Add m-esr52 at 52.6.0

1 files changed, 579 insertions, 0 deletions

diff --git a/js/src/jsapi-tests/testAssemblerBuffer.cpp b/js/src/jsapi-tests/testAssemblerBuffer.cpp
new file mode 100644
index 000000000..95927cf59
--- /dev/null
+++ b/js/src/jsapi-tests/testAssemblerBuffer.cpp
@@ -0,0 +1,579 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+#include <stdlib.h>
+
+#include "jsatom.h"
+
+#include "jit/shared/IonAssemblerBufferWithConstantPools.h"
+
+#include "jsapi-tests/tests.h"
+
+// Tests for classes in:
+//
+//   jit/shared/IonAssemblerBuffer.h
+//   jit/shared/IonAssemblerBufferWithConstantPools.h
+//
+// Classes in js::jit tested:
+//
+//   BufferOffset
+//   BufferSlice (implicitly)
+//   AssemblerBuffer
+//
+//   BranchDeadlineSet
+//   Pool (implicitly)
+//   AssemblerBufferWithConstantPools
+//
+
+BEGIN_TEST(testAssemblerBuffer_BufferOffset)
+{
+    using js::jit::BufferOffset;
+
+    BufferOffset off1;
+    BufferOffset off2(10);
+
+    CHECK(!off1.assigned());
+    CHECK(off2.assigned());
+    CHECK_EQUAL(off2.getOffset(), 10);
+    off1 = off2;
+    CHECK(off1.assigned());
+    CHECK_EQUAL(off1.getOffset(), 10);
+
+    return true;
+}
+END_TEST(testAssemblerBuffer_BufferOffset)
+
+BEGIN_TEST(testAssemblerBuffer_AssemblerBuffer)
+{
+    using js::jit::BufferOffset;
+    typedef js::jit::AssemblerBuffer<5 * sizeof(uint32_t), uint32_t> AsmBuf;
+
+    AsmBuf ab;
+    CHECK(ab.isAligned(16));
+    CHECK_EQUAL(ab.size(), 0u);
+    CHECK_EQUAL(ab.nextOffset().getOffset(), 0);
+    CHECK(!ab.oom());
+    CHECK(!ab.bail());
+
+    BufferOffset off1 = ab.putInt(1000017);
+    CHECK_EQUAL(off1.getOffset(), 0);
+    CHECK_EQUAL(ab.size(), 4u);
+    CHECK_EQUAL(ab.nextOffset().getOffset(), 4);
+    CHECK(!ab.isAligned(16));
+    CHECK(ab.isAligned(4));
+    CHECK(ab.isAligned(1));
+    CHECK_EQUAL(*ab.getInst(off1), 1000017u);
+
+    BufferOffset off2 = ab.putInt(1000018);
+    CHECK_EQUAL(off2.getOffset(), 4);
+
+    BufferOffset off3 = ab.putInt(1000019);
+    CHECK_EQUAL(off3.getOffset(), 8);
+
+    BufferOffset off4 = ab.putInt(1000020);
+    CHECK_EQUAL(off4.getOffset(), 12);
+    CHECK_EQUAL(ab.size(), 16u);
+    CHECK_EQUAL(ab.nextOffset().getOffset(), 16);
+
+    // Last one in the slice.
+    BufferOffset off5 = ab.putInt(1000021);
+    CHECK_EQUAL(off5.getOffset(), 16);
+    CHECK_EQUAL(ab.size(), 20u);
+    CHECK_EQUAL(ab.nextOffset().getOffset(), 20);
+
+    BufferOffset off6 = ab.putInt(1000022);
+    CHECK_EQUAL(off6.getOffset(), 20);
+    CHECK_EQUAL(ab.size(), 24u);
+    CHECK_EQUAL(ab.nextOffset().getOffset(), 24);
+
+    // Reference previous slice. Excercise the finger.
+    CHECK_EQUAL(*ab.getInst(off1), 1000017u);
+    CHECK_EQUAL(*ab.getInst(off6), 1000022u);
+    CHECK_EQUAL(*ab.getInst(off1), 1000017u);
+    CHECK_EQUAL(*ab.getInst(off5), 1000021u);
+
+    // Too much data for one slice.
+    const uint32_t fixdata[] = { 2000036, 2000037, 2000038, 2000039, 2000040, 2000041 };
+
+    // Split payload across multiple slices.
+    CHECK_EQUAL(ab.nextOffset().getOffset(), 24);
+    BufferOffset good1 = ab.putBytesLarge(sizeof(fixdata), fixdata);
+    CHECK_EQUAL(good1.getOffset(), 24);
+    CHECK_EQUAL(ab.nextOffset().getOffset(), 48);
+    CHECK_EQUAL(*ab.getInst(good1), 2000036u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(32)), 2000038u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(36)), 2000039u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(40)), 2000040u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(44)), 2000041u);
+
+    return true;
+}
+END_TEST(testAssemblerBuffer_AssemblerBuffer)
+
+BEGIN_TEST(testAssemblerBuffer_BranchDeadlineSet)
+{
+    typedef js::jit::BranchDeadlineSet<3> DLSet;
+    using js::jit::BufferOffset;
+
+    js::LifoAlloc alloc(1024);
+    DLSet dls(alloc);
+
+    CHECK(dls.empty());
+    CHECK(alloc.isEmpty()); // Constructor must be infallible.
+    CHECK_EQUAL(dls.size(), 0u);
+    CHECK_EQUAL(dls.maxRangeSize(), 0u);
+
+    // Removing non-existant deadline is OK.
+    dls.removeDeadline(1, BufferOffset(7));
+
+    // Add deadlines in increasing order as intended. This is optimal.
+    dls.addDeadline(1, BufferOffset(10));
+    CHECK(!dls.empty());
+    CHECK_EQUAL(dls.size(), 1u);
+    CHECK_EQUAL(dls.maxRangeSize(), 1u);
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 10);
+    CHECK_EQUAL(dls.earliestDeadlineRange(), 1u);
+
+    // Removing non-existant deadline is OK.
+    dls.removeDeadline(1, BufferOffset(7));
+    dls.removeDeadline(1, BufferOffset(17));
+    dls.removeDeadline(0, BufferOffset(10));
+    CHECK_EQUAL(dls.size(), 1u);
+    CHECK_EQUAL(dls.maxRangeSize(), 1u);
+
+    // Two identical deadlines for different ranges.
+    dls.addDeadline(2, BufferOffset(10));
+    CHECK(!dls.empty());
+    CHECK_EQUAL(dls.size(), 2u);
+    CHECK_EQUAL(dls.maxRangeSize(), 1u);
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 10);
+
+    // It doesn't matter which range earliestDeadlineRange() reports first,
+    // but it must report both.
+    if (dls.earliestDeadlineRange() == 1) {
+        dls.removeDeadline(1, BufferOffset(10));
+        CHECK_EQUAL(dls.earliestDeadline().getOffset(), 10);
+        CHECK_EQUAL(dls.earliestDeadlineRange(), 2u);
+    } else {
+        CHECK_EQUAL(dls.earliestDeadlineRange(), 2u);
+        dls.removeDeadline(2, BufferOffset(10));
+        CHECK_EQUAL(dls.earliestDeadline().getOffset(), 10);
+        CHECK_EQUAL(dls.earliestDeadlineRange(), 1u);
+    }
+
+    // Add deadline which is the front of range 0, but not the global earliest.
+    dls.addDeadline(0, BufferOffset(20));
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 10);
+    CHECK(dls.earliestDeadlineRange() > 0);
+
+    // Non-optimal add to front of single-entry range 0.
+    dls.addDeadline(0, BufferOffset(15));
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 10);
+    CHECK(dls.earliestDeadlineRange() > 0);
+
+    // Append to 2-entry range 0.
+    dls.addDeadline(0, BufferOffset(30));
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 10);
+    CHECK(dls.earliestDeadlineRange() > 0);
+
+    // Add penultimate entry.
+    dls.addDeadline(0, BufferOffset(25));
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 10);
+    CHECK(dls.earliestDeadlineRange() > 0);
+
+    // Prepend, stealing earliest from other range.
+    dls.addDeadline(0, BufferOffset(5));
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 5);
+    CHECK_EQUAL(dls.earliestDeadlineRange(), 0u);
+
+    // Remove central element.
+    dls.removeDeadline(0, BufferOffset(20));
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 5);
+    CHECK_EQUAL(dls.earliestDeadlineRange(), 0u);
+
+    // Remove front, giving back the lead.
+    dls.removeDeadline(0, BufferOffset(5));
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 10);
+    CHECK(dls.earliestDeadlineRange() > 0);
+
+    // Remove front, giving back earliest to range 0.
+    dls.removeDeadline(dls.earliestDeadlineRange(), BufferOffset(10));
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 15);
+    CHECK_EQUAL(dls.earliestDeadlineRange(), 0u);
+
+    // Remove tail.
+    dls.removeDeadline(0, BufferOffset(30));
+    CHECK_EQUAL(dls.earliestDeadline().getOffset(), 15);
+    CHECK_EQUAL(dls.earliestDeadlineRange(), 0u);
+
+    // Now range 0 = [15, 25].
+    CHECK_EQUAL(dls.size(), 2u);
+    dls.removeDeadline(0, BufferOffset(25));
+    dls.removeDeadline(0, BufferOffset(15));
+    CHECK(dls.empty());
+
+    return true;
+}
+END_TEST(testAssemblerBuffer_BranchDeadlineSet)
+
+// Mock Assembler class for testing the AssemblerBufferWithConstantPools
+// callbacks.
+namespace {
+
+struct TestAssembler;
+
+typedef js::jit::AssemblerBufferWithConstantPools<
+  /* SliceSize */ 5 * sizeof(uint32_t),
+  /* InstSize */ 4,
+  /* Inst */ uint32_t,
+  /* Asm */ TestAssembler,
+  /* NumShortBranchRanges */ 3> AsmBufWithPool;
+
+struct TestAssembler
+{
+    // Mock instruction set:
+    //
+    //   0x1111xxxx - align filler instructions.
+    //   0x2222xxxx - manually inserted 'arith' instructions.
+    //   0xaaaaxxxx - noop filler instruction.
+    //   0xb0bbxxxx - branch xxxx bytes forward. (Pool guard).
+    //   0xb1bbxxxx - branch xxxx bytes forward. (Short-range branch).
+    //   0xb2bbxxxx - branch xxxx bytes forward. (Veneer branch).
+    //   0xb3bbxxxx - branch xxxx bytes forward. (Patched short-range branch).
+    //   0xc0ccxxxx - constant pool load (uninitialized).
+    //   0xc1ccxxxx - constant pool load to index xxxx.
+    //   0xc2ccxxxx - constant pool load xxxx bytes ahead.
+    //   0xffffxxxx - pool header with xxxx bytes.
+
+    static const unsigned BranchRange = 36;
+
+    static void InsertIndexIntoTag(uint8_t* load_, uint32_t index)
+    {
+        uint32_t* load = reinterpret_cast<uint32_t*>(load_);
+        MOZ_ASSERT(*load == 0xc0cc0000, "Expected uninitialized constant pool load");
+        MOZ_ASSERT(index < 0x10000);
+        *load = 0xc1cc0000 + index;
+    }
+
+    static void PatchConstantPoolLoad(void* loadAddr, void* constPoolAddr)
+    {
+        uint32_t* load = reinterpret_cast<uint32_t*>(loadAddr);
+        uint32_t index = *load & 0xffff;
+        MOZ_ASSERT(*load == (0xc1cc0000 | index), "Expected constant pool load(index)");
+        ptrdiff_t offset =
+          reinterpret_cast<uint8_t*>(constPoolAddr) - reinterpret_cast<uint8_t*>(loadAddr);
+        offset += index * 4;
+        MOZ_ASSERT(offset % 4 == 0, "Unaligned constant pool");
+        MOZ_ASSERT(offset > 0 && offset < 0x10000, "Pool out of range");
+        *load = 0xc2cc0000 + offset;
+    }
+
+    static void WritePoolGuard(js::jit::BufferOffset branch, uint32_t* dest,
+                               js::jit::BufferOffset afterPool)
+    {
+        MOZ_ASSERT(branch.assigned());
+        MOZ_ASSERT(afterPool.assigned());
+        size_t branchOff = branch.getOffset();
+        size_t afterPoolOff = afterPool.getOffset();
+        MOZ_ASSERT(afterPoolOff > branchOff);
+        uint32_t delta = afterPoolOff - branchOff;
+        *dest = 0xb0bb0000 + delta;
+    }
+
+    static void WritePoolHeader(void* start, js::jit::Pool* p, bool isNatural)
+    {
+        MOZ_ASSERT(!isNatural, "Natural pool guards not implemented.");
+        uint32_t* hdr = reinterpret_cast<uint32_t*>(start);
+        *hdr = 0xffff0000 + p->getPoolSize();
+    }
+
+    static void PatchShortRangeBranchToVeneer(AsmBufWithPool* buffer, unsigned rangeIdx,
+                                              js::jit::BufferOffset deadline,
+                                              js::jit::BufferOffset veneer)
+    {
+        size_t branchOff = deadline.getOffset() - BranchRange;
+        size_t veneerOff = veneer.getOffset();
+        uint32_t *branch = buffer->getInst(js::jit::BufferOffset(branchOff));
+
+        MOZ_ASSERT((*branch & 0xffff0000) == 0xb1bb0000,
+                   "Expected short-range branch instruction");
+        // Copy branch offset to veneer. A real instruction set would require
+        // some adjustment of the label linked-list.
+        *buffer->getInst(veneer) = 0xb2bb0000 | (*branch & 0xffff);
+        MOZ_ASSERT(veneerOff > branchOff, "Veneer should follow branch");
+        *branch = 0xb3bb0000 + (veneerOff - branchOff);
+    }
+};
+}
+
+BEGIN_TEST(testAssemblerBuffer_AssemblerBufferWithConstantPools)
+{
+    using js::jit::BufferOffset;
+
+    AsmBufWithPool ab(/* guardSize= */ 1,
+                      /* headerSize= */ 1,
+                      /* instBufferAlign(unused)= */ 0,
+                      /* poolMaxOffset= */ 17,
+                      /* pcBias= */ 0,
+                      /* alignFillInst= */ 0x11110000,
+                      /* nopFillInst= */ 0xaaaa0000,
+                      /* nopFill= */ 0);
+
+    CHECK(ab.isAligned(16));
+    CHECK_EQUAL(ab.size(), 0u);
+    CHECK_EQUAL(ab.nextOffset().getOffset(), 0);
+    CHECK(!ab.oom());
+    CHECK(!ab.bail());
+
+    // Each slice holds 5 instructions. Trigger a constant pool inside the slice.
+    uint32_t poolLoad[] = { 0xc0cc0000 };
+    uint32_t poolData[] = { 0xdddd0000, 0xdddd0001, 0xdddd0002, 0xdddd0003 };
+    AsmBufWithPool::PoolEntry pe;
+    BufferOffset load = ab.allocEntry(1, 1, (uint8_t*)poolLoad, (uint8_t*)poolData, &pe);
+    CHECK_EQUAL(pe.index(), 0u);
+    CHECK_EQUAL(load.getOffset(), 0);
+
+    // Pool hasn't been emitted yet. Load has been patched by
+    // InsertIndexIntoTag.
+    CHECK_EQUAL(*ab.getInst(load), 0xc1cc0000);
+
+    // Expected layout:
+    //
+    //   0: load [pc+16]
+    //   4: 0x22220001
+    //   8: guard branch pc+12
+    //  12: pool header
+    //  16: poolData
+    //  20: 0x22220002
+    //
+    ab.putInt(0x22220001);
+    // One could argue that the pool should be flushed here since there is no
+    // more room. However, the current implementation doesn't dump pool until
+    // asked to add data:
+    ab.putInt(0x22220002);
+
+    CHECK_EQUAL(*ab.getInst(BufferOffset(0)), 0xc2cc0010u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(4)), 0x22220001u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(8)), 0xb0bb000cu);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(12)), 0xffff0004u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(16)), 0xdddd0000u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(20)), 0x22220002u);
+
+    // allocEntry() overwrites the load instruction! Restore the original.
+    poolLoad[0] = 0xc0cc0000;
+
+    // Now try with load and pool data on separate slices.
+    load = ab.allocEntry(1, 1, (uint8_t*)poolLoad, (uint8_t*)poolData, &pe);
+    CHECK_EQUAL(pe.index(), 1u); // Global pool entry index.
+    CHECK_EQUAL(load.getOffset(), 24);
+    CHECK_EQUAL(*ab.getInst(load), 0xc1cc0000); // Index into current pool.
+    ab.putInt(0x22220001);
+    ab.putInt(0x22220002);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(24)), 0xc2cc0010u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(28)), 0x22220001u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(32)), 0xb0bb000cu);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(36)), 0xffff0004u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(40)), 0xdddd0000u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(44)), 0x22220002u);
+
+    // Two adjacent loads to the same pool.
+    poolLoad[0] = 0xc0cc0000;
+    load = ab.allocEntry(1, 1, (uint8_t*)poolLoad, (uint8_t*)poolData, &pe);
+    CHECK_EQUAL(pe.index(), 2u); // Global pool entry index.
+    CHECK_EQUAL(load.getOffset(), 48);
+    CHECK_EQUAL(*ab.getInst(load), 0xc1cc0000); // Index into current pool.
+
+    poolLoad[0] = 0xc0cc0000;
+    load = ab.allocEntry(1, 1, (uint8_t*)poolLoad, (uint8_t*)(poolData + 1), &pe);
+    CHECK_EQUAL(pe.index(), 3u); // Global pool entry index.
+    CHECK_EQUAL(load.getOffset(), 52);
+    CHECK_EQUAL(*ab.getInst(load), 0xc1cc0001); // Index into current pool.
+
+    ab.putInt(0x22220005);
+
+    CHECK_EQUAL(*ab.getInst(BufferOffset(48)), 0xc2cc0010u); // load pc+16.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(52)), 0xc2cc0010u); // load pc+16.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(56)), 0xb0bb0010u); // guard branch pc+16.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(60)), 0xffff0008u); // header 8 bytes.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(64)), 0xdddd0000u); // datum 1.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(68)), 0xdddd0001u); // datum 2.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(72)), 0x22220005u); // putInt(0x22220005)
+
+    // Two loads as above, but the first load has an 8-byte pool entry, and the
+    // second load wouldn't be able to reach its data. This must produce two
+    // pools.
+    poolLoad[0] = 0xc0cc0000;
+    load = ab.allocEntry(1, 2, (uint8_t*)poolLoad, (uint8_t*)(poolData+2), &pe);
+    CHECK_EQUAL(pe.index(), 4u); // Global pool entry index.
+    CHECK_EQUAL(load.getOffset(), 76);
+    CHECK_EQUAL(*ab.getInst(load), 0xc1cc0000); // Index into current pool.
+
+    poolLoad[0] = 0xc0cc0000;
+    load = ab.allocEntry(1, 1, (uint8_t*)poolLoad, (uint8_t*)poolData, &pe);
+    CHECK_EQUAL(pe.index(), 6u); // Global pool entry index. (Prev one is two indexes).
+    CHECK_EQUAL(load.getOffset(), 96);
+    CHECK_EQUAL(*ab.getInst(load), 0xc1cc0000); // Index into current pool.
+
+    CHECK_EQUAL(*ab.getInst(BufferOffset(76)), 0xc2cc000cu); // load pc+12.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(80)), 0xb0bb0010u); // guard branch pc+16.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(84)), 0xffff0008u); // header 8 bytes.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(88)), 0xdddd0002u); // datum 1.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(92)), 0xdddd0003u); // datum 2.
+
+    // Second pool is not flushed yet, and there is room for one instruction
+    // after the load. Test the keep-together feature.
+    ab.enterNoPool(2);
+    ab.putInt(0x22220006);
+    ab.putInt(0x22220007);
+    ab.leaveNoPool();
+
+    CHECK_EQUAL(*ab.getInst(BufferOffset( 96)), 0xc2cc000cu); // load pc+16.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(100)), 0xb0bb000cu); // guard branch pc+12.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(104)), 0xffff0004u); // header 4 bytes.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(108)), 0xdddd0000u); // datum 1.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(112)), 0x22220006u);
+    CHECK_EQUAL(*ab.getInst(BufferOffset(116)), 0x22220007u);
+
+    return true;
+}
+END_TEST(testAssemblerBuffer_AssemblerBufferWithConstantPools)
+
+BEGIN_TEST(testAssemblerBuffer_AssemblerBufferWithConstantPools_ShortBranch)
+{
+    using js::jit::BufferOffset;
+
+    AsmBufWithPool ab(/* guardSize= */ 1,
+                      /* headerSize= */ 1,
+                      /* instBufferAlign(unused)= */ 0,
+                      /* poolMaxOffset= */ 17,
+                      /* pcBias= */ 0,
+                      /* alignFillInst= */ 0x11110000,
+                      /* nopFillInst= */ 0xaaaa0000,
+                      /* nopFill= */ 0);
+
+    // Insert short-range branch.
+    BufferOffset br1 = ab.putInt(0xb1bb00cc);
+    ab.registerBranchDeadline(1, BufferOffset(br1.getOffset() + TestAssembler::BranchRange));
+    ab.putInt(0x22220001);
+    BufferOffset off = ab.putInt(0x22220002);
+    ab.registerBranchDeadline(1, BufferOffset(off.getOffset() + TestAssembler::BranchRange));
+    ab.putInt(0x22220003);
+    ab.putInt(0x22220004);
+
+    // Second short-range branch that will be swiped up by hysteresis.
+    BufferOffset br2 = ab.putInt(0xb1bb0d2d);
+    ab.registerBranchDeadline(1, BufferOffset(br2.getOffset() + TestAssembler::BranchRange));
+
+    // Branch should not have been patched yet here.
+    CHECK_EQUAL(*ab.getInst(br1), 0xb1bb00cc);
+    CHECK_EQUAL(*ab.getInst(br2), 0xb1bb0d2d);
+
+    // Cancel one of the pending branches.
+    // This is what will happen to most branches as they are bound before
+    // expiring by Assembler::bind().
+    ab.unregisterBranchDeadline(1, BufferOffset(off.getOffset() + TestAssembler::BranchRange));
+
+    off = ab.putInt(0x22220006);
+    // Here we may or may not have patched the branch yet, but it is inevitable now:
+    //
+    //  0: br1 pc+36
+    //  4: 0x22220001
+    //  8: 0x22220002 (unpatched)
+    // 12: 0x22220003
+    // 16: 0x22220004
+    // 20: br2 pc+20
+    // 24: 0x22220006
+    CHECK_EQUAL(off.getOffset(), 24);
+    // 28: guard branch pc+16
+    // 32: pool header
+    // 36: veneer1
+    // 40: veneer2
+    // 44: 0x22220007
+
+    off = ab.putInt(0x22220007);
+    CHECK_EQUAL(off.getOffset(), 44);
+
+    // Now the branch must have been patched.
+    CHECK_EQUAL(*ab.getInst(br1), 0xb3bb0000 + 36);         // br1 pc+36 (patched)
+    CHECK_EQUAL(*ab.getInst(BufferOffset(8)), 0x22220002u);  // 0x22220002 (unpatched)
+    CHECK_EQUAL(*ab.getInst(br2), 0xb3bb0000 + 20);         // br2 pc+20 (patched)
+    CHECK_EQUAL(*ab.getInst(BufferOffset(28)), 0xb0bb0010u); // br pc+16 (guard)
+    CHECK_EQUAL(*ab.getInst(BufferOffset(32)), 0xffff0000u); // pool header 0 bytes.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(36)), 0xb2bb00ccu); // veneer1 w/ original 'cc' offset.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(40)), 0xb2bb0d2du); // veneer2 w/ original 'd2d' offset.
+    CHECK_EQUAL(*ab.getInst(BufferOffset(44)), 0x22220007u);
+
+    return true;
+}
+END_TEST(testAssemblerBuffer_AssemblerBufferWithConstantPools_ShortBranch)
+
+// Test that everything is put together correctly in the ARM64 assembler.
+#if defined(JS_CODEGEN_ARM64)
+
+#include "jit/MacroAssembler-inl.h"
+
+BEGIN_TEST(testAssemblerBuffer_ARM64)
+{
+    using namespace js::jit;
+
+    js::LifoAlloc lifo(4096);
+    TempAllocator alloc(&lifo);
+    JitContext jc(cx, &alloc);
+    cx->getJitRuntime(cx);
+    MacroAssembler masm;
+
+    // Branches to an unbound label.
+    Label lab1;
+    masm.branch(Assembler::Equal, &lab1);
+    masm.branch(Assembler::LessThan, &lab1);
+    masm.bind(&lab1);
+    masm.branch(Assembler::Equal, &lab1);
+
+    CHECK_EQUAL(masm.getInstructionAt(BufferOffset(0))->InstructionBits(),
+                vixl::B_cond | vixl::Assembler::ImmCondBranch(2) | vixl::eq);
+    CHECK_EQUAL(masm.getInstructionAt(BufferOffset(4))->InstructionBits(),
+                vixl::B_cond | vixl::Assembler::ImmCondBranch(1) | vixl::lt);
+    CHECK_EQUAL(masm.getInstructionAt(BufferOffset(8))->InstructionBits(),
+                vixl::B_cond | vixl::Assembler::ImmCondBranch(0) | vixl::eq);
+
+    // Branches can reach the label, but the linked list of uses needs to be
+    // rearranged. The final conditional branch cannot reach the first branch.
+    Label lab2a;
+    Label lab2b;
+    masm.bind(&lab2a);
+    masm.B(&lab2b);
+    // Generate 1,100,000 bytes of NOPs.
+    for (unsigned n = 0; n < 1100000; n += 4)
+        masm.Nop();
+    masm.branch(Assembler::LessThan, &lab2b);
+    masm.bind(&lab2b);
+    CHECK_EQUAL(masm.getInstructionAt(BufferOffset(lab2a.offset()))->InstructionBits(),
+                vixl::B | vixl::Assembler::ImmUncondBranch(1100000 / 4 + 2));
+    CHECK_EQUAL(masm.getInstructionAt(BufferOffset(lab2b.offset() - 4))->InstructionBits(),
+                vixl::B_cond | vixl::Assembler::ImmCondBranch(1) | vixl::lt);
+
+    // Generate a conditional branch that can't reach its label.
+    Label lab3a;
+    Label lab3b;
+    masm.bind(&lab3a);
+    masm.branch(Assembler::LessThan, &lab3b);
+    for (unsigned n = 0; n < 1100000; n += 4)
+        masm.Nop();
+    masm.bind(&lab3b);
+    masm.B(&lab3a);
+    Instruction* bcond3 = masm.getInstructionAt(BufferOffset(lab3a.offset()));
+    CHECK_EQUAL(bcond3->BranchType(), vixl::CondBranchType);
+    ptrdiff_t delta = bcond3->ImmPCRawOffset() * 4;
+    Instruction* veneer = masm.getInstructionAt(BufferOffset(lab3a.offset() + delta));
+    CHECK_EQUAL(veneer->BranchType(), vixl::UncondBranchType);
+    delta += veneer->ImmPCRawOffset() * 4;
+    CHECK_EQUAL(delta, lab3b.offset() - lab3a.offset());
+    Instruction* b3 = masm.getInstructionAt(BufferOffset(lab3b.offset()));
+    CHECK_EQUAL(b3->BranchType(), vixl::UncondBranchType);
+    CHECK_EQUAL(4 * b3->ImmPCRawOffset(), -delta);
+
+    return true;
+}
+END_TEST(testAssemblerBuffer_ARM64)
+#endif /* JS_CODEGEN_ARM64 */