	assertEq(a, 1);
+	assertEq(b, undefined);
+	assertEq(c, undefined);
+	return 1;
+    };
+    for (var i=0; i<25; i++) {
+	f.call(null, 1);
+    }
+}
+test4();
diff --git a/js/src/jit-test/tests/baseline/getgname-uninitialized-let.js b/js/src/jit-test/tests/baseline/getgname-uninitialized-let.js
new file mode 100644
index 0000000000..6901ded963
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/getgname-uninitialized-let.js
@@ -0,0 +1,8 @@
+for (var i = 0; i < 12; i++) {
+    try {
+        // GetGName
+        void x;
+    } catch (e) { }
+}
+
+let x;
diff --git a/js/src/jit-test/tests/baseline/getname-uninitialized-let.js b/js/src/jit-test/tests/baseline/getname-uninitialized-let.js
new file mode 100644
index 0000000000..a20d4a8906
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/getname-uninitialized-let.js
@@ -0,0 +1,13 @@
+function f() {
+    for (var i = 0; i < 12; i++) {
+        try {
+            eval("");
+
+            void x;
+        } catch (e) { }
+    }
+}
+
+f();
+
+let x;
diff --git a/js/src/jit-test/tests/baseline/getter_setter.js b/js/src/jit-test/tests/baseline/getter_setter.js
new file mode 100644
index 0000000000..1ca3ff8c51
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/getter_setter.js
@@ -0,0 +1,25 @@
+function f() {
+    for (var i=0; i<20; i++) {
+	var o = {x: 1,
+		 get g1() { return this.x; },
+		 set g2(v) { this.x = v; },
+		 get 44() { return this.x },
+		 set 44(v) { this.x = v; }
+		};
+
+	assertEq(o.x, 1);
+	assertEq(o.g1, 1);
+	assertEq(o[44], 1);
+
+	o.g2 = i;
+	assertEq(o.x, i);
+	assertEq(o.g1, i);
+	assertEq(o[44], i);
+
+	o[44] = 33;
+	assertEq(o.x, 33);
+	assertEq(o.g1, 33);
+	assertEq(o[44], 33);
+    }
+}
+f();
diff --git a/js/src/jit-test/tests/baseline/long-proto-chains.js b/js/src/jit-test/tests/baseline/long-proto-chains.js
new file mode 100644
index 0000000000..ceb387b087
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/long-proto-chains.js
@@ -0,0 +1,10 @@
+function f() {
+    var o = {x: 1};
+    for (var i = 0; i < 300; i++)
+        o = Object.create(o);
+    for (var i = 0; i < 15; i++) {
+        assertEq(o.x, 1);
+        assertEq(o.y, undefined);
+    }
+}
+f();
diff --git a/js/src/jit-test/tests/baseline/metadata-hook-on-stack.js b/js/src/jit-test/tests/baseline/metadata-hook-on-stack.js
new file mode 100644
index 0000000000..c2103f32f6
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/metadata-hook-on-stack.js
@@ -0,0 +1,16 @@
+// JSOP_NEWOBJECT should respect the metadata hook, even if
+// it's set with scripts on the stack.
+
+function f() {
+    for (var i=0; i<100; i++) {
+	if (i === 20)
+	    enableShellAllocationMetadataBuilder();
+	var o = {x: 1};
+	if (i >= 20) {
+	    var md = getAllocationMetadata(o);
+	    assertEq(typeof md === "object" && md !== null, true);
+	    assertEq(typeof md.index, "number");
+	}
+    }
+}
+f();
diff --git a/js/src/jit-test/tests/baseline/no-such-property-getprop.js b/js/src/jit-test/tests/baseline/no-such-property-getprop.js
new file mode 100644
index 0000000000..72303d2660
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/no-such-property-getprop.js
@@ -0,0 +1,1025 @@
+/////////////////////////////////////////
+// This is a generated file!
+// See jit-tests/etc/generate-nosuchproperty-tests.js for the code
+// that generated this code!
+/////////////////////////////////////////
+
+/////////////////////////////////////////
+// PRELUDE                             //
+/////////////////////////////////////////
+
+function createTower(n) {
+    var result = Object.create(null);
+    for (var i = 0; i < n; i++)
+        result = Object.create(result);
+    return result;
+}
+function updateChain(obj, depth, prop, value) {
+    // Walk down the proto chain |depth| iterations and set |prop| to |value|.
+    var cur = obj;
+    for (var i = 0; i < depth; i++)
+        cur = Object.getPrototypeOf(cur);
+
+    var desc = {value:value, writable:true, configurable:true, enumerable:true};
+    Object.defineProperty(cur, prop, desc);
+}
+
+/////////////////////////////////////////
+// TEST CASES                          //
+/////////////////////////////////////////
+
+//// Test chain of length 0 with late-property-addition at depth 0
+function runChain_0_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_0_0() {
+    var obj = createTower(0);
+    assertEq(runChain_0_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_0_0(obj), 900);
+}
+
+//// Test chain of length 1 with late-property-addition at depth 0
+function runChain_1_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_1_0() {
+    var obj = createTower(1);
+    assertEq(runChain_1_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_1_0(obj), 900);
+}
+
+//// Test chain of length 1 with late-property-addition at depth 1
+function runChain_1_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_1_1() {
+    var obj = createTower(1);
+    assertEq(runChain_1_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_1_1(obj), 900);
+}
+
+//// Test chain of length 2 with late-property-addition at depth 0
+function runChain_2_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_2_0() {
+    var obj = createTower(2);
+    assertEq(runChain_2_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_2_0(obj), 900);
+}
+
+//// Test chain of length 2 with late-property-addition at depth 1
+function runChain_2_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_2_1() {
+    var obj = createTower(2);
+    assertEq(runChain_2_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_2_1(obj), 900);
+}
+
+//// Test chain of length 2 with late-property-addition at depth 2
+function runChain_2_2(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_2_2() {
+    var obj = createTower(2);
+    assertEq(runChain_2_2(obj), NaN);
+    updateChain(obj, 2, 'foo', 9);
+    assertEq(runChain_2_2(obj), 900);
+}
+
+//// Test chain of length 3 with late-property-addition at depth 0
+function runChain_3_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_3_0() {
+    var obj = createTower(3);
+    assertEq(runChain_3_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_3_0(obj), 900);
+}
+
+//// Test chain of length 3 with late-property-addition at depth 1
+function runChain_3_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_3_1() {
+    var obj = createTower(3);
+    assertEq(runChain_3_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_3_1(obj), 900);
+}
+
+//// Test chain of length 3 with late-property-addition at depth 2
+function runChain_3_2(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_3_2() {
+    var obj = createTower(3);
+    assertEq(runChain_3_2(obj), NaN);
+    updateChain(obj, 2, 'foo', 9);
+    assertEq(runChain_3_2(obj), 900);
+}
+
+//// Test chain of length 3 with late-property-addition at depth 3
+function runChain_3_3(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_3_3() {
+    var obj = createTower(3);
+    assertEq(runChain_3_3(obj), NaN);
+    updateChain(obj, 3, 'foo', 9);
+    assertEq(runChain_3_3(obj), 900);
+}
+
+//// Test chain of length 4 with late-property-addition at depth 0
+function runChain_4_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_4_0() {
+    var obj = createTower(4);
+    assertEq(runChain_4_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_4_0(obj), 900);
+}
+
+//// Test chain of length 4 with late-property-addition at depth 1
+function runChain_4_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_4_1() {
+    var obj = createTower(4);
+    assertEq(runChain_4_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_4_1(obj), 900);
+}
+
+//// Test chain of length 4 with late-property-addition at depth 2
+function runChain_4_2(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_4_2() {
+    var obj = createTower(4);
+    assertEq(runChain_4_2(obj), NaN);
+    updateChain(obj, 2, 'foo', 9);
+    assertEq(runChain_4_2(obj), 900);
+}
+
+//// Test chain of length 4 with late-property-addition at depth 3
+function runChain_4_3(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_4_3() {
+    var obj = createTower(4);
+    assertEq(runChain_4_3(obj), NaN);
+    updateChain(obj, 3, 'foo', 9);
+    assertEq(runChain_4_3(obj), 900);
+}
+
+//// Test chain of length 4 with late-property-addition at depth 4
+function runChain_4_4(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_4_4() {
+    var obj = createTower(4);
+    assertEq(runChain_4_4(obj), NaN);
+    updateChain(obj, 4, 'foo', 9);
+    assertEq(runChain_4_4(obj), 900);
+}
+
+//// Test chain of length 5 with late-property-addition at depth 0
+function runChain_5_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_5_0() {
+    var obj = createTower(5);
+    assertEq(runChain_5_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_5_0(obj), 900);
+}
+
+//// Test chain of length 5 with late-property-addition at depth 1
+function runChain_5_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_5_1() {
+    var obj = createTower(5);
+    assertEq(runChain_5_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_5_1(obj), 900);
+}
+
+//// Test chain of length 5 with late-property-addition at depth 2
+function runChain_5_2(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_5_2() {
+    var obj = createTower(5);
+    assertEq(runChain_5_2(obj), NaN);
+    updateChain(obj, 2, 'foo', 9);
+    assertEq(runChain_5_2(obj), 900);
+}
+
+//// Test chain of length 5 with late-property-addition at depth 3
+function runChain_5_3(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_5_3() {
+    var obj = createTower(5);
+    assertEq(runChain_5_3(obj), NaN);
+    updateChain(obj, 3, 'foo', 9);
+    assertEq(runChain_5_3(obj), 900);
+}
+
+//// Test chain of length 5 with late-property-addition at depth 4
+function runChain_5_4(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_5_4() {
+    var obj = createTower(5);
+    assertEq(runChain_5_4(obj), NaN);
+    updateChain(obj, 4, 'foo', 9);
+    assertEq(runChain_5_4(obj), 900);
+}
+
+//// Test chain of length 5 with late-property-addition at depth 5
+function runChain_5_5(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_5_5() {
+    var obj = createTower(5);
+    assertEq(runChain_5_5(obj), NaN);
+    updateChain(obj, 5, 'foo', 9);
+    assertEq(runChain_5_5(obj), 900);
+}
+
+//// Test chain of length 6 with late-property-addition at depth 0
+function runChain_6_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_6_0() {
+    var obj = createTower(6);
+    assertEq(runChain_6_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_6_0(obj), 900);
+}
+
+//// Test chain of length 6 with late-property-addition at depth 1
+function runChain_6_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_6_1() {
+    var obj = createTower(6);
+    assertEq(runChain_6_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_6_1(obj), 900);
+}
+
+//// Test chain of length 6 with late-property-addition at depth 2
+function runChain_6_2(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_6_2() {
+    var obj = createTower(6);
+    assertEq(runChain_6_2(obj), NaN);
+    updateChain(obj, 2, 'foo', 9);
+    assertEq(runChain_6_2(obj), 900);
+}
+
+//// Test chain of length 6 with late-property-addition at depth 3
+function runChain_6_3(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_6_3() {
+    var obj = createTower(6);
+    assertEq(runChain_6_3(obj), NaN);
+    updateChain(obj, 3, 'foo', 9);
+    assertEq(runChain_6_3(obj), 900);
+}
+
+//// Test chain of length 6 with late-property-addition at depth 4
+function runChain_6_4(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_6_4() {
+    var obj = createTower(6);
+    assertEq(runChain_6_4(obj), NaN);
+    updateChain(obj, 4, 'foo', 9);
+    assertEq(runChain_6_4(obj), 900);
+}
+
+//// Test chain of length 6 with late-property-addition at depth 5
+function runChain_6_5(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_6_5() {
+    var obj = createTower(6);
+    assertEq(runChain_6_5(obj), NaN);
+    updateChain(obj, 5, 'foo', 9);
+    assertEq(runChain_6_5(obj), 900);
+}
+
+//// Test chain of length 6 with late-property-addition at depth 6
+function runChain_6_6(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_6_6() {
+    var obj = createTower(6);
+    assertEq(runChain_6_6(obj), NaN);
+    updateChain(obj, 6, 'foo', 9);
+    assertEq(runChain_6_6(obj), 900);
+}
+
+//// Test chain of length 7 with late-property-addition at depth 0
+function runChain_7_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_7_0() {
+    var obj = createTower(7);
+    assertEq(runChain_7_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_7_0(obj), 900);
+}
+
+//// Test chain of length 7 with late-property-addition at depth 1
+function runChain_7_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_7_1() {
+    var obj = createTower(7);
+    assertEq(runChain_7_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_7_1(obj), 900);
+}
+
+//// Test chain of length 7 with late-property-addition at depth 2
+function runChain_7_2(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_7_2() {
+    var obj = createTower(7);
+    assertEq(runChain_7_2(obj), NaN);
+    updateChain(obj, 2, 'foo', 9);
+    assertEq(runChain_7_2(obj), 900);
+}
+
+//// Test chain of length 7 with late-property-addition at depth 3
+function runChain_7_3(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_7_3() {
+    var obj = createTower(7);
+    assertEq(runChain_7_3(obj), NaN);
+    updateChain(obj, 3, 'foo', 9);
+    assertEq(runChain_7_3(obj), 900);
+}
+
+//// Test chain of length 7 with late-property-addition at depth 4
+function runChain_7_4(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_7_4() {
+    var obj = createTower(7);
+    assertEq(runChain_7_4(obj), NaN);
+    updateChain(obj, 4, 'foo', 9);
+    assertEq(runChain_7_4(obj), 900);
+}
+
+//// Test chain of length 7 with late-property-addition at depth 5
+function runChain_7_5(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_7_5() {
+    var obj = createTower(7);
+    assertEq(runChain_7_5(obj), NaN);
+    updateChain(obj, 5, 'foo', 9);
+    assertEq(runChain_7_5(obj), 900);
+}
+
+//// Test chain of length 7 with late-property-addition at depth 6
+function runChain_7_6(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_7_6() {
+    var obj = createTower(7);
+    assertEq(runChain_7_6(obj), NaN);
+    updateChain(obj, 6, 'foo', 9);
+    assertEq(runChain_7_6(obj), 900);
+}
+
+//// Test chain of length 7 with late-property-addition at depth 7
+function runChain_7_7(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_7_7() {
+    var obj = createTower(7);
+    assertEq(runChain_7_7(obj), NaN);
+    updateChain(obj, 7, 'foo', 9);
+    assertEq(runChain_7_7(obj), 900);
+}
+
+//// Test chain of length 8 with late-property-addition at depth 0
+function runChain_8_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_8_0() {
+    var obj = createTower(8);
+    assertEq(runChain_8_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_8_0(obj), 900);
+}
+
+//// Test chain of length 8 with late-property-addition at depth 1
+function runChain_8_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_8_1() {
+    var obj = createTower(8);
+    assertEq(runChain_8_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_8_1(obj), 900);
+}
+
+//// Test chain of length 8 with late-property-addition at depth 2
+function runChain_8_2(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_8_2() {
+    var obj = createTower(8);
+    assertEq(runChain_8_2(obj), NaN);
+    updateChain(obj, 2, 'foo', 9);
+    assertEq(runChain_8_2(obj), 900);
+}
+
+//// Test chain of length 8 with late-property-addition at depth 3
+function runChain_8_3(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_8_3() {
+    var obj = createTower(8);
+    assertEq(runChain_8_3(obj), NaN);
+    updateChain(obj, 3, 'foo', 9);
+    assertEq(runChain_8_3(obj), 900);
+}
+
+//// Test chain of length 8 with late-property-addition at depth 4
+function runChain_8_4(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_8_4() {
+    var obj = createTower(8);
+    assertEq(runChain_8_4(obj), NaN);
+    updateChain(obj, 4, 'foo', 9);
+    assertEq(runChain_8_4(obj), 900);
+}
+
+//// Test chain of length 8 with late-property-addition at depth 5
+function runChain_8_5(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_8_5() {
+    var obj = createTower(8);
+    assertEq(runChain_8_5(obj), NaN);
+    updateChain(obj, 5, 'foo', 9);
+    assertEq(runChain_8_5(obj), 900);
+}
+
+//// Test chain of length 8 with late-property-addition at depth 6
+function runChain_8_6(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_8_6() {
+    var obj = createTower(8);
+    assertEq(runChain_8_6(obj), NaN);
+    updateChain(obj, 6, 'foo', 9);
+    assertEq(runChain_8_6(obj), 900);
+}
+
+//// Test chain of length 8 with late-property-addition at depth 7
+function runChain_8_7(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_8_7() {
+    var obj = createTower(8);
+    assertEq(runChain_8_7(obj), NaN);
+    updateChain(obj, 7, 'foo', 9);
+    assertEq(runChain_8_7(obj), 900);
+}
+
+//// Test chain of length 8 with late-property-addition at depth 8
+function runChain_8_8(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_8_8() {
+    var obj = createTower(8);
+    assertEq(runChain_8_8(obj), NaN);
+    updateChain(obj, 8, 'foo', 9);
+    assertEq(runChain_8_8(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 0
+function runChain_9_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_0() {
+    var obj = createTower(9);
+    assertEq(runChain_9_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_9_0(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 1
+function runChain_9_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_1() {
+    var obj = createTower(9);
+    assertEq(runChain_9_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_9_1(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 2
+function runChain_9_2(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_2() {
+    var obj = createTower(9);
+    assertEq(runChain_9_2(obj), NaN);
+    updateChain(obj, 2, 'foo', 9);
+    assertEq(runChain_9_2(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 3
+function runChain_9_3(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_3() {
+    var obj = createTower(9);
+    assertEq(runChain_9_3(obj), NaN);
+    updateChain(obj, 3, 'foo', 9);
+    assertEq(runChain_9_3(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 4
+function runChain_9_4(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_4() {
+    var obj = createTower(9);
+    assertEq(runChain_9_4(obj), NaN);
+    updateChain(obj, 4, 'foo', 9);
+    assertEq(runChain_9_4(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 5
+function runChain_9_5(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_5() {
+    var obj = createTower(9);
+    assertEq(runChain_9_5(obj), NaN);
+    updateChain(obj, 5, 'foo', 9);
+    assertEq(runChain_9_5(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 6
+function runChain_9_6(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_6() {
+    var obj = createTower(9);
+    assertEq(runChain_9_6(obj), NaN);
+    updateChain(obj, 6, 'foo', 9);
+    assertEq(runChain_9_6(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 7
+function runChain_9_7(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_7() {
+    var obj = createTower(9);
+    assertEq(runChain_9_7(obj), NaN);
+    updateChain(obj, 7, 'foo', 9);
+    assertEq(runChain_9_7(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 8
+function runChain_9_8(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_8() {
+    var obj = createTower(9);
+    assertEq(runChain_9_8(obj), NaN);
+    updateChain(obj, 8, 'foo', 9);
+    assertEq(runChain_9_8(obj), 900);
+}
+
+//// Test chain of length 9 with late-property-addition at depth 9
+function runChain_9_9(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_9_9() {
+    var obj = createTower(9);
+    assertEq(runChain_9_9(obj), NaN);
+    updateChain(obj, 9, 'foo', 9);
+    assertEq(runChain_9_9(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 0
+function runChain_10_0(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_0() {
+    var obj = createTower(10);
+    assertEq(runChain_10_0(obj), NaN);
+    updateChain(obj, 0, 'foo', 9);
+    assertEq(runChain_10_0(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 1
+function runChain_10_1(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_1() {
+    var obj = createTower(10);
+    assertEq(runChain_10_1(obj), NaN);
+    updateChain(obj, 1, 'foo', 9);
+    assertEq(runChain_10_1(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 2
+function runChain_10_2(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_2() {
+    var obj = createTower(10);
+    assertEq(runChain_10_2(obj), NaN);
+    updateChain(obj, 2, 'foo', 9);
+    assertEq(runChain_10_2(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 3
+function runChain_10_3(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_3() {
+    var obj = createTower(10);
+    assertEq(runChain_10_3(obj), NaN);
+    updateChain(obj, 3, 'foo', 9);
+    assertEq(runChain_10_3(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 4
+function runChain_10_4(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_4() {
+    var obj = createTower(10);
+    assertEq(runChain_10_4(obj), NaN);
+    updateChain(obj, 4, 'foo', 9);
+    assertEq(runChain_10_4(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 5
+function runChain_10_5(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_5() {
+    var obj = createTower(10);
+    assertEq(runChain_10_5(obj), NaN);
+    updateChain(obj, 5, 'foo', 9);
+    assertEq(runChain_10_5(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 6
+function runChain_10_6(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_6() {
+    var obj = createTower(10);
+    assertEq(runChain_10_6(obj), NaN);
+    updateChain(obj, 6, 'foo', 9);
+    assertEq(runChain_10_6(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 7
+function runChain_10_7(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_7() {
+    var obj = createTower(10);
+    assertEq(runChain_10_7(obj), NaN);
+    updateChain(obj, 7, 'foo', 9);
+    assertEq(runChain_10_7(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 8
+function runChain_10_8(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_8() {
+    var obj = createTower(10);
+    assertEq(runChain_10_8(obj), NaN);
+    updateChain(obj, 8, 'foo', 9);
+    assertEq(runChain_10_8(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 9
+function runChain_10_9(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_9() {
+    var obj = createTower(10);
+    assertEq(runChain_10_9(obj), NaN);
+    updateChain(obj, 9, 'foo', 9);
+    assertEq(runChain_10_9(obj), 900);
+}
+
+//// Test chain of length 10 with late-property-addition at depth 10
+function runChain_10_10(obj) {
+    var sum = 0;
+    for (var i = 0; i < 100; i++)
+        sum += obj.foo;
+    return sum;
+}
+function testChain_10_10() {
+    var obj = createTower(10);
+    assertEq(runChain_10_10(obj), NaN);
+    updateChain(obj, 10, 'foo', 9);
+    assertEq(runChain_10_10(obj), 900);
+}
+
+
+/////////////////////////////////////////
+// RUNNER                              //
+/////////////////////////////////////////
+
+testChain_0_0();
+testChain_1_0();
+testChain_1_1();
+testChain_2_0();
+testChain_2_1();
+testChain_2_2();
+testChain_3_0();
+testChain_3_1();
+testChain_3_2();
+testChain_3_3();
+testChain_4_0();
+testChain_4_1();
+testChain_4_2();
+testChain_4_3();
+testChain_4_4();
+testChain_5_0();
+testChain_5_1();
+testChain_5_2();
+testChain_5_3();
+testChain_5_4();
+testChain_5_5();
+testChain_6_0();
+testChain_6_1();
+testChain_6_2();
+testChain_6_3();
+testChain_6_4();
+testChain_6_5();
+testChain_6_6();
+testChain_7_0();
+testChain_7_1();
+testChain_7_2();
+testChain_7_3();
+testChain_7_4();
+testChain_7_5();
+testChain_7_6();
+testChain_7_7();
+testChain_8_0();
+testChain_8_1();
+testChain_8_2();
+testChain_8_3();
+testChain_8_4();
+testChain_8_5();
+testChain_8_6();
+testChain_8_7();
+testChain_8_8();
+testChain_9_0();
+testChain_9_1();
+testChain_9_2();
+testChain_9_3();
+testChain_9_4();
+testChain_9_5();
+testChain_9_6();
+testChain_9_7();
+testChain_9_8();
+testChain_9_9();
+testChain_10_0();
+testChain_10_1();
+testChain_10_2();
+testChain_10_3();
+testChain_10_4();
+testChain_10_5();
+testChain_10_6();
+testChain_10_7();
+testChain_10_8();
+testChain_10_9();
+testChain_10_10();
diff --git a/js/src/jit-test/tests/baseline/osr-large-stack-frame.js b/js/src/jit-test/tests/baseline/osr-large-stack-frame.js
new file mode 100644
index 0000000000..bcaca2cfc2
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/osr-large-stack-frame.js
@@ -0,0 +1,18 @@
+// Creates a huge stack frame and uses OSR. See bug 1839669.
+function f() {
+    var varinits = [];
+    var varnames = [];
+    for (var i = 0; i < 19553; i++) {
+        var varname = `x${i}`;
+        varnames.push(varname);
+        varinits.push(`${varname} = ${i}`);
+    }
+    var source = "var " + varinits.join(",") + ";\n";
+    source += "for (var i = 0; i < 100; i++) {}\n";
+    source += "return " + varnames.join("+") + ";";
+
+    var g = new Function(source);
+    assertEq(g(), 191150128);
+    assertEq(g(), 191150128);
+}
+f();
diff --git a/js/src/jit-test/tests/baseline/setcall.js b/js/src/jit-test/tests/baseline/setcall.js
new file mode 100644
index 0000000000..c5b6494aac
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/setcall.js
@@ -0,0 +1,32 @@
+load(libdir + 'asserts.js');
+
+var calls = 0;
+function g() {
+    calls++;
+};
+function test1() {
+    for (var i=0; i<20; i++) {
+	if (i > 18)
+	    g() = 2;
+    }
+}
+assertThrowsInstanceOf(test1, ReferenceError);
+assertEq(calls, 1);
+
+function test2() {
+    for (var i=0; i<20; i++) {
+	if (i > 18)
+	    g()++;
+    }
+}
+assertThrowsInstanceOf(test2, ReferenceError);
+assertEq(calls, 2);
+
+function test3() {
+    for (var i=0; i<20; i++) {
+	if (i > 18)
+	    g() >>= 2;
+    }
+}
+assertThrowsInstanceOf(test3, ReferenceError);
+assertEq(calls, 3);
diff --git a/js/src/jit-test/tests/baseline/try-finally-1.js b/js/src/jit-test/tests/baseline/try-finally-1.js
new file mode 100644
index 0000000000..8ce4f5a89b
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/try-finally-1.js
@@ -0,0 +1,28 @@
+function test1() {
+    try {
+	return "try";
+    } finally {
+	return "finally";
+    }
+}
+assertEq(test1(), "finally");
+
+function test2() {
+    try {
+	throw 4;
+    } catch(e) {
+	return "catch";
+    } finally {
+	return "finally";
+    }
+}
+assertEq(test2(), "finally");
+
+function test3() {
+    try {
+	throw 4;
+    } finally {
+	return "finally"; // Don't rethrow.
+    }
+}
+assertEq(test3(), "finally");
diff --git a/js/src/jit-test/tests/baseline/try-finally-2.js b/js/src/jit-test/tests/baseline/try-finally-2.js
new file mode 100644
index 0000000000..1a51a6af12
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/try-finally-2.js
@@ -0,0 +1,37 @@
+var count = 0;
+function f() {
+    try {
+	try {
+	    try {
+		count += 2;
+	    } finally {
+		count += 3;
+		throw 3;
+	    }
+	} catch(e) {
+	    count += 4;
+	    throw 4;
+	}
+    } finally {
+	count += 5;
+	try {
+	    count += 6;
+	} catch(e) {
+	    count += 7;
+	    throw 123;
+	} finally {
+	    count += 8;
+	}
+	count += 9;
+    }
+    count += 10;
+}
+for (var i=0; i<3; i++) {
+    try {
+	f();
+	assertEq(0, 1);
+    } catch(e) {
+	assertEq(e, 4);
+    }
+}
+assertEq(count, 111);
diff --git a/js/src/jit-test/tests/baseline/try-finally-3.js b/js/src/jit-test/tests/baseline/try-finally-3.js
new file mode 100644
index 0000000000..23bfacbeb5
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/try-finally-3.js
@@ -0,0 +1,30 @@
+// Test optimized RetSub stubs.
+var count = 0;
+function f(x) {
+    try {
+	if (x < 0)
+	    throw "negative";
+	if (x & 1)
+	    return "odd";
+	count++;
+    } finally {
+	count += 3;
+    }
+
+    return "even";
+}
+for (var i=0; i<15; i++) {
+    var res = f(i);
+    if ((i % 2) === 0)
+	assertEq(res, "even");
+    else
+	assertEq(res, "odd");
+}
+try {
+    f(-1);
+    assertEq(0, 1);
+} catch(e) {
+    assertEq(e, "negative");
+}
+
+assertEq(count, 56);
diff --git a/js/src/jit-test/tests/baseline/try-finally-osr.js b/js/src/jit-test/tests/baseline/try-finally-osr.js
new file mode 100644
index 0000000000..4a58aec711
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/try-finally-osr.js
@@ -0,0 +1,29 @@
+var count = 0;
+
+// OSR into a finally block should not throw away the frame's
+// return value.
+function test1() {
+    try {
+	return [1, 2, 3];
+    } finally {
+	for (var i=0; i<20; i++) { count++; }
+    }
+}
+assertEq(test1().toString(), "1,2,3");
+assertEq(count, 20);
+
+// OSR into the finally block, with exception pending.
+function test2() {
+    try {
+	throw 3;
+    } finally {
+	for (var i=0; i<20; i++) { count++; }
+    }
+}
+try {
+    test2();
+    assertEq(0, 1);
+} catch(e) {
+    assertEq(e, 3);
+}
+assertEq(count, 40);
diff --git a/js/src/jit-test/tests/baseline/unboxed-expando-type-update.js b/js/src/jit-test/tests/baseline/unboxed-expando-type-update.js
new file mode 100644
index 0000000000..ad7bca5b77
--- /dev/null
+++ b/js/src/jit-test/tests/baseline/unboxed-expando-type-update.js
@@ -0,0 +1,18 @@
+function f() {
+    var a = [];
+    for (var i=0; i<100; i++)
+        a.push({x: i});
+
+    var vals = [1, "", true, null];
+
+    for (var j=0; j<100; j++) {
+        var v = vals[j % vals.length];
+        a[95].y = v;
+        assertEq(a[95].y, v);
+        a[j].z1 = v;
+        a[j].z2 = v;
+        assertEq(a[j].z1, v);
+        assertEq(a[j].z2, v);
+    }
+}
+f();