Add m-esr52 at 52.6.0

19 files changed, 662 insertions, 0 deletions

diff --git a/js/src/jit-test/tests/wasm/regress/baseline-pop-along-edge.js b/js/src/jit-test/tests/wasm/regress/baseline-pop-along-edge.js
new file mode 100644
index 000000000..75768f0d7
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/baseline-pop-along-edge.js
@@ -0,0 +1,68 @@
+// Bug 1316181
+
+load(libdir + "wasm.js");
+
+// There are locals with different values here to ensure that the
+// get_local at the end picks up the right one even if the stack might
+// have become unbalanced by a failure to adjust SP along the branch
+// edge.  The logic is that we use SP-relative addressing, and if the
+// actual SP is not what the compiler thinks it is we will read
+// something other than the expected value.
+
+var o = wasmEvalText(
+    `(module
+      (func (result i32)
+       (local $v0 i32)
+       (local $v1 i32)
+       (local $v2 i32)
+       (local $v3 i32)
+       (local $v4 i32)
+       (local $v5 i32)
+       (local $v6 i32)
+       (local $v7 i32)
+       (local $res i32)
+       (set_local $v0 (i32.const 0xDEADBEEF))
+       (set_local $v1 (i32.const 0xFDEADBEE))
+       (set_local $v2 (i32.const 0xEFDEADBE))
+       (set_local $v3 (i32.const 0xEEFDEADB))
+       (set_local $v4 (i32.const 0xBEEFDEAD))
+       (set_local $v5 (i32.const 0xDBEEFDEA))
+       (set_local $v6 (i32.const 0xADBEEFDE))
+       (set_local $v7 (i32.const 0xEADBEEFD))
+       (block $b
+	(set_local $res
+	 (i32.add
+	  (i32.add (i32.const 1) (i32.const 2))
+	  (i32.add
+	   (i32.add (i32.const 3) (i32.const 4))
+	   (i32.add
+	    (i32.add (i32.const 5) (i32.const 6))
+	    (i32.add
+	     (i32.add (i32.const 7) (i32.const 8))
+	     (i32.add
+	      (i32.add (i32.const 9) (i32.const 10))
+	      (i32.add
+	       (i32.add (i32.const 11) (i32.const 12))
+	       (i32.add
+		(i32.add (i32.const 13) (i32.const 14))
+		(i32.add
+		 (i32.add (i32.const 15) (i32.const 16))
+		 (i32.add
+		  (i32.add (i32.const 17) (i32.const 18))
+		  (i32.add
+		   (i32.add (i32.const 19) (i32.const 20))
+		   (i32.add
+		    (i32.add (i32.const 21) (i32.const 22))
+		    (i32.add
+		     (i32.add (i32.const 23) (i32.const 24))
+		     (i32.add
+		      (i32.add (i32.const 25) (i32.const 26))
+		      (i32.add
+		       (i32.add (i32.const 27) (i32.const 28))
+		       (i32.add
+			(i32.add (i32.const 29) (i32.const 30))
+			(br_if $b (i32.const 31) (i32.const 1)))))))))))))))))))
+       (return (get_local $v3)))
+      (export "a" 0))`).exports;
+
+assertEq(o["a"](), 0xEEFDEADB|0);
diff --git a/js/src/jit-test/tests/wasm/regress/brtable-conditionblock-folding.js b/js/src/jit-test/tests/wasm/regress/brtable-conditionblock-folding.js
new file mode 100644
index 000000000..a2f9b4e37
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/brtable-conditionblock-folding.js
@@ -0,0 +1,19 @@
+load(libdir + "wasm.js");
+
+assertEq(wasmEvalText(`
+(module
+  (func $f (param $p i32)
+    block $out
+      i32.const 0
+      if
+        i32.const 1
+        tee_local $p
+        br_table $out $out
+      end
+    end
+    get_local $p
+    br_if 0
+  )
+  (export "f" $f)
+)
+`).exports.f(42), undefined);
diff --git a/js/src/jit-test/tests/wasm/regress/bug1300546.js b/js/src/jit-test/tests/wasm/regress/bug1300546.js
new file mode 100644
index 000000000..6ef35dc13
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/bug1300546.js
@@ -0,0 +1,34 @@
+load(libdir + "wasm.js");
+
+setJitCompilerOption('wasm.test-mode', 1);
+
+try {
+    wasmEvalText(`
+
+    (module
+      (type $type0 (func))
+      (func $func0
+          (nop)
+          (f64.load offset=59 align=1 (i32.const 0))
+          (current_memory)
+          (current_memory)
+          (current_memory)
+          (current_memory)
+          (current_memory)
+          (current_memory)
+          (current_memory)
+          (current_memory)
+          (i64.rem_s (i64.const 17) (i64.xor (i64.const 17) (i64.xor (i64.const 17) (i64.xor (i64.xor (i64.const 17) (i64.const 17)) (i64.xor (i64.const 17) (i64.const 17))))))
+
+         (i64.rem_s
+          (i64.const 17)
+          (i64.xor
+            (i64.rem_s (i64.const 17) (i64.const 17))
+            (i64.xor (i64.rem_s (i64.const 17) (i64.const 17)) (i64.xor (i64.const 17) (i64.const 17)))))
+      )
+      (memory 1 1)
+    )
+
+    `)(createI64(41));
+} catch(e) {
+}
diff --git a/js/src/jit-test/tests/wasm/regress/bug1311019.js b/js/src/jit-test/tests/wasm/regress/bug1311019.js
new file mode 100644
index 000000000..db977d108
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/bug1311019.js
@@ -0,0 +1,11 @@
+load(libdir + "wasm.js");
+
+new WebAssembly.Module(wasmTextToBinary(`(module
+    (memory 1)
+    (func
+        (i64.trunc_s/f32 (f32.const 6.96875))
+        (i32.load8_s (i32.const 0))
+        (f32.const -7.66028056e-31)
+        (unreachable)
+    )
+)`));
diff --git a/js/src/jit-test/tests/wasm/regress/directives.txt b/js/src/jit-test/tests/wasm/regress/directives.txt
new file mode 100644
index 000000000..057bdf4c2
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/directives.txt
@@ -0,0 +1 @@
+|jit-test| test-also-wasm-baseline
diff --git a/js/src/jit-test/tests/wasm/regress/gvn-unremovable-phi.js b/js/src/jit-test/tests/wasm/regress/gvn-unremovable-phi.js
new file mode 100644
index 000000000..02b5fed5f
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/gvn-unremovable-phi.js
@@ -0,0 +1,22 @@
+load(libdir + "wasm.js");
+
+wasmEvalText(`(module
+  (type $type0 (func (param i32)))
+  (func $f (param $p i32)
+    (local $x i32) (local $y i32)
+    loop $top
+      get_local $x
+      get_local $p
+      get_local $x
+      br_if $top
+      i32.const 1
+      tee_local $p
+      get_local $y
+      set_local $x
+      i32.add
+      call $f
+      br_if $top
+      return
+    end
+  )
+)`);
diff --git a/js/src/jit-test/tests/wasm/regress/misc-control-flow.js b/js/src/jit-test/tests/wasm/regress/misc-control-flow.js
new file mode 100644
index 000000000..81d44f278
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/misc-control-flow.js
@@ -0,0 +1,226 @@
+load(libdir + "wasm.js");
+
+wasmFailValidateText(`(module
+   (func (result i32) (param i32)
+     (loop (if (i32.const 0) (br 0)) (get_local 0)))
+   (export "" 0)
+)`, /unused values not explicitly dropped by end of block/);
+
+wasmFailValidateText(`(module
+   (func (param i32)
+     (loop (if (i32.const 0) (br 0)) (get_local 0)))
+   (export "" 0)
+)`, /unused values not explicitly dropped by end of block/);
+
+wasmFailValidateText(`(module
+   (func (result i32) (param i32)
+     (loop (if (i32.const 0) (br 0)) (drop (get_local 0))))
+   (export "" 0)
+)`, mismatchError("void", "i32"));
+
+assertEq(wasmEvalText(`(module
+   (func (result i32) (param i32)
+     (loop (if (i32.const 0) (br 0))) (get_local 0))
+   (export "" 0)
+)`).exports[""](42), 42);
+
+wasmEvalText(`(module (func $func$0
+      (block (if (i32.const 1) (loop (br_table 0 (br 0)))))
+  )
+)`);
+
+wasmEvalText(`(module (func
+      (loop $out $in (br_table $out $out $in (i32.const 0)))
+  )
+)`);
+
+wasmEvalText(`(module (func (result i32)
+  (select
+    (block i32
+      (drop (block i32
+        (br_table
+         1
+         0
+         (i32.const 1)
+         (i32.const 0)
+        )
+      ))
+      (i32.const 2)
+    )
+    (i32.const 3)
+    (i32.const 4)
+  )
+))
+`);
+
+wasmEvalText(`(module
+  (func (result i32) (param i32) (param i32) (i32.const 0))
+  (func (result i32)
+   (call 0 (i32.const 1) (call 0 (i32.const 2) (i32.const 3)))
+   (call 0 (unreachable) (i32.const 4))
+  )
+)`);
+
+wasmEvalText(`
+(module
+
+ (func
+  (param i32) (param i32) (param i32) (param i32)
+  (result i32)
+  (i32.const 0)
+ )
+
+ (func (result i32)
+  (call 0
+   (i32.const 42)
+   (i32.const 53)
+   (call 0 (i32.const 100) (i32.const 13) (i32.const 37) (i32.const 128))
+   (return (i32.const 42))
+  )
+ )
+
+ (export "" 1)
+)
+`).exports[""]();
+
+wasmEvalText(`
+(module
+    (import "check" "one" (param i32))
+    (import "check" "two" (param i32) (param i32))
+    (func (param i32) (call 0 (get_local 0)))
+    (func (param i32) (param i32) (call 1 (get_local 0) (get_local 1)))
+    (func
+        (call 1
+            (i32.const 43)
+            (block $b i32
+                (if (i32.const 1)
+                    (call 0
+                        (block i32
+                            (call 0 (i32.const 42))
+                            (br $b (i32.const 10)))))
+                (i32.const 44))))
+    (export "foo" 4))
+`, {
+    check: {
+        one(x) {
+            assertEq(x, 42);
+        },
+        two(x, y) {
+            assertEq(x, 43);
+            assertEq(y, 10);
+        }
+    }
+}).exports.foo();
+
+assertEq(wasmEvalText(`(module (func
+ (return)
+ (select
+  (loop (i32.const 1))
+  (loop (i32.const 2))
+  (i32.const 3)
+ )
+) (export "" 0))`).exports[""](), undefined);
+
+wasmEvalText(`(module (func (result i32)
+ (return (i32.const 0))
+ (select
+  (loop (i32.const 1))
+  (loop (i32.const 2))
+  (i32.const 3)
+ )
+))`);
+
+wasmEvalText(`(module (func
+ (block $return
+  (block $beforeReturn
+   (loop $out $in
+    (block $otherTable
+      (br_table
+       $return
+       $return
+       $otherTable
+       $beforeReturn
+       (i32.const 0)
+      )
+    )
+    (block $backTop
+     (br_table
+      $backTop
+      $backTop
+      $beforeReturn
+      (i32.const 0)
+     )
+    )
+    (br $in)
+   )
+  )
+ )
+))`);
+
+wasmFailValidateText(
+`(module
+  (func $func$0
+   (select
+    (if f32
+     (i32.const 0)
+     (f32.const 0)
+     (i32.const 0)
+    )
+    (if f32
+     (i32.const 0)
+     (f32.const 0)
+     (i32.const 0)
+    )
+    (i32.const 0)
+   )
+  )
+)`, mismatchError("i32", "f32"));
+
+wasmEvalText(`
+(module
+ (func (result i32)
+  (i32.add
+   (block $outer i32
+    (drop (block $middle i32
+     (block $inner i32
+      (br_table $middle $outer $inner (i32.const 42) (i32.const 1))
+     )
+     (nop)
+    ))
+    (i32.const 0)
+   )
+   (i32.const 13)
+  )
+ )
+)
+`);
+
+wasmFailValidateText(`
+(module
+    (func (result i32)
+      (loop
+        (i32.const 0)
+        (br_table 1 0 (i32.const 15))
+      )
+    )
+)`, mismatchError("i32", "void"));
+
+wasmFailValidateText(`
+(module
+  (func (result i32)
+    (loop i32
+      (i32.const 0)
+      (br_table 1 0 (i32.const 15))
+    )
+  )
+)`, mismatchError("i32", "void"));
+
+wasmValidateText(`
+(module
+    (func
+        (loop
+          (i32.const 0)
+          (br_table 1 0 (i32.const 15))
+        )
+    )
+)`);
diff --git a/js/src/jit-test/tests/wasm/regress/movable-traps.js b/js/src/jit-test/tests/wasm/regress/movable-traps.js
new file mode 100644
index 000000000..07a980a1e
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/movable-traps.js
@@ -0,0 +1,40 @@
+load(libdir + "wasm.js");
+
+let bodies = [
+    `
+    i32.const 1
+    i32.const 0
+    i32.div_s
+    `,
+    `
+    i32.const 1
+    i32.const 0
+    i32.rem_s
+    `,
+    `
+    f64.const 1797693134862315708145274e284
+    i64.trunc_s/f64
+    `,
+    `
+    f32.const 1797693134862315708145274e284
+    i32.trunc_s/f32
+    `
+];
+
+for (let body of bodies) {
+    wasmFullPass(`
+    (module
+        (func $f (param $x i32) (result i32)
+            loop $top
+                get_local $x
+                if
+                    get_local $x
+                    br 2
+                end
+                ${body}
+                br $top
+            end
+        )
+        (export "run" $f)
+    )`, 42, {}, 42);
+}
diff --git a/js/src/jit-test/tests/wasm/regress/null-metadata-filename.js b/js/src/jit-test/tests/wasm/regress/null-metadata-filename.js
new file mode 100644
index 000000000..5d653062a
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/null-metadata-filename.js
@@ -0,0 +1,14 @@
+if (typeof enableSPSProfiling === 'undefined' || !isAsmJSCompilationAvailable())
+    quit();
+
+evaluate(`
+let f = evalReturningScope.bind(null, '');
+
+(function(glob, stdlib) {
+    "use asm";
+    var f = stdlib.f;
+    function _() { f(); }
+    return _;
+})(this, { f })();
+`, { fileName: null });
+
diff --git a/js/src/jit-test/tests/wasm/regress/oom-eval.js b/js/src/jit-test/tests/wasm/regress/oom-eval.js
new file mode 100644
index 000000000..738a21857
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/oom-eval.js
@@ -0,0 +1,12 @@
+// |jit-test| slow; allow-oom
+
+if (typeof oomTest !== 'function' || !wasmIsSupported()) {
+    print('Missing oomTest or wasm support in wasm/regress/oom-eval');
+    quit();
+}
+
+function foo() {
+  var g = newGlobal();
+  g.eval(`o = new WebAssembly.Instance(new WebAssemby.Module(wasmTextToBinary('(module (func) (export "" 0))')));`);
+}
+oomTest(foo);
diff --git a/js/src/jit-test/tests/wasm/regress/oom-init.js b/js/src/jit-test/tests/wasm/regress/oom-init.js
new file mode 100644
index 000000000..24719d316
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/oom-init.js
@@ -0,0 +1,24 @@
+// |jit-test| slow; allow-oom
+
+if (typeof oomTest !== 'function' || !wasmIsSupported())
+    quit();
+
+Object.getOwnPropertyNames(this);
+s = newGlobal();
+evalcx("\
+    /x/;\
+    oomTest(function() {\
+        this[\"\"];\
+        void 0;\
+        Object.freeze(this);\
+        l(undefined)();\
+        O;\
+        t;\
+        0;\
+        ({e});\
+        i;\
+        0;\
+        ({ z: p ? 0 : 0});\
+        s;\
+    });\
+", s);
diff --git a/js/src/jit-test/tests/wasm/regress/pass-stack-int64.js b/js/src/jit-test/tests/wasm/regress/pass-stack-int64.js
new file mode 100644
index 000000000..0350f5ad8
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/pass-stack-int64.js
@@ -0,0 +1,17 @@
+load(libdir + "wasm.js");
+
+var params = '';
+var locals = '';
+for (let i = 0; i < 20; i++) {
+    params += '(param i64) ';
+    locals += `(get_local ${i}) `;
+}
+
+wasmEvalText(`
+(module
+    (func
+        ${params}
+        (call 0 ${locals})
+    )
+)
+`);
diff --git a/js/src/jit-test/tests/wasm/regress/regalloc-muli64.js b/js/src/jit-test/tests/wasm/regress/regalloc-muli64.js
new file mode 100644
index 000000000..c90cd40e0
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/regalloc-muli64.js
@@ -0,0 +1,16 @@
+load(libdir + "wasm.js");
+
+// Bug 1298808.
+assertEq(wasmEvalText(`(module
+    (func
+        (result i32)
+        (i32.wrap/i64
+            (i64.mul
+                ;; Conditions: rhs == lhs, rhs is not a constant.
+                (i64.add (i64.const 1) (i64.const 10))
+                (i64.add (i64.const 1) (i64.const 10))
+            )
+        )
+    )
+    (export "" 0)
+)`).exports[""](), 121);
diff --git a/js/src/jit-test/tests/wasm/regress/reserve-enough.js b/js/src/jit-test/tests/wasm/regress/reserve-enough.js
new file mode 100644
index 000000000..4866772b2
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/reserve-enough.js
@@ -0,0 +1,15 @@
+load(libdir + "wasm.js");
+
+// Bug 1281131 - be sure to reserve enough stack space
+
+wasmEvalText(
+`(module
+  (func $func0
+   ${loopy(100)}
+   (nop)))`);
+
+function loopy(n) {
+    if (n == 0)
+	return "(nop)";
+    return `(loop $out${n} $in${n} ${loopy(n-1)})`;
+}
diff --git a/js/src/jit-test/tests/wasm/regress/reserve-joinreg.js b/js/src/jit-test/tests/wasm/regress/reserve-joinreg.js
new file mode 100644
index 000000000..354292a8a
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/reserve-joinreg.js
@@ -0,0 +1,18 @@
+load(libdir + "wasm.js");
+
+// Bug 1280933, excerpted from binary test case provided there.
+
+wasmEvalText(
+`(module
+  (func $func0 (param $arg0 i32) (result i32) (local $var0 i64)
+	(set_local $var0 (i64.extend_u/i32 (get_local $arg0)))
+	(i32.wrap/i64
+	 (i64.add
+	  (block i64
+	   (loop $label1 $label0
+		(drop (block $label2 i64
+		       (br_table $label2 (i64.const 0) (get_local $arg0))))
+		(set_local $var0 (i64.mul (i64.const 2) (get_local $var0))))
+	   (tee_local $var0 (i64.add (i64.const 4) (get_local $var0))))
+	  (i64.const 1))))
+  (export "" 0))`);
diff --git a/js/src/jit-test/tests/wasm/regress/select-any.js b/js/src/jit-test/tests/wasm/regress/select-any.js
new file mode 100644
index 000000000..51b589d25
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/select-any.js
@@ -0,0 +1,31 @@
+load(libdir + "wasm.js");
+
+// Bug 1280921
+
+var m1 = wasmEvalText(
+`(module
+  (type $type0 (func))
+  (func $func0
+   (select (unreachable) (return (nop)) (loop (i32.const 1))))
+  (export "" 0))`).exports[""];
+
+try {
+    m1();
+} catch (e) {
+    if (!(e instanceof Error && e.message.match(/unreachable executed/)))
+	throw e;
+}
+
+var m2 = wasmEvalText(
+`(module
+  (type $type0 (func))
+  (func $func0
+   (select (i32.const 26) (unreachable) (i32.const 3)))
+  (export "" 0))`).exports[""];
+
+try {
+    m2();
+} catch (e) {
+    if (!(e instanceof Error && e.message.match(/unreachable executed/)))
+	throw e;
+}
diff --git a/js/src/jit-test/tests/wasm/regress/shift-counts.js b/js/src/jit-test/tests/wasm/regress/shift-counts.js
new file mode 100644
index 000000000..33e78ed7d
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/shift-counts.js
@@ -0,0 +1,10 @@
+load(libdir + "wasm.js");
+
+// Bug 1280926, extracted from binary
+
+wasmEvalText(
+`(module
+  (type $type0 (func (result i32)))
+  (export "" $func0)
+  (func $func0 (result i32)
+   (i32.shr_s (i32.const -40) (i32.const 34))))`);
diff --git a/js/src/jit-test/tests/wasm/regress/teavm-bugs.js b/js/src/jit-test/tests/wasm/regress/teavm-bugs.js
new file mode 100644
index 000000000..d7403eaa0
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/teavm-bugs.js
@@ -0,0 +1,55 @@
+load(libdir + "wasm.js");
+
+// Register allocation issue with LCompareI64AndBranch.
+let params = '';
+let locals = '';
+let tests = '(i64.const 0)';
+
+for (let i = 15; i --> 0;) {
+    params += `\n(param i64)`;
+    locals += `\n(local i64)`;
+    tests = `
+    (if i64
+        (i64.eq
+            (get_local ${i + 8})
+            (get_local ${i})
+        )
+        (get_local ${i + 8})
+        ${tests}
+    )`;
+}
+
+let code = `(module
+   (func $i64 (result i64)
+     ${params} ${locals}
+     ${tests}
+   )
+)`
+
+wasmEvalText(code);
+
+// Bounds check elimination.
+assertEq(wasmEvalText(`(module
+    (memory 1)
+    (func (param $p i32) (local $l i32) (result i32)
+        (set_local $l (i32.const 0))
+        (if
+            (get_local $p)
+            (set_local $l
+               (i32.add
+                  (get_local $l)
+                  (i32.load8_s (get_local $p))
+               )
+            )
+        )
+        (set_local $l
+           (i32.add
+              (get_local $l)
+              (i32.load8_s (get_local $p))
+           )
+        )
+        (get_local $l)
+    )
+    (data (i32.const 0) "\\00\\01\\02\\03\\04\\05\\06\\07\\08\\09\\0a\\0b\\0c\\0d\\0e\\0f")
+    (export "test" 0)
+)`).exports["test"](3), 6);
diff --git a/js/src/jit-test/tests/wasm/regress/too-large-frame.js b/js/src/jit-test/tests/wasm/regress/too-large-frame.js
new file mode 100644
index 000000000..357cb0149
--- /dev/null
+++ b/js/src/jit-test/tests/wasm/regress/too-large-frame.js
@@ -0,0 +1,29 @@
+load(libdir + "wasm.js");
+
+// Bug 1280934, equivalent test case.
+
+try {
+
+wasmEvalText(
+`(module
+  (func $func0 (result i32) ${locals()}
+   (i32.const 0))
+  (export "" 0))`);
+
+} catch (e) {
+    // The wasm baseline compiler throws OOM on too-large frames, so
+    // handle that.
+    if (!String(e).match(/out of memory/))
+	throw e;
+}
+
+// The wasm baseline compiler cuts off frames at 256KB at the moment;
+// the test case for bug 1280934 constructed a frame around 512KB so
+// duplicate that here.
+
+function locals() {
+    var s = "";
+    for ( var i=0 ; i < 64000 ; i++ )
+	s += "(local f64)\n";
+    return s;
+}