[JSC] Do not check isValid() in op_new_regexp
[WebKit-https.git] / JSTests / ChangeLog
1 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         [JSC] Do not check isValid() in op_new_regexp
4         https://bugs.webkit.org/show_bug.cgi?id=180970
5
6         Reviewed by Saam Barati.
7
8         * stress/regexp-syntax-error-invalid-flags.js: Added.
9         (shouldThrow):
10
11 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
12
13         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
14         https://bugs.webkit.org/show_bug.cgi?id=180712
15
16         Reviewed by Michael Catanzaro.
17
18         stress/call-apply-exponential-bytecode-size.js crashes if the
19         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
20         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
21         should skip the test on other platforms.
22
23         * stress/call-apply-exponential-bytecode-size.js:
24
25 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
26
27         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
28         https://bugs.webkit.org/show_bug.cgi?id=179762
29
30         Reviewed by Saam Barati.
31
32         * stress/call-varargs-double-new-array-buffer.js: Added.
33         (assert):
34         (bar):
35         (foo):
36         * stress/call-varargs-spread-new-array-buffer.js: Added.
37         (assert):
38         (bar):
39         (foo):
40         * stress/call-varargs-spread-new-array-buffer2.js: Added.
41         (assert):
42         (bar):
43         (foo):
44         * stress/forward-varargs-double-new-array-buffer.js: Added.
45         (assert):
46         (test.baz):
47         (test.bar):
48         (test.foo):
49         (test):
50         * stress/new-array-buffer-sinking-osrexit.js: Added.
51         (target):
52         (test):
53         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
54         (shouldBe):
55         (test):
56         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
57         (shouldBe):
58         (target):
59         (test):
60         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
61         (assert):
62         (test1.bar):
63         (test1.foo):
64         (test1):
65         (test2.bar):
66         (test2.foo):
67         (test3.baz):
68         (test3.bar):
69         (test3.foo):
70         (test4.baz):
71         (test4.bar):
72         (test4.foo):
73         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
74         (assert):
75         (test.baz):
76         (test.bar):
77         (test.foo):
78         (test):
79         * stress/phantom-new-array-buffer-osr-exit.js: Added.
80         (assert):
81         (baz):
82         (bar):
83         (effects):
84         (foo):
85
86 2017-12-14  Saam Barati  <sbarati@apple.com>
87
88         The CleanUp after LICM is erroneously removing a Check
89         https://bugs.webkit.org/show_bug.cgi?id=180852
90         <rdar://problem/36063494>
91
92         Reviewed by Filip Pizlo.
93
94         * stress/dont-run-cleanup-after-licm.js: Added.
95
96 2017-12-14  Michael Saboff  <msaboff@apple.com>
97
98         REGRESSION (r225695): Repro crash on yahoo login page
99         https://bugs.webkit.org/show_bug.cgi?id=180761
100
101         Reviewed by JF Bastien.
102
103         New regression test.
104
105         * stress/regress-180761.js: Added.
106
107 2017-12-13  Keith Miller  <keith_miller@apple.com>
108
109         JSObjects should have a mask for loading indexed properties
110         https://bugs.webkit.org/show_bug.cgi?id=180768
111
112         Reviewed by Mark Lam.
113
114         * stress/int16-put-by-val-in-and-out-of-bounds.js:
115         (test):
116
117 2017-12-13  Saam Barati  <sbarati@apple.com>
118
119         Arrow functions need their own structure because they have different properties than sloppy functions
120         https://bugs.webkit.org/show_bug.cgi?id=180779
121         <rdar://problem/35814591>
122
123         Reviewed by Mark Lam.
124
125         * stress/arrow-function-needs-its-own-structure.js: Added.
126         (assert):
127         (readPrototype):
128         (noInline.let.f1):
129         (noInline):
130
131 2017-12-13  Saam Barati  <sbarati@apple.com>
132
133         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
134         https://bugs.webkit.org/show_bug.cgi?id=163579
135         <rdar://problem/35455798>
136
137         Reviewed by Mark Lam.
138
139         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
140         (assert):
141         (test1):
142         (i.test1):
143         (i.test1.C):
144         (i.test1.async.foo):
145         (i.test1.foo):
146         (test2):
147
148 2017-12-13  Saam Barati  <sbarati@apple.com>
149
150         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
151         https://bugs.webkit.org/show_bug.cgi?id=180734
152         <rdar://problem/35640547>
153
154         Reviewed by Yusuke Suzuki.
155
156         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
157         (__isPropertyOfType):
158         (__getProperties):
159         (__getObjects):
160         (__getRandomObject):
161         (theClass.):
162         (theClass):
163         (childClass):
164         (counter.catch):
165
166 2017-12-12  Saam Barati  <sbarati@apple.com>
167
168         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
169         https://bugs.webkit.org/show_bug.cgi?id=180725
170         <rdar://problem/35970511>
171
172         Reviewed by Michael Saboff.
173
174         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
175         (f1):
176         (f2):
177         (let.o2.valueOf):
178
179 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
180
181         [JSC] Implement optimized WeakMap and WeakSet
182         https://bugs.webkit.org/show_bug.cgi?id=179929
183
184         Reviewed by Saam Barati.
185
186         * microbenchmarks/weak-map-key.js:
187         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
188         (assert):
189         (objectKey):
190         (let.start.Date.now):
191         * stress/basic-weakmap.js: Added.
192         (shouldBe):
193         (test):
194         * stress/basic-weakset.js: Added.
195         (shouldBe):
196         (test.set new):
197         * stress/weakmap-cse-set-break.js: Added.
198         (shouldBe):
199         (test):
200         * stress/weakmap-cse.js: Added.
201         (shouldBe):
202         (test):
203         * stress/weakmap-gc.js: Added.
204         (test):
205         * stress/weakset-cse-add-break.js: Added.
206         (shouldBe):
207         (test.set new):
208         * stress/weakset-cse.js: Added.
209         (shouldBe):
210         (test.set new):
211         * stress/weakset-gc.js: Added.
212         (test.set add):
213         (test.set new):
214         (test):
215
216 2017-12-12  Saam Barati  <sbarati@apple.com>
217
218         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
219         https://bugs.webkit.org/show_bug.cgi?id=180723
220         <rdar://problem/35859726>
221
222         Reviewed by JF Bastien.
223
224         * stress/get-my-argument-by-val-constant-folding.js: Added.
225         (test):
226         (catch):
227
228 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
229
230         [ESNext][BigInt] Implement BigInt literals and JSBigInt
231         https://bugs.webkit.org/show_bug.cgi?id=179000
232
233         Reviewed by Darin Adler and Yusuke Suzuki.
234
235         * bigIntTests.yaml: Added.
236         * stress/big-int-literal-line-terminator.js: Added.
237         * stress/big-int-literals.js: Added.
238         * stress/big-int-operations-error.js: Added.
239         * stress/big-int-type-of.js: Added.
240         * stress/big-int-white-space-trailing-leading.js: Added.
241         * stress/big-int-function-apply.js: Added.
242
243 2017-12-11  Saam Barati  <sbarati@apple.com>
244
245         We need to disableCaching() in ErrorInstance when we materialize properties
246         https://bugs.webkit.org/show_bug.cgi?id=180343
247         <rdar://problem/35833002>
248
249         Reviewed by Mark Lam.
250
251         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
252         (assert):
253         (makeError):
254         (storeToStack):
255         (storeToStackAlreadyMaterialized):
256
257 2017-12-05  JF Bastien  <jfbastien@apple.com>
258
259         WebAssembly: don't eagerly checksum
260         https://bugs.webkit.org/show_bug.cgi?id=180441
261         <rdar://problem/35156628>
262
263         Reviewed by Saam Barati.
264
265         Checksum is now disabled, so tests only have <?> as the module
266         name.
267
268         * wasm/function-tests/nameSection.js:
269         * wasm/function-tests/stack-overflow.js:
270         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
271         (assertOverflows.assertThrows):
272         (assertOverflows):
273         * wasm/function-tests/stack-trace.js:
274
275 2017-12-04  JF Bastien  <jfbastien@apple.com>
276
277         Proxy all functions, except the $ objects
278         https://bugs.webkit.org/show_bug.cgi?id=180375
279
280         Reviewed by Saam Barati.
281
282         It looks like this test may have broken some executions because I
283         call some internal objects. Explicitly ignore objects whose name
284         starts with "$" because it's a bad idea anyways.
285
286         * stress/proxy-all-the-parameters.js:
287         (generateObjects):
288         (get throw):
289
290 2017-12-04  Saam Barati  <sbarati@apple.com>
291
292         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
293         https://bugs.webkit.org/show_bug.cgi?id=180366
294         <rdar://problem/35685877>
295
296         Reviewed by Michael Saboff.
297
298         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
299         (theParent):
300         (test1.base.getParentStaticValue):
301         (test1.base):
302         (test1.__v_24888.prototype.set prop):
303         (test1.__v_24888):
304         (test2.base.getParentStaticValue):
305         (test2.base):
306         (test2.__v_24888.prototype.set prop):
307         (test2.__v_24888):
308         (test2):
309
310 2017-12-01  JF Bastien  <jfbastien@apple.com>
311
312         Try proxying all function arguments
313         https://bugs.webkit.org/show_bug.cgi?id=180306
314
315         Reviewed by Saam Barati.
316
317         * stress/proxy-all-the-parameters.js: Added.
318         (isPropertyOfType):
319         (getProperties):
320         (generateObjects):
321         (getObjects):
322         (getFunctions):
323         (get throw):
324         (let.o.of.getObjects.let.f.of.getFunctions.catch):
325
326 2017-12-01  JF Bastien  <jfbastien@apple.com>
327
328         JavaScriptCore: missing exception checks in Math functions that take more than one argument
329         https://bugs.webkit.org/show_bug.cgi?id=180297
330         <rdar://problem/35745556>
331
332         Reviewed by Mark Lam.
333
334         * stress/math-exceptions.js: Added.
335         (get try):
336         (catch):
337
338 2017-12-01  JF Bastien  <jfbastien@apple.com>
339
340         JavaScriptCore: add test for weird class static getters
341         https://bugs.webkit.org/show_bug.cgi?id=180281
342         <rdar://problem/35592139>
343
344         Reviewed by Mark Lam.
345
346         I fixed a bug for it in r224927 and didn't add a test. Do so.
347
348         * stress/class-static-get-weird.js: Added.
349         (c.prototype.get name):
350         (c):
351         (c.prototype.get arguments):
352         (c.prototype.get caller):
353         (c.prototype.get length):
354
355 2017-12-01  Saam Barati  <sbarati@apple.com>
356
357         Having a bad time needs to handle ArrayClass indexing type as well
358         https://bugs.webkit.org/show_bug.cgi?id=180274
359         <rdar://problem/35667869>
360
361         Reviewed by Keith Miller and Mark Lam.
362
363         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
364         (assert):
365         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
366         (assert):
367
368 2017-12-01  JF Bastien  <jfbastien@apple.com>
369
370         WebAssembly: restore cached stack limit after out-call
371         https://bugs.webkit.org/show_bug.cgi?id=179106
372         <rdar://problem/35337525>
373
374         Reviewed by Saam Barati.
375
376         * wasm/function-tests/double-instance.js: Added.
377         (const.imp.boom):
378         (const.imp.get callAnother):
379
380 2017-11-30  JF Bastien  <jfbastien@apple.com>
381
382         WebAssembly: improve stack trace
383         https://bugs.webkit.org/show_bug.cgi?id=179343
384
385         Reviewed by Saam Barati.
386
387         Update the tests to follow the new format. Notably, SHA1 module
388         hash is now included in traces, and stubs are properly identified.
389
390         * wasm/assert.js: Add an assertion which matches regular expressions.
391         * wasm/function-tests/nameSection.js:
392         * wasm/function-tests/stack-overflow.js:
393         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
394         (assertOverflows.assertThrows.wasm.1):
395         (assertOverflows.assertThrows.wasm.0):
396         (assertOverflows.assertThrows):
397         (assertOverflows):
398         * wasm/function-tests/stack-trace.js:
399         (import.Builder.from.string_appeared_here.assert): Deleted.
400         * wasm/function-tests/trap-after-cross-instance-call.js:
401         (wasmFrameCountFromError):
402         * wasm/function-tests/trap-load-2.js:
403         (wasmFrameCountFromError):
404         * wasm/function-tests/trap-load.js:
405         (wasmFrameCountFromError):
406
407 2017-11-30  Mark Lam  <mark.lam@apple.com>
408
409         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
410         https://bugs.webkit.org/show_bug.cgi?id=180219
411         <rdar://problem/35696536>
412
413         Reviewed by Filip Pizlo.
414
415         * stress/regress-180219.js: Added.
416
417 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
418
419         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
420         https://bugs.webkit.org/show_bug.cgi?id=180190
421
422         Reviewed by Mark Lam.
423
424         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
425         (shouldBe):
426         (test1):
427         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
428         (shouldBe):
429         (test1):
430         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
431         (shouldBe):
432         (test1):
433         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
434         (shouldBe):
435         (test1):
436         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
437         (shouldBe):
438         (test1):
439         * stress/operation-in-may-have-negative-int32.js: Added.
440         (shouldBe):
441         (test2):
442         * stress/operation-in-negative-int32-cast.js: Added.
443         (shouldBe):
444         (test1):
445
446 2017-11-28  JF Bastien  <jfbastien@apple.com>
447
448         Strict and sloppy functions shouldn't share structure
449         https://bugs.webkit.org/show_bug.cgi?id=180103
450         <rdar://problem/35667847>
451
452         Reviewed by Saam Barati.
453
454         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
455         because the IC was wrong.
456         (foo):
457         (bar):
458         (baz):
459         (catch):
460         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
461         in this patch, but may as well test odd strict mode corner cases.
462         (bar):
463         (baz):
464         (catch):
465         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
466         (foo):
467         (bar):
468         (baz):
469         (catch):
470         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
471         next file, but with invalidation of the FunctionExecutable's
472         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
473         slower path.
474         (foo):
475         (bar.const.x):
476         (bar.const.y):
477         (bar):
478         (catch):
479         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
480         strict nesting works correctly.
481         (foo):
482         (bar.baz):
483         (bar):
484         * stress/strict-function-structure.js: Added. The test used to
485         assert in objectProtoFuncHasOwnProperty.
486         (foo):
487         (bar):
488         (baz):
489         * stress/strict-nested-function-structure.js: Added. Nesting.
490         (foo):
491         (bar):
492         (baz.boo):
493         (baz):
494
495 2017-11-29  Robin Morisset  <rmorisset@apple.com>
496
497         The recursive tail call optimisation is wrong on closures
498         https://bugs.webkit.org/show_bug.cgi?id=179835
499
500         Reviewed by Saam Barati.
501
502         * stress/closure-recursive-tail-call.js: Added.
503         (makeClosure):
504
505 2017-11-27  JF Bastien  <jfbastien@apple.com>
506
507         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
508         https://bugs.webkit.org/show_bug.cgi?id=180051
509         <rdar://problem/35614371>
510
511         Reviewed by Saam Barati.
512
513         * stress/rest-parameter-negative.js: Added.
514         (__f_5484):
515         (catch):
516         (__f_5485):
517         (__v_22598.catch):
518
519 2017-11-27  Saam Barati  <sbarati@apple.com>
520
521         Spread can escape when CreateRest does not
522         https://bugs.webkit.org/show_bug.cgi?id=180057
523         <rdar://problem/35676119>
524
525         Reviewed by JF Bastien.
526
527         * stress/spread-escapes-but-create-rest-does-not.js: Added.
528         (assert):
529         (getProperties):
530         (theFunc):
531         (let.obj.valueOf):
532
533 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
534
535         [DFG] Add NormalizeMapKey DFG IR
536         https://bugs.webkit.org/show_bug.cgi?id=179912
537
538         Reviewed by Saam Barati.
539
540         * stress/map-untyped-normalize-cse.js: Added.
541         (shouldBe):
542         (test):
543         * stress/map-untyped-normalize.js: Added.
544         (shouldBe):
545         (test):
546         * stress/set-untyped-normalize-cse.js: Added.
547         (shouldBe):
548         (set return.set has.set has):
549         * stress/set-untyped-normalize.js: Added.
550         (shouldBe):
551         (set return.set has):
552
553 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
554
555         [FTL] Support DeleteById and DeleteByVal
556         https://bugs.webkit.org/show_bug.cgi?id=180022
557
558         Reviewed by Saam Barati.
559
560         * stress/delete-by-id.js: Added.
561         (shouldBe):
562         (test1):
563         (test2):
564         * stress/delete-by-val-ftl.js: Added.
565         (shouldBe):
566         (test1):
567         (test2):
568
569 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
570
571         [DFG] Introduce {Set,Map,WeakMap}Fields
572         https://bugs.webkit.org/show_bug.cgi?id=179925
573
574         Reviewed by Saam Barati.
575
576         * stress/map-set-clobber-map-get.js: Added.
577         (shouldBe):
578         (test):
579         * stress/map-set-does-not-clobber-set-has.js: Added.
580         (shouldBe):
581         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
582         (shouldBe):
583         (test):
584         * stress/set-add-clobber-set-has.js: Added.
585         (shouldBe):
586         * stress/set-add-does-not-clobber-map-get.js: Added.
587         (shouldBe):
588
589 2017-11-24  Mark Lam  <mark.lam@apple.com>
590
591         Move unsafe jsc shell test functions to the $vm object.
592         https://bugs.webkit.org/show_bug.cgi?id=179980
593
594         Reviewed by Yusuke Suzuki.
595
596         * controlFlowProfiler/driver/driver.js:
597         * controlFlowProfiler/execution-count.js:
598         * controlFlowProfiler/if-statement.js:
599         * controlFlowProfiler/loop-statements.js:
600         * controlFlowProfiler/switch-statements.js:
601         * controlFlowProfiler/test-jit.js:
602         * exceptionFuzz/3d-cube.js:
603         * exceptionFuzz/date-format-xparb.js:
604         * exceptionFuzz/earley-boyer.js:
605         * heapProfiler/basic-edges.js:
606         * heapProfiler/property-edge-types.js:
607         * microbenchmarks/try-get-by-id-basic.js:
608         * microbenchmarks/try-get-by-id-polymorphic.js:
609         * modules/namespace-object-try-get.js:
610         * stress/argument-count-bytecode.js:
611         * stress/argument-intrinsic-basic.js:
612         * stress/argument-intrinsic-inlining-use-caller-arg.js:
613         * stress/argument-intrinsic-inlining-with-result-escape.js:
614         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
615         * stress/argument-intrinsic-inlining-with-vararg.js:
616         * stress/argument-intrinsic-nested-inlining.js:
617         * stress/argument-intrinsic-not-convert-to-get-argument.js:
618         * stress/argument-intrinsic-with-stack-write.js:
619         * stress/arity-mismatch-get-argument.js:
620         * stress/array-message-passing.js:
621         * stress/array-push-with-force-exit.js:
622         * stress/check-dom-with-signature.js:
623         * stress/check-sub-class.js:
624         * stress/compare-eq-incomplete-profile.js:
625         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
626         * stress/do-eval-virtual-call-correctly.js:
627         * stress/dom-jit-with-poly-proto.js:
628         * stress/domjit-exception-ic.js:
629         * stress/domjit-exception.js:
630         * stress/domjit-getter-complex-with-incorrect-object.js:
631         * stress/domjit-getter-complex.js:
632         * stress/domjit-getter-poly.js:
633         * stress/domjit-getter-proto.js:
634         * stress/domjit-getter-super-poly.js:
635         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
636         * stress/domjit-getter-type-check.js:
637         * stress/domjit-getter.js:
638         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
639         * stress/for-in-proxy-target-changed-structure.js:
640         * stress/for-in-proxy.js:
641         * stress/generational-opaque-roots.js:
642         * stress/global-const-redeclaration-setting-2.js:
643         * stress/global-const-redeclaration-setting-3.js:
644         * stress/global-const-redeclaration-setting-4.js:
645         * stress/global-const-redeclaration-setting-5.js:
646         * stress/global-const-redeclaration-setting.js:
647         * stress/import-basic.js:
648         * stress/import-from-eval.js:
649         * stress/import-reject-with-exception.js:
650         * stress/import-syntax.js:
651         * stress/impure-get-own-property-slot-inline-cache.js:
652         * stress/is-constructor.js:
653         * stress/istypedarrayview-intrinsic.js:
654         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
655         * stress/jsc-test-functions-should-be-more-robust.js:
656         * stress/object-toString-with-proxy.js:
657         * stress/poly-proto-custom-value-and-accessor.js:
658         * stress/proxy-inline-cache.js:
659         * stress/re-execute-error-module.js:
660         * stress/regress-150532.js:
661         * stress/regress-156992.js:
662         * stress/regress-179619.js:
663         * stress/resources/shadow-chicken-support.js:
664         * stress/runtime-array.js:
665         * stress/sampling-profiler-microtasks.js:
666         * stress/shadow-chicken-enabled.js:
667         * stress/spread-correct-global-object-on-exception.js:
668         * stress/super-get-by-id.js:
669         * stress/tailCallForwardArguments.js:
670         * stress/to-object-intrinsic-boolean-edge.js:
671         * stress/to-object-intrinsic-null-or-undefined-edge.js:
672         * stress/to-object-intrinsic-number-edge.js:
673         * stress/to-object-intrinsic-object-edge.js:
674         * stress/to-object-intrinsic-string-edge.js:
675         * stress/to-object-intrinsic-symbol-edge.js:
676         * stress/to-object-intrinsic.js:
677         * stress/try-catch-custom-getter-as-get-by-id.js:
678         * stress/try-get-by-id-poly-proto.js:
679         * stress/try-get-by-id-should-spill-registers-dfg.js:
680         * stress/try-get-by-id.js:
681         * typeProfiler/arrow-functions.js:
682         * typeProfiler/basic.js:
683         * typeProfiler/captured.js:
684         * typeProfiler/classes.js:
685         * typeProfiler/dfg-jit-optimizations.js:
686         * typeProfiler/dictionary-mode.js:
687         * typeProfiler/es6-block-scoping.js:
688         * typeProfiler/es6-classes.js:
689         * typeProfiler/inheritance.js:
690         * typeProfiler/int52-dfg.js:
691         * typeProfiler/loop.js:
692         * typeProfiler/optional-fields.js:
693         * typeProfiler/overflow.js:
694         * typeProfiler/return.js:
695         * typeProfiler/symbol.js:
696         * typeProfiler/weird-prototype-chain.js:
697
698 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
699
700         [DFG][FTL] Support MapSet / SetAdd intrinsics
701         https://bugs.webkit.org/show_bug.cgi?id=179858
702
703         Reviewed by Saam Barati.
704
705         * microbenchmarks/map-has-and-set.js: Added.
706         (test):
707         * stress/map-set-check-failure.js: Added.
708         (shouldBe):
709         (shouldThrow):
710         (target):
711         * stress/map-set-cse.js: Added.
712         (shouldBe):
713         (test):
714         * stress/set-add-check-failure.js: Added.
715         (shouldBe):
716         (shouldThrow):
717         (set shouldThrow):
718         * stress/set-add-cse.js: Added.
719         (shouldBe):
720
721 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
722
723         [JSC] Allow poly proto for intrinsic getters
724         https://bugs.webkit.org/show_bug.cgi?id=179550
725
726         Reviewed by Saam Barati.
727
728         This change is also tested by existing tests.
729
730             1. stress/intrinsic-getter-with-poly-proto.js
731             2. stress/poly-proto-intrinsic-getter-correctness.js
732
733         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
734         (shouldBe):
735         (makePolyProtoObject.foo.C):
736         (makePolyProtoObject.foo):
737         (makePolyProtoObject):
738         (target):
739         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
740         (shouldBe):
741         (makePolyProtoObject.foo.C):
742         (makePolyProtoObject.foo):
743         (makePolyProtoObject):
744         (target):
745
746 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
747
748         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
749         https://bugs.webkit.org/show_bug.cgi?id=179744
750
751         Reviewed by Michael Catanzaro.
752
753         This test uses too much memory for our buildbots on these platforms
754         and gets OOM-killed.
755
756         * stress/unshiftCountSlowCase-correct-postCapacity.js:
757         Skip if $memoryLimited and linux.
758
759 2017-11-17  JF Bastien  <jfbastien@apple.com>
760
761         WebAssembly JS API: throw when a promise can't be created
762         https://bugs.webkit.org/show_bug.cgi?id=179826
763         <rdar://problem/35455813>
764
765         Reviewed by Mark Lam.
766
767         Test WebAssembly.{compile,instantiate} where promise creation
768         fails because of a stack overflow.
769
770         * wasm/js-api/promise-stack-overflow.js: Added.
771         (const.runNearStackLimit.f.const.t):
772         (async.testCompile):
773         (async.testInstantiate):
774
775 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
776
777         Unreviewed, mark regress-178385.js as memory exhausting
778
779         * stress/regress-178385.js:
780
781 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
782
783         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
784
785         Unreviewed test gardening.
786
787         * test262.yaml:
788
789 2017-11-16  Robin Morisset  <rmorisset@apple.com>
790
791         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
792         https://bugs.webkit.org/show_bug.cgi?id=179763
793         <rdar://problem/35550513>
794
795         Reviewed by Keith Miller.
796
797         Just adding a slightly cleaned-up version of the original fuzzer-found test.
798
799         * stress/tdz-this-in-try-catch.js: Added.
800         (__v_6388):
801         (__v_6392):
802
803 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
804
805         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
806         https://bugs.webkit.org/show_bug.cgi?id=179594
807
808         Reviewed by Saam Barati.
809
810         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
811         (shouldBe):
812         (args):
813         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
814         (shouldBe):
815         (args):
816
817 2017-11-14  Saam Barati  <sbarati@apple.com>
818
819         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
820         https://bugs.webkit.org/show_bug.cgi?id=179639
821         <rdar://problem/35513018>
822
823         Reviewed by JF Bastien.
824
825         * wasm/function-tests/grow-memory-cause-gc.js: Added.
826         (escape):
827         (i.func):
828
829 2017-11-13  Mark Lam  <mark.lam@apple.com>
830
831         Add more overflow check book-keeping for MarkedArgumentBuffer.
832         https://bugs.webkit.org/show_bug.cgi?id=179634
833         <rdar://problem/35492517>
834
835         Reviewed by Saam Barati.
836
837         * stress/regress-179634.js: Added.
838
839 2017-11-13  Mark Lam  <mark.lam@apple.com>
840
841         Make the jsc shell loadGetterFromGetterSetter() function more robust.
842         https://bugs.webkit.org/show_bug.cgi?id=179619
843         <rdar://problem/35492518>
844
845         Reviewed by Saam Barati.
846
847         * stress/regress-179619.js: Added.
848
849 2017-11-12  Mark Lam  <mark.lam@apple.com>
850
851         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
852         https://bugs.webkit.org/show_bug.cgi?id=179562
853         <rdar://problem/35467022>
854
855         Reviewed by Saam Barati.
856
857         * regress-179562.js: Added.
858
859 2017-11-08  Saam Barati  <sbarati@apple.com>
860
861         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
862         https://bugs.webkit.org/show_bug.cgi?id=177792
863
864         Reviewed by Yusuke Suzuki.
865
866         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
867         (assert):
868         (foo.Foo.prototype.ensureX):
869         (foo.Foo):
870         (foo):
871         (access):
872
873 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
874
875         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
876         https://bugs.webkit.org/show_bug.cgi?id=178592
877
878         Unreviewed test gardening.
879
880         * test262.yaml:
881
882 2017-11-08  Robin Morisset  <rmorisset@apple.com>
883
884         Turn recursive tail calls into loops
885         https://bugs.webkit.org/show_bug.cgi?id=176601
886
887         Reviewed by Saam Barati.
888
889         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
890
891         Add some simple test that computes factorial in several ways, and other trivial computations.
892         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
893         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
894         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
895         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
896
897         * stress/inline-call-to-recursive-tail-call.js: Added.
898         (factorial.aux):
899         (factorial):
900         (factorial2.aux2):
901         (factorial2.id):
902         (factorial2):
903         (factorial3.aux3):
904         (factorial3):
905         (aux4):
906         (factorial4):
907         (foo):
908         (auxBar):
909         (bar):
910         (test):
911
912 2017-11-07  Mark Lam  <mark.lam@apple.com>
913
914         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
915         https://bugs.webkit.org/show_bug.cgi?id=179355
916         <rdar://problem/35263053>
917
918         Reviewed by Saam Barati.
919
920         * stress/regress-179355.js: Added.
921
922 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
923
924         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
925         https://bugs.webkit.org/show_bug.cgi?id=144458
926
927         Reviewed by Saam Barati.
928
929         * microbenchmarks/dfg-internal-function-call.js: Added.
930         (target):
931         * microbenchmarks/dfg-internal-function-construct.js: Added.
932         (target):
933         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
934         (target):
935         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
936         (target):
937         * stress/dfg-internal-function-call.js: Added.
938         (shouldBe):
939         (target):
940         * stress/dfg-internal-function-construct.js: Added.
941         (shouldBe):
942         (target):
943         * stress/internal-function-call.js: Added.
944         (shouldBe):
945         * stress/internal-function-construct.js: Added.
946         (shouldBe):
947
948 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
949
950         [Win] Skip stress/regress-178385.js.
951         https://bugs.webkit.org/show_bug.cgi?id=179298
952
953         Unreviewed test gardening.
954
955         * stress/regress-178385.js:
956
957 2017-11-03  Keith Miller  <keith_miller@apple.com>
958
959         Add test for ic with side effects
960         https://bugs.webkit.org/show_bug.cgi?id=179268
961
962         Reviewed by Saam Barati.
963
964         * stress/put-inline-cache-side-effects.js: Added.
965         (let.i.of.objs.keys):
966         (f):
967
968 2017-11-03  Mark Lam  <mark.lam@apple.com>
969
970         CachedCall (and its clients) needs overflow checks.
971         https://bugs.webkit.org/show_bug.cgi?id=179185
972
973         Reviewed by JF Bastien.
974
975         * stress/regress-179185.js: Added.
976
977 2017-11-02  Michael Saboff  <msaboff@apple.com>
978
979         DFG needs to handle code motion of code in for..in loop bodies
980         https://bugs.webkit.org/show_bug.cgi?id=179212
981
982         Reviewed by Keith Miller.
983
984         New regression test.
985
986         * stress/for-in-side-effects.js: Added.
987         (getPrototypeOf):
988         (reset):
989         (testWithoutFTL.f):
990         (testWithoutFTL):
991         (testWithFTL.f):
992         (testWithFTL):
993
994 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
995
996         AI does not correctly model the clobber case of ArithClz32
997         https://bugs.webkit.org/show_bug.cgi?id=179188
998
999         Reviewed by Michael Saboff.
1000
1001         * stress/arith-clz32-effects.js: Added.
1002         (foo):
1003         (valueOf):
1004
1005 2017-11-01  Michael Saboff  <msaboff@apple.com>
1006
1007         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1008         https://bugs.webkit.org/show_bug.cgi?id=179140
1009
1010         Reviewed by Saam Barati.
1011
1012         New regression test.
1013
1014         * stress/regress-179140.js: Added.
1015         (testWithoutFTL):
1016         (testWithFTL):
1017
1018 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1019
1020         [JSC] Introduce @toObject
1021         https://bugs.webkit.org/show_bug.cgi?id=178726
1022
1023         Reviewed by Saam Barati.
1024
1025         * stress/array-copywithin.js:
1026         (shouldThrow):
1027         * stress/object-constructor-boolean-edge.js: Added.
1028         (shouldBe):
1029         (test):
1030         * stress/object-constructor-global.js: Added.
1031         (shouldBe):
1032         * stress/object-constructor-null-edge.js: Added.
1033         (shouldBe):
1034         (test):
1035         * stress/object-constructor-number-edge.js: Added.
1036         (shouldBe):
1037         (test):
1038         * stress/object-constructor-object-edge.js: Added.
1039         (shouldBe):
1040         (test):
1041         (i.arg):
1042         * stress/object-constructor-string-edge.js: Added.
1043         (shouldBe):
1044         (test):
1045         * stress/object-constructor-symbol-edge.js: Added.
1046         (shouldBe):
1047         (test):
1048         * stress/object-constructor-undefined-edge.js: Added.
1049         (shouldBe):
1050         (test):
1051         * stress/symbol-array-from.js: Added.
1052         (shouldBe):
1053         * stress/to-object-intrinsic-boolean-edge.js: Added.
1054         (shouldBe):
1055         (builtin.createBuiltin):
1056         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1057         (shouldThrow):
1058         * stress/to-object-intrinsic-number-edge.js: Added.
1059         (shouldBe):
1060         (builtin.createBuiltin):
1061         * stress/to-object-intrinsic-object-edge.js: Added.
1062         (shouldBe):
1063         (builtin.createBuiltin):
1064         (i.arg):
1065         * stress/to-object-intrinsic-string-edge.js: Added.
1066         (shouldBe):
1067         (builtin.createBuiltin):
1068         * stress/to-object-intrinsic-symbol-edge.js: Added.
1069         (shouldBe):
1070         (builtin.createBuiltin):
1071         * stress/to-object-intrinsic.js: Added.
1072         (shouldBe):
1073         (shouldThrow):
1074         (builtin.createBuiltin):
1075
1076 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1077
1078         [DFG][FTL] Introduce StringSlice
1079         https://bugs.webkit.org/show_bug.cgi?id=178934
1080
1081         Reviewed by Saam Barati.
1082
1083         * microbenchmarks/string-slice-empty.js: Added.
1084         (slice):
1085         * microbenchmarks/string-slice-one-char.js: Added.
1086         (slice):
1087         * microbenchmarks/string-slice.js: Added.
1088         (slice):
1089
1090 2017-10-26  Michael Saboff  <msaboff@apple.com>
1091
1092         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1093         https://bugs.webkit.org/show_bug.cgi?id=178890
1094
1095         Reviewed by Keith Miller.
1096
1097         New regression test.
1098
1099         * stress/regress-178890.js: Added.
1100
1101 2017-10-26  Mark Lam  <mark.lam@apple.com>
1102
1103         JSRopeString::RopeBuilder::append() should check for overflows.
1104         https://bugs.webkit.org/show_bug.cgi?id=178385
1105         <rdar://problem/35027468>
1106
1107         Reviewed by Saam Barati.
1108
1109         * stress/regress-178385.js: Added.
1110
1111 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1112
1113         Unreviewed, rolling out r223961.
1114
1115         The change that required this has been rolled out.
1116
1117         Reverted changeset:
1118
1119         "Mark test262.yaml/test262/test/language/statements/try/tco-
1120         catch.js as passing."
1121         https://bugs.webkit.org/show_bug.cgi?id=178592
1122         https://trac.webkit.org/changeset/223961
1123
1124 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1125
1126         Unreviewed, rolling out r223691 and r223729.
1127         https://bugs.webkit.org/show_bug.cgi?id=178834
1128
1129         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1130         by rniwa on #webkit).
1131
1132         Reverted changesets:
1133
1134         "Turn recursive tail calls into loops"
1135         https://bugs.webkit.org/show_bug.cgi?id=176601
1136         https://trac.webkit.org/changeset/223691
1137
1138         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1139         comparison is always false due to limited range of data type
1140         [-Wtype-limits]"
1141         https://bugs.webkit.org/show_bug.cgi?id=178543
1142         https://trac.webkit.org/changeset/223729
1143
1144 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1145
1146         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1147         https://bugs.webkit.org/show_bug.cgi?id=178592
1148
1149         Unreviewed test gardening.
1150
1151         * test262.yaml:
1152
1153 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1154
1155         [FTL] Support NewStringObject
1156         https://bugs.webkit.org/show_bug.cgi?id=178737
1157
1158         Reviewed by Saam Barati.
1159
1160         * stress/new-string-object.js: Added.
1161         (shouldBe):
1162         (test):
1163
1164 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1165
1166         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1167         https://bugs.webkit.org/show_bug.cgi?id=178308
1168
1169         Reviewed by Mark Lam.
1170
1171         * test262.yaml:
1172
1173 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1174
1175         [JSC] Use fastJoin in Array#toString
1176         https://bugs.webkit.org/show_bug.cgi?id=178062
1177
1178         Reviewed by Darin Adler.
1179
1180         * microbenchmarks/contiguous-array-to-string.js: Added.
1181         (target):
1182         * microbenchmarks/double-array-to-string.js: Added.
1183         (target):
1184         * microbenchmarks/int32-array-to-string.js: Added.
1185         (target):
1186
1187 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1188
1189         stress/check-string-ident.js is improperly skipped
1190         https://bugs.webkit.org/show_bug.cgi?id=178642
1191
1192         Reviewed by Saam Barati.
1193
1194         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1195         since it enforces the run-jsc-stress-tests script to still set up the
1196         test to run, despite the skip directive that's used before.
1197
1198 2017-10-20  Mark Lam  <mark.lam@apple.com>
1199
1200         Add a test case for r214334.
1201         https://bugs.webkit.org/show_bug.cgi?id=169941
1202         <rdar://problem/31221258>
1203
1204         Reviewed by JF Bastien.
1205
1206         * stress/regress-169941.js: Added.
1207
1208 2017-10-19  JF Bastien  <jfbastien@apple.com>
1209
1210         WebAssembly: no VM / JS version of everything but Instance
1211         https://bugs.webkit.org/show_bug.cgi?id=177473
1212
1213         Reviewed by Filip Pizlo, Saam Barati.
1214
1215         - Exceeding max on memory growth now returns a range error as per
1216         spec. This is a (very minor) breaking change: it used to throw OOM
1217         error. Update the corresponding test.
1218
1219         * wasm/js-api/memory-grow.js:
1220         (assertEq):
1221         * wasm/js-api/table.js:
1222         (assert.throws):
1223
1224 2017-10-19  Mark Lam  <mark.lam@apple.com>
1225
1226         Stringifier::appendStringifiedValue() is missing an exception check.
1227         https://bugs.webkit.org/show_bug.cgi?id=178386
1228         <rdar://problem/35027610>
1229
1230         Reviewed by Saam Barati.
1231
1232         * stress/regress-178386.js: Added.
1233
1234 2017-10-19  Michael Saboff  <msaboff@apple.com>
1235
1236         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1237         https://bugs.webkit.org/show_bug.cgi?id=178521
1238
1239         Reviewed by JF Bastien.
1240
1241         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1242         now passes with the current version (5.0) of the Emoji spec.
1243
1244 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1245
1246         Turn recursive tail calls into loops
1247         https://bugs.webkit.org/show_bug.cgi?id=176601
1248
1249         Reviewed by Saam Barati.
1250
1251         Add some simple test that computes factorial in several ways, and other trivial computations.
1252         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1253         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1254         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1255         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1256
1257         * stress/inline-call-to-recursive-tail-call.js: Added.
1258         (factorial.aux):
1259         (factorial):
1260         (factorial2.aux):
1261         (factorial2.id):
1262         (factorial2):
1263         (factorial3.aux):
1264         (factorial3):
1265         (aux):
1266         (factorial4):
1267         (test):
1268
1269 2017-10-18  Mark Lam  <mark.lam@apple.com>
1270
1271         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1272         https://bugs.webkit.org/show_bug.cgi?id=177600
1273         <rdar://problem/34710985>
1274
1275         Reviewed by Saam Barati.
1276
1277         * stress/regress-177600.js: Added.
1278
1279 2017-10-18  Mark Lam  <mark.lam@apple.com>
1280
1281         The compiler should always register a structure when it adds its transitionWatchPointSet.
1282         https://bugs.webkit.org/show_bug.cgi?id=178420
1283         <rdar://problem/34814024>
1284
1285         Reviewed by Saam Barati and Filip Pizlo.
1286
1287         * stress/regress-178420.js: Added.
1288         (new.Array.10000.map):
1289
1290 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1291
1292         [JSC] __proto__ getter should be fast
1293         https://bugs.webkit.org/show_bug.cgi?id=178067
1294
1295         Reviewed by Saam Barati.
1296
1297         * stress/dfg-object-proto-accessor.js: Added.
1298         (shouldBe):
1299         (shouldThrow):
1300         (target):
1301         * stress/dfg-object-proto-getter.js: Added.
1302         (shouldBe):
1303         (shouldThrow):
1304         (target):
1305         * stress/dfg-object-prototype-of.js: Added.
1306         (shouldBe):
1307         (shouldThrow):
1308         (target):
1309         * stress/dfg-reflect-get-prototype-of.js: Added.
1310         (shouldBe):
1311         (shouldThrow):
1312         (target):
1313         * stress/intrinsic-getter-with-poly-proto.js: Added.
1314         (shouldBe):
1315         (makePolyProtoObject.foo.C):
1316         (makePolyProtoObject.foo):
1317         (makePolyProtoObject):
1318         (target):
1319         * stress/object-get-prototype-of-filtered.js: Added.
1320         (shouldBe):
1321         (shouldThrow):
1322         (target):
1323         (i.Cocoa):
1324         * stress/object-get-prototype-of-mono-proto.js: Added.
1325         (shouldBe):
1326         (makePolyProtoObject.foo.C):
1327         (makePolyProtoObject.foo):
1328         (makePolyProtoObject):
1329         (target):
1330         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1331         (shouldBe):
1332         (makePolyProtoObject.foo.C):
1333         (makePolyProtoObject.foo):
1334         (makePolyProtoObject):
1335         (target):
1336         * stress/object-get-prototype-of-poly-proto.js: Added.
1337         (shouldBe):
1338         (makePolyProtoObject.foo.C):
1339         (makePolyProtoObject.foo):
1340         (makePolyProtoObject):
1341         (target):
1342         * stress/object-proto-getter-filtered.js: Added.
1343         (shouldBe):
1344         (shouldThrow):
1345         (target):
1346         (i.Cocoa):
1347         * stress/object-proto-getter-poly-mono-proto.js: Added.
1348         (shouldBe):
1349         (makePolyProtoObject.foo.C):
1350         (makePolyProtoObject.foo):
1351         (makePolyProtoObject):
1352         (target):
1353         * stress/object-proto-getter-poly-proto.js: Added.
1354         (shouldBe):
1355         (makePolyProtoObject.foo.C):
1356         (makePolyProtoObject.foo):
1357         (makePolyProtoObject):
1358         (target):
1359         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1360         * stress/string-proto.js: Added.
1361         (shouldBe):
1362         (target):
1363
1364 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1365
1366         Unreviewed, rolling out r223523.
1367
1368         A test for this change is failing on debug JSC bots.
1369
1370         Reverted changeset:
1371
1372         "[JSC] __proto__ getter should be fast"
1373         https://bugs.webkit.org/show_bug.cgi?id=178067
1374         https://trac.webkit.org/changeset/223523
1375
1376 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1377
1378         [JSC] __proto__ getter should be fast
1379         https://bugs.webkit.org/show_bug.cgi?id=178067
1380
1381         Reviewed by Saam Barati.
1382
1383         * stress/dfg-object-proto-accessor.js: Added.
1384         (shouldBe):
1385         (shouldThrow):
1386         (target):
1387         * stress/dfg-object-proto-getter.js: Added.
1388         (shouldBe):
1389         (shouldThrow):
1390         (target):
1391         * stress/dfg-object-prototype-of.js: Added.
1392         (shouldBe):
1393         (shouldThrow):
1394         (target):
1395         * stress/dfg-reflect-get-prototype-of.js: Added.
1396         (shouldBe):
1397         (shouldThrow):
1398         (target):
1399         * stress/object-get-prototype-of-filtered.js: Added.
1400         (shouldBe):
1401         (shouldThrow):
1402         (target):
1403         (i.Cocoa):
1404         * stress/object-get-prototype-of-mono-proto.js: Added.
1405         (shouldBe):
1406         (makePolyProtoObject.foo.C):
1407         (makePolyProtoObject.foo):
1408         (makePolyProtoObject):
1409         (target):
1410         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1411         (shouldBe):
1412         (makePolyProtoObject.foo.C):
1413         (makePolyProtoObject.foo):
1414         (makePolyProtoObject):
1415         (target):
1416         * stress/object-get-prototype-of-poly-proto.js: Added.
1417         (shouldBe):
1418         (makePolyProtoObject.foo.C):
1419         (makePolyProtoObject.foo):
1420         (makePolyProtoObject):
1421         (target):
1422         * stress/object-proto-getter-filtered.js: Added.
1423         (shouldBe):
1424         (shouldThrow):
1425         (target):
1426         (i.Cocoa):
1427         * stress/object-proto-getter-poly-mono-proto.js: Added.
1428         (shouldBe):
1429         (makePolyProtoObject.foo.C):
1430         (makePolyProtoObject.foo):
1431         (makePolyProtoObject):
1432         (target):
1433         * stress/object-proto-getter-poly-proto.js: Added.
1434         (shouldBe):
1435         (makePolyProtoObject.foo.C):
1436         (makePolyProtoObject.foo):
1437         (makePolyProtoObject):
1438         (target):
1439         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1440         * stress/string-proto.js: Added.
1441         (shouldBe):
1442         (target):
1443
1444 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1445
1446         Reland "Add Above/Below comparisons for UInt32 patterns"
1447         https://bugs.webkit.org/show_bug.cgi?id=177281
1448
1449         Reviewed by Saam Barati.
1450
1451         * stress/uint32-comparison-jump.js: Added.
1452         (shouldBe):
1453         (above):
1454         (aboveOrEqual):
1455         (below):
1456         (belowOrEqual):
1457         (notAbove):
1458         (notAboveOrEqual):
1459         (notBelow):
1460         (notBelowOrEqual):
1461         * stress/uint32-comparison.js: Added.
1462         (shouldBe):
1463         (above):
1464         (aboveOrEqual):
1465         (below):
1466         (belowOrEqual):
1467         (aboveTest):
1468         (aboveOrEqualTest):
1469         (belowTest):
1470         (belowOrEqualTest):
1471
1472 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1473
1474         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1475         https://bugs.webkit.org/show_bug.cgi?id=178210
1476
1477         Reviewed by Saam Barati.
1478
1479         * wasm/function-tests/trap-from-start-async.js:
1480         (async.StartTrapsAsync):
1481         * wasm/function-tests/trap-from-start.js:
1482         (StartTraps):
1483         * wasm/js-api/web-assembly-function.js:
1484         (assert.eq.Object.getPrototypeOf):
1485         * wasm/js-api/wrapper-function.js:
1486         (return.new.WebAssembly.Module):
1487         (assert.throws.makeInstance): Deleted.
1488         (assert.throws.Bar): Deleted.
1489         (assert.throws): Deleted.
1490
1491 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1492
1493         Enable gigacage on iOS
1494         https://bugs.webkit.org/show_bug.cgi?id=177586
1495
1496         Reviewed by JF Bastien.
1497         
1498         Add tests for when Gigacage gets runtime disabled.
1499
1500         * stress/disable-gigacage-arrays.js: Added.
1501         (foo):
1502         * stress/disable-gigacage-strings.js: Added.
1503         (foo):
1504         * stress/disable-gigacage-typed-arrays.js: Added.
1505         (foo):
1506
1507 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1508
1509         import.meta should not be assignable
1510         https://bugs.webkit.org/show_bug.cgi?id=178202
1511
1512         Reviewed by Saam Barati.
1513
1514         * modules/import-meta-assignment.js: Added.
1515         (shouldThrow):
1516         (SyntaxError.import.meta.can.shouldThrow):
1517
1518 2017-10-11  Saam Barati  <sbarati@apple.com>
1519
1520         Unreviewed. Actually skip certain type profiler tests in debug.
1521
1522         * typeProfiler.yaml:
1523         * typeProfiler/deltablue-for-of.js:
1524         * typeProfiler/getter-richards.js:
1525
1526 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1527
1528         Unreviewed, rolling out r223113 and r223121.
1529         https://bugs.webkit.org/show_bug.cgi?id=178182
1530
1531         Reintroduced 20% regression on Kraken (Requested by rniwa on
1532         #webkit).
1533
1534         Reverted changesets:
1535
1536         "Enable gigacage on iOS"
1537         https://bugs.webkit.org/show_bug.cgi?id=177586
1538         https://trac.webkit.org/changeset/223113
1539
1540         "Use one virtual allocation for all gigacages and their
1541         runways"
1542         https://bugs.webkit.org/show_bug.cgi?id=178050
1543         https://trac.webkit.org/changeset/223121
1544
1545 2017-10-11  Michael Saboff  <msaboff@apple.com>
1546
1547         Disable test262 named capture group tests with direct unicode names and with references before definitions
1548         https://bugs.webkit.org/show_bug.cgi?id=178177
1549
1550         Reviewed by Keith Miller.
1551
1552         Bugs to track fixing these test are:
1553         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1554             "Add support in named capture group identifiers for direct surrogate pairs"
1555         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1556             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1557
1558         * test262.yaml:
1559
1560 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1561
1562         Object properties are undefined in super.call() but not in this.call()
1563         https://bugs.webkit.org/show_bug.cgi?id=177230
1564
1565         Reviewed by Saam Barati.
1566
1567         * stress/super-call-function-subclass.js: Added.
1568         (assert):
1569         (A.prototype.t):
1570         (A):
1571         * stress/super-dot-call-and-apply.js: Added.
1572         (assert):
1573         (A):
1574         (A.prototype.call):
1575         (A.prototype.apply):
1576         (B.prototype.testSuper):
1577         (B):
1578         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1579         (D.prototype.testSuper):
1580         (D):
1581
1582 2017-10-10  Saam Barati  <sbarati@apple.com>
1583
1584         The prototype cache should be aware of the Executable it generates a Structure for
1585         https://bugs.webkit.org/show_bug.cgi?id=177907
1586
1587         Reviewed by Filip Pizlo.
1588
1589         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1590         (assert):
1591         (foo.C):
1592         (foo):
1593         (bar.C):
1594         (bar):
1595         (access):
1596         (makeLongChain):
1597         (accessY):
1598
1599 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1600
1601         `async` should be able to be used as an imported binding name
1602         https://bugs.webkit.org/show_bug.cgi?id=176573
1603
1604         Reviewed by Saam Barati.
1605
1606         * modules/import-default-async.js: Added.
1607         * modules/import-named-async-as.js: Added.
1608         * modules/import-named-async.js: Added.
1609         * modules/import-named-async/target.js: Added.
1610         * modules/import-namespace-async.js: Added.
1611         * test262.yaml:
1612
1613 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1614
1615         Enable gigacage on iOS
1616         https://bugs.webkit.org/show_bug.cgi?id=177586
1617
1618         Reviewed by JF Bastien.
1619         
1620         Add tests for when Gigacage gets runtime disabled.
1621
1622         * stress/disable-gigacage-arrays.js: Added.
1623         (foo):
1624         * stress/disable-gigacage-strings.js: Added.
1625         (foo):
1626         * stress/disable-gigacage-typed-arrays.js: Added.
1627         (foo):
1628
1629 2017-10-09  Michael Saboff  <msaboff@apple.com>
1630
1631         Implement RegExp Unicode property escapes
1632         https://bugs.webkit.org/show_bug.cgi?id=172069
1633
1634         Reviewed by JF Bastien.
1635
1636         Enabled Unicode Property tests.
1637
1638         * test262.yaml:
1639
1640 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1641
1642         Unreviewed, rolling out r223015 and r223025.
1643         https://bugs.webkit.org/show_bug.cgi?id=178093
1644
1645         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1646         #webkit).
1647
1648         Reverted changesets:
1649
1650         "Enable gigacage on iOS"
1651         https://bugs.webkit.org/show_bug.cgi?id=177586
1652         http://trac.webkit.org/changeset/223015
1653
1654         "Unreviewed, disable Gigacage on ARM64 Linux"
1655         https://bugs.webkit.org/show_bug.cgi?id=177586
1656         http://trac.webkit.org/changeset/223025
1657
1658 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1659
1660         Update expectations for test262 tests that pass after r223043.
1661         https://bugs.webkit.org/show_bug.cgi?id=176685
1662
1663         Unreviewed test gardening.
1664
1665         * test262.yaml:
1666
1667 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1668
1669         Unreviewed, rolling out r223022.
1670
1671         This change introduced 18 test262 failures.
1672
1673         Reverted changeset:
1674
1675         "`async` should be able to be used as an imported binding
1676         name"
1677         https://bugs.webkit.org/show_bug.cgi?id=176573
1678         http://trac.webkit.org/changeset/223022
1679
1680 2017-10-09  Saam Barati  <sbarati@apple.com>
1681
1682         3 poly-proto JSC tests timing out on debug after r222827
1683         https://bugs.webkit.org/show_bug.cgi?id=177880
1684         <rdar://problem/34817122>
1685
1686         Unreviewed.
1687
1688         I'm skipping these type profiler tests on debug since they are long running.
1689
1690         * typeProfiler/deltablue-for-of.js:
1691         * typeProfiler/getter-richards.js:
1692
1693 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1694
1695         Safari 10 /11 problem with if (!await get(something)).
1696         https://bugs.webkit.org/show_bug.cgi?id=176685
1697
1698         Reviewed by Saam Barati.
1699
1700         * stress/async-await-basic.js:
1701         (awaitEpression.async):
1702         * stress/async-await-syntax.js:
1703         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1704         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1705
1706 2017-10-08  Saam Barati  <sbarati@apple.com>
1707
1708         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1709
1710         * typeProfiler/deltablue-for-of.js:
1711         * typeProfiler/getter-richards.js:
1712
1713 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1714
1715         `async` should be able to be used as an imported binding name
1716         https://bugs.webkit.org/show_bug.cgi?id=176573
1717
1718         Reviewed by Darin Adler.
1719
1720         * modules/import-default-async.js: Added.
1721         * modules/import-named-async-as.js: Added.
1722         * modules/import-named-async.js: Added.
1723         * modules/import-named-async/target.js: Added.
1724         * modules/import-namespace-async.js: Added.
1725
1726 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1727
1728         Enable gigacage on iOS
1729         https://bugs.webkit.org/show_bug.cgi?id=177586
1730
1731         Reviewed by JF Bastien.
1732         
1733         Add tests for when Gigacage gets runtime disabled.
1734
1735         * stress/disable-gigacage-arrays.js: Added.
1736         (foo):
1737         * stress/disable-gigacage-strings.js: Added.
1738         (foo):
1739         * stress/disable-gigacage-typed-arrays.js: Added.
1740         (foo):
1741
1742 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1743
1744         Unreviewed, rolling out r222791 and r222873.
1745         https://bugs.webkit.org/show_bug.cgi?id=178031
1746
1747         Caused crashes with workers/wasm LayoutTests (Requested by
1748         ryanhaddad on #webkit).
1749
1750         Reverted changesets:
1751
1752         "WebAssembly: no VM / JS version of everything but Instance"
1753         https://bugs.webkit.org/show_bug.cgi?id=177473
1754         http://trac.webkit.org/changeset/222791
1755
1756         "WebAssembly: address no VM / JS follow-ups"
1757         https://bugs.webkit.org/show_bug.cgi?id=177887
1758         http://trac.webkit.org/changeset/222873
1759
1760 2017-10-05  Saam Barati  <sbarati@apple.com>
1761
1762         Make sure all prototypes under poly proto get added into the VM's prototype map
1763         https://bugs.webkit.org/show_bug.cgi?id=177909
1764
1765         Reviewed by Keith Miller.
1766
1767         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1768         (assert):
1769         (foo.C):
1770         (foo):
1771         (set x):
1772
1773 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1774
1775         [JSC] Introduce import.meta
1776         https://bugs.webkit.org/show_bug.cgi?id=177703
1777
1778         Reviewed by Filip Pizlo.
1779
1780         * modules/import-meta-syntax.js: Added.
1781         (shouldThrow):
1782         (shouldNotThrow):
1783         * modules/import-meta.js: Added.
1784         * modules/import-meta/cocoa.js: Added.
1785         * modules/resources/assert.js:
1786         (export.shouldNotThrow):
1787         * stress/import-syntax.js:
1788
1789 2017-10-04  Saam Barati  <sbarati@apple.com>
1790
1791         Make pertinent AccessCases watch the poly proto watchpoint
1792         https://bugs.webkit.org/show_bug.cgi?id=177765
1793
1794         Reviewed by Keith Miller.
1795
1796         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1797         (assert):
1798         (foo.C):
1799         (foo):
1800         (validate):
1801         * stress/poly-proto-clear-stub.js: Added.
1802         (assert):
1803         (foo.C):
1804         (foo):
1805
1806 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1807
1808         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1809
1810         Unreviewed test gardening.
1811
1812         * test262.yaml:
1813
1814 2017-10-04  Saam Barati  <sbarati@apple.com>
1815
1816         3 poly-proto JSC tests timing out on debug after r222827
1817         https://bugs.webkit.org/show_bug.cgi?id=177880
1818
1819         Rubber stamped by Mark Lam.
1820
1821         * microbenchmarks/poly-proto-access.js:
1822         * typeProfiler/deltablue-for-of.js:
1823         * typeProfiler/getter-richards.js:
1824
1825 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1826
1827         Unreviewed, marking tco-catch.js as a failure after test262 update
1828         https://bugs.webkit.org/show_bug.cgi?id=177859
1829
1830         * test262.yaml:
1831
1832 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1833
1834         Unreviewed, marking one async iterator test262 test failed
1835         https://bugs.webkit.org/show_bug.cgi?id=177859
1836
1837         * test262.yaml:
1838
1839 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1840
1841         [Test262] Update Test262 to Oct 4 version
1842         https://bugs.webkit.org/show_bug.cgi?id=177859
1843
1844         Reviewed by Sam Weinig.
1845
1846         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1847         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1848
1849         * test262.yaml:
1850         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1851         (checkSequence):
1852         * test262/harness/typeCoercion.js:
1853         (testCoercibleToIndexZero):
1854         (testCoercibleToIndexOne):
1855         (testCoercibleToIndexFromIndex):
1856         (testNotCoercibleToIndex.testPrimitiveValue):
1857         (testNotCoercibleToInteger):
1858         (testCoercibleToBigIntZero.testPrimitiveValue):
1859         (testCoercibleToBigIntZero):
1860         (testCoercibleToBigIntOne.testPrimitiveValue):
1861         (testCoercibleToBigIntOne):
1862         (testPrimitiveValue):
1863         (testCoercibleToBigIntFromBigInt):
1864         (testNotCoercibleToBigInt.testPrimitiveValue):
1865         (testNotCoercibleToBigInt.testStringValue):
1866         (testNotCoercibleToBigInt):
1867         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1868         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1869         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1870         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1871         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1872         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1873         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1874         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1875         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1876         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1877         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1878         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1879         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1880         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1881         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1882         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1883         (testCoercibleToBigIntZero):
1884         (testCoercibleToBigIntOne):
1885         (testNotCoercibleToBigInt):
1886         (MyError): Deleted.
1887         (valueOf): Deleted.
1888         (toString): Deleted.
1889         (Symbol.toPrimitive): Deleted.
1890         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1891         (testCoercibleToIndexZero):
1892         (testCoercibleToIndexOne):
1893         (testNotCoercibleToIndex):
1894         (MyError): Deleted.
1895         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1896         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1897         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1898         (BigInt.asIntN.valueOf): Deleted.
1899         (BigInt.asIntN.toString): Deleted.
1900         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1901         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1902         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1903         (testCoercibleToBigIntZero):
1904         (testCoercibleToBigIntOne):
1905         (testNotCoercibleToBigInt):
1906         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1907         (testCoercibleToIndexZero):
1908         (testCoercibleToIndexOne):
1909         (testNotCoercibleToIndex):
1910         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1911         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1912         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1913         (bits.valueOf):
1914         (bigint.valueOf):
1915         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1916         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1917         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1918         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1919         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1920         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1921         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1922         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1923         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1924         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1925         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1926         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1927         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1928         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1929         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1930         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1931         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1932         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1933         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1934         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1935         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1936         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1937         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1938         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1939         (replacer):
1940         (BigInt.prototype.toJSON):
1941         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1942         (replacer):
1943         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1944         (BigInt.prototype.toJSON):
1945         * test262/test/built-ins/JSON/stringify/bigint.js:
1946         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1947         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1948         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1949         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1950         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1951         * test262/test/built-ins/Object/proto-from-ctor.js:
1952         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1953         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1954         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1955         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1956         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1957         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1958         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1959         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1960         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1961         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1962         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1963         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1964         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1965         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1966         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1967         * test262/test/built-ins/Proxy/get-fn-realm.js:
1968         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1969         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1970         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1971         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1972         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1973         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1974         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1975         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1976         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1977         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1978         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1979         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1980         (i6.replace):
1981         (i6b.replace):
1982         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1983         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1984         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1985         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1986         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1987         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1988         * test262/test/built-ins/RegExp/u180e.js: Added.
1989         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1990         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1991         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1992         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1993         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1994         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1995         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1996         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1997         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1998         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1999         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2000         * test262/test/built-ins/String/prototype/endsWith/length.js:
2001         * test262/test/built-ins/String/prototype/endsWith/name.js:
2002         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2003         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2004         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2005         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2006         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2007         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2008         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2009         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2010         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2011         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2012         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2013         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2014         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2015         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2016         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2017         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2018         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2019         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2020         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2021         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2022         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2023         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2024         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2025         * test262/test/built-ins/String/prototype/includes/includes.js:
2026         * test262/test/built-ins/String/prototype/includes/length.js:
2027         * test262/test/built-ins/String/prototype/includes/name.js:
2028         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2029         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2030         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2031         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2032         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2033         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2034         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2035         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2036         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2037         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2038         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2039         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2040         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2041         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2042         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2043         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2044         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2045         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2046         * test262/test/built-ins/String/prototype/trim/u180e.js:
2047         * test262/test/built-ins/Symbol/for/cross-realm.js:
2048         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2049         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2050         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2051         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2052         * test262/test/built-ins/Symbol/match/cross-realm.js:
2053         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2054         * test262/test/built-ins/Symbol/search/cross-realm.js:
2055         * test262/test/built-ins/Symbol/species/cross-realm.js:
2056         * test262/test/built-ins/Symbol/split/cross-realm.js:
2057         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2058         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2059         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2060         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2061         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2062         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2063         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2064         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2065         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2066         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2067         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2068         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2069         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2070         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2071         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2072         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2073         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2074         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2075         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2076         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2077         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2078         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2079         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2080         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2081         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2082         * test262/test/language/eval-code/indirect/realm.js:
2083         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2084         (o.get z):
2085         (o.get a):
2086         * test262/test/language/expressions/call/eval-realm-indirect.js:
2087         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2088         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2089         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2090         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2091         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2092         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2093         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2094         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2095         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2096         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2097         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2098         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2099         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2100         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2101         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2102         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2103         * test262/test/language/expressions/less-than/bigint-and-number.js:
2104         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2105         * test262/test/language/expressions/super/realm.js:
2106         * test262/test/language/expressions/tagged-template/cache-realm.js:
2107         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2108         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2109         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2110         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2111         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2112         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2113         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2114         (o.get z):
2115         (o.get a):
2116         * test262/test/language/statements/for-of/iterator-next-reference.js:
2117         (next):
2118         (iterator.next): Deleted.
2119         (x.of.iterable.): Deleted.
2120         (x.of.iterable.get return): Deleted.
2121         (x.of.iterable.iterator.next): Deleted.
2122         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2123         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2124         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2125         * test262/test/language/white-space/mongolian-vowel-separator.js:
2126         * test262/test262-Revision.txt:
2127
2128 2017-10-03  Saam Barati  <sbarati@apple.com>
2129
2130         Implement polymorphic prototypes
2131         https://bugs.webkit.org/show_bug.cgi?id=176391
2132
2133         Reviewed by Filip Pizlo.
2134
2135         * microbenchmarks/poly-proto-access.js: Added.
2136         (assert):
2137         (foo.C):
2138         (foo.C.prototype.get bar):
2139         (foo):
2140         (bar):
2141         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2142         (assert):
2143         (makePolyProtoObject.foo.C):
2144         (makePolyProtoObject.foo):
2145         (makePolyProtoObject):
2146         (performSet):
2147         * microbenchmarks/poly-proto-setter-speed.js: Added.
2148         (assert):
2149         (makePolyProtoObject.foo.C):
2150         (makePolyProtoObject.foo.C.prototype.set p):
2151         (makePolyProtoObject.foo):
2152         (makePolyProtoObject):
2153         (performSet):
2154         * stress/constructor-with-return.js:
2155         (i.tests.forEach.Constructor):
2156         (i.tests.forEach):
2157         (tests.forEach.Constructor): Deleted.
2158         (tests.forEach): Deleted.
2159         * stress/dom-jit-with-poly-proto.js: Added.
2160         (assert):
2161         (makePolyProtoObject.foo.C):
2162         (makePolyProtoObject.foo):
2163         (makePolyProtoObject):
2164         (validate):
2165         * stress/poly-proto-custom-value-and-accessor.js: Added.
2166         (assert):
2167         (makePolyProtoObject.foo.C):
2168         (makePolyProtoObject.foo):
2169         (makePolyProtoObject):
2170         (items.forEach):
2171         (set get for):
2172         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2173         (assert):
2174         (makePolyProtoObject.foo.C):
2175         (makePolyProtoObject.foo):
2176         (makePolyProtoObject):
2177         (foo):
2178         * stress/poly-proto-miss.js: Added.
2179         (makePolyProtoInstanceWithNullPrototype.foo.C):
2180         (makePolyProtoInstanceWithNullPrototype.foo):
2181         (makePolyProtoInstanceWithNullPrototype):
2182         (assert):
2183         (validate):
2184         * stress/poly-proto-op-in-caching.js: Added.
2185         (assert):
2186         (makePolyProtoObject.foo.C):
2187         (makePolyProtoObject.foo):
2188         (makePolyProtoObject):
2189         (validate):
2190         (validate2):
2191         * stress/poly-proto-put-transition.js: Added.
2192         (assert):
2193         (makePolyProtoObject.foo.C):
2194         (makePolyProtoObject.foo):
2195         (makePolyProtoObject):
2196         (performSet):
2197         (i.obj.__proto__.set p):
2198         * stress/poly-proto-set-prototype.js: Added.
2199         (assert):
2200         (let.alternateProto.get x):
2201         (let.alternateProto2.get y):
2202         (let.alternateProto2.get x):
2203         (foo.C):
2204         (foo):
2205         (validate):
2206         * stress/poly-proto-setter.js: Added.
2207         (assert):
2208         (makePolyProtoObject.foo.C):
2209         (makePolyProtoObject.foo.C.prototype.set p):
2210         (makePolyProtoObject.foo.C.prototype.get p):
2211         (makePolyProtoObject.foo):
2212         (makePolyProtoObject):
2213         (performSet):
2214         * stress/poly-proto-using-inheritance.js: Added.
2215         (assert):
2216         (foo.C):
2217         (foo.C.prototype.get baz):
2218         (foo):
2219         (bar.C):
2220         (bar):
2221         (validate):
2222         * stress/primitive-poly-proto.js: Added.
2223         (makePolyProtoInstance.foo.C):
2224         (makePolyProtoInstance.foo):
2225         (makePolyProtoInstance):
2226         (assert):
2227         (validate):
2228         * stress/prototype-is-not-js-object.js: Added.
2229         (foo.bar):
2230         (foo):
2231         (assert):
2232         (validate):
2233         * stress/try-get-by-id-poly-proto.js: Added.
2234         (assert):
2235         (makePolyProtoObject.foo.C):
2236         (makePolyProtoObject.foo):
2237         (makePolyProtoObject):
2238         (tryGetByIdText):
2239         (x.__proto__.get bar):
2240         (validate):
2241         * typeProfiler/overflow.js:
2242
2243 2017-10-03  JF Bastien  <jfbastien@apple.com>
2244
2245         WebAssembly: no VM / JS version of everything but Instance
2246         https://bugs.webkit.org/show_bug.cgi?id=177473
2247
2248         Reviewed by Filip Pizlo.
2249
2250         - Exceeding max on memory growth now returns a range error as per
2251         spec. This is a (very minor) breaking change: it used to throw OOM
2252         error. Update the corresponding test.
2253
2254         * wasm/js-api/memory-grow.js:
2255         (assertEq):
2256         * wasm/js-api/table.js:
2257         (assert.throws):
2258
2259 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2260
2261         Skip JSC test stress/regress-159779-2.js on debug.
2262         https://bugs.webkit.org/show_bug.cgi?id=177204
2263
2264         Unreviewed test gardening.
2265
2266         * stress/regress-159779-2.js:
2267
2268 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2269
2270         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2271         https://bugs.webkit.org/show_bug.cgi?id=175642
2272
2273         Reviewed by Darin Adler.
2274
2275         * ChakraCore/test/Function/apply3.baseline-jsc:
2276
2277 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2278
2279         Unreviewed, rolling out r222564.
2280         https://bugs.webkit.org/show_bug.cgi?id=177720
2281
2282         "It regressed JetStream by 2% on iOS caused by a 50%
2283         regression on the bigfib subtest" (Requested by saamyjoon on
2284         #webkit).
2285
2286         Reverted changeset:
2287
2288         "Add Above/Below comparisons for UInt32 patterns"
2289         https://bugs.webkit.org/show_bug.cgi?id=177281
2290         http://trac.webkit.org/changeset/222564
2291
2292 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2293
2294         [DFG] Support ArrayPush with multiple args
2295         https://bugs.webkit.org/show_bug.cgi?id=175823
2296
2297         Reviewed by Saam Barati.
2298
2299         * microbenchmarks/array-push-0.js: Added.
2300         (arrayPush0):
2301         * microbenchmarks/array-push-1.js: Added.
2302         (arrayPush1):
2303         * microbenchmarks/array-push-2.js: Added.
2304         (arrayPush2):
2305         * microbenchmarks/array-push-3.js: Added.
2306         (arrayPush3):
2307         * stress/array-push-multiple-contiguous.js: Added.
2308         (shouldBe):
2309         (test):
2310         * stress/array-push-multiple-double-nan.js: Added.
2311         (shouldBe):
2312         (test):
2313         * stress/array-push-multiple-double.js: Added.
2314         (shouldBe):
2315         (test):
2316         * stress/array-push-multiple-int32.js: Added.
2317         (shouldBe):
2318         (test):
2319         * stress/array-push-multiple-many-contiguous.js: Added.
2320         (shouldBe):
2321         (test):
2322         * stress/array-push-multiple-many-double.js: Added.
2323         (shouldBe):
2324         (test):
2325         * stress/array-push-multiple-many-int32.js: Added.
2326         (shouldBe):
2327         (test):
2328         * stress/array-push-multiple-many-storage.js: Added.
2329         (shouldBe):
2330         (test):
2331         * stress/array-push-multiple-storage.js: Added.
2332         (shouldBe):
2333         (test):
2334         * stress/array-push-with-force-exit.js: Added.
2335         (target.createBuiltin):
2336
2337 2017-09-29  Saam Barati  <sbarati@apple.com>
2338
2339         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2340         https://bugs.webkit.org/show_bug.cgi?id=177639
2341
2342         Reviewed by Geoffrey Garen.
2343
2344         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2345         (assert):
2346         (Class):
2347         (items.forEach):
2348         (set get for):
2349
2350 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2351
2352         Unreviewed, rolling out r222563, r222565, and r222581.
2353         https://bugs.webkit.org/show_bug.cgi?id=177675
2354
2355         "It causes a crash when playing youtube videos" (Requested by
2356         saamyjoon on #webkit).
2357
2358         Reverted changesets:
2359
2360         "[DFG] Support ArrayPush with multiple args"
2361         https://bugs.webkit.org/show_bug.cgi?id=175823
2362         http://trac.webkit.org/changeset/222563
2363
2364         "Unreviewed, build fix after r222563"
2365         https://bugs.webkit.org/show_bug.cgi?id=175823
2366         http://trac.webkit.org/changeset/222565
2367
2368         "Unreviewed, fix x86 breaking due to exhausted registers"
2369         https://bugs.webkit.org/show_bug.cgi?id=175823
2370         http://trac.webkit.org/changeset/222581
2371
2372 2017-09-28  Mark Lam  <mark.lam@apple.com>
2373
2374         test262: Unexpected passes after r222617 and r222618.
2375         https://bugs.webkit.org/show_bug.cgi?id=177622
2376         <rdar://problem/34725960>
2377
2378         Reviewed by Saam Barati.
2379
2380         Update test262.yaml for tests that are now passing.
2381
2382         * test262.yaml:
2383
2384 2017-09-27  Michael Saboff  <msaboff@apple.com>
2385
2386         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2387         https://bugs.webkit.org/show_bug.cgi?id=177570
2388
2389         Reviewed by Filip Pizlo.
2390
2391         New regression test.
2392
2393         * stress/regress-177570.js: Added.
2394
2395 2017-09-28  Michael Saboff  <msaboff@apple.com>
2396
2397         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2398         https://bugs.webkit.org/show_bug.cgi?id=177423
2399
2400         Reviewed by Mark Lam.
2401
2402         Updated regression test.
2403
2404         * stress/regress-177423.js:
2405         (catch):
2406
2407 2017-09-27  Mark Lam  <mark.lam@apple.com>
2408
2409         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2410         https://bugs.webkit.org/show_bug.cgi?id=177584
2411         <rdar://problem/34463903>
2412
2413         Reviewed by Saam Barati.
2414
2415         * stress/regress-177584.js: Added.
2416         (assertEqual):
2417         (Array.prototype.Symbol.species):
2418
2419 2017-09-27  Saam Barati  <sbarati@apple.com>
2420
2421         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2422         https://bugs.webkit.org/show_bug.cgi?id=177523
2423
2424         Reviewed by Mark Lam.
2425
2426         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2427         (assert):
2428         (Test):
2429         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2430         (addMethods):
2431         (i.Test.prototype.propName):
2432
2433 2017-09-27  Mark Lam  <mark.lam@apple.com>
2434
2435         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2436         https://bugs.webkit.org/show_bug.cgi?id=177423
2437         <rdar://problem/34621320>
2438
2439         Reviewed by Keith Miller.
2440
2441         * stress/regress-177423.js: Added.
2442
2443 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2444
2445         Add Above/Below comparisons for UInt32 patterns
2446         https://bugs.webkit.org/show_bug.cgi?id=177281
2447
2448         Reviewed by Saam Barati.
2449
2450         * stress/uint32-comparison-jump.js: Added.
2451         (shouldBe):
2452         (above):
2453         (aboveOrEqual):
2454         (below):
2455         (belowOrEqual):
2456         (notAbove):
2457         (notAboveOrEqual):
2458         (notBelow):
2459         (notBelowOrEqual):
2460         * stress/uint32-comparison.js: Added.
2461         (shouldBe):
2462         (above):
2463         (aboveOrEqual):
2464         (below):
2465         (belowOrEqual):
2466         (aboveTest):
2467         (aboveOrEqualTest):
2468         (belowTest):
2469         (belowOrEqualTest):
2470
2471 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2472
2473         [DFG] Support ArrayPush with multiple args
2474         https://bugs.webkit.org/show_bug.cgi?id=175823
2475
2476         Reviewed by Saam Barati.
2477
2478         * microbenchmarks/array-push-0.js: Added.
2479         (arrayPush0):
2480         * microbenchmarks/array-push-1.js: Added.
2481         (arrayPush1):
2482         * microbenchmarks/array-push-2.js: Added.
2483         (arrayPush2):
2484         * microbenchmarks/array-push-3.js: Added.
2485         (arrayPush3):
2486         * stress/array-push-multiple-contiguous.js: Added.
2487         (shouldBe):
2488         (test):
2489         * stress/array-push-multiple-double-nan.js: Added.
2490         (shouldBe):
2491         (test):
2492         * stress/array-push-multiple-double.js: Added.
2493         (shouldBe):
2494         (test):
2495         * stress/array-push-multiple-int32.js: Added.
2496         (shouldBe):
2497         (test):
2498         * stress/array-push-multiple-many-contiguous.js: Added.
2499         (shouldBe):
2500         (test):
2501         * stress/array-push-multiple-many-double.js: Added.
2502         (shouldBe):
2503         (test):
2504         * stress/array-push-multiple-many-int32.js: Added.
2505         (shouldBe):
2506         (test):
2507         * stress/array-push-multiple-many-storage.js: Added.
2508         (shouldBe):
2509         (test):
2510         * stress/array-push-multiple-storage.js: Added.
2511         (shouldBe):
2512         (test):
2513
2514 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2515
2516         Unreviewed, rolling out r222518.
2517         https://bugs.webkit.org/show_bug.cgi?id=177507
2518
2519         Break the High Sierra build (Requested by yusukesuzuki on
2520         #webkit).
2521
2522         Reverted changeset:
2523
2524         "Add Above/Below comparisons for UInt32 patterns"
2525         https://bugs.webkit.org/show_bug.cgi?id=177281
2526         http://trac.webkit.org/changeset/222518
2527
2528 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2529
2530         Add Above/Below comparisons for UInt32 patterns
2531         https://bugs.webkit.org/show_bug.cgi?id=177281
2532
2533         Reviewed by Saam Barati.
2534
2535         * stress/uint32-comparison-jump.js: Added.
2536         (shouldBe):
2537         (above):
2538         (aboveOrEqual):
2539         (below):
2540         (belowOrEqual):
2541         (notAbove):
2542         (notAboveOrEqual):
2543         (notBelow):
2544         (notBelowOrEqual):
2545         * stress/uint32-comparison.js: Added.
2546         (shouldBe):
2547         (above):
2548         (aboveOrEqual):
2549         (below):
2550         (belowOrEqual):
2551         (aboveTest):
2552         (aboveOrEqualTest):
2553         (belowTest):
2554         (belowOrEqualTest):
2555
2556 2017-09-23  Keith Miller  <keith_miller@apple.com>
2557
2558         Fix infinite looping test262 test
2559         https://bugs.webkit.org/show_bug.cgi?id=177412
2560
2561         Reviewed by Yusuke Suzuki.
2562
2563         This test was poorly designed since failing it would cause the vm
2564         to inifinite loop. I've fixed it locally and will fix it on github pending
2565         the results of next weeks tc39 meeting.
2566
2567         * test262.yaml:
2568         * test262/test/language/statements/for-of/iterator-next-reference.js:
2569
2570 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2571
2572         test262: $.agent became $262.agent in test262 update
2573         https://bugs.webkit.org/show_bug.cgi?id=177407
2574
2575         Reviewed by Yusuke Suzuki.
2576
2577         * test262.yaml:
2578         ~320 tests pass now that we correctly make $262 available.
2579
2580 2017-09-22  Keith Miller  <keith_miller@apple.com>
2581
2582         Speculatively change iteration protocall to use the same next function
2583         https://bugs.webkit.org/show_bug.cgi?id=175653
2584
2585         Reviewed by Saam Barati.
2586
2587         Change test to match the new iteration behavior.
2588
2589         * stress/spread-optimized-properly.js:
2590
2591 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2592
2593         [DFG][FTL] Profile array vector length for array allocation
2594         https://bugs.webkit.org/show_bug.cgi?id=177051
2595
2596         Reviewed by Saam Barati.
2597
2598         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2599         (target):
2600
2601 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2602
2603         Unreviewed, rolling out r222380.
2604         https://bugs.webkit.org/show_bug.cgi?id=177352
2605
2606         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2607         #webkit).
2608
2609         Reverted changeset:
2610
2611         "[DFG][FTL] Profile array vector length for array allocation"
2612         https://bugs.webkit.org/show_bug.cgi?id=177051
2613         http://trac.webkit.org/changeset/222380
2614
2615 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2616
2617         [DFG][FTL] Profile array vector length for array allocation
2618         https://bugs.webkit.org/show_bug.cgi?id=177051
2619
2620         Reviewed by Saam Barati.
2621
2622         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2623         (target):
2624
2625 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2626
2627         Skip new hanging test262 tests.
2628         https://bugs.webkit.org/show_bug.cgi?id=177326
2629
2630         Unreviewed test gardening.
2631
2632         * test262.yaml:
2633
2634 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2635
2636         Mark 6 test262 tests as passing.
2637         https://bugs.webkit.org/show_bug.cgi?id=177307
2638
2639         Unreviewed test gardening.
2640
2641         * test262.yaml:
2642
2643 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2644
2645         Unreviewed follow-up to r222311.
2646
2647         * test262/harness/sta.js:
2648         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2649         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2650         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2651         * test262/test/built-ins/Array/from/elements-added-after.js:
2652         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2653         * test262/test/built-ins/Array/from/elements-updated-after.js:
2654         * test262/test/built-ins/Array/from/from-array.js:
2655         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2656         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2657         * test262/test/built-ins/Array/from/source-array-boundary.js:
2658         * test262/test/built-ins/Array/from/source-object-constructor.js:
2659         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2660         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2661         * test262/test/built-ins/Array/from/source-object-length.js:
2662         * test262/test/built-ins/Array/from/source-object-missing.js:
2663         * test262/test/built-ins/Array/from/source-object-without.js:
2664         * test262/test/built-ins/Array/from/this-null.js:
2665         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2666         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2667         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2668         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2669         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2670         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2671         * test262/test/language/literals/string/7.8.4-1gs.js:
2672         Fix some files that I failed to update when I applied my patch.
2673
2674 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2675
2676         Update test262 tests
2677         https://bugs.webkit.org/show_bug.cgi?id=177220
2678
2679         Reviewed by Saam Barati and Yusuke Suzuki.
2680
2681         * test262.yaml:
2682         * test262/test262-Revision.txt:
2683         New rebaselined expectations for all tests.
2684
2685         * test262/*:
2686         Updated.
2687
2688 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2689
2690         [DFG] Remove ToThis more aggressively
2691         https://bugs.webkit.org/show_bug.cgi?id=177056
2692
2693         Reviewed by Saam Barati.
2694
2695         * stress/generator-with-this-strict.js: Added.
2696         (shouldBe):
2697         (generator):
2698         (target):
2699         * stress/generator-with-this.js: Added.
2700         (shouldBe):
2701         (generator):
2702         (target):
2703
2704 2017-09-17  Michael Saboff  <msaboff@apple.com>
2705
2706         https://bugs.webkit.org/show_bug.cgi?id=177038
2707         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2708
2709         Reviewed by JF Bastien.
2710
2711         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2712         as it dies using too much memory.
2713
2714 2017-09-15  Saam Barati  <sbarati@apple.com>
2715
2716         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2717         https://bugs.webkit.org/show_bug.cgi?id=176981
2718
2719         Reviewed by Yusuke Suzuki.
2720
2721         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2722         (assert):
2723         (verify):
2724         (func):
2725         (const.bar.createBuiltin):
2726
2727 2017-09-14  Saam Barati  <sbarati@apple.com>
2728
2729         It should be valid to exit before each set when doing arity fixup when inlining
2730         https://bugs.webkit.org/show_bug.cgi?id=176948
2731
2732         Reviewed by Keith Miller.
2733
2734         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2735         (baz):
2736         (bar):
2737         (foo):
2738
2739 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2740
2741         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2742         https://bugs.webkit.org/show_bug.cgi?id=176867
2743
2744         Reviewed by Sam Weinig.
2745
2746         * microbenchmarks/object-get-own-property-symbols.js: Added.
2747         (test):
2748
2749 2017-09-13  Mark Lam  <mark.lam@apple.com>
2750
2751         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2752         https://bugs.webkit.org/show_bug.cgi?id=176888
2753         <rdar://problem/34381832>
2754
2755         Not reviewed.
2756
2757         * stress/op_mod-ConstVar.js:
2758         * stress/op_mod-VarConst.js:
2759         * stress/op_mod-VarVar.js:
2760
2761 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2762
2763         Skip 3 op_mod tests on Debug JSC bots.
2764         https://bugs.webkit.org/show_bug.cgi?id=176630
2765
2766         Unreviewed test gardening.
2767
2768         * stress/op_mod-ConstVar.js:
2769         * stress/op_mod-VarConst.js:
2770         * stress/op_mod-VarVar.js:
2771
2772 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2773
2774         [JSC] Fix Array allocation in Object.keys
2775         https://bugs.webkit.org/show_bug.cgi?id=176826
2776
2777         Reviewed by Saam Barati.
2778
2779         * stress/object-own-property-keys.js: Added.
2780         (shouldBe):
2781
2782 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2783
2784         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2785         https://bugs.webkit.org/show_bug.cgi?id=176010
2786
2787         Reviewed by Filip Pizlo.
2788
2789         * microbenchmarks/weak-map-key.js: Added.
2790         (assert):
2791         (objectKey):
2792         (let.start.Date.now):
2793
2794 2017-09-12  Mark Lam  <mark.lam@apple.com>
2795
2796         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2797         https://bugs.webkit.org/show_bug.cgi?id=176630
2798
2799         Reviewed by JF Bastien.
2800
2801         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2802         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2803         a speculative fix for the bots that are seeing these fail.
2804
2805         I also undid the skipping of the op_mod tests for debug builds.
2806
2807         * stress/op_div-ConstVar.js:
2808         * stress/op_div-VarConst.js:
2809         * stress/op_div-VarVar.js:
2810         * stress/op_mod-ConstVar.js:
2811         * stress/op_mod-VarConst.js:
2812         * stress/op_mod-VarVar.js:
2813
2814 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2815
2816         Skip stress/value-to-boolean.js on Debug bots.
2817         https://bugs.webkit.org/show_bug.cgi?id=176787
2818
2819         Unreviewed test gardening.
2820
2821         * stress/value-to-boolean.js:
2822
2823 2017-09-11  Mark Lam  <mark.lam@apple.com>
2824
2825         Change test expectation for test262/test/language/statements/try/tco-catch.js
2826         https://bugs.webkit.org/show_bug.cgi?id=176749
2827
2828         Rubber stamped by Keith Miller.
2829
2830         It's been failing since at least r221821.  I'm changing the test expectation to
2831         fail to green the bots while I investigate some more.
2832
2833         * test262.yaml:
2834
2835 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2836
2837         Unreviewed, rolling out r221854.
2838
2839         The test added with this change fails on 32-bit JSC bots.
2840
2841         Reverted changeset:
2842
2843         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2844         https://bugs.webkit.org/show_bug.cgi?id=176010
2845         http://trac.webkit.org/changeset/221854
2846
2847 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2848
2849         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2850         https://bugs.webkit.org/show_bug.cgi?id=176010
2851
2852         Reviewed by Filip Pizlo.
2853
2854         * microbenchmarks/weak-map-key.js: Added.
2855         (assert):
2856         (objectKey):
2857         (let.start.Date.now):
2858
2859 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2860
2861         [JSC] Optimize Object.keys by using careful array allocation
2862         https://bugs.webkit.org/show_bug.cgi?id=176654
2863
2864         Reviewed by Darin Adler.
2865
2866         * microbenchmarks/object-keys.js: Added.
2867         (test):
2868
2869 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2870
2871         Error should compute .stack and friends lazily
2872         https://bugs.webkit.org/show_bug.cgi?id=176645
2873
2874         Reviewed by Saam Barati.
2875
2876         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2877         * microbenchmarks/new-error.js: Added.
2878         * microbenchmarks/throw.js: Added.
2879
2880 2017-09-09  Mark Lam  <mark.lam@apple.com>
2881
2882         [Re-landing] Use JIT probes for DFG OSR exit.
2883         https://bugs.webkit.org/show_bug.cgi?id=175144
2884         <rdar://problem/33437050>
2885
2886         Not reviewed.  Original patch reviewed by Saam Barati.
2887
2888         Disable these tests for debug builds because they run too slow with the new OSR exit.
2889
2890         * stress/op_mod-ConstVar.js:
2891         * stress/op_mod-VarConst.js:
2892         * stress/op_mod-VarVar.js:
2893
2894 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2895
2896         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2897         https://bugs.webkit.org/show_bug.cgi?id=176300
2898
2899         Reviewed by Saam Barati.
2900
2901         * stress/new-array-with-size-div.js: Added.
2902         (shouldBe):
2903         (test):
2904         (i.i):
2905
2906 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2907
2908         [DFG] PutByVal with Array::Generic is too generic
2909         https://bugs.webkit.org/show_bug.cgi?id=176345
2910
2911         Reviewed by Filip Pizlo.
2912
2913         * stress/object-assign-symbols.js: Added.
2914         (shouldBe):
2915         (test):
2916         * stress/object-assign.js: Added.
2917         (shouldBe):
2918         (test):
2919         (i.shouldBe.JSON.stringify.test):
2920
2921 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2922
2923         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2924         https://bugs.webkit.org/show_bug.cgi?id=176590
2925
2926         Reviewed by Saam Barati.
2927
2928         * microbenchmarks/object-iterate-symbols.js: Added.
2929         (test):
2930         * microbenchmarks/object-iterate.js: Added.
2931         (test):
2932         * stress/object-iterate-symbols.js: Added.
2933         (shouldBe):
2934         (test):
2935         * stress/object-iterate.js: Added.
2936         (shouldBe):
2937         (test):
2938
2939 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2940
2941         [Win32] 10 JSC stress tests are failing.
2942         https://bugs.webkit.org/show_bug.cgi?id=176538
2943
2944         Reviewed by Mark Lam.
2945
2946         Skip tests on Windows to make the bots green.
2947
2948         * ChakraCore.yaml:
2949         * stress/date-relaxed.js:
2950
2951 2017-09-06  Mark Lam  <mark.lam@apple.com>
2952
2953         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2954         https://bugs.webkit.org/show_bug.cgi?id=176485
2955         <rdar://problem/33898874>
2956
2957         Reviewed by Keith Miller.
2958
2959         * stress/regress-176485.js: Added.
2960
2961 2017-09-05  Saam Barati  <sbarati@apple.com>
2962
2963         isNotCellSpeculation is wrong with respect to SpecEmpty
2964         https://bugs.webkit.org/show_bug.cgi?id=176429
2965
2966         Reviewed by Michael Saboff.
2967
2968         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2969         (Foo):
2970
2971 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2972
2973         test262: Completion values for control flow do not match the spec
2974         https://bugs.webkit.org/show_bug.cgi?id=171265
2975
2976         Reviewed by Saam Barati.
2977
2978         * stress/completion-value.js:
2979         Condensed test for completion values in top level statements.
2980
2981         * stress/super-get-by-id.js:
2982         ClassDeclaration when evaled no longer produce values. Convert
2983         these to ClassExpressions so they produce the class value.
2984         
2985         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2986         This is a progression for currect spec behavior.
2987
2988         * mozilla/mozilla-tests.yaml:
2989         This test is now outdated, so mark it as failing for that reason.
2990
2991         * test262.yaml:
2992         Passing all "cptn" completion value tests.
2993
2994 2017-09-04  Saam Barati  <sbarati@apple.com>
2995
2996         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2997         https://bugs.webkit.org/show_bug.cgi?id=176317
2998
2999         Reviewed by Keith Miller.
3000
3001         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3002         (Foo):
3003
3004 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3005
3006         [DFG][FTL] Efficiently execute number#toString()
3007         https://bugs.webkit.org/show_bug.cgi?id=170007
3008
3009         Reviewed by Keith Miller.
3010
3011         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3012         (test):
3013         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3014         (test):
3015         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3016         (test):
3017         * microbenchmarks/number-to-string-with-radix.js: Added.
3018         (test):
3019         * stress/number-to-string-strength-reduction.js: Added.
3020         (shouldBe):
3021         (test):
3022         * stress/number-to-string-with-radix-10.js: Added.
3023         (shouldBe):
3024         (test):
3025         * stress/number-to-string-with-radix-cse.js: Added.
3026         (shouldBe):
3027         (test):
3028         * stress/number-to-string-with-radix-invalid.js: Added.
3029         (shouldThrow):
3030         * stress/number-to-string-with-radix-watchpoint.js: Added.
3031         (shouldBe):
3032         (test):
3033         (i.i.1e3.Number.prototype.toString):
3034         * stress/number-to-string-with-radix.js: Added.
3035         (shouldBe):
3036         (test):
3037
3038 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3039
3040         [DFG] Relax arity requirement
3041         https://bugs.webkit.org/show_bug.cgi?id=175523
3042
3043         Reviewed by Saam Barati.
3044
3045         * stress/arity-mismatch-arguments-length.js: Added.
3046         (shouldBe):
3047         (test1):
3048         (test):
3049         * stress/arity-mismatch-get-argument.js: Added.
3050         (shouldBe):
3051         (builtin.createBuiltin):
3052         (test):
3053         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3054         (shouldBe):
3055         (inlineTarget):
3056         (test):
3057         * stress/arity-mismatch-inlining.js: Added.
3058         (shouldBe):
3059         (inlineTarget):
3060         (test):
3061         * stress/arity-mismatch-rest.js: Added.
3062         (shouldBe):
3063         (test2):
3064         (test1):
3065         (test):
3066
3067 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3068
3069         [JSC] Fix "name" and "length" of Proxy revoke function
3070         https://bugs.webkit.org/show_bug.cgi?id=176155
3071
3072         Reviewed by Mark Lam.
3073
3074         * test262.yaml:
3075
3076 2017-08-31  Saam Barati  <sbarati@apple.com>
3077
3078         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3079         https://bugs.webkit.org/show_bug.cgi?id=176206
3080
3081         Reviewed by Keith Miller.
3082
3083         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3084         (a):
3085         (b):
3086         (foo):
3087
3088 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3089
3090         Skip two slow JSC tests after r221422.
3091
3092         Unreviewed test gardening.
3093
3094         * stress/regexp-prototype-match-on-too-long-rope.js:
3095         * stress/regexp-prototype-test-on-too-long-rope.js:
3096
3097 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3098
3099         Unreviewed, skipping slow tests.
3100         
3101         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3102         work differently now.
3103
3104         * stress/regexp-prototype-exec-on-too-long-rope.js:
3105         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3106
3107 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3108
3109         [JSC] Use reifying system for "name" property of builtin JSFunction
3110         https://bugs.webkit.org/show_bug.cgi?id=175260
3111
3112         Reviewed by Saam Barati.
3113
3114         * stress/accessors-get-set-prefix.js:
3115         * stress/builtin-function-name.js: Added.
3116         (shouldBe):
3117         (shouldThrow):
3118         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3119         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3120         * stress/private-name-as-anonymous-builtin.js: Added.
3121         (shouldBe):
3122         (NotPromise):
3123
3124 2017-08-30  Saam Barati  <sbarati@apple.com>
3125
3126         Unreviewed. Make test stop printing.
3127
3128         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3129
3130 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3131
3132         Unreviewed, rolling out r221327.
3133
3134         This change caused test262 failures.
3135
3136         Reverted changeset:
3137
3138         "[JSC] Use reifying system for "name" property of builtin
3139         JSFunction"
3140         https://bugs.webkit.org/show_bug.cgi?id=175260
3141         http://trac.webkit.org/changeset/221327
3142
3143 2017-08-30  Saam Barati  <sbarati@apple.com>
3144
3145         semicolon is being interpreted as an = in the LiteralParser
3146         https://bugs.webkit.org/show_bug.cgi?id=176114
3147
3148         Reviewed by Oliver Hunt.
3149
3150         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3151         * stress/resources/literal-parser-test-case.js: Added.
3152
3153 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3154
3155         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3156         https://bugs.webkit.org/show_bug.cgi?id=166698
3157
3158         Reviewed by Yusuke Suzuki.
3159
3160         * stress/async-iteration-for-await-of-syntax.js: Added.
3161         (assert):
3162         (checkSyntax):
3163         (checkSyntaxError):
3164         (checkSimpleAsyncGeneratorSloppyMode):
3165         (checkSimpleAsyncGeneratorStrictMode):
3166         (checkNestedAsyncGenerators):
3167         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3168         * stress/async-iteration-for-await-of.js: Added.
3169         (assert):
3170         (async.foo):
3171         (async.boo):
3172         (const.boo.async):
3173
3174 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3175
3176         [JSC] Use reifying system for "name" property of builtin JSFunction
3177         https://bugs.webkit.org/show_bug.cgi?id=175260
3178
3179         Reviewed by Saam Barati.
3180
3181         * stress/accessors-get-set-prefix.js:
3182         * stress/builtin-function-name.js: Added.
3183         (shouldBe):
3184         (shouldThrow):
3185         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3186         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3187
3188 2017-08-25  Saam Barati  <sbarati@apple.com>
3189
3190         Support compiling catch in the DFG
3191         https://bugs.webkit.org/show_bug.cgi?id=174590
3192         <rdar://problem/34047845>
3193
3194         Reviewed by Filip Pizlo.
3195
3196         * microbenchmarks/delta-blue-try-catch.js: Added.
3197         (exception):
3198         (value):
3199         (OrderedCollection):
3200         (OrderedCollection.prototype.add):
3201         (OrderedCollection.prototype.at):
3202         (OrderedCollection.prototype.size):
3203         (OrderedCollection.prototype.removeFirst):
3204         (OrderedCollection.prototype.remove):
3205         (Strength):
3206         (Strength.stronger):
3207         (Strength.weaker):
3208         (Strength.weakestOf):
3209         (Strength.strongest):
3210         (Strength.prototype.nextWeaker):
3211         (Constraint):
3212         (Constraint.prototype.addConstraint):
3213         (Constraint.prototype.satisfy):
3214         (Constraint.prototype.destroyConstraint):
3215         (Constraint.prototype.isInput):
3216         (UnaryConstraint):
3217         (UnaryConstraint.prototype.addToGraph):
3218         (UnaryConstraint.prototype.chooseMethod):
3219         (UnaryConstraint.prototype.isSatisfied):
3220         (UnaryConstraint.prototype.markInputs):
3221         (UnaryConstraint.prototype.output):
3222         (UnaryConstraint.prototype.recalculate):
3223         (UnaryConstraint.prototype.markUnsatisfied):
3224         (UnaryConstraint.prototype.inputsKnown):
3225         (UnaryConstraint.prototype.removeFromGraph):
3226         (StayConstraint):
3227         (StayConstraint.prototype.execute):
3228         (EditConstraint.prototype.isInput):
3229         (EditConstraint.prototype.execute):
3230         (BinaryConstraint):
3231         (BinaryConstraint.prototype.chooseMethod):
3232         (BinaryConstraint.prototype.addToGraph):
3233         (BinaryConstraint.prototype.isSatisfied):
3234         (BinaryConstraint.prototype.markInputs):
3235         (BinaryConstraint.prototype.input):
3236         (BinaryConstraint.prototype.output):
3237         (BinaryConstraint.prototype.recalculate):
3238         (BinaryConstraint.prototype.markUnsatisfied):
3239         (BinaryConstraint.prototype.inputsKnown):
3240         (BinaryConstraint.prototype.removeFromGraph):
3241         (ScaleConstraint):
3242         (ScaleConstraint.prototype.addToGraph):
3243         (ScaleConstraint.prototype.removeFromGraph):
3244         (ScaleConstraint.prototype.markInputs):
3245         (ScaleConstraint.prototype.execute):
3246         (ScaleConstraint.prototype.recalculate):
3247         (EqualityConstraint):
3248         (EqualityConstraint.prototype.execute):
3249         (Variable):
3250         (Variable.prototype.addConstraint):
3251         (Variable.prototype.removeConstraint):
3252         (Planner):
3253         (Planner.prototype.incrementalAdd):
3254         (Planner.prototype.incrementalRemove):
3255         (Planner.prototype.newMark):
3256         (Planner.prototype.makePlan):
3257         (Planner.prototype.extractPlanFromConstraints):
3258         (Planner.prototype.addPropagate):
3259         (Planner.prototype.removePropagateFrom):
3260         (Planner.prototype.addConstraintsConsumingTo):
3261         (Plan):
3262         (Plan.prototype.addConstraint):
3263         (Plan.prototype.size):
3264         (Plan.prototype.constraintAt):
3265         (Plan.prototype.execute):
3266         (chainTest):
3267         (projectionTest):
3268         (change):
3269         (deltaBlue):
3270         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3271         (assert):
3272         (Numbers):
3273         (Numbers.prototype.next):
3274         (return.Transpose):
3275         (return.Transpose.prototype.next):
3276         (transpose):
3277         (verifyEven):
3278         (verifyString):
3279         (foo):
3280         (runIterators):
3281         * microbenchmarks/try-catch-word-count.js: Added.
3282         (let.assert):
3283         (EOF):
3284         (let.texts):
3285         (let.o.apply):
3286         (foo):
3287         (bar):
3288         (f):
3289         (run):
3290         (test1):
3291         (test2):
3292         (test3):
3293         (fn):
3294         (A):
3295         (B):
3296         (A.prototype.getValue):
3297         (B.prototype.getParentValue):
3298         (strlen):
3299         (sum.0):
3300         (test):
3301         (result.test.o):
3302         (set add.set add):
3303         (set forEach):
3304         (stringHash):
3305         (set if):
3306         (testFunction):
3307         (set delete.set has.set add):
3308         * stress/catch-set-argument-speculation-failure.js: Added.
3309         (o):
3310         (e):
3311         (e2):
3312         (escape):
3313         (baz):
3314         (noInline.run):
3315         (noInline):
3316         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3317         (foo):
3318         (e):
3319         (baz):
3320         (bar):
3321
3322 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3323
3324         Unreviewed, rolling out r221119, r221124, and r221143.
3325         https://bugs.webkit.org/show_bug.cgi?id=175973
3326
3327         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3328         on #webkit).
3329
3330         Reverted changesets:
3331
3332         "Support compiling catch in the DFG"
3333         https://bugs.webkit.org/show_bug.cgi?id=174590
3334         http://trac.webkit.org/changeset/221119
3335
3336         "Unreviewed, build fix in GTK port"
3337         https://bugs.webkit.org/show_bug.cgi?id=174590
3338         http://trac.webkit.org/changeset/221124
3339
3340         "DFG::JITCode::osrEntry should get sorted since we perform a
3341         binary search on it"
3342         https://bugs.webkit.org/show_bug.cgi?id=175893
3343         http://trac.webkit.org/changeset/221143
3344
3345 2017-08-24  Michael Saboff  <msaboff@apple.com>
3346
3347         Add support for RegExp "dotAll" flag
3348         https://bugs.webkit.org/show_bug.cgi?id=175924
3349
3350         Reviewed by Keith Miller.
3351
3352         Updated tests for new dotAll ('s' flag) changes.
3353
3354         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3355         * stress/static-getter-in-names.js:
3356
3357 2017-08-24  Mark Lam  <mark.lam@apple.com>
3358
3359         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3360         https://bugs.webkit.org/show_bug.cgi?id=175940
3361         <rdar://problem/29003921>
3362
3363         Reviewed by Saam Barati.
3364
3365         * stress/regress-164081.js: Added.
3366         (shouldEqual):
3367         (testcase):
3368
3369 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3370
3371         Skip flaky JSC test stress/test-finally.js.
3372         https://bugs.webkit.org/show_bug.cgi?id=160283
3373
3374         Unreviewed test gardening.
3375
3376         * stress/test-finally.js:
3377
3378 2017-08-23  Saam Barati  <sbarati@apple.com>
3379
3380         Support compiling catch in the DFG
3381         https://bugs.webkit.org/show_bug.cgi?id=174590
3382
3383         Reviewed by Filip Pizlo.
3384
3385         * microbenchmarks/delta-blue-try-catch.js: Added.
3386         (exception):
3387         (value):
3388         (OrderedCollection):
3389         (OrderedCollection.prototype.add):
3390         (OrderedCollection.prototype.at):
3391         (OrderedCollection.prototype.size):
3392         (OrderedCollection.prototype.removeFirst):
3393         (OrderedCollection.prototype.remove):
3394         (Strength):
3395         (Strength.stronger):
3396         (Strength.weaker):
3397         (Strength.weakestOf):
3398         (Strength.strongest):
3399         (Strength.prototype.nextWeaker):
3400         (Constraint):
3401         (Constraint.prototype.addConstraint):
3402         (Constraint.prototype.satisfy):
3403         (Constraint.prototype.destroyConstraint):
3404         (Constraint.prototype.isInput):
3405         (UnaryConstraint):
3406         (UnaryConstraint.prototype.addToGraph):
3407         (UnaryConstraint.prototype.chooseMethod):
3408         (UnaryConstraint.prototype.isSatisfied):
3409         (UnaryConstraint.prototype.markInputs):
3410         (UnaryConstraint.prototype.output):
3411         (UnaryConstraint.prototype.recalculate):
3412         (UnaryConstraint.prototype.markUnsatisfied):
3413         (UnaryConstraint.prototype.inputsKnown):
3414         (UnaryConstraint.prototype.removeFromGraph):
3415         (StayConstraint):
3416         (StayConstraint.prototype.execute):
3417         (EditConstraint.prototype.isInput):
3418         (EditConstraint.prototype.execute):
3419         (BinaryConstraint):
3420         (BinaryConstraint.prototype.chooseMethod):
3421         (BinaryConstraint.prototype.addToGraph):
3422         (BinaryConstraint.prototype.isSatisfied):
3423         (BinaryConstraint.prototype.markInputs):
3424         (BinaryConstraint.prototype.input):
3425         (BinaryConstraint.prototype.output):
3426         (BinaryConstraint.prototype.recalculate):
3427         (BinaryConstraint.prototype.markUnsatisfied):
3428         (BinaryConstraint.prototype.inputsKnown):
3429         (BinaryConstraint.prototype.removeFromGraph):
3430         (ScaleConstraint):
3431         (ScaleConstraint.prototype.addToGraph):
3432         (ScaleConstraint.prototype.removeFromGraph):
3433         (ScaleConstraint.prototype.markInputs):
3434         (ScaleConstraint.prototype.execute):
3435         (ScaleConstraint.prototype.recalculate):
3436         (EqualityConstraint):
3437         (EqualityConstraint.prototype.execute):
3438         (Variable):
3439         (Variable.prototype.addConstraint):
3440         (Variable.prototype.removeConstraint):
3441         (Planner):
3442         (Planner.prototype.incrementalAdd):
3443         (Planner.prototype.incrementalRemove):
3444         (Planner.prototype.newMark):
3445         (Planner.prototype.makePlan):
3446         (Planner.prototype.extractPlanFromConstraints):
3447         (Planner.prototype.addPropagate):
3448         (Planner.prototype.removePropagateFrom):
3449         (Planner.prototype.addConstraintsConsumingTo):
3450         (Plan):
3451         (Plan.prototype.addConstraint):
3452         (Plan.prototype.size):
3453         (Plan.prototype.constraintAt):
3454         (Plan.prototype.execute):
3455         (chainTest):
3456         (projectionTest):
3457         (change):
3458         (deltaBlue):
3459         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3460         (assert):
3461         (Numbers):
3462         (Numbers.prototype.next):
3463         (return.Transpose):
3464         (return.Transpose.prototype.next):
3465         (transpose):
3466         (verifyEven):
3467         (verifyString):
3468         (foo):
3469         (runIterators):
3470         * microbenchmarks/try-catch-word-count.js: Added.
3471         (let.assert):
3472         (EOF):
3473         (let.texts):
3474         (let.o.apply):
3475         (foo):
3476         (bar):
3477         (f):
3478         (run):
3479         (test1):
3480         (test2):
3481         (test3):
3482         (fn):
3483         (A):
3484         (B):
3485         (A.prototype.getValue):
3486         (B.prototype.getParentValue):
3487         (strlen):
3488         (sum.0):
3489         (test):
3490         (result.test.o):
3491         (set add.set add):
3492         (set forEach):
3493         (stringHash):
3494         (set if):
3495         (testFunction):
3496         (set delete.set has.set add):
3497         * stress/catch-set-argument-speculation-failure.js: Added.
3498         (o):
3499         (e):
3500         (e2):
3501         (escape):
3502         (baz):
3503         (noInline.run):
3504         (noInline):
3505         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3506         (foo):
3507         (e):
3508         (baz):
3509         (bar):
3510
3511 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3512
3513         [JSC] Optimize Map iteration with intrinsic
3514         https://bugs.webkit.org/show_bug.cgi?id=174355
3515
3516         Reviewed by Saam Barati.
3517
3518         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3519         (shouldBe):
3520         (throw.new.Error):
3521         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3522         (shouldBe):
3523         (throw.new.Error.let.iterator.set Symbol):
3524         (throw.new.Error.set add):
3525         (let.iterator.set Symbol):
3526
3527 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3528
3529         Add a micro-benchmark for checking that accessing a variable within a 'with'
3530         block does not automatically prevent type prediction.
3531         https://bugs.webkit.org/show_bug.cgi?id=175738
3532
3533         Reviewed by Saam Barati.
3534
3535         * stress/with_and_arith.js: Added.
3536         (with):
3537
3538 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3539
3540         [ESNext] Async iteration - Implement Async Generator - runtime
3541         https://bugs.webkit.org/show_bug.cgi?id=175240
3542
3543         Reviewed by Yusuke Suzuki.
3544
3545         * stress/async-iteration-async-from-sync.js: Added.
3546         (assert):
3547         (const.Logger):
3548         (this.fullfilled):
3549         (this.fullfilledDone):
3550         (this.rejected):
3551         (this.catched):
3552         (this.isFinal):
3553         (_assertLogger):
3554         (const.assertLogger):
3555         (const.getPromise.promiseHolder.return.new.Promise):
3556         (foo):
3557         (async.boo):
3558         (bar):
3559         (async.baz):
3560         (async.goo):
3561         * stress/async-iteration-basic.js: Added.
3562         (assert):
3563         (const.Logger):
3564         (this.fullfilled):
3565         (this.fullfilledDone):
3566         (this.rejected):
3567         (this.catched):
3568         (this.isFinal):
3569         (_assertLogger):
3570         (const.assertLogger):
3571         (const.getPromise.promiseHolder.return.new.Promise):
3572         (async.generator):
3573         (iterator.next.then):
3574         (async.baz):
3575         (async.boo):
3576         (async.foo):
3577         (async.goo):
3578         (A.prototype.async.foo):
3579         (A.prototype.async.boo):
3580         (A):
3581         (asyncGenExp.async):
3582         (async.joo):
3583         (j.next.then):
3584         (then):
3585         (async.koo):
3586         (async.loo):
3587         (async.moo):
3588         (async.noo):
3589         (async.ooo):
3590         (async.roo):
3591         (async.poo):
3592         (async.soo):
3593         (async.too):
3594         * stress/async-iteration-evaluation.js: Added.
3595         (assert):
3596         (async.foo):
3597         (catch):
3598         * stress/async-iteration-syntax.js:
3599         * stress/async-iteration-yield-promise.js: Added.
3600         (assert):
3601         (const.Logger):
3602         (this.fullfilled):
3603         (this.fullfilledDone):
3604         (this.rejected):
3605         (this.catched):
3606         (this.isFinal):
3607         (_assertLogger):
3608         (const.assertLogger):
3609         (const.getPromise.promiseHolder.return.new.Promise):
3610         (async.foo):
3611         (async.boo):
3612         (async.bar):
3613         * stress/async-iteration-yield-star-interface.js: Added.
3614         (assert):
3615         (const.getPromise.promiseHolder.return.new.Promise):
3616         (const.Logger):
3617         (this.fullfilled):
3618         (this.fullfilledDone):
3619         (this.rejected):
3620         (this.catched):
3621         (this.custom):
3622         (this.isFinal):
3623         (_assertLogger):
3624         (const.assertLogger):
3625         (let.asyncIter.Symbol.asyncIterator):
3626         (let.asyncIter.next):
3627         (let.asyncIter.throw):
3628         (let.asyncIter.return):
3629         (async.foo):
3630         (asyncIter.Symbol.asyncIterator):
3631         (asyncIter.next):
3632         (async.boo):
3633         (asyncIter.return):
3634         (async.bar):
3635         (async.baz):
3636         (async.foobar):
3637         * stress/async-iteration-yield-star.js: Added.
3638         (assert):
3639         (const.Logger):
3640         (this.fullfilled):
3641         (this.fullfilledDone):
3642         (this.rejected):
3643         (this.catched):
3644         (this.custom):
3645         (this.isFinal):
3646         (_assertLogger):
3647         (const.assertLogger):
3648         (const.getPromise.promiseHolder.return.new.Promise):
3649         (async.foo):
3650         (async.boo):
3651         (async.bar):
3652         (async.baz):
3653         (async.joo):
3654         (async.goo):
3655         (async.koo):
3656         (async.loo):
3657         (let.asyncIter.Symbol.asyncIterator):
3658         (let.asyncIter.next):
3659         (let.asyncIter.throw):
3660         (let.asyncIter.return):
3661         (async.moo):
3662         (async.noo):
3663         * test262.yaml:
3664
3665 2017-08-23  JF Bastien  <jfbastien@apple.com>
3666
3667         Fix printing in test
3668
3669         Unreviewed: fixing verbosity, shouldn't have been there.
3670
3671         * wasm/regress/175693.js:
3672         (else.else):
3673         (catch):
3674
3675 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3676
3677         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3678         https://bugs.webkit.org/show_bug.cgi?id=172543
3679
3680         Unreviewed test gardening.
3681
3682         * microbenchmarks/generator-with-several-types.js:
3683
3684 2017-08-17  JF Bastien  <jfbastien@apple.com>
3685
3686         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3687         https://bugs.webkit.org/show_bug.cgi?id=175693
3688         <rdar://problem/33952443>
3689
3690         Reviewed by Saam Barati.
3691
3692         Add a regression directory for WebAssembly tests.
3693
3694         * wasm.yaml:
3695         * wasm/regress/175693.js: Added.
3696         (else.else):
3697         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3698         (catch):
3699         * wasm/regress/175693.wasm: Added.
3700
3701 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3702
3703         Support the 'with' keyword in FTL.
3704         https://bugs.webkit.org/show_bug.cgi?id=175585
3705
3706         Reviewed by Saam Barati.
3707
3708         Also improve the JSTest/stress/with.js file to test
3709         what happens when non-objects are passed to with.
3710
3711         * stress/with.js:
3712         (foo):
3713         (i.catch):
3714         (i.with): Deleted.
3715
3716 2017-08-14  Keith Miller  <keith_miller@apple.com>
3717
3718         Add testing tool to lie to the DFG about profiles
3719         https://bugs.webkit.org/show_bug.cgi?id=175487
3720
3721         Reviewed by Saam Barati.
3722
3723         * stress/compare-eq-incomplete-profile.js: Added.
3724         (const.test.createBuiltin):
3725
3726 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3727
3728         Support the with keyword in DFG
3729         https://bugs.webkit.org/show_bug.cgi?id=175470
3730