Add m-esr52 at 52.6.0

15 files changed, 279 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/self-hosting/GetStringDataProperty.js b/js/src/jit-test/tests/self-hosting/GetStringDataProperty.js
new file mode 100644
index 000000000..119bedcbc
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/GetStringDataProperty.js
@@ -0,0 +1,33 @@
+// Bug 1267364 - GetStringDataProperty should return undefined when the object
+// is non-native.
+
+var GetStringDataProperty = getSelfHostedValue("GetStringDataProperty");
+
+function testProxy() {
+    var obj = new Proxy({"foo": "10"}, {});
+    var v = GetStringDataProperty(obj, "foo");
+    assertEq(v, undefined);
+}
+
+function testMaybeUnboxed() {
+    // Use JSON.parse to create unboxed object if availbale.
+    var obj = JSON.parse("[" + '{"foo": "10"},'.repeat(100) +"{}]");
+
+    // GetStringDataProperty may return "10" or undefined, depending on whether
+    // `obj` is unboxed or not
+    var v = GetStringDataProperty(obj[0], "foo");
+    assertEq(v == undefined || v == "10", true);
+}
+
+function testTypedObject() {
+    var {StructType, string} = TypedObject;
+    var S = new StructType({foo: string});
+    var obj = new S({foo: "10"});
+    var v = GetStringDataProperty(obj, "foo");
+    assertEq(v, undefined);
+}
+
+testProxy();
+testMaybeUnboxed();
+if (typeof TypedObject !== "undefined")
+    testTypedObject();
diff --git a/js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js b/js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js
new file mode 100644
index 000000000..38c838357
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/alternate-static-and-instance-array-extras.js
@@ -0,0 +1,3 @@
+actual = Array.indexOf([]);
+actual += [].indexOf();
+actual += Array.indexOf([]);
\ No newline at end of file
diff --git a/js/src/jit-test/tests/self-hosting/bug1264575.js b/js/src/jit-test/tests/self-hosting/bug1264575.js
new file mode 100644
index 000000000..db74ef48c
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/bug1264575.js
@@ -0,0 +1,7 @@
+function f(x, [y]) {}
+f(0, []);
+// jsfunfuzz-generated
+let i = 0;
+for (var z of [0, 0, 0]) {
+    verifyprebarriers();
+}
diff --git a/js/src/jit-test/tests/self-hosting/bug957004.js b/js/src/jit-test/tests/self-hosting/bug957004.js
new file mode 100644
index 000000000..ce767a9a4
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/bug957004.js
@@ -0,0 +1,3 @@
+// No result, just mustn't crash.
+Array.prototype.push(0);
+Array.prototype.indexOf();
diff --git a/js/src/jit-test/tests/self-hosting/define-value-property.js b/js/src/jit-test/tests/self-hosting/define-value-property.js
new file mode 100644
index 000000000..b5ffebde2
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/define-value-property.js
@@ -0,0 +1,8 @@
+// These tests just mustn't trigger asserts.
+if (!this.hasOwnProperty('Intl'))
+    quit();
+
+Object.prototype.get = 5;
+new Intl.Collator().resolvedOptions();
+
+Intl.DateTimeFormat.supportedLocalesOf('en');
diff --git a/js/src/jit-test/tests/self-hosting/for-each-in-over-uncloned-method.js b/js/src/jit-test/tests/self-hosting/for-each-in-over-uncloned-method.js
new file mode 100644
index 000000000..cca58512e
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/for-each-in-over-uncloned-method.js
@@ -0,0 +1 @@
+for each(e in [].some) {}
\ No newline at end of file
diff --git a/js/src/jit-test/tests/self-hosting/get-backtrace-in-constructing-bound-function.js b/js/src/jit-test/tests/self-hosting/get-backtrace-in-constructing-bound-function.js
new file mode 100644
index 000000000..10cc1b321
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/get-backtrace-in-constructing-bound-function.js
@@ -0,0 +1,6 @@
+function t() {
+    getBacktrace({ locals: true });
+}
+var f = t.bind();
+new f();
+f();
diff --git a/js/src/jit-test/tests/self-hosting/getbuiltinconstructor.js b/js/src/jit-test/tests/self-hosting/getbuiltinconstructor.js
new file mode 100644
index 000000000..57134875a
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/getbuiltinconstructor.js
@@ -0,0 +1,13 @@
+let getCtor = getSelfHostedValue('GetBuiltinConstructor');
+
+assertEq(getCtor('Array'), Array);
+
+let origArray = Array;
+Array = function(){};
+assertEq(getCtor('Array') == Array, false);
+assertEq(getCtor('Array'), origArray);
+
+let origMap = Map;
+Map = function(){};
+assertEq(getCtor('Map') == Map, false);
+assertEq(getCtor('Map'), origMap);
diff --git a/js/src/jit-test/tests/self-hosting/invoke-self-hosted-function.js b/js/src/jit-test/tests/self-hosting/invoke-self-hosted-function.js
new file mode 100644
index 000000000..88893c58b
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/invoke-self-hosted-function.js
@@ -0,0 +1,9 @@
+var callees = [function a() {}, function b() {}, function c() {}, function d() {}, Array.prototype.forEach];
+
+function f() {
+    for (var i = 0; i < callees.length; ++i) {
+    	callees[i](function(){});
+    }
+}
+
+f();
\ No newline at end of file
diff --git a/js/src/jit-test/tests/self-hosting/invoke-self-hosted-with-primitive-this.js b/js/src/jit-test/tests/self-hosting/invoke-self-hosted-with-primitive-this.js
new file mode 100644
index 000000000..24130e0f0
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/invoke-self-hosted-with-primitive-this.js
@@ -0,0 +1,7 @@
+try {
+	[0,0].sort(Array.some)
+	"".replace(RegExp(), Array.reduce)
+} catch (error) {
+	if (!(error instanceof TypeError && /^\w is not a function$/.test(error.message)))
+		throw error;
+}
diff --git a/js/src/jit-test/tests/self-hosting/is-possibly-wrapped-typed-array.js b/js/src/jit-test/tests/self-hosting/is-possibly-wrapped-typed-array.js
new file mode 100644
index 000000000..5e76aad69
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/is-possibly-wrapped-typed-array.js
@@ -0,0 +1,151 @@
+var IsPossiblyWrappedTypedArray = getSelfHostedValue("IsPossiblyWrappedTypedArray");
+
+var declareSamples = `
+    var allTypedArraySamples = [
+        { value: new Int8Array(1), expected: true },
+        { value: new Uint8Array(1), expected: true },
+        { value: new Int16Array(1), expected: true },
+        { value: new Uint16Array(1), expected: true },
+        { value: new Int32Array(1), expected: true },
+        { value: new Uint32Array(1), expected: true },
+        { value: new Float32Array(1), expected: true },
+        { value: new Float64Array(1), expected: true },
+        { value: new Uint8ClampedArray(1), expected: true }
+    ];
+
+    var allObjectSamples = [
+        { value: new Array(1), expected: false },
+        { value: {}, expected: false },
+        { value: { length: 1 }, expected: false }
+    ];
+
+    var allNonObjectSamples = [
+        { value: "a", expected: false },
+        { value: 1.2, expected: false },
+        { value: true, expected: false },
+        { value: Symbol("a"), expected: false }
+    ];
+`;
+
+// Create a new global to wrap with cross compartment wrappers.
+var g = newGlobal();
+evaluate(declareSamples)
+g.evaluate(declareSamples);
+
+var assertCode = `function (value, expected) {
+    assertEq(IsPossiblyWrappedTypedArray(value), expected);
+    return inIon();
+}`;
+
+function checkSamples(samples) {
+    // Create the assert function anew every run so as not to share JIT code,
+    // type information, etc.
+    var assert = new Function(`return (${assertCode})`)();
+
+    // Prevent Ion compilation of this function so that we don't freeze the
+    // sample array's type.  If we did, IonBuilder's typed-array-length inlining
+    // would always see a Mixed state, preventing IsPossiblyWrappedTypedArray
+    // from being inlined.
+    with ({}) {};
+
+    do {
+        // spinInJit is used to ensure that we at least test all elements in the
+        // sample vector while running a compiled version of the assert
+        // function.
+        var spinInJit = true;
+        for (var i = 0; i < samples.length; i++) {
+            var e = samples[i];
+            if (!e) continue;
+            spinInJit = spinInJit && assert(e.value, e.expected);
+        }
+    } while(!spinInJit);
+}
+
+// Check a mix of samples from each type.
+function test(a, b, c, d, e, f) {
+    var samples = [
+        a == -1 ? null : allTypedArraySamples[a],
+        b == -1 ? null : allObjectSamples[b],
+        c == -1 ? null : allNonObjectSamples[c],
+        d == -1 ? null : g.allTypedArraySamples[d],
+        e == -1 ? null : g.allObjectSamples[e],
+        f == -1 ? null : g.allNonObjectSamples[f]
+    ];
+
+    checkSamples(samples);
+}
+
+// Check all samples.
+checkSamples(allTypedArraySamples);
+checkSamples(allObjectSamples);
+checkSamples(allNonObjectSamples);
+checkSamples(g.allTypedArraySamples);
+checkSamples(g.allObjectSamples);
+checkSamples(g.allNonObjectSamples);
+
+// Check combinations mixing 2 elements from different types.
+test(-1, -1, -1, -1,  0,  0);
+test(-1, -1, -1,  0, -1,  0);
+test(-1, -1, -1,  0,  0, -1);
+test(-1, -1,  0, -1, -1,  0);
+test(-1, -1,  0, -1,  0, -1);
+test(-1, -1,  0,  0, -1, -1);
+test(-1,  0, -1, -1, -1,  0);
+test(-1,  0, -1, -1,  0, -1);
+test(-1,  0, -1,  0, -1, -1);
+test(-1,  0,  0, -1, -1, -1);
+test( 0, -1, -1, -1, -1,  0);
+test( 0, -1, -1, -1,  0, -1);
+test( 0, -1, -1,  0, -1, -1);
+test( 0, -1,  0, -1, -1, -1);
+test( 0,  0, -1, -1, -1, -1);
+
+// Check combinations mixing 3 elements from different types.
+test(-1, -1, -1,  0,  0,  0);
+test(-1, -1,  0, -1,  0,  0);
+test(-1, -1,  0,  0, -1,  0);
+test(-1, -1,  0,  0,  0, -1);
+test(-1,  0, -1, -1,  0,  0);
+test(-1,  0, -1,  0, -1,  0);
+test(-1,  0, -1,  0,  0, -1);
+test(-1,  0,  0, -1, -1,  0);
+test(-1,  0,  0, -1,  0, -1);
+test(-1,  0,  0,  0, -1, -1);
+test( 0, -1, -1, -1,  0,  0);
+test( 0, -1, -1,  0, -1,  0);
+test( 0, -1, -1,  0,  0, -1);
+test( 0, -1,  0, -1, -1,  0);
+test( 0, -1,  0, -1,  0, -1);
+test( 0, -1,  0,  0, -1, -1);
+test( 0,  0, -1, -1, -1,  0);
+test( 0,  0, -1, -1,  0, -1);
+test( 0,  0, -1,  0, -1, -1);
+test( 0,  0,  0, -1, -1, -1);
+
+// Check combinations mixing 4 elements from different types.
+test(-1, -1,  0,  0,  0,  0);
+test(-1,  0, -1,  0,  0,  0);
+test(-1,  0,  0, -1,  0,  0);
+test(-1,  0,  0,  0, -1,  0);
+test(-1,  0,  0,  0,  0, -1);
+test( 0, -1, -1,  0,  0,  0);
+test( 0, -1,  0, -1,  0,  0);
+test( 0, -1,  0,  0, -1,  0);
+test( 0, -1,  0,  0,  0, -1);
+test( 0,  0, -1, -1,  0,  0);
+test( 0,  0, -1,  0, -1,  0);
+test( 0,  0, -1,  0,  0, -1);
+test( 0,  0,  0, -1, -1,  0);
+test( 0,  0,  0, -1,  0, -1);
+test( 0,  0,  0,  0, -1, -1);
+
+// Check combinations mixing 5 elements from different types.
+test(-1,  0,  0,  0,  0,  0);
+test( 0, -1,  0,  0,  0,  0);
+test( 0,  0, -1,  0,  0,  0);
+test( 0,  0,  0, -1,  0,  0);
+test( 0,  0,  0,  0, -1,  0);
+test( 0,  0,  0,  0,  0, -1);
+
+// Check combinations mixing 6 elements from different types.
+test( 0,  0,  0,  0,  0,  0);
diff --git a/js/src/jit-test/tests/self-hosting/makeconstructible-function-inherited-prototype-property.js b/js/src/jit-test/tests/self-hosting/makeconstructible-function-inherited-prototype-property.js
new file mode 100644
index 000000000..ff4d0c000
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/makeconstructible-function-inherited-prototype-property.js
@@ -0,0 +1,3 @@
+var proxy = new Proxy({ get: function() { throw 42; } }, {});
+Function.prototype.__proto__ = proxy;
+this.hasOwnProperty("Intl");
diff --git a/js/src/jit-test/tests/self-hosting/method-called-on-incompatible.js b/js/src/jit-test/tests/self-hosting/method-called-on-incompatible.js
new file mode 100644
index 000000000..2d111cc3a
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/method-called-on-incompatible.js
@@ -0,0 +1,9 @@
+load(libdir + "asserts.js");
+
+assertTypeErrorMessage(() => WeakSet.prototype.add.call({}), "add method called on incompatible Object");
+assertTypeErrorMessage(() => newGlobal().WeakSet.prototype.add.call({}), "add method called on incompatible Object");
+assertTypeErrorMessage(() => WeakSet.prototype.add.call(15), "add method called on incompatible number");
+
+assertTypeErrorMessage(() => Int8Array.prototype.find.call({}), "find method called on incompatible Object");
+assertTypeErrorMessage(() => newGlobal().Int8Array.prototype.find.call({}), "find method called on incompatible Object");
+assertTypeErrorMessage(() => Int8Array.prototype.find.call(15), "find method called on incompatible number");
diff --git a/js/src/jit-test/tests/self-hosting/object-define-hazard.js b/js/src/jit-test/tests/self-hosting/object-define-hazard.js
new file mode 100644
index 000000000..7a1ccc224
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/object-define-hazard.js
@@ -0,0 +1,18 @@
+// We shouldn't do the wrong thing in the face of an evil Object.prototype
+
+Object.prototype.get = function() {};
+var x = {};
+var setter = function () {};
+x.__defineSetter__("a", setter);
+var desc = Object.getOwnPropertyDescriptor(x, "a");
+assertEq(desc.get, undefined);
+assertEq(desc.set, setter);
+delete Object.prototype.get;
+
+Object.prototype.set = function() {};
+x = {};
+var getter = function () {};
+x.__defineGetter__("a", getter);
+desc = Object.getOwnPropertyDescriptor(x, "a");
+assertEq(desc.set, undefined);
+assertEq(desc.get, getter);
diff --git a/js/src/jit-test/tests/self-hosting/object-lookup-hazard.js b/js/src/jit-test/tests/self-hosting/object-lookup-hazard.js
new file mode 100644
index 000000000..5197a9113
--- /dev/null
+++ b/js/src/jit-test/tests/self-hosting/object-lookup-hazard.js
@@ -0,0 +1,8 @@
+// We shouldn't do the wrong thing in the face of an evil Object.prototype
+
+Object.prototype.get = function() {};
+assertEq(({a: 1}).__lookupGetter__("a"), undefined);
+delete Object.prototype.get;
+
+Object.prototype.set = function() {};
+assertEq(({a: 1}).__lookupSetter__("a"), undefined);