Adding upstream version 115.7.0esr.upstream/115.7.0esrupstream

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

5 files changed, 89 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/record-tuple/bug-1772597.js b/js/src/jit-test/tests/record-tuple/bug-1772597.js
new file mode 100644
index 0000000000..a220a813fe
--- /dev/null
+++ b/js/src/jit-test/tests/record-tuple/bug-1772597.js
@@ -0,0 +1,23 @@
+// |jit-test| skip-if: !this.hasOwnProperty("Tuple")
+
+gczeal(14);
+
+var c = #["a", "b", "c"]; // Need at least 3 elements to trigger the bug
+var t;
+
+for (i = 0; i < 2; i++) {
+    /*
+       To trigger the bug, the calculated tenured size needs to exceed
+       the size of the nursery during the previous GC. So we call Tuple.with(),
+       which is implemented in C++, because most of the self-hosted Tuple
+       methods allocate temporary space that increases the nursery size,
+       masking the bug.
+     */
+    t = c.with(1, "x");
+    /*
+      Calling gc() manually forces `t` to be tenured. This test fails if
+      the GC assumes that `t` has the same alloc kind in the nursery and
+      the tenured heap, as happened in Bug 1772597.
+    */
+    gc();
+}
diff --git a/js/src/jit-test/tests/record-tuple/compacting-gc-nested-tuples.js b/js/src/jit-test/tests/record-tuple/compacting-gc-nested-tuples.js
new file mode 100644
index 0000000000..396ab359ed
--- /dev/null
+++ b/js/src/jit-test/tests/record-tuple/compacting-gc-nested-tuples.js
@@ -0,0 +1,23 @@
+// |jit-test| skip-if: !this.hasOwnProperty("Tuple")
+gczeal(14); // Be sure to run compacting GC
+
+function f() {
+  assertEq(#[1, 2].flatMap(function(e) {
+    return #[e, e * 2];
+  }), #[1, 2, 2, 4]);
+
+  var result = #[1, 2, 3].flatMap(function(ele) {
+    return #[
+      #[ele * 2]
+    ];
+  });
+
+  assertEq(result.length, 3);
+  assertEq(result[0], #[2]);
+  assertEq(result[1], #[4]);
+  assertEq(result[2], #[6]);
+}
+
+for (i = 0; i < 20; i++) {
+    f();
+}
diff --git a/js/src/jit-test/tests/record-tuple/compartments.js b/js/src/jit-test/tests/record-tuple/compartments.js
new file mode 100644
index 0000000000..ce05db021e
--- /dev/null
+++ b/js/src/jit-test/tests/record-tuple/compartments.js
@@ -0,0 +1,19 @@
+// |jit-test| --more-compartments; skip-if: !this.hasOwnProperty("Record")
+const realm = newGlobal();
+
+const realm_record = realm.eval(`Record({ x: 1, y: 2 })`);
+
+assertEq(realm_record === #{ x: 1, y: 2 }, true);
+
+const realm_tuple = realm.eval(`Tuple(1, 2, 3)`);
+
+assertEq(realm_tuple === #[1, 2, 3], true);
+
+// Test that an object can point to a record in a different realm
+const realm2 = newGlobal();
+
+const realm2_object = realm.eval(`new Object()`);
+
+realm2_object['r'] = realm_record;
+
+assertEq(realm2_object['r'] === #{"x": 1, "y": 2}, true);
diff --git a/js/src/jit-test/tests/record-tuple/from.js b/js/src/jit-test/tests/record-tuple/from.js
new file mode 100644
index 0000000000..1d23517295
--- /dev/null
+++ b/js/src/jit-test/tests/record-tuple/from.js
@@ -0,0 +1,13 @@
+// |jit-test| skip-if: !this.hasOwnProperty("Tuple")
+
+gczeal(10); // Run incremental GC in many slices
+
+var c = ["a", "b"];
+var t = Tuple.from(c);
+
+for (i = 0; i < 100; i++) {
+c = ["a", "b"];
+t = Tuple.from(c);
+c = null;
+gc();
+}
diff --git a/js/src/jit-test/tests/record-tuple/with.js b/js/src/jit-test/tests/record-tuple/with.js
new file mode 100644
index 0000000000..920512caa9
--- /dev/null
+++ b/js/src/jit-test/tests/record-tuple/with.js
@@ -0,0 +1,11 @@
+// |jit-test| skip-if: !this.hasOwnProperty("Tuple")
+
+function f() {
+    var expected = #[1, "monkeys", 3];
+    assertEq(#[1,2,3].with(1, "monkeys"), expected);
+    assertEq(Object(#[1,2,3]).with(1, "monkeys"), expected);
+}
+
+for (i = 0; i < 500; i++) {
+    f();
+}