Add m-esr52 at 52.6.0

25 files changed, 764 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-multi.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-multi.js
new file mode 100644
index 000000000..9d31c0eab
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-multi.js
@@ -0,0 +1,41 @@
+/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests
+ * internal to Type.toSource().
+ *
+ * In this case the argument type is always a type descriptor object
+ * (though not a unique one), so ObjectIsTypeDescr resolves to true
+ * and there should be no exceptions.
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  You're looking for a smallish function within the
+ * "self-hosted" domain.  Look for a call to ObjectIsTypeDescr far
+ * down in the graph for pass00, with a call to DescrToSource in a
+ * subsequent block (all of this is at the mercy of the way the code
+ * is currently written).
+ */
+
+if (!this.TypedObject)
+  quit();
+
+var T = TypedObject;
+var ST1 = new T.StructType({x:T.int32});
+var ST2 = new T.StructType({x:T.float64});
+
+function check(v) {
+    return v.toSource();
+}
+
+function test() {
+  var a = [ ST1, ST2 ];
+    for ( var i=0 ; i < 1000 ; i++ )
+	check(a[i%2]);
+    return check(a[0]);
+}
+
+print(test());
+
+
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-unknown.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-unknown.js
new file mode 100644
index 000000000..92d1333bc
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-unknown.js
@@ -0,0 +1,39 @@
+/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests
+ * internal to Type.toSource().
+ *
+ * In this case the argument type is never a type descriptor object,
+ * so ObjectIsTypeDescr resolves to false (and we have to catch
+ * exceptions).
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  You're looking for a smallish function within the
+ * "self-hosted" domain.  Look for a call to ObjectIsTypeDescr far
+ * down in the graph for pass00, with a call to DescrToSource in a
+ * subsequent block (all of this is at the mercy of the way the code
+ * is currently written).
+ */
+
+if (!this.TypedObject)
+  quit();
+
+var T = TypedObject;
+var ST = new T.StructType({x:T.int32});
+
+function check(v) {
+    return v.toSource();
+}
+
+function test() {
+    var fake = { toSource: ST.toSource };
+    var a = [ ST, fake ];
+    for ( var i=0 ; i < 1000 ; i++ )
+	try { check(a[i%2]); } catch (e) {}
+    try { return check(a[0]); } catch (e) { return "Thrown" }
+}
+
+print(test());
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong-multi.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong-multi.js
new file mode 100644
index 000000000..f00186adf
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong-multi.js
@@ -0,0 +1,41 @@
+/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests
+ * internal to Type.toSource().
+ *
+ * In this case the argument type is never a type descriptor object
+ * (though not a unique non-type-descriptor), so ObjectIsTypeDescr
+ * resolves to false (and we have to catch exceptions).
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  You're looking for a smallish function within the
+ * "self-hosted" domain.  Look for a call to ObjectIsTypeDescr far
+ * down in the graph for pass00, with a call to DescrToSource in a
+ * subsequent block (all of this is at the mercy of the way the code
+ * is currently written).
+ */
+
+if (!this.TypedObject)
+  quit();
+
+var T = TypedObject;
+var ST = new T.StructType({x:T.int32});
+
+function check(v) {
+    return v.toSource();
+}
+
+function test() {
+    var fake1 = { toSource: ST.toSource };
+    var fake2 = [];  fake2.toSource = ST.toSource;
+    var a = [ fake1, fake2 ];
+    for ( var i=0 ; i < 1000 ; i++ )
+	try { check(a[i%2]); } catch (e) {}
+    try { return check(a[0]); } catch (e) { return "Thrown" }
+}
+
+print(test());
+
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong.js
new file mode 100644
index 000000000..6696b2d2d
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr-wrong.js
@@ -0,0 +1,39 @@
+/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests
+ * internal to Type.toSource().
+ *
+ * In this case the argument type is never a type descriptor object,
+ * so ObjectIsTypeDescr resolves to false (and we have to catch
+ * exceptions).
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  You're looking for a smallish function within the
+ * "self-hosted" domain.  Look for a call to ObjectIsTypeDescr far
+ * down in the graph for pass00, with a call to DescrToSource in a
+ * subsequent block (all of this is at the mercy of the way the code
+ * is currently written).
+ */
+
+if (!this.TypedObject)
+  quit();
+
+var T = TypedObject;
+var ST = new T.StructType({x:T.int32});
+
+function check(v) {
+    return v.toSource();
+}
+
+function test() {
+    var fake = { toSource: ST.toSource };
+    for ( var i=0 ; i < 1000 ; i++ )
+	try { check(fake); } catch (e) {}
+    try { return check(fake); } catch (e) { return "Thrown" }
+}
+
+print(test());
+
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr.js
new file mode 100644
index 000000000..08f5bf47b
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypeDescr.js
@@ -0,0 +1,39 @@
+/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the ObjectIsTypeDescr tests
+ * internal to Type.toSource().
+ *
+ * In this case the argument type is always a type descriptor object,
+ * so ObjectIsTypeDescr resolves to true and there should be no
+ * exceptions.
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  You're looking for a smallish function within the
+ * "self-hosted" domain.  Look for a call to ObjectIsTypeDescr far
+ * down in the graph for pass00, with a call to DescrToSource in a
+ * subsequent block (all of this is at the mercy of the way the code
+ * is currently written).
+ */
+
+if (!this.TypedObject)
+  quit();
+
+var T = TypedObject;
+var ST = new T.StructType({x:T.int32});
+
+function check(v) {
+    return v.toSource();
+}
+
+function test() {
+    for ( var i=0 ; i < 1000 ; i++ )
+	check(ST);
+    return check(ST);
+}
+
+print(test());
+
+
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-multi.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-multi.js
new file mode 100644
index 000000000..b83656007
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-multi.js
@@ -0,0 +1,44 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the ObjectIsTypedObject tests
+ * used in the TO.objectType() method, among other places.
+ *
+ * In this case the argument type is always a TypedObject (though not
+ * a unique one), so ObjectIsTypedObject resolves to true and there
+ * should be no exceptions.
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  You're looking for a smallish function within the
+ * "self-hosted" domain.  Look for a call to ObjectIsTypedObject far
+ * down in the graph for pass00, with a subgraph before it that looks
+ * like it's comparing something to a string and to null (this is the
+ * inlining of IsObject).  (All of this is at the mercy of the way the
+ * code is currently written.)
+ */
+
+if (!this.TypedObject) {
+    print("No TypedObject, skipping");
+    quit();
+}
+
+var T = TypedObject;
+var ST1 = new T.StructType({x:T.int32});
+var ST2 = new T.StructType({f:T.float64});
+var v1 = new ST1({x:10});
+var v2 = new ST2({f:3.14159});
+
+function check(v) {
+  return T.objectType(v);
+}
+
+function test() {
+  var a = [ v1, v2 ];
+  for ( var i=0 ; i < 1000 ; i++ )
+    assertEq(check(a[i%2]), ((i%2)==0 ? ST1 : ST2));
+  return check(a[i%2]);
+}
+
+print("Done");
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-unknown.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-unknown.js
new file mode 100644
index 000000000..a008e65ae
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject-unknown.js
@@ -0,0 +1,47 @@
+/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the ObjectIsTypedObject tests
+ * used in the TO.objectType() method, among other places.
+ *
+ * In this case the argument type is sometimes a TypedObject,
+ * sometimes not, so ObjectIsTypedObject must be a run-time check and
+ * sometimes it resolves to "false" and takes a more expensive path.
+ * There should be no exceptions: the operation is defined also on
+ * non-TypedObjects.
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  You're looking for a smallish function within the
+ * "self-hosted" domain.  Look for a call to ObjectIsTypedObject far
+ * down in the graph for pass00, with a subgraph before it that looks
+ * like it's comparing something to a string and to null (this is the
+ * inlining of IsObject).  (All of this is at the mercy of the way the
+ * code is currently written.)
+ */
+
+if (!this.TypedObject) {
+    print("No TypedObject, skipping");
+    quit();
+}
+
+var T = TypedObject;
+var ST1 = new T.StructType({x:T.int32});
+var v1 = new ST1({x:10});
+
+function check(v) {
+    return T.objectType(v);
+}
+
+function test() {
+    var v2 = { tag: "Hello, world!" };
+    var a = [ v1, v2 ];
+    for ( var i=0 ; i < 1000 ; i++ )
+	assertEq(check(a[i%2]), (i%2) == 0 ? ST1 : T.Object);
+    return check(a[i%2]);
+}
+
+print("Done");
+
+
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject.js b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject.js
new file mode 100644
index 000000000..7618f278d
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-ObjectIsTypedObject.js
@@ -0,0 +1,43 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the ObjectIsTypedObject tests
+ * used in the TO.objectType() method, among other places.
+ *
+ * In this case the argument type is always a TypedObject, so
+ * ObjectIsTypedObject resolves to true and there should be no
+ * exceptions.
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  You're looking for a smallish function within the
+ * "self-hosted" domain.  Look for a call to ObjectIsTypedObject far
+ * down in the graph for pass00, with a subgraph before it that looks
+ * like it's comparing something to a string and to null (this is the
+ * inlining of IsObject).  (All of this is at the mercy of the way the
+ * code is currently written.)
+ */
+
+if (!this.TypedObject) {
+    print("No TypedObject, skipping");
+    quit();
+}
+
+var T = TypedObject;
+var ST = new T.StructType({x:T.int32});
+var v = new ST({x:10});
+
+function check(v) {
+  return T.objectType(v);
+}
+
+function test() {
+  for ( var i=0 ; i < 1000 ; i++ )
+    assertEq(check(v), ST);
+  return check(v);
+}
+
+print("Done");
+
+
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-TypeDescrIsSimpleType.js b/js/src/jit-test/tests/ion/inlining/TypedObject-TypeDescrIsSimpleType.js
new file mode 100644
index 000000000..7536c4218
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-TypeDescrIsSimpleType.js
@@ -0,0 +1,43 @@
+/* -*- tab-width: 8; indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Testing TypeDescrIsSimpleType() is tricky because it's not exposed.
+ * However, the implementation of <typed-object>.build() must use it.
+ *
+ * This basically asserts that build() works, and thus that the code is
+ * at least not broken.
+ *
+ * To verify that inlining happens:
+ *
+ * Run this with IONFLAGS=logs, generate pdfs with iongraph, and then
+ * try running "pdfgrep TypeDescrIsSimpleType func*pass00*.pdf", this
+ * might net a couple of functions that are likely candidates for
+ * manual inspection.
+ */
+
+if (!this.TypedObject) {
+    print("No TypedObject, skipping");
+    quit();
+}
+
+var T = TypedObject;
+var AT = new T.ArrayType(T.uint32, 100);
+
+function check() {
+    return AT.build(x => x+1);
+}
+
+function test() {
+    var w;
+    for ( var i=0 ; i < 100 ; i++ )
+	w = check();
+    return w;
+}
+
+var w = test();
+assertEq(w.length, 100);
+assertEq(w[99], 100);
+print("Done");
+
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-storage-opaque.js b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-opaque.js
new file mode 100644
index 000000000..7bf882e48
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-opaque.js
@@ -0,0 +1,36 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the transparent/opaque type
+ * tests internal to storage().
+ *
+ * In this case the argument type is always an opaque object, so
+ * ObjectIsOpaqueTypedObject resolves to true and
+ * ObjectIsTransparentTypedObject resolves to false.
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  func01 will likely be the one we want (look for calls to
+ * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject in the
+ * graph for pass00).
+ */
+
+if (!this.TypedObject)
+  quit();
+
+var T = TypedObject;
+
+function check(v) {
+    return T.storage(v);
+}
+
+function test() {
+    var AT = new T.ArrayType(T.Any,10);
+    var v = new AT();
+    for ( var i=0 ; i < 1000 ; i++ )
+        check(v);
+    return check(v);
+}
+
+test();
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-storage-transparent.js b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-transparent.js
new file mode 100644
index 000000000..e4faf1128
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-transparent.js
@@ -0,0 +1,36 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the transparent/opaque type
+ * tests internal to storage().
+ *
+ * In this case the argument type is always a transparent object, so
+ * ObjectIsOpaqueTypedObject resolves to false and
+ * ObjectIsTransparentTypedObject resolves to true.
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  func01 will likely be the one we want (look for calls to
+ * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject in the
+ * graph for pass00).
+ */
+
+if (!this.TypedObject)
+  quit();
+
+var T = TypedObject;
+
+function check(v) {
+    return T.storage(v);
+}
+
+function test() {
+    var AT = new T.ArrayType(T.int32, 10);
+    var v = new AT();
+    for ( var i=0 ; i < 1000 ; i++ )
+        check(v);
+    return check(v);
+}
+
+test();
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-storage-unknown.js b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-unknown.js
new file mode 100644
index 000000000..fe1aaa0d4
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-unknown.js
@@ -0,0 +1,39 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the transparent/opaque type
+ * tests internal to storage().
+ *
+ * In this case the argument type is variable and thus unknown to the
+ * JIT, so both ObjectIsOpaqueTypedObject and
+ * ObjectIsTransparentTypedObject are resolved as uses of the
+ * "HasClass" primitive.
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  func01 will likely be the one we want (look for calls to
+ * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject in the
+ * graph for pass00).
+ */
+
+if (!this.TypedObject)
+  quit();
+
+var T = TypedObject;
+
+function check(v) {
+    return T.storage(v);
+}
+
+function test() {
+    var AT = new T.ArrayType(T.int32,10);
+    var v = new Object;         // Not actually a typed object
+    var w = new AT();           // Actually a typed object
+    var a = [v,w];
+    for ( var i=0 ; i < 1000 ; i++ )
+        try { check(a[i%2]); } catch (e) {}
+    try { return check(a[1]); } catch (e) {}
+}
+
+test();
diff --git a/js/src/jit-test/tests/ion/inlining/TypedObject-storage-wrong.js b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-wrong.js
new file mode 100644
index 000000000..2e454c273
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/TypedObject-storage-wrong.js
@@ -0,0 +1,35 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*-
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+/* Used to verify that the JIT resolves the transparent/opaque type
+ * tests internal to storage().
+ *
+ * In this case the argument type is always a non-TypedObject, so both
+ * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject
+ * resolve to false.
+ *
+ * Load this into the js shell with IONFLAGS=logs, then exit and run
+ * iongraph.  func01 will likely be the one we want (look for calls to
+ * ObjectIsOpaqueTypedObject and ObjectIsTransparentTypedObject in the
+ * graph for pass00).
+ */
+
+if (!this.TypedObject)
+  quit();
+
+var T = TypedObject;
+
+function check(v) {
+    return T.storage(v);
+}
+
+function test() {
+    var v = new Object;         // Not actually a typed object
+    for ( var i=0 ; i < 1000 ; i++ )
+        try { check(v); } catch (e) {}
+    try { return check(v); } catch (e) {}
+}
+
+test();
diff --git a/js/src/jit-test/tests/ion/inlining/array-pop.js b/js/src/jit-test/tests/ion/inlining/array-pop.js
new file mode 100644
index 000000000..007b1dc8e
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/array-pop.js
@@ -0,0 +1,17 @@
+function f(arr) {
+    var x;
+    for (var i=0; i<100; i++) {
+        x = arr.pop();
+    }
+    return x;
+}
+
+var arr = [];
+for (var i=0; i<130; i++) {
+    arr.push({i: i});
+}
+
+assertEq(f(arr).i, 30);
+assertEq(arr.length, 30);
+assertEq(f(arr), undefined);
+assertEq(arr.length, 0);
diff --git a/js/src/jit-test/tests/ion/inlining/array-push.js b/js/src/jit-test/tests/ion/inlining/array-push.js
new file mode 100644
index 000000000..3e7ac159e
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/array-push.js
@@ -0,0 +1,37 @@
+function test1() {
+    function push(arr, x) {
+        return arr.push(x);
+    }
+    var arr = [];
+    for (var i=0; i<100; i++) {
+        assertEq(push(arr, i), i + 1);
+    }
+}
+test1();
+
+function test2() {
+    var arr;
+    for (var i=0; i<60; i++) {
+        arr = [];
+        assertEq(arr.push(3.3), 1);
+        assertEq(arr.push(undefined), 2);
+        assertEq(arr.push(true), 3);
+        assertEq(arr.push(Math), 4);
+        assertEq(arr.toString(), "3.3,,true,[object Math]");
+    }
+}
+test2();
+
+function test3() {
+    function push(arr, v) {
+        arr.push(v);
+    }
+    for (var i=0; i<60; i++) {
+        var arr = [];
+        push(arr, null);
+        push(arr, 3.14);
+        push(arr, {});
+        assertEq(arr.toString(), ",3.14,[object Object]");
+    }
+}
+test3();
diff --git a/js/src/jit-test/tests/ion/inlining/bug705251.js b/js/src/jit-test/tests/ion/inlining/bug705251.js
new file mode 100644
index 000000000..19f639d7a
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/bug705251.js
@@ -0,0 +1,10 @@
+function bitsinbyte() {
+    var c = 0;
+    while (false) c = c * 2;
+}
+function TimeFunc(func) {
+    for(var y=0; y<11000; y++)
+        func();
+}
+for (var i=0; i<50; i++)
+    TimeFunc(bitsinbyte);
diff --git a/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout-phi.js b/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout-phi.js
new file mode 100644
index 000000000..06bc1f6ef
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout-phi.js
@@ -0,0 +1,29 @@
+function add(x, y) {
+    if (x & 0x1)
+        return x + y;
+    else
+        return y + x;
+}
+
+function runBinop(binop, lhs, rhs) {
+    return binop(lhs, rhs);
+}
+
+//dis(run_binop);
+
+// Get the add function to compile.
+var accum = 0;
+for (var i = 0; i < 1000; ++i)
+    accum += add(1, 1);
+assertEq(accum, 2000);
+
+// Get the runBinop function to compile and inline the add function.
+var accum = 0;
+for (var i = 0; i < 11000; ++i)
+    accum = runBinop(add, i, i);
+assertEq(accum, 21998);
+
+var t30 = 1 << 30;
+var t31 = t30 + t30;
+var result = runBinop(add, t31, t31);
+assertEq(result, Math.pow(2, 32));
diff --git a/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout.js b/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout.js
new file mode 100644
index 000000000..fad2c1a3b
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/inline-callarg-bailout.js
@@ -0,0 +1,26 @@
+function add(x, y) {
+    return x + y;
+}
+
+function runBinop(binop, lhs, rhs) {
+    return binop(lhs, rhs);
+}
+
+//dis(run_binop);
+
+// Get the add function to compile.
+var accum = 0;
+for (var i = 0; i < 1000; ++i)
+    accum += add(1, 1);
+assertEq(accum, 2000);
+
+// Get the runBinop function to compile and inline the add function.
+var accum = 0;
+for (var i = 0; i < 10100; ++i)
+    accum = runBinop(add, i, i);
+assertEq(accum, 20198);
+
+var t30 = 1 << 30;
+var t31 = t30 + t30;
+var result = runBinop(add, t31, t31);
+assertEq(result, Math.pow(2, 32));
diff --git a/js/src/jit-test/tests/ion/inlining/inline-callarg-ubench-no-double2.js b/js/src/jit-test/tests/ion/inlining/inline-callarg-ubench-no-double2.js
new file mode 100644
index 000000000..385ea1a02
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/inline-callarg-ubench-no-double2.js
@@ -0,0 +1,27 @@
+function lameFunc(x, y) {
+  var lsw = (x & 0xFFFF) + (y & 0xFFFF);
+  var msw = (x >> 16) + (y >> 16) + (lsw >> 16);
+  return (msw << 16) | (lsw & 0xFFFF);
+}
+
+function runSomeTimes(func, iters) {
+    var result;
+    for (var i = 0; i < iters; ++i) {
+        result = func(42, 42);
+        result = func(42, 42);
+    }
+    return result;
+}
+
+// First, run the inner function to get TI information.
+for (var i = 0; i < 100; ++i)
+    lameFunc(42, 42);
+
+// Then, run the outer function with the inner function as a CALLARG to get it
+// to Ion compile with inlining.
+for (var i = 0; i < 11000; ++i)
+    runSomeTimes(lameFunc, 1);
+
+// Lastly, now that we're all inlined and compiled, perform the test!
+var iterations = 100;
+assertEq(84, runSomeTimes(lameFunc, iterations));
diff --git a/js/src/jit-test/tests/ion/inlining/inline-istypedarray-on-nontypedarray.js b/js/src/jit-test/tests/ion/inlining/inline-istypedarray-on-nontypedarray.js
new file mode 100644
index 000000000..e1c540d19
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/inline-istypedarray-on-nontypedarray.js
@@ -0,0 +1,6 @@
+(new Int8Array(3)).join();
+[Math.abs, Math.abs].forEach(x => {
+    try {
+        Int8Array.prototype.join.call(x);
+    } catch(e) {}
+});
diff --git a/js/src/jit-test/tests/ion/inlining/isFiniteInline.js b/js/src/jit-test/tests/ion/inlining/isFiniteInline.js
new file mode 100644
index 000000000..c61191ee5
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/isFiniteInline.js
@@ -0,0 +1,15 @@
+/* Test inlining of Number.isFinite() */
+
+for (var i = 0; i < 200000; i++) {
+    assertEq(Number.isFinite(NaN), false);
+    assertEq(Number.isFinite(-NaN), false);
+    assertEq(Number.isFinite(+Infinity), false);
+    assertEq(Number.isFinite(-Infinity), false);
+    assertEq(Number.isFinite(3), true);
+    assertEq(Number.isFinite(3.141592654), true);
+    assertEq(Number.isFinite(+0), true);
+    assertEq(Number.isFinite(-0), true);
+    assertEq(Number.isFinite(-3), true);
+    assertEq(Number.isFinite(-3.141592654), true);
+    assertEq(Number.isFinite({}), false);
+}
diff --git a/js/src/jit-test/tests/ion/inlining/isNaNInline.js b/js/src/jit-test/tests/ion/inlining/isNaNInline.js
new file mode 100644
index 000000000..f8c92e075
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/isNaNInline.js
@@ -0,0 +1,15 @@
+/* Test inlining of Number.isNaN() */
+
+for (var i = 0; i < 200000; i++) {
+    assertEq(Number.isNaN(NaN), true);
+    assertEq(Number.isNaN(-NaN), true);
+    assertEq(Number.isNaN(+Infinity), false);
+    assertEq(Number.isNaN(-Infinity), false);
+    assertEq(Number.isNaN(3.14159), false);
+    assertEq(Number.isNaN(-3.14159), false);
+    assertEq(Number.isNaN(3), false);
+    assertEq(Number.isNaN(-3), false);
+    assertEq(Number.isNaN(+0), false);
+    assertEq(Number.isNaN(-0), false);
+    assertEq(Number.isNaN({}), false);
+}
diff --git a/js/src/jit-test/tests/ion/inlining/typedarray-data-inlining-neuter-samedata.js b/js/src/jit-test/tests/ion/inlining/typedarray-data-inlining-neuter-samedata.js
new file mode 100644
index 000000000..16478e0a0
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/typedarray-data-inlining-neuter-samedata.js
@@ -0,0 +1,28 @@
+var NONINLINABLE_AMOUNT = 40;
+var SIZEOF_INT32 = 4;
+
+var INLINABLE_INT8_AMOUNT = 4;
+
+// Large arrays with non-inline data
+
+var ab1 = new ArrayBuffer(NONINLINABLE_AMOUNT * SIZEOF_INT32);
+var ta1 = new Int32Array(ab1);
+for (var i = 0; i < ta1.length; i++)
+  ta1[i] = i + 43;
+function q1() { return ta1[NONINLINABLE_AMOUNT - 1]; }
+assertEq(q1(), NONINLINABLE_AMOUNT - 1 + 43);
+assertEq(q1(), NONINLINABLE_AMOUNT - 1 + 43);
+detachArrayBuffer(ab1);
+assertEq(q1(), undefined);
+
+// Small arrays with inline data
+
+var ab2 = new ArrayBuffer(INLINABLE_INT8_AMOUNT);
+var ta2 = new Int8Array(ab2);
+for (var i = 0; i < ta2.length; i++)
+  ta2[i] = i + 13;
+function q2() { return ta2[INLINABLE_INT8_AMOUNT - 1]; }
+assertEq(q2(), INLINABLE_INT8_AMOUNT - 1 + 13);
+assertEq(q2(), INLINABLE_INT8_AMOUNT - 1 + 13);
+detachArrayBuffer(ab2);
+assertEq(q2(), undefined);
diff --git a/js/src/jit-test/tests/ion/inlining/typedarray-large-length.js b/js/src/jit-test/tests/ion/inlining/typedarray-large-length.js
new file mode 100644
index 000000000..9e6d67d3b
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/typedarray-large-length.js
@@ -0,0 +1,10 @@
+var SINGLETON_BYTE_LENGTH = 1024 * 1024 * 10;
+
+for (var i = 0; i < 2000; i++) {
+    if (i == 1500)
+        len = SINGLETON_BYTE_LENGTH >> 3;
+    else
+        len = i % 64;
+    var arr = new Float64Array(len);
+    assertEq(arr[0], len ? 0 : undefined);
+}
diff --git a/js/src/jit-test/tests/ion/inlining/typedarray-length-inlining-neuter.js b/js/src/jit-test/tests/ion/inlining/typedarray-length-inlining-neuter.js
new file mode 100644
index 000000000..520dd1a38
--- /dev/null
+++ b/js/src/jit-test/tests/ion/inlining/typedarray-length-inlining-neuter.js
@@ -0,0 +1,22 @@
+var INLINE_INT8_AMOUNT = 4;
+var OUT_OF_LINE_INT8_AMOUNT = 237;
+
+// Small and inline
+
+var ab1 = new ArrayBuffer(INLINE_INT8_AMOUNT);
+var ta1 = new Int8Array(ab1);
+function q1() { return ta1.length; }
+q1();
+q1();
+detachArrayBuffer(ab1);
+assertEq(q1(), 0);
+
+// Large and out-of-line
+
+var ab2 = new ArrayBuffer(OUT_OF_LINE_INT8_AMOUNT);
+var ta2 = new Int8Array(ab2);
+function q2() { return ta2.length; }
+q2();
+q2();
+detachArrayBuffer(ab2);
+assertEq(q2(), 0);