1 2017-12-19 Yusuke Suzuki <utatane.tea@gmail.com>
3 [JSC] Do not check isValid() in op_new_regexp
4 https://bugs.webkit.org/show_bug.cgi?id=180970
6 Reviewed by Saam Barati.
8 * stress/regexp-syntax-error-invalid-flags.js: Added.
11 2017-12-18 Guillaume Emont <guijemont@igalia.com>
13 Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
14 https://bugs.webkit.org/show_bug.cgi?id=180712
16 Reviewed by Michael Catanzaro.
18 stress/call-apply-exponential-bytecode-size.js crashes if the
19 ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
20 MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
21 should skip the test on other platforms.
23 * stress/call-apply-exponential-bytecode-size.js:
25 2017-12-17 Yusuke Suzuki <utatane.tea@gmail.com>
27 [FTL] NewArrayBuffer should be sinked if it is only used for spreading
28 https://bugs.webkit.org/show_bug.cgi?id=179762
30 Reviewed by Saam Barati.
32 * stress/call-varargs-double-new-array-buffer.js: Added.
36 * stress/call-varargs-spread-new-array-buffer.js: Added.
40 * stress/call-varargs-spread-new-array-buffer2.js: Added.
44 * stress/forward-varargs-double-new-array-buffer.js: Added.
50 * stress/new-array-buffer-sinking-osrexit.js: Added.
53 * stress/new-array-with-spread-double-new-array-buffer.js: Added.
56 * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
60 * stress/phantom-new-array-buffer-forward-varargs.js: Added.
73 * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
79 * stress/phantom-new-array-buffer-osr-exit.js: Added.
86 2017-12-14 Saam Barati <sbarati@apple.com>
88 The CleanUp after LICM is erroneously removing a Check
89 https://bugs.webkit.org/show_bug.cgi?id=180852
90 <rdar://problem/36063494>
92 Reviewed by Filip Pizlo.
94 * stress/dont-run-cleanup-after-licm.js: Added.
96 2017-12-14 Michael Saboff <msaboff@apple.com>
98 REGRESSION (r225695): Repro crash on yahoo login page
99 https://bugs.webkit.org/show_bug.cgi?id=180761
101 Reviewed by JF Bastien.
105 * stress/regress-180761.js: Added.
107 2017-12-13 Keith Miller <keith_miller@apple.com>
109 JSObjects should have a mask for loading indexed properties
110 https://bugs.webkit.org/show_bug.cgi?id=180768
112 Reviewed by Mark Lam.
114 * stress/int16-put-by-val-in-and-out-of-bounds.js:
117 2017-12-13 Saam Barati <sbarati@apple.com>
119 Arrow functions need their own structure because they have different properties than sloppy functions
120 https://bugs.webkit.org/show_bug.cgi?id=180779
121 <rdar://problem/35814591>
123 Reviewed by Mark Lam.
125 * stress/arrow-function-needs-its-own-structure.js: Added.
131 2017-12-13 Saam Barati <sbarati@apple.com>
133 Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
134 https://bugs.webkit.org/show_bug.cgi?id=163579
135 <rdar://problem/35455798>
137 Reviewed by Mark Lam.
139 * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
148 2017-12-13 Saam Barati <sbarati@apple.com>
150 TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
151 https://bugs.webkit.org/show_bug.cgi?id=180734
152 <rdar://problem/35640547>
154 Reviewed by Yusuke Suzuki.
156 * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
157 (__isPropertyOfType):
166 2017-12-12 Saam Barati <sbarati@apple.com>
168 We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
169 https://bugs.webkit.org/show_bug.cgi?id=180725
170 <rdar://problem/35970511>
172 Reviewed by Michael Saboff.
174 * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
179 2017-12-12 Yusuke Suzuki <utatane.tea@gmail.com>
181 [JSC] Implement optimized WeakMap and WeakSet
182 https://bugs.webkit.org/show_bug.cgi?id=179929
184 Reviewed by Saam Barati.
186 * microbenchmarks/weak-map-key.js:
187 * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
190 (let.start.Date.now):
191 * stress/basic-weakmap.js: Added.
194 * stress/basic-weakset.js: Added.
197 * stress/weakmap-cse-set-break.js: Added.
200 * stress/weakmap-cse.js: Added.
203 * stress/weakmap-gc.js: Added.
205 * stress/weakset-cse-add-break.js: Added.
208 * stress/weakset-cse.js: Added.
211 * stress/weakset-gc.js: Added.
216 2017-12-12 Saam Barati <sbarati@apple.com>
218 ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
219 https://bugs.webkit.org/show_bug.cgi?id=180723
220 <rdar://problem/35859726>
222 Reviewed by JF Bastien.
224 * stress/get-my-argument-by-val-constant-folding.js: Added.
228 2017-12-12 Caio Lima <ticaiolima@gmail.com>
230 [ESNext][BigInt] Implement BigInt literals and JSBigInt
231 https://bugs.webkit.org/show_bug.cgi?id=179000
233 Reviewed by Darin Adler and Yusuke Suzuki.
235 * bigIntTests.yaml: Added.
236 * stress/big-int-literal-line-terminator.js: Added.
237 * stress/big-int-literals.js: Added.
238 * stress/big-int-operations-error.js: Added.
239 * stress/big-int-type-of.js: Added.
240 * stress/big-int-white-space-trailing-leading.js: Added.
241 * stress/big-int-function-apply.js: Added.
243 2017-12-11 Saam Barati <sbarati@apple.com>
245 We need to disableCaching() in ErrorInstance when we materialize properties
246 https://bugs.webkit.org/show_bug.cgi?id=180343
247 <rdar://problem/35833002>
249 Reviewed by Mark Lam.
251 * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
255 (storeToStackAlreadyMaterialized):
257 2017-12-05 JF Bastien <jfbastien@apple.com>
259 WebAssembly: don't eagerly checksum
260 https://bugs.webkit.org/show_bug.cgi?id=180441
261 <rdar://problem/35156628>
263 Reviewed by Saam Barati.
265 Checksum is now disabled, so tests only have <?> as the module
268 * wasm/function-tests/nameSection.js:
269 * wasm/function-tests/stack-overflow.js:
270 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
271 (assertOverflows.assertThrows):
273 * wasm/function-tests/stack-trace.js:
275 2017-12-04 JF Bastien <jfbastien@apple.com>
277 Proxy all functions, except the $ objects
278 https://bugs.webkit.org/show_bug.cgi?id=180375
280 Reviewed by Saam Barati.
282 It looks like this test may have broken some executions because I
283 call some internal objects. Explicitly ignore objects whose name
284 starts with "$" because it's a bad idea anyways.
286 * stress/proxy-all-the-parameters.js:
290 2017-12-04 Saam Barati <sbarati@apple.com>
292 We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
293 https://bugs.webkit.org/show_bug.cgi?id=180366
294 <rdar://problem/35685877>
296 Reviewed by Michael Saboff.
298 * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
300 (test1.base.getParentStaticValue):
302 (test1.__v_24888.prototype.set prop):
304 (test2.base.getParentStaticValue):
306 (test2.__v_24888.prototype.set prop):
310 2017-12-01 JF Bastien <jfbastien@apple.com>
312 Try proxying all function arguments
313 https://bugs.webkit.org/show_bug.cgi?id=180306
315 Reviewed by Saam Barati.
317 * stress/proxy-all-the-parameters.js: Added.
324 (let.o.of.getObjects.let.f.of.getFunctions.catch):
326 2017-12-01 JF Bastien <jfbastien@apple.com>
328 JavaScriptCore: missing exception checks in Math functions that take more than one argument
329 https://bugs.webkit.org/show_bug.cgi?id=180297
330 <rdar://problem/35745556>
332 Reviewed by Mark Lam.
334 * stress/math-exceptions.js: Added.
338 2017-12-01 JF Bastien <jfbastien@apple.com>
340 JavaScriptCore: add test for weird class static getters
341 https://bugs.webkit.org/show_bug.cgi?id=180281
342 <rdar://problem/35592139>
344 Reviewed by Mark Lam.
346 I fixed a bug for it in r224927 and didn't add a test. Do so.
348 * stress/class-static-get-weird.js: Added.
349 (c.prototype.get name):
351 (c.prototype.get arguments):
352 (c.prototype.get caller):
353 (c.prototype.get length):
355 2017-12-01 Saam Barati <sbarati@apple.com>
357 Having a bad time needs to handle ArrayClass indexing type as well
358 https://bugs.webkit.org/show_bug.cgi?id=180274
359 <rdar://problem/35667869>
361 Reviewed by Keith Miller and Mark Lam.
363 * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
365 * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
368 2017-12-01 JF Bastien <jfbastien@apple.com>
370 WebAssembly: restore cached stack limit after out-call
371 https://bugs.webkit.org/show_bug.cgi?id=179106
372 <rdar://problem/35337525>
374 Reviewed by Saam Barati.
376 * wasm/function-tests/double-instance.js: Added.
378 (const.imp.get callAnother):
380 2017-11-30 JF Bastien <jfbastien@apple.com>
382 WebAssembly: improve stack trace
383 https://bugs.webkit.org/show_bug.cgi?id=179343
385 Reviewed by Saam Barati.
387 Update the tests to follow the new format. Notably, SHA1 module
388 hash is now included in traces, and stubs are properly identified.
390 * wasm/assert.js: Add an assertion which matches regular expressions.
391 * wasm/function-tests/nameSection.js:
392 * wasm/function-tests/stack-overflow.js:
393 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
394 (assertOverflows.assertThrows.wasm.1):
395 (assertOverflows.assertThrows.wasm.0):
396 (assertOverflows.assertThrows):
398 * wasm/function-tests/stack-trace.js:
399 (import.Builder.from.string_appeared_here.assert): Deleted.
400 * wasm/function-tests/trap-after-cross-instance-call.js:
401 (wasmFrameCountFromError):
402 * wasm/function-tests/trap-load-2.js:
403 (wasmFrameCountFromError):
404 * wasm/function-tests/trap-load.js:
405 (wasmFrameCountFromError):
407 2017-11-30 Mark Lam <mark.lam@apple.com>
409 jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
410 https://bugs.webkit.org/show_bug.cgi?id=180219
411 <rdar://problem/35696536>
413 Reviewed by Filip Pizlo.
415 * stress/regress-180219.js: Added.
417 2017-11-30 Yusuke Suzuki <utatane.tea@gmail.com>
419 [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
420 https://bugs.webkit.org/show_bug.cgi?id=180190
422 Reviewed by Mark Lam.
424 * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
427 * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
430 * stress/operation-in-may-have-negative-int32-double-array.js: Added.
433 * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
436 * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
439 * stress/operation-in-may-have-negative-int32.js: Added.
442 * stress/operation-in-negative-int32-cast.js: Added.
446 2017-11-28 JF Bastien <jfbastien@apple.com>
448 Strict and sloppy functions shouldn't share structure
449 https://bugs.webkit.org/show_bug.cgi?id=180103
450 <rdar://problem/35667847>
452 Reviewed by Saam Barati.
454 * stress/get-by-id-strict-arguments.js: Added. Used to not throw
455 because the IC was wrong.
460 * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
461 in this patch, but may as well test odd strict mode corner cases.
465 * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
470 * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
471 next file, but with invalidation of the FunctionExecutable's
472 singletonFunction() to hit SpeculativeJIT::compileNewFunction's
479 * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
480 strict nesting works correctly.
484 * stress/strict-function-structure.js: Added. The test used to
485 assert in objectProtoFuncHasOwnProperty.
489 * stress/strict-nested-function-structure.js: Added. Nesting.
495 2017-11-29 Robin Morisset <rmorisset@apple.com>
497 The recursive tail call optimisation is wrong on closures
498 https://bugs.webkit.org/show_bug.cgi?id=179835
500 Reviewed by Saam Barati.
502 * stress/closure-recursive-tail-call.js: Added.
505 2017-11-27 JF Bastien <jfbastien@apple.com>
507 JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
508 https://bugs.webkit.org/show_bug.cgi?id=180051
509 <rdar://problem/35614371>
511 Reviewed by Saam Barati.
513 * stress/rest-parameter-negative.js: Added.
519 2017-11-27 Saam Barati <sbarati@apple.com>
521 Spread can escape when CreateRest does not
522 https://bugs.webkit.org/show_bug.cgi?id=180057
523 <rdar://problem/35676119>
525 Reviewed by JF Bastien.
527 * stress/spread-escapes-but-create-rest-does-not.js: Added.
533 2017-11-21 Yusuke Suzuki <utatane.tea@gmail.com>
535 [DFG] Add NormalizeMapKey DFG IR
536 https://bugs.webkit.org/show_bug.cgi?id=179912
538 Reviewed by Saam Barati.
540 * stress/map-untyped-normalize-cse.js: Added.
543 * stress/map-untyped-normalize.js: Added.
546 * stress/set-untyped-normalize-cse.js: Added.
548 (set return.set has.set has):
549 * stress/set-untyped-normalize.js: Added.
551 (set return.set has):
553 2017-11-26 Yusuke Suzuki <utatane.tea@gmail.com>
555 [FTL] Support DeleteById and DeleteByVal
556 https://bugs.webkit.org/show_bug.cgi?id=180022
558 Reviewed by Saam Barati.
560 * stress/delete-by-id.js: Added.
564 * stress/delete-by-val-ftl.js: Added.
569 2017-11-26 Yusuke Suzuki <utatane.tea@gmail.com>
571 [DFG] Introduce {Set,Map,WeakMap}Fields
572 https://bugs.webkit.org/show_bug.cgi?id=179925
574 Reviewed by Saam Barati.
576 * stress/map-set-clobber-map-get.js: Added.
579 * stress/map-set-does-not-clobber-set-has.js: Added.
581 * stress/map-set-does-not-clobber-weak-map-get.js: Added.
584 * stress/set-add-clobber-set-has.js: Added.
586 * stress/set-add-does-not-clobber-map-get.js: Added.
589 2017-11-24 Mark Lam <mark.lam@apple.com>
591 Move unsafe jsc shell test functions to the $vm object.
592 https://bugs.webkit.org/show_bug.cgi?id=179980
594 Reviewed by Yusuke Suzuki.
596 * controlFlowProfiler/driver/driver.js:
597 * controlFlowProfiler/execution-count.js:
598 * controlFlowProfiler/if-statement.js:
599 * controlFlowProfiler/loop-statements.js:
600 * controlFlowProfiler/switch-statements.js:
601 * controlFlowProfiler/test-jit.js:
602 * exceptionFuzz/3d-cube.js:
603 * exceptionFuzz/date-format-xparb.js:
604 * exceptionFuzz/earley-boyer.js:
605 * heapProfiler/basic-edges.js:
606 * heapProfiler/property-edge-types.js:
607 * microbenchmarks/try-get-by-id-basic.js:
608 * microbenchmarks/try-get-by-id-polymorphic.js:
609 * modules/namespace-object-try-get.js:
610 * stress/argument-count-bytecode.js:
611 * stress/argument-intrinsic-basic.js:
612 * stress/argument-intrinsic-inlining-use-caller-arg.js:
613 * stress/argument-intrinsic-inlining-with-result-escape.js:
614 * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
615 * stress/argument-intrinsic-inlining-with-vararg.js:
616 * stress/argument-intrinsic-nested-inlining.js:
617 * stress/argument-intrinsic-not-convert-to-get-argument.js:
618 * stress/argument-intrinsic-with-stack-write.js:
619 * stress/arity-mismatch-get-argument.js:
620 * stress/array-message-passing.js:
621 * stress/array-push-with-force-exit.js:
622 * stress/check-dom-with-signature.js:
623 * stress/check-sub-class.js:
624 * stress/compare-eq-incomplete-profile.js:
625 * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
626 * stress/do-eval-virtual-call-correctly.js:
627 * stress/dom-jit-with-poly-proto.js:
628 * stress/domjit-exception-ic.js:
629 * stress/domjit-exception.js:
630 * stress/domjit-getter-complex-with-incorrect-object.js:
631 * stress/domjit-getter-complex.js:
632 * stress/domjit-getter-poly.js:
633 * stress/domjit-getter-proto.js:
634 * stress/domjit-getter-super-poly.js:
635 * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
636 * stress/domjit-getter-type-check.js:
637 * stress/domjit-getter.js:
638 * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
639 * stress/for-in-proxy-target-changed-structure.js:
640 * stress/for-in-proxy.js:
641 * stress/generational-opaque-roots.js:
642 * stress/global-const-redeclaration-setting-2.js:
643 * stress/global-const-redeclaration-setting-3.js:
644 * stress/global-const-redeclaration-setting-4.js:
645 * stress/global-const-redeclaration-setting-5.js:
646 * stress/global-const-redeclaration-setting.js:
647 * stress/import-basic.js:
648 * stress/import-from-eval.js:
649 * stress/import-reject-with-exception.js:
650 * stress/import-syntax.js:
651 * stress/impure-get-own-property-slot-inline-cache.js:
652 * stress/is-constructor.js:
653 * stress/istypedarrayview-intrinsic.js:
654 * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
655 * stress/jsc-test-functions-should-be-more-robust.js:
656 * stress/object-toString-with-proxy.js:
657 * stress/poly-proto-custom-value-and-accessor.js:
658 * stress/proxy-inline-cache.js:
659 * stress/re-execute-error-module.js:
660 * stress/regress-150532.js:
661 * stress/regress-156992.js:
662 * stress/regress-179619.js:
663 * stress/resources/shadow-chicken-support.js:
664 * stress/runtime-array.js:
665 * stress/sampling-profiler-microtasks.js:
666 * stress/shadow-chicken-enabled.js:
667 * stress/spread-correct-global-object-on-exception.js:
668 * stress/super-get-by-id.js:
669 * stress/tailCallForwardArguments.js:
670 * stress/to-object-intrinsic-boolean-edge.js:
671 * stress/to-object-intrinsic-null-or-undefined-edge.js:
672 * stress/to-object-intrinsic-number-edge.js:
673 * stress/to-object-intrinsic-object-edge.js:
674 * stress/to-object-intrinsic-string-edge.js:
675 * stress/to-object-intrinsic-symbol-edge.js:
676 * stress/to-object-intrinsic.js:
677 * stress/try-catch-custom-getter-as-get-by-id.js:
678 * stress/try-get-by-id-poly-proto.js:
679 * stress/try-get-by-id-should-spill-registers-dfg.js:
680 * stress/try-get-by-id.js:
681 * typeProfiler/arrow-functions.js:
682 * typeProfiler/basic.js:
683 * typeProfiler/captured.js:
684 * typeProfiler/classes.js:
685 * typeProfiler/dfg-jit-optimizations.js:
686 * typeProfiler/dictionary-mode.js:
687 * typeProfiler/es6-block-scoping.js:
688 * typeProfiler/es6-classes.js:
689 * typeProfiler/inheritance.js:
690 * typeProfiler/int52-dfg.js:
691 * typeProfiler/loop.js:
692 * typeProfiler/optional-fields.js:
693 * typeProfiler/overflow.js:
694 * typeProfiler/return.js:
695 * typeProfiler/symbol.js:
696 * typeProfiler/weird-prototype-chain.js:
698 2017-11-21 Yusuke Suzuki <utatane.tea@gmail.com>
700 [DFG][FTL] Support MapSet / SetAdd intrinsics
701 https://bugs.webkit.org/show_bug.cgi?id=179858
703 Reviewed by Saam Barati.
705 * microbenchmarks/map-has-and-set.js: Added.
707 * stress/map-set-check-failure.js: Added.
711 * stress/map-set-cse.js: Added.
714 * stress/set-add-check-failure.js: Added.
718 * stress/set-add-cse.js: Added.
721 2017-11-21 Yusuke Suzuki <utatane.tea@gmail.com>
723 [JSC] Allow poly proto for intrinsic getters
724 https://bugs.webkit.org/show_bug.cgi?id=179550
726 Reviewed by Saam Barati.
728 This change is also tested by existing tests.
730 1. stress/intrinsic-getter-with-poly-proto.js
731 2. stress/poly-proto-intrinsic-getter-correctness.js
733 * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
735 (makePolyProtoObject.foo.C):
736 (makePolyProtoObject.foo):
737 (makePolyProtoObject):
739 * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
741 (makePolyProtoObject.foo.C):
742 (makePolyProtoObject.foo):
743 (makePolyProtoObject):
746 2017-11-20 Guillaume Emont <guijemont@igalia.com>
748 Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
749 https://bugs.webkit.org/show_bug.cgi?id=179744
751 Reviewed by Michael Catanzaro.
753 This test uses too much memory for our buildbots on these platforms
756 * stress/unshiftCountSlowCase-correct-postCapacity.js:
757 Skip if $memoryLimited and linux.
759 2017-11-17 JF Bastien <jfbastien@apple.com>
761 WebAssembly JS API: throw when a promise can't be created
762 https://bugs.webkit.org/show_bug.cgi?id=179826
763 <rdar://problem/35455813>
765 Reviewed by Mark Lam.
767 Test WebAssembly.{compile,instantiate} where promise creation
768 fails because of a stack overflow.
770 * wasm/js-api/promise-stack-overflow.js: Added.
771 (const.runNearStackLimit.f.const.t):
773 (async.testInstantiate):
775 2017-11-16 Yusuke Suzuki <utatane.tea@gmail.com>
777 Unreviewed, mark regress-178385.js as memory exhausting
779 * stress/regress-178385.js:
781 2017-11-16 Ryan Haddad <ryanhaddad@apple.com>
783 Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
785 Unreviewed test gardening.
789 2017-11-16 Robin Morisset <rmorisset@apple.com>
791 REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
792 https://bugs.webkit.org/show_bug.cgi?id=179763
793 <rdar://problem/35550513>
795 Reviewed by Keith Miller.
797 Just adding a slightly cleaned-up version of the original fuzzer-found test.
799 * stress/tdz-this-in-try-catch.js: Added.
803 2017-11-14 Yusuke Suzuki <utatane.tea@gmail.com>
805 [DFG][FTL] Support Array::DirectArguments with OutOfBounds
806 https://bugs.webkit.org/show_bug.cgi?id=179594
808 Reviewed by Saam Barati.
810 * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
813 * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
817 2017-11-14 Saam Barati <sbarati@apple.com>
819 We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
820 https://bugs.webkit.org/show_bug.cgi?id=179639
821 <rdar://problem/35513018>
823 Reviewed by JF Bastien.
825 * wasm/function-tests/grow-memory-cause-gc.js: Added.
829 2017-11-13 Mark Lam <mark.lam@apple.com>
831 Add more overflow check book-keeping for MarkedArgumentBuffer.
832 https://bugs.webkit.org/show_bug.cgi?id=179634
833 <rdar://problem/35492517>
835 Reviewed by Saam Barati.
837 * stress/regress-179634.js: Added.
839 2017-11-13 Mark Lam <mark.lam@apple.com>
841 Make the jsc shell loadGetterFromGetterSetter() function more robust.
842 https://bugs.webkit.org/show_bug.cgi?id=179619
843 <rdar://problem/35492518>
845 Reviewed by Saam Barati.
847 * stress/regress-179619.js: Added.
849 2017-11-12 Mark Lam <mark.lam@apple.com>
851 We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
852 https://bugs.webkit.org/show_bug.cgi?id=179562
853 <rdar://problem/35467022>
855 Reviewed by Saam Barati.
857 * regress-179562.js: Added.
859 2017-11-08 Saam Barati <sbarati@apple.com>
861 A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
862 https://bugs.webkit.org/show_bug.cgi?id=177792
864 Reviewed by Yusuke Suzuki.
866 * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
868 (foo.Foo.prototype.ensureX):
873 2017-11-08 Ryan Haddad <ryanhaddad@apple.com>
875 Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
876 https://bugs.webkit.org/show_bug.cgi?id=178592
878 Unreviewed test gardening.
882 2017-11-08 Robin Morisset <rmorisset@apple.com>
884 Turn recursive tail calls into loops
885 https://bugs.webkit.org/show_bug.cgi?id=176601
887 Reviewed by Saam Barati.
889 Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
891 Add some simple test that computes factorial in several ways, and other trivial computations.
892 They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
893 Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
894 I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
895 (which it doesn't if that tail call is transformed into a loop in the unsound cases).
897 * stress/inline-call-to-recursive-tail-call.js: Added.
912 2017-11-07 Mark Lam <mark.lam@apple.com>
914 AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
915 https://bugs.webkit.org/show_bug.cgi?id=179355
916 <rdar://problem/35263053>
918 Reviewed by Saam Barati.
920 * stress/regress-179355.js: Added.
922 2017-11-05 Yusuke Suzuki <utatane.tea@gmail.com>
924 JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
925 https://bugs.webkit.org/show_bug.cgi?id=144458
927 Reviewed by Saam Barati.
929 * microbenchmarks/dfg-internal-function-call.js: Added.
931 * microbenchmarks/dfg-internal-function-construct.js: Added.
933 * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
935 * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
937 * stress/dfg-internal-function-call.js: Added.
940 * stress/dfg-internal-function-construct.js: Added.
943 * stress/internal-function-call.js: Added.
945 * stress/internal-function-construct.js: Added.
948 2017-11-05 Per Arne Vollan <pvollan@apple.com>
950 [Win] Skip stress/regress-178385.js.
951 https://bugs.webkit.org/show_bug.cgi?id=179298
953 Unreviewed test gardening.
955 * stress/regress-178385.js:
957 2017-11-03 Keith Miller <keith_miller@apple.com>
959 Add test for ic with side effects
960 https://bugs.webkit.org/show_bug.cgi?id=179268
962 Reviewed by Saam Barati.
964 * stress/put-inline-cache-side-effects.js: Added.
965 (let.i.of.objs.keys):
968 2017-11-03 Mark Lam <mark.lam@apple.com>
970 CachedCall (and its clients) needs overflow checks.
971 https://bugs.webkit.org/show_bug.cgi?id=179185
973 Reviewed by JF Bastien.
975 * stress/regress-179185.js: Added.
977 2017-11-02 Michael Saboff <msaboff@apple.com>
979 DFG needs to handle code motion of code in for..in loop bodies
980 https://bugs.webkit.org/show_bug.cgi?id=179212
982 Reviewed by Keith Miller.
986 * stress/for-in-side-effects.js: Added.
994 2017-11-02 Filip Pizlo <fpizlo@apple.com>
996 AI does not correctly model the clobber case of ArithClz32
997 https://bugs.webkit.org/show_bug.cgi?id=179188
999 Reviewed by Michael Saboff.
1001 * stress/arith-clz32-effects.js: Added.
1005 2017-11-01 Michael Saboff <msaboff@apple.com>
1007 Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1008 https://bugs.webkit.org/show_bug.cgi?id=179140
1010 Reviewed by Saam Barati.
1012 New regression test.
1014 * stress/regress-179140.js: Added.
1018 2017-11-01 Yusuke Suzuki <utatane.tea@gmail.com>
1020 [JSC] Introduce @toObject
1021 https://bugs.webkit.org/show_bug.cgi?id=178726
1023 Reviewed by Saam Barati.
1025 * stress/array-copywithin.js:
1027 * stress/object-constructor-boolean-edge.js: Added.
1030 * stress/object-constructor-global.js: Added.
1032 * stress/object-constructor-null-edge.js: Added.
1035 * stress/object-constructor-number-edge.js: Added.
1038 * stress/object-constructor-object-edge.js: Added.
1042 * stress/object-constructor-string-edge.js: Added.
1045 * stress/object-constructor-symbol-edge.js: Added.
1048 * stress/object-constructor-undefined-edge.js: Added.
1051 * stress/symbol-array-from.js: Added.
1053 * stress/to-object-intrinsic-boolean-edge.js: Added.
1055 (builtin.createBuiltin):
1056 * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1058 * stress/to-object-intrinsic-number-edge.js: Added.
1060 (builtin.createBuiltin):
1061 * stress/to-object-intrinsic-object-edge.js: Added.
1063 (builtin.createBuiltin):
1065 * stress/to-object-intrinsic-string-edge.js: Added.
1067 (builtin.createBuiltin):
1068 * stress/to-object-intrinsic-symbol-edge.js: Added.
1070 (builtin.createBuiltin):
1071 * stress/to-object-intrinsic.js: Added.
1074 (builtin.createBuiltin):
1076 2017-10-27 Yusuke Suzuki <utatane.tea@gmail.com>
1078 [DFG][FTL] Introduce StringSlice
1079 https://bugs.webkit.org/show_bug.cgi?id=178934
1081 Reviewed by Saam Barati.
1083 * microbenchmarks/string-slice-empty.js: Added.
1085 * microbenchmarks/string-slice-one-char.js: Added.
1087 * microbenchmarks/string-slice.js: Added.
1090 2017-10-26 Michael Saboff <msaboff@apple.com>
1092 REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1093 https://bugs.webkit.org/show_bug.cgi?id=178890
1095 Reviewed by Keith Miller.
1097 New regression test.
1099 * stress/regress-178890.js: Added.
1101 2017-10-26 Mark Lam <mark.lam@apple.com>
1103 JSRopeString::RopeBuilder::append() should check for overflows.
1104 https://bugs.webkit.org/show_bug.cgi?id=178385
1105 <rdar://problem/35027468>
1107 Reviewed by Saam Barati.
1109 * stress/regress-178385.js: Added.
1111 2017-10-26 Ryan Haddad <ryanhaddad@apple.com>
1113 Unreviewed, rolling out r223961.
1115 The change that required this has been rolled out.
1119 "Mark test262.yaml/test262/test/language/statements/try/tco-
1120 catch.js as passing."
1121 https://bugs.webkit.org/show_bug.cgi?id=178592
1122 https://trac.webkit.org/changeset/223961
1124 2017-10-25 Commit Queue <commit-queue@webkit.org>
1126 Unreviewed, rolling out r223691 and r223729.
1127 https://bugs.webkit.org/show_bug.cgi?id=178834
1129 Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1130 by rniwa on #webkit).
1132 Reverted changesets:
1134 "Turn recursive tail calls into loops"
1135 https://bugs.webkit.org/show_bug.cgi?id=176601
1136 https://trac.webkit.org/changeset/223691
1138 "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1139 comparison is always false due to limited range of data type
1141 https://bugs.webkit.org/show_bug.cgi?id=178543
1142 https://trac.webkit.org/changeset/223729
1144 2017-10-25 Ryan Haddad <ryanhaddad@apple.com>
1146 Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1147 https://bugs.webkit.org/show_bug.cgi?id=178592
1149 Unreviewed test gardening.
1153 2017-10-24 Yusuke Suzuki <utatane.tea@gmail.com>
1155 [FTL] Support NewStringObject
1156 https://bugs.webkit.org/show_bug.cgi?id=178737
1158 Reviewed by Saam Barati.
1160 * stress/new-string-object.js: Added.
1164 2017-10-15 Yusuke Suzuki <utatane.tea@gmail.com>
1166 [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1167 https://bugs.webkit.org/show_bug.cgi?id=178308
1169 Reviewed by Mark Lam.
1173 2017-10-23 Yusuke Suzuki <utatane.tea@gmail.com>
1175 [JSC] Use fastJoin in Array#toString
1176 https://bugs.webkit.org/show_bug.cgi?id=178062
1178 Reviewed by Darin Adler.
1180 * microbenchmarks/contiguous-array-to-string.js: Added.
1182 * microbenchmarks/double-array-to-string.js: Added.
1184 * microbenchmarks/int32-array-to-string.js: Added.
1187 2017-10-22 Zan Dobersek <zdobersek@igalia.com>
1189 stress/check-string-ident.js is improperly skipped
1190 https://bugs.webkit.org/show_bug.cgi?id=178642
1192 Reviewed by Saam Barati.
1194 * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1195 since it enforces the run-jsc-stress-tests script to still set up the
1196 test to run, despite the skip directive that's used before.
1198 2017-10-20 Mark Lam <mark.lam@apple.com>
1200 Add a test case for r214334.
1201 https://bugs.webkit.org/show_bug.cgi?id=169941
1202 <rdar://problem/31221258>
1204 Reviewed by JF Bastien.
1206 * stress/regress-169941.js: Added.
1208 2017-10-19 JF Bastien <jfbastien@apple.com>
1210 WebAssembly: no VM / JS version of everything but Instance
1211 https://bugs.webkit.org/show_bug.cgi?id=177473
1213 Reviewed by Filip Pizlo, Saam Barati.
1215 - Exceeding max on memory growth now returns a range error as per
1216 spec. This is a (very minor) breaking change: it used to throw OOM
1217 error. Update the corresponding test.
1219 * wasm/js-api/memory-grow.js:
1221 * wasm/js-api/table.js:
1224 2017-10-19 Mark Lam <mark.lam@apple.com>
1226 Stringifier::appendStringifiedValue() is missing an exception check.
1227 https://bugs.webkit.org/show_bug.cgi?id=178386
1228 <rdar://problem/35027610>
1230 Reviewed by Saam Barati.
1232 * stress/regress-178386.js: Added.
1234 2017-10-19 Michael Saboff <msaboff@apple.com>
1236 Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1237 https://bugs.webkit.org/show_bug.cgi?id=178521
1239 Reviewed by JF Bastien.
1241 * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1242 now passes with the current version (5.0) of the Emoji spec.
1244 2017-10-19 Robin Morisset <rmorisset@apple.com>
1246 Turn recursive tail calls into loops
1247 https://bugs.webkit.org/show_bug.cgi?id=176601
1249 Reviewed by Saam Barati.
1251 Add some simple test that computes factorial in several ways, and other trivial computations.
1252 They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1253 Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1254 I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1255 (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1257 * stress/inline-call-to-recursive-tail-call.js: Added.
1269 2017-10-18 Mark Lam <mark.lam@apple.com>
1271 RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1272 https://bugs.webkit.org/show_bug.cgi?id=177600
1273 <rdar://problem/34710985>
1275 Reviewed by Saam Barati.
1277 * stress/regress-177600.js: Added.
1279 2017-10-18 Mark Lam <mark.lam@apple.com>
1281 The compiler should always register a structure when it adds its transitionWatchPointSet.
1282 https://bugs.webkit.org/show_bug.cgi?id=178420
1283 <rdar://problem/34814024>
1285 Reviewed by Saam Barati and Filip Pizlo.
1287 * stress/regress-178420.js: Added.
1288 (new.Array.10000.map):
1290 2017-10-18 Yusuke Suzuki <utatane.tea@gmail.com>
1292 [JSC] __proto__ getter should be fast
1293 https://bugs.webkit.org/show_bug.cgi?id=178067
1295 Reviewed by Saam Barati.
1297 * stress/dfg-object-proto-accessor.js: Added.
1301 * stress/dfg-object-proto-getter.js: Added.
1305 * stress/dfg-object-prototype-of.js: Added.
1309 * stress/dfg-reflect-get-prototype-of.js: Added.
1313 * stress/intrinsic-getter-with-poly-proto.js: Added.
1315 (makePolyProtoObject.foo.C):
1316 (makePolyProtoObject.foo):
1317 (makePolyProtoObject):
1319 * stress/object-get-prototype-of-filtered.js: Added.
1324 * stress/object-get-prototype-of-mono-proto.js: Added.
1326 (makePolyProtoObject.foo.C):
1327 (makePolyProtoObject.foo):
1328 (makePolyProtoObject):
1330 * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1332 (makePolyProtoObject.foo.C):
1333 (makePolyProtoObject.foo):
1334 (makePolyProtoObject):
1336 * stress/object-get-prototype-of-poly-proto.js: Added.
1338 (makePolyProtoObject.foo.C):
1339 (makePolyProtoObject.foo):
1340 (makePolyProtoObject):
1342 * stress/object-proto-getter-filtered.js: Added.
1347 * stress/object-proto-getter-poly-mono-proto.js: Added.
1349 (makePolyProtoObject.foo.C):
1350 (makePolyProtoObject.foo):
1351 (makePolyProtoObject):
1353 * stress/object-proto-getter-poly-proto.js: Added.
1355 (makePolyProtoObject.foo.C):
1356 (makePolyProtoObject.foo):
1357 (makePolyProtoObject):
1359 * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1360 * stress/string-proto.js: Added.
1364 2017-10-17 Ryan Haddad <ryanhaddad@apple.com>
1366 Unreviewed, rolling out r223523.
1368 A test for this change is failing on debug JSC bots.
1372 "[JSC] __proto__ getter should be fast"
1373 https://bugs.webkit.org/show_bug.cgi?id=178067
1374 https://trac.webkit.org/changeset/223523
1376 2017-10-10 Yusuke Suzuki <utatane.tea@gmail.com>
1378 [JSC] __proto__ getter should be fast
1379 https://bugs.webkit.org/show_bug.cgi?id=178067
1381 Reviewed by Saam Barati.
1383 * stress/dfg-object-proto-accessor.js: Added.
1387 * stress/dfg-object-proto-getter.js: Added.
1391 * stress/dfg-object-prototype-of.js: Added.
1395 * stress/dfg-reflect-get-prototype-of.js: Added.
1399 * stress/object-get-prototype-of-filtered.js: Added.
1404 * stress/object-get-prototype-of-mono-proto.js: Added.
1406 (makePolyProtoObject.foo.C):
1407 (makePolyProtoObject.foo):
1408 (makePolyProtoObject):
1410 * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1412 (makePolyProtoObject.foo.C):
1413 (makePolyProtoObject.foo):
1414 (makePolyProtoObject):
1416 * stress/object-get-prototype-of-poly-proto.js: Added.
1418 (makePolyProtoObject.foo.C):
1419 (makePolyProtoObject.foo):
1420 (makePolyProtoObject):
1422 * stress/object-proto-getter-filtered.js: Added.
1427 * stress/object-proto-getter-poly-mono-proto.js: Added.
1429 (makePolyProtoObject.foo.C):
1430 (makePolyProtoObject.foo):
1431 (makePolyProtoObject):
1433 * stress/object-proto-getter-poly-proto.js: Added.
1435 (makePolyProtoObject.foo.C):
1436 (makePolyProtoObject.foo):
1437 (makePolyProtoObject):
1439 * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1440 * stress/string-proto.js: Added.
1444 2017-10-14 Yusuke Suzuki <utatane.tea@gmail.com>
1446 Reland "Add Above/Below comparisons for UInt32 patterns"
1447 https://bugs.webkit.org/show_bug.cgi?id=177281
1449 Reviewed by Saam Barati.
1451 * stress/uint32-comparison-jump.js: Added.
1461 * stress/uint32-comparison.js: Added.
1472 2017-10-12 Yusuke Suzuki <utatane.tea@gmail.com>
1474 WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1475 https://bugs.webkit.org/show_bug.cgi?id=178210
1477 Reviewed by Saam Barati.
1479 * wasm/function-tests/trap-from-start-async.js:
1480 (async.StartTrapsAsync):
1481 * wasm/function-tests/trap-from-start.js:
1483 * wasm/js-api/web-assembly-function.js:
1484 (assert.eq.Object.getPrototypeOf):
1485 * wasm/js-api/wrapper-function.js:
1486 (return.new.WebAssembly.Module):
1487 (assert.throws.makeInstance): Deleted.
1488 (assert.throws.Bar): Deleted.
1489 (assert.throws): Deleted.
1491 2017-09-29 Filip Pizlo <fpizlo@apple.com>
1493 Enable gigacage on iOS
1494 https://bugs.webkit.org/show_bug.cgi?id=177586
1496 Reviewed by JF Bastien.
1498 Add tests for when Gigacage gets runtime disabled.
1500 * stress/disable-gigacage-arrays.js: Added.
1502 * stress/disable-gigacage-strings.js: Added.
1504 * stress/disable-gigacage-typed-arrays.js: Added.
1507 2017-10-11 Yusuke Suzuki <utatane.tea@gmail.com>
1509 import.meta should not be assignable
1510 https://bugs.webkit.org/show_bug.cgi?id=178202
1512 Reviewed by Saam Barati.
1514 * modules/import-meta-assignment.js: Added.
1516 (SyntaxError.import.meta.can.shouldThrow):
1518 2017-10-11 Saam Barati <sbarati@apple.com>
1520 Unreviewed. Actually skip certain type profiler tests in debug.
1522 * typeProfiler.yaml:
1523 * typeProfiler/deltablue-for-of.js:
1524 * typeProfiler/getter-richards.js:
1526 2017-10-11 Commit Queue <commit-queue@webkit.org>
1528 Unreviewed, rolling out r223113 and r223121.
1529 https://bugs.webkit.org/show_bug.cgi?id=178182
1531 Reintroduced 20% regression on Kraken (Requested by rniwa on
1534 Reverted changesets:
1536 "Enable gigacage on iOS"
1537 https://bugs.webkit.org/show_bug.cgi?id=177586
1538 https://trac.webkit.org/changeset/223113
1540 "Use one virtual allocation for all gigacages and their
1542 https://bugs.webkit.org/show_bug.cgi?id=178050
1543 https://trac.webkit.org/changeset/223121
1545 2017-10-11 Michael Saboff <msaboff@apple.com>
1547 Disable test262 named capture group tests with direct unicode names and with references before definitions
1548 https://bugs.webkit.org/show_bug.cgi?id=178177
1550 Reviewed by Keith Miller.
1552 Bugs to track fixing these test are:
1553 https://bugs.webkit.org/show_bug.cgi?id=178174 -
1554 "Add support in named capture group identifiers for direct surrogate pairs"
1555 https://bugs.webkit.org/show_bug.cgi?id=178175 -
1556 "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1560 2017-10-11 Caio Lima <ticaiolima@gmail.com>
1562 Object properties are undefined in super.call() but not in this.call()
1563 https://bugs.webkit.org/show_bug.cgi?id=177230
1565 Reviewed by Saam Barati.
1567 * stress/super-call-function-subclass.js: Added.
1571 * stress/super-dot-call-and-apply.js: Added.
1575 (A.prototype.apply):
1576 (B.prototype.testSuper):
1578 (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1579 (D.prototype.testSuper):
1582 2017-10-10 Saam Barati <sbarati@apple.com>
1584 The prototype cache should be aware of the Executable it generates a Structure for
1585 https://bugs.webkit.org/show_bug.cgi?id=177907
1587 Reviewed by Filip Pizlo.
1589 * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1599 2017-10-09 Yusuke Suzuki <utatane.tea@gmail.com>
1601 `async` should be able to be used as an imported binding name
1602 https://bugs.webkit.org/show_bug.cgi?id=176573
1604 Reviewed by Saam Barati.
1606 * modules/import-default-async.js: Added.
1607 * modules/import-named-async-as.js: Added.
1608 * modules/import-named-async.js: Added.
1609 * modules/import-named-async/target.js: Added.
1610 * modules/import-namespace-async.js: Added.
1613 2017-09-29 Filip Pizlo <fpizlo@apple.com>
1615 Enable gigacage on iOS
1616 https://bugs.webkit.org/show_bug.cgi?id=177586
1618 Reviewed by JF Bastien.
1620 Add tests for when Gigacage gets runtime disabled.
1622 * stress/disable-gigacage-arrays.js: Added.
1624 * stress/disable-gigacage-strings.js: Added.
1626 * stress/disable-gigacage-typed-arrays.js: Added.
1629 2017-10-09 Michael Saboff <msaboff@apple.com>
1631 Implement RegExp Unicode property escapes
1632 https://bugs.webkit.org/show_bug.cgi?id=172069
1634 Reviewed by JF Bastien.
1636 Enabled Unicode Property tests.
1640 2017-10-09 Commit Queue <commit-queue@webkit.org>
1642 Unreviewed, rolling out r223015 and r223025.
1643 https://bugs.webkit.org/show_bug.cgi?id=178093
1645 Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1648 Reverted changesets:
1650 "Enable gigacage on iOS"
1651 https://bugs.webkit.org/show_bug.cgi?id=177586
1652 http://trac.webkit.org/changeset/223015
1654 "Unreviewed, disable Gigacage on ARM64 Linux"
1655 https://bugs.webkit.org/show_bug.cgi?id=177586
1656 http://trac.webkit.org/changeset/223025
1658 2017-10-09 Ryan Haddad <ryanhaddad@apple.com>
1660 Update expectations for test262 tests that pass after r223043.
1661 https://bugs.webkit.org/show_bug.cgi?id=176685
1663 Unreviewed test gardening.
1667 2017-10-09 Ryan Haddad <ryanhaddad@apple.com>
1669 Unreviewed, rolling out r223022.
1671 This change introduced 18 test262 failures.
1675 "`async` should be able to be used as an imported binding
1677 https://bugs.webkit.org/show_bug.cgi?id=176573
1678 http://trac.webkit.org/changeset/223022
1680 2017-10-09 Saam Barati <sbarati@apple.com>
1682 3 poly-proto JSC tests timing out on debug after r222827
1683 https://bugs.webkit.org/show_bug.cgi?id=177880
1684 <rdar://problem/34817122>
1688 I'm skipping these type profiler tests on debug since they are long running.
1690 * typeProfiler/deltablue-for-of.js:
1691 * typeProfiler/getter-richards.js:
1693 2017-10-09 Oleksandr Skachkov <gskachkov@gmail.com>
1695 Safari 10 /11 problem with if (!await get(something)).
1696 https://bugs.webkit.org/show_bug.cgi?id=176685
1698 Reviewed by Saam Barati.
1700 * stress/async-await-basic.js:
1701 (awaitEpression.async):
1702 * stress/async-await-syntax.js:
1703 (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1704 (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1706 2017-10-08 Saam Barati <sbarati@apple.com>
1708 Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1710 * typeProfiler/deltablue-for-of.js:
1711 * typeProfiler/getter-richards.js:
1713 2017-10-07 Yusuke Suzuki <utatane.tea@gmail.com>
1715 `async` should be able to be used as an imported binding name
1716 https://bugs.webkit.org/show_bug.cgi?id=176573
1718 Reviewed by Darin Adler.
1720 * modules/import-default-async.js: Added.
1721 * modules/import-named-async-as.js: Added.
1722 * modules/import-named-async.js: Added.
1723 * modules/import-named-async/target.js: Added.
1724 * modules/import-namespace-async.js: Added.
1726 2017-09-29 Filip Pizlo <fpizlo@apple.com>
1728 Enable gigacage on iOS
1729 https://bugs.webkit.org/show_bug.cgi?id=177586
1731 Reviewed by JF Bastien.
1733 Add tests for when Gigacage gets runtime disabled.
1735 * stress/disable-gigacage-arrays.js: Added.
1737 * stress/disable-gigacage-strings.js: Added.
1739 * stress/disable-gigacage-typed-arrays.js: Added.
1742 2017-10-06 Commit Queue <commit-queue@webkit.org>
1744 Unreviewed, rolling out r222791 and r222873.
1745 https://bugs.webkit.org/show_bug.cgi?id=178031
1747 Caused crashes with workers/wasm LayoutTests (Requested by
1748 ryanhaddad on #webkit).
1750 Reverted changesets:
1752 "WebAssembly: no VM / JS version of everything but Instance"
1753 https://bugs.webkit.org/show_bug.cgi?id=177473
1754 http://trac.webkit.org/changeset/222791
1756 "WebAssembly: address no VM / JS follow-ups"
1757 https://bugs.webkit.org/show_bug.cgi?id=177887
1758 http://trac.webkit.org/changeset/222873
1760 2017-10-05 Saam Barati <sbarati@apple.com>
1762 Make sure all prototypes under poly proto get added into the VM's prototype map
1763 https://bugs.webkit.org/show_bug.cgi?id=177909
1765 Reviewed by Keith Miller.
1767 * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1773 2017-09-30 Yusuke Suzuki <utatane.tea@gmail.com>
1775 [JSC] Introduce import.meta
1776 https://bugs.webkit.org/show_bug.cgi?id=177703
1778 Reviewed by Filip Pizlo.
1780 * modules/import-meta-syntax.js: Added.
1783 * modules/import-meta.js: Added.
1784 * modules/import-meta/cocoa.js: Added.
1785 * modules/resources/assert.js:
1786 (export.shouldNotThrow):
1787 * stress/import-syntax.js:
1789 2017-10-04 Saam Barati <sbarati@apple.com>
1791 Make pertinent AccessCases watch the poly proto watchpoint
1792 https://bugs.webkit.org/show_bug.cgi?id=177765
1794 Reviewed by Keith Miller.
1796 * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1801 * stress/poly-proto-clear-stub.js: Added.
1806 2017-10-04 Ryan Haddad <ryanhaddad@apple.com>
1808 Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1810 Unreviewed test gardening.
1814 2017-10-04 Saam Barati <sbarati@apple.com>
1816 3 poly-proto JSC tests timing out on debug after r222827
1817 https://bugs.webkit.org/show_bug.cgi?id=177880
1819 Rubber stamped by Mark Lam.
1821 * microbenchmarks/poly-proto-access.js:
1822 * typeProfiler/deltablue-for-of.js:
1823 * typeProfiler/getter-richards.js:
1825 2017-10-04 Joseph Pecoraro <pecoraro@apple.com>
1827 Unreviewed, marking tco-catch.js as a failure after test262 update
1828 https://bugs.webkit.org/show_bug.cgi?id=177859
1832 2017-10-04 Yusuke Suzuki <utatane.tea@gmail.com>
1834 Unreviewed, marking one async iterator test262 test failed
1835 https://bugs.webkit.org/show_bug.cgi?id=177859
1839 2017-10-04 Yusuke Suzuki <utatane.tea@gmail.com>
1841 [Test262] Update Test262 to Oct 4 version
1842 https://bugs.webkit.org/show_bug.cgi?id=177859
1844 Reviewed by Sam Weinig.
1846 Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1847 we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1850 * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1852 * test262/harness/typeCoercion.js:
1853 (testCoercibleToIndexZero):
1854 (testCoercibleToIndexOne):
1855 (testCoercibleToIndexFromIndex):
1856 (testNotCoercibleToIndex.testPrimitiveValue):
1857 (testNotCoercibleToInteger):
1858 (testCoercibleToBigIntZero.testPrimitiveValue):
1859 (testCoercibleToBigIntZero):
1860 (testCoercibleToBigIntOne.testPrimitiveValue):
1861 (testCoercibleToBigIntOne):
1862 (testPrimitiveValue):
1863 (testCoercibleToBigIntFromBigInt):
1864 (testNotCoercibleToBigInt.testPrimitiveValue):
1865 (testNotCoercibleToBigInt.testStringValue):
1866 (testNotCoercibleToBigInt):
1867 * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1868 * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1869 * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1870 * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1871 * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1872 * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1873 * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1874 * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1875 * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1876 * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1877 * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1878 * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1879 * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1880 * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1881 * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1882 * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1883 (testCoercibleToBigIntZero):
1884 (testCoercibleToBigIntOne):
1885 (testNotCoercibleToBigInt):
1888 (toString): Deleted.
1889 (Symbol.toPrimitive): Deleted.
1890 * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1891 (testCoercibleToIndexZero):
1892 (testCoercibleToIndexOne):
1893 (testNotCoercibleToIndex):
1895 (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1896 (assert.sameValue.BigInt.asIntN.toString): Deleted.
1897 (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1898 (BigInt.asIntN.valueOf): Deleted.
1899 (BigInt.asIntN.toString): Deleted.
1900 * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1901 * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1902 * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1903 (testCoercibleToBigIntZero):
1904 (testCoercibleToBigIntOne):
1905 (testNotCoercibleToBigInt):
1906 * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1907 (testCoercibleToIndexZero):
1908 (testCoercibleToIndexOne):
1909 (testNotCoercibleToIndex):
1910 * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1911 * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1912 * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1915 * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1916 * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1917 * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1918 * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1919 * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1920 * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1921 * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1922 * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1923 * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1924 * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1925 * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1926 * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1927 * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1928 * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1929 * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1930 * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1931 * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1932 * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1933 * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1934 * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1935 * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1936 * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1937 * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1938 * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1940 (BigInt.prototype.toJSON):
1941 * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1943 * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1944 (BigInt.prototype.toJSON):
1945 * test262/test/built-ins/JSON/stringify/bigint.js:
1946 * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1947 * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1948 * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1949 * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1950 * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1951 * test262/test/built-ins/Object/proto-from-ctor.js:
1952 * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1953 * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1954 * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1955 * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1956 * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1957 * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1958 * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1959 * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1960 * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1961 * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1962 * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1963 * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1964 * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1965 * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1966 * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1967 * test262/test/built-ins/Proxy/get-fn-realm.js:
1968 * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1969 * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1970 * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1971 * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1972 * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1973 * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1974 * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1975 * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1976 * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1977 * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1978 * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1979 * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1982 * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1983 * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1984 * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1985 * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1986 * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1987 * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1988 * test262/test/built-ins/RegExp/u180e.js: Added.
1989 * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1990 * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1991 * test262/test/built-ins/String/proto-from-ctor-realm.js:
1992 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1993 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1994 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1995 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1996 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1997 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1998 * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1999 * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2000 * test262/test/built-ins/String/prototype/endsWith/length.js:
2001 * test262/test/built-ins/String/prototype/endsWith/name.js:
2002 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2003 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2004 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2005 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2006 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2007 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2008 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2009 * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2010 * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2011 * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2012 * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2013 * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2014 * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2015 * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2016 * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2017 * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2018 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2019 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2020 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2021 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2022 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2023 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2024 * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2025 * test262/test/built-ins/String/prototype/includes/includes.js:
2026 * test262/test/built-ins/String/prototype/includes/length.js:
2027 * test262/test/built-ins/String/prototype/includes/name.js:
2028 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2029 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2030 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2031 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2032 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2033 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2034 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2035 * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2036 * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2037 * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2038 * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2039 * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2040 * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2041 * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2042 * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2043 * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2044 * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2045 * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2046 * test262/test/built-ins/String/prototype/trim/u180e.js:
2047 * test262/test/built-ins/Symbol/for/cross-realm.js:
2048 * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2049 * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2050 * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2051 * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2052 * test262/test/built-ins/Symbol/match/cross-realm.js:
2053 * test262/test/built-ins/Symbol/replace/cross-realm.js:
2054 * test262/test/built-ins/Symbol/search/cross-realm.js:
2055 * test262/test/built-ins/Symbol/species/cross-realm.js:
2056 * test262/test/built-ins/Symbol/split/cross-realm.js:
2057 * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2058 * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2059 * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2060 * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2061 * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2062 * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2063 * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2064 * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2065 * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2066 * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2067 * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2068 * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2069 * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2070 * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2071 * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2072 * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2073 * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2074 * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2075 * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2076 * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2077 * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2078 * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2079 * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2080 * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2081 * test262/test/language/comments/mongolian-vowel-separator-single.js:
2082 * test262/test/language/eval-code/indirect/realm.js:
2083 * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2086 * test262/test/language/expressions/call/eval-realm-indirect.js:
2087 * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2088 * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2089 * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2090 * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2091 * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2092 * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2093 * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2094 * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2095 * test262/test/language/expressions/greater-than/bigint-and-number.js:
2096 * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2097 * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2098 * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2099 * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2100 * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2101 * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2102 * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2103 * test262/test/language/expressions/less-than/bigint-and-number.js:
2104 * test262/test/language/expressions/new/non-ctor-err-realm.js:
2105 * test262/test/language/expressions/super/realm.js:
2106 * test262/test/language/expressions/tagged-template/cache-realm.js:
2107 * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2108 * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2109 * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2110 * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2111 * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2112 * test262/test/language/literals/string/mongolian-vowel-separator.js:
2113 * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2116 * test262/test/language/statements/for-of/iterator-next-reference.js:
2118 (iterator.next): Deleted.
2119 (x.of.iterable.): Deleted.
2120 (x.of.iterable.get return): Deleted.
2121 (x.of.iterable.iterator.next): Deleted.
2122 * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2123 * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2124 * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2125 * test262/test/language/white-space/mongolian-vowel-separator.js:
2126 * test262/test262-Revision.txt:
2128 2017-10-03 Saam Barati <sbarati@apple.com>
2130 Implement polymorphic prototypes
2131 https://bugs.webkit.org/show_bug.cgi?id=176391
2133 Reviewed by Filip Pizlo.
2135 * microbenchmarks/poly-proto-access.js: Added.
2138 (foo.C.prototype.get bar):
2141 * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2143 (makePolyProtoObject.foo.C):
2144 (makePolyProtoObject.foo):
2145 (makePolyProtoObject):
2147 * microbenchmarks/poly-proto-setter-speed.js: Added.
2149 (makePolyProtoObject.foo.C):
2150 (makePolyProtoObject.foo.C.prototype.set p):
2151 (makePolyProtoObject.foo):
2152 (makePolyProtoObject):
2154 * stress/constructor-with-return.js:
2155 (i.tests.forEach.Constructor):
2157 (tests.forEach.Constructor): Deleted.
2158 (tests.forEach): Deleted.
2159 * stress/dom-jit-with-poly-proto.js: Added.
2161 (makePolyProtoObject.foo.C):
2162 (makePolyProtoObject.foo):
2163 (makePolyProtoObject):
2165 * stress/poly-proto-custom-value-and-accessor.js: Added.
2167 (makePolyProtoObject.foo.C):
2168 (makePolyProtoObject.foo):
2169 (makePolyProtoObject):
2172 * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2174 (makePolyProtoObject.foo.C):
2175 (makePolyProtoObject.foo):
2176 (makePolyProtoObject):
2178 * stress/poly-proto-miss.js: Added.
2179 (makePolyProtoInstanceWithNullPrototype.foo.C):
2180 (makePolyProtoInstanceWithNullPrototype.foo):
2181 (makePolyProtoInstanceWithNullPrototype):
2184 * stress/poly-proto-op-in-caching.js: Added.
2186 (makePolyProtoObject.foo.C):
2187 (makePolyProtoObject.foo):
2188 (makePolyProtoObject):
2191 * stress/poly-proto-put-transition.js: Added.
2193 (makePolyProtoObject.foo.C):
2194 (makePolyProtoObject.foo):
2195 (makePolyProtoObject):
2197 (i.obj.__proto__.set p):
2198 * stress/poly-proto-set-prototype.js: Added.
2200 (let.alternateProto.get x):
2201 (let.alternateProto2.get y):
2202 (let.alternateProto2.get x):
2206 * stress/poly-proto-setter.js: Added.
2208 (makePolyProtoObject.foo.C):
2209 (makePolyProtoObject.foo.C.prototype.set p):
2210 (makePolyProtoObject.foo.C.prototype.get p):
2211 (makePolyProtoObject.foo):
2212 (makePolyProtoObject):
2214 * stress/poly-proto-using-inheritance.js: Added.
2217 (foo.C.prototype.get baz):
2222 * stress/primitive-poly-proto.js: Added.
2223 (makePolyProtoInstance.foo.C):
2224 (makePolyProtoInstance.foo):
2225 (makePolyProtoInstance):
2228 * stress/prototype-is-not-js-object.js: Added.
2233 * stress/try-get-by-id-poly-proto.js: Added.
2235 (makePolyProtoObject.foo.C):
2236 (makePolyProtoObject.foo):
2237 (makePolyProtoObject):
2239 (x.__proto__.get bar):
2241 * typeProfiler/overflow.js:
2243 2017-10-03 JF Bastien <jfbastien@apple.com>
2245 WebAssembly: no VM / JS version of everything but Instance
2246 https://bugs.webkit.org/show_bug.cgi?id=177473
2248 Reviewed by Filip Pizlo.
2250 - Exceeding max on memory growth now returns a range error as per
2251 spec. This is a (very minor) breaking change: it used to throw OOM
2252 error. Update the corresponding test.
2254 * wasm/js-api/memory-grow.js:
2256 * wasm/js-api/table.js:
2259 2017-10-03 Ryan Haddad <ryanhaddad@apple.com>
2261 Skip JSC test stress/regress-159779-2.js on debug.
2262 https://bugs.webkit.org/show_bug.cgi?id=177204
2264 Unreviewed test gardening.
2266 * stress/regress-159779-2.js:
2268 2017-10-02 Caio Lima <ticaiolima@gmail.com>
2270 ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2271 https://bugs.webkit.org/show_bug.cgi?id=175642
2273 Reviewed by Darin Adler.
2275 * ChakraCore/test/Function/apply3.baseline-jsc:
2277 2017-10-01 Commit Queue <commit-queue@webkit.org>
2279 Unreviewed, rolling out r222564.
2280 https://bugs.webkit.org/show_bug.cgi?id=177720
2282 "It regressed JetStream by 2% on iOS caused by a 50%
2283 regression on the bigfib subtest" (Requested by saamyjoon on
2288 "Add Above/Below comparisons for UInt32 patterns"
2289 https://bugs.webkit.org/show_bug.cgi?id=177281
2290 http://trac.webkit.org/changeset/222564
2292 2017-09-29 Yusuke Suzuki <utatane.tea@gmail.com>
2294 [DFG] Support ArrayPush with multiple args
2295 https://bugs.webkit.org/show_bug.cgi?id=175823
2297 Reviewed by Saam Barati.
2299 * microbenchmarks/array-push-0.js: Added.
2301 * microbenchmarks/array-push-1.js: Added.
2303 * microbenchmarks/array-push-2.js: Added.
2305 * microbenchmarks/array-push-3.js: Added.
2307 * stress/array-push-multiple-contiguous.js: Added.
2310 * stress/array-push-multiple-double-nan.js: Added.
2313 * stress/array-push-multiple-double.js: Added.
2316 * stress/array-push-multiple-int32.js: Added.
2319 * stress/array-push-multiple-many-contiguous.js: Added.
2322 * stress/array-push-multiple-many-double.js: Added.
2325 * stress/array-push-multiple-many-int32.js: Added.
2328 * stress/array-push-multiple-many-storage.js: Added.
2331 * stress/array-push-multiple-storage.js: Added.
2334 * stress/array-push-with-force-exit.js: Added.
2335 (target.createBuiltin):
2337 2017-09-29 Saam Barati <sbarati@apple.com>
2339 Custom GetterSetterAccessCase does not use the correct slotBase when making call
2340 https://bugs.webkit.org/show_bug.cgi?id=177639
2342 Reviewed by Geoffrey Garen.
2344 * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2350 2017-09-29 Commit Queue <commit-queue@webkit.org>
2352 Unreviewed, rolling out r222563, r222565, and r222581.
2353 https://bugs.webkit.org/show_bug.cgi?id=177675
2355 "It causes a crash when playing youtube videos" (Requested by
2356 saamyjoon on #webkit).
2358 Reverted changesets:
2360 "[DFG] Support ArrayPush with multiple args"
2361 https://bugs.webkit.org/show_bug.cgi?id=175823
2362 http://trac.webkit.org/changeset/222563
2364 "Unreviewed, build fix after r222563"
2365 https://bugs.webkit.org/show_bug.cgi?id=175823
2366 http://trac.webkit.org/changeset/222565
2368 "Unreviewed, fix x86 breaking due to exhausted registers"
2369 https://bugs.webkit.org/show_bug.cgi?id=175823
2370 http://trac.webkit.org/changeset/222581
2372 2017-09-28 Mark Lam <mark.lam@apple.com>
2374 test262: Unexpected passes after r222617 and r222618.
2375 https://bugs.webkit.org/show_bug.cgi?id=177622
2376 <rdar://problem/34725960>
2378 Reviewed by Saam Barati.
2380 Update test262.yaml for tests that are now passing.
2384 2017-09-27 Michael Saboff <msaboff@apple.com>
2386 REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2387 https://bugs.webkit.org/show_bug.cgi?id=177570
2389 Reviewed by Filip Pizlo.
2391 New regression test.
2393 * stress/regress-177570.js: Added.
2395 2017-09-28 Michael Saboff <msaboff@apple.com>
2397 Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2398 https://bugs.webkit.org/show_bug.cgi?id=177423
2400 Reviewed by Mark Lam.
2402 Updated regression test.
2404 * stress/regress-177423.js:
2407 2017-09-27 Mark Lam <mark.lam@apple.com>
2409 JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2410 https://bugs.webkit.org/show_bug.cgi?id=177584
2411 <rdar://problem/34463903>
2413 Reviewed by Saam Barati.
2415 * stress/regress-177584.js: Added.
2417 (Array.prototype.Symbol.species):
2419 2017-09-27 Saam Barati <sbarati@apple.com>
2421 Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2422 https://bugs.webkit.org/show_bug.cgi?id=177523
2424 Reviewed by Mark Lam.
2426 * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2429 (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2431 (i.Test.prototype.propName):
2433 2017-09-27 Mark Lam <mark.lam@apple.com>
2435 Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2436 https://bugs.webkit.org/show_bug.cgi?id=177423
2437 <rdar://problem/34621320>
2439 Reviewed by Keith Miller.
2441 * stress/regress-177423.js: Added.
2443 2017-09-27 Yusuke Suzuki <utatane.tea@gmail.com>
2445 Add Above/Below comparisons for UInt32 patterns
2446 https://bugs.webkit.org/show_bug.cgi?id=177281
2448 Reviewed by Saam Barati.
2450 * stress/uint32-comparison-jump.js: Added.
2460 * stress/uint32-comparison.js: Added.
2471 2017-09-25 Yusuke Suzuki <utatane.tea@gmail.com>
2473 [DFG] Support ArrayPush with multiple args
2474 https://bugs.webkit.org/show_bug.cgi?id=175823
2476 Reviewed by Saam Barati.
2478 * microbenchmarks/array-push-0.js: Added.
2480 * microbenchmarks/array-push-1.js: Added.
2482 * microbenchmarks/array-push-2.js: Added.
2484 * microbenchmarks/array-push-3.js: Added.
2486 * stress/array-push-multiple-contiguous.js: Added.
2489 * stress/array-push-multiple-double-nan.js: Added.
2492 * stress/array-push-multiple-double.js: Added.
2495 * stress/array-push-multiple-int32.js: Added.
2498 * stress/array-push-multiple-many-contiguous.js: Added.
2501 * stress/array-push-multiple-many-double.js: Added.
2504 * stress/array-push-multiple-many-int32.js: Added.
2507 * stress/array-push-multiple-many-storage.js: Added.
2510 * stress/array-push-multiple-storage.js: Added.
2514 2017-09-26 Commit Queue <commit-queue@webkit.org>
2516 Unreviewed, rolling out r222518.
2517 https://bugs.webkit.org/show_bug.cgi?id=177507
2519 Break the High Sierra build (Requested by yusukesuzuki on
2524 "Add Above/Below comparisons for UInt32 patterns"
2525 https://bugs.webkit.org/show_bug.cgi?id=177281
2526 http://trac.webkit.org/changeset/222518
2528 2017-09-26 Yusuke Suzuki <utatane.tea@gmail.com>
2530 Add Above/Below comparisons for UInt32 patterns
2531 https://bugs.webkit.org/show_bug.cgi?id=177281
2533 Reviewed by Saam Barati.
2535 * stress/uint32-comparison-jump.js: Added.
2545 * stress/uint32-comparison.js: Added.
2556 2017-09-23 Keith Miller <keith_miller@apple.com>
2558 Fix infinite looping test262 test
2559 https://bugs.webkit.org/show_bug.cgi?id=177412
2561 Reviewed by Yusuke Suzuki.
2563 This test was poorly designed since failing it would cause the vm
2564 to inifinite loop. I've fixed it locally and will fix it on github pending
2565 the results of next weeks tc39 meeting.
2568 * test262/test/language/statements/for-of/iterator-next-reference.js:
2570 2017-09-23 Joseph Pecoraro <pecoraro@apple.com>
2572 test262: $.agent became $262.agent in test262 update
2573 https://bugs.webkit.org/show_bug.cgi?id=177407
2575 Reviewed by Yusuke Suzuki.
2578 ~320 tests pass now that we correctly make $262 available.
2580 2017-09-22 Keith Miller <keith_miller@apple.com>
2582 Speculatively change iteration protocall to use the same next function
2583 https://bugs.webkit.org/show_bug.cgi?id=175653
2585 Reviewed by Saam Barati.
2587 Change test to match the new iteration behavior.
2589 * stress/spread-optimized-properly.js:
2591 2017-09-22 Yusuke Suzuki <utatane.tea@gmail.com>
2593 [DFG][FTL] Profile array vector length for array allocation
2594 https://bugs.webkit.org/show_bug.cgi?id=177051
2596 Reviewed by Saam Barati.
2598 * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2601 2017-09-22 Commit Queue <commit-queue@webkit.org>
2603 Unreviewed, rolling out r222380.
2604 https://bugs.webkit.org/show_bug.cgi?id=177352
2606 Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2611 "[DFG][FTL] Profile array vector length for array allocation"
2612 https://bugs.webkit.org/show_bug.cgi?id=177051
2613 http://trac.webkit.org/changeset/222380
2615 2017-09-21 Yusuke Suzuki <utatane.tea@gmail.com>
2617 [DFG][FTL] Profile array vector length for array allocation
2618 https://bugs.webkit.org/show_bug.cgi?id=177051
2620 Reviewed by Saam Barati.
2622 * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2625 2017-09-21 Joseph Pecoraro <pecoraro@apple.com>
2627 Skip new hanging test262 tests.
2628 https://bugs.webkit.org/show_bug.cgi?id=177326
2630 Unreviewed test gardening.
2634 2017-09-21 Ryan Haddad <ryanhaddad@apple.com>
2636 Mark 6 test262 tests as passing.
2637 https://bugs.webkit.org/show_bug.cgi?id=177307
2639 Unreviewed test gardening.
2643 2017-09-20 Joseph Pecoraro <pecoraro@apple.com>
2645 Unreviewed follow-up to r222311.
2647 * test262/harness/sta.js:
2648 * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2649 * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2650 * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2651 * test262/test/built-ins/Array/from/elements-added-after.js:
2652 * test262/test/built-ins/Array/from/elements-deleted-after.js:
2653 * test262/test/built-ins/Array/from/elements-updated-after.js:
2654 * test262/test/built-ins/Array/from/from-array.js:
2655 * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2656 * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2657 * test262/test/built-ins/Array/from/source-array-boundary.js:
2658 * test262/test/built-ins/Array/from/source-object-constructor.js:
2659 * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2660 * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2661 * test262/test/built-ins/Array/from/source-object-length.js:
2662 * test262/test/built-ins/Array/from/source-object-missing.js:
2663 * test262/test/built-ins/Array/from/source-object-without.js:
2664 * test262/test/built-ins/Array/from/this-null.js:
2665 * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2666 * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2667 * test262/test/language/literals/numeric/7.8.3-1gs.js:
2668 * test262/test/language/literals/numeric/7.8.3-2gs.js:
2669 * test262/test/language/literals/numeric/7.8.3-3gs.js:
2670 * test262/test/language/literals/regexp/7.8.5-1gs.js:
2671 * test262/test/language/literals/string/7.8.4-1gs.js:
2672 Fix some files that I failed to update when I applied my patch.
2674 2017-09-20 Joseph Pecoraro <pecoraro@apple.com>
2676 Update test262 tests
2677 https://bugs.webkit.org/show_bug.cgi?id=177220
2679 Reviewed by Saam Barati and Yusuke Suzuki.
2682 * test262/test262-Revision.txt:
2683 New rebaselined expectations for all tests.
2688 2017-09-17 Yusuke Suzuki <utatane.tea@gmail.com>
2690 [DFG] Remove ToThis more aggressively
2691 https://bugs.webkit.org/show_bug.cgi?id=177056
2693 Reviewed by Saam Barati.
2695 * stress/generator-with-this-strict.js: Added.
2699 * stress/generator-with-this.js: Added.
2704 2017-09-17 Michael Saboff <msaboff@apple.com>
2706 https://bugs.webkit.org/show_bug.cgi?id=177038
2707 Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2709 Reviewed by JF Bastien.
2711 * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2712 as it dies using too much memory.
2714 2017-09-15 Saam Barati <sbarati@apple.com>
2716 Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2717 https://bugs.webkit.org/show_bug.cgi?id=176981
2719 Reviewed by Yusuke Suzuki.
2721 * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2725 (const.bar.createBuiltin):
2727 2017-09-14 Saam Barati <sbarati@apple.com>
2729 It should be valid to exit before each set when doing arity fixup when inlining
2730 https://bugs.webkit.org/show_bug.cgi?id=176948
2732 Reviewed by Keith Miller.
2734 * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2739 2017-09-14 Yusuke Suzuki <utatane.tea@gmail.com>
2741 [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2742 https://bugs.webkit.org/show_bug.cgi?id=176867
2744 Reviewed by Sam Weinig.
2746 * microbenchmarks/object-get-own-property-symbols.js: Added.
2749 2017-09-13 Mark Lam <mark.lam@apple.com>
2751 Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2752 https://bugs.webkit.org/show_bug.cgi?id=176888
2753 <rdar://problem/34381832>
2757 * stress/op_mod-ConstVar.js:
2758 * stress/op_mod-VarConst.js:
2759 * stress/op_mod-VarVar.js:
2761 2017-09-13 Ryan Haddad <ryanhaddad@apple.com>
2763 Skip 3 op_mod tests on Debug JSC bots.
2764 https://bugs.webkit.org/show_bug.cgi?id=176630
2766 Unreviewed test gardening.
2768 * stress/op_mod-ConstVar.js:
2769 * stress/op_mod-VarConst.js:
2770 * stress/op_mod-VarVar.js:
2772 2017-09-13 Yusuke Suzuki <utatane.tea@gmail.com>
2774 [JSC] Fix Array allocation in Object.keys
2775 https://bugs.webkit.org/show_bug.cgi?id=176826
2777 Reviewed by Saam Barati.
2779 * stress/object-own-property-keys.js: Added.
2782 2017-09-12 Yusuke Suzuki <utatane.tea@gmail.com>
2784 [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2785 https://bugs.webkit.org/show_bug.cgi?id=176010
2787 Reviewed by Filip Pizlo.
2789 * microbenchmarks/weak-map-key.js: Added.
2792 (let.start.Date.now):
2794 2017-09-12 Mark Lam <mark.lam@apple.com>
2796 REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2797 https://bugs.webkit.org/show_bug.cgi?id=176630
2799 Reviewed by JF Bastien.
2801 Debug builds are just slow, and these tests do a lot. They pass when I run them
2802 locally on my MacBook Pro. So, I'm bumping their timing multiplier to 2.0x as
2803 a speculative fix for the bots that are seeing these fail.
2805 I also undid the skipping of the op_mod tests for debug builds.
2807 * stress/op_div-ConstVar.js:
2808 * stress/op_div-VarConst.js:
2809 * stress/op_div-VarVar.js:
2810 * stress/op_mod-ConstVar.js:
2811 * stress/op_mod-VarConst.js:
2812 * stress/op_mod-VarVar.js:
2814 2017-09-12 Ryan Haddad <ryanhaddad@apple.com>
2816 Skip stress/value-to-boolean.js on Debug bots.
2817 https://bugs.webkit.org/show_bug.cgi?id=176787
2819 Unreviewed test gardening.
2821 * stress/value-to-boolean.js:
2823 2017-09-11 Mark Lam <mark.lam@apple.com>
2825 Change test expectation for test262/test/language/statements/try/tco-catch.js
2826 https://bugs.webkit.org/show_bug.cgi?id=176749
2828 Rubber stamped by Keith Miller.
2830 It's been failing since at least r221821. I'm changing the test expectation to
2831 fail to green the bots while I investigate some more.
2835 2017-09-11 Ryan Haddad <ryanhaddad@apple.com>
2837 Unreviewed, rolling out r221854.
2839 The test added with this change fails on 32-bit JSC bots.
2843 "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2844 https://bugs.webkit.org/show_bug.cgi?id=176010
2845 http://trac.webkit.org/changeset/221854
2847 2017-09-03 Yusuke Suzuki <utatane.tea@gmail.com>
2849 [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2850 https://bugs.webkit.org/show_bug.cgi?id=176010
2852 Reviewed by Filip Pizlo.
2854 * microbenchmarks/weak-map-key.js: Added.
2857 (let.start.Date.now):
2859 2017-09-09 Yusuke Suzuki <utatane.tea@gmail.com>
2861 [JSC] Optimize Object.keys by using careful array allocation
2862 https://bugs.webkit.org/show_bug.cgi?id=176654
2864 Reviewed by Darin Adler.
2866 * microbenchmarks/object-keys.js: Added.
2869 2017-09-09 Filip Pizlo <fpizlo@apple.com>
2871 Error should compute .stack and friends lazily
2872 https://bugs.webkit.org/show_bug.cgi?id=176645
2874 Reviewed by Saam Barati.
2876 * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2877 * microbenchmarks/new-error.js: Added.
2878 * microbenchmarks/throw.js: Added.
2880 2017-09-09 Mark Lam <mark.lam@apple.com>
2882 [Re-landing] Use JIT probes for DFG OSR exit.
2883 https://bugs.webkit.org/show_bug.cgi?id=175144
2884 <rdar://problem/33437050>
2886 Not reviewed. Original patch reviewed by Saam Barati.
2888 Disable these tests for debug builds because they run too slow with the new OSR exit.
2890 * stress/op_mod-ConstVar.js:
2891 * stress/op_mod-VarConst.js:
2892 * stress/op_mod-VarVar.js:
2894 2017-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
2896 [DFG] NewArrayWithSize(size)'s size does not care negative zero
2897 https://bugs.webkit.org/show_bug.cgi?id=176300
2899 Reviewed by Saam Barati.
2901 * stress/new-array-with-size-div.js: Added.
2906 2017-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
2908 [DFG] PutByVal with Array::Generic is too generic
2909 https://bugs.webkit.org/show_bug.cgi?id=176345
2911 Reviewed by Filip Pizlo.
2913 * stress/object-assign-symbols.js: Added.
2916 * stress/object-assign.js: Added.
2919 (i.shouldBe.JSON.stringify.test):
2921 2017-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
2923 [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2924 https://bugs.webkit.org/show_bug.cgi?id=176590
2926 Reviewed by Saam Barati.
2928 * microbenchmarks/object-iterate-symbols.js: Added.
2930 * microbenchmarks/object-iterate.js: Added.
2932 * stress/object-iterate-symbols.js: Added.
2935 * stress/object-iterate.js: Added.
2939 2017-09-07 Per Arne Vollan <pvollan@apple.com>
2941 [Win32] 10 JSC stress tests are failing.
2942 https://bugs.webkit.org/show_bug.cgi?id=176538
2944 Reviewed by Mark Lam.
2946 Skip tests on Windows to make the bots green.
2949 * stress/date-relaxed.js:
2951 2017-09-06 Mark Lam <mark.lam@apple.com>
2953 constructGenericTypedArrayViewWithArguments() is missing an exception check.
2954 https://bugs.webkit.org/show_bug.cgi?id=176485
2955 <rdar://problem/33898874>
2957 Reviewed by Keith Miller.
2959 * stress/regress-176485.js: Added.
2961 2017-09-05 Saam Barati <sbarati@apple.com>
2963 isNotCellSpeculation is wrong with respect to SpecEmpty
2964 https://bugs.webkit.org/show_bug.cgi?id=176429
2966 Reviewed by Michael Saboff.
2968 * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2971 2017-09-05 Joseph Pecoraro <pecoraro@apple.com>
2973 test262: Completion values for control flow do not match the spec
2974 https://bugs.webkit.org/show_bug.cgi?id=171265
2976 Reviewed by Saam Barati.
2978 * stress/completion-value.js:
2979 Condensed test for completion values in top level statements.
2981 * stress/super-get-by-id.js:
2982 ClassDeclaration when evaled no longer produce values. Convert
2983 these to ClassExpressions so they produce the class value.
2985 * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2986 This is a progression for currect spec behavior.
2988 * mozilla/mozilla-tests.yaml:
2989 This test is now outdated, so mark it as failing for that reason.
2992 Passing all "cptn" completion value tests.
2994 2017-09-04 Saam Barati <sbarati@apple.com>
2996 typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2997 https://bugs.webkit.org/show_bug.cgi?id=176317
2999 Reviewed by Keith Miller.
3001 * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3004 2017-09-03 Yusuke Suzuki <utatane.tea@gmail.com>
3006 [DFG][FTL] Efficiently execute number#toString()
3007 https://bugs.webkit.org/show_bug.cgi?id=170007
3009 Reviewed by Keith Miller.
3011 * microbenchmarks/number-to-string-strength-reduction.js: Added.
3013 * microbenchmarks/number-to-string-with-radix-10.js: Added.
3015 * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3017 * microbenchmarks/number-to-string-with-radix.js: Added.
3019 * stress/number-to-string-strength-reduction.js: Added.
3022 * stress/number-to-string-with-radix-10.js: Added.
3025 * stress/number-to-string-with-radix-cse.js: Added.
3028 * stress/number-to-string-with-radix-invalid.js: Added.
3030 * stress/number-to-string-with-radix-watchpoint.js: Added.
3033 (i.i.1e3.Number.prototype.toString):
3034 * stress/number-to-string-with-radix.js: Added.
3038 2017-09-02 Yusuke Suzuki <utatane.tea@gmail.com>
3040 [DFG] Relax arity requirement
3041 https://bugs.webkit.org/show_bug.cgi?id=175523
3043 Reviewed by Saam Barati.
3045 * stress/arity-mismatch-arguments-length.js: Added.
3049 * stress/arity-mismatch-get-argument.js: Added.
3051 (builtin.createBuiltin):
3053 * stress/arity-mismatch-inlining-extra-slots.js: Added.
3057 * stress/arity-mismatch-inlining.js: Added.
3061 * stress/arity-mismatch-rest.js: Added.
3067 2017-08-31 Yusuke Suzuki <utatane.tea@gmail.com>
3069 [JSC] Fix "name" and "length" of Proxy revoke function
3070 https://bugs.webkit.org/show_bug.cgi?id=176155
3072 Reviewed by Mark Lam.
3076 2017-08-31 Saam Barati <sbarati@apple.com>
3078 Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3079 https://bugs.webkit.org/show_bug.cgi?id=176206
3081 Reviewed by Keith Miller.
3083 * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3088 2017-08-31 Ryan Haddad <ryanhaddad@apple.com>
3090 Skip two slow JSC tests after r221422.
3092 Unreviewed test gardening.
3094 * stress/regexp-prototype-match-on-too-long-rope.js:
3095 * stress/regexp-prototype-test-on-too-long-rope.js:
3097 2017-08-31 Filip Pizlo <fpizlo@apple.com>
3099 Unreviewed, skipping slow tests.
3101 These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3102 work differently now.
3104 * stress/regexp-prototype-exec-on-too-long-rope.js:
3105 * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3107 2017-08-31 Yusuke Suzuki <utatane.tea@gmail.com>
3109 [JSC] Use reifying system for "name" property of builtin JSFunction
3110 https://bugs.webkit.org/show_bug.cgi?id=175260
3112 Reviewed by Saam Barati.
3114 * stress/accessors-get-set-prefix.js:
3115 * stress/builtin-function-name.js: Added.
3118 (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3119 (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3120 * stress/private-name-as-anonymous-builtin.js: Added.
3124 2017-08-30 Saam Barati <sbarati@apple.com>
3126 Unreviewed. Make test stop printing.
3128 * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3130 2017-08-30 Ryan Haddad <ryanhaddad@apple.com>
3132 Unreviewed, rolling out r221327.
3134 This change caused test262 failures.
3138 "[JSC] Use reifying system for "name" property of builtin
3140 https://bugs.webkit.org/show_bug.cgi?id=175260
3141 http://trac.webkit.org/changeset/221327
3143 2017-08-30 Saam Barati <sbarati@apple.com>
3145 semicolon is being interpreted as an = in the LiteralParser
3146 https://bugs.webkit.org/show_bug.cgi?id=176114
3148 Reviewed by Oliver Hunt.
3150 * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3151 * stress/resources/literal-parser-test-case.js: Added.
3153 2017-08-30 Oleksandr Skachkov <gskachkov@gmail.com>
3155 [ESNext] Async iteration - Implement async iteration statement: for-await-of
3156 https://bugs.webkit.org/show_bug.cgi?id=166698
3158 Reviewed by Yusuke Suzuki.
3160 * stress/async-iteration-for-await-of-syntax.js: Added.
3164 (checkSimpleAsyncGeneratorSloppyMode):
3165 (checkSimpleAsyncGeneratorStrictMode):
3166 (checkNestedAsyncGenerators):
3167 (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3168 * stress/async-iteration-for-await-of.js: Added.
3174 2017-08-29 Yusuke Suzuki <utatane.tea@gmail.com>
3176 [JSC] Use reifying system for "name" property of builtin JSFunction
3177 https://bugs.webkit.org/show_bug.cgi?id=175260
3179 Reviewed by Saam Barati.
3181 * stress/accessors-get-set-prefix.js:
3182 * stress/builtin-function-name.js: Added.
3185 (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3186 (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3188 2017-08-25 Saam Barati <sbarati@apple.com>
3190 Support compiling catch in the DFG
3191 https://bugs.webkit.org/show_bug.cgi?id=174590
3192 <rdar://problem/34047845>
3194 Reviewed by Filip Pizlo.
3196 * microbenchmarks/delta-blue-try-catch.js: Added.
3199 (OrderedCollection):
3200 (OrderedCollection.prototype.add):
3201 (OrderedCollection.prototype.at):
3202 (OrderedCollection.prototype.size):
3203 (OrderedCollection.prototype.removeFirst):
3204 (OrderedCollection.prototype.remove):
3206 (Strength.stronger):
3208 (Strength.weakestOf):
3209 (Strength.strongest):
3210 (Strength.prototype.nextWeaker):
3212 (Constraint.prototype.addConstraint):
3213 (Constraint.prototype.satisfy):
3214 (Constraint.prototype.destroyConstraint):
3215 (Constraint.prototype.isInput):
3217 (UnaryConstraint.prototype.addToGraph):
3218 (UnaryConstraint.prototype.chooseMethod):
3219 (UnaryConstraint.prototype.isSatisfied):
3220 (UnaryConstraint.prototype.markInputs):
3221 (UnaryConstraint.prototype.output):
3222 (UnaryConstraint.prototype.recalculate):
3223 (UnaryConstraint.prototype.markUnsatisfied):
3224 (UnaryConstraint.prototype.inputsKnown):
3225 (UnaryConstraint.prototype.removeFromGraph):
3227 (StayConstraint.prototype.execute):
3228 (EditConstraint.prototype.isInput):
3229 (EditConstraint.prototype.execute):
3231 (BinaryConstraint.prototype.chooseMethod):
3232 (BinaryConstraint.prototype.addToGraph):
3233 (BinaryConstraint.prototype.isSatisfied):
3234 (BinaryConstraint.prototype.markInputs):
3235 (BinaryConstraint.prototype.input):
3236 (BinaryConstraint.prototype.output):
3237 (BinaryConstraint.prototype.recalculate):
3238 (BinaryConstraint.prototype.markUnsatisfied):
3239 (BinaryConstraint.prototype.inputsKnown):
3240 (BinaryConstraint.prototype.removeFromGraph):
3242 (ScaleConstraint.prototype.addToGraph):
3243 (ScaleConstraint.prototype.removeFromGraph):
3244 (ScaleConstraint.prototype.markInputs):
3245 (ScaleConstraint.prototype.execute):
3246 (ScaleConstraint.prototype.recalculate):
3247 (EqualityConstraint):
3248 (EqualityConstraint.prototype.execute):
3250 (Variable.prototype.addConstraint):
3251 (Variable.prototype.removeConstraint):
3253 (Planner.prototype.incrementalAdd):
3254 (Planner.prototype.incrementalRemove):
3255 (Planner.prototype.newMark):
3256 (Planner.prototype.makePlan):
3257 (Planner.prototype.extractPlanFromConstraints):
3258 (Planner.prototype.addPropagate):
3259 (Planner.prototype.removePropagateFrom):
3260 (Planner.prototype.addConstraintsConsumingTo):
3262 (Plan.prototype.addConstraint):
3263 (Plan.prototype.size):
3264 (Plan.prototype.constraintAt):
3265 (Plan.prototype.execute):
3270 * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3273 (Numbers.prototype.next):
3275 (return.Transpose.prototype.next):
3281 * microbenchmarks/try-catch-word-count.js: Added.
3296 (A.prototype.getValue):
3297 (B.prototype.getParentValue):
3307 (set delete.set has.set add):
3308 * stress/catch-set-argument-speculation-failure.js: Added.
3316 * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3322 2017-08-24 Commit Queue <commit-queue@webkit.org>
3324 Unreviewed, rolling out r221119, r221124, and r221143.
3325 https://bugs.webkit.org/show_bug.cgi?id=175973
3327 "I think it regressed JSBench by 20%" (Requested by saamyjoon
3330 Reverted changesets:
3332 "Support compiling catch in the DFG"
3333 https://bugs.webkit.org/show_bug.cgi?id=174590
3334 http://trac.webkit.org/changeset/221119
3336 "Unreviewed, build fix in GTK port"
3337 https://bugs.webkit.org/show_bug.cgi?id=174590
3338 http://trac.webkit.org/changeset/221124
3340 "DFG::JITCode::osrEntry should get sorted since we perform a
3341 binary search on it"
3342 https://bugs.webkit.org/show_bug.cgi?id=175893
3343 http://trac.webkit.org/changeset/221143
3345 2017-08-24 Michael Saboff <msaboff@apple.com>
3347 Add support for RegExp "dotAll" flag
3348 https://bugs.webkit.org/show_bug.cgi?id=175924
3350 Reviewed by Keith Miller.
3352 Updated tests for new dotAll ('s' flag) changes.
3354 * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3355 * stress/static-getter-in-names.js:
3357 2017-08-24 Mark Lam <mark.lam@apple.com>
3359 Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3360 https://bugs.webkit.org/show_bug.cgi?id=175940
3361 <rdar://problem/29003921>
3363 Reviewed by Saam Barati.
3365 * stress/regress-164081.js: Added.
3369 2017-08-24 Ryan Haddad <ryanhaddad@apple.com>
3371 Skip flaky JSC test stress/test-finally.js.
3372 https://bugs.webkit.org/show_bug.cgi?id=160283
3374 Unreviewed test gardening.
3376 * stress/test-finally.js:
3378 2017-08-23 Saam Barati <sbarati@apple.com>
3380 Support compiling catch in the DFG
3381 https://bugs.webkit.org/show_bug.cgi?id=174590
3383 Reviewed by Filip Pizlo.
3385 * microbenchmarks/delta-blue-try-catch.js: Added.
3388 (OrderedCollection):
3389 (OrderedCollection.prototype.add):
3390 (OrderedCollection.prototype.at):
3391 (OrderedCollection.prototype.size):
3392 (OrderedCollection.prototype.removeFirst):
3393 (OrderedCollection.prototype.remove):
3395 (Strength.stronger):
3397 (Strength.weakestOf):
3398 (Strength.strongest):
3399 (Strength.prototype.nextWeaker):
3401 (Constraint.prototype.addConstraint):
3402 (Constraint.prototype.satisfy):
3403 (Constraint.prototype.destroyConstraint):
3404 (Constraint.prototype.isInput):
3406 (UnaryConstraint.prototype.addToGraph):
3407 (UnaryConstraint.prototype.chooseMethod):
3408 (UnaryConstraint.prototype.isSatisfied):
3409 (UnaryConstraint.prototype.markInputs):
3410 (UnaryConstraint.prototype.output):
3411 (UnaryConstraint.prototype.recalculate):
3412 (UnaryConstraint.prototype.markUnsatisfied):
3413 (UnaryConstraint.prototype.inputsKnown):
3414 (UnaryConstraint.prototype.removeFromGraph):
3416 (StayConstraint.prototype.execute):
3417 (EditConstraint.prototype.isInput):
3418 (EditConstraint.prototype.execute):
3420 (BinaryConstraint.prototype.chooseMethod):
3421 (BinaryConstraint.prototype.addToGraph):
3422 (BinaryConstraint.prototype.isSatisfied):
3423 (BinaryConstraint.prototype.markInputs):
3424 (BinaryConstraint.prototype.input):
3425 (BinaryConstraint.prototype.output):
3426 (BinaryConstraint.prototype.recalculate):
3427 (BinaryConstraint.prototype.markUnsatisfied):
3428 (BinaryConstraint.prototype.inputsKnown):
3429 (BinaryConstraint.prototype.removeFromGraph):
3431 (ScaleConstraint.prototype.addToGraph):
3432 (ScaleConstraint.prototype.removeFromGraph):
3433 (ScaleConstraint.prototype.markInputs):
3434 (ScaleConstraint.prototype.execute):
3435 (ScaleConstraint.prototype.recalculate):
3436 (EqualityConstraint):
3437 (EqualityConstraint.prototype.execute):
3439 (Variable.prototype.addConstraint):
3440 (Variable.prototype.removeConstraint):
3442 (Planner.prototype.incrementalAdd):
3443 (Planner.prototype.incrementalRemove):
3444 (Planner.prototype.newMark):
3445 (Planner.prototype.makePlan):
3446 (Planner.prototype.extractPlanFromConstraints):
3447 (Planner.prototype.addPropagate):
3448 (Planner.prototype.removePropagateFrom):
3449 (Planner.prototype.addConstraintsConsumingTo):
3451 (Plan.prototype.addConstraint):
3452 (Plan.prototype.size):
3453 (Plan.prototype.constraintAt):
3454 (Plan.prototype.execute):
3459 * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3462 (Numbers.prototype.next):
3464 (return.Transpose.prototype.next):
3470 * microbenchmarks/try-catch-word-count.js: Added.
3485 (A.prototype.getValue):
3486 (B.prototype.getParentValue):
3496 (set delete.set has.set add):
3497 * stress/catch-set-argument-speculation-failure.js: Added.
3505 * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3511 2017-08-23 Yusuke Suzuki <utatane.tea@gmail.com>
3513 [JSC] Optimize Map iteration with intrinsic
3514 https://bugs.webkit.org/show_bug.cgi?id=174355
3516 Reviewed by Saam Barati.
3518 * stress/map-iterator-result-should-have-expected-shape.js: Added.
3521 * stress/set-iterator-result-should-have-expected-shape.js: Added.
3523 (throw.new.Error.let.iterator.set Symbol):
3524 (throw.new.Error.set add):
3525 (let.iterator.set Symbol):
3527 2017-08-23 Robin Morisset <rmorisset@apple.com>
3529 Add a micro-benchmark for checking that accessing a variable within a 'with'
3530 block does not automatically prevent type prediction.
3531 https://bugs.webkit.org/show_bug.cgi?id=175738
3533 Reviewed by Saam Barati.
3535 * stress/with_and_arith.js: Added.
3538 2017-08-23 Skachkov Oleksandr <gskachkov@gmail.com>
3540 [ESNext] Async iteration - Implement Async Generator - runtime
3541 https://bugs.webkit.org/show_bug.cgi?id=175240
3543 Reviewed by Yusuke Suzuki.
3545 * stress/async-iteration-async-from-sync.js: Added.
3549 (this.fullfilledDone):
3554 (const.assertLogger):
3555 (const.getPromise.promiseHolder.return.new.Promise):
3561 * stress/async-iteration-basic.js: Added.
3565 (this.fullfilledDone):
3570 (const.assertLogger):
3571 (const.getPromise.promiseHolder.return.new.Promise):
3573 (iterator.next.then):
3578 (A.prototype.async.foo):
3579 (A.prototype.async.boo):
3581 (asyncGenExp.async):
3594 * stress/async-iteration-evaluation.js: Added.
3598 * stress/async-iteration-syntax.js:
3599 * stress/async-iteration-yield-promise.js: Added.
3603 (this.fullfilledDone):
3608 (const.assertLogger):
3609 (const.getPromise.promiseHolder.return.new.Promise):
3613 * stress/async-iteration-yield-star-interface.js: Added.
3615 (const.getPromise.promiseHolder.return.new.Promise):
3618 (this.fullfilledDone):
3624 (const.assertLogger):
3625 (let.asyncIter.Symbol.asyncIterator):
3626 (let.asyncIter.next):
3627 (let.asyncIter.throw):
3628 (let.asyncIter.return):
3630 (asyncIter.Symbol.asyncIterator):
3637 * stress/async-iteration-yield-star.js: Added.
3641 (this.fullfilledDone):
3647 (const.assertLogger):
3648 (const.getPromise.promiseHolder.return.new.Promise):
3657 (let.asyncIter.Symbol.asyncIterator):
3658 (let.asyncIter.next):
3659 (let.asyncIter.throw):
3660 (let.asyncIter.return):
3665 2017-08-23 JF Bastien <jfbastien@apple.com>
3667 Fix printing in test
3669 Unreviewed: fixing verbosity, shouldn't have been there.
3671 * wasm/regress/175693.js:
3675 2017-08-18 Ryan Haddad <ryanhaddad@apple.com>
3677 Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3678 https://bugs.webkit.org/show_bug.cgi?id=172543
3680 Unreviewed test gardening.
3682 * microbenchmarks/generator-with-several-types.js:
3684 2017-08-17 JF Bastien <jfbastien@apple.com>
3686 WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3687 https://bugs.webkit.org/show_bug.cgi?id=175693
3688 <rdar://problem/33952443>
3690 Reviewed by Saam Barati.
3692 Add a regression directory for WebAssembly tests.
3695 * wasm/regress/175693.js: Added.
3697 (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3699 * wasm/regress/175693.wasm: Added.
3701 2017-08-15 Robin Morisset <rmorisset@apple.com>
3703 Support the 'with' keyword in FTL.
3704 https://bugs.webkit.org/show_bug.cgi?id=175585
3706 Reviewed by Saam Barati.
3708 Also improve the JSTest/stress/with.js file to test
3709 what happens when non-objects are passed to with.
3716 2017-08-14 Keith Miller <keith_miller@apple.com>
3718 Add testing tool to lie to the DFG about profiles
3719 https://bugs.webkit.org/show_bug.cgi?id=175487
3721 Reviewed by Saam Barati.
3723 * stress/compare-eq-incomplete-profile.js: Added.
3724 (const.test.createBuiltin):
3726 2017-08-14 Robin Morisset <rmorisset@apple.com>
3728 Support the with keyword in DFG
3729 https://bugs.webkit.org/show_bug.cgi?id=175470