Merge.

js/src/builtins.tbl

@@ -55,6 +55,7 @@ BUILTIN1(Math_sqrt,             F,      F,      jsdouble,  jsdouble, 1, 1)
 BUILTIN1(Math_floor,            F,      F,      jsdouble,  jsdouble, 1, 1)
 BUILTIN1(Math_ceil,             F,      F,      jsdouble,  jsdouble, 1, 1)
 BUILTIN1(Math_log,              F,      F,      jsdouble,  jsdouble, 1, 1)
+BUILTIN2(Math_max,              F,  F,  F,      jsdouble,  jsdouble, jsdouble, 1, 1)
 BUILTIN4(Array_dense_setelem,   LO, LO, LO, LO, LO, bool,  JSContext*, JSObject*, jsint, jsval, 0, 0)
 BUILTIN3(Array_p_join,          LO, LO, LO, P,  JSString*, JSContext*, JSObject*, JSString*, 0, 0)
 BUILTIN4(String_p_substring,    LO, LO, LO, LO, P,  JSString*, JSContext*, JSString*, jsint, jsint, 1, 1)

js/src/correct.sh

@@ -0,0 +1,23 @@
+#!/bin/bash
+FAILURES="FAILED"
+for i in correct/*.js; do 
+    echo $i;
+    echo -n interp:' '
+    INTERP=`Darwin_OPT.OBJ/js -f $i`
+    echo $INTERP' '
+    echo -n jit:' '
+    JIT=`Darwin_OPT.OBJ/js -j -f $i`
+    echo $JIT' '
+    if [ $INTERP != "true" -o $JIT != "true" ]
+    then
+        FAILURES=${FAILURES}" "${i}
+    fi
+done
+
+echo
+if [[ "FAILED" != "${FAILURES}" ]]
+then
+    echo ${FAILURES}
+else
+    echo "PASSED"
+fi

js/src/correct/check-3d-morph.js

@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+var loops = 15
+var nx = 120
+var nz = 120
+
+function morph(a, f) {
+    var PI2nx = Math.PI * 8/nx
+    var sin = Math.sin
+    var f30 = -(50 * sin(f*Math.PI*2))
+    
+    for (var i = 0; i < nz; ++i) {
+        for (var j = 0; j < nx; ++j) {
+            a[3*(i*nx+j)+1]    = sin((j-1) * PI2nx ) * -f30
+        }
+    }
+}
+
+    
+var a = Array()
+for (var i=0; i < nx*nz*3; ++i) 
+    a[i] = 0
+
+for (var i = 0; i < loops; ++i) {
+    morph(a, i/loops)
+}
+
+testOutput = 0;
+for (var i = 0; i < nx; i++)
+    testOutput += a[3*(i*nx+i)+1];
+a = null;
+print(testOutput == 6.394884621840902e-14)

js/src/correct/check-access-binary-trees.js

@@ -0,0 +1,52 @@
+/* The Great Computer Language Shootout
+   http://shootout.alioth.debian.org/
+   contributed by Isaac Gouy */
+
+function TreeNode(left,right,item){
+   this.left = left;
+   this.right = right;
+   this.item = item;
+}
+
+TreeNode.prototype.itemCheck = function(){
+   if (this.left==null) return this.item;
+   else return this.item + this.left.itemCheck() - this.right.itemCheck();
+}
+
+function bottomUpTree(item,depth){
+   if (depth>0){
+      return new TreeNode(
+          bottomUpTree(2*item-1, depth-1)
+         ,bottomUpTree(2*item, depth-1)
+         ,item
+      );
+   }
+   else {
+      return new TreeNode(null,null,item);
+   }
+}
+
+var ret;
+
+for ( var n = 4; n <= 7; n += 1 ) {
+    var minDepth = 4;
+    var maxDepth = Math.max(minDepth + 2, n);
+    var stretchDepth = maxDepth + 1;
+    
+    var check = bottomUpTree(0,stretchDepth).itemCheck();
+    
+    var longLivedTree = bottomUpTree(0,maxDepth);
+    for (var depth=minDepth; depth<=maxDepth; depth+=2){
+        var iterations = 1 << (maxDepth - depth + minDepth);
+
+        check = 0;
+        for (var i=1; i<=iterations; i++){
+            check += bottomUpTree(i,depth).itemCheck();
+            check += bottomUpTree(-i,depth).itemCheck();
+        }
+    }
+
+    ret = longLivedTree.itemCheck();
+}
+
+print(ret == -1)

js/src/correct/check-access-fannkuch.js

@@ -0,0 +1,66 @@
+/* The Great Computer Language Shootout
+   http://shootout.alioth.debian.org/
+   contributed by Isaac Gouy */
+
+function fannkuch(n) {
+   var check = 0;
+   var perm = Array(n);
+   var perm1 = Array(n);
+   var count = Array(n);
+   var maxPerm = Array(n);
+   var maxFlipsCount = 0;
+   var m = n - 1;
+
+   for (var i = 0; i < n; i++) perm1[i] = i;
+   var r = n;
+
+   while (true) {
+      // write-out the first 30 permutations
+      if (check < 30){
+         var s = "";
+         for(var i=0; i<n; i++) s += (perm1[i]+1).toString();
+         check++;
+      }
+
+      while (r != 1) { count[r - 1] = r; r--; }
+      if (!(perm1[0] == 0 || perm1[m] == m)) {
+         for (var i = 0; i < n; i++) perm[i] = perm1[i];
+
+         var flipsCount = 0;
+         var k;
+
+         while (!((k = perm[0]) == 0)) {
+            var k2 = (k + 1) >> 1;
+            for (var i = 0; i < k2; i++) {
+               var temp = perm[i]; perm[i] = perm[k - i]; perm[k - i] = temp;
+            }
+            flipsCount++;
+         }
+
+         if (flipsCount > maxFlipsCount) {
+            maxFlipsCount = flipsCount;
+            for (var i = 0; i < n; i++) maxPerm[i] = perm1[i];
+         }
+      }
+
+      while (true) {
+         if (r == n) return maxFlipsCount;
+         var perm0 = perm1[0];
+         var i = 0;
+         while (i < r) {
+            var j = i + 1;
+            perm1[i] = perm1[j];
+            i = j;
+         }
+         perm1[r] = perm0;
+
+         count[r] = count[r] - 1;
+         if (count[r] > 0) break;
+         r++;
+      }
+   }
+}
+
+var n = 8;
+var ret = fannkuch(n);
+print(ret == 22)

js/src/correct/check-access-nbody.js

@@ -0,0 +1,171 @@
+/* The Great Computer Language Shootout
+   http://shootout.alioth.debian.org/
+   contributed by Isaac Gouy */
+
+var PI = 3.141592653589793;
+var SOLAR_MASS = 4 * PI * PI;
+var DAYS_PER_YEAR = 365.24;
+
+function Body(x,y,z,vx,vy,vz,mass){
+   this.x = x;
+   this.y = y;
+   this.z = z;
+   this.vx = vx;
+   this.vy = vy;
+   this.vz = vz;
+   this.mass = mass;
+}
+
+Body.prototype.offsetMomentum = function(px,py,pz) {
+   this.vx = -px / SOLAR_MASS;
+   this.vy = -py / SOLAR_MASS;
+   this.vz = -pz / SOLAR_MASS;
+   return this;
+}
+
+function Jupiter(){
+   return new Body(
+      4.84143144246472090e+00,
+      -1.16032004402742839e+00,
+      -1.03622044471123109e-01,
+      1.66007664274403694e-03 * DAYS_PER_YEAR,
+      7.69901118419740425e-03 * DAYS_PER_YEAR,
+      -6.90460016972063023e-05 * DAYS_PER_YEAR,
+      9.54791938424326609e-04 * SOLAR_MASS
+   );
+}
+
+function Saturn(){
+   return new Body(
+      8.34336671824457987e+00,
+      4.12479856412430479e+00,
+      -4.03523417114321381e-01,
+      -2.76742510726862411e-03 * DAYS_PER_YEAR,
+      4.99852801234917238e-03 * DAYS_PER_YEAR,
+      2.30417297573763929e-05 * DAYS_PER_YEAR,
+      2.85885980666130812e-04 * SOLAR_MASS
+   );
+}
+
+function Uranus(){
+   return new Body(
+      1.28943695621391310e+01,
+      -1.51111514016986312e+01,
+      -2.23307578892655734e-01,
+      2.96460137564761618e-03 * DAYS_PER_YEAR,
+      2.37847173959480950e-03 * DAYS_PER_YEAR,
+      -2.96589568540237556e-05 * DAYS_PER_YEAR,
+      4.36624404335156298e-05 * SOLAR_MASS
+   );
+}
+
+function Neptune(){
+   return new Body(
+      1.53796971148509165e+01,
+      -2.59193146099879641e+01,
+      1.79258772950371181e-01,
+      2.68067772490389322e-03 * DAYS_PER_YEAR,
+      1.62824170038242295e-03 * DAYS_PER_YEAR,
+      -9.51592254519715870e-05 * DAYS_PER_YEAR,
+      5.15138902046611451e-05 * SOLAR_MASS
+   );
+}
+
+function Sun(){
+   return new Body(0.0, 0.0, 0.0, 0.0, 0.0, 0.0, SOLAR_MASS);
+}
+
+
+function NBodySystem(bodies){
+   this.bodies = bodies;
+   var px = 0.0;
+   var py = 0.0;
+   var pz = 0.0;
+   var size = this.bodies.length;
+   for (var i=0; i<size; i++){
+      var b = this.bodies[i];
+      var m = b.mass;
+      px += b.vx * m;
+      py += b.vy * m;
+      pz += b.vz * m;
+   }
+   this.bodies[0].offsetMomentum(px,py,pz);
+}
+
+NBodySystem.prototype.advance = function(dt){
+   var dx, dy, dz, distance, mag;
+   var size = this.bodies.length;
+
+   for (var i=0; i<size; i++) {
+      var bodyi = this.bodies[i];
+      for (var j=i+1; j<size; j++) {
+         var bodyj = this.bodies[j];
+         dx = bodyi.x - bodyj.x;
+         dy = bodyi.y - bodyj.y;
+         dz = bodyi.z - bodyj.z;
+
+         distance = Math.sqrt(dx*dx + dy*dy + dz*dz);
+         mag = dt / (distance * distance * distance);
+
+         bodyi.vx -= dx * bodyj.mass * mag;
+         bodyi.vy -= dy * bodyj.mass * mag;
+         bodyi.vz -= dz * bodyj.mass * mag;
+
+         bodyj.vx += dx * bodyi.mass * mag;
+         bodyj.vy += dy * bodyi.mass * mag;
+         bodyj.vz += dz * bodyi.mass * mag;
+      }
+   }
+
+   for (var i=0; i<size; i++) {
+      var body = this.bodies[i];
+      body.x += dt * body.vx;
+      body.y += dt * body.vy;
+      body.z += dt * body.vz;
+   }
+}
+
+NBodySystem.prototype.energy = function(){
+   var dx, dy, dz, distance;
+   var e = 0.0;
+   var size = this.bodies.length;
+
+   for (var i=0; i<size; i++) {
+      var bodyi = this.bodies[i];
+
+      e += 0.5 * bodyi.mass *
+         ( bodyi.vx * bodyi.vx
+         + bodyi.vy * bodyi.vy
+         + bodyi.vz * bodyi.vz );
+
+      for (var j=i+1; j<size; j++) {
+         var bodyj = this.bodies[j];
+         dx = bodyi.x - bodyj.x;
+         dy = bodyi.y - bodyj.y;
+         dz = bodyi.z - bodyj.z;
+
+         distance = Math.sqrt(dx*dx + dy*dy + dz*dz);
+         e -= (bodyi.mass * bodyj.mass) / distance;
+      }
+   }
+   return e;
+}
+
+var ret;
+
+for ( var n = 3; n <= 24; n *= 2 ) {
+    (function(){
+        var bodies = new NBodySystem( Array(
+           Sun(),Jupiter(),Saturn(),Uranus(),Neptune()
+        ));
+        var max = n * 100;
+        
+        ret = bodies.energy();
+        for (var i=0; i<max; i++){
+            bodies.advance(0.01);
+        }
+        ret = bodies.energy();
+    })();
+}
+
+print(ret == -0.16906933525822856)

js/src/correct/check-access-nsieve.js

@@ -0,0 +1,40 @@
+// The Great Computer Language Shootout
+// http://shootout.alioth.debian.org/
+//
+// modified by Isaac Gouy
+
+function pad(number,width){
+   var s = number.toString();
+   var prefixWidth = width - s.length;
+   if (prefixWidth>0){
+      for (var i=1; i<=prefixWidth; i++) s = " " + s;
+   }
+   return s;
+}
+
+function nsieve(m, isPrime){
+   var i, k, count;
+
+   for (i=2; i<=m; i++) { isPrime[i] = true; }
+   count = 0;
+
+   for (i=2; i<=m; i++){
+      if (isPrime[i]) {
+         for (k=i+i; k<=m; k+=i) isPrime[k] = false;
+         count++;
+      }
+   }
+   return count;
+}
+
+var ret = 0;
+function sieve() {
+    for (var i = 1; i <= 3; i++ ) {
+        var m = (1<<i)*10000;
+        var flags = Array(m+1);
+        ret += nsieve(m, flags);
+    }
+}
+
+sieve();
+print(ret == 14302)

js/src/correct/check-bitops-3bit-bits-in-byte.js

@@ -0,0 +1,35 @@
+// Copyright (c) 2004 by Arthur Langereis (arthur_ext at domain xfinitegames, tld com
+
+// 1 op = 6 ANDs, 3 SHRs, 3 SHLs, 4 assigns, 2 ADDs
+// O(1)
+function fast3bitlookup(b) {
+var c, bi3b = 0xE994; // 0b1110 1001 1001 0100; // 3 2 2 1  2 1 1 0
+c  = 3 & (bi3b >> ((b << 1) & 14));
+c += 3 & (bi3b >> ((b >> 2) & 14));
+c += 3 & (bi3b >> ((b >> 5) & 6));
+return c;
+
+/*
+lir4,0xE994; 9 instructions, no memory access, minimal register dependence, 6 shifts, 2 adds, 1 inline assign
+rlwinmr5,r3,1,28,30
+rlwinmr6,r3,30,28,30
+rlwinmr7,r3,27,29,30
+rlwnmr8,r4,r5,30,31
+rlwnmr9,r4,r6,30,31
+rlwnmr10,r4,r7,30,31
+addr3,r8,r9
+addr3,r3,r10
+*/
+}
+
+var ret = 0;
+function TimeFunc(func) {
+  var x, y, t;
+  for(var x=0; x<500; x++)
+  for(var y=0; y<256; y++) {
+    ret += func(y);
+  }
+}
+
+TimeFunc(fast3bitlookup);
+print(ret == 512000)

js/src/correct/check-bitops-bits-in-byte.js

@@ -0,0 +1,24 @@
+// Copyright (c) 2004 by Arthur Langereis (arthur_ext at domain xfinitegames, tld com)
+
+
+// 1 op = 2 assigns, 16 compare/branches, 8 ANDs, (0-8) ADDs, 8 SHLs
+// O(n)
+function bitsinbyte(b) {
+var m = 1, c = 0;
+while(m<0x100) {
+if(b & m) c++;
+m <<= 1;
+}
+return c;
+}
+
+var ret = 0;
+function TimeFunc(func) {
+var x, y, t;
+for(var x=0; x<350; x++)
+for(var y=0; y<256; y++) 
+  ret += func(y);
+}
+
+TimeFunc(bitsinbyte);
+print(ret == 358400)

js/src/correct/check-bitops-bitwise-and.js

@@ -0,0 +1,29 @@
+/*
+ * Copyright (C) 2007 Apple Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+bitwiseAndValue = 4294967296;
+for (var i = 0; i < 60; i++)
+    bitwiseAndValue = bitwiseAndValue & i;
+print(bitwiseAndValue == 0)

js/src/correct/check-bitops-nsieve-bits.js

@@ -0,0 +1,40 @@
+// The Great Computer Language Shootout
+//  http://shootout.alioth.debian.org
+//
+//  Contributed by Ian Osgood
+
+var result = [];
+
+function pad(n,width) {
+  var s = n.toString();
+  while (s.length < width) s = ' ' + s;
+  return s;
+}
+
+function primes(isPrime, n) {
+  var i, count = 0, m = 10000<<n, size = m+31>>5;
+
+  for (i=0; i<size; i++) isPrime[i] = 0xffffffff;
+
+  for (i=2; i<m; i++)
+    if (isPrime[i>>5] & 1<<(i&31)) {
+      for (var j=i+i; j<m; j+=i)
+        result.push(isPrime[j>>5] &= ~(1<<(j&31)));
+      count++;
+    }
+}
+
+function sieve() {
+    for (var i = 4; i <= 4; i++) {
+        var isPrime = new Array((10000<<i)+31>>5);
+        primes(isPrime, i);
+    }
+}
+
+sieve();
+
+var ret = 0;
+for (var i = 0; i < result.length; ++i)
+  ret += result[i];
+
+print(ret == -211235557404919)

js/src/correct/check-controlflow-recursive.js

@@ -0,0 +1,27 @@
+// The Computer Language Shootout
+// http://shootout.alioth.debian.org/
+// contributed by Isaac Gouy
+
+function ack(m,n){
+   if (m==0) { return n+1; }
+   if (n==0) { return ack(m-1,1); }
+   return ack(m-1, ack(m,n-1) );
+}
+
+function fib(n) {
+    if (n < 2){ return 1; }
+    return fib(n-2) + fib(n-1);
+}
+
+function tak(x,y,z) {
+    if (y >= x) return z;
+    return tak(tak(x-1,y,z), tak(y-1,z,x), tak(z-1,x,y));
+}
+
+var ret = 0;
+for ( var i = 3; i <= 5; i++ ) {
+    ret += ack(3,i);
+    ret += fib(17.0+i);
+    ret += tak(3*i+3,2*i+2,i+1);
+}
+print(ret == 57775);

js/src/jsbuiltins.cpp

@@ -48,6 +48,7 @@
 #include "jscntxt.h"
 #include "jsgc.h"
 #include "jsiter.h"
+#include "jslibmath.h"
 #include "jsmath.h"
 #include "jsnum.h"
 #include "jsscope.h"
@@ -195,6 +196,17 @@ js_Math_log(jsdouble d)
     return log(d);
 }
 
+jsdouble FASTCALL
+js_Math_max(jsdouble d, jsdouble p)
+{
+    if (JSDOUBLE_IS_NaN(d) || JSDOUBLE_IS_NaN(p))
+        return js_NaN;
+
+    if (p == 0 && p == d && fd_copysign(1.0, d) == -1)
+        return p;
+    return (d > p) ? d : p;
+}
+
 JSBool FASTCALL
 js_Array_dense_setelem(JSContext* cx, JSObject* obj, jsint i, jsval v)
 {

js/src/jsinterp.cpp

@@ -258,7 +258,7 @@ js_FillPropertyCache(JSContext *cx, JSObject *obj, jsuword kshape,
      * but that is a one-time event and we'll have to miss the old shape and
      * re-fill under the new one.
      */
-    if (!(cs->format & (JOF_SET | JOF_INCDEC)))
+    if (!(cs->format & (JOF_SET | JOF_INCDEC)) && obj == pobj)
         kshape = scope->shape;
 
     khash = PROPERTY_CACHE_HASH_PC(pc, kshape);

js/src/jsmath.cpp

@@ -321,8 +321,8 @@ js_math_log(JSContext *cx, uintN argc, jsval *vp)
     return js_NewNumberInRootedValue(cx, z, vp);
 }
 
-static JSBool
-math_max(JSContext *cx, uintN argc, jsval *vp)
+JSBool
+js_math_max(JSContext *cx, uintN argc, jsval *vp)
 {
     jsdouble x, z = *cx->runtime->jsNegativeInfinity;
     jsval *argv;
@@ -598,7 +598,7 @@ static JSFunctionSpec math_static_methods[] = {
     JS_FN("exp",            math_exp,           1, 0),
     JS_FN("floor",          js_math_floor,      1, 0),
     JS_FN("log",            js_math_log,        1, 0),
-    JS_FN("max",            math_max,           2, 0),
+    JS_FN("max",            js_math_max,        2, 0),
     JS_FN("min",            math_min,           2, 0),
     JS_FN("pow",            js_math_pow,        2, 0),
     JS_FN("random",         js_math_random,     0, 0),

js/src/jstracer.cpp

@@ -3466,7 +3466,7 @@ TraceRecorder::test_property_cache_direct_slot(JSObject* obj, LIns* obj_ins, uin
         return true;
     }
 
-    /* Insist if setting on obj being the directly addressed object. */
+    /* If modifying the slot, insist on obj being the directly addressed object. */
     uint32 setflags = (js_CodeSpec[*cx->fp->regs->pc].format & (JOF_SET | JOF_INCDEC));
     if (setflags && obj2 != obj)
         ABORT_TRACE("JOF_SET opcode hit prototype chain");
@@ -4645,6 +4645,7 @@ KNOWN_NATIVE_DECL(js_math_ceil)
 KNOWN_NATIVE_DECL(js_math_cos)
 KNOWN_NATIVE_DECL(js_math_floor)
 KNOWN_NATIVE_DECL(js_math_log)
+KNOWN_NATIVE_DECL(js_math_max)
 KNOWN_NATIVE_DECL(js_math_pow)
 KNOWN_NATIVE_DECL(js_math_random)
 KNOWN_NATIVE_DECL(js_math_sin)
@@ -4700,6 +4701,7 @@ TraceRecorder::record_JSOP_CALL()
         { js_math_ceil,                F_Math_ceil,            "",    "d",    INFALLIBLE },
         { js_math_random,              F_Math_random,          "R",    "",    INFALLIBLE },
         { js_math_log,                 F_Math_log,             "",    "d",    INFALLIBLE },
+        { js_math_max,                 F_Math_max,             "",    "dd",   INFALLIBLE },
         { js_num_parseInt,             F_ParseInt,             "C",   "s",    INFALLIBLE },
         { js_num_parseInt,             F_ParseIntDouble,       "",    "d",    INFALLIBLE },
         { js_num_parseFloat,           F_ParseFloat,           "C",   "s",    INFALLIBLE },

js/src/trace-test.js

@@ -1206,7 +1206,7 @@ function testTypeofHole() {
   a[5] = 3;
   for (var i = 0; i < 6; ++i)
     a[i] = typeof a[i];
-  return a.toString();
+  return a.join(",");
 }
 testTypeofHole.expected = "undefined,undefined,undefined,undefined,undefined,number"
 test(testTypeofHole);
@@ -1279,6 +1279,28 @@ function test_JSOP_ARGCNT() {
 test_JSOP_ARGCNT.expected = "1,2,3,4,5,6,7,8,9,10";
 test(test_JSOP_ARGCNT);
 
+function testNativeMax() {
+    var out = [], k;
+    for (var i = 0; i < 5; ++i) {
+        k = Math.max(k, i);
+    }
+    out.push(k);
+
+    k = 0;
+    for (var i = 0; i < 5; ++i) {
+        k = Math.max(k, i);
+    }
+    out.push(k);
+
+    for (var i = 0; i < 5; ++i) {
+        k = Math.max(0, -0);
+    }
+    out.push((1 / k) < 0);
+    return out.join(",");
+}
+testNativeMax.expected = "NaN,4,false";
+test(testNativeMax);
+
 /* Keep these at the end so that we can see the summary after the trace-debug spew. */
 print("\npassed:", passes.length && passes.join(","));
 print("\nFAILED:", fails.length && fails.join(","));