Add m-esr52 at 52.6.0

7 files changed, 914 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/atomics/basic-tests.js b/js/src/jit-test/tests/atomics/basic-tests.js
new file mode 100644
index 000000000..710822982
--- /dev/null
+++ b/js/src/jit-test/tests/atomics/basic-tests.js
@@ -0,0 +1,560 @@
+// Basic functional tests for the Atomics primitives.
+//
+// These do not test atomicity, just that calling and coercions and
+// indexing and exception behavior all work right.
+//
+// These do not test the wait/wake operations.
+
+load(libdir + "asserts.js");
+
+var DEBUG = false;		// Set to true for useful printouts
+
+function dprint(...xs) {
+    if (!DEBUG)
+	return;
+    var s = "";
+    for ( var x in xs )
+	s += String(xs[x]);
+    print(s);
+}
+
+// Clone a function so that we get reliable inlining of primitives with --ion-eager.
+// For eg testMethod and testFunction that are polymorphic in the array a,
+// the inliner gets confused and stops inlining after Int8 -- not what we want.
+function CLONE(f) {
+    return this.eval("(" + f.toSource() + ")");
+}
+
+function testMethod(a, ...indices) {
+    dprint("Method: " + a.constructor.name);
+    var poison;
+    switch (a.BYTES_PER_ELEMENT) {
+    case 1: poison = 0x5A; break;
+    case 2: poison = 0x5A5A; break;
+    case 4: poison = 0x5A5A5A5A; break;
+    }
+    for ( var i=0 ; i < indices.length ; i++ ) {
+	var x = indices[i];
+	if (x > 0)
+	    a[x-1] = poison;
+	if (x < a.length-1)
+	    a[x+1] = poison;
+
+	// val = 0
+	assertEq(Atomics.compareExchange(a, x, 0, 37), 0);
+	// val = 37
+	assertEq(Atomics.compareExchange(a, x, 37, 5), 37);
+	// val = 5
+	assertEq(Atomics.compareExchange(a, x, 7, 8), 5); // ie should fail
+	// val = 5
+	assertEq(Atomics.compareExchange(a, x, 5, 9), 5);
+	// val = 9
+	assertEq(Atomics.compareExchange(a, x, 5, 0), 9); // should also fail
+
+ 	// val = 9
+	assertEq(Atomics.exchange(a, x, 4), 9);
+	// val = 4
+	assertEq(Atomics.exchange(a, x, 9), 4);
+
+	// val = 9
+	assertEq(Atomics.load(a, x), 9);
+	// val = 9
+	assertEq(Atomics.store(a, x, 14), 14); // What about coercion?
+	// val = 14
+	assertEq(Atomics.load(a, x), 14);
+	// val = 14
+	Atomics.store(a, x, 0);
+	// val = 0
+
+	// val = 0
+	assertEq(Atomics.add(a, x, 3), 0);
+	// val = 3
+	assertEq(Atomics.sub(a, x, 2), 3);
+	// val = 1
+	assertEq(Atomics.or(a, x, 6), 1);
+	// val = 7
+	assertEq(Atomics.and(a, x, 14), 7);
+	// val = 6
+	assertEq(Atomics.xor(a, x, 5), 6);
+	// val = 3
+	assertEq(Atomics.load(a, x), 3);
+	// val = 3
+	Atomics.store(a, x, 0);
+	// val = 0
+
+	// Check adjacent elements were not affected
+	if (x > 0) {
+	    assertEq(a[x-1], poison);
+	    a[x-1] = 0;
+	}
+	if (x < a.length-1) {
+	    assertEq(a[x+1], poison);
+	    a[x+1] = 0;
+	}
+    }
+}
+
+function testFunction(a, ...indices) {
+    dprint("Function: " + a.constructor.name);
+    var poison;
+    switch (a.BYTES_PER_ELEMENT) {
+    case 1: poison = 0x5A; break;
+    case 2: poison = 0x5A5A; break;
+    case 4: poison = 0x5A5A5A5A; break;
+    }
+    for ( var i=0 ; i < indices.length ; i++ ) {
+	var x = indices[i];
+	if (x > 0)
+	    a[x-1] = poison;
+	if (x < a.length-1)
+	    a[x+1] = poison;
+
+	// val = 0
+	assertEq(gAtomics_compareExchange(a, x, 0, 37), 0);
+	// val = 37
+	assertEq(gAtomics_compareExchange(a, x, 37, 5), 37);
+	// val = 5
+	assertEq(gAtomics_compareExchange(a, x, 7, 8), 5); // ie should fail
+	// val = 5
+	assertEq(gAtomics_compareExchange(a, x, 5, 9), 5);
+	// val = 9
+	assertEq(gAtomics_compareExchange(a, x, 5, 0), 9); // should also fail
+
+	// val = 9
+	assertEq(gAtomics_exchange(a, x, 4), 9);
+	// val = 4
+	assertEq(gAtomics_exchange(a, x, 9), 4);
+
+	// val = 9
+	assertEq(gAtomics_load(a, x), 9);
+	// val = 9
+	assertEq(gAtomics_store(a, x, 14), 14); // What about coercion?
+	// val = 14
+	assertEq(gAtomics_load(a, x), 14);
+	// val = 14
+	gAtomics_store(a, x, 0);
+	// val = 0
+
+	// val = 0
+	assertEq(gAtomics_add(a, x, 3), 0);
+	// val = 3
+	assertEq(gAtomics_sub(a, x, 2), 3);
+	// val = 1
+	assertEq(gAtomics_or(a, x, 6), 1);
+	// val = 7
+	assertEq(gAtomics_and(a, x, 14), 7);
+	// val = 6
+	assertEq(gAtomics_xor(a, x, 5), 6);
+	// val = 3
+	assertEq(gAtomics_load(a, x), 3);
+	// val = 3
+	gAtomics_store(a, x, 0);
+	// val = 0
+
+	// Check adjacent elements were not affected
+	if (x > 0) {
+	    assertEq(a[x-1], poison);
+	    a[x-1] = 0;
+	}
+	if (x < a.length-1) {
+	    assertEq(a[x+1], poison);
+	    a[x+1] = 0;
+	}
+    }
+}
+
+function testTypeCAS(a) {
+    dprint("Type: " + a.constructor.name);
+
+    var thrown = false;
+    try {
+	Atomics.compareExchange([0], 0, 0, 1);
+    }
+    catch (e) {
+	thrown = true;
+	assertEq(e instanceof TypeError, true);
+    }
+    assertEq(thrown, true);
+
+    // All these variants should be OK
+    Atomics.compareExchange(a, 0, 0.7, 1.8);
+    Atomics.compareExchange(a, 0, "0", 1);
+    Atomics.compareExchange(a, 0, 0, "1");
+    Atomics.compareExchange(a, 0, 0);
+}
+
+function testTypeBinop(a, op) {
+    dprint("Type: " + a.constructor.name);
+
+    var thrown = false;
+    try {
+	op([0], 0, 1);
+    }
+    catch (e) {
+	thrown = true;
+	assertEq(e instanceof TypeError, true);
+    }
+    assertEq(thrown, true);
+
+    // These are all OK
+    op(a, 0, 0.7);
+    op(a, 0, "0");
+    op(a, 0);
+}
+
+var globlength = 0;		// Will be set later
+
+function testRangeCAS(a) {
+    dprint("Range: " + a.constructor.name);
+
+    var msg = /out-of-range index/; // A generic message
+
+    assertErrorMessage(() => Atomics.compareExchange(a, -1, 0, 1), RangeError, msg);
+    assertEq(a[0], 0);
+
+    assertErrorMessage(() => Atomics.compareExchange(a, "hi", 0, 1), RangeError, msg);
+    assertEq(a[0], 0);
+
+    assertErrorMessage(() => Atomics.compareExchange(a, a.length + 5, 0, 1), RangeError, msg);
+    assertEq(a[0], 0);
+
+    assertErrorMessage(() => Atomics.compareExchange(a, globlength, 0, 1), RangeError, msg);
+    assertEq(a[0], 0);
+}
+
+// Ad-hoc tests for extreme and out-of-range values.
+// None of these should throw
+
+function testInt8Extremes(a) {
+    dprint("Int8 extremes");
+
+    a[10] = 0;
+    a[11] = 0;
+
+    Atomics.store(a, 10, 255);
+    assertEq(a[10], -1);
+    assertEq(Atomics.load(a, 10), -1);
+
+    Atomics.add(a, 10, 255); // should coerce to -1
+    assertEq(a[10], -2);
+    assertEq(Atomics.load(a, 10), -2);
+
+    Atomics.add(a, 10, -1);
+    assertEq(a[10], -3);
+    assertEq(Atomics.load(a, 10), -3);
+
+    Atomics.sub(a, 10, 255);	// should coerce to -1
+    assertEq(a[10], -2);
+    assertEq(Atomics.load(a, 10), -2);
+
+    Atomics.sub(a, 10, 256);	// should coerce to 0
+    assertEq(a[10], -2);
+    assertEq(Atomics.load(a, 10), -2);
+
+    Atomics.and(a, 10, -1);	// Preserve all
+    assertEq(a[10], -2);
+    assertEq(Atomics.load(a, 10), -2);
+
+    Atomics.and(a, 10, 256);	// Preserve none
+    assertEq(a[10], 0);
+    assertEq(Atomics.load(a, 10), 0);
+
+    Atomics.store(a, 10, 255);
+    assertEq(Atomics.exchange(a, 10, 0), -1);
+
+    assertEq(a[11], 0);
+}
+
+function testUint8Extremes(a) {
+    dprint("Uint8 extremes");
+
+    a[10] = 0;
+    a[11] = 0;
+
+    Atomics.store(a, 10, 255);
+    assertEq(a[10], 255);
+    assertEq(Atomics.load(a, 10), 255);
+
+    Atomics.add(a, 10, 255);
+    assertEq(a[10], 254);
+    assertEq(Atomics.load(a, 10), 254);
+
+    Atomics.add(a, 10, -1);
+    assertEq(a[10], 253);
+    assertEq(Atomics.load(a, 10), 253);
+
+    Atomics.sub(a, 10, 255);
+    assertEq(a[10], 254);
+    assertEq(Atomics.load(a, 10), 254);
+
+    Atomics.and(a, 10, -1);	// Preserve all
+    assertEq(a[10], 254);
+    assertEq(Atomics.load(a, 10), 254);
+
+    Atomics.and(a, 10, 256);	// Preserve none
+    assertEq(a[10], 0);
+    assertEq(Atomics.load(a, 10), 0);
+
+    Atomics.store(a, 10, 255);
+    assertEq(Atomics.exchange(a, 10, 0), 255);
+
+    assertEq(a[11], 0);
+}
+
+function testInt16Extremes(a) {
+    dprint("Int16 extremes");
+
+    a[10] = 0;
+    a[11] = 0;
+
+    Atomics.store(a, 10, 65535);
+    assertEq(a[10], -1);
+    assertEq(Atomics.load(a, 10), -1);
+
+    Atomics.add(a, 10, 65535); // should coerce to -1
+    assertEq(a[10], -2);
+    assertEq(Atomics.load(a, 10), -2);
+
+    Atomics.add(a, 10, -1);
+    assertEq(a[10], -3);
+    assertEq(Atomics.load(a, 10), -3);
+
+    Atomics.sub(a, 10, 65535);	// should coerce to -1
+    assertEq(a[10], -2);
+    assertEq(Atomics.load(a, 10), -2);
+
+    Atomics.sub(a, 10, 65536);	// should coerce to 0
+    assertEq(a[10], -2);
+    assertEq(Atomics.load(a, 10), -2);
+
+    Atomics.and(a, 10, -1);	// Preserve all
+    assertEq(a[10], -2);
+    assertEq(Atomics.load(a, 10), -2);
+
+    Atomics.and(a, 10, 65536);	// Preserve none
+    assertEq(a[10], 0);
+    assertEq(Atomics.load(a, 10), 0);
+
+    assertEq(a[11], 0);
+}
+
+function testUint32(a) {
+    var k = 0;
+    for ( var i=0 ; i < 20 ; i++ ) {
+	a[i] = i+5;
+	k += a[i];
+    }
+
+    var sum = 0;
+    for ( var i=0 ; i < 20 ; i++ )
+	sum += Atomics.add(a, i, 1);
+
+    assertEq(sum, k);
+}
+
+// This test is a reliable test of sign extension in the JIT where
+// testInt8Extremes is not (because there may not be enough type
+// information without a loop - see bug 1181062 for a description
+// of the general problem).
+
+function exchangeLoop(ta) {
+    var sum = 0;
+    for ( var i=0 ; i < 100000 ; i++ )
+	sum += Atomics.exchange(ta, i & 15, 255);
+    return sum;
+}
+
+function adHocExchange() {
+    var a = new Int8Array(new SharedArrayBuffer(16));
+    for ( var i=0 ; i < a.length ; i++ )
+	a[i] = 255;
+    assertEq(exchangeLoop(a), -100000);
+}
+
+// isLockFree(n) may return true only if there is an integer array
+// on which atomic operations is allowed whose byte size is n,
+// ie, it must return false for n=8.
+//
+// SpiderMonkey has isLockFree(1), isLockFree(2), isLockFree(4) on all
+// supported platforms, only the last is guaranteed by the spec.
+
+var sizes   = [    1,     2,     3,     4,     5,     6,     7,  8,
+                   9,    10,    11,    12];
+var answers = [ true,  true, false,  true, false, false, false, false,
+	       false, false, false, false];
+
+function testIsLockFree() {
+    // This ought to defeat most compile-time resolution.
+    for ( var i=0 ; i < sizes.length ; i++ ) {
+	var v = Atomics.isLockFree(sizes[i]);
+	var a = answers[i];
+	assertEq(typeof v, 'boolean');
+	assertEq(v, a);
+    }
+
+    // This ought to be optimizable.
+    assertEq(Atomics.isLockFree(1), true);
+    assertEq(Atomics.isLockFree(2), true);
+    assertEq(Atomics.isLockFree(3), false);
+    assertEq(Atomics.isLockFree(4), true);
+    assertEq(Atomics.isLockFree(5), false);
+    assertEq(Atomics.isLockFree(6), false);
+    assertEq(Atomics.isLockFree(7), false);
+    assertEq(Atomics.isLockFree(8), false);
+    assertEq(Atomics.isLockFree(9), false);
+    assertEq(Atomics.isLockFree(10), false);
+    assertEq(Atomics.isLockFree(11), false);
+    assertEq(Atomics.isLockFree(12), false);
+}
+
+function testIsLockFree2() {
+    assertEq(Atomics.isLockFree(0), false);
+    assertEq(Atomics.isLockFree(0/-1), false);
+    assertEq(Atomics.isLockFree(3.5), false);
+    assertEq(Atomics.isLockFree(Number.NaN), false);  // NaN => +0
+    assertEq(Atomics.isLockFree(Number.POSITIVE_INFINITY), false);
+    assertEq(Atomics.isLockFree(Number.NEGATIVE_INFINITY), false);
+    assertEq(Atomics.isLockFree(-4), false);
+    assertEq(Atomics.isLockFree('4'), true);
+    assertEq(Atomics.isLockFree('-4'), false);
+    assertEq(Atomics.isLockFree('4.5'), true);
+    assertEq(Atomics.isLockFree('5.5'), false);
+    assertEq(Atomics.isLockFree(new Number(4)), true);
+    assertEq(Atomics.isLockFree(new String('4')), true);
+    assertEq(Atomics.isLockFree(new Boolean(true)), true);
+    var thrown = false;
+    try {
+	Atomics.isLockFree(Symbol('1'));
+    } catch (e) {
+	thrown = e;
+    }
+    assertEq(thrown instanceof TypeError, true);
+    assertEq(Atomics.isLockFree(true), true);
+    assertEq(Atomics.isLockFree(false), false);
+    assertEq(Atomics.isLockFree(undefined), false);
+    assertEq(Atomics.isLockFree(null), false);
+    assertEq(Atomics.isLockFree({toString: () => '4'}), true);
+    assertEq(Atomics.isLockFree({valueOf: () => 4}), true);
+    assertEq(Atomics.isLockFree({valueOf: () => 5}), false);
+    assertEq(Atomics.isLockFree({password: "qumquat"}), false);
+}
+
+function testUint8Clamped(sab) {
+    var ta = new Uint8ClampedArray(sab);
+    var thrown = false;
+    try {
+	CLONE(testMethod)(ta, 0);
+    }
+    catch (e) {
+	thrown = true;
+	assertEq(e instanceof TypeError, true);
+    }
+    assertEq(thrown, true);
+}
+
+function testWeirdIndices() {
+    var a = new Int8Array(new SharedArrayBuffer(16));
+    a[3] = 10;
+    assertEq(Atomics.load(a, "0x03"), 10);
+    assertEq(Atomics.load(a, {valueOf: () => 3}), 10);
+}
+
+function isLittleEndian() {
+    var xxx = new ArrayBuffer(2);
+    var xxa = new Int16Array(xxx);
+    var xxb = new Int8Array(xxx);
+    xxa[0] = 37;
+    var is_little = xxb[0] == 37;
+    return is_little;
+}
+
+function runTests() {
+    var is_little = isLittleEndian();
+
+    // Currently the SharedArrayBuffer needs to be a multiple of 4K bytes in size.
+    var sab = new SharedArrayBuffer(4096);
+
+    // Test that two arrays created on the same storage alias
+    var t1 = new Int8Array(sab);
+    var t2 = new Uint16Array(sab);
+
+    assertEq(t1[0], 0);
+    assertEq(t2[0], 0);
+    t1[0] = 37;
+    if (is_little)
+	assertEq(t2[0], 37);
+    else
+	assertEq(t2[0], 37 << 16);
+    t1[0] = 0;
+
+    // Test that invoking as Atomics.whatever() works, on correct arguments.
+    CLONE(testMethod)(new Int8Array(sab), 0, 42, 4095);
+    CLONE(testMethod)(new Uint8Array(sab), 0, 42, 4095);
+    CLONE(testMethod)(new Int16Array(sab), 0, 42, 2047);
+    CLONE(testMethod)(new Uint16Array(sab), 0, 42, 2047);
+    CLONE(testMethod)(new Int32Array(sab), 0, 42, 1023);
+    CLONE(testMethod)(new Uint32Array(sab), 0, 42, 1023);
+
+    // Test that invoking as v = Atomics.whatever; v() works, on correct arguments.
+    gAtomics_compareExchange = Atomics.compareExchange;
+    gAtomics_exchange = Atomics.exchange;
+    gAtomics_load = Atomics.load;
+    gAtomics_store = Atomics.store;
+    gAtomics_add = Atomics.add;
+    gAtomics_sub = Atomics.sub;
+    gAtomics_and = Atomics.and;
+    gAtomics_or = Atomics.or;
+    gAtomics_xor = Atomics.xor;
+
+    CLONE(testFunction)(new Int8Array(sab), 0, 42, 4095);
+    CLONE(testFunction)(new Uint8Array(sab), 0, 42, 4095);
+    CLONE(testFunction)(new Int16Array(sab), 0, 42, 2047);
+    CLONE(testFunction)(new Uint16Array(sab), 0, 42, 2047);
+    CLONE(testFunction)(new Int32Array(sab), 0, 42, 1023);
+    CLONE(testFunction)(new Uint32Array(sab), 0, 42, 1023);
+
+    // Test various range and type conditions
+    var v8 = new Int8Array(sab);
+    var v32 = new Int32Array(sab);
+
+    CLONE(testTypeCAS)(v8);
+    CLONE(testTypeCAS)(v32);
+
+    CLONE(testTypeBinop)(v8, Atomics.add);
+    CLONE(testTypeBinop)(v8, Atomics.sub);
+    CLONE(testTypeBinop)(v8, Atomics.and);
+    CLONE(testTypeBinop)(v8, Atomics.or);
+    CLONE(testTypeBinop)(v8, Atomics.xor);
+
+    CLONE(testTypeBinop)(v32, Atomics.add);
+    CLONE(testTypeBinop)(v32, Atomics.sub);
+    CLONE(testTypeBinop)(v32, Atomics.and);
+    CLONE(testTypeBinop)(v32, Atomics.or);
+    CLONE(testTypeBinop)(v32, Atomics.xor);
+
+    // Test out-of-range references
+    globlength = v8.length + 5;
+    CLONE(testRangeCAS)(v8);
+    globlength = v32.length + 5;
+    CLONE(testRangeCAS)(v32);
+
+    // Test extreme values
+    testInt8Extremes(new Int8Array(sab));
+    testUint8Extremes(new Uint8Array(sab));
+    testInt16Extremes(new Int16Array(sab));
+    testUint32(new Uint32Array(sab));
+
+    // Test that Uint8ClampedArray is not accepted.
+    testUint8Clamped(sab);
+
+    // Misc ad-hoc tests
+    adHocExchange();
+
+    // Misc
+    testIsLockFree();
+    testIsLockFree2();
+    testWeirdIndices();
+}
+
+if (this.Atomics && this.SharedArrayBuffer)
+    runTests();
diff --git a/js/src/jit-test/tests/atomics/inline-add.js b/js/src/jit-test/tests/atomics/inline-add.js
new file mode 100644
index 000000000..d690041d8
--- /dev/null
+++ b/js/src/jit-test/tests/atomics/inline-add.js
@@ -0,0 +1,31 @@
+// |jit-test| slow;
+//
+// This is intended to be run manually with IONFLAGS=logs and
+// postprocessing by iongraph to verify manually (by inspecting the
+// MIR) that:
+//
+//  - the add operation is inlined as it should be
+//  - loads and stores are not moved across the add
+//
+// Be sure to run with --ion-eager --ion-offthread-compile=off.
+
+function add(ta) {
+    var x = ta[0];
+    Atomics.add(ta, 86, 6);
+    var y = ta[1];
+    var z = y + 1;
+    var w = x + z;
+    return w;
+}
+
+if (!this.SharedArrayBuffer || !this.Atomics)
+    quit(0);
+
+var sab = new SharedArrayBuffer(4096);
+var ia = new Int32Array(sab);
+for ( var i=0, limit=ia.length ; i < limit ; i++ )
+    ia[i] = 37;
+var v = 0;
+for ( var i=0 ; i < 1000 ; i++ )
+    v += add(ia);
+//print(v);
diff --git a/js/src/jit-test/tests/atomics/inline-add2.js b/js/src/jit-test/tests/atomics/inline-add2.js
new file mode 100644
index 000000000..6357e4d3f
--- /dev/null
+++ b/js/src/jit-test/tests/atomics/inline-add2.js
@@ -0,0 +1,31 @@
+// |jit-test| slow;
+//
+// Like inline-add, but with Uint32Array, which is a special case
+// because the value is representable only as a Number.  All this
+// tests is that the Uint32 path is being triggered.
+//
+// This is intended to be run manually with IONFLAGS=logs and
+// postprocessing by iongraph to verify manually (by inspecting the
+// MIR) that:
+//
+//  - the add operation is inlined as it should be, with
+//    a return type 'Double'
+//  - loads and stores are not moved across the add
+//
+// Be sure to run with --ion-eager --ion-offthread-compile=off.
+
+function add(ta) {
+    return Atomics.add(ta, 86, 6);
+}
+
+if (!this.SharedArrayBuffer || !this.Atomics)
+    quit(0);
+
+var sab = new SharedArrayBuffer(4096);
+var ia = new Uint32Array(sab);
+for ( var i=0, limit=ia.length ; i < limit ; i++ )
+    ia[i] = 0xdeadbeef;		// Important: Not an int32-capable value
+var v = 0;
+for ( var i=0 ; i < 1000 ; i++ )
+    v += add(ia);
+//print(v);
diff --git a/js/src/jit-test/tests/atomics/inline-cmpxchg.js b/js/src/jit-test/tests/atomics/inline-cmpxchg.js
new file mode 100644
index 000000000..ddec40644
--- /dev/null
+++ b/js/src/jit-test/tests/atomics/inline-cmpxchg.js
@@ -0,0 +1,31 @@
+// |jit-test| slow;
+//
+// This is intended to be run manually with IONFLAGS=logs and
+// postprocessing by iongraph to verify manually (by inspecting the
+// MIR) that:
+//
+//  - the cmpxchg operation is inlined as it should be
+//  - loads and stores are not moved across the cmpxchg
+//
+// Be sure to run with --ion-eager --ion-offthread-compile=off.
+
+function cmpxchg(ta) {
+    var x = ta[0];
+    Atomics.compareExchange(ta, 86, 37, 42);
+    var y = ta[1];
+    var z = y + 1;
+    var w = x + z;
+    return w;
+}
+
+if (!this.SharedArrayBuffer || !this.Atomics)
+    quit(0);
+
+var sab = new SharedArrayBuffer(4096);
+var ia = new Int32Array(sab);
+for ( var i=0, limit=ia.length ; i < limit ; i++ )
+    ia[i] = 37;
+var v = 0;
+for ( var i=0 ; i < 1000 ; i++ )
+    v += cmpxchg(ia);
+//print(v);
diff --git a/js/src/jit-test/tests/atomics/mutual-exclusion.js b/js/src/jit-test/tests/atomics/mutual-exclusion.js
new file mode 100644
index 000000000..146901d9d
--- /dev/null
+++ b/js/src/jit-test/tests/atomics/mutual-exclusion.js
@@ -0,0 +1,91 @@
+// Let a few threads hammer on memory with atomics to provoke errors
+// in exclusion work.  This test is not 100% fail-safe: the test may
+// pass despite a bug, but this is unlikely.
+
+if (!(this.SharedArrayBuffer && this.getSharedArrayBuffer && this.setSharedArrayBuffer && this.evalInWorker))
+    quit(0);
+
+try {
+    // This will fail with --no-threads.
+    evalInWorker("37");
+}
+catch (e) {
+    quit(0);
+}
+
+// Map an Int32Array on shared memory.  The first location is used as
+// a counter, each worker counts up on exit and the main thread will
+// wait until the counter reaches the number of workers.  The other
+// elements are contended accumulators where we count up and down very
+// rapidly and for a long time, any failure in mutual exclusion should
+// lead to errors in the result.  (For example, the test fails almost
+// immediately when I disable simulation of mutual exclusion in the
+// ARM simulator.)
+
+const numWorkers = 4;           // You're not meant to change this
+const iterCount = 255;          // Nor this
+const sabLength = 1024;         // Nor this
+
+const oddResult = (function () {
+    var v = 0;
+    for ( var j=0 ; j < numWorkers ; j++ )
+        v |= (iterCount << (8 * j));
+    return v;
+})();
+
+const evenResult = 0;
+
+const sab = new SharedArrayBuffer(sabLength);
+
+setSharedArrayBuffer(sab);
+
+const iab = new Int32Array(sab);
+
+function testRun(limit) {
+    console.log("Limit = " + limit);
+
+    // Fork off workers to hammer on memory.
+    for ( var i=0 ; i < numWorkers ; i++ ) {
+        evalInWorker(`
+                     const iab = new Int32Array(getSharedArrayBuffer());
+                     const v = 1 << (8 * ${i});
+                     for ( var i=0 ; i < ${limit} ; i++ ) {
+                         for ( var k=0 ; k < ${iterCount} ; k++ ) {
+                             if (i & 1) {
+                                 for ( var j=1 ; j < iab.length ; j++ )
+                                     Atomics.sub(iab, j, v);
+                             }
+                             else {
+                                 for ( var j=1 ; j < iab.length ; j++ )
+                                     Atomics.add(iab, j, v);
+                             }
+                         }
+                     }
+                     Atomics.add(iab, 0, 1);
+                     `);
+    }
+
+    // Wait...
+    while (Atomics.load(iab, 0) != numWorkers)
+        ;
+    Atomics.store(iab, 0, 0);
+
+    // Check the results and clear the array again.
+    const v = (limit & 1) ? oddResult : evenResult;
+    for ( var i=1 ; i < iab.length ; i++ ) {
+        assertEq(iab[i], v);
+        iab[i] = 0;
+    }
+}
+
+// Under some configurations the test can take a while to run (and may
+// saturate the CPU since it runs four workers); try not to time out.
+
+var then = new Date();
+testRun(1);
+if (new Date() - then < 20000) {
+    testRun(2);
+    if (new Date() - then < 30000) {
+	testRun(3);
+    }
+}
diff --git a/js/src/jit-test/tests/atomics/optimization-tests.js b/js/src/jit-test/tests/atomics/optimization-tests.js
new file mode 100644
index 000000000..7503219a3
--- /dev/null
+++ b/js/src/jit-test/tests/atomics/optimization-tests.js
@@ -0,0 +1,128 @@
+// Some optimization tests for the Atomics primitives.
+//
+// These do not test atomicity, just code generation on a single
+// thread.
+//
+// It's useful to look at the code generated for this test with -D to
+// the JS shell.
+//
+// Bug 1138348 - unconstrained use of byte registers on x64
+// Bug 1077014 - code generation for Atomic operations for effect,
+//               all platforms
+// Bug 1141121 - immediate operand in atomic operations on x86/x64
+
+if (!(this.Atomics && this.SharedArrayBuffer))
+    quit(0);
+
+var sum = 0;
+
+function f(ia, k) {
+    // For effect, variable value.  The generated code on x86/x64
+    // should be one LOCK ADDB.  (On ARM, there should be no
+    // sign-extend of the current value in the cell, otherwise this is
+    // still a LDREX/STREX loop.)
+    Atomics.add(ia, 0, k);
+
+    // Ditto constant value.  Here the LOCK ADDB should have an
+    // immediate operand.
+    Atomics.add(ia, 0, 1);
+}
+
+function f2(ia, k) {
+    // For effect, variable value and constant value.  The generated
+    // code on x86/x64 should be one LOCK SUBB.
+    Atomics.sub(ia, 2, k);
+
+    // Ditto constant value.  Here the LOCK SUBB should have an
+    // immediate operand.
+    Atomics.sub(ia, 2, 1);
+}
+
+function f4(ia, k) {
+    // For effect, variable value.  The generated code on x86/x64
+    // should be one LOCK ORB.  (On ARM, there should be no
+    // sign-extend of the current value in the cell, otherwise this is
+    // still a LDREX/STREX loop.)
+    Atomics.or(ia, 6, k);
+
+    // Ditto constant value.  Here the LOCK ORB should have an
+    // immediate operand.
+    Atomics.or(ia, 6, 1);
+}
+
+function g(ia, k) {
+    // For its value, variable value.  The generated code on x86/x64
+    // should be one LOCK XADDB.
+    sum += Atomics.add(ia, 1, k);
+
+    // Ditto constant value.  XADD does not admit an immediate
+    // operand, so in the second case there should be a preliminary
+    // MOV of the immediate to the output register.
+    sum += Atomics.add(ia, 1, 1);
+}
+
+function g2(ia, k) {
+    // For its value, variable value.  The generated code on x86/x64
+    // should be one LOCK XADDB, preceded by a NEG into the output
+    // register instead of a MOV.
+    sum += Atomics.sub(ia, 3, k);
+
+    // Ditto constant value.  XADD does not admit an immediate
+    // operand, so in the second case there should be a preliminary
+    // MOV of the negated immediate to the output register.
+    sum += Atomics.sub(ia, 3, 1);
+}
+
+function g4(ia, k) {
+    // For its value, variable value.  The generated code on x86/x64
+    // should be a loop around ORB ; CMPXCHGB
+    sum += Atomics.or(ia, 7, k);
+
+    // Ditto constant value.  Here the ORB in the loop should have
+    // an immediate operand.
+    sum += Atomics.or(ia, 7, 1);
+}
+
+function mod(stdlib, ffi, heap) {
+    "use asm";
+
+    var i8a = new stdlib.Int8Array(heap);
+    var add = stdlib.Atomics.add;
+    var sum = 0;
+
+    function f3(k) {
+	k = k|0;
+	add(i8a, 4, 1);
+	add(i8a, 4, k);
+    }
+
+    function g3(k) {
+	k = k|0;
+	sum = sum + add(i8a, 5, k)|0;
+	sum = sum + add(i8a, 5, 1)|0;
+    }
+
+    return {f3:f3, g3:g3};
+}
+
+var i8a = new Int8Array(new SharedArrayBuffer(65536));
+var { f3, g3 } = mod(this, {}, i8a.buffer);
+for ( var i=0 ; i < 10000 ; i++ ) {
+    f(i8a, i % 10);
+    g(i8a, i % 10);
+    f2(i8a, i % 10);
+    g2(i8a, i % 10);
+    f3(i % 10);
+    g3(i % 10);
+    f4(i8a, i % 10);
+    g4(i8a, i % 10);
+}
+
+assertEq(i8a[0], ((10000 + 10000*4.5) << 24) >> 24);
+assertEq(i8a[1], ((10000 + 10000*4.5) << 24) >> 24);
+assertEq(i8a[2], ((-10000 + -10000*4.5) << 24) >> 24);
+assertEq(i8a[3], ((-10000 + -10000*4.5) << 24) >> 24);
+assertEq(i8a[4], ((10000 + 10000*4.5) << 24) >> 24);
+assertEq(i8a[5], ((10000 + 10000*4.5) << 24) >> 24);
+assertEq(i8a[6], 15);
+assertEq(i8a[7], 15);
diff --git a/js/src/jit-test/tests/atomics/store-does-not-truncate-returnval.js b/js/src/jit-test/tests/atomics/store-does-not-truncate-returnval.js
new file mode 100644
index 000000000..cb3f23f16
--- /dev/null
+++ b/js/src/jit-test/tests/atomics/store-does-not-truncate-returnval.js
@@ -0,0 +1,42 @@
+if (!this.SharedArrayBuffer)
+    quit(0);
+
+var ia = new Int32Array(new SharedArrayBuffer(4));
+
+// Atomics.store() returns the input value converted to integer as if
+// by ToInteger.
+//
+// JIT and interpreter have different paths here, so loop a little to
+// trigger the JIT properly.
+
+function f() {
+    assertEq(Atomics.store(ia, 0, 3.5), 3);
+    assertEq(ia[0], 3);
+
+    assertEq(Atomics.store(ia, 0, -0), -0);
+    assertEq(ia[0], 0);
+
+    assertEq(Atomics.store(ia, 0, '4.6'), 4);
+    assertEq(ia[0], 4);
+
+    assertEq(Atomics.store(ia, 0, '-4.6'), -4);
+    assertEq(ia[0], -4);
+
+    assertEq(Atomics.store(ia, 0, undefined), 0);
+    assertEq(ia[0], 0);
+
+    assertEq(Atomics.store(ia, 0, Infinity), Infinity);
+    assertEq(ia[0], 0);
+
+    assertEq(Atomics.store(ia, 0, -Infinity), -Infinity);
+    assertEq(ia[0], 0);
+
+    assertEq(Atomics.store(ia, 0, Math.pow(2, 32)+5), Math.pow(2, 32)+5);
+    assertEq(ia[0], 5);
+
+    assertEq(Atomics.store(ia, 0, { valueOf: () => 3.7 }), 3);
+    assertEq(ia[0], 3);
+}
+
+for ( var i=0 ; i < 10 ; i++ )
+    f();