Add m-esr52 at 52.6.0

64 files changed, 2472 insertions, 0 deletions

diff --git a/js/src/tests/js1_8_1/regress/browser.js b/js/src/tests/js1_8_1/regress/browser.js
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/browser.js
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-006.js b/js/src/tests/js1_8_1/regress/regress-452498-006.js
new file mode 100644
index 000000000..63fffd211
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-006.js
@@ -0,0 +1,45 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #6 From Andreas Gal :gal
+
+  function foo() {
+    var x = 4;
+    var f = (function() { return x++; });
+    var g = (function() { return x++; });
+    return [f,g];
+  }
+
+  var bar = foo();
+
+  expect = '9';
+  actual = 0;
+
+  bar[0]();
+  bar[1]();
+
+  actual = String(expect);
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-027.js b/js/src/tests/js1_8_1/regress/regress-452498-027.js
new file mode 100644
index 000000000..3583fa03b
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-027.js
@@ -0,0 +1,38 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  expect = '5';
+
+// ------- Comment #27 From Brendan Eich
+
+  function f(x){function g(y)x+y;return g}
+  g = f(2);
+
+  actual = String(g(3));
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
+
+
+
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-030.js b/js/src/tests/js1_8_1/regress/regress-452498-030.js
new file mode 100644
index 000000000..1d8b41908
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-030.js
@@ -0,0 +1,31 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #30 From Mike Shaver
+
+  function f() { var i = 0; var i = 5; }
+  f();
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-040.js b/js/src/tests/js1_8_1/regress/regress-452498-040.js
new file mode 100644
index 000000000..8bd97207a
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-040.js
@@ -0,0 +1,37 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #40 From Jesse Ruderman
+
+  function m()
+  {
+    function a() { }
+    function b() { a(); }
+    this.c = function () { b(); }
+  }
+  (new m).c();
+
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-050.js b/js/src/tests/js1_8_1/regress/regress-452498-050.js
new file mode 100644
index 000000000..309242a62
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-050.js
@@ -0,0 +1,43 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #50 From Jason Orendorff
+
+// Do not crash
+
+// compiler bug when a block introduces no names
+  { let {}={}; }
+
+  try
+  {
+// compiler incorrectly emits GETLOCAL for first `x`,
+// triggering decompiler assertion
+    while (x.y) { let x; }
+  }
+  catch(ex)
+  {
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-051.js b/js/src/tests/js1_8_1/regress/regress-452498-051.js
new file mode 100644
index 000000000..cd5554e74
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-051.js
@@ -0,0 +1,48 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #51 From Jason Orendorff
+
+// Assertion failure: UPVAR_FRAME_SKIP(uva->vector[i]) == 0
+// at ../jsopcode.cpp:2791
+//
+// when decompiling the eval code, which is:
+//
+// main:
+// 00000:  10  getupvar 0
+// 00003:  10  getprop "y"
+// 00006:  10  popv
+// 00007:  10  stop
+  try
+  {
+    function f() { var x; eval("x.y"); }
+    f();
+  }
+  catch(ex)
+  {
+  }
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-052-a.js b/js/src/tests/js1_8_1/regress/regress-452498-052-a.js
new file mode 100644
index 000000000..0f55d9324
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-052-a.js
@@ -0,0 +1,42 @@
+// |reftest| skip-if(Android)
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #52 From Jason Orendorff
+
+
+// Assertion failure: pn_arity == PN_FUNC || pn_arity == PN_NAME, at ../jsparse.h:444
+// Here the function node has been morphed into a JSOP_TRUE node, but we're in
+// FindFunArgs poking it anyway.
+  if (typeof timeout == 'function')
+  {
+    expectExitCode(6);
+    timeout(3);
+    while(function(){});
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-053.js b/js/src/tests/js1_8_1/regress/regress-452498-053.js
new file mode 100644
index 000000000..9f70a0f74
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-053.js
@@ -0,0 +1,80 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #53 From Jason Orendorff
+
+// Assertion failure: (slot) < (uint32_t)(obj)->dslots[-1]
+// at ../jsobj.cpp:5559
+// On the last line of BindLet, we have
+//    JS_SetReservedSlot(cx, blockObj, index, PRIVATE_TO_JSVAL(pn));
+// but this uses reserved slots as though they were unlimited.
+// blockObj only has 2.
+  { let a=0, b=1, c=2; }
+
+// In RecycleTree at ../jsparse.cpp:315, we hit
+//     MOZ_CRASH("RecycleUseDefKids");
+// pn->pn_type is TOK_UNARYOP
+// pn->pn_op   is JSOP_XMLNAME
+// pn->pn_defn is 1
+// pn->pn_used is 1
+  try
+  {
+    true; 0;
+  }
+  catch(ex)
+  {
+  }
+// Calls LinkUseToDef with pn->pn_defn == 1.
+//
+// If you say "var x;" first, then run this case, it gets further,
+// crashing in NoteLValue like the first case in comment 52.
+//
+  try
+  {
+    for (var [x] in y) var x;
+  }
+  catch(ex)
+  {
+  }
+// Assertion failure: !pn2->pn_defn, at ../jsparse.h:461
+// Another case where some optimization is going on.
+  try
+  {
+    if (true && foo) ;
+  }
+  catch(ex)
+  {
+  }
+// Assertion failure: scope->object == ctor
+// in js_FastNewObject at ../jsbuiltins.cpp:237
+//
+// With the patch, we're new-ing a different function each time, and the
+// .prototype property is missing.
+//
+  for (var z = 0; z < 3; z++) { (new function(){}); }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-058.js b/js/src/tests/js1_8_1/regress/regress-452498-058.js
new file mode 100644
index 000000000..ac2ba0f7a
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-058.js
@@ -0,0 +1,31 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #58 From Gary Kwong [:nth10sd]
+
+  function foo(x) { var x = x }
+
+// Assertion failure: dn->kind() == ((data->op == JSOP_DEFCONST) ? JSDefinition::CONST : JSDefinition::VAR), at ../jsparse.cpp:2595
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-062.js b/js/src/tests/js1_8_1/regress/regress-452498-062.js
new file mode 100644
index 000000000..f28c29bbf
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-062.js
@@ -0,0 +1,44 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #62 From Gary Kwong [:nth10sd]
+
+  try
+  {
+    eval(
+      '(function(){' +
+      '  var x;' +
+      '  this.init_by_array = function()' +
+      '    x = 0;' +
+      '})();'
+      );
+  }
+  catch(ex)
+  {
+  }
+
+// Assertion failure: ATOM_IS_STRING(atom), at ../jsinterp.cpp:5686
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-063.js b/js/src/tests/js1_8_1/regress/regress-452498-063.js
new file mode 100644
index 000000000..970dfeca6
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-063.js
@@ -0,0 +1,35 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #63 From Brendan Eich
+
+  function f(that) {
+    for (ix in this)
+      print(ix);
+    for (let ix in that)
+      ;
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-071.js b/js/src/tests/js1_8_1/regress/regress-452498-071.js
new file mode 100644
index 000000000..647677877
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-071.js
@@ -0,0 +1,31 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #71 From Jesse Ruderman
+
+  x; var x
+// Assertion failure: pn->pn_op == JSOP_NOP, at ../jsparse.cpp:1118
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-072.js b/js/src/tests/js1_8_1/regress/regress-452498-072.js
new file mode 100644
index 000000000..99e540c77
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-072.js
@@ -0,0 +1,31 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #72 From Jesse Ruderman
+
+  v = function p() { delete p; };
+// Assertion failure: JOF_OPTYPE(op) == JOF_ATOM, at ../jsemit.cpp:1711
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-073.js b/js/src/tests/js1_8_1/regress/regress-452498-073.js
new file mode 100644
index 000000000..9de10e87b
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-073.js
@@ -0,0 +1,38 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #73 From Jesse Ruderman
+
+  try
+  {
+    eval('function() { var arguments }');
+  }
+  catch(ex)
+  {
+  }
+
+// Assertion failure: (uintN)i < ss->top, at ../jsopcode.cpp:2801
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-074.js b/js/src/tests/js1_8_1/regress/regress-452498-074.js
new file mode 100644
index 000000000..d7f920d4a
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-074.js
@@ -0,0 +1,34 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  expect = '1';
+
+// ------- Comment #74 From Jesse Ruderman
+
+  const [d] = [1]; print(actual = d);
+
+  actual = String(actual);
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-075.js b/js/src/tests/js1_8_1/regress/regress-452498-075.js
new file mode 100644
index 000000000..7b5945719
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-075.js
@@ -0,0 +1,32 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #75 From Jesse Ruderman
+
+  (function p(){ p = 3; });
+  (function p(){ p = 3; return p; })()
+// Assertion failure: regs.sp == StackBase(fp), at ../jsinterp.cpp:2980
+
+    reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-076.js b/js/src/tests/js1_8_1/regress/regress-452498-076.js
new file mode 100644
index 000000000..925f3db03
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-076.js
@@ -0,0 +1,31 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #76 From Jesse Ruderman
+
+  for (let d = 0; d < 4; ++d) { d; }
+// 1: ReferenceError: d is not defined
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-079.js b/js/src/tests/js1_8_1/regress/regress-452498-079.js
new file mode 100644
index 000000000..d8b3a1f1d
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-079.js
@@ -0,0 +1,34 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #79 From Jason Orendorff
+
+  x; var x; function x() 0
+
+// Assertion failure: !(pn->pn_dflags & flag), at ../jsparse.h:635
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-082.js b/js/src/tests/js1_8_1/regress/regress-452498-082.js
new file mode 100644
index 000000000..5568cf8f5
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-082.js
@@ -0,0 +1,84 @@
+/* -*- tab-width: 2; indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #82 From Gary Kwong [:nth10sd]
+
+// =====
+
+  (function(){function  x(){} {let x = [] }});
+
+// =====
+
+  var f = new Function("new function x(){ return x |= function(){} } ([], function(){})");
+  "" + f;
+
+// =====
+
+  uneval(function(){[y] = [x];});
+
+// =====
+
+  function g(code)
+  {
+    var f = new Function(code);
+    f();
+  }
+  g("for (var x = 0; x < 3; ++x)(new (function(){})());");
+
+// =====
+  try
+  {
+    eval(
+      'for(let [\n' +
+      'function  x () { M:if([1,,])  }\n'
+      );
+  }
+  catch(ex)
+  {
+  }
+
+// =====
+
+  try
+  {
+    function foo(code)
+    {
+      var c;
+      eval("const c, x5 = c;");
+    }
+    foo();
+  }
+  catch(ex)
+  {
+  }
+
+// =====
+
+  var f = new Function("[] = [( '' )()];");
+  "" + f;
+
+// =====
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-092.js b/js/src/tests/js1_8_1/regress/regress-452498-092.js
new file mode 100644
index 000000000..54d42c8af
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-092.js
@@ -0,0 +1,40 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #92 From Jesse Ruderman
+
+  expect = 'SyntaxError: redeclaration of formal parameter e';
+  try
+  {
+    eval('(function (e) { var e; const e = undefined; });');
+  }
+  catch(ex)
+  {
+    actual = ex + '';
+  }
+// Without patch: "SyntaxError: redeclaration of var e"
+// expected new behavior // With patch:    "SyntaxError: redeclaration of formal parameter e:"
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-101.js b/js/src/tests/js1_8_1/regress/regress-452498-101.js
new file mode 100644
index 000000000..5bd15b2b7
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-101.js
@@ -0,0 +1,31 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #101 From Gary Kwong [:nth10sd]
+
+  uneval(function(){with({functional: []}){x5, y = this;const y = undefined }});
+// Assertion failure: strcmp(rval, with_cookie) == 0, at ../jsopcode.cpp:2567
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-102.js b/js/src/tests/js1_8_1/regress/regress-452498-102.js
new file mode 100644
index 000000000..0aa60e4ec
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-102.js
@@ -0,0 +1,69 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+ 
+// ------- Comment #102 From Gary Kwong [:nth10sd]
+
+// =====
+
+  (function(){function x(){} function x()y})();
+
+// Assertion failure: JOF_OPTYPE(op) == JOF_ATOM, at ../jsemit.cpp:1710
+
+// =====
+  function f() {
+    "" + (function(){
+        for( ; [function(){}] ; x = 0)
+          with({x: ""}) {
+            const x = []
+           }});
+  }
+  f();
+
+// Assertion failure: ss->top - saveTop <= 1U, at ../jsopcode.cpp:2156
+
+// =====
+
+  try
+  {
+    function f() {
+      var x;
+      eval("const x = [];");
+    }
+    f();
+  }
+  catch(ex)
+  {
+  }
+// Assertion failure: regs.sp == StackBase(fp), at ../jsinterp.cpp:2984
+
+// Assertion failure: cg->staticLevel >= level, at ../jsemit.cpp:2014
+// Crash [@ BindNameToSlot] in opt without -j
+
+// =====
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
+
+
+
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-104.js b/js/src/tests/js1_8_1/regress/regress-452498-104.js
new file mode 100644
index 000000000..19ade2695
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-104.js
@@ -0,0 +1,31 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #104 From Jesse Ruderman
+
+  (function(a) { function b() { a; } function a() { } })();
+// Assertion failure: pn_defn, at ../jsparse.h:655
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-111.js b/js/src/tests/js1_8_1/regress/regress-452498-111.js
new file mode 100644
index 000000000..0a6cb99a6
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-111.js
@@ -0,0 +1,34 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+ 
+// ------- Comment #111 From Gary Kwong [:nth10sd]
+
+new Function("{function x(){}}");
+
+// Assertion failure: pn->pn_defn || (fun->flags & JSFUN_LAMBDA), at ../jsemit.cpp:4149
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
+
+
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-112.js b/js/src/tests/js1_8_1/regress/regress-452498-112.js
new file mode 100644
index 000000000..19aa63b10
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-112.js
@@ -0,0 +1,39 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #112 From Jesse Ruderman
+
+  expect = 'ReferenceError: can\'t access lexical declaration `q\' before initialization';
+
+  try
+  {
+    q = new Function("(function() { q(3); })(); const q = undefined;"); q();
+  }
+  catch(ex)
+  {
+    actual = ex + '';
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-114-a.js b/js/src/tests/js1_8_1/regress/regress-452498-114-a.js
new file mode 100644
index 000000000..5d753f9eb
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-114-a.js
@@ -0,0 +1,43 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #114 From Gary Kwong [:nth10sd]
+
+  if (typeof timeout == 'function')
+  {
+    timeout(3);
+    try
+    {
+      eval('while(x|={}) with({}) const x;');
+    }
+    catch(ex)
+    {
+    }
+    reportCompare(expect, actual, '');
+  }
+
+// Assertion failure: cg->stackDepth >= 0, at ../jsemit.cpp:185
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-114.js b/js/src/tests/js1_8_1/regress/regress-452498-114.js
new file mode 100644
index 000000000..8962ca956
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-114.js
@@ -0,0 +1,50 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #114 From Gary Kwong [:nth10sd]
+
+  for (var x = 0; x < 3; ++x){ y = function (){} }
+
+// glorp!
+// Assertion failed: "Constantly false guard detected": 0 (../nanojit/LIR.cpp:999)
+// (note, this is with -j; I don't know what the glorp! message is about.)
+
+// =====
+  function y([{x: x, y}]){}
+
+// Assertion failure: UPVAR_FRAME_SKIP(pn->pn_cookie) == (pn->pn_defn ? cg->staticLevel : 0), at ../jsemit.cpp:3547
+
+// =====
+
+  try
+  {
+    eval("(1.3.__defineGetter__(\"\"));let (y, x) { var z = true, x = 0; }");
+  }
+  catch(ex)
+  {
+  }
+// Assertion failure: ATOM_IS_STRING(atom), at ../jsinterp.cpp:5691
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-116.js b/js/src/tests/js1_8_1/regress/regress-452498-116.js
new file mode 100644
index 000000000..c81b2b892
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-116.js
@@ -0,0 +1,33 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #116 From Gary Kwong [:nth10sd]
+
+// -j
+  (new Function("for (var x = 0; x < 3; ++x) { (function(){})() } "))();
+
+//Crash [@ js_IsActiveWithOrBlock]
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-117.js b/js/src/tests/js1_8_1/regress/regress-452498-117.js
new file mode 100644
index 000000000..ce37ea418
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-117.js
@@ -0,0 +1,95 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #117 From Gary Kwong [:nth10sd]
+
+// The following all do not require -j.
+
+// =====
+
+  try
+  {
+    eval('x; function  x(){}; const x = undefined;');
+  }
+  catch(ex)
+  {
+  }
+
+// Assertion failure: !pn->isPlaceholder(), at ../jsparse.cpp:4876
+// =====
+  (function(){ var x; eval("var x; x = null"); })();
+
+// Assertion failure: !(pnu->pn_dflags & PND_BOUND), at ../jsemit.cpp:1818
+// =====
+  (function(){const x = 0, y = delete x;})()
+
+// Assertion failure: JOF_OPTYPE(op) == JOF_ATOM, at ../jsemit.cpp:1710
+// =====
+    try
+    {
+      (function(){(yield []) (function(){with({}){x} }); const x = undefined;})();
+    }
+    catch(ex)
+    {
+    }
+
+// Assertion failure: pnu->pn_lexdef == dn, at ../jsemit.cpp:1817
+// =====
+  uneval(function(){arguments = ({ get y(){} }); for(var [arguments] in y ) (x);});
+
+// Assertion failure: n != 0, at ../jsfun.cpp:2689
+// =====
+  try
+  {
+    eval('(function(){{for(c in (function (){ for(x in (x1))window} )()) {const x = undefined;} }})();');
+  }
+  catch(ex)
+  {
+  }
+
+// Assertion failure: (fun->u.i.script)->upvarsOffset != 0, at ../jsfun.cpp:1537
+// Opt crash [@ js_NewFlatClosure] near null
+// =====
+  "" + function(){for(var [x] in x1) ([]); function x(){}}
+
+// Assertion failure: cg->stackDepth == stackDepth, at ../jsemit.cpp:3664
+// Opt crash [@ JS_ArenaRealloc] near null
+// =====
+  try
+  {
+    eval(
+      "for (a in (function(){" +
+      "      for each (let x in ['']) { return new function x1 (\u3056) { yield x } ();" +
+      "        }})())" +
+      "  function(){}"
+      );
+  }
+  catch(ex)
+  {
+  }
+// Crash [@ js_Interpret] near null
+// =====
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-118.js b/js/src/tests/js1_8_1/regress/regress-452498-118.js
new file mode 100644
index 000000000..4c4ee1750
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-118.js
@@ -0,0 +1,33 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #118 From Jesse Ruderman
+
+  (function() { (function() { e *= 4; })(); var e; })();
+
+//Without patch: no output
+//With patch:   ReferenceError: reference to undefined property "e"
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-121.js b/js/src/tests/js1_8_1/regress/regress-452498-121.js
new file mode 100644
index 000000000..99cecd79b
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-121.js
@@ -0,0 +1,33 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #121 From Gary Kwong [:nth10sd]
+
+// without -j
+  x = function()x;
+
+// Assertion failure: !(pn->pn_dflags & flag), at ../jsparse.h:651
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-123.js b/js/src/tests/js1_8_1/regress/regress-452498-123.js
new file mode 100644
index 000000000..ec9973fdd
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-123.js
@@ -0,0 +1,59 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+
+// ------- Comment #123 From Gary Kwong [:nth10sd]
+
+// Does not require -j:
+// =====
+  try
+  {
+    eval('y = (function (){y} for (x in []);');
+  }
+  catch(ex)
+  {
+  }
+
+// Assertion failure: !(pn->pn_dflags & flag), at ../jsparse.h:651
+// =====
+  (function(){for(var x in [arguments]){} function x(){}})();
+
+// Assertion failure: dn->pn_defn, at ../jsemit.cpp:1873
+// =====
+
+
+// Requires -j:
+// =====
+  (function(){ eval("for (x in ['', {}, '', {}]) { this; }" )})();
+
+// Assertion failure: fp->thisp == fp->argv[-1].toObjectOrNull(), at ../jstracer.cpp:4172
+// =====
+  for each (let x in ['', '', '']) { (new function(){} )}
+
+// Assertion failure: scope->object == ctor, at ../jsbuiltins.cpp:236
+// Opt crash [@ js_FastNewObject] near null
+// =====
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-129.js b/js/src/tests/js1_8_1/regress/regress-452498-129.js
new file mode 100644
index 000000000..b7f3c1474
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-129.js
@@ -0,0 +1,50 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #129 From Gary Kwong [:nth10sd]
+
+// Does not require -j:
+// =====
+try {
+    eval("({ set x x () { for(x in function(){}){}}  })");
+} catch (e)
+{
+}
+
+// Assertion failure: JOF_OPTYPE(op) == JOF_ATOM, at ../jsemit.cpp:1710
+// =====
+
+try
+{
+    (function (){ eval("(function(){delete !function(){}});"); })();
+}
+catch(ex)
+{
+}
+// Debug crash [@ JSParseNode::isFunArg] at null
+// Opt crash [@ FindFunArgs] near null
+// =====
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-131.js b/js/src/tests/js1_8_1/regress/regress-452498-131.js
new file mode 100644
index 000000000..d4cb82384
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-131.js
@@ -0,0 +1,49 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #131 From Gary Kwong [:nth10sd]
+
+// Does not require -j:
+// =====
+  try
+  {
+    eval('((__defineGetter__, function (x) { function x(){} }) for');
+  }
+  catch(ex)
+  {
+  }
+// Assertion failure: pn->pn_cookie == FREE_UPVAR_COOKIE, at ../jsparse.cpp:5698
+// =====
+  try
+  {
+    eval('( ""  ? 1.3 : x); *::*; x::x;');
+  }
+  catch(ex)
+  {
+  }
+// Assertion failure: pn != dn->dn_uses, at ../jsparse.cpp:1171
+// =====
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-135.js b/js/src/tests/js1_8_1/regress/regress-452498-135.js
new file mode 100644
index 000000000..b2bf72fab
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-135.js
@@ -0,0 +1,46 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// ------- Comment #135 From Gary Kwong [:nth10sd]
+
+// -j is not required:
+// ===
+
+  for (let i = 0; i < 9; ++i) {
+    let m = i;
+    if (i % 3 == 1) {
+      print('' + (function() { return m; })());
+    }
+  }
+
+// Debug & opt crash [@ BindNameToSlot]
+
+// -j is required:
+// ===
+    for (let a=0;a<3;++a) for (let b=0;b<3;++b) if ((g=a|(a%b))) with({}){}
+
+// Assertion failure: OBJ_IS_CLONED_BLOCK(obj), at ../jsobj.cpp:2392
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-155.js b/js/src/tests/js1_8_1/regress/regress-452498-155.js
new file mode 100644
index 000000000..5798569fa
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-155.js
@@ -0,0 +1,34 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  try
+  {
+    delete (1 ? window : function(){});
+  }
+  catch(ex)
+  {
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-160.js b/js/src/tests/js1_8_1/regress/regress-452498-160.js
new file mode 100644
index 000000000..6498a0b5a
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-160.js
@@ -0,0 +1,34 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+//-------  Comment #160  From  Gary Kwong
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// crash [@ js_Interpret]
+  (eval("(function(){ this.watch(\"x\", function () { new function ()y } ); const y = undefined });"))();
+  x = NaN;
+  reportCompare(expect, actual, summary + ': 2');
+
+// Assertion failure: JOF_OPTYPE(op) == JOF_ATOM, at ../jsemit.cpp:5916
+  ({ set z(v){},  set y(v)--x, set w(v)--w });
+  reportCompare(expect, actual, summary + ': 3');
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-168-1.js b/js/src/tests/js1_8_1/regress/regress-452498-168-1.js
new file mode 100644
index 000000000..c94653e49
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-168-1.js
@@ -0,0 +1,33 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+//-------  Comment #168  From  Gary Kwong
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// Assertion failure: (fun->u.i.script)->upvarsOffset != 0, at ../jsfun.cpp:1543
+
+  (
+    new Function("const x = (function () { if (1e+81){} else{x} } )"
+      ))();
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-168-2.js b/js/src/tests/js1_8_1/regress/regress-452498-168-2.js
new file mode 100644
index 000000000..b41a5211c
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-168-2.js
@@ -0,0 +1,32 @@
+// |reftest| skip -- slow
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+//-------  Comment #168  From  Gary Kwong
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// Assertion failure: cg->upvars.lookup(atom), at ../jsemit.cpp:2047
+
+  for (let x; __defineSetter__; (<{x}></{x}> for (x in x))) {}
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-176.js b/js/src/tests/js1_8_1/regress/regress-452498-176.js
new file mode 100644
index 000000000..77460e789
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-176.js
@@ -0,0 +1,31 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+//-------  Comment #176  From  Gary Kwong
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+// Assertion failure: pn_arity == PN_FUNC || pn_arity == PN_NAME, at ../jsparse.h:449
+
+  if(delete( 5 ? [] : (function(){})() )) [];
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-181.js b/js/src/tests/js1_8_1/regress/regress-452498-181.js
new file mode 100644
index 000000000..df5f3a160
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-181.js
@@ -0,0 +1,31 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+//-------  Comment #181  From  Jesse Ruderman
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  expect = 3;
+
+  (function(print) { delete print; })(); print(actual = 3);
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-185.js b/js/src/tests/js1_8_1/regress/regress-452498-185.js
new file mode 100644
index 000000000..1c88dc348
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-185.js
@@ -0,0 +1,37 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+//-------  Comment #185  From  Jesse Ruderman
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  expect = 'SyntaxError: redeclaration of var e';
+  try
+  {
+    eval('{ var e = 3; let e = ""; } print(typeof e);');
+  }
+  catch(ex)
+  {
+    actual = ex + '';
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-187.js b/js/src/tests/js1_8_1/regress/regress-452498-187.js
new file mode 100644
index 000000000..e4138ba28
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-187.js
@@ -0,0 +1,36 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+//-------  Comment #187  From  Jesse Ruderman
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  try
+  {
+    eval('const x = undefined; for (x in []);');
+  }
+  catch(ex)
+  {
+    actual = ex + '';
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-191.js b/js/src/tests/js1_8_1/regress/regress-452498-191.js
new file mode 100644
index 000000000..1628d7f87
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-191.js
@@ -0,0 +1,47 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+//-------  Comment #191  From  Brendan Eich
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  expect = actual = 'No Error';
+  try
+  {
+    eval('{ var x; {let x;} }');
+  }
+  catch(ex)
+  {
+    actual = ex + '';
+  }
+  reportCompare(expect, actual, summary);
+
+  expect = 'SyntaxError: redeclaration of let x';
+  try
+  {
+    eval('{ let x; {var x;} }');
+  }
+  catch(ex)
+  {
+    actual = ex + '';
+  }
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-452498-192.js b/js/src/tests/js1_8_1/regress/regress-452498-192.js
new file mode 100644
index 000000000..6f176788b
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-452498-192.js
@@ -0,0 +1,30 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 452498;
+var summary = 'TM: upvar2 regression tests';
+var actual = '';
+var expect = '';
+
+//-------  Comment #192  From  Brendan Eich
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  let x;
+  with({x: (x -= 0)}){([]); const x = undefined; }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-466905-01.js b/js/src/tests/js1_8_1/regress/regress-466905-01.js
new file mode 100644
index 000000000..882f8d7e3
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-466905-01.js
@@ -0,0 +1,30 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 466905;
+var summary = 'Do not assert: v_ins->isCall() && v_ins->callInfo() == &js_FastNewArray_ci';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+ 
+  function f(a) { for each (let c in a) [(c > 5) ? 'A' : 'B']; }
+  f([true, 8]);
+  f([2]);
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-466905-02.js b/js/src/tests/js1_8_1/regress/regress-466905-02.js
new file mode 100644
index 000000000..89872af19
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-466905-02.js
@@ -0,0 +1,29 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 466905;
+var summary = 'Do not assert: v_ins->isCall() && v_ins->callInfo() == &js_FastNewArray_ci';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+ 
+  for (var i = 0; i < 5; i++)
+    [(i > 3) ? 'a' : 'b'];
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-479430-01.js b/js/src/tests/js1_8_1/regress/regress-479430-01.js
new file mode 100644
index 000000000..c61cea7d4
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-479430-01.js
@@ -0,0 +1,44 @@
+// |reftest| skip-if(Android)
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 479430;
+var summary = 'Missing operation callback checks';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  if (typeof timeout == 'function')
+  {
+    expectExitCode(6);
+
+    timeout(0.01);
+
+    function f(n)
+    {
+      if (n != 0) {
+        f(n - 1);
+        f(n - 1);
+      }
+    }
+
+    f(100);
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-479430-02.js b/js/src/tests/js1_8_1/regress/regress-479430-02.js
new file mode 100644
index 000000000..04e6fca89
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-479430-02.js
@@ -0,0 +1,46 @@
+// |reftest| skip-if(Android)
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 479430;
+var summary = 'Missing operation callback checks';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  if (typeof timeout == 'function')
+  {
+    expectExitCode(6);
+
+    timeout(0.01);
+
+    function f(n)
+    {
+      if (n != 0) {
+        try { f(n - 1); } catch (e) {}
+        try { f(n - 1); } catch (e) {}
+      }
+      throw 0;
+    }
+
+    f(100);
+
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-479430-03.js b/js/src/tests/js1_8_1/regress/regress-479430-03.js
new file mode 100644
index 000000000..dcac2bfb5
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-479430-03.js
@@ -0,0 +1,49 @@
+// |reftest| skip-if(Android)
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 479430;
+var summary = 'Missing operation callback checks';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  if (typeof timeout == 'function')
+  {
+    expectExitCode(6);
+
+    timeout(0.01);
+
+    function f(n)
+    {
+      if (n != 0) {
+        f(n - 1);
+        f(n - 1);
+      }
+      try {
+        return 0;
+      } finally {
+        n++;
+      }
+    }
+
+    f(100);
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-479430-04.js b/js/src/tests/js1_8_1/regress/regress-479430-04.js
new file mode 100644
index 000000000..7ddcea3b0
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-479430-04.js
@@ -0,0 +1,45 @@
+// |reftest| skip-if(Android)
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 479430;
+var summary = 'Missing operation callback checks';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  if (typeof timeout== 'function')
+  {
+    expectExitCode(6);
+
+    timeout(0.01);
+
+    function f(n)
+    {
+      if (n != 0) {
+        try { f(n - 1); } catch (e) {}
+        try { f(n - 1); } catch (e) {}
+      }
+      name_that_does_not_exists;
+    }
+
+    f(100);
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-479430-05.js b/js/src/tests/js1_8_1/regress/regress-479430-05.js
new file mode 100644
index 000000000..b811202f8
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-479430-05.js
@@ -0,0 +1,44 @@
+// |reftest| skip-if(Android)
+/* -*- Mode: C++; tab-width: 2; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 479430;
+var summary = 'Missing operation callback checks';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  if (typeof timeout == 'function')
+  {
+    expectExitCode(6);
+
+    timeout(0.01);
+
+    function f(n)
+    {
+      if (n != 0) {
+        try { f(n - 1); } finally { f(n - 1); }
+      }
+      name_that_does_not_exists;
+    }
+
+    f(100);
+  }
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-495773.js b/js/src/tests/js1_8_1/regress/regress-495773.js
new file mode 100644
index 000000000..53c0387a7
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-495773.js
@@ -0,0 +1,42 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 495773;
+var summary = 'Read upvar from trace-entry frame from JSStackFrame instead of tracing native stack';
+var actual = ''
+var expect = '010101';
+//-----------------------------------------------------------------------------
+function f() {
+    var q = [];
+    for (var a = 0; a < 3; ++a) {
+        (function () {
+            for (var b = 0; b < 2; ++b) {
+                (function () {
+                    for (var c = 0; c < 1; ++c) {
+                        q.push(b);
+                    }
+                })();
+            }
+        })();
+    }
+    return q.join("");
+}
+
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+
+  actual = f();
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-495907.js b/js/src/tests/js1_8_1/regress/regress-495907.js
new file mode 100644
index 000000000..12ac1ef83
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-495907.js
@@ -0,0 +1,34 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 495907;
+var summary = 'Read upvar from trace-entry frame when created with top-level let';
+var actual = ''
+var expect = '00112233';
+//-----------------------------------------------------------------------------
+
+// The test code needs to run at top level in order to expose the bug.
+start_test();
+
+var o = [];
+for (let a = 0; a < 4; ++a) {
+    (function () {for (var b = 0; b < 2; ++b) {o.push(a);}}());
+}
+actual = o.join("");
+
+finish_test();
+//-----------------------------------------------------------------------------
+
+function start_test() {
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+}
+
+function finish_test() {
+  reportCompare(expect, actual, summary);
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-496922.js b/js/src/tests/js1_8_1/regress/regress-496922.js
new file mode 100644
index 000000000..7b32c26c1
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-496922.js
@@ -0,0 +1,38 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 496922;
+var summary = 'Incorrect handling of extra arguments';
+var actual = ''
+var expect = '0,0,1,1,2,2,3,3';
+
+
+//-----------------------------------------------------------------------------
+
+// The code must run as part of the top-level script in order to get the bug.
+enterFunc ('test');
+printBugNumber(BUGNUMBER);
+printStatus (summary);
+
+var a = [];
+{
+let f = function() {
+    for (let x = 0; x < 4; ++x) {
+        (function() {
+            for (let y = 0; y < 2; ++y) {
+              a.push(x);
+            }
+        })()
+    }
+}; (function() {})()
+    f(99)
+}
+actual = '' + a;
+
+reportCompare(expect, actual, summary);
+exitFunc ('test');
+//-----------------------------------------------------------------------------
+
diff --git a/js/src/tests/js1_8_1/regress/regress-507053.js b/js/src/tests/js1_8_1/regress/regress-507053.js
new file mode 100644
index 000000000..ace72f326
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-507053.js
@@ -0,0 +1,46 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 507053;
+var summary = 'TM: invalid results with setting a closure variable in a loop'
+var actual = '';
+var expect = '2,4,8,16,32,2,4,8,16,32,2,4,8,16,32,2,4,8,16,32,2,4,8,16,32,';
+
+
+//-----------------------------------------------------------------------------
+start_test();
+
+var f = function() {
+  var p = 1;
+  
+  function g() {
+    for (var i = 0; i < 5; ++i) {
+      p = p * 2;
+      actual += p + ',';
+    }
+  }
+  g();
+}
+
+for (var i = 0; i < 5; ++i) {
+  f();
+}
+
+finish_test();
+//-----------------------------------------------------------------------------
+
+function start_test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+}
+
+function finish_test()
+{
+  reportCompare(expect, actual, summary);
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-507295.js b/js/src/tests/js1_8_1/regress/regress-507295.js
new file mode 100644
index 000000000..7a1de77e0
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-507295.js
@@ -0,0 +1,41 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 507295;
+var summary = 'TM: assert with using result of assignment to closure var'
+var actual = '';
+var expect = 'do not crash';
+
+
+//-----------------------------------------------------------------------------
+start_test();
+
+(function () {
+    var y;
+    (eval("(function () {\
+               for (var x = 0; x < 3; ++x) {\
+               ''.replace(/a/, (y = 3))\
+               }\
+           });\
+     "))()
+})()
+
+actual = 'do not crash'
+finish_test();
+//-----------------------------------------------------------------------------
+
+function start_test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+}
+
+function finish_test()
+{
+  reportCompare(expect, actual, summary);
+  exitFunc ('test');
+}
diff --git a/js/src/tests/js1_8_1/regress/regress-509354.js b/js/src/tests/js1_8_1/regress/regress-509354.js
new file mode 100644
index 000000000..cbf4cfc59
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-509354.js
@@ -0,0 +1,41 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff <jorendorff@mozilla.com>
+ */
+
+// Decompile destructuring argument named `arguments` correctly.
+var actual = "" + function ([arguments]) {return arguments;};
+compareSource('function ([arguments]) {return arguments;}', actual, "part 1");
+
+// Make sure the 'arguments' argument actually works.
+var f = function ([arguments]) {return arguments + 1;};
+reportCompare(3.25, f([2.25]), "part 2");
+
+// Throw SyntaxError when `arguments` appears twice in a destructuring parameter.
+actual = "no exception";
+try {
+    eval('(function ([arguments, arguments]) {return arguments();})');
+} catch (exc) {
+    actual = exc.name;
+}
+reportCompare("SyntaxError", actual, "part 3");
+
+// And again...
+actual = "no exception";
+try {
+    eval('(function ([a, b, arguments, d], [e, f, arguments]) {return arguments();})');
+} catch (exc) {
+    actual = exc.name;
+}
+reportCompare("SyntaxError", actual, "part 4");
+
+// The original test case from bug 509354. Don't crash.
+try {
+    eval('print(function([arguments,arguments,arguments,arguments,arguments,' +
+         'arguments,arguments,arguments,arguments,arguments,arguments,' +
+         'arguments,arguments,arguments,arguments,arguments]){})');
+} catch (exc) {
+}
+reportCompare("no crash", "no crash", "part 5");
+
diff --git a/js/src/tests/js1_8_1/regress/regress-522123.js b/js/src/tests/js1_8_1/regress/regress-522123.js
new file mode 100644
index 000000000..7a491e094
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-522123.js
@@ -0,0 +1,38 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+//-----------------------------------------------------------------------------
+var BUGNUMBER = 522123;
+var summary = 'Indirect eval confuses scope chain';
+var actual = '';
+var expect = '';
+
+
+//-----------------------------------------------------------------------------
+var x=1;
+
+test();
+//-----------------------------------------------------------------------------
+
+function test()
+{
+  enterFunc ('test');
+  printBugNumber(BUGNUMBER);
+  printStatus (summary);
+ 
+  expect = 1;
+
+  evil=eval;
+  {
+    let x=2;
+    actual = evil("x");
+  };
+
+  reportCompare(expect, actual, summary);
+
+  exitFunc ('test');
+}
+
+reportCompare(true, true);
diff --git a/js/src/tests/js1_8_1/regress/regress-524264.js b/js/src/tests/js1_8_1/regress/regress-524264.js
new file mode 100644
index 000000000..78006bd6c
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-524264.js
@@ -0,0 +1,7 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+uneval(function () { do yield; while (0); });
+reportCompare("no assertion failure", "no assertion failure", "bug 524264");
diff --git a/js/src/tests/js1_8_1/regress/regress-524743.js b/js/src/tests/js1_8_1/regress/regress-524743.js
new file mode 100644
index 000000000..8bd3cd6ee
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-524743.js
@@ -0,0 +1,20 @@
+// |reftest| skip-if((isDebugBuild&&!xulRuntime.shell)||Android)  -- hang
+// Any copyright is dedicated to the Public Domain.
+// http://creativecommons.org/licenses/publicdomain/
+
+if (typeof gczeal != 'undefined' && typeof gc != 'undefined') {
+    try
+    {
+        gczeal(2);
+        var obj = {};
+        for (var i = 0; i < 50; i++) {
+            obj["_" + i] = 0;
+            gc();
+        }
+    }
+    catch(ex)
+    {
+    }
+    gczeal(0);
+}
+reportCompare("no assertion failure", "no assertion failure", "bug 524743");
diff --git a/js/src/tests/js1_8_1/regress/regress-530879.js b/js/src/tests/js1_8_1/regress/regress-530879.js
new file mode 100644
index 000000000..39931d1c3
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/regress-530879.js
@@ -0,0 +1,9 @@
+/*
+ * Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/licenses/publicdomain/
+ * Contributor: Jason Orendorff
+ */
+function f(a, b, c, d) {
+    yield arguments.length;
+}
+reportCompare(0, f().next(), "bug 530879");
diff --git a/js/src/tests/js1_8_1/regress/shell.js b/js/src/tests/js1_8_1/regress/shell.js
new file mode 100644
index 000000000..e69de29bb
--- /dev/null
+++ b/js/src/tests/js1_8_1/regress/shell.js