summaryrefslogtreecommitdiffstats
path: root/js/src/jit-test/tests/pic
diff options
context:
space:
mode:
authorDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
committerDaniel Baumann <daniel.baumann@progress-linux.org>2024-04-07 19:33:14 +0000
commit36d22d82aa202bb199967e9512281e9a53db42c9 (patch)
tree105e8c98ddea1c1e4784a60a5a6410fa416be2de /js/src/jit-test/tests/pic
parentInitial commit. (diff)
downloadfirefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.tar.xz
firefox-esr-36d22d82aa202bb199967e9512281e9a53db42c9.zip
Adding upstream version 115.7.0esr.upstream/115.7.0esr
Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
Diffstat (limited to 'js/src/jit-test/tests/pic')
-rw-r--r--js/src/jit-test/tests/pic/arguments.js23
-rw-r--r--js/src/jit-test/tests/pic/bug584642.js3
-rw-r--r--js/src/jit-test/tests/pic/bug595706.js19
-rw-r--r--js/src/jit-test/tests/pic/bug645184.js8
-rw-r--r--js/src/jit-test/tests/pic/call_self.js15
-rw-r--r--js/src/jit-test/tests/pic/callname-eager-this1.js11
-rw-r--r--js/src/jit-test/tests/pic/callname-eager-this2.js25
-rw-r--r--js/src/jit-test/tests/pic/callname-global1.js35
-rw-r--r--js/src/jit-test/tests/pic/callname-global2.js15
-rw-r--r--js/src/jit-test/tests/pic/callname-with.js15
-rw-r--r--js/src/jit-test/tests/pic/densearray.js12
-rw-r--r--js/src/jit-test/tests/pic/getelem-large-index.js13
-rw-r--r--js/src/jit-test/tests/pic/grandproto.js28
-rw-r--r--js/src/jit-test/tests/pic/length_array.js16
-rw-r--r--js/src/jit-test/tests/pic/length_mix.js22
-rw-r--r--js/src/jit-test/tests/pic/length_object.js16
-rw-r--r--js/src/jit-test/tests/pic/length_string.js16
-rw-r--r--js/src/jit-test/tests/pic/length_string_object.js36
-rw-r--r--js/src/jit-test/tests/pic/proto1.js24
-rw-r--r--js/src/jit-test/tests/pic/proto3.js32
-rw-r--r--js/src/jit-test/tests/pic/proto_self.js39
-rw-r--r--js/src/jit-test/tests/pic/self1.js18
-rw-r--r--js/src/jit-test/tests/pic/self2.js18
-rw-r--r--js/src/jit-test/tests/pic/self3.js19
-rw-r--r--js/src/jit-test/tests/pic/self8.js32
-rw-r--r--js/src/jit-test/tests/pic/set-assign.js10
-rw-r--r--js/src/jit-test/tests/pic/set1.js11
-rw-r--r--js/src/jit-test/tests/pic/set2.js14
-rw-r--r--js/src/jit-test/tests/pic/shape_regen.js33
-rw-r--r--js/src/jit-test/tests/pic/thisprop.js30
-rw-r--r--js/src/jit-test/tests/pic/to-dictionary.js9
31 files changed, 617 insertions, 0 deletions
diff --git a/js/src/jit-test/tests/pic/arguments.js b/js/src/jit-test/tests/pic/arguments.js
new file mode 100644
index 0000000000..0ca82f690d
--- /dev/null
+++ b/js/src/jit-test/tests/pic/arguments.js
@@ -0,0 +1,23 @@
+function f() {
+ var args = arguments, r;
+
+ for (var i = 0; i < args.length; i++)
+ r = args[i];
+
+ return r;
+}
+
+assertEq(f.apply(null, [1, 2, 3, 4, 5, 6]), 6)
+assertEq(f.apply(null, [1, 2, 3, 4, 5]), 5)
+assertEq(f.apply(null, [1, 2, 3, 4]), 4)
+
+function g(arg) {
+ var r;
+ for (var i = 0; i < arg.length; i++)
+ r = arg[i];
+ return r;
+}
+
+assertEq(g((function () { return arguments; }).call(null, 1, 2, 3)), 3);
+assertEq(g(new Float32Array(3)), 0.0);
+assertEq(g([1, 2, 3, 4]), 4);
diff --git a/js/src/jit-test/tests/pic/bug584642.js b/js/src/jit-test/tests/pic/bug584642.js
new file mode 100644
index 0000000000..ebf4d78553
--- /dev/null
+++ b/js/src/jit-test/tests/pic/bug584642.js
@@ -0,0 +1,3 @@
+// |jit-test| error: ReferenceError
+Function("x=[(x)=s]")();
+/* Don't assert. */
diff --git a/js/src/jit-test/tests/pic/bug595706.js b/js/src/jit-test/tests/pic/bug595706.js
new file mode 100644
index 0000000000..63c031ad07
--- /dev/null
+++ b/js/src/jit-test/tests/pic/bug595706.js
@@ -0,0 +1,19 @@
+function f(useArg2, arg2, expect) {
+ var args = arguments;
+ if (useArg2)
+ args = arg2;
+
+ print(args)
+ assertEq(args.length, expect);
+}
+
+// Generate a PIC for arguments.
+f(false, 0, 3);
+f(false, 0, 3);
+f(false, 0, 3);
+
+// Now call it with a slow array.
+var a = [1, 2, 3];
+a.x = 9;
+
+f(true, a, 3);
diff --git a/js/src/jit-test/tests/pic/bug645184.js b/js/src/jit-test/tests/pic/bug645184.js
new file mode 100644
index 0000000000..80d20d45a4
--- /dev/null
+++ b/js/src/jit-test/tests/pic/bug645184.js
@@ -0,0 +1,8 @@
+var obj = new Object();
+var passed = true;
+for (var i = 0; i < 100; i++) {
+ if (obj['-1'] == null)
+ obj['-1'] = new Array();
+ assertEq(obj['-1'] == null, false);
+ obj = new Object();
+}
diff --git a/js/src/jit-test/tests/pic/call_self.js b/js/src/jit-test/tests/pic/call_self.js
new file mode 100644
index 0000000000..0709b23472
--- /dev/null
+++ b/js/src/jit-test/tests/pic/call_self.js
@@ -0,0 +1,15 @@
+var o = {
+ g: function(a) {
+ return a;
+ }
+};
+
+function f() {
+ var z;
+ for (var i = 0; i < 10; ++i) {
+ z = o.g(i);
+ assertEq(z, i);
+ }
+}
+
+f();
diff --git a/js/src/jit-test/tests/pic/callname-eager-this1.js b/js/src/jit-test/tests/pic/callname-eager-this1.js
new file mode 100644
index 0000000000..1052ada52a
--- /dev/null
+++ b/js/src/jit-test/tests/pic/callname-eager-this1.js
@@ -0,0 +1,11 @@
+this.name = "outer";
+
+var sb = evalcx('');
+sb.name = "inner";
+sb.parent = this;
+
+function f() {
+ assertEq(this.name, "outer");
+}
+
+evalcx('with(this) { ff = parent.f; }; (function() { eval(""); for(var i=0; i<10; i++) { ff() } })()', sb);
diff --git a/js/src/jit-test/tests/pic/callname-eager-this2.js b/js/src/jit-test/tests/pic/callname-eager-this2.js
new file mode 100644
index 0000000000..86bd740d14
--- /dev/null
+++ b/js/src/jit-test/tests/pic/callname-eager-this2.js
@@ -0,0 +1,25 @@
+this.name = "outer";
+
+var sb = evalcx('');
+sb.name = "inner";
+sb.parent = this;
+
+var res = 0;
+
+function f() {
+ assertEq(this.name, "outer");
+ res++;
+}
+
+// ff is a property of the inner global object. Generate a CALLNAME IC, then
+// change ff to a function on the outer global. It should get the inner this
+// value.
+evalcx('this.ff = function() {};' +
+ '(function() { ' +
+ 'eval("");' +
+ 'for(var i=0; i<10; i++) {' +
+ 'ff();' +
+ 'if (i == 5) ff = parent.f;' +
+ '}' +
+ '})()', sb);
+assertEq(res, 4);
diff --git a/js/src/jit-test/tests/pic/callname-global1.js b/js/src/jit-test/tests/pic/callname-global1.js
new file mode 100644
index 0000000000..ed34ec6b2a
--- /dev/null
+++ b/js/src/jit-test/tests/pic/callname-global1.js
@@ -0,0 +1,35 @@
+// Check that the implicit-this logic needed for CALLNAME global stubs
+// handles non-function values correctly.
+var self = this;
+var count = 0;
+function g1() {
+ assertEq(this, self);
+ this.count++;
+}
+function g2() {
+ this.count += 10;
+}
+function f() {
+ function f1(other) {
+ eval("gc(); h = g1");
+ try {
+ for(var i=0; i<20; i++) {
+ h();
+ if (i === 9) {
+ h = other;
+ }
+ }
+ assertEq(typeof other, "function");
+ } catch(e) {
+ assertEq(typeof other !== "function", true);
+ assertEq(e instanceof TypeError, true);
+ }
+ }
+ f1(3);
+ f1(null);
+ f1({});
+ f1(Math.abs);
+ f1(g2);
+}
+f();
+assertEq(count, 150);
diff --git a/js/src/jit-test/tests/pic/callname-global2.js b/js/src/jit-test/tests/pic/callname-global2.js
new file mode 100644
index 0000000000..5ee3aa2650
--- /dev/null
+++ b/js/src/jit-test/tests/pic/callname-global2.js
@@ -0,0 +1,15 @@
+g0 = function(i) {
+ this["g"+(i+1)] = g0;
+ return "g"+(i+1);
+}
+function f() {
+ a = eval("g0");
+ for(var i=0; i<40; i++) {
+ a = this[a(i)];
+ if (i === 30) {
+ gc();
+ }
+ assertEq(this["g" + i], g0);
+ }
+}
+f();
diff --git a/js/src/jit-test/tests/pic/callname-with.js b/js/src/jit-test/tests/pic/callname-with.js
new file mode 100644
index 0000000000..0a988edbf3
--- /dev/null
+++ b/js/src/jit-test/tests/pic/callname-with.js
@@ -0,0 +1,15 @@
+var res;
+var x = 0;
+
+function f() {
+ x = {x: 1, f: function() { res = this.x; }};
+ with(x) {
+ g = function() {
+ eval("");
+ f();
+ }
+ g();
+ }
+}
+f();
+assertEq(res, 1);
diff --git a/js/src/jit-test/tests/pic/densearray.js b/js/src/jit-test/tests/pic/densearray.js
new file mode 100644
index 0000000000..1d0e8fa7c3
--- /dev/null
+++ b/js/src/jit-test/tests/pic/densearray.js
@@ -0,0 +1,12 @@
+function f() {
+ var o = [ 1, 2, 3, 4, 5 ];
+
+ for (var i = 6; i < 10; ++i)
+ o.push(i);
+
+ return o;
+}
+
+var o = f();
+
+assertEq(o.join(','), [ 1, 2, 3, 4, 5, 6, 7, 8, 9 ].join(',')); \ No newline at end of file
diff --git a/js/src/jit-test/tests/pic/getelem-large-index.js b/js/src/jit-test/tests/pic/getelem-large-index.js
new file mode 100644
index 0000000000..c7f813ea2a
--- /dev/null
+++ b/js/src/jit-test/tests/pic/getelem-large-index.js
@@ -0,0 +1,13 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+function testProperty(i)
+{
+ actual = obj[String(i)];
+}
+
+var obj = {};
+var index = [null, 1073741824, 1073741825];
+for (var j in index)
+ testProperty(index[j]);
diff --git a/js/src/jit-test/tests/pic/grandproto.js b/js/src/jit-test/tests/pic/grandproto.js
new file mode 100644
index 0000000000..0dd65fc328
--- /dev/null
+++ b/js/src/jit-test/tests/pic/grandproto.js
@@ -0,0 +1,28 @@
+function A()
+{
+ this.a = 77;
+ this.b = 88;
+}
+
+function B()
+{
+}
+
+B.prototype = new A;
+
+function C()
+{
+}
+
+C.prototype = new B;
+
+function f() {
+ var o = new C;
+ var z;
+ for (var i = 0; i < 5; ++i) {
+ z = o.a;
+ assertEq(z, 77);
+ }
+}
+
+f(); \ No newline at end of file
diff --git a/js/src/jit-test/tests/pic/length_array.js b/js/src/jit-test/tests/pic/length_array.js
new file mode 100644
index 0000000000..ab77749b76
--- /dev/null
+++ b/js/src/jit-test/tests/pic/length_array.js
@@ -0,0 +1,16 @@
+// length, string
+
+var expected = "3,6,4,3,6,4,3,6,4,3,6,4,";
+var actual = '';
+
+function f() {
+ var ss = [ [1, 2, 3], [1, 2, 3, 4, 5, 6], [1, 2, 3, 4] ];
+
+ for (var i = 0; i < 12; ++i) {
+ actual += ss[i%3].length + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/length_mix.js b/js/src/jit-test/tests/pic/length_mix.js
new file mode 100644
index 0000000000..094762f1e7
--- /dev/null
+++ b/js/src/jit-test/tests/pic/length_mix.js
@@ -0,0 +1,22 @@
+// length, various types
+
+var expected = "4,5,44,5,44,4,44,4,5,4,5,44,5,44,4,44,4,5,";
+var actual = '';
+
+function f() {
+ var a = [ "abcd", [1, 2, 3, 4, 5], { length: 44 } ];
+
+ for (var i = 0; i < 6; ++i) {
+ // Use 3 PICs so we start out with each type in one PIC.
+ var i1 = i % 3;
+ var i2 = (i+1) % 3;
+ var i3 = (i+2) % 3;
+ actual += a[i1].length + ',';
+ actual += a[i2].length + ',';
+ actual += a[i3].length + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/length_object.js b/js/src/jit-test/tests/pic/length_object.js
new file mode 100644
index 0000000000..5f01d57dff
--- /dev/null
+++ b/js/src/jit-test/tests/pic/length_object.js
@@ -0,0 +1,16 @@
+// length, object
+
+var expected = "777,777,777,777,777,";
+var actual = '';
+
+function f() {
+ var o = { a: 11, length: 777, b: 22 };
+
+ for (var i = 0; i < 5; ++i) {
+ actual += o.length + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/length_string.js b/js/src/jit-test/tests/pic/length_string.js
new file mode 100644
index 0000000000..abdf62cbf6
--- /dev/null
+++ b/js/src/jit-test/tests/pic/length_string.js
@@ -0,0 +1,16 @@
+// length, string
+
+var expected = "3,6,4,3,6,4,3,6,4,3,6,4,";
+var actual = '';
+
+function f() {
+ var ss = [ "abc", "foobar", "quux" ];
+
+ for (var i = 0; i < 12; ++i) {
+ actual += ss[i%3].length + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/length_string_object.js b/js/src/jit-test/tests/pic/length_string_object.js
new file mode 100644
index 0000000000..534c6b451e
--- /dev/null
+++ b/js/src/jit-test/tests/pic/length_string_object.js
@@ -0,0 +1,36 @@
+//length, string, object
+
+var expected = "3,6,4,3,6,4,3,6,4,3,6,4,";
+var actual = '';
+
+function f() {
+ var ss = [new String("abc"), new String("foobar"), new String("quux")];
+
+ for (var i = 0; i < 12; ++i) {
+ actual += ss[i%3].length + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
+
+
+function g(s) {
+ return new String(s).length;
+}
+
+assertEq(g("x"), 1); // Warm-up
+assertEq(g("x"), 1); // Create IC
+assertEq(g("x"), 1); // Test IC
+
+function h(s) {
+ var x = new String(s);
+ for (var i = 0; i < 100; i++)
+ x[i] = i;
+ return x.length;
+}
+
+assertEq(h("x"), 1);
+assertEq(h("x"), 1);
+assertEq(h("x"), 1);
diff --git a/js/src/jit-test/tests/pic/proto1.js b/js/src/jit-test/tests/pic/proto1.js
new file mode 100644
index 0000000000..4c98dd7da0
--- /dev/null
+++ b/js/src/jit-test/tests/pic/proto1.js
@@ -0,0 +1,24 @@
+// getprop, proto, 1 shape
+
+var expected = "11,22,33,11,22,33,11,22,33,11,22,33,11,22,33,";
+var actual = '';
+
+var proto = { a: 11, b: 22, c: 33 };
+
+function B() {
+}
+B.prototype = proto;
+
+function f() {
+ var o = new B();
+
+ for (var i = 0; i < 5; ++i) {
+ actual += o.a + ',';
+ actual += o.b + ',';
+ actual += o.c + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/proto3.js b/js/src/jit-test/tests/pic/proto3.js
new file mode 100644
index 0000000000..48800ebb99
--- /dev/null
+++ b/js/src/jit-test/tests/pic/proto3.js
@@ -0,0 +1,32 @@
+// getprop, proto, 3 shapes
+
+var expected = "22,202,202,22,202,202,22,202,202,";
+var actual = '';
+
+var protoB = { a: 11, b: 22, c: 33 };
+
+function B() {
+}
+B.prototype = protoB;
+
+var protoC = { a: 101, b: 202, c: 303 };
+
+function C() {
+}
+C.prototype = protoC;
+
+function f() {
+ var o1 = new B();
+ var o2 = new C();
+ var o3 = new C();
+ o3.q = 99;
+ var oa = [ o1, o2, o3 ];
+
+ for (var i = 0; i < 9; ++i) {
+ actual += oa[i%3].b + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/proto_self.js b/js/src/jit-test/tests/pic/proto_self.js
new file mode 100644
index 0000000000..faa3e4a8ee
--- /dev/null
+++ b/js/src/jit-test/tests/pic/proto_self.js
@@ -0,0 +1,39 @@
+// getprop, proto and self, 3 shapes
+
+var expected = "22,202,99;202,99,22;99,22,202;22,202,99;202,99,22;99,22,202;22,202,99;202,99,22;99,22,202;";
+var actual = '';
+
+var protoB = { a: 11, b: 22, c: 33 };
+
+function B() {
+}
+B.prototype = protoB;
+
+var protoC = { a: 101, b: 202, c: 303 };
+
+function C() {
+}
+C.prototype = protoC;
+
+function f() {
+ var o1 = new B();
+ var o2 = new C();
+ var o3 = new C();
+ o3.b = 99;
+ var oa = [ o1, o2, o3 ];
+
+ for (var i = 0; i < 9; ++i) {
+ // Use 3 PICs so we start out with each type in one PIC.
+ var i1 = i % 3;
+ var i2 = (i+1) % 3;
+ var i3 = (i+2) % 3;
+
+ actual += oa[i1].b + ',';
+ actual += oa[i2].b + ',';
+ actual += oa[i3].b + ';';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/self1.js b/js/src/jit-test/tests/pic/self1.js
new file mode 100644
index 0000000000..3a8d45e520
--- /dev/null
+++ b/js/src/jit-test/tests/pic/self1.js
@@ -0,0 +1,18 @@
+// getprop, self, 1 shape
+
+var expected = "11,22,33,11,22,33,11,22,33,11,22,33,11,22,33,";
+var actual = '';
+
+function f() {
+ var o = { a: 11, b: 22, c: 33 };
+
+ for (var i = 0; i < 5; ++i) {
+ actual += o.a + ',';
+ actual += o.b + ',';
+ actual += o.c + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/self2.js b/js/src/jit-test/tests/pic/self2.js
new file mode 100644
index 0000000000..146771c672
--- /dev/null
+++ b/js/src/jit-test/tests/pic/self2.js
@@ -0,0 +1,18 @@
+// getprop, self, 2 shapes
+
+var expected = "22,303,22,303,22,303,22,303,";
+var actual = '';
+
+function f() {
+ var o1 = { a: 11, b: 22, c: 33 };
+ var o2 = { x: 101, y: 202, b: 303 };
+ var oa = [ o1, o2 ];
+
+ for (var i = 0; i < 8; ++i) {
+ actual += oa[i%2].b + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/self3.js b/js/src/jit-test/tests/pic/self3.js
new file mode 100644
index 0000000000..b865a224d5
--- /dev/null
+++ b/js/src/jit-test/tests/pic/self3.js
@@ -0,0 +1,19 @@
+// getprop, self, 3 shapes
+
+var expected = "22,303,1001,22,303,1001,22,303,";
+var actual = '';
+
+function f() {
+ var o1 = { a: 11, b: 22, c: 33 };
+ var o2 = { x: 101, y: 202, b: 303 };
+ var o3 = { b: 1001, x: 2002, y: 3003 };
+ var oa = [ o1, o2, o3 ];
+
+ for (var i = 0; i < 8; ++i) {
+ actual += oa[i%3].b + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/self8.js b/js/src/jit-test/tests/pic/self8.js
new file mode 100644
index 0000000000..3c0523cb04
--- /dev/null
+++ b/js/src/jit-test/tests/pic/self8.js
@@ -0,0 +1,32 @@
+// getprop, self, 8 shapes
+
+var expected = "0,1,2,3,4,5,6,7,0,1,2,3,4,5,6,7,0,1,2,3,4,5,6,7,";
+var actual = '';
+
+function letter(i) {
+ return String.fromCharCode(97 + i);
+}
+
+function f() {
+ // Build 8 objects with different shapes and x in different slots.
+ var oa = [];
+ for (var i = 0; i < 8; ++i) {
+ var o = {};
+ for (var j = 0; j < 8; ++j) {
+ if (j != i) {
+ o[letter(j)] = 1000 + i * 10 + j;
+ } else {
+ o.x = i;
+ }
+ }
+ oa[i] = o;
+ }
+
+ for (var i = 0; i < 24; ++i) {
+ actual += oa[i%8].x + ',';
+ }
+}
+
+f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/set-assign.js b/js/src/jit-test/tests/pic/set-assign.js
new file mode 100644
index 0000000000..227d92a338
--- /dev/null
+++ b/js/src/jit-test/tests/pic/set-assign.js
@@ -0,0 +1,10 @@
+function f() {
+ var o = { a: 555 };
+
+ for (var j = 0; j < 10; ++j) {
+ var i = o.a = 100 + j;
+ assertEq(i, 100 + j);
+ }
+}
+
+f() \ No newline at end of file
diff --git a/js/src/jit-test/tests/pic/set1.js b/js/src/jit-test/tests/pic/set1.js
new file mode 100644
index 0000000000..58db0a3f0d
--- /dev/null
+++ b/js/src/jit-test/tests/pic/set1.js
@@ -0,0 +1,11 @@
+function f() {
+ var o = { a: 5 };
+
+ for (var i = 0; i < 5; ++i) {
+ o.a = i;
+ }
+
+ assertEq(o.a, 4);
+}
+
+f(); \ No newline at end of file
diff --git a/js/src/jit-test/tests/pic/set2.js b/js/src/jit-test/tests/pic/set2.js
new file mode 100644
index 0000000000..8713642e48
--- /dev/null
+++ b/js/src/jit-test/tests/pic/set2.js
@@ -0,0 +1,14 @@
+function f(k) {
+ var o1 = { a: 5 };
+ var o2 = { b : 7, a : 9 };
+
+ for (var i = 0; i < k; ++i) {
+ var o = i % 2 ? o2 : o1;
+ o.a = i;
+ }
+
+ return o1.a + ',' + o2.a;
+}
+
+assertEq(f(5), '4,3')
+assertEq(f(6), '4,5')
diff --git a/js/src/jit-test/tests/pic/shape_regen.js b/js/src/jit-test/tests/pic/shape_regen.js
new file mode 100644
index 0000000000..55b3ff1cfa
--- /dev/null
+++ b/js/src/jit-test/tests/pic/shape_regen.js
@@ -0,0 +1,33 @@
+// Try to test that we handle shape regeneration correctly.
+// This is a fragile test, but as of this writing, on dmandelin's
+// windows box, we have the same shape number with different
+// logical shapes in the two assertEq lines.
+
+var o;
+var p;
+var zz;
+var o2;
+
+function f(x) {
+ return x.a;
+}
+
+gczeal(1);
+gc();
+
+zz = { q: 11 };
+o = { a: 77, b: 88 };
+o2 = { c: 11 };
+p = { b: 99, a: 11 };
+
+//print('s ' + shapeOf(zz) + ' ' + shapeOf(o) + ' ' + shapeOf(o2) + ' ' + shapeOf(p));
+
+assertEq(f(o), 77);
+
+o = undefined;
+
+gczeal(1);
+gc();
+//print('s ' + 'x' + ' ' + shapeOf(p));
+
+assertEq(f(p), 11);
diff --git a/js/src/jit-test/tests/pic/thisprop.js b/js/src/jit-test/tests/pic/thisprop.js
new file mode 100644
index 0000000000..e20d6993d2
--- /dev/null
+++ b/js/src/jit-test/tests/pic/thisprop.js
@@ -0,0 +1,30 @@
+// test getthisprop
+
+var expected = "22,22,22,;33,33,33,;";
+var actual = '';
+
+function f() {
+ for (var i = 0; i < 3; ++i) {
+ actual += this.b + ',';
+ }
+ actual += ';';
+}
+
+function A() {
+ this.a = 11;
+ this.b = 22;
+};
+
+A.prototype.f = f;
+
+function B() {
+ this.b = 33;
+ this.c = 44;
+};
+
+B.prototype.f = f;
+
+new A().f();
+new B().f();
+
+assertEq(actual, expected);
diff --git a/js/src/jit-test/tests/pic/to-dictionary.js b/js/src/jit-test/tests/pic/to-dictionary.js
new file mode 100644
index 0000000000..e4f22021f8
--- /dev/null
+++ b/js/src/jit-test/tests/pic/to-dictionary.js
@@ -0,0 +1,9 @@
+function f() {
+ var MAX_HEIGHT = 512;
+ var obj = {};
+ for (var i = 0; i < MAX_HEIGHT; i++)
+ obj['a' + i] = i;
+ obj.m = function () { return 0; };
+}
+f();
+f();