Add m-esr52 at 52.6.0

67 files changed, 1571 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/TypedObject/Bug981650.js b/js/src/jit-test/tests/TypedObject/Bug981650.js
new file mode 100644
index 000000000..49a044091
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/Bug981650.js
@@ -0,0 +1,9 @@
+// Fuzz bug 981650: Test creating an array type based on an instance of
+// that same type.
+
+if (typeof TypedObject === "undefined")
+  quit();
+
+var T = TypedObject;
+var v = new T.ArrayType(T.int32, 10);
+new v(v);
diff --git a/js/src/jit-test/tests/TypedObject/aggregate-set-neutered.js b/js/src/jit-test/tests/TypedObject/aggregate-set-neutered.js
new file mode 100644
index 000000000..e9e98965a
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/aggregate-set-neutered.js
@@ -0,0 +1,27 @@
+// Bug 991981. Check for various quirks when setting a field of a typed object
+// during which set operation the underlying buffer is detached.
+
+if (typeof TypedObject === "undefined")
+  quit();
+
+load(libdir + "asserts.js")
+
+var StructType = TypedObject.StructType;
+var uint32 = TypedObject.uint32;
+
+function main()
+{
+  var Point = new StructType({ x: uint32, y: uint32 });
+  var Line = new StructType({ from: Point, to: Point });
+
+  var buf = new ArrayBuffer(16);
+  var line = new Line(buf);
+
+  assertThrowsInstanceOf(function()
+  {
+    line.to = { x: 22,
+                get y() { detachArrayBuffer(buf); return 44; } };
+  }, TypeError, "setting into a detached buffer is bad mojo");
+}
+
+main();
diff --git a/js/src/jit-test/tests/TypedObject/array-hasproperty.js b/js/src/jit-test/tests/TypedObject/array-hasproperty.js
new file mode 100644
index 000000000..3e119af33
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/array-hasproperty.js
@@ -0,0 +1,20 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var array = new (TypedObject.uint8.array(5));
+
+for (var i = 0; i < array.length; i++)
+    assertEq(i in array, true);
+
+for (var v of [20, 300, -1, 5, -10, Math.pow(2, 32) - 1, -Math.pow(2, 32)])
+    assertEq(v in array, false);
+
+// Don't inherit elements
+array.__proto__[50] = "hello";
+assertEq(array.__proto__[50], "hello");
+assertEq(50 in array, false);
+
+// Do inherit normal properties
+array.__proto__.a = "world";
+assertEq(array.__proto__.a, "world");
+assertEq("a" in array, true);
diff --git a/js/src/jit-test/tests/TypedObject/atopneuteredbuffer.js b/js/src/jit-test/tests/TypedObject/atopneuteredbuffer.js
new file mode 100644
index 000000000..d763d2436
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/atopneuteredbuffer.js
@@ -0,0 +1,23 @@
+// Bug 976697. Check for various quirks when instantiating a typed
+// object atop a detached buffer.
+
+if (typeof TypedObject === "undefined")
+  quit();
+
+load(libdir + "asserts.js")
+
+var {StructType, uint32, Object, Any, storage, objectType} = TypedObject;
+
+function main() { // once a C programmer, always a C programmer.
+  var Uints = uint32.array(0);
+  var Unit = new StructType({});   // Empty struct type
+  var buffer = new ArrayBuffer(0); // Empty buffer
+  var p = new Unit(buffer);        // OK
+  detachArrayBuffer(buffer);
+  assertThrowsInstanceOf(() => new Unit(buffer), TypeError,
+                         "Able to instantiate atop detached buffer");
+  assertThrowsInstanceOf(() => new Uints(buffer), TypeError,
+                         "Able to instantiate atop detached buffer");
+}
+
+main();
diff --git a/js/src/jit-test/tests/TypedObject/bug1004527.js b/js/src/jit-test/tests/TypedObject/bug1004527.js
new file mode 100644
index 000000000..db4387598
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1004527.js
@@ -0,0 +1,9 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var { ArrayType, StructType, uint32 } = TypedObject;
+var L = 1024;
+var Matrix = uint32.array(L, 2);
+var matrix = new Matrix();
+evaluate("for (var i = 0; i < L; i++) matrix[i][0] = (function d() {});",
+	 { isRunOnce: true });
diff --git a/js/src/jit-test/tests/TypedObject/bug1082649.js b/js/src/jit-test/tests/TypedObject/bug1082649.js
new file mode 100644
index 000000000..bf21d3859
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1082649.js
@@ -0,0 +1,16 @@
+if (typeof TypedObject === "undefined")
+  quit();
+
+var {StructType, uint32, storage} = TypedObject;
+var S = new StructType({f: uint32, g: uint32});
+function main() {
+  var s = new S({f: 22, g: 44});
+  detachArrayBuffer(storage(s).buffer);
+  print(storage(s).byteOffset);
+}
+try {
+    main();
+    assertEq(true, false);
+} catch (e) {
+    assertEq(e instanceof TypeError, true);
+}
diff --git a/js/src/jit-test/tests/TypedObject/bug1096016.js b/js/src/jit-test/tests/TypedObject/bug1096016.js
new file mode 100644
index 000000000..48b0d9ac5
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1096016.js
@@ -0,0 +1,13 @@
+if (typeof TypedObject === "undefined")
+  quit();
+
+var T = TypedObject;
+var ObjectStruct = new T.StructType({f: T.Object});
+var o = new ObjectStruct();
+function testGC(o, p) {
+    for (var i = 0; i < 5; i++) {
+        minorgc();
+        o.f >>=  p;
+    }
+}
+testGC(o, {});
diff --git a/js/src/jit-test/tests/TypedObject/bug1096023.js b/js/src/jit-test/tests/TypedObject/bug1096023.js
new file mode 100644
index 000000000..d2f28e485
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1096023.js
@@ -0,0 +1,20 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+enableSPSProfiling();
+var T = TypedObject;
+function check(results, ctor) {
+  for (var i = 0; i < results.length; i++)
+  var S = new T.StructType({f: ctor});
+  for (var i = 0; i < results.length; i++) {
+    var s = new S({f: results[i][1]});
+  }
+}
+var int8results = [
+  [22, 22],
+  [-128, 128],
+  [-1, 255],
+  [0x75, 0x7575],
+  [-123, 0x7585]
+];
+check(int8results, T.int8);
diff --git a/js/src/jit-test/tests/TypedObject/bug1098961.js b/js/src/jit-test/tests/TypedObject/bug1098961.js
new file mode 100644
index 000000000..65a59a937
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1098961.js
@@ -0,0 +1,9 @@
+if (!this.hasOwnProperty("TypedObject"))
+    quit();
+
+Array.prototype[Symbol.iterator] = function() {
+    for (var i = 3; --i >= 0;) {
+        yield this[i]
+    }
+}
+new TypedObject.ArrayType(TypedObject.int32, 0).build(1, x => 1)
diff --git a/js/src/jit-test/tests/TypedObject/bug1100202.js b/js/src/jit-test/tests/TypedObject/bug1100202.js
new file mode 100644
index 000000000..7b8609186
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1100202.js
@@ -0,0 +1,15 @@
+if (typeof TypedObject === "undefined")
+  quit();
+
+(function() {
+    Object
+})()
+var {
+    Object
+} = TypedObject
+function f() {
+    Object(Symbol)
+}
+for (var i = 0; i < 1; i++) {
+    f()
+}
diff --git a/js/src/jit-test/tests/TypedObject/bug1102329.js b/js/src/jit-test/tests/TypedObject/bug1102329.js
new file mode 100644
index 000000000..937c2f9d6
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1102329.js
@@ -0,0 +1,12 @@
+if (typeof TypedObject === "undefined")
+  quit();
+
+A = Array.bind()
+var {
+    StructType
+} = TypedObject
+var A = new StructType({});
+(function() {
+    new A
+    for (var i = 0; i < 9; i++) {}
+})()
diff --git a/js/src/jit-test/tests/TypedObject/bug1103273-1.js b/js/src/jit-test/tests/TypedObject/bug1103273-1.js
new file mode 100644
index 000000000..3e9664423
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1103273-1.js
@@ -0,0 +1,14 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+gczeal(2);
+var Vec3u16Type = TypedObject.uint16.array(3);
+function foo_u16(n) {
+    if (n == 0)
+        return;
+    var i = 0;
+    var vec = new Vec3u16Type([i, i+1, i+2]);
+    var sum = vec[0] + vec[1] + vec[(/[]/g )];
+    foo_u16(n - 1);
+}
+foo_u16(100);
diff --git a/js/src/jit-test/tests/TypedObject/bug1103273-2.js b/js/src/jit-test/tests/TypedObject/bug1103273-2.js
new file mode 100644
index 000000000..a033df285
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1103273-2.js
@@ -0,0 +1,22 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var Vec3u16Type = TypedObject.uint16.array(3);
+
+function foo() {
+    var x = 0;
+    for (var i = 0; i < 3; i++) {
+        var obj = new Vec3u16Type;
+        var buf = TypedObject.storage(obj).buffer;
+        var arr = new Uint8Array(buf, 3);
+        arr[0] = i + 1;
+        arr[1] = i + 2;
+        arr[2] = i + 3;
+        for (var j = 0; j < arr.length; j++) {
+            minorgc();
+            x += arr[j];
+        }
+    }
+    assertEq(x, 27);
+}
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/bug1232159.js b/js/src/jit-test/tests/TypedObject/bug1232159.js
new file mode 100644
index 000000000..67b8b6946
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1232159.js
@@ -0,0 +1,16 @@
+if (!this.hasOwnProperty("TypedObject"))
+    quit();
+
+Function.prototype.prototype = function() {}
+
+var type = TypedObject.uint8.array(4).array(4);
+var x = new type([
+    [, , , 0],
+    [, , , 0],
+    [, , , 0],
+    [, , , 0]
+]);
+
+x.map(2, function(y) {
+    return 0;
+});
diff --git a/js/src/jit-test/tests/TypedObject/bug1265690.js b/js/src/jit-test/tests/TypedObject/bug1265690.js
new file mode 100644
index 000000000..7e20a2ed1
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug1265690.js
@@ -0,0 +1,14 @@
+if (!('oomTest' in this) || !this.hasOwnProperty("TypedObject"))
+    quit();
+lfCodeBuffer = `
+    ArrayType = TypedObject.ArrayType;
+    var StructType = TypedObject.StructType;
+    float32 = TypedObject.float32;
+    Point = new ArrayType(float32, 3);
+    var Line = new StructType({ Point });
+    new ArrayType(Line, 3);
+`;
+loadFile(lfCodeBuffer);
+function loadFile(lfVarx) {
+    oomTest(function() { eval(lfVarx) });
+}
diff --git a/js/src/jit-test/tests/TypedObject/bug920463.js b/js/src/jit-test/tests/TypedObject/bug920463.js
new file mode 100644
index 000000000..7a510011e
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug920463.js
@@ -0,0 +1,15 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var StructType = TypedObject.StructType;
+var float64 = TypedObject.float64;
+
+var PointType3 = new StructType({ x: float64, y: float64});
+function xPlusY(p) {
+  return p.x + p.y;
+}
+var N = 30000;
+for (var i = 0; i < N; ++i && xPlusY(function () { p; }) ) {
+  obj = new PointType3();
+  xPlusY(obj)
+}
diff --git a/js/src/jit-test/tests/TypedObject/bug950458.js b/js/src/jit-test/tests/TypedObject/bug950458.js
new file mode 100644
index 000000000..7c90c7bcc
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug950458.js
@@ -0,0 +1,23 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+// Test for fuzz condition failure. Cause of the failure
+// was that we were not adding a type barrier after the
+// creation of derived typed objects. When run in --ion-eager
+// mode, arr[i] (below) would yield a derived typed object
+// with an empty type set, which would then fail sanity
+// checking assertions.
+//
+// Public domain.
+
+var N = 100;
+var T = TypedObject;
+var Point = new T.StructType({x: T.uint32, y: T.uint32, z: T.uint32});
+var PointArray = Point.array(N);
+function foo(arr) {
+  var sum = 0;
+  for (var i = 0; i < N; i++) {
+    sum += arr[i].x + arr[i].y + arr[i].z;
+  }
+}
+foo(new PointArray());
diff --git a/js/src/jit-test/tests/TypedObject/bug953111.js b/js/src/jit-test/tests/TypedObject/bug953111.js
new file mode 100644
index 000000000..4610a848e
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug953111.js
@@ -0,0 +1,18 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+// bug 953111
+
+var A = TypedObject.uint8.array(0);
+var a = new A();
+a.forEach(function(val, i) {});
+
+// bug 951356 (dup, but a dup that is more likely to crash)
+
+var AA = TypedObject.uint8.array(2147483647).array(0);
+var aa = new AA();
diff --git a/js/src/jit-test/tests/TypedObject/bug959119.js b/js/src/jit-test/tests/TypedObject/bug959119.js
new file mode 100644
index 000000000..f329acc3f
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug959119.js
@@ -0,0 +1,21 @@
+// This test exposed a bug in float32 optimization.
+// The (inlined and optimized) code for `add()` created
+// MDiv instructions specialized to integers, which was
+// then "respecialized" to float32, leading to internal
+// assertion errors.
+//
+// Public domain.
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var {StructType,uint8,float32} = TypedObject;
+var RgbColor2 = new StructType({r: uint8, g: float32, b: uint8});
+RgbColor2.prototype.add = function(c) {
+  this.g += c;
+  this.b += c;
+};
+var gray = new RgbColor2({r: 129, g: 128, b: 127});
+gray.add(1);
+gray.add(2);
+
diff --git a/js/src/jit-test/tests/TypedObject/bug969159.js b/js/src/jit-test/tests/TypedObject/bug969159.js
new file mode 100644
index 000000000..18534a609
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug969159.js
@@ -0,0 +1,9 @@
+// Test access to a 0-sized element (in this case,
+// a zero-length array).
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var AA = TypedObject.uint8.array(0.).array(5);
+var aa = new AA();
+var aa0 = aa[0];
diff --git a/js/src/jit-test/tests/TypedObject/bug970285.js b/js/src/jit-test/tests/TypedObject/bug970285.js
new file mode 100644
index 000000000..f5d36cdc9
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug970285.js
@@ -0,0 +1,11 @@
+// |jit-test| error:TypeError
+
+if (!this.hasOwnProperty("TypedObject"))
+  throw new TypeError();
+
+// Test that we detect invalid lengths supplied to unsized array
+// constructor. Public domain.
+
+var AA = TypedObject.uint8.array(2147483647).array();
+var aa = new AA(-1);
+
diff --git a/js/src/jit-test/tests/TypedObject/bug973563.js b/js/src/jit-test/tests/TypedObject/bug973563.js
new file mode 100644
index 000000000..2112cc023
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug973563.js
@@ -0,0 +1,9 @@
+// Test that empty sized structs don't trigger any assertion failures.
+// Public domain.
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var PointType = new TypedObject.StructType({});
+var LineType = new TypedObject.StructType({source: PointType, target: PointType});
+var fromAToB = new LineType({source: {x: 22, y: 44}, target: {x: 66, y: 88}});
diff --git a/js/src/jit-test/tests/TypedObject/bug976530.js b/js/src/jit-test/tests/TypedObject/bug976530.js
new file mode 100644
index 000000000..650a26040
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/bug976530.js
@@ -0,0 +1,10 @@
+// |jit-test| error:Error
+
+// Test that we don't permit structs whose fields exceed 32 bits.
+
+if (!this.hasOwnProperty("TypedObject"))
+  throw new Error();
+
+var Vec3u16Type = TypedObject.uint16.array((1073741823));
+var PairVec3u16Type = new TypedObject.StructType({ fst: Vec3u16Type, snd: Vec3u16Type });
+new PairVec3u16Type();
diff --git a/js/src/jit-test/tests/TypedObject/common-array-prototypes.js b/js/src/jit-test/tests/TypedObject/common-array-prototypes.js
new file mode 100644
index 000000000..cc7db5aaf
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/common-array-prototypes.js
@@ -0,0 +1,22 @@
+
+if (typeof TypedObject === "undefined")
+    quit();
+
+// Test the relationships between prototypes for array typed objects.
+
+var arrA = new TypedObject.ArrayType(TypedObject.int32, 10);
+var arrB = new TypedObject.ArrayType(TypedObject.int32, 20);
+var arrC = new TypedObject.ArrayType(TypedObject.int8, 10);
+
+assertEq(arrA.prototype == arrB.prototype, true);
+assertEq(arrA.prototype == arrC.prototype, false);
+assertEq(Object.getPrototypeOf(arrA.prototype) == Object.getPrototypeOf(arrC.prototype), true);
+assertEq(Object.getPrototypeOf(arrA.prototype) == TypedObject.ArrayType.prototype.prototype, true);
+
+var instanceA = new arrA();
+var instanceB = new arrB();
+var instanceC = new arrC();
+
+assertEq(Object.getPrototypeOf(instanceA) == arrA.prototype, true);
+assertEq(Object.getPrototypeOf(instanceB) == arrB.prototype, true);
+assertEq(Object.getPrototypeOf(instanceC) == arrC.prototype, true);
diff --git a/js/src/jit-test/tests/TypedObject/function-names.js b/js/src/jit-test/tests/TypedObject/function-names.js
new file mode 100644
index 000000000..e7c5f482a
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/function-names.js
@@ -0,0 +1,8 @@
+
+if (typeof TypedObject === "undefined")
+    quit();
+
+// Make sure some builtin TypedObject functions are given sensible names.
+assertEq(TypedObject.ArrayType.name, "ArrayType");
+assertEq(TypedObject.StructType.name, "StructType");
+assertEq(TypedObject.storage.name, "storage");
diff --git a/js/src/jit-test/tests/TypedObject/fuzz1.js b/js/src/jit-test/tests/TypedObject/fuzz1.js
new file mode 100644
index 000000000..8cfdcdd49
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz1.js
@@ -0,0 +1,10 @@
+// |jit-test| error:RangeError
+
+if (!this.hasOwnProperty("TypedObject"))
+  throw new RangeError();
+
+function eval() {
+    yield(undefined)
+}
+new TypedObject.StructType();
+eval();
diff --git a/js/src/jit-test/tests/TypedObject/fuzz10.js b/js/src/jit-test/tests/TypedObject/fuzz10.js
new file mode 100644
index 000000000..6858efb6c
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz10.js
@@ -0,0 +1,8 @@
+// |jit-test| error:Error
+
+if (!this.hasOwnProperty("TypedObject"))
+  throw new Error("type too large");
+
+var AA = TypedObject.uint8.array(2147483647).array(5);
+var aa = new AA();
+var aa0 = aa[0];
diff --git a/js/src/jit-test/tests/TypedObject/fuzz11.js b/js/src/jit-test/tests/TypedObject/fuzz11.js
new file mode 100644
index 000000000..0fe74582e
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz11.js
@@ -0,0 +1,13 @@
+// |jit-test| error:Error
+
+if (!this.hasOwnProperty("TypedObject"))
+  throw new Error("type too large");
+
+var A = TypedObject.uint8.array(2147483647);
+var S = new TypedObject.StructType({a: A,
+                                    b: A,
+                                    c: A,
+                                    d: A,
+                                    e: A});
+var aa = new S();
+var aa0 = aa.a;
diff --git a/js/src/jit-test/tests/TypedObject/fuzz2.js b/js/src/jit-test/tests/TypedObject/fuzz2.js
new file mode 100644
index 000000000..1c46a3e03
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz2.js
@@ -0,0 +1,4 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+new TypedObject.StructType([]);
diff --git a/js/src/jit-test/tests/TypedObject/fuzz4.js b/js/src/jit-test/tests/TypedObject/fuzz4.js
new file mode 100644
index 000000000..e7eda834e
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz4.js
@@ -0,0 +1,10 @@
+// |jit-test| error:Error;
+
+if (!this.hasOwnProperty("TypedObject"))
+  throw new Error();
+
+var A = TypedObject.uint8.array(10);
+var a = new A();
+a.forEach(function(val, i) {
+  assertEq(arguments[5], a);
+});
diff --git a/js/src/jit-test/tests/TypedObject/fuzz5.js b/js/src/jit-test/tests/TypedObject/fuzz5.js
new file mode 100644
index 000000000..cc6eb9111
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz5.js
@@ -0,0 +1,8 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var Color = new TypedObject.StructType({r: TypedObject.uint8,
+                                        g: TypedObject.uint8,
+                                        b: TypedObject.uint8});
+var white2 = new Color({r: 255, toString: null, b: 253});
+
diff --git a/js/src/jit-test/tests/TypedObject/fuzz6.js b/js/src/jit-test/tests/TypedObject/fuzz6.js
new file mode 100644
index 000000000..6fc0162a0
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz6.js
@@ -0,0 +1,6 @@
+// |jit-test| error:TypeError
+
+if (!this.hasOwnProperty("TypedObject"))
+  throw new TypeError();
+
+new TypedObject.StructType(RegExp);
diff --git a/js/src/jit-test/tests/TypedObject/fuzz7.js b/js/src/jit-test/tests/TypedObject/fuzz7.js
new file mode 100644
index 000000000..5847fe14d
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz7.js
@@ -0,0 +1,4 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+new TypedObject.StructType(RegExp());
diff --git a/js/src/jit-test/tests/TypedObject/fuzz8.js b/js/src/jit-test/tests/TypedObject/fuzz8.js
new file mode 100644
index 000000000..6a562d7dd
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz8.js
@@ -0,0 +1,6 @@
+// |jit-test| error:Error
+
+if (!this.hasOwnProperty("TypedObject"))
+  throw new Error();
+
+TypedObject.uint8.array(.0000000009);
diff --git a/js/src/jit-test/tests/TypedObject/fuzz9.js b/js/src/jit-test/tests/TypedObject/fuzz9.js
new file mode 100644
index 000000000..3cab1bcc1
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/fuzz9.js
@@ -0,0 +1,10 @@
+// |jit-test| error: TypeError
+
+if (!this.hasOwnProperty("TypedObject"))
+  throw new TypeError();
+
+var Vec3 = TypedObject.float32.array(3);
+var Sprite = Vec3.array(3);
+var mario = new Sprite();
+mario[/\u00ee[]/] = new Vec3([1, 0, 0]);
+
diff --git a/js/src/jit-test/tests/TypedObject/inlineopaque.js b/js/src/jit-test/tests/TypedObject/inlineopaque.js
new file mode 100644
index 000000000..709ee0406
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/inlineopaque.js
@@ -0,0 +1,25 @@
+if (!this.hasOwnProperty("TypedObject"))
+    quit();
+
+var TO = TypedObject;
+
+var PointType = new TO.StructType({x: TO.float64, y: TO.float64, name:TO.string});
+var LineType = new TO.StructType({from: PointType, to: PointType});
+
+function testBasic(gc) {
+    var line = new LineType();
+    var from = line.from;
+    var to = line.to;
+    line.from.x = 12;
+    line.from.name = "three";
+    if (gc)
+	minorgc();
+    assertEq(to.name, "");
+    assertEq(from.name, "three");
+    assertEq(from.x, 12);
+    assertEq(from.y, 0);
+}
+for (var i = 0; i < 5; i++)
+    testBasic(false);
+for (var i = 0; i < 5; i++)
+    testBasic(true);
diff --git a/js/src/jit-test/tests/TypedObject/inlinetransparent.js b/js/src/jit-test/tests/TypedObject/inlinetransparent.js
new file mode 100644
index 000000000..83528fa0b
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/inlinetransparent.js
@@ -0,0 +1,35 @@
+if (!this.hasOwnProperty("TypedObject"))
+    quit();
+
+var TO = TypedObject;
+
+var PointType = new TO.StructType({x: TO.int32, y: TO.int32});
+var LineType = new TO.StructType({from: PointType, to: PointType});
+
+function testBasic(how) {
+    var line = new LineType();
+    var from = line.from;
+    var to = line.to;
+    TO.storage(to).buffer.expando = "hello";
+    var dataview = new DataView(TO.storage(from).buffer);
+    line.from.x = 12;
+    line.to.x = 3;
+    if (how == 1)
+        minorgc();
+    else if (how == 2)
+	gc();
+    assertEq(from.x, 12);
+    assertEq(from.y, 0);
+    assertEq(to.x, 3);
+    assertEq(to.y, 0);
+    assertEq(TO.storage(to).byteOffset, 8);
+    dataview.setInt32(8, 10, true);
+    assertEq(to.x, 10);
+    assertEq(TO.storage(line).buffer.expando, "hello");
+}
+for (var i = 0; i < 5; i++)
+    testBasic(0);
+for (var i = 0; i < 5; i++)
+    testBasic(1);
+for (var i = 0; i < 5; i++)
+    testBasic(2);
diff --git a/js/src/jit-test/tests/TypedObject/jit-complex.js b/js/src/jit-test/tests/TypedObject/jit-complex.js
new file mode 100644
index 000000000..616e027f3
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-complex.js
@@ -0,0 +1,33 @@
+// Test that we can optimize stuff like line.target.x without
+// creating an intermediate object.
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var PointType = new TypedObject.StructType({x: TypedObject.float64,
+                                            y: TypedObject.float64});
+var LineType = new TypedObject.StructType({source: PointType,
+                                           target: PointType});
+
+function manhattanDistance(line) {
+  return (Math.abs(line.target.x - line.source.x) +
+          Math.abs(line.target.y - line.source.y));
+}
+
+function foo() {
+  var N = 100;
+  var points = [];
+  var obj;
+  var s;
+
+  var fromAToB = new LineType({source: {x: 22, y: 44},
+                               target: {x: 66, y: 88}});
+
+  for (var i = 0; i < N; i++) {
+    assertEq(manhattanDistance(fromAToB), 88);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-prefix.js b/js/src/jit-test/tests/TypedObject/jit-prefix.js
new file mode 100644
index 000000000..198406aaf
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-prefix.js
@@ -0,0 +1,43 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var PointType2 =
+  new TypedObject.StructType({
+    x: TypedObject.float64,
+    y: TypedObject.float64});
+
+var PointType3 =
+  new TypedObject.StructType({
+    x: TypedObject.float64,
+    y: TypedObject.float64,
+    z: TypedObject.float64});
+
+function xPlusY(p) {
+  return p.x + p.y;
+}
+
+function xPlusYTweak(p) {
+  p.x = 22;
+  return xPlusY(p);
+}
+
+function foo() {
+  var N = 100;
+  var points = [];
+  var obj;
+  var s;
+
+  for (var i = 0; i < N; i++) {
+    if ((i % 2) == 0)
+      obj = new PointType2({x: i, y: i+1});
+    else
+      obj = new PointType3({x: i, y: i+1, z: i+2});
+
+    assertEq(xPlusY(obj), i + i + 1);
+    assertEq(xPlusYTweak(obj), 22 + i + 1);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-float64.js b/js/src/jit-test/tests/TypedObject/jit-read-float64.js
new file mode 100644
index 000000000..4a766b41f
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-float64.js
@@ -0,0 +1,17 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var PointType = new TypedObject.StructType({x: TypedObject.float64,
+                                            y: TypedObject.float64,
+                                            z: TypedObject.float64});
+
+function foo() {
+  for (var i = 0; i < 30000; i += 3) {
+    var pt = new PointType({x: i, y: i+1, z: i+2});
+    var sum = pt.x + pt.y + pt.z;
+    print(pt.x, pt.y, pt.z);
+    assertEq(sum, 3*i + 3);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-int.js b/js/src/jit-test/tests/TypedObject/jit-read-int.js
new file mode 100644
index 000000000..1463d4424
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-int.js
@@ -0,0 +1,16 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var PointType = new TypedObject.StructType({x: TypedObject.uint32,
+                                            y: TypedObject.uint32,
+                                            z: TypedObject.uint32});
+
+function foo() {
+  for (var i = 0; i < 30000; i += 3) {
+    var pt = new PointType({x: i, y: i+1, z: i+2});
+    var sum = pt.x + pt.y + pt.z;
+    assertEq(sum, 3*i + 3);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-many.js b/js/src/jit-test/tests/TypedObject/jit-read-many.js
new file mode 100644
index 000000000..dc15916f3
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-many.js
@@ -0,0 +1,62 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+// Test a single function (`bar`) being used with arrays that are all
+// of known length, but not the same length.
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var N0 = 50;
+var N1 = 100;
+var N2 = 150;
+var T = TypedObject;
+var Array0 = T.uint32.array(N0);
+var Array1 = T.uint32.array(N1);
+var Array2 = T.uint32.array(N2);
+
+function bar(array, i, v) {
+  assertEq(array[i], v);
+}
+
+function foo() {
+  var array0 = new Array0();
+  var array1 = new Array1();
+  var array2 = new Array2();
+
+  for (var i = 0; i < N0; i++)
+    array0[i] = i + 0;
+
+  for (var i = 0; i < N1; i++)
+    array1[i] = i + 1;
+
+  for (var i = 0; i < N2; i++)
+    array2[i] = i + 2;
+
+  // get it primed up..
+  for (var i = 0; i < N0; i++) {
+    bar(array0, i, i);
+    bar(array1, i, i + 1);
+    bar(array2, i, i + 2);
+  }
+
+  // ...do some OOB accesses...
+  for (var i = N0; i < N1; i++) {
+    bar(array0, i, undefined);
+    bar(array1, i, i + 1);
+    bar(array2, i, i + 2);
+  }
+
+  // ...and some more.
+  for (var i = N1; i < N2; i++) {
+    bar(array0, i, undefined);
+    bar(array1, i, undefined);
+    bar(array2, i, i + 2);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u16-from-mdim-array.js b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-mdim-array.js
new file mode 100644
index 000000000..d61c3fa19
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-mdim-array.js
@@ -0,0 +1,28 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var T = TypedObject;
+var PointType = T.uint16.array(3);
+var VecPointType = PointType.array(3);
+
+function foo() {
+  for (var i = 0; i < 10000; i += 9) {
+    var vec = new VecPointType([
+      [i,   i+1, i+2],
+      [i+3, i+4, i+5],
+      [i+6, i+7, i+8]]);
+    var sum = vec[0][0] + vec[0][1] + vec[0][2];
+    assertEq(sum, 3*i + 3);
+    sum = vec[1][0] + vec[1][1] + vec[1][2];
+    assertEq(sum, 3*i + 12);
+    sum = vec[2][0] + vec[2][1] + vec[2][2];
+    assertEq(sum, 3*i + 21);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u16-from-struct-array-in-struct.js b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-struct-array-in-struct.js
new file mode 100644
index 000000000..ccd5264e2
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-struct-array-in-struct.js
@@ -0,0 +1,45 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var PointType = new TypedObject.StructType({x: TypedObject.uint16,
+                                            y: TypedObject.uint16,
+                                            z: TypedObject.uint16});
+
+var VecPointType = PointType.array(3);
+
+var PairVecType = new TypedObject.StructType({fst: VecPointType,
+                                              snd: VecPointType});
+
+function foo() {
+  for (var i = 0; i < 5000; i += 9) {
+    var p = new PairVecType({fst: [{x:    i, y: i+1, z:i+2},
+                                   {x:  i+3, y: i+4, z:i+5},
+                                   {x:  i+6, y: i+7, z:i+8}],
+                             snd: [{x:  i+9, y:i+10, z:i+11},
+                                   {x: i+12, y:i+13, z:i+14},
+                                   {x: i+15, y:i+16, z:i+17}]
+                            });
+    var sum;
+
+    sum = p.fst[0].x + p.fst[0].y + p.fst[0].z;
+    assertEq(sum, 3*i + 3);
+    sum = p.fst[1].x + p.fst[1].y + p.fst[1].z;
+    assertEq(sum, 3*i + 12);
+    sum = p.fst[2].x + p.fst[2].y + p.fst[2].z;
+    assertEq(sum, 3*i + 21);
+
+    sum = p.snd[0].x + p.snd[0].y + p.snd[0].z;
+    assertEq(sum, 3*i + 30);
+    sum = p.snd[1].x + p.snd[1].y + p.snd[1].z;
+    assertEq(sum, 3*i + 39);
+    sum = p.snd[2].x + p.snd[2].y + p.snd[2].z;
+    assertEq(sum, 3*i + 48);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u16-from-struct-array.js b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-struct-array.js
new file mode 100644
index 000000000..bdaaa456c
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-struct-array.js
@@ -0,0 +1,30 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var PointType = new TypedObject.StructType({x: TypedObject.uint16,
+                                            y: TypedObject.uint16,
+                                            z: TypedObject.uint16});
+
+var VecPointType = PointType.array(3);
+
+function foo() {
+  for (var i = 0; i < 10000; i += 9) {
+    var vec = new VecPointType([
+      {x: i,   y:i+1, z:i+2},
+      {x: i+3, y:i+4, z:i+5},
+      {x: i+6, y:i+7, z:i+8}]);
+    var sum = vec[0].x + vec[0].y + vec[0].z;
+    assertEq(sum, 3*i + 3);
+    sum = vec[1].x + vec[1].y + vec[1].z;
+    assertEq(sum, 3*i + 12);
+    sum = vec[2].x + vec[2].y + vec[2].z;
+    assertEq(sum, 3*i + 21);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u16-from-u16-array-in-struct.js b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-u16-array-in-struct.js
new file mode 100644
index 000000000..9b1cf5f0a
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-u16-array-in-struct.js
@@ -0,0 +1,24 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var Vec3u16Type = TypedObject.uint16.array(3);
+var PairVec3u16Type = new TypedObject.StructType({fst: Vec3u16Type,
+                                                  snd: Vec3u16Type});
+
+function foo_u16() {
+  for (var i = 0; i < 15000; i += 6) {
+    var p = new PairVec3u16Type({fst: [i, i+1, i+2],
+                                 snd: [i+3,i+4,i+5]});
+    var sum = p.fst[0] + p.fst[1] + p.fst[2];
+    assertEq(sum, 3*i + 3);
+    sum = p.snd[0] + p.snd[1] + p.snd[2];
+    assertEq(sum, 3*i + 12);
+  }
+}
+
+foo_u16();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u16-from-u16-array.js b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-u16-array.js
new file mode 100644
index 000000000..6ebacf232
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u16-from-u16-array.js
@@ -0,0 +1,19 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var Vec3u16Type = TypedObject.uint16.array(3);
+
+function foo_u16() {
+  for (var i = 0; i < 30000; i += 3) {
+    var vec = new Vec3u16Type([i, i+1, i+2]);
+    var sum = vec[0] + vec[1] + vec[2];
+    assertEq(sum, 3*i + 3);
+  }
+}
+
+foo_u16();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u32-from-mdim-array.js b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-mdim-array.js
new file mode 100644
index 000000000..da88da1fa
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-mdim-array.js
@@ -0,0 +1,27 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var PointType = TypedObject.uint32.array(3);
+var VecPointType = PointType.array(3);
+
+function foo() {
+  for (var i = 0; i < 10000; i += 9) {
+    var vec = new VecPointType([
+      [i,   i+1, i+2],
+      [i+3, i+4, i+5],
+      [i+6, i+7, i+8]]);
+    var sum = vec[0][0] + vec[0][1] + vec[0][2];
+    assertEq(sum, 3*i + 3);
+    sum = vec[1][0] + vec[1][1] + vec[1][2];
+    assertEq(sum, 3*i + 12);
+    sum = vec[2][0] + vec[2][1] + vec[2][2];
+    assertEq(sum, 3*i + 21);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u32-from-struct-array-in-struct.js b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-struct-array-in-struct.js
new file mode 100644
index 000000000..07d25e034
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-struct-array-in-struct.js
@@ -0,0 +1,45 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var PointType = new TypedObject.StructType({x: TypedObject.uint32,
+                                            y: TypedObject.uint32,
+                                            z: TypedObject.uint32});
+
+var VecPointType = PointType.array(3);
+
+var PairVecType = new TypedObject.StructType({fst: VecPointType,
+                                              snd: VecPointType});
+
+function foo() {
+  for (var i = 0; i < 5000; i += 9) {
+    var p = new PairVecType({fst: [{x:    i, y: i+1, z:i+2},
+                                   {x:  i+3, y: i+4, z:i+5},
+                                   {x:  i+6, y: i+7, z:i+8}],
+                             snd: [{x:  i+9, y:i+10, z:i+11},
+                                   {x: i+12, y:i+13, z:i+14},
+                                   {x: i+15, y:i+16, z:i+17}]
+                            });
+    var sum;
+
+    sum = p.fst[0].x + p.fst[0].y + p.fst[0].z;
+    assertEq(sum, 3*i + 3);
+    sum = p.fst[1].x + p.fst[1].y + p.fst[1].z;
+    assertEq(sum, 3*i + 12);
+    sum = p.fst[2].x + p.fst[2].y + p.fst[2].z;
+    assertEq(sum, 3*i + 21);
+
+    sum = p.snd[0].x + p.snd[0].y + p.snd[0].z;
+    assertEq(sum, 3*i + 30);
+    sum = p.snd[1].x + p.snd[1].y + p.snd[1].z;
+    assertEq(sum, 3*i + 39);
+    sum = p.snd[2].x + p.snd[2].y + p.snd[2].z;
+    assertEq(sum, 3*i + 48);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u32-from-struct-array.js b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-struct-array.js
new file mode 100644
index 000000000..4a5f09091
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-struct-array.js
@@ -0,0 +1,30 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var PointType = new TypedObject.StructType({x: TypedObject.uint32,
+                                            y: TypedObject.uint32,
+                                            z: TypedObject.uint32});
+
+var VecPointType = PointType.array(3);
+
+function foo() {
+  for (var i = 0; i < 10000; i += 9) {
+    var vec = new VecPointType([
+      {x: i,   y:i+1, z:i+2},
+      {x: i+3, y:i+4, z:i+5},
+      {x: i+6, y:i+7, z:i+8}]);
+    var sum = vec[0].x + vec[0].y + vec[0].z;
+    assertEq(sum, 3*i + 3);
+    sum = vec[1].x + vec[1].y + vec[1].z;
+    assertEq(sum, 3*i + 12);
+    sum = vec[2].x + vec[2].y + vec[2].z;
+    assertEq(sum, 3*i + 21);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u32-from-u32-array-in-struct.js b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-u32-array-in-struct.js
new file mode 100644
index 000000000..7258297d5
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-u32-array-in-struct.js
@@ -0,0 +1,24 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var Vec3u32Type = TypedObject.uint32.array(3);
+var PairVec3u32Type = new TypedObject.StructType({fst: Vec3u32Type,
+                                                  snd: Vec3u32Type});
+
+function foo_u32() {
+  for (var i = 0; i < 15000; i += 6) {
+    var p = new PairVec3u32Type({fst: [i, i+1, i+2],
+                                 snd: [i+3,i+4,i+5]});
+    var sum = p.fst[0] + p.fst[1] + p.fst[2];
+    assertEq(sum, 3*i + 3);
+    sum = p.snd[0] + p.snd[1] + p.snd[2];
+    assertEq(sum, 3*i + 12);
+  }
+}
+
+foo_u32();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-u32-from-u32-array.js b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-u32-array.js
new file mode 100644
index 000000000..5c2906c41
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-u32-from-u32-array.js
@@ -0,0 +1,19 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var Vec3u32Type = TypedObject.uint32.array(3);
+
+function foo_u32() {
+  for (var i = 0; i < 30000; i += 3) {
+    var vec = new Vec3u32Type([i, i+1, i+2]);
+    var sum = vec[0] + vec[1] + vec[2];
+    assertEq(sum, 3*i + 3);
+  }
+}
+
+foo_u32();
diff --git a/js/src/jit-test/tests/TypedObject/jit-read-unsized.js b/js/src/jit-test/tests/TypedObject/jit-read-unsized.js
new file mode 100644
index 000000000..799d27189
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-read-unsized.js
@@ -0,0 +1,47 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var N = 100;
+var T = TypedObject;
+var Point = new T.StructType({x: T.uint32, y: T.uint32, z: T.uint32});
+var PointArray = Point.array(N);
+
+function bar(array, i, x, y, z) {
+  assertEq(array[i].x, x);
+  assertEq(array[i].y, y);
+  assertEq(array[i].z, z);
+}
+
+function foo() {
+  var array = new PointArray();
+  for (var i = 0; i < N; i++) {
+    array[i].x = i + 0;
+    array[i].y = i + 1;
+    array[i].z = i + 2;
+  }
+
+  // get it primed up..
+  for (var i = 0; i < N; i++)
+    bar(array, i, i, i + 1, i + 2);
+
+  // ...do some OOB accesses...
+  for (var i = 0; i < N; i++) {
+    try {
+      bar(array, N, undefined, undefined, undefined);
+      assertEq(false, true);
+    } catch(e) { }
+  }
+
+  // ...test again.
+  for (var i = 0; i < N; i++)
+    bar(array, i, i, i + 1, i + 2);
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-write-references-2.js b/js/src/jit-test/tests/TypedObject/jit-write-references-2.js
new file mode 100644
index 000000000..eec2f0d92
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-write-references-2.js
@@ -0,0 +1,16 @@
+if (typeof TypedObject === "undefined" || typeof Intl === "undefined")
+    quit();
+
+try {
+    gczeal(4)
+} catch (exc) {}
+var T = TypedObject;
+var ValueStruct = new T.StructType({
+    f: T.Any
+})
+var v = new ValueStruct;
+new class get extends Number {};
+function writeValue(o, v)
+  o.f = v
+for (var i = 0; i < 5; i++)
+  writeValue(v, {}, "helo")
diff --git a/js/src/jit-test/tests/TypedObject/jit-write-references.js b/js/src/jit-test/tests/TypedObject/jit-write-references.js
new file mode 100644
index 000000000..2ea25004c
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-write-references.js
@@ -0,0 +1,83 @@
+if (typeof TypedObject === "undefined")
+    quit();
+
+var T = TypedObject;
+
+var ObjectStruct = new T.StructType({f: T.Object});
+var StringStruct = new T.StructType({f: T.string});
+var ValueStruct = new T.StructType({f: T.Any});
+
+// Suppress ion compilation of the global script.
+with({}){}
+
+var o = new ObjectStruct();
+var s = new StringStruct();
+var v = new ValueStruct();
+
+// Make sure that unboxed null pointers on the stack are marked correctly.
+whatever = new Array();
+function testGC(o, p) {
+    for (var i = 0; i < 5; i++) {
+        minorgc();
+        o.f = p;
+        whatever.push(new Array()); // minorgc needs garbage before it scans the stack.
+    }
+}
+testGC(o, {});
+testGC(o, null);
+
+// Test writing various things to an object field.
+function writeObject(o, v, expected) {
+    o.f = v;
+    assertEq(typeof o.f, "object");
+    assertEq("" + o.f, expected);
+}
+for (var i = 0; i < 5; i++)
+    writeObject(o, {toString: function() { return "helo"} }, "helo");
+for (var i = 0; i < 5; i++)
+    writeObject(o, null, "null");
+for (var i = 0; i < 5; i++)
+    writeObject(o, "three", "three");
+for (var i = 0; i < 5; i++)
+    writeObject(o, 4.5, "4.5");
+for (var i = 0; i < 5; i++) {
+    try {
+        writeObject(o, undefined, "");
+    } catch (e) {
+        assertEq(e instanceof TypeError, true);
+    }
+}
+
+// Test writing various things to a string field.
+function writeString(o, v, expected) {
+    o.f = v;
+    assertEq(typeof o.f, "string");
+    assertEq("" + o.f, expected);
+}
+for (var i = 0; i < 5; i++)
+    writeString(s, {toString: function() { return "helo"} }, "helo");
+for (var i = 0; i < 5; i++)
+    writeString(s, null, "null");
+for (var i = 0; i < 5; i++)
+    writeString(s, "three", "three");
+for (var i = 0; i < 5; i++)
+    writeString(s, 4.5, "4.5");
+for (var i = 0; i < 5; i++)
+    writeString(s, undefined, "undefined");
+
+// Test writing various things to a value field.
+function writeValue(o, v, expectedType, expected) {
+    o.f = v;
+    assertEq(typeof o.f, expectedType);
+    assertEq("" + o.f, expected);
+}
+for (var i = 0; i < 5; i++)
+    writeValue(v, {toString: function() { return "helo"} }, "object", "helo");
+for (var i = 0; i < 5; i++)
+    writeValue(v, null, "object", "null");
+for (var i = 0; i < 5; i++)
+    writeValue(v, "three", "string", "three");
+for (var i = 0; i < 5; i++)
+    writeValue(v, 4.5, "number", "4.5");
+for (var i = 0; i < 5; i++)
+    writeValue(v, undefined, "undefined", "undefined");
diff --git a/js/src/jit-test/tests/TypedObject/jit-write-u16-into-mdim-array.js b/js/src/jit-test/tests/TypedObject/jit-write-u16-into-mdim-array.js
new file mode 100644
index 000000000..726274848
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-write-u16-into-mdim-array.js
@@ -0,0 +1,43 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var PointType = TypedObject.uint16.array(3);
+var VecPointType = PointType.array(3);
+
+function foo() {
+  for (var i = 0; i < 5000; i += 10) {
+    var vec = new VecPointType();
+
+    var i0 = i % 3;
+    var i1 = (i+1) % 3;
+    var i2 = (i+2) % 3;
+
+    vec[i0][i0] = i;
+    vec[i0][i1] = i+1;
+    vec[i0][i2] = i+2;
+
+    vec[i1][i0] = i+3;
+    vec[i1][i1] = i+4;
+    vec[i1][i2] = i+5;
+
+    vec[i2][i0] = i+6;
+    vec[i2][i1] = i+7;
+    vec[i2][i2] = i+8;
+
+    var sum = vec[i0][i0] + vec[i0][i1] + vec[i0][i2];
+    assertEq(sum, 3*i + 3);
+    sum = vec[i1][i0] + vec[i1][i1] + vec[i1][i2];
+    assertEq(sum, 3*i + 12);
+    sum = vec[i2][i0] + vec[i2][i1] + vec[i2][i2];
+    assertEq(sum, 3*i + 21);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-write-u16-into-u16-array-in-struct.js b/js/src/jit-test/tests/TypedObject/jit-write-u16-into-u16-array-in-struct.js
new file mode 100644
index 000000000..5e984cfd3
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-write-u16-into-u16-array-in-struct.js
@@ -0,0 +1,34 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var Vec3u16Type = TypedObject.uint16.array(3);
+var PairVec3u16Type = new TypedObject.StructType({fst: Vec3u16Type,
+                                                  snd: Vec3u16Type});
+
+function foo_u16() {
+  for (var i = 0; i < 5000; i += 10) {
+    var p = new PairVec3u16Type();
+
+    p.fst[(i)   % 3] = i;
+    p.fst[(i+1) % 3] = i+1;
+    p.fst[(i+2) % 3] = i+2;
+
+    p.snd[(i)   % 3] = i+3;
+    p.snd[(i+1) % 3] = i+4;
+    p.snd[(i+2) % 3] = i+5;
+
+    var sum = p.fst[0] + p.fst[1] + p.fst[2];
+    assertEq(sum, 3*i + 3);
+    sum = p.snd[0] + p.snd[1] + p.snd[2];
+    assertEq(sum, 3*i + 12);
+  }
+}
+
+foo_u16();
diff --git a/js/src/jit-test/tests/TypedObject/jit-write-u16-into-u16-array.js b/js/src/jit-test/tests/TypedObject/jit-write-u16-into-u16-array.js
new file mode 100644
index 000000000..6c0fe0d78
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-write-u16-into-u16-array.js
@@ -0,0 +1,25 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var Vec3u16Type = TypedObject.uint16.array(3);
+
+function foo_u16() {
+  for (var i = 0; i < 5000; i += 10) {
+    var vec = new Vec3u16Type();
+    // making index non-trivially dependent on |i| to foil compiler optimization
+    vec[(i)     % 3] = i;
+    vec[(i + 1) % 3] = i+1;
+    vec[(i + 2) % 3] = i+2;
+    var sum = vec[0] + vec[1] + vec[2];
+    assertEq(sum, 3*i + 3);
+  }
+}
+
+foo_u16();
diff --git a/js/src/jit-test/tests/TypedObject/jit-write-u32-into-mdim-array.js b/js/src/jit-test/tests/TypedObject/jit-write-u32-into-mdim-array.js
new file mode 100644
index 000000000..eaf941f34
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-write-u32-into-mdim-array.js
@@ -0,0 +1,43 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var PointType = TypedObject.uint32.array(3);
+var VecPointType = PointType.array(3);
+
+function foo() {
+  for (var i = 0; i < 5000; i += 10) {
+    var vec = new VecPointType();
+
+    var i0 = i % 3;
+    var i1 = (i+1) % 3;
+    var i2 = (i+2) % 3;
+
+    vec[i0][i0] = i;
+    vec[i0][i1] = i+1;
+    vec[i0][i2] = i+2;
+
+    vec[i1][i0] = i+3;
+    vec[i1][i1] = i+4;
+    vec[i1][i2] = i+5;
+
+    vec[i2][i0] = i+6;
+    vec[i2][i1] = i+7;
+    vec[i2][i2] = i+8;
+
+    var sum = vec[i0][i0] + vec[i0][i1] + vec[i0][i2];
+    assertEq(sum, 3*i + 3);
+    sum = vec[i1][i0] + vec[i1][i1] + vec[i1][i2];
+    assertEq(sum, 3*i + 12);
+    sum = vec[i2][i0] + vec[i2][i1] + vec[i2][i2];
+    assertEq(sum, 3*i + 21);
+  }
+}
+
+foo();
diff --git a/js/src/jit-test/tests/TypedObject/jit-write-u32-into-u32-array-in-struct.js b/js/src/jit-test/tests/TypedObject/jit-write-u32-into-u32-array-in-struct.js
new file mode 100644
index 000000000..5359acca3
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-write-u32-into-u32-array-in-struct.js
@@ -0,0 +1,34 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var Vec3u32Type = TypedObject.uint32.array(3);
+var PairVec3u32Type = new TypedObject.StructType({fst: Vec3u32Type,
+                                                  snd: Vec3u32Type});
+
+function foo_u32() {
+  for (var i = 0; i < 5000; i += 10) {
+    var p = new PairVec3u32Type();
+
+    p.fst[(i)   % 3] = i;
+    p.fst[(i+1) % 3] = i+1;
+    p.fst[(i+2) % 3] = i+2;
+
+    p.snd[(i)   % 3] = i+3;
+    p.snd[(i+1) % 3] = i+4;
+    p.snd[(i+2) % 3] = i+5;
+
+    var sum = p.fst[0] + p.fst[1] + p.fst[2];
+    assertEq(sum, 3*i + 3);
+    sum = p.snd[0] + p.snd[1] + p.snd[2];
+    assertEq(sum, 3*i + 12);
+  }
+}
+
+foo_u32();
diff --git a/js/src/jit-test/tests/TypedObject/jit-write-u32-into-u32-array.js b/js/src/jit-test/tests/TypedObject/jit-write-u32-into-u32-array.js
new file mode 100644
index 000000000..ad13b5c00
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/jit-write-u32-into-u32-array.js
@@ -0,0 +1,25 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ */
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+setJitCompilerOption("ion.warmup.trigger", 30);
+
+var Vec3u32Type = TypedObject.uint32.array(3);
+
+function foo_u32() {
+  for (var i = 0; i < 5000; i += 10) {
+    var vec = new Vec3u32Type();
+    // making index non-trivially dependent on |i| to foil compiler optimization
+    vec[(i)     % 3] = i;
+    vec[(i + 1) % 3] = i+1;
+    vec[(i + 2) % 3] = i+2;
+    var sum = vec[0] + vec[1] + vec[2];
+    assertEq(sum, 3*i + 3);
+  }
+}
+
+foo_u32();
diff --git a/js/src/jit-test/tests/TypedObject/neutertypedobj.js b/js/src/jit-test/tests/TypedObject/neutertypedobj.js
new file mode 100644
index 000000000..ff5c0360f
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/neutertypedobj.js
@@ -0,0 +1,32 @@
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var {StructType, uint32, storage} = TypedObject;
+var S = new StructType({f: uint32, g: uint32});
+
+function readFromS(s) {
+  return s.f + s.g;
+}
+
+function main() {
+  var s = new S({f: 22, g: 44});
+
+  for (var i = 0; i < 10; i++)
+    assertEq(readFromS(s), 66);
+
+  detachArrayBuffer(storage(s).buffer);
+
+  for (var i = 0; i < 10; i++) {
+    var ok = false;
+
+    try {
+      readFromS(s);
+    } catch (e) {
+      ok = e instanceof TypeError;
+    }
+
+    assertEq(ok, true);
+  }
+}
+
+main();
diff --git a/js/src/jit-test/tests/TypedObject/neutertypedobjsizedarray.js b/js/src/jit-test/tests/TypedObject/neutertypedobjsizedarray.js
new file mode 100644
index 000000000..6f8522906
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/neutertypedobjsizedarray.js
@@ -0,0 +1,40 @@
+// Test the case where we detach the buffer underlying a fixed-sized array.
+// This is a bit of a tricky case because we cannot (necessarily) fold
+// the detached check into the bounds check, as we obtain the bounds
+// directly from the type.
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var {StructType, uint32, storage} = TypedObject;
+var S = new StructType({f: uint32, g: uint32});
+var A = S.array(10);
+
+function readFrom(a) {
+  return a[2].f + a[2].g;
+}
+
+function main() {
+  var a = new A();
+  a[2].f = 22;
+  a[2].g = 44;
+
+  for (var i = 0; i < 10; i++)
+    assertEq(readFrom(a), 66);
+
+  detachArrayBuffer(storage(a).buffer);
+
+  for (var i = 0; i < 10; i++) {
+    var ok = false;
+
+    try {
+      readFrom(a);
+    } catch (e) {
+      ok = e instanceof TypeError;
+    }
+
+    assertEq(ok, true);
+  }
+}
+
+main();
diff --git a/js/src/jit-test/tests/TypedObject/neutertypedobjunsizedarray.js b/js/src/jit-test/tests/TypedObject/neutertypedobjunsizedarray.js
new file mode 100644
index 000000000..c1c248d72
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/neutertypedobjunsizedarray.js
@@ -0,0 +1,38 @@
+// Test the case where we detach the buffer underlying a variable-length array.
+// Here we can fold the detached check into the bounds check.
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+var {StructType, uint32, storage} = TypedObject;
+var S = new StructType({f: uint32, g: uint32});
+var A = S.array(10);
+
+function readFrom(a) {
+  return a[2].f + a[2].g;
+}
+
+function main() {
+  var a = new A();
+  a[2].f = 22;
+  a[2].g = 44;
+
+  for (var i = 0; i < 10; i++)
+    assertEq(readFrom(a), 66);
+
+  detachArrayBuffer(storage(a).buffer);
+
+  for (var i = 0; i < 10; i++) {
+    var ok = false;
+
+    try {
+      readFrom(a);
+    } catch (e) {
+      ok = e instanceof TypeError;
+    }
+
+    assertEq(ok, true);
+  }
+}
+
+main();
diff --git a/js/src/jit-test/tests/TypedObject/opaqueatopbuffer.js b/js/src/jit-test/tests/TypedObject/opaqueatopbuffer.js
new file mode 100644
index 000000000..739ce05a4
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/opaqueatopbuffer.js
@@ -0,0 +1,19 @@
+if (typeof TypedObject === "undefined")
+  quit();
+
+load(libdir + "asserts.js")
+
+var {StructType, ArrayType, uint32, Object,
+     Any, storage, objectType} = TypedObject;
+
+var anArray = new Uint32Array(100);
+anArray[0] = 22;
+var buffer = anArray.buffer;
+
+var Unit = new StructType(({ f : Object, } ));
+assertThrowsInstanceOf(() => new Unit(buffer), TypeError,
+                       "Able to instantiate opaque type atop buffer");
+
+var Units = new ArrayType(Unit, 2);
+assertThrowsInstanceOf(() => new Units(buffer), TypeError,
+                       "Able to instantiate opaque type atop buffer");
diff --git a/js/src/jit-test/tests/TypedObject/prototypes.js b/js/src/jit-test/tests/TypedObject/prototypes.js
new file mode 100644
index 000000000..4a569e09e
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/prototypes.js
@@ -0,0 +1,34 @@
+// API Surface Test: check that mutating prototypes
+// of type objects has no effect, and that mutating
+// the prototypes of typed objects is an error.
+
+if (!this.hasOwnProperty("TypedObject"))
+  quit();
+
+load(libdir + "asserts.js");
+
+var {StructType, uint32, Object, Any, storage, objectType} = TypedObject;
+
+function main() { // once a C programmer, always a C programmer.
+  var Uints = new StructType({f: uint32, g: uint32});
+  var p = Uints.prototype;
+  Uints.prototype = {}; // no effect
+  assertEq(p, Uints.prototype);
+
+  var uints = new Uints();
+  assertEq(uints.__proto__, p);
+  assertThrowsInstanceOf(() => uints.__proto__ = {},
+                         TypeError);
+  assertThrowsInstanceOf(() => Object.setPrototypeOf(uints, {}),
+                         TypeError);
+  assertEq(uints.__proto__, p);
+
+  var Uintss = Uints.array(2);
+  var p = Uintss.prototype;
+  Uintss.prototype = {}; // no effect
+  assertEq(p, Uintss.prototype);
+
+  print("Tests complete");
+}
+
+main();
diff --git a/js/src/jit-test/tests/TypedObject/set-property-with-prototype.js b/js/src/jit-test/tests/TypedObject/set-property-with-prototype.js
new file mode 100644
index 000000000..96bba9e54
--- /dev/null
+++ b/js/src/jit-test/tests/TypedObject/set-property-with-prototype.js
@@ -0,0 +1,72 @@
+
+if (typeof TypedObject === "undefined")
+    quit();
+
+// Test the behavior of property sets on typed objects when they are a
+// prototype or their prototype has a setter.
+var TO = TypedObject;
+
+function assertThrows(fun, errorType) {
+  try {
+    fun();
+    assertEq(true, false, "Expected error, but none was thrown");
+  } catch (e) {
+    assertEq(e instanceof errorType, true, "Wrong error type thrown");
+  }
+}
+
+var PointType = new TO.StructType({x: TO.int32, y: TO.int32 });
+
+function testPoint() {
+    var p = new PointType();
+    var sub = Object.create(p);
+    var found;
+    Object.defineProperty(PointType.prototype, "z", {set: function(a) { this.d = a; }});
+    Object.defineProperty(PointType.prototype, "innocuous", {set: function(a) { found = a; }});
+
+    sub.x = 5;
+    assertEq(sub.x, 5);
+    assertEq(p.x, 0);
+
+    sub.z = 5;
+    assertEq(sub.d, 5);
+    assertEq(sub.z, undefined);
+
+    sub[3] = 5;
+    assertEq(sub[3], 5);
+
+    p.innocuous = 10;
+    assertEq(found, 10);
+
+    assertThrows(function() {
+        p.z = 10;
+        assertEq(true, false);
+    }, TypeError);
+}
+testPoint();
+
+var IntArrayType = new TO.ArrayType(TO.int32, 3);
+
+function testArray() {
+    var arr = new IntArrayType();
+    var found;
+    Object.defineProperty(IntArrayType.prototype, 5, {set: function(a) { found = a; }});
+
+    assertThrows(function() {
+        arr[5] = 5;
+    }, RangeError);
+
+    assertThrows(function() {
+        arr[4] = 5;
+    }, RangeError);
+
+    var p = Object.create(arr);
+    p.length = 100;
+    assertEq(p.length, 3);
+
+    assertThrows(function() {
+        "use strict";
+        p.length = 100;
+    }, TypeError);
+}
+testArray();