The CleanUp after LICM is erroneously removing a Check
[WebKit-https.git] / JSTests / ChangeLog
1 2017-12-14  Saam Barati  <sbarati@apple.com>
2
3         The CleanUp after LICM is erroneously removing a Check
4         https://bugs.webkit.org/show_bug.cgi?id=180852
5         <rdar://problem/36063494>
6
7         Reviewed by Filip Pizlo.
8
9         * stress/dont-run-cleanup-after-licm.js: Added.
10
11 2017-12-14  Michael Saboff  <msaboff@apple.com>
12
13         REGRESSION (r225695): Repro crash on yahoo login page
14         https://bugs.webkit.org/show_bug.cgi?id=180761
15
16         Reviewed by JF Bastien.
17
18         New regression test.
19
20         * stress/regress-180761.js: Added.
21
22 2017-12-13  Keith Miller  <keith_miller@apple.com>
23
24         JSObjects should have a mask for loading indexed properties
25         https://bugs.webkit.org/show_bug.cgi?id=180768
26
27         Reviewed by Mark Lam.
28
29         * stress/int16-put-by-val-in-and-out-of-bounds.js:
30         (test):
31
32 2017-12-13  Saam Barati  <sbarati@apple.com>
33
34         Arrow functions need their own structure because they have different properties than sloppy functions
35         https://bugs.webkit.org/show_bug.cgi?id=180779
36         <rdar://problem/35814591>
37
38         Reviewed by Mark Lam.
39
40         * stress/arrow-function-needs-its-own-structure.js: Added.
41         (assert):
42         (readPrototype):
43         (noInline.let.f1):
44         (noInline):
45
46 2017-12-13  Saam Barati  <sbarati@apple.com>
47
48         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
49         https://bugs.webkit.org/show_bug.cgi?id=163579
50         <rdar://problem/35455798>
51
52         Reviewed by Mark Lam.
53
54         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
55         (assert):
56         (test1):
57         (i.test1):
58         (i.test1.C):
59         (i.test1.async.foo):
60         (i.test1.foo):
61         (test2):
62
63 2017-12-13  Saam Barati  <sbarati@apple.com>
64
65         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
66         https://bugs.webkit.org/show_bug.cgi?id=180734
67         <rdar://problem/35640547>
68
69         Reviewed by Yusuke Suzuki.
70
71         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
72         (__isPropertyOfType):
73         (__getProperties):
74         (__getObjects):
75         (__getRandomObject):
76         (theClass.):
77         (theClass):
78         (childClass):
79         (counter.catch):
80
81 2017-12-12  Saam Barati  <sbarati@apple.com>
82
83         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
84         https://bugs.webkit.org/show_bug.cgi?id=180725
85         <rdar://problem/35970511>
86
87         Reviewed by Michael Saboff.
88
89         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
90         (f1):
91         (f2):
92         (let.o2.valueOf):
93
94 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
95
96         [JSC] Implement optimized WeakMap and WeakSet
97         https://bugs.webkit.org/show_bug.cgi?id=179929
98
99         Reviewed by Saam Barati.
100
101         * microbenchmarks/weak-map-key.js:
102         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
103         (assert):
104         (objectKey):
105         (let.start.Date.now):
106         * stress/basic-weakmap.js: Added.
107         (shouldBe):
108         (test):
109         * stress/basic-weakset.js: Added.
110         (shouldBe):
111         (test.set new):
112         * stress/weakmap-cse-set-break.js: Added.
113         (shouldBe):
114         (test):
115         * stress/weakmap-cse.js: Added.
116         (shouldBe):
117         (test):
118         * stress/weakmap-gc.js: Added.
119         (test):
120         * stress/weakset-cse-add-break.js: Added.
121         (shouldBe):
122         (test.set new):
123         * stress/weakset-cse.js: Added.
124         (shouldBe):
125         (test.set new):
126         * stress/weakset-gc.js: Added.
127         (test.set add):
128         (test.set new):
129         (test):
130
131 2017-12-12  Saam Barati  <sbarati@apple.com>
132
133         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
134         https://bugs.webkit.org/show_bug.cgi?id=180723
135         <rdar://problem/35859726>
136
137         Reviewed by JF Bastien.
138
139         * stress/get-my-argument-by-val-constant-folding.js: Added.
140         (test):
141         (catch):
142
143 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
144
145         [ESNext][BigInt] Implement BigInt literals and JSBigInt
146         https://bugs.webkit.org/show_bug.cgi?id=179000
147
148         Reviewed by Darin Adler and Yusuke Suzuki.
149
150         * bigIntTests.yaml: Added.
151         * stress/big-int-literal-line-terminator.js: Added.
152         * stress/big-int-literals.js: Added.
153         * stress/big-int-operations-error.js: Added.
154         * stress/big-int-type-of.js: Added.
155         * stress/big-int-white-space-trailing-leading.js: Added.
156         * stress/big-int-function-apply.js: Added.
157
158 2017-12-11  Saam Barati  <sbarati@apple.com>
159
160         We need to disableCaching() in ErrorInstance when we materialize properties
161         https://bugs.webkit.org/show_bug.cgi?id=180343
162         <rdar://problem/35833002>
163
164         Reviewed by Mark Lam.
165
166         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
167         (assert):
168         (makeError):
169         (storeToStack):
170         (storeToStackAlreadyMaterialized):
171
172 2017-12-05  JF Bastien  <jfbastien@apple.com>
173
174         WebAssembly: don't eagerly checksum
175         https://bugs.webkit.org/show_bug.cgi?id=180441
176         <rdar://problem/35156628>
177
178         Reviewed by Saam Barati.
179
180         Checksum is now disabled, so tests only have <?> as the module
181         name.
182
183         * wasm/function-tests/nameSection.js:
184         * wasm/function-tests/stack-overflow.js:
185         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
186         (assertOverflows.assertThrows):
187         (assertOverflows):
188         * wasm/function-tests/stack-trace.js:
189
190 2017-12-04  JF Bastien  <jfbastien@apple.com>
191
192         Proxy all functions, except the $ objects
193         https://bugs.webkit.org/show_bug.cgi?id=180375
194
195         Reviewed by Saam Barati.
196
197         It looks like this test may have broken some executions because I
198         call some internal objects. Explicitly ignore objects whose name
199         starts with "$" because it's a bad idea anyways.
200
201         * stress/proxy-all-the-parameters.js:
202         (generateObjects):
203         (get throw):
204
205 2017-12-04  Saam Barati  <sbarati@apple.com>
206
207         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
208         https://bugs.webkit.org/show_bug.cgi?id=180366
209         <rdar://problem/35685877>
210
211         Reviewed by Michael Saboff.
212
213         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
214         (theParent):
215         (test1.base.getParentStaticValue):
216         (test1.base):
217         (test1.__v_24888.prototype.set prop):
218         (test1.__v_24888):
219         (test2.base.getParentStaticValue):
220         (test2.base):
221         (test2.__v_24888.prototype.set prop):
222         (test2.__v_24888):
223         (test2):
224
225 2017-12-01  JF Bastien  <jfbastien@apple.com>
226
227         Try proxying all function arguments
228         https://bugs.webkit.org/show_bug.cgi?id=180306
229
230         Reviewed by Saam Barati.
231
232         * stress/proxy-all-the-parameters.js: Added.
233         (isPropertyOfType):
234         (getProperties):
235         (generateObjects):
236         (getObjects):
237         (getFunctions):
238         (get throw):
239         (let.o.of.getObjects.let.f.of.getFunctions.catch):
240
241 2017-12-01  JF Bastien  <jfbastien@apple.com>
242
243         JavaScriptCore: missing exception checks in Math functions that take more than one argument
244         https://bugs.webkit.org/show_bug.cgi?id=180297
245         <rdar://problem/35745556>
246
247         Reviewed by Mark Lam.
248
249         * stress/math-exceptions.js: Added.
250         (get try):
251         (catch):
252
253 2017-12-01  JF Bastien  <jfbastien@apple.com>
254
255         JavaScriptCore: add test for weird class static getters
256         https://bugs.webkit.org/show_bug.cgi?id=180281
257         <rdar://problem/35592139>
258
259         Reviewed by Mark Lam.
260
261         I fixed a bug for it in r224927 and didn't add a test. Do so.
262
263         * stress/class-static-get-weird.js: Added.
264         (c.prototype.get name):
265         (c):
266         (c.prototype.get arguments):
267         (c.prototype.get caller):
268         (c.prototype.get length):
269
270 2017-12-01  Saam Barati  <sbarati@apple.com>
271
272         Having a bad time needs to handle ArrayClass indexing type as well
273         https://bugs.webkit.org/show_bug.cgi?id=180274
274         <rdar://problem/35667869>
275
276         Reviewed by Keith Miller and Mark Lam.
277
278         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
279         (assert):
280         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
281         (assert):
282
283 2017-12-01  JF Bastien  <jfbastien@apple.com>
284
285         WebAssembly: restore cached stack limit after out-call
286         https://bugs.webkit.org/show_bug.cgi?id=179106
287         <rdar://problem/35337525>
288
289         Reviewed by Saam Barati.
290
291         * wasm/function-tests/double-instance.js: Added.
292         (const.imp.boom):
293         (const.imp.get callAnother):
294
295 2017-11-30  JF Bastien  <jfbastien@apple.com>
296
297         WebAssembly: improve stack trace
298         https://bugs.webkit.org/show_bug.cgi?id=179343
299
300         Reviewed by Saam Barati.
301
302         Update the tests to follow the new format. Notably, SHA1 module
303         hash is now included in traces, and stubs are properly identified.
304
305         * wasm/assert.js: Add an assertion which matches regular expressions.
306         * wasm/function-tests/nameSection.js:
307         * wasm/function-tests/stack-overflow.js:
308         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
309         (assertOverflows.assertThrows.wasm.1):
310         (assertOverflows.assertThrows.wasm.0):
311         (assertOverflows.assertThrows):
312         (assertOverflows):
313         * wasm/function-tests/stack-trace.js:
314         (import.Builder.from.string_appeared_here.assert): Deleted.
315         * wasm/function-tests/trap-after-cross-instance-call.js:
316         (wasmFrameCountFromError):
317         * wasm/function-tests/trap-load-2.js:
318         (wasmFrameCountFromError):
319         * wasm/function-tests/trap-load.js:
320         (wasmFrameCountFromError):
321
322 2017-11-30  Mark Lam  <mark.lam@apple.com>
323
324         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
325         https://bugs.webkit.org/show_bug.cgi?id=180219
326         <rdar://problem/35696536>
327
328         Reviewed by Filip Pizlo.
329
330         * stress/regress-180219.js: Added.
331
332 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
333
334         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
335         https://bugs.webkit.org/show_bug.cgi?id=180190
336
337         Reviewed by Mark Lam.
338
339         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
340         (shouldBe):
341         (test1):
342         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
343         (shouldBe):
344         (test1):
345         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
346         (shouldBe):
347         (test1):
348         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
349         (shouldBe):
350         (test1):
351         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
352         (shouldBe):
353         (test1):
354         * stress/operation-in-may-have-negative-int32.js: Added.
355         (shouldBe):
356         (test2):
357         * stress/operation-in-negative-int32-cast.js: Added.
358         (shouldBe):
359         (test1):
360
361 2017-11-28  JF Bastien  <jfbastien@apple.com>
362
363         Strict and sloppy functions shouldn't share structure
364         https://bugs.webkit.org/show_bug.cgi?id=180103
365         <rdar://problem/35667847>
366
367         Reviewed by Saam Barati.
368
369         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
370         because the IC was wrong.
371         (foo):
372         (bar):
373         (baz):
374         (catch):
375         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
376         in this patch, but may as well test odd strict mode corner cases.
377         (bar):
378         (baz):
379         (catch):
380         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
381         (foo):
382         (bar):
383         (baz):
384         (catch):
385         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
386         next file, but with invalidation of the FunctionExecutable's
387         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
388         slower path.
389         (foo):
390         (bar.const.x):
391         (bar.const.y):
392         (bar):
393         (catch):
394         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
395         strict nesting works correctly.
396         (foo):
397         (bar.baz):
398         (bar):
399         * stress/strict-function-structure.js: Added. The test used to
400         assert in objectProtoFuncHasOwnProperty.
401         (foo):
402         (bar):
403         (baz):
404         * stress/strict-nested-function-structure.js: Added. Nesting.
405         (foo):
406         (bar):
407         (baz.boo):
408         (baz):
409
410 2017-11-29  Robin Morisset  <rmorisset@apple.com>
411
412         The recursive tail call optimisation is wrong on closures
413         https://bugs.webkit.org/show_bug.cgi?id=179835
414
415         Reviewed by Saam Barati.
416
417         * stress/closure-recursive-tail-call.js: Added.
418         (makeClosure):
419
420 2017-11-27  JF Bastien  <jfbastien@apple.com>
421
422         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
423         https://bugs.webkit.org/show_bug.cgi?id=180051
424         <rdar://problem/35614371>
425
426         Reviewed by Saam Barati.
427
428         * stress/rest-parameter-negative.js: Added.
429         (__f_5484):
430         (catch):
431         (__f_5485):
432         (__v_22598.catch):
433
434 2017-11-27  Saam Barati  <sbarati@apple.com>
435
436         Spread can escape when CreateRest does not
437         https://bugs.webkit.org/show_bug.cgi?id=180057
438         <rdar://problem/35676119>
439
440         Reviewed by JF Bastien.
441
442         * stress/spread-escapes-but-create-rest-does-not.js: Added.
443         (assert):
444         (getProperties):
445         (theFunc):
446         (let.obj.valueOf):
447
448 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
449
450         [DFG] Add NormalizeMapKey DFG IR
451         https://bugs.webkit.org/show_bug.cgi?id=179912
452
453         Reviewed by Saam Barati.
454
455         * stress/map-untyped-normalize-cse.js: Added.
456         (shouldBe):
457         (test):
458         * stress/map-untyped-normalize.js: Added.
459         (shouldBe):
460         (test):
461         * stress/set-untyped-normalize-cse.js: Added.
462         (shouldBe):
463         (set return.set has.set has):
464         * stress/set-untyped-normalize.js: Added.
465         (shouldBe):
466         (set return.set has):
467
468 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
469
470         [FTL] Support DeleteById and DeleteByVal
471         https://bugs.webkit.org/show_bug.cgi?id=180022
472
473         Reviewed by Saam Barati.
474
475         * stress/delete-by-id.js: Added.
476         (shouldBe):
477         (test1):
478         (test2):
479         * stress/delete-by-val-ftl.js: Added.
480         (shouldBe):
481         (test1):
482         (test2):
483
484 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
485
486         [DFG] Introduce {Set,Map,WeakMap}Fields
487         https://bugs.webkit.org/show_bug.cgi?id=179925
488
489         Reviewed by Saam Barati.
490
491         * stress/map-set-clobber-map-get.js: Added.
492         (shouldBe):
493         (test):
494         * stress/map-set-does-not-clobber-set-has.js: Added.
495         (shouldBe):
496         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
497         (shouldBe):
498         (test):
499         * stress/set-add-clobber-set-has.js: Added.
500         (shouldBe):
501         * stress/set-add-does-not-clobber-map-get.js: Added.
502         (shouldBe):
503
504 2017-11-24  Mark Lam  <mark.lam@apple.com>
505
506         Move unsafe jsc shell test functions to the $vm object.
507         https://bugs.webkit.org/show_bug.cgi?id=179980
508
509         Reviewed by Yusuke Suzuki.
510
511         * controlFlowProfiler/driver/driver.js:
512         * controlFlowProfiler/execution-count.js:
513         * controlFlowProfiler/if-statement.js:
514         * controlFlowProfiler/loop-statements.js:
515         * controlFlowProfiler/switch-statements.js:
516         * controlFlowProfiler/test-jit.js:
517         * exceptionFuzz/3d-cube.js:
518         * exceptionFuzz/date-format-xparb.js:
519         * exceptionFuzz/earley-boyer.js:
520         * heapProfiler/basic-edges.js:
521         * heapProfiler/property-edge-types.js:
522         * microbenchmarks/try-get-by-id-basic.js:
523         * microbenchmarks/try-get-by-id-polymorphic.js:
524         * modules/namespace-object-try-get.js:
525         * stress/argument-count-bytecode.js:
526         * stress/argument-intrinsic-basic.js:
527         * stress/argument-intrinsic-inlining-use-caller-arg.js:
528         * stress/argument-intrinsic-inlining-with-result-escape.js:
529         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
530         * stress/argument-intrinsic-inlining-with-vararg.js:
531         * stress/argument-intrinsic-nested-inlining.js:
532         * stress/argument-intrinsic-not-convert-to-get-argument.js:
533         * stress/argument-intrinsic-with-stack-write.js:
534         * stress/arity-mismatch-get-argument.js:
535         * stress/array-message-passing.js:
536         * stress/array-push-with-force-exit.js:
537         * stress/check-dom-with-signature.js:
538         * stress/check-sub-class.js:
539         * stress/compare-eq-incomplete-profile.js:
540         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
541         * stress/do-eval-virtual-call-correctly.js:
542         * stress/dom-jit-with-poly-proto.js:
543         * stress/domjit-exception-ic.js:
544         * stress/domjit-exception.js:
545         * stress/domjit-getter-complex-with-incorrect-object.js:
546         * stress/domjit-getter-complex.js:
547         * stress/domjit-getter-poly.js:
548         * stress/domjit-getter-proto.js:
549         * stress/domjit-getter-super-poly.js:
550         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
551         * stress/domjit-getter-type-check.js:
552         * stress/domjit-getter.js:
553         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
554         * stress/for-in-proxy-target-changed-structure.js:
555         * stress/for-in-proxy.js:
556         * stress/generational-opaque-roots.js:
557         * stress/global-const-redeclaration-setting-2.js:
558         * stress/global-const-redeclaration-setting-3.js:
559         * stress/global-const-redeclaration-setting-4.js:
560         * stress/global-const-redeclaration-setting-5.js:
561         * stress/global-const-redeclaration-setting.js:
562         * stress/import-basic.js:
563         * stress/import-from-eval.js:
564         * stress/import-reject-with-exception.js:
565         * stress/import-syntax.js:
566         * stress/impure-get-own-property-slot-inline-cache.js:
567         * stress/is-constructor.js:
568         * stress/istypedarrayview-intrinsic.js:
569         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
570         * stress/jsc-test-functions-should-be-more-robust.js:
571         * stress/object-toString-with-proxy.js:
572         * stress/poly-proto-custom-value-and-accessor.js:
573         * stress/proxy-inline-cache.js:
574         * stress/re-execute-error-module.js:
575         * stress/regress-150532.js:
576         * stress/regress-156992.js:
577         * stress/regress-179619.js:
578         * stress/resources/shadow-chicken-support.js:
579         * stress/runtime-array.js:
580         * stress/sampling-profiler-microtasks.js:
581         * stress/shadow-chicken-enabled.js:
582         * stress/spread-correct-global-object-on-exception.js:
583         * stress/super-get-by-id.js:
584         * stress/tailCallForwardArguments.js:
585         * stress/to-object-intrinsic-boolean-edge.js:
586         * stress/to-object-intrinsic-null-or-undefined-edge.js:
587         * stress/to-object-intrinsic-number-edge.js:
588         * stress/to-object-intrinsic-object-edge.js:
589         * stress/to-object-intrinsic-string-edge.js:
590         * stress/to-object-intrinsic-symbol-edge.js:
591         * stress/to-object-intrinsic.js:
592         * stress/try-catch-custom-getter-as-get-by-id.js:
593         * stress/try-get-by-id-poly-proto.js:
594         * stress/try-get-by-id-should-spill-registers-dfg.js:
595         * stress/try-get-by-id.js:
596         * typeProfiler/arrow-functions.js:
597         * typeProfiler/basic.js:
598         * typeProfiler/captured.js:
599         * typeProfiler/classes.js:
600         * typeProfiler/dfg-jit-optimizations.js:
601         * typeProfiler/dictionary-mode.js:
602         * typeProfiler/es6-block-scoping.js:
603         * typeProfiler/es6-classes.js:
604         * typeProfiler/inheritance.js:
605         * typeProfiler/int52-dfg.js:
606         * typeProfiler/loop.js:
607         * typeProfiler/optional-fields.js:
608         * typeProfiler/overflow.js:
609         * typeProfiler/return.js:
610         * typeProfiler/symbol.js:
611         * typeProfiler/weird-prototype-chain.js:
612
613 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
614
615         [DFG][FTL] Support MapSet / SetAdd intrinsics
616         https://bugs.webkit.org/show_bug.cgi?id=179858
617
618         Reviewed by Saam Barati.
619
620         * microbenchmarks/map-has-and-set.js: Added.
621         (test):
622         * stress/map-set-check-failure.js: Added.
623         (shouldBe):
624         (shouldThrow):
625         (target):
626         * stress/map-set-cse.js: Added.
627         (shouldBe):
628         (test):
629         * stress/set-add-check-failure.js: Added.
630         (shouldBe):
631         (shouldThrow):
632         (set shouldThrow):
633         * stress/set-add-cse.js: Added.
634         (shouldBe):
635
636 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
637
638         [JSC] Allow poly proto for intrinsic getters
639         https://bugs.webkit.org/show_bug.cgi?id=179550
640
641         Reviewed by Saam Barati.
642
643         This change is also tested by existing tests.
644
645             1. stress/intrinsic-getter-with-poly-proto.js
646             2. stress/poly-proto-intrinsic-getter-correctness.js
647
648         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
649         (shouldBe):
650         (makePolyProtoObject.foo.C):
651         (makePolyProtoObject.foo):
652         (makePolyProtoObject):
653         (target):
654         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
655         (shouldBe):
656         (makePolyProtoObject.foo.C):
657         (makePolyProtoObject.foo):
658         (makePolyProtoObject):
659         (target):
660
661 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
662
663         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
664         https://bugs.webkit.org/show_bug.cgi?id=179744
665
666         Reviewed by Michael Catanzaro.
667
668         This test uses too much memory for our buildbots on these platforms
669         and gets OOM-killed.
670
671         * stress/unshiftCountSlowCase-correct-postCapacity.js:
672         Skip if $memoryLimited and linux.
673
674 2017-11-17  JF Bastien  <jfbastien@apple.com>
675
676         WebAssembly JS API: throw when a promise can't be created
677         https://bugs.webkit.org/show_bug.cgi?id=179826
678         <rdar://problem/35455813>
679
680         Reviewed by Mark Lam.
681
682         Test WebAssembly.{compile,instantiate} where promise creation
683         fails because of a stack overflow.
684
685         * wasm/js-api/promise-stack-overflow.js: Added.
686         (const.runNearStackLimit.f.const.t):
687         (async.testCompile):
688         (async.testInstantiate):
689
690 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
691
692         Unreviewed, mark regress-178385.js as memory exhausting
693
694         * stress/regress-178385.js:
695
696 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
697
698         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
699
700         Unreviewed test gardening.
701
702         * test262.yaml:
703
704 2017-11-16  Robin Morisset  <rmorisset@apple.com>
705
706         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
707         https://bugs.webkit.org/show_bug.cgi?id=179763
708         <rdar://problem/35550513>
709
710         Reviewed by Keith Miller.
711
712         Just adding a slightly cleaned-up version of the original fuzzer-found test.
713
714         * stress/tdz-this-in-try-catch.js: Added.
715         (__v_6388):
716         (__v_6392):
717
718 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
719
720         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
721         https://bugs.webkit.org/show_bug.cgi?id=179594
722
723         Reviewed by Saam Barati.
724
725         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
726         (shouldBe):
727         (args):
728         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
729         (shouldBe):
730         (args):
731
732 2017-11-14  Saam Barati  <sbarati@apple.com>
733
734         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
735         https://bugs.webkit.org/show_bug.cgi?id=179639
736         <rdar://problem/35513018>
737
738         Reviewed by JF Bastien.
739
740         * wasm/function-tests/grow-memory-cause-gc.js: Added.
741         (escape):
742         (i.func):
743
744 2017-11-13  Mark Lam  <mark.lam@apple.com>
745
746         Add more overflow check book-keeping for MarkedArgumentBuffer.
747         https://bugs.webkit.org/show_bug.cgi?id=179634
748         <rdar://problem/35492517>
749
750         Reviewed by Saam Barati.
751
752         * stress/regress-179634.js: Added.
753
754 2017-11-13  Mark Lam  <mark.lam@apple.com>
755
756         Make the jsc shell loadGetterFromGetterSetter() function more robust.
757         https://bugs.webkit.org/show_bug.cgi?id=179619
758         <rdar://problem/35492518>
759
760         Reviewed by Saam Barati.
761
762         * stress/regress-179619.js: Added.
763
764 2017-11-12  Mark Lam  <mark.lam@apple.com>
765
766         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
767         https://bugs.webkit.org/show_bug.cgi?id=179562
768         <rdar://problem/35467022>
769
770         Reviewed by Saam Barati.
771
772         * regress-179562.js: Added.
773
774 2017-11-08  Saam Barati  <sbarati@apple.com>
775
776         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
777         https://bugs.webkit.org/show_bug.cgi?id=177792
778
779         Reviewed by Yusuke Suzuki.
780
781         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
782         (assert):
783         (foo.Foo.prototype.ensureX):
784         (foo.Foo):
785         (foo):
786         (access):
787
788 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
789
790         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
791         https://bugs.webkit.org/show_bug.cgi?id=178592
792
793         Unreviewed test gardening.
794
795         * test262.yaml:
796
797 2017-11-08  Robin Morisset  <rmorisset@apple.com>
798
799         Turn recursive tail calls into loops
800         https://bugs.webkit.org/show_bug.cgi?id=176601
801
802         Reviewed by Saam Barati.
803
804         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
805
806         Add some simple test that computes factorial in several ways, and other trivial computations.
807         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
808         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
809         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
810         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
811
812         * stress/inline-call-to-recursive-tail-call.js: Added.
813         (factorial.aux):
814         (factorial):
815         (factorial2.aux2):
816         (factorial2.id):
817         (factorial2):
818         (factorial3.aux3):
819         (factorial3):
820         (aux4):
821         (factorial4):
822         (foo):
823         (auxBar):
824         (bar):
825         (test):
826
827 2017-11-07  Mark Lam  <mark.lam@apple.com>
828
829         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
830         https://bugs.webkit.org/show_bug.cgi?id=179355
831         <rdar://problem/35263053>
832
833         Reviewed by Saam Barati.
834
835         * stress/regress-179355.js: Added.
836
837 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
838
839         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
840         https://bugs.webkit.org/show_bug.cgi?id=144458
841
842         Reviewed by Saam Barati.
843
844         * microbenchmarks/dfg-internal-function-call.js: Added.
845         (target):
846         * microbenchmarks/dfg-internal-function-construct.js: Added.
847         (target):
848         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
849         (target):
850         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
851         (target):
852         * stress/dfg-internal-function-call.js: Added.
853         (shouldBe):
854         (target):
855         * stress/dfg-internal-function-construct.js: Added.
856         (shouldBe):
857         (target):
858         * stress/internal-function-call.js: Added.
859         (shouldBe):
860         * stress/internal-function-construct.js: Added.
861         (shouldBe):
862
863 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
864
865         [Win] Skip stress/regress-178385.js.
866         https://bugs.webkit.org/show_bug.cgi?id=179298
867
868         Unreviewed test gardening.
869
870         * stress/regress-178385.js:
871
872 2017-11-03  Keith Miller  <keith_miller@apple.com>
873
874         Add test for ic with side effects
875         https://bugs.webkit.org/show_bug.cgi?id=179268
876
877         Reviewed by Saam Barati.
878
879         * stress/put-inline-cache-side-effects.js: Added.
880         (let.i.of.objs.keys):
881         (f):
882
883 2017-11-03  Mark Lam  <mark.lam@apple.com>
884
885         CachedCall (and its clients) needs overflow checks.
886         https://bugs.webkit.org/show_bug.cgi?id=179185
887
888         Reviewed by JF Bastien.
889
890         * stress/regress-179185.js: Added.
891
892 2017-11-02  Michael Saboff  <msaboff@apple.com>
893
894         DFG needs to handle code motion of code in for..in loop bodies
895         https://bugs.webkit.org/show_bug.cgi?id=179212
896
897         Reviewed by Keith Miller.
898
899         New regression test.
900
901         * stress/for-in-side-effects.js: Added.
902         (getPrototypeOf):
903         (reset):
904         (testWithoutFTL.f):
905         (testWithoutFTL):
906         (testWithFTL.f):
907         (testWithFTL):
908
909 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
910
911         AI does not correctly model the clobber case of ArithClz32
912         https://bugs.webkit.org/show_bug.cgi?id=179188
913
914         Reviewed by Michael Saboff.
915
916         * stress/arith-clz32-effects.js: Added.
917         (foo):
918         (valueOf):
919
920 2017-11-01  Michael Saboff  <msaboff@apple.com>
921
922         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
923         https://bugs.webkit.org/show_bug.cgi?id=179140
924
925         Reviewed by Saam Barati.
926
927         New regression test.
928
929         * stress/regress-179140.js: Added.
930         (testWithoutFTL):
931         (testWithFTL):
932
933 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
934
935         [JSC] Introduce @toObject
936         https://bugs.webkit.org/show_bug.cgi?id=178726
937
938         Reviewed by Saam Barati.
939
940         * stress/array-copywithin.js:
941         (shouldThrow):
942         * stress/object-constructor-boolean-edge.js: Added.
943         (shouldBe):
944         (test):
945         * stress/object-constructor-global.js: Added.
946         (shouldBe):
947         * stress/object-constructor-null-edge.js: Added.
948         (shouldBe):
949         (test):
950         * stress/object-constructor-number-edge.js: Added.
951         (shouldBe):
952         (test):
953         * stress/object-constructor-object-edge.js: Added.
954         (shouldBe):
955         (test):
956         (i.arg):
957         * stress/object-constructor-string-edge.js: Added.
958         (shouldBe):
959         (test):
960         * stress/object-constructor-symbol-edge.js: Added.
961         (shouldBe):
962         (test):
963         * stress/object-constructor-undefined-edge.js: Added.
964         (shouldBe):
965         (test):
966         * stress/symbol-array-from.js: Added.
967         (shouldBe):
968         * stress/to-object-intrinsic-boolean-edge.js: Added.
969         (shouldBe):
970         (builtin.createBuiltin):
971         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
972         (shouldThrow):
973         * stress/to-object-intrinsic-number-edge.js: Added.
974         (shouldBe):
975         (builtin.createBuiltin):
976         * stress/to-object-intrinsic-object-edge.js: Added.
977         (shouldBe):
978         (builtin.createBuiltin):
979         (i.arg):
980         * stress/to-object-intrinsic-string-edge.js: Added.
981         (shouldBe):
982         (builtin.createBuiltin):
983         * stress/to-object-intrinsic-symbol-edge.js: Added.
984         (shouldBe):
985         (builtin.createBuiltin):
986         * stress/to-object-intrinsic.js: Added.
987         (shouldBe):
988         (shouldThrow):
989         (builtin.createBuiltin):
990
991 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
992
993         [DFG][FTL] Introduce StringSlice
994         https://bugs.webkit.org/show_bug.cgi?id=178934
995
996         Reviewed by Saam Barati.
997
998         * microbenchmarks/string-slice-empty.js: Added.
999         (slice):
1000         * microbenchmarks/string-slice-one-char.js: Added.
1001         (slice):
1002         * microbenchmarks/string-slice.js: Added.
1003         (slice):
1004
1005 2017-10-26  Michael Saboff  <msaboff@apple.com>
1006
1007         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1008         https://bugs.webkit.org/show_bug.cgi?id=178890
1009
1010         Reviewed by Keith Miller.
1011
1012         New regression test.
1013
1014         * stress/regress-178890.js: Added.
1015
1016 2017-10-26  Mark Lam  <mark.lam@apple.com>
1017
1018         JSRopeString::RopeBuilder::append() should check for overflows.
1019         https://bugs.webkit.org/show_bug.cgi?id=178385
1020         <rdar://problem/35027468>
1021
1022         Reviewed by Saam Barati.
1023
1024         * stress/regress-178385.js: Added.
1025
1026 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1027
1028         Unreviewed, rolling out r223961.
1029
1030         The change that required this has been rolled out.
1031
1032         Reverted changeset:
1033
1034         "Mark test262.yaml/test262/test/language/statements/try/tco-
1035         catch.js as passing."
1036         https://bugs.webkit.org/show_bug.cgi?id=178592
1037         https://trac.webkit.org/changeset/223961
1038
1039 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1040
1041         Unreviewed, rolling out r223691 and r223729.
1042         https://bugs.webkit.org/show_bug.cgi?id=178834
1043
1044         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1045         by rniwa on #webkit).
1046
1047         Reverted changesets:
1048
1049         "Turn recursive tail calls into loops"
1050         https://bugs.webkit.org/show_bug.cgi?id=176601
1051         https://trac.webkit.org/changeset/223691
1052
1053         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1054         comparison is always false due to limited range of data type
1055         [-Wtype-limits]"
1056         https://bugs.webkit.org/show_bug.cgi?id=178543
1057         https://trac.webkit.org/changeset/223729
1058
1059 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1060
1061         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1062         https://bugs.webkit.org/show_bug.cgi?id=178592
1063
1064         Unreviewed test gardening.
1065
1066         * test262.yaml:
1067
1068 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1069
1070         [FTL] Support NewStringObject
1071         https://bugs.webkit.org/show_bug.cgi?id=178737
1072
1073         Reviewed by Saam Barati.
1074
1075         * stress/new-string-object.js: Added.
1076         (shouldBe):
1077         (test):
1078
1079 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1080
1081         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1082         https://bugs.webkit.org/show_bug.cgi?id=178308
1083
1084         Reviewed by Mark Lam.
1085
1086         * test262.yaml:
1087
1088 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1089
1090         [JSC] Use fastJoin in Array#toString
1091         https://bugs.webkit.org/show_bug.cgi?id=178062
1092
1093         Reviewed by Darin Adler.
1094
1095         * microbenchmarks/contiguous-array-to-string.js: Added.
1096         (target):
1097         * microbenchmarks/double-array-to-string.js: Added.
1098         (target):
1099         * microbenchmarks/int32-array-to-string.js: Added.
1100         (target):
1101
1102 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1103
1104         stress/check-string-ident.js is improperly skipped
1105         https://bugs.webkit.org/show_bug.cgi?id=178642
1106
1107         Reviewed by Saam Barati.
1108
1109         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1110         since it enforces the run-jsc-stress-tests script to still set up the
1111         test to run, despite the skip directive that's used before.
1112
1113 2017-10-20  Mark Lam  <mark.lam@apple.com>
1114
1115         Add a test case for r214334.
1116         https://bugs.webkit.org/show_bug.cgi?id=169941
1117         <rdar://problem/31221258>
1118
1119         Reviewed by JF Bastien.
1120
1121         * stress/regress-169941.js: Added.
1122
1123 2017-10-19  JF Bastien  <jfbastien@apple.com>
1124
1125         WebAssembly: no VM / JS version of everything but Instance
1126         https://bugs.webkit.org/show_bug.cgi?id=177473
1127
1128         Reviewed by Filip Pizlo, Saam Barati.
1129
1130         - Exceeding max on memory growth now returns a range error as per
1131         spec. This is a (very minor) breaking change: it used to throw OOM
1132         error. Update the corresponding test.
1133
1134         * wasm/js-api/memory-grow.js:
1135         (assertEq):
1136         * wasm/js-api/table.js:
1137         (assert.throws):
1138
1139 2017-10-19  Mark Lam  <mark.lam@apple.com>
1140
1141         Stringifier::appendStringifiedValue() is missing an exception check.
1142         https://bugs.webkit.org/show_bug.cgi?id=178386
1143         <rdar://problem/35027610>
1144
1145         Reviewed by Saam Barati.
1146
1147         * stress/regress-178386.js: Added.
1148
1149 2017-10-19  Michael Saboff  <msaboff@apple.com>
1150
1151         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1152         https://bugs.webkit.org/show_bug.cgi?id=178521
1153
1154         Reviewed by JF Bastien.
1155
1156         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1157         now passes with the current version (5.0) of the Emoji spec.
1158
1159 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1160
1161         Turn recursive tail calls into loops
1162         https://bugs.webkit.org/show_bug.cgi?id=176601
1163
1164         Reviewed by Saam Barati.
1165
1166         Add some simple test that computes factorial in several ways, and other trivial computations.
1167         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1168         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1169         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1170         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1171
1172         * stress/inline-call-to-recursive-tail-call.js: Added.
1173         (factorial.aux):
1174         (factorial):
1175         (factorial2.aux):
1176         (factorial2.id):
1177         (factorial2):
1178         (factorial3.aux):
1179         (factorial3):
1180         (aux):
1181         (factorial4):
1182         (test):
1183
1184 2017-10-18  Mark Lam  <mark.lam@apple.com>
1185
1186         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1187         https://bugs.webkit.org/show_bug.cgi?id=177600
1188         <rdar://problem/34710985>
1189
1190         Reviewed by Saam Barati.
1191
1192         * stress/regress-177600.js: Added.
1193
1194 2017-10-18  Mark Lam  <mark.lam@apple.com>
1195
1196         The compiler should always register a structure when it adds its transitionWatchPointSet.
1197         https://bugs.webkit.org/show_bug.cgi?id=178420
1198         <rdar://problem/34814024>
1199
1200         Reviewed by Saam Barati and Filip Pizlo.
1201
1202         * stress/regress-178420.js: Added.
1203         (new.Array.10000.map):
1204
1205 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1206
1207         [JSC] __proto__ getter should be fast
1208         https://bugs.webkit.org/show_bug.cgi?id=178067
1209
1210         Reviewed by Saam Barati.
1211
1212         * stress/dfg-object-proto-accessor.js: Added.
1213         (shouldBe):
1214         (shouldThrow):
1215         (target):
1216         * stress/dfg-object-proto-getter.js: Added.
1217         (shouldBe):
1218         (shouldThrow):
1219         (target):
1220         * stress/dfg-object-prototype-of.js: Added.
1221         (shouldBe):
1222         (shouldThrow):
1223         (target):
1224         * stress/dfg-reflect-get-prototype-of.js: Added.
1225         (shouldBe):
1226         (shouldThrow):
1227         (target):
1228         * stress/intrinsic-getter-with-poly-proto.js: Added.
1229         (shouldBe):
1230         (makePolyProtoObject.foo.C):
1231         (makePolyProtoObject.foo):
1232         (makePolyProtoObject):
1233         (target):
1234         * stress/object-get-prototype-of-filtered.js: Added.
1235         (shouldBe):
1236         (shouldThrow):
1237         (target):
1238         (i.Cocoa):
1239         * stress/object-get-prototype-of-mono-proto.js: Added.
1240         (shouldBe):
1241         (makePolyProtoObject.foo.C):
1242         (makePolyProtoObject.foo):
1243         (makePolyProtoObject):
1244         (target):
1245         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1246         (shouldBe):
1247         (makePolyProtoObject.foo.C):
1248         (makePolyProtoObject.foo):
1249         (makePolyProtoObject):
1250         (target):
1251         * stress/object-get-prototype-of-poly-proto.js: Added.
1252         (shouldBe):
1253         (makePolyProtoObject.foo.C):
1254         (makePolyProtoObject.foo):
1255         (makePolyProtoObject):
1256         (target):
1257         * stress/object-proto-getter-filtered.js: Added.
1258         (shouldBe):
1259         (shouldThrow):
1260         (target):
1261         (i.Cocoa):
1262         * stress/object-proto-getter-poly-mono-proto.js: Added.
1263         (shouldBe):
1264         (makePolyProtoObject.foo.C):
1265         (makePolyProtoObject.foo):
1266         (makePolyProtoObject):
1267         (target):
1268         * stress/object-proto-getter-poly-proto.js: Added.
1269         (shouldBe):
1270         (makePolyProtoObject.foo.C):
1271         (makePolyProtoObject.foo):
1272         (makePolyProtoObject):
1273         (target):
1274         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1275         * stress/string-proto.js: Added.
1276         (shouldBe):
1277         (target):
1278
1279 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1280
1281         Unreviewed, rolling out r223523.
1282
1283         A test for this change is failing on debug JSC bots.
1284
1285         Reverted changeset:
1286
1287         "[JSC] __proto__ getter should be fast"
1288         https://bugs.webkit.org/show_bug.cgi?id=178067
1289         https://trac.webkit.org/changeset/223523
1290
1291 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1292
1293         [JSC] __proto__ getter should be fast
1294         https://bugs.webkit.org/show_bug.cgi?id=178067
1295
1296         Reviewed by Saam Barati.
1297
1298         * stress/dfg-object-proto-accessor.js: Added.
1299         (shouldBe):
1300         (shouldThrow):
1301         (target):
1302         * stress/dfg-object-proto-getter.js: Added.
1303         (shouldBe):
1304         (shouldThrow):
1305         (target):
1306         * stress/dfg-object-prototype-of.js: Added.
1307         (shouldBe):
1308         (shouldThrow):
1309         (target):
1310         * stress/dfg-reflect-get-prototype-of.js: Added.
1311         (shouldBe):
1312         (shouldThrow):
1313         (target):
1314         * stress/object-get-prototype-of-filtered.js: Added.
1315         (shouldBe):
1316         (shouldThrow):
1317         (target):
1318         (i.Cocoa):
1319         * stress/object-get-prototype-of-mono-proto.js: Added.
1320         (shouldBe):
1321         (makePolyProtoObject.foo.C):
1322         (makePolyProtoObject.foo):
1323         (makePolyProtoObject):
1324         (target):
1325         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1326         (shouldBe):
1327         (makePolyProtoObject.foo.C):
1328         (makePolyProtoObject.foo):
1329         (makePolyProtoObject):
1330         (target):
1331         * stress/object-get-prototype-of-poly-proto.js: Added.
1332         (shouldBe):
1333         (makePolyProtoObject.foo.C):
1334         (makePolyProtoObject.foo):
1335         (makePolyProtoObject):
1336         (target):
1337         * stress/object-proto-getter-filtered.js: Added.
1338         (shouldBe):
1339         (shouldThrow):
1340         (target):
1341         (i.Cocoa):
1342         * stress/object-proto-getter-poly-mono-proto.js: Added.
1343         (shouldBe):
1344         (makePolyProtoObject.foo.C):
1345         (makePolyProtoObject.foo):
1346         (makePolyProtoObject):
1347         (target):
1348         * stress/object-proto-getter-poly-proto.js: Added.
1349         (shouldBe):
1350         (makePolyProtoObject.foo.C):
1351         (makePolyProtoObject.foo):
1352         (makePolyProtoObject):
1353         (target):
1354         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1355         * stress/string-proto.js: Added.
1356         (shouldBe):
1357         (target):
1358
1359 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1360
1361         Reland "Add Above/Below comparisons for UInt32 patterns"
1362         https://bugs.webkit.org/show_bug.cgi?id=177281
1363
1364         Reviewed by Saam Barati.
1365
1366         * stress/uint32-comparison-jump.js: Added.
1367         (shouldBe):
1368         (above):
1369         (aboveOrEqual):
1370         (below):
1371         (belowOrEqual):
1372         (notAbove):
1373         (notAboveOrEqual):
1374         (notBelow):
1375         (notBelowOrEqual):
1376         * stress/uint32-comparison.js: Added.
1377         (shouldBe):
1378         (above):
1379         (aboveOrEqual):
1380         (below):
1381         (belowOrEqual):
1382         (aboveTest):
1383         (aboveOrEqualTest):
1384         (belowTest):
1385         (belowOrEqualTest):
1386
1387 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1388
1389         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1390         https://bugs.webkit.org/show_bug.cgi?id=178210
1391
1392         Reviewed by Saam Barati.
1393
1394         * wasm/function-tests/trap-from-start-async.js:
1395         (async.StartTrapsAsync):
1396         * wasm/function-tests/trap-from-start.js:
1397         (StartTraps):
1398         * wasm/js-api/web-assembly-function.js:
1399         (assert.eq.Object.getPrototypeOf):
1400         * wasm/js-api/wrapper-function.js:
1401         (return.new.WebAssembly.Module):
1402         (assert.throws.makeInstance): Deleted.
1403         (assert.throws.Bar): Deleted.
1404         (assert.throws): Deleted.
1405
1406 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1407
1408         Enable gigacage on iOS
1409         https://bugs.webkit.org/show_bug.cgi?id=177586
1410
1411         Reviewed by JF Bastien.
1412         
1413         Add tests for when Gigacage gets runtime disabled.
1414
1415         * stress/disable-gigacage-arrays.js: Added.
1416         (foo):
1417         * stress/disable-gigacage-strings.js: Added.
1418         (foo):
1419         * stress/disable-gigacage-typed-arrays.js: Added.
1420         (foo):
1421
1422 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1423
1424         import.meta should not be assignable
1425         https://bugs.webkit.org/show_bug.cgi?id=178202
1426
1427         Reviewed by Saam Barati.
1428
1429         * modules/import-meta-assignment.js: Added.
1430         (shouldThrow):
1431         (SyntaxError.import.meta.can.shouldThrow):
1432
1433 2017-10-11  Saam Barati  <sbarati@apple.com>
1434
1435         Unreviewed. Actually skip certain type profiler tests in debug.
1436
1437         * typeProfiler.yaml:
1438         * typeProfiler/deltablue-for-of.js:
1439         * typeProfiler/getter-richards.js:
1440
1441 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1442
1443         Unreviewed, rolling out r223113 and r223121.
1444         https://bugs.webkit.org/show_bug.cgi?id=178182
1445
1446         Reintroduced 20% regression on Kraken (Requested by rniwa on
1447         #webkit).
1448
1449         Reverted changesets:
1450
1451         "Enable gigacage on iOS"
1452         https://bugs.webkit.org/show_bug.cgi?id=177586
1453         https://trac.webkit.org/changeset/223113
1454
1455         "Use one virtual allocation for all gigacages and their
1456         runways"
1457         https://bugs.webkit.org/show_bug.cgi?id=178050
1458         https://trac.webkit.org/changeset/223121
1459
1460 2017-10-11  Michael Saboff  <msaboff@apple.com>
1461
1462         Disable test262 named capture group tests with direct unicode names and with references before definitions
1463         https://bugs.webkit.org/show_bug.cgi?id=178177
1464
1465         Reviewed by Keith Miller.
1466
1467         Bugs to track fixing these test are:
1468         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1469             "Add support in named capture group identifiers for direct surrogate pairs"
1470         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1471             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1472
1473         * test262.yaml:
1474
1475 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1476
1477         Object properties are undefined in super.call() but not in this.call()
1478         https://bugs.webkit.org/show_bug.cgi?id=177230
1479
1480         Reviewed by Saam Barati.
1481
1482         * stress/super-call-function-subclass.js: Added.
1483         (assert):
1484         (A.prototype.t):
1485         (A):
1486         * stress/super-dot-call-and-apply.js: Added.
1487         (assert):
1488         (A):
1489         (A.prototype.call):
1490         (A.prototype.apply):
1491         (B.prototype.testSuper):
1492         (B):
1493         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1494         (D.prototype.testSuper):
1495         (D):
1496
1497 2017-10-10  Saam Barati  <sbarati@apple.com>
1498
1499         The prototype cache should be aware of the Executable it generates a Structure for
1500         https://bugs.webkit.org/show_bug.cgi?id=177907
1501
1502         Reviewed by Filip Pizlo.
1503
1504         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1505         (assert):
1506         (foo.C):
1507         (foo):
1508         (bar.C):
1509         (bar):
1510         (access):
1511         (makeLongChain):
1512         (accessY):
1513
1514 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1515
1516         `async` should be able to be used as an imported binding name
1517         https://bugs.webkit.org/show_bug.cgi?id=176573
1518
1519         Reviewed by Saam Barati.
1520
1521         * modules/import-default-async.js: Added.
1522         * modules/import-named-async-as.js: Added.
1523         * modules/import-named-async.js: Added.
1524         * modules/import-named-async/target.js: Added.
1525         * modules/import-namespace-async.js: Added.
1526         * test262.yaml:
1527
1528 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1529
1530         Enable gigacage on iOS
1531         https://bugs.webkit.org/show_bug.cgi?id=177586
1532
1533         Reviewed by JF Bastien.
1534         
1535         Add tests for when Gigacage gets runtime disabled.
1536
1537         * stress/disable-gigacage-arrays.js: Added.
1538         (foo):
1539         * stress/disable-gigacage-strings.js: Added.
1540         (foo):
1541         * stress/disable-gigacage-typed-arrays.js: Added.
1542         (foo):
1543
1544 2017-10-09  Michael Saboff  <msaboff@apple.com>
1545
1546         Implement RegExp Unicode property escapes
1547         https://bugs.webkit.org/show_bug.cgi?id=172069
1548
1549         Reviewed by JF Bastien.
1550
1551         Enabled Unicode Property tests.
1552
1553         * test262.yaml:
1554
1555 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1556
1557         Unreviewed, rolling out r223015 and r223025.
1558         https://bugs.webkit.org/show_bug.cgi?id=178093
1559
1560         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1561         #webkit).
1562
1563         Reverted changesets:
1564
1565         "Enable gigacage on iOS"
1566         https://bugs.webkit.org/show_bug.cgi?id=177586
1567         http://trac.webkit.org/changeset/223015
1568
1569         "Unreviewed, disable Gigacage on ARM64 Linux"
1570         https://bugs.webkit.org/show_bug.cgi?id=177586
1571         http://trac.webkit.org/changeset/223025
1572
1573 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1574
1575         Update expectations for test262 tests that pass after r223043.
1576         https://bugs.webkit.org/show_bug.cgi?id=176685
1577
1578         Unreviewed test gardening.
1579
1580         * test262.yaml:
1581
1582 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1583
1584         Unreviewed, rolling out r223022.
1585
1586         This change introduced 18 test262 failures.
1587
1588         Reverted changeset:
1589
1590         "`async` should be able to be used as an imported binding
1591         name"
1592         https://bugs.webkit.org/show_bug.cgi?id=176573
1593         http://trac.webkit.org/changeset/223022
1594
1595 2017-10-09  Saam Barati  <sbarati@apple.com>
1596
1597         3 poly-proto JSC tests timing out on debug after r222827
1598         https://bugs.webkit.org/show_bug.cgi?id=177880
1599         <rdar://problem/34817122>
1600
1601         Unreviewed.
1602
1603         I'm skipping these type profiler tests on debug since they are long running.
1604
1605         * typeProfiler/deltablue-for-of.js:
1606         * typeProfiler/getter-richards.js:
1607
1608 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1609
1610         Safari 10 /11 problem with if (!await get(something)).
1611         https://bugs.webkit.org/show_bug.cgi?id=176685
1612
1613         Reviewed by Saam Barati.
1614
1615         * stress/async-await-basic.js:
1616         (awaitEpression.async):
1617         * stress/async-await-syntax.js:
1618         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1619         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1620
1621 2017-10-08  Saam Barati  <sbarati@apple.com>
1622
1623         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1624
1625         * typeProfiler/deltablue-for-of.js:
1626         * typeProfiler/getter-richards.js:
1627
1628 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1629
1630         `async` should be able to be used as an imported binding name
1631         https://bugs.webkit.org/show_bug.cgi?id=176573
1632
1633         Reviewed by Darin Adler.
1634
1635         * modules/import-default-async.js: Added.
1636         * modules/import-named-async-as.js: Added.
1637         * modules/import-named-async.js: Added.
1638         * modules/import-named-async/target.js: Added.
1639         * modules/import-namespace-async.js: Added.
1640
1641 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1642
1643         Enable gigacage on iOS
1644         https://bugs.webkit.org/show_bug.cgi?id=177586
1645
1646         Reviewed by JF Bastien.
1647         
1648         Add tests for when Gigacage gets runtime disabled.
1649
1650         * stress/disable-gigacage-arrays.js: Added.
1651         (foo):
1652         * stress/disable-gigacage-strings.js: Added.
1653         (foo):
1654         * stress/disable-gigacage-typed-arrays.js: Added.
1655         (foo):
1656
1657 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1658
1659         Unreviewed, rolling out r222791 and r222873.
1660         https://bugs.webkit.org/show_bug.cgi?id=178031
1661
1662         Caused crashes with workers/wasm LayoutTests (Requested by
1663         ryanhaddad on #webkit).
1664
1665         Reverted changesets:
1666
1667         "WebAssembly: no VM / JS version of everything but Instance"
1668         https://bugs.webkit.org/show_bug.cgi?id=177473
1669         http://trac.webkit.org/changeset/222791
1670
1671         "WebAssembly: address no VM / JS follow-ups"
1672         https://bugs.webkit.org/show_bug.cgi?id=177887
1673         http://trac.webkit.org/changeset/222873
1674
1675 2017-10-05  Saam Barati  <sbarati@apple.com>
1676
1677         Make sure all prototypes under poly proto get added into the VM's prototype map
1678         https://bugs.webkit.org/show_bug.cgi?id=177909
1679
1680         Reviewed by Keith Miller.
1681
1682         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1683         (assert):
1684         (foo.C):
1685         (foo):
1686         (set x):
1687
1688 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1689
1690         [JSC] Introduce import.meta
1691         https://bugs.webkit.org/show_bug.cgi?id=177703
1692
1693         Reviewed by Filip Pizlo.
1694
1695         * modules/import-meta-syntax.js: Added.
1696         (shouldThrow):
1697         (shouldNotThrow):
1698         * modules/import-meta.js: Added.
1699         * modules/import-meta/cocoa.js: Added.
1700         * modules/resources/assert.js:
1701         (export.shouldNotThrow):
1702         * stress/import-syntax.js:
1703
1704 2017-10-04  Saam Barati  <sbarati@apple.com>
1705
1706         Make pertinent AccessCases watch the poly proto watchpoint
1707         https://bugs.webkit.org/show_bug.cgi?id=177765
1708
1709         Reviewed by Keith Miller.
1710
1711         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1712         (assert):
1713         (foo.C):
1714         (foo):
1715         (validate):
1716         * stress/poly-proto-clear-stub.js: Added.
1717         (assert):
1718         (foo.C):
1719         (foo):
1720
1721 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1722
1723         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1724
1725         Unreviewed test gardening.
1726
1727         * test262.yaml:
1728
1729 2017-10-04  Saam Barati  <sbarati@apple.com>
1730
1731         3 poly-proto JSC tests timing out on debug after r222827
1732         https://bugs.webkit.org/show_bug.cgi?id=177880
1733
1734         Rubber stamped by Mark Lam.
1735
1736         * microbenchmarks/poly-proto-access.js:
1737         * typeProfiler/deltablue-for-of.js:
1738         * typeProfiler/getter-richards.js:
1739
1740 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1741
1742         Unreviewed, marking tco-catch.js as a failure after test262 update
1743         https://bugs.webkit.org/show_bug.cgi?id=177859
1744
1745         * test262.yaml:
1746
1747 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1748
1749         Unreviewed, marking one async iterator test262 test failed
1750         https://bugs.webkit.org/show_bug.cgi?id=177859
1751
1752         * test262.yaml:
1753
1754 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1755
1756         [Test262] Update Test262 to Oct 4 version
1757         https://bugs.webkit.org/show_bug.cgi?id=177859
1758
1759         Reviewed by Sam Weinig.
1760
1761         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1762         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1763
1764         * test262.yaml:
1765         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1766         (checkSequence):
1767         * test262/harness/typeCoercion.js:
1768         (testCoercibleToIndexZero):
1769         (testCoercibleToIndexOne):
1770         (testCoercibleToIndexFromIndex):
1771         (testNotCoercibleToIndex.testPrimitiveValue):
1772         (testNotCoercibleToInteger):
1773         (testCoercibleToBigIntZero.testPrimitiveValue):
1774         (testCoercibleToBigIntZero):
1775         (testCoercibleToBigIntOne.testPrimitiveValue):
1776         (testCoercibleToBigIntOne):
1777         (testPrimitiveValue):
1778         (testCoercibleToBigIntFromBigInt):
1779         (testNotCoercibleToBigInt.testPrimitiveValue):
1780         (testNotCoercibleToBigInt.testStringValue):
1781         (testNotCoercibleToBigInt):
1782         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1783         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1784         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1785         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1786         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1787         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1788         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1789         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1790         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1791         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1792         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1793         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1794         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1795         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1796         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1797         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1798         (testCoercibleToBigIntZero):
1799         (testCoercibleToBigIntOne):
1800         (testNotCoercibleToBigInt):
1801         (MyError): Deleted.
1802         (valueOf): Deleted.
1803         (toString): Deleted.
1804         (Symbol.toPrimitive): Deleted.
1805         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1806         (testCoercibleToIndexZero):
1807         (testCoercibleToIndexOne):
1808         (testNotCoercibleToIndex):
1809         (MyError): Deleted.
1810         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1811         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1812         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1813         (BigInt.asIntN.valueOf): Deleted.
1814         (BigInt.asIntN.toString): Deleted.
1815         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1816         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1817         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1818         (testCoercibleToBigIntZero):
1819         (testCoercibleToBigIntOne):
1820         (testNotCoercibleToBigInt):
1821         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1822         (testCoercibleToIndexZero):
1823         (testCoercibleToIndexOne):
1824         (testNotCoercibleToIndex):
1825         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1826         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1827         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1828         (bits.valueOf):
1829         (bigint.valueOf):
1830         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1831         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1832         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1833         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1834         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1835         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1836         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1837         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1838         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1839         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1840         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1841         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1842         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1843         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1844         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1845         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1846         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1847         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1848         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1849         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1850         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1851         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1852         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1853         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1854         (replacer):
1855         (BigInt.prototype.toJSON):
1856         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1857         (replacer):
1858         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1859         (BigInt.prototype.toJSON):
1860         * test262/test/built-ins/JSON/stringify/bigint.js:
1861         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1862         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1863         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1864         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1865         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1866         * test262/test/built-ins/Object/proto-from-ctor.js:
1867         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1868         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1869         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1870         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1871         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1872         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1873         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1874         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1875         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1876         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1877         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1878         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1879         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1880         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1881         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1882         * test262/test/built-ins/Proxy/get-fn-realm.js:
1883         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1884         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1885         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1886         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1887         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1888         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1889         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1890         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1891         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1892         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1893         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1894         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1895         (i6.replace):
1896         (i6b.replace):
1897         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1898         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1899         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1900         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1901         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1902         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1903         * test262/test/built-ins/RegExp/u180e.js: Added.
1904         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1905         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1906         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1907         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1908         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1909         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1910         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1911         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1912         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1913         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1914         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1915         * test262/test/built-ins/String/prototype/endsWith/length.js:
1916         * test262/test/built-ins/String/prototype/endsWith/name.js:
1917         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1918         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1919         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1920         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1921         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1922         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1923         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1924         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1925         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1926         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1927         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1928         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1929         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1930         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1931         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1932         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1933         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1934         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1935         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1936         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1937         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1938         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1939         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1940         * test262/test/built-ins/String/prototype/includes/includes.js:
1941         * test262/test/built-ins/String/prototype/includes/length.js:
1942         * test262/test/built-ins/String/prototype/includes/name.js:
1943         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1944         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1945         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1946         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1947         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1948         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1949         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1950         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1951         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1952         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1953         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1954         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1955         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1956         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1957         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1958         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1959         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1960         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1961         * test262/test/built-ins/String/prototype/trim/u180e.js:
1962         * test262/test/built-ins/Symbol/for/cross-realm.js:
1963         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1964         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1965         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1966         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1967         * test262/test/built-ins/Symbol/match/cross-realm.js:
1968         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1969         * test262/test/built-ins/Symbol/search/cross-realm.js:
1970         * test262/test/built-ins/Symbol/species/cross-realm.js:
1971         * test262/test/built-ins/Symbol/split/cross-realm.js:
1972         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1973         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1974         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1975         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1976         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1977         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1978         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1979         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1980         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1981         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1982         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1983         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1984         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1985         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1986         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1987         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1988         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1989         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1990         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1991         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1992         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1993         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1994         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1995         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1996         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1997         * test262/test/language/eval-code/indirect/realm.js:
1998         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1999         (o.get z):
2000         (o.get a):
2001         * test262/test/language/expressions/call/eval-realm-indirect.js:
2002         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2003         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2004         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2005         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2006         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2007         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2008         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2009         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2010         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2011         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2012         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2013         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2014         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2015         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2016         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2017         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2018         * test262/test/language/expressions/less-than/bigint-and-number.js:
2019         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2020         * test262/test/language/expressions/super/realm.js:
2021         * test262/test/language/expressions/tagged-template/cache-realm.js:
2022         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2023         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2024         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2025         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2026         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2027         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2028         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2029         (o.get z):
2030         (o.get a):
2031         * test262/test/language/statements/for-of/iterator-next-reference.js:
2032         (next):
2033         (iterator.next): Deleted.
2034         (x.of.iterable.): Deleted.
2035         (x.of.iterable.get return): Deleted.
2036         (x.of.iterable.iterator.next): Deleted.
2037         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2038         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2039         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2040         * test262/test/language/white-space/mongolian-vowel-separator.js:
2041         * test262/test262-Revision.txt:
2042
2043 2017-10-03  Saam Barati  <sbarati@apple.com>
2044
2045         Implement polymorphic prototypes
2046         https://bugs.webkit.org/show_bug.cgi?id=176391
2047
2048         Reviewed by Filip Pizlo.
2049
2050         * microbenchmarks/poly-proto-access.js: Added.
2051         (assert):
2052         (foo.C):
2053         (foo.C.prototype.get bar):
2054         (foo):
2055         (bar):
2056         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2057         (assert):
2058         (makePolyProtoObject.foo.C):
2059         (makePolyProtoObject.foo):
2060         (makePolyProtoObject):
2061         (performSet):
2062         * microbenchmarks/poly-proto-setter-speed.js: Added.
2063         (assert):
2064         (makePolyProtoObject.foo.C):
2065         (makePolyProtoObject.foo.C.prototype.set p):
2066         (makePolyProtoObject.foo):
2067         (makePolyProtoObject):
2068         (performSet):
2069         * stress/constructor-with-return.js:
2070         (i.tests.forEach.Constructor):
2071         (i.tests.forEach):
2072         (tests.forEach.Constructor): Deleted.
2073         (tests.forEach): Deleted.
2074         * stress/dom-jit-with-poly-proto.js: Added.
2075         (assert):
2076         (makePolyProtoObject.foo.C):
2077         (makePolyProtoObject.foo):
2078         (makePolyProtoObject):
2079         (validate):
2080         * stress/poly-proto-custom-value-and-accessor.js: Added.
2081         (assert):
2082         (makePolyProtoObject.foo.C):
2083         (makePolyProtoObject.foo):
2084         (makePolyProtoObject):
2085         (items.forEach):
2086         (set get for):
2087         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2088         (assert):
2089         (makePolyProtoObject.foo.C):
2090         (makePolyProtoObject.foo):
2091         (makePolyProtoObject):
2092         (foo):
2093         * stress/poly-proto-miss.js: Added.
2094         (makePolyProtoInstanceWithNullPrototype.foo.C):
2095         (makePolyProtoInstanceWithNullPrototype.foo):
2096         (makePolyProtoInstanceWithNullPrototype):
2097         (assert):
2098         (validate):
2099         * stress/poly-proto-op-in-caching.js: Added.
2100         (assert):
2101         (makePolyProtoObject.foo.C):
2102         (makePolyProtoObject.foo):
2103         (makePolyProtoObject):
2104         (validate):
2105         (validate2):
2106         * stress/poly-proto-put-transition.js: Added.
2107         (assert):
2108         (makePolyProtoObject.foo.C):
2109         (makePolyProtoObject.foo):
2110         (makePolyProtoObject):
2111         (performSet):
2112         (i.obj.__proto__.set p):
2113         * stress/poly-proto-set-prototype.js: Added.
2114         (assert):
2115         (let.alternateProto.get x):
2116         (let.alternateProto2.get y):
2117         (let.alternateProto2.get x):
2118         (foo.C):
2119         (foo):
2120         (validate):
2121         * stress/poly-proto-setter.js: Added.
2122         (assert):
2123         (makePolyProtoObject.foo.C):
2124         (makePolyProtoObject.foo.C.prototype.set p):
2125         (makePolyProtoObject.foo.C.prototype.get p):
2126         (makePolyProtoObject.foo):
2127         (makePolyProtoObject):
2128         (performSet):
2129         * stress/poly-proto-using-inheritance.js: Added.
2130         (assert):
2131         (foo.C):
2132         (foo.C.prototype.get baz):
2133         (foo):
2134         (bar.C):
2135         (bar):
2136         (validate):
2137         * stress/primitive-poly-proto.js: Added.
2138         (makePolyProtoInstance.foo.C):
2139         (makePolyProtoInstance.foo):
2140         (makePolyProtoInstance):
2141         (assert):
2142         (validate):
2143         * stress/prototype-is-not-js-object.js: Added.
2144         (foo.bar):
2145         (foo):
2146         (assert):
2147         (validate):
2148         * stress/try-get-by-id-poly-proto.js: Added.
2149         (assert):
2150         (makePolyProtoObject.foo.C):
2151         (makePolyProtoObject.foo):
2152         (makePolyProtoObject):
2153         (tryGetByIdText):
2154         (x.__proto__.get bar):
2155         (validate):
2156         * typeProfiler/overflow.js:
2157
2158 2017-10-03  JF Bastien  <jfbastien@apple.com>
2159
2160         WebAssembly: no VM / JS version of everything but Instance
2161         https://bugs.webkit.org/show_bug.cgi?id=177473
2162
2163         Reviewed by Filip Pizlo.
2164
2165         - Exceeding max on memory growth now returns a range error as per
2166         spec. This is a (very minor) breaking change: it used to throw OOM
2167         error. Update the corresponding test.
2168
2169         * wasm/js-api/memory-grow.js:
2170         (assertEq):
2171         * wasm/js-api/table.js:
2172         (assert.throws):
2173
2174 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2175
2176         Skip JSC test stress/regress-159779-2.js on debug.
2177         https://bugs.webkit.org/show_bug.cgi?id=177204
2178
2179         Unreviewed test gardening.
2180
2181         * stress/regress-159779-2.js:
2182
2183 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2184
2185         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2186         https://bugs.webkit.org/show_bug.cgi?id=175642
2187
2188         Reviewed by Darin Adler.
2189
2190         * ChakraCore/test/Function/apply3.baseline-jsc:
2191
2192 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2193
2194         Unreviewed, rolling out r222564.
2195         https://bugs.webkit.org/show_bug.cgi?id=177720
2196
2197         "It regressed JetStream by 2% on iOS caused by a 50%
2198         regression on the bigfib subtest" (Requested by saamyjoon on
2199         #webkit).
2200
2201         Reverted changeset:
2202
2203         "Add Above/Below comparisons for UInt32 patterns"
2204         https://bugs.webkit.org/show_bug.cgi?id=177281
2205         http://trac.webkit.org/changeset/222564
2206
2207 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2208
2209         [DFG] Support ArrayPush with multiple args
2210         https://bugs.webkit.org/show_bug.cgi?id=175823
2211
2212         Reviewed by Saam Barati.
2213
2214         * microbenchmarks/array-push-0.js: Added.
2215         (arrayPush0):
2216         * microbenchmarks/array-push-1.js: Added.
2217         (arrayPush1):
2218         * microbenchmarks/array-push-2.js: Added.
2219         (arrayPush2):
2220         * microbenchmarks/array-push-3.js: Added.
2221         (arrayPush3):
2222         * stress/array-push-multiple-contiguous.js: Added.
2223         (shouldBe):
2224         (test):
2225         * stress/array-push-multiple-double-nan.js: Added.
2226         (shouldBe):
2227         (test):
2228         * stress/array-push-multiple-double.js: Added.
2229         (shouldBe):
2230         (test):
2231         * stress/array-push-multiple-int32.js: Added.
2232         (shouldBe):
2233         (test):
2234         * stress/array-push-multiple-many-contiguous.js: Added.
2235         (shouldBe):
2236         (test):
2237         * stress/array-push-multiple-many-double.js: Added.
2238         (shouldBe):
2239         (test):
2240         * stress/array-push-multiple-many-int32.js: Added.
2241         (shouldBe):
2242         (test):
2243         * stress/array-push-multiple-many-storage.js: Added.
2244         (shouldBe):
2245         (test):
2246         * stress/array-push-multiple-storage.js: Added.
2247         (shouldBe):
2248         (test):
2249         * stress/array-push-with-force-exit.js: Added.
2250         (target.createBuiltin):
2251
2252 2017-09-29  Saam Barati  <sbarati@apple.com>
2253
2254         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2255         https://bugs.webkit.org/show_bug.cgi?id=177639
2256
2257         Reviewed by Geoffrey Garen.
2258
2259         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2260         (assert):
2261         (Class):
2262         (items.forEach):
2263         (set get for):
2264
2265 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2266
2267         Unreviewed, rolling out r222563, r222565, and r222581.
2268         https://bugs.webkit.org/show_bug.cgi?id=177675
2269
2270         "It causes a crash when playing youtube videos" (Requested by
2271         saamyjoon on #webkit).
2272
2273         Reverted changesets:
2274
2275         "[DFG] Support ArrayPush with multiple args"
2276         https://bugs.webkit.org/show_bug.cgi?id=175823
2277         http://trac.webkit.org/changeset/222563
2278
2279         "Unreviewed, build fix after r222563"
2280         https://bugs.webkit.org/show_bug.cgi?id=175823
2281         http://trac.webkit.org/changeset/222565
2282
2283         "Unreviewed, fix x86 breaking due to exhausted registers"
2284         https://bugs.webkit.org/show_bug.cgi?id=175823
2285         http://trac.webkit.org/changeset/222581
2286
2287 2017-09-28  Mark Lam  <mark.lam@apple.com>
2288
2289         test262: Unexpected passes after r222617 and r222618.
2290         https://bugs.webkit.org/show_bug.cgi?id=177622
2291         <rdar://problem/34725960>
2292
2293         Reviewed by Saam Barati.
2294
2295         Update test262.yaml for tests that are now passing.
2296
2297         * test262.yaml:
2298
2299 2017-09-27  Michael Saboff  <msaboff@apple.com>
2300
2301         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2302         https://bugs.webkit.org/show_bug.cgi?id=177570
2303
2304         Reviewed by Filip Pizlo.
2305
2306         New regression test.
2307
2308         * stress/regress-177570.js: Added.
2309
2310 2017-09-28  Michael Saboff  <msaboff@apple.com>
2311
2312         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2313         https://bugs.webkit.org/show_bug.cgi?id=177423
2314
2315         Reviewed by Mark Lam.
2316
2317         Updated regression test.
2318
2319         * stress/regress-177423.js:
2320         (catch):
2321
2322 2017-09-27  Mark Lam  <mark.lam@apple.com>
2323
2324         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2325         https://bugs.webkit.org/show_bug.cgi?id=177584
2326         <rdar://problem/34463903>
2327
2328         Reviewed by Saam Barati.
2329
2330         * stress/regress-177584.js: Added.
2331         (assertEqual):
2332         (Array.prototype.Symbol.species):
2333
2334 2017-09-27  Saam Barati  <sbarati@apple.com>
2335
2336         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2337         https://bugs.webkit.org/show_bug.cgi?id=177523
2338
2339         Reviewed by Mark Lam.
2340
2341         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2342         (assert):
2343         (Test):
2344         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2345         (addMethods):
2346         (i.Test.prototype.propName):
2347
2348 2017-09-27  Mark Lam  <mark.lam@apple.com>
2349
2350         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2351         https://bugs.webkit.org/show_bug.cgi?id=177423
2352         <rdar://problem/34621320>
2353
2354         Reviewed by Keith Miller.
2355
2356         * stress/regress-177423.js: Added.
2357
2358 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2359
2360         Add Above/Below comparisons for UInt32 patterns
2361         https://bugs.webkit.org/show_bug.cgi?id=177281
2362
2363         Reviewed by Saam Barati.
2364
2365         * stress/uint32-comparison-jump.js: Added.
2366         (shouldBe):
2367         (above):
2368         (aboveOrEqual):
2369         (below):
2370         (belowOrEqual):
2371         (notAbove):
2372         (notAboveOrEqual):
2373         (notBelow):
2374         (notBelowOrEqual):
2375         * stress/uint32-comparison.js: Added.
2376         (shouldBe):
2377         (above):
2378         (aboveOrEqual):
2379         (below):
2380         (belowOrEqual):
2381         (aboveTest):
2382         (aboveOrEqualTest):
2383         (belowTest):
2384         (belowOrEqualTest):
2385
2386 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2387
2388         [DFG] Support ArrayPush with multiple args
2389         https://bugs.webkit.org/show_bug.cgi?id=175823
2390
2391         Reviewed by Saam Barati.
2392
2393         * microbenchmarks/array-push-0.js: Added.
2394         (arrayPush0):
2395         * microbenchmarks/array-push-1.js: Added.
2396         (arrayPush1):
2397         * microbenchmarks/array-push-2.js: Added.
2398         (arrayPush2):
2399         * microbenchmarks/array-push-3.js: Added.
2400         (arrayPush3):
2401         * stress/array-push-multiple-contiguous.js: Added.
2402         (shouldBe):
2403         (test):
2404         * stress/array-push-multiple-double-nan.js: Added.
2405         (shouldBe):
2406         (test):
2407         * stress/array-push-multiple-double.js: Added.
2408         (shouldBe):
2409         (test):
2410         * stress/array-push-multiple-int32.js: Added.
2411         (shouldBe):
2412         (test):
2413         * stress/array-push-multiple-many-contiguous.js: Added.
2414         (shouldBe):
2415         (test):
2416         * stress/array-push-multiple-many-double.js: Added.
2417         (shouldBe):
2418         (test):
2419         * stress/array-push-multiple-many-int32.js: Added.
2420         (shouldBe):
2421         (test):
2422         * stress/array-push-multiple-many-storage.js: Added.
2423         (shouldBe):
2424         (test):
2425         * stress/array-push-multiple-storage.js: Added.
2426         (shouldBe):
2427         (test):
2428
2429 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2430
2431         Unreviewed, rolling out r222518.
2432         https://bugs.webkit.org/show_bug.cgi?id=177507
2433
2434         Break the High Sierra build (Requested by yusukesuzuki on
2435         #webkit).
2436
2437         Reverted changeset:
2438
2439         "Add Above/Below comparisons for UInt32 patterns"
2440         https://bugs.webkit.org/show_bug.cgi?id=177281
2441         http://trac.webkit.org/changeset/222518
2442
2443 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2444
2445         Add Above/Below comparisons for UInt32 patterns
2446         https://bugs.webkit.org/show_bug.cgi?id=177281
2447
2448         Reviewed by Saam Barati.
2449
2450         * stress/uint32-comparison-jump.js: Added.
2451         (shouldBe):
2452         (above):
2453         (aboveOrEqual):
2454         (below):
2455         (belowOrEqual):
2456         (notAbove):
2457         (notAboveOrEqual):
2458         (notBelow):
2459         (notBelowOrEqual):
2460         * stress/uint32-comparison.js: Added.
2461         (shouldBe):
2462         (above):
2463         (aboveOrEqual):
2464         (below):
2465         (belowOrEqual):
2466         (aboveTest):
2467         (aboveOrEqualTest):
2468         (belowTest):
2469         (belowOrEqualTest):
2470
2471 2017-09-23  Keith Miller  <keith_miller@apple.com>
2472
2473         Fix infinite looping test262 test
2474         https://bugs.webkit.org/show_bug.cgi?id=177412
2475
2476         Reviewed by Yusuke Suzuki.
2477
2478         This test was poorly designed since failing it would cause the vm
2479         to inifinite loop. I've fixed it locally and will fix it on github pending
2480         the results of next weeks tc39 meeting.
2481
2482         * test262.yaml:
2483         * test262/test/language/statements/for-of/iterator-next-reference.js:
2484
2485 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2486
2487         test262: $.agent became $262.agent in test262 update
2488         https://bugs.webkit.org/show_bug.cgi?id=177407
2489
2490         Reviewed by Yusuke Suzuki.
2491
2492         * test262.yaml:
2493         ~320 tests pass now that we correctly make $262 available.
2494
2495 2017-09-22  Keith Miller  <keith_miller@apple.com>
2496
2497         Speculatively change iteration protocall to use the same next function
2498         https://bugs.webkit.org/show_bug.cgi?id=175653
2499
2500         Reviewed by Saam Barati.
2501
2502         Change test to match the new iteration behavior.
2503
2504         * stress/spread-optimized-properly.js:
2505
2506 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2507
2508         [DFG][FTL] Profile array vector length for array allocation
2509         https://bugs.webkit.org/show_bug.cgi?id=177051
2510
2511         Reviewed by Saam Barati.
2512
2513         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2514         (target):
2515
2516 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2517
2518         Unreviewed, rolling out r222380.
2519         https://bugs.webkit.org/show_bug.cgi?id=177352
2520
2521         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2522         #webkit).
2523
2524         Reverted changeset:
2525
2526         "[DFG][FTL] Profile array vector length for array allocation"
2527         https://bugs.webkit.org/show_bug.cgi?id=177051
2528         http://trac.webkit.org/changeset/222380
2529
2530 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2531
2532         [DFG][FTL] Profile array vector length for array allocation
2533         https://bugs.webkit.org/show_bug.cgi?id=177051
2534
2535         Reviewed by Saam Barati.
2536
2537         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2538         (target):
2539
2540 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2541
2542         Skip new hanging test262 tests.
2543         https://bugs.webkit.org/show_bug.cgi?id=177326
2544
2545         Unreviewed test gardening.
2546
2547         * test262.yaml:
2548
2549 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2550
2551         Mark 6 test262 tests as passing.
2552         https://bugs.webkit.org/show_bug.cgi?id=177307
2553
2554         Unreviewed test gardening.
2555
2556         * test262.yaml:
2557
2558 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2559
2560         Unreviewed follow-up to r222311.
2561
2562         * test262/harness/sta.js:
2563         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2564         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2565         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2566         * test262/test/built-ins/Array/from/elements-added-after.js:
2567         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2568         * test262/test/built-ins/Array/from/elements-updated-after.js:
2569         * test262/test/built-ins/Array/from/from-array.js:
2570         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2571         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2572         * test262/test/built-ins/Array/from/source-array-boundary.js:
2573         * test262/test/built-ins/Array/from/source-object-constructor.js:
2574         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2575         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2576         * test262/test/built-ins/Array/from/source-object-length.js:
2577         * test262/test/built-ins/Array/from/source-object-missing.js:
2578         * test262/test/built-ins/Array/from/source-object-without.js:
2579         * test262/test/built-ins/Array/from/this-null.js:
2580         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2581         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2582         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2583         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2584         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2585         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2586         * test262/test/language/literals/string/7.8.4-1gs.js:
2587         Fix some files that I failed to update when I applied my patch.
2588
2589 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2590
2591         Update test262 tests
2592         https://bugs.webkit.org/show_bug.cgi?id=177220
2593
2594         Reviewed by Saam Barati and Yusuke Suzuki.
2595
2596         * test262.yaml:
2597         * test262/test262-Revision.txt:
2598         New rebaselined expectations for all tests.
2599
2600         * test262/*:
2601         Updated.
2602
2603 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2604
2605         [DFG] Remove ToThis more aggressively
2606         https://bugs.webkit.org/show_bug.cgi?id=177056
2607
2608         Reviewed by Saam Barati.
2609
2610         * stress/generator-with-this-strict.js: Added.
2611         (shouldBe):
2612         (generator):
2613         (target):
2614         * stress/generator-with-this.js: Added.
2615         (shouldBe):
2616         (generator):
2617         (target):
2618
2619 2017-09-17  Michael Saboff  <msaboff@apple.com>
2620
2621         https://bugs.webkit.org/show_bug.cgi?id=177038
2622         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2623
2624         Reviewed by JF Bastien.
2625
2626         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2627         as it dies using too much memory.
2628
2629 2017-09-15  Saam Barati  <sbarati@apple.com>
2630
2631         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2632         https://bugs.webkit.org/show_bug.cgi?id=176981
2633
2634         Reviewed by Yusuke Suzuki.
2635
2636         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2637         (assert):
2638         (verify):
2639         (func):
2640         (const.bar.createBuiltin):
2641
2642 2017-09-14  Saam Barati  <sbarati@apple.com>
2643
2644         It should be valid to exit before each set when doing arity fixup when inlining
2645         https://bugs.webkit.org/show_bug.cgi?id=176948
2646
2647         Reviewed by Keith Miller.
2648
2649         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2650         (baz):
2651         (bar):
2652         (foo):
2653
2654 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2655
2656         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2657         https://bugs.webkit.org/show_bug.cgi?id=176867
2658
2659         Reviewed by Sam Weinig.
2660
2661         * microbenchmarks/object-get-own-property-symbols.js: Added.
2662         (test):
2663
2664 2017-09-13  Mark Lam  <mark.lam@apple.com>
2665
2666         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2667         https://bugs.webkit.org/show_bug.cgi?id=176888
2668         <rdar://problem/34381832>
2669
2670         Not reviewed.
2671
2672         * stress/op_mod-ConstVar.js:
2673         * stress/op_mod-VarConst.js:
2674         * stress/op_mod-VarVar.js:
2675
2676 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2677
2678         Skip 3 op_mod tests on Debug JSC bots.
2679         https://bugs.webkit.org/show_bug.cgi?id=176630
2680
2681         Unreviewed test gardening.
2682
2683         * stress/op_mod-ConstVar.js:
2684         * stress/op_mod-VarConst.js:
2685         * stress/op_mod-VarVar.js:
2686
2687 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2688
2689         [JSC] Fix Array allocation in Object.keys
2690         https://bugs.webkit.org/show_bug.cgi?id=176826
2691
2692         Reviewed by Saam Barati.
2693
2694         * stress/object-own-property-keys.js: Added.
2695         (shouldBe):
2696
2697 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2698
2699         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2700         https://bugs.webkit.org/show_bug.cgi?id=176010
2701
2702         Reviewed by Filip Pizlo.
2703
2704         * microbenchmarks/weak-map-key.js: Added.
2705         (assert):
2706         (objectKey):
2707         (let.start.Date.now):
2708
2709 2017-09-12  Mark Lam  <mark.lam@apple.com>
2710
2711         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2712         https://bugs.webkit.org/show_bug.cgi?id=176630
2713
2714         Reviewed by JF Bastien.
2715
2716         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2717         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2718         a speculative fix for the bots that are seeing these fail.
2719
2720         I also undid the skipping of the op_mod tests for debug builds.
2721
2722         * stress/op_div-ConstVar.js:
2723         * stress/op_div-VarConst.js:
2724         * stress/op_div-VarVar.js:
2725         * stress/op_mod-ConstVar.js:
2726         * stress/op_mod-VarConst.js:
2727         * stress/op_mod-VarVar.js:
2728
2729 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2730
2731         Skip stress/value-to-boolean.js on Debug bots.
2732         https://bugs.webkit.org/show_bug.cgi?id=176787
2733
2734         Unreviewed test gardening.
2735
2736         * stress/value-to-boolean.js:
2737
2738 2017-09-11  Mark Lam  <mark.lam@apple.com>
2739
2740         Change test expectation for test262/test/language/statements/try/tco-catch.js
2741         https://bugs.webkit.org/show_bug.cgi?id=176749
2742
2743         Rubber stamped by Keith Miller.
2744
2745         It's been failing since at least r221821.  I'm changing the test expectation to
2746         fail to green the bots while I investigate some more.
2747
2748         * test262.yaml:
2749
2750 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2751
2752         Unreviewed, rolling out r221854.
2753
2754         The test added with this change fails on 32-bit JSC bots.
2755
2756         Reverted changeset:
2757
2758         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2759         https://bugs.webkit.org/show_bug.cgi?id=176010
2760         http://trac.webkit.org/changeset/221854
2761
2762 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2763
2764         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2765         https://bugs.webkit.org/show_bug.cgi?id=176010
2766
2767         Reviewed by Filip Pizlo.
2768
2769         * microbenchmarks/weak-map-key.js: Added.
2770         (assert):
2771         (objectKey):
2772         (let.start.Date.now):
2773
2774 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2775
2776         [JSC] Optimize Object.keys by using careful array allocation
2777         https://bugs.webkit.org/show_bug.cgi?id=176654
2778
2779         Reviewed by Darin Adler.
2780
2781         * microbenchmarks/object-keys.js: Added.
2782         (test):
2783
2784 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2785
2786         Error should compute .stack and friends lazily
2787         https://bugs.webkit.org/show_bug.cgi?id=176645
2788
2789         Reviewed by Saam Barati.
2790
2791         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2792         * microbenchmarks/new-error.js: Added.
2793         * microbenchmarks/throw.js: Added.
2794
2795 2017-09-09  Mark Lam  <mark.lam@apple.com>
2796
2797         [Re-landing] Use JIT probes for DFG OSR exit.
2798         https://bugs.webkit.org/show_bug.cgi?id=175144
2799         <rdar://problem/33437050>
2800
2801         Not reviewed.  Original patch reviewed by Saam Barati.
2802
2803         Disable these tests for debug builds because they run too slow with the new OSR exit.
2804
2805         * stress/op_mod-ConstVar.js:
2806         * stress/op_mod-VarConst.js:
2807         * stress/op_mod-VarVar.js:
2808
2809 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2810
2811         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2812         https://bugs.webkit.org/show_bug.cgi?id=176300
2813
2814         Reviewed by Saam Barati.
2815
2816         * stress/new-array-with-size-div.js: Added.
2817         (shouldBe):
2818         (test):
2819         (i.i):
2820
2821 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2822
2823         [DFG] PutByVal with Array::Generic is too generic
2824         https://bugs.webkit.org/show_bug.cgi?id=176345
2825
2826         Reviewed by Filip Pizlo.
2827
2828         * stress/object-assign-symbols.js: Added.
2829         (shouldBe):
2830         (test):
2831         * stress/object-assign.js: Added.
2832         (shouldBe):
2833         (test):
2834         (i.shouldBe.JSON.stringify.test):
2835
2836 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2837
2838         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2839         https://bugs.webkit.org/show_bug.cgi?id=176590
2840
2841         Reviewed by Saam Barati.
2842
2843         * microbenchmarks/object-iterate-symbols.js: Added.
2844         (test):
2845         * microbenchmarks/object-iterate.js: Added.
2846         (test):
2847         * stress/object-iterate-symbols.js: Added.
2848         (shouldBe):
2849         (test):
2850         * stress/object-iterate.js: Added.
2851         (shouldBe):
2852         (test):
2853
2854 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2855
2856         [Win32] 10 JSC stress tests are failing.
2857         https://bugs.webkit.org/show_bug.cgi?id=176538
2858
2859         Reviewed by Mark Lam.
2860
2861         Skip tests on Windows to make the bots green.
2862
2863         * ChakraCore.yaml:
2864         * stress/date-relaxed.js:
2865
2866 2017-09-06  Mark Lam  <mark.lam@apple.com>
2867
2868         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2869         https://bugs.webkit.org/show_bug.cgi?id=176485
2870         <rdar://problem/33898874>
2871
2872         Reviewed by Keith Miller.
2873
2874         * stress/regress-176485.js: Added.
2875
2876 2017-09-05  Saam Barati  <sbarati@apple.com>
2877
2878         isNotCellSpeculation is wrong with respect to SpecEmpty
2879         https://bugs.webkit.org/show_bug.cgi?id=176429
2880
2881         Reviewed by Michael Saboff.
2882
2883         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2884         (Foo):
2885
2886 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2887
2888         test262: Completion values for control flow do not match the spec
2889         https://bugs.webkit.org/show_bug.cgi?id=171265
2890
2891         Reviewed by Saam Barati.
2892
2893         * stress/completion-value.js:
2894         Condensed test for completion values in top level statements.
2895
2896         * stress/super-get-by-id.js:
2897         ClassDeclaration when evaled no longer produce values. Convert
2898         these to ClassExpressions so they produce the class value.
2899         
2900         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2901         This is a progression for currect spec behavior.
2902
2903         * mozilla/mozilla-tests.yaml:
2904         This test is now outdated, so mark it as failing for that reason.
2905
2906         * test262.yaml:
2907         Passing all "cptn" completion value tests.
2908
2909 2017-09-04  Saam Barati  <sbarati@apple.com>
2910
2911         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2912         https://bugs.webkit.org/show_bug.cgi?id=176317
2913
2914         Reviewed by Keith Miller.
2915
2916         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2917         (Foo):
2918
2919 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2920
2921         [DFG][FTL] Efficiently execute number#toString()
2922         https://bugs.webkit.org/show_bug.cgi?id=170007
2923
2924         Reviewed by Keith Miller.
2925
2926         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2927         (test):
2928         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2929         (test):
2930         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2931         (test):
2932         * microbenchmarks/number-to-string-with-radix.js: Added.
2933         (test):
2934         * stress/number-to-string-strength-reduction.js: Added.
2935         (shouldBe):
2936         (test):
2937         * stress/number-to-string-with-radix-10.js: Added.
2938         (shouldBe):
2939         (test):
2940         * stress/number-to-string-with-radix-cse.js: Added.
2941         (shouldBe):
2942         (test):
2943         * stress/number-to-string-with-radix-invalid.js: Added.
2944         (shouldThrow):
2945         * stress/number-to-string-with-radix-watchpoint.js: Added.
2946         (shouldBe):
2947         (test):
2948         (i.i.1e3.Number.prototype.toString):
2949         * stress/number-to-string-with-radix.js: Added.
2950         (shouldBe):
2951         (test):
2952
2953 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2954
2955         [DFG] Relax arity requirement
2956         https://bugs.webkit.org/show_bug.cgi?id=175523
2957
2958         Reviewed by Saam Barati.
2959
2960         * stress/arity-mismatch-arguments-length.js: Added.
2961         (shouldBe):
2962         (test1):
2963         (test):
2964         * stress/arity-mismatch-get-argument.js: Added.
2965         (shouldBe):
2966         (builtin.createBuiltin):
2967         (test):
2968         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2969         (shouldBe):
2970         (inlineTarget):
2971         (test):
2972         * stress/arity-mismatch-inlining.js: Added.
2973         (shouldBe):
2974         (inlineTarget):
2975         (test):
2976         * stress/arity-mismatch-rest.js: Added.
2977         (shouldBe):
2978         (test2):
2979         (test1):
2980         (test):
2981
2982 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2983
2984         [JSC] Fix "name" and "length" of Proxy revoke function
2985         https://bugs.webkit.org/show_bug.cgi?id=176155
2986
2987         Reviewed by Mark Lam.
2988
2989         * test262.yaml:
2990
2991 2017-08-31  Saam Barati  <sbarati@apple.com>
2992
2993         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2994         https://bugs.webkit.org/show_bug.cgi?id=176206
2995
2996         Reviewed by Keith Miller.
2997
2998         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2999         (a):
3000         (b):
3001         (foo):
3002
3003 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3004
3005         Skip two slow JSC tests after r221422.
3006
3007         Unreviewed test gardening.
3008
3009         * stress/regexp-prototype-match-on-too-long-rope.js:
3010         * stress/regexp-prototype-test-on-too-long-rope.js:
3011
3012 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3013
3014         Unreviewed, skipping slow tests.
3015         
3016         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3017         work differently now.
3018
3019         * stress/regexp-prototype-exec-on-too-long-rope.js:
3020         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3021
3022 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3023
3024         [JSC] Use reifying system for "name" property of builtin JSFunction
3025         https://bugs.webkit.org/show_bug.cgi?id=175260
3026
3027         Reviewed by Saam Barati.
3028
3029         * stress/accessors-get-set-prefix.js:
3030         * stress/builtin-function-name.js: Added.
3031         (shouldBe):
3032         (shouldThrow):
3033         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3034         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3035         * stress/private-name-as-anonymous-builtin.js: Added.
3036         (shouldBe):
3037         (NotPromise):
3038
3039 2017-08-30  Saam Barati  <sbarati@apple.com>
3040
3041         Unreviewed. Make test stop printing.
3042
3043         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3044
3045 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3046
3047         Unreviewed, rolling out r221327.
3048
3049         This change caused test262 failures.
3050
3051         Reverted changeset:
3052
3053         "[JSC] Use reifying system for "name" property of builtin
3054         JSFunction"
3055         https://bugs.webkit.org/show_bug.cgi?id=175260
3056         http://trac.webkit.org/changeset/221327
3057
3058 2017-08-30  Saam Barati  <sbarati@apple.com>
3059
3060         semicolon is being interpreted as an = in the LiteralParser
3061         https://bugs.webkit.org/show_bug.cgi?id=176114
3062
3063         Reviewed by Oliver Hunt.
3064
3065         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3066         * stress/resources/literal-parser-test-case.js: Added.
3067
3068 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3069
3070         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3071         https://bugs.webkit.org/show_bug.cgi?id=166698
3072
3073         Reviewed by Yusuke Suzuki.
3074
3075         * stress/async-iteration-for-await-of-syntax.js: Added.
3076         (assert):
3077         (checkSyntax):
3078         (checkSyntaxError):
3079         (checkSimpleAsyncGeneratorSloppyMode):
3080         (checkSimpleAsyncGeneratorStrictMode):
3081         (checkNestedAsyncGenerators):
3082         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3083         * stress/async-iteration-for-await-of.js: Added.
3084         (assert):
3085         (async.foo):
3086         (async.boo):
3087         (const.boo.async):
3088
3089 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3090
3091         [JSC] Use reifying system for "name" property of builtin JSFunction
3092         https://bugs.webkit.org/show_bug.cgi?id=175260
3093
3094         Reviewed by Saam Barati.
3095
3096         * stress/accessors-get-set-prefix.js:
3097         * stress/builtin-function-name.js: Added.
3098         (shouldBe):
3099         (shouldThrow):
3100         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3101         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3102
3103 2017-08-25  Saam Barati  <sbarati@apple.com>
3104
3105         Support compiling catch in the DFG
3106         https://bugs.webkit.org/show_bug.cgi?id=174590
3107         <rdar://problem/34047845>
3108
3109         Reviewed by Filip Pizlo.
3110
3111         * microbenchmarks/delta-blue-try-catch.js: Added.
3112         (exception):
3113         (value):
3114         (OrderedCollection):
3115         (OrderedCollection.prototype.add):
3116         (OrderedCollection.prototype.at):
3117         (OrderedCollection.prototype.size):
3118         (OrderedCollection.prototype.removeFirst):
3119         (OrderedCollection.prototype.remove):
3120         (Strength):
3121         (Strength.stronger):
3122         (Strength.weaker):
3123         (Strength.weakestOf):
3124         (Strength.strongest):
3125         (Strength.prototype.nextWeaker):
3126         (Constraint):
3127         (Constraint.prototype.addConstraint):
3128         (Constraint.prototype.satisfy):
3129         (Constraint.prototype.destroyConstraint):
3130         (Constraint.prototype.isInput):
3131         (UnaryConstraint):
3132         (UnaryConstraint.prototype.addToGraph):
3133         (UnaryConstraint.prototype.chooseMethod):
3134         (UnaryConstraint.prototype.isSatisfied):
3135         (UnaryConstraint.prototype.markInputs):
3136         (UnaryConstraint.prototype.output):
3137         (UnaryConstraint.prototype.recalculate):
3138         (UnaryConstraint.prototype.markUnsatisfied):
3139         (UnaryConstraint.prototype.inputsKnown):
3140         (UnaryConstraint.prototype.removeFromGraph):
3141         (StayConstraint):
3142         (StayConstraint.prototype.execute):
3143         (EditConstraint.prototype.isInput):
3144         (EditConstraint.prototype.execute):
3145         (BinaryConstraint):
3146         (BinaryConstraint.prototype.chooseMethod):
3147         (BinaryConstraint.prototype.addToGraph):
3148         (BinaryConstraint.prototype.isSatisfied):
3149         (BinaryConstraint.prototype.markInputs):
3150         (BinaryConstraint.prototype.input):
3151         (BinaryConstraint.prototype.output):
3152         (BinaryConstraint.prototype.recalculate):
3153         (BinaryConstraint.prototype.markUnsatisfied):
3154         (BinaryConstraint.prototype.inputsKnown):
3155         (BinaryConstraint.prototype.removeFromGraph):
3156         (ScaleConstraint):
3157         (ScaleConstraint.prototype.addToGraph):
3158         (ScaleConstraint.prototype.removeFromGraph):
3159         (ScaleConstraint.prototype.markInputs):
3160         (ScaleConstraint.prototype.execute):
3161         (ScaleConstraint.prototype.recalculate):
3162         (EqualityConstraint):
3163         (EqualityConstraint.prototype.execute):
3164         (Variable):
3165         (Variable.prototype.addConstraint):
3166         (Variable.prototype.removeConstraint):
3167         (Planner):
3168         (Planner.prototype.incrementalAdd):
3169         (Planner.prototype.incrementalRemove):
3170         (Planner.prototype.newMark):
3171         (Planner.prototype.makePlan):
3172         (Planner.prototype.extractPlanFromConstraints):
3173         (Planner.prototype.addPropagate):
3174         (Planner.prototype.removePropagateFrom):
3175         (Planner.prototype.addConstraintsConsumingTo):
3176         (Plan):
3177         (Plan.prototype.addConstraint):
3178         (Plan.prototype.size):
3179         (Plan.prototype.constraintAt):
3180         (Plan.prototype.execute):
3181         (chainTest):
3182         (projectionTest):
3183         (change):
3184         (deltaBlue):
3185         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3186         (assert):
3187         (Numbers):
3188         (Numbers.prototype.next):
3189         (return.Transpose):
3190         (return.Transpose.prototype.next):
3191         (transpose):
3192         (verifyEven):
3193         (verifyString):
3194         (foo):
3195         (runIterators):
3196         * microbenchmarks/try-catch-word-count.js: Added.
3197         (let.assert):
3198         (EOF):
3199         (let.texts):
3200         (let.o.apply):
3201         (foo):
3202         (bar):
3203         (f):
3204         (run):
3205         (test1):
3206         (test2):
3207         (test3):
3208         (fn):
3209         (A):
3210         (B):
3211         (A.prototype.getValue):
3212         (B.prototype.getParentValue):
3213         (strlen):
3214         (sum.0):
3215         (test):
3216         (result.test.o):
3217         (set add.set add):
3218         (set forEach):
3219         (stringHash):
3220         (set if):
3221         (testFunction):
3222         (set delete.set has.set add):
3223         * stress/catch-set-argument-speculation-failure.js: Added.
3224         (o):
3225         (e):
3226         (e2):
3227         (escape):
3228         (baz):
3229         (noInline.run):
3230         (noInline):
3231         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3232         (foo):
3233         (e):
3234         (baz):
3235         (bar):
3236
3237 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3238
3239         Unreviewed, rolling out r221119, r221124, and r221143.
3240         https://bugs.webkit.org/show_bug.cgi?id=175973
3241
3242         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3243         on #webkit).
3244
3245         Reverted changesets:
3246
3247         "Support compiling catch in the DFG"
3248         https://bugs.webkit.org/show_bug.cgi?id=174590
3249         http://trac.webkit.org/changeset/221119
3250
3251         "Unreviewed, build fix in GTK port"
3252         https://bugs.webkit.org/show_bug.cgi?id=174590
3253         http://trac.webkit.org/changeset/221124
3254
3255         "DFG::JITCode::osrEntry should get sorted since we perform a
3256         binary search on it"
3257         https://bugs.webkit.org/show_bug.cgi?id=175893
3258         http://trac.webkit.org/changeset/221143
3259
3260 2017-08-24  Michael Saboff  <msaboff@apple.com>
3261
3262         Add support for RegExp "dotAll" flag
3263         https://bugs.webkit.org/show_bug.cgi?id=175924
3264
3265         Reviewed by Keith Miller.
3266
3267         Updated tests for new dotAll ('s' flag) changes.
3268
3269         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3270         * stress/static-getter-in-names.js:
3271
3272 2017-08-24  Mark Lam  <mark.lam@apple.com>
3273
3274         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3275         https://bugs.webkit.org/show_bug.cgi?id=175940
3276         <rdar://problem/29003921>
3277
3278         Reviewed by Saam Barati.
3279
3280         * stress/regress-164081.js: Added.
3281         (shouldEqual):
3282         (testcase):
3283
3284 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3285
3286         Skip flaky JSC test stress/test-finally.js.
3287         https://bugs.webkit.org/show_bug.cgi?id=160283
3288
3289         Unreviewed test gardening.
3290
3291         * stress/test-finally.js:
3292
3293 2017-08-23  Saam Barati  <sbarati@apple.com>
3294
3295         Support compiling catch in the DFG
3296         https://bugs.webkit.org/show_bug.cgi?id=174590
3297
3298         Reviewed by Filip Pizlo.
3299
3300         * microbenchmarks/delta-blue-try-catch.js: Added.
3301         (exception):
3302         (value):
3303         (OrderedCollection):
3304         (OrderedCollection.prototype.add):
3305         (OrderedCollection.prototype.at):
3306         (OrderedCollection.prototype.size):
3307         (OrderedCollection.prototype.removeFirst):
3308         (OrderedCollection.prototype.remove):
3309         (Strength):
3310         (Strength.stronger):
3311         (Strength.weaker):
3312         (Strength.weakestOf):
3313         (Strength.strongest):
3314         (Strength.prototype.nextWeaker):
3315         (Constraint):
3316         (Constraint.prototype.addConstraint):
3317         (Constraint.prototype.satisfy):
3318         (Constraint.prototype.destroyConstraint):
3319         (Constraint.prototype.isInput):
3320         (UnaryConstraint):
3321         (UnaryConstraint.prototype.addToGraph):
3322         (UnaryConstraint.prototype.chooseMethod):
3323         (UnaryConstraint.prototype.isSatisfied):
3324         (UnaryConstraint.prototype.markInputs):
3325         (UnaryConstraint.prototype.output):
3326         (UnaryConstraint.prototype.recalculate):
3327         (UnaryConstraint.prototype.markUnsatisfied):
3328         (UnaryConstraint.prototype.inputsKnown):
3329         (UnaryConstraint.prototype.removeFromGraph):
3330         (StayConstraint):
3331         (StayConstraint.prototype.execute):
3332         (EditConstraint.prototype.isInput):
3333         (EditConstraint.prototype.execute):
3334         (BinaryConstraint):
3335         (BinaryConstraint.prototype.chooseMethod):
3336         (BinaryConstraint.prototype.addToGraph):
3337         (BinaryConstraint.prototype.isSatisfied):
3338         (BinaryConstraint.prototype.markInputs):
3339         (BinaryConstraint.prototype.input):
3340         (BinaryConstraint.prototype.output):
3341         (BinaryConstraint.prototype.recalculate):
3342         (BinaryConstraint.prototype.markUnsatisfied):
3343         (BinaryConstraint.prototype.inputsKnown):
3344         (BinaryConstraint.prototype.removeFromGraph):
3345         (ScaleConstraint):
3346         (ScaleConstraint.prototype.addToGraph):
3347         (ScaleConstraint.prototype.removeFromGraph):
3348         (ScaleConstraint.prototype.markInputs):
3349         (ScaleConstraint.prototype.execute):
3350         (ScaleConstraint.prototype.recalculate):
3351         (EqualityConstraint):
3352         (EqualityConstraint.prototype.execute):
3353         (Variable):
3354         (Variable.prototype.addConstraint):
3355         (Variable.prototype.removeConstraint):
3356         (Planner):
3357         (Planner.prototype.incrementalAdd):
3358         (Planner.prototype.incrementalRemove):
3359         (Planner.prototype.newMark):
3360         (Planner.prototype.makePlan):
3361         (Planner.prototype.extractPlanFromConstraints):
3362         (Planner.prototype.addPropagate):
3363         (Planner.prototype.removePropagateFrom):
3364         (Planner.prototype.addConstraintsConsumingTo):
3365         (Plan):
3366         (Plan.prototype.addConstraint):
3367         (Plan.prototype.size):
3368         (Plan.prototype.constraintAt):
3369         (Plan.prototype.execute):
3370         (chainTest):
3371         (projectionTest):
3372         (change):
3373         (deltaBlue):
3374         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3375         (assert):
3376         (Numbers):
3377         (Numbers.prototype.next):
3378         (return.Transpose):
3379         (return.Transpose.prototype.next):
3380         (transpose):
3381         (verifyEven):
3382         (verifyString):
3383         (foo):
3384         (runIterators):
3385         * microbenchmarks/try-catch-word-count.js: Added.
3386         (let.assert):
3387         (EOF):
3388         (let.texts):
3389         (let.o.apply):
3390         (foo):
3391         (bar):
3392         (f):
3393         (run):
3394         (test1):
3395         (test2):
3396         (test3):
3397         (fn):
3398         (A):
3399         (B):
3400         (A.prototype.getValue):
3401         (B.prototype.getParentValue):
3402         (strlen):
3403         (sum.0):
3404         (test):
3405         (result.test.o):
3406         (set add.set add):
3407         (set forEach):
3408         (stringHash):
3409         (set if):
3410         (testFunction):
3411         (set delete.set has.set add):
3412         * stress/catch-set-argument-speculation-failure.js: Added.
3413         (o):
3414         (e):
3415         (e2):
3416         (escape):
3417         (baz):
3418         (noInline.run):
3419         (noInline):
3420         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3421         (foo):
3422         (e):
3423         (baz):
3424         (bar):
3425
3426 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3427
3428         [JSC] Optimize Map iteration with intrinsic
3429         https://bugs.webkit.org/show_bug.cgi?id=174355
3430
3431         Reviewed by Saam Barati.
3432
3433         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3434         (shouldBe):
3435         (throw.new.Error):
3436         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3437         (shouldBe):
3438         (throw.new.Error.let.iterator.set Symbol):
3439         (throw.new.Error.set add):
3440         (let.iterator.set Symbol):
3441
3442 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3443
3444         Add a micro-benchmark for checking that accessing a variable within a 'with'
3445         block does not automatically prevent type prediction.
3446         https://bugs.webkit.org/show_bug.cgi?id=175738
3447
3448         Reviewed by Saam Barati.
3449
3450         * stress/with_and_arith.js: Added.
3451         (with):
3452
3453 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3454
3455         [ESNext] Async iteration - Implement Async Generator - runtime
3456         https://bugs.webkit.org/show_bug.cgi?id=175240
3457
3458         Reviewed by Yusuke Suzuki.
3459
3460         * stress/async-iteration-async-from-sync.js: Added.
3461         (assert):
3462         (const.Logger):
3463         (this.fullfilled):
3464         (this.fullfilledDone):
3465         (this.rejected):
3466         (this.catched):
3467         (this.isFinal):
3468         (_assertLogger):
3469         (const.assertLogger):
3470         (const.getPromise.promiseHolder.return.new.Promise):
3471         (foo):
3472         (async.boo):
3473         (bar):
3474         (async.baz):
3475         (async.goo):
3476         * stress/async-iteration-basic.js: Added.
3477         (assert):
3478         (const.Logger):
3479         (this.fullfilled):
3480         (this.fullfilledDone):
3481         (this.rejected):
3482         (this.catched):
3483         (this.isFinal):
3484         (_assertLogger):
3485         (const.assertLogger):
3486         (const.getPromise.promiseHolder.return.new.Promise):
3487         (async.generator):
3488         (iterator.next.then):
3489         (async.baz):
3490         (async.boo):
3491         (async.foo):
3492         (async.goo):
3493         (A.prototype.async.foo):
3494         (A.prototype.async.boo):
3495         (A):
3496         (asyncGenExp.async):
3497         (async.joo):
3498         (j.next.then):
3499         (then):
3500         (async.koo):
3501         (async.loo):
3502         (async.moo):
3503         (async.noo):
3504         (async.ooo):
3505         (async.roo):
3506         (async.poo):
3507         (async.soo):
3508         (async.too):
3509         * stress/async-iteration-evaluation.js: Added.
3510         (assert):
3511         (async.foo):
3512         (catch):
3513         * stress/async-iteration-syntax.js:
3514         * stress/async-iteration-yield-promise.js: Added.
3515         (assert):
3516         (const.Logger):
3517         (this.fullfilled):
3518         (this.fullfilledDone):
3519         (this.rejected):
3520         (this.catched):
3521         (this.isFinal):
3522         (_assertLogger):
3523         (const.assertLogger):
3524         (const.getPromise.promiseHolder.return.new.Promise):
3525         (async.foo):
3526         (async.boo):
3527         (async.bar):
3528         * stress/async-iteration-yield-star-interface.js: Added.
3529         (assert):
3530         (const.getPromise.promiseHolder.return.new.Promise):
3531         (const.Logger):
3532         (this.fullfilled):
3533         (this.fullfilledDone):
3534         (this.rejected):
3535         (this.catched):
3536         (this.custom):
3537         (this.isFinal):
3538         (_assertLogger):
3539         (const.assertLogger):
3540         (let.asyncIter.Symbol.asyncIterator):
3541         (let.asyncIter.next):
3542         (let.asyncIter.throw):
3543         (let.asyncIter.return):
3544         (async.foo):
3545         (asyncIter.Symbol.asyncIterator):
3546         (asyncIter.next):
3547         (async.boo):
3548         (asyncIter.return):
3549         (async.bar):
3550         (async.baz):
3551         (async.foobar):
3552         * stress/async-iteration-yield-star.js: Added.
3553         (assert):
3554         (const.Logger):
3555         (this.fullfilled):
3556         (this.fullfilledDone):
3557         (this.rejected):
3558         (this.catched):
3559         (this.custom):
3560         (this.isFinal):
3561         (_assertLogger):
3562         (const.assertLogger):
3563         (const.getPromise.promiseHolder.return.new.Promise):
3564         (async.foo):
3565         (async.boo):
3566         (async.bar):
3567         (async.baz):
3568         (async.joo):
3569         (async.goo):
3570         (async.koo):
3571         (async.loo):
3572         (let.asyncIter.Symbol.asyncIterator):
3573         (let.asyncIter.next):
3574         (let.asyncIter.throw):
3575         (let.asyncIter.return):
3576         (async.moo):
3577         (async.noo):
3578         * test262.yaml:
3579
3580 2017-08-23  JF Bastien  <jfbastien@apple.com>
3581
3582         Fix printing in test
3583
3584         Unreviewed: fixing verbosity, shouldn't have been there.
3585
3586         * wasm/regress/175693.js:
3587         (else.else):
3588         (catch):
3589
3590 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3591
3592         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3593         https://bugs.webkit.org/show_bug.cgi?id=172543
3594
3595         Unreviewed test gardening.
3596
3597         * microbenchmarks/generator-with-several-types.js:
3598
3599 2017-08-17  JF Bastien  <jfbastien@apple.com>
3600
3601         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3602         https://bugs.webkit.org/show_bug.cgi?id=175693
3603         <rdar://problem/33952443>
3604
3605         Reviewed by Saam Barati.
3606
3607         Add a regression directory for WebAssembly tests.
3608
3609         * wasm.yaml:
3610         * wasm/regress/175693.js: Added.
3611         (else.else):
3612         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3613         (catch):
3614         * wasm/regress/175693.wasm: Added.
3615
3616 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3617
3618         Support the 'with' keyword in FTL.
3619         https://bugs.webkit.org/show_bug.cgi?id=175585
3620
3621         Reviewed by Saam Barati.
3622
3623         Also improve the JSTest/stress/with.js file to test
3624         what happens when non-objects are passed to with.
3625
3626         * stress/with.js:
3627         (foo):
3628         (i.catch):
3629         (i.with): Deleted.
3630
3631 2017-08-14  Keith Miller  <keith_miller@apple.com>
3632
3633         Add testing tool to lie to the DFG about profiles
3634         https://bugs.webkit.org/show_bug.cgi?id=175487
3635
3636         Reviewed by Saam Barati.
3637
3638         * stress/compare-eq-incomplete-profile.js: Added.
3639         (const.test.createBuiltin):
3640
3641 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3642
3643         Support the with keyword in DFG
3644         https://bugs.webkit.org/show_bug.cgi?id=175470
3645
3646         Reviewed by Saam Barati.
3647
3648         Added a new stress-test for the 'with' keyword, that caught a bug in a
3649         previous version of this code.
3650
3651         * stress/with.js: Added.
3652         (i.with):
3653
3654 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3655
3656         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3657         https://bugs.webkit.org/show_bug.cgi?id=175544
3658
3659         Unreviewed test gardening.
3660
3661         * ChakraCore.yaml:
3662
3663 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3664
3665         Early error on ANY operator before new.target
3666         https://bugs.webkit.org/show_bug.cgi?id=157970
3667
3668         Reviewed by Saam Barati.
3669
3670         Instead of throwing if any unary operator precedes new.target, only
3671         throw if the unary operator updates the reference.
3672
3673         The following become legal in JSC:
3674
3675         ```
3676         !new.target
3677         ~new.target
3678         typeof new.target
3679         delete new.target
3680         void new.target
3681         ```
3682
3683         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3684
3685         * stress/new-target-syntax-errors.js:
3686         * stress/new-target.js:
3687
3688 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3689
3690         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3691         https://bugs.webkit.org/show_bug.cgi?id=175255
3692
3693         Unreviewed test gardening.
3694
3695         * stress/regress-169783.js:
3696         * wasm/stress/oom.js:
3697
3698 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3699
3700         REGRESSION: 2 test262/test/language/statements/async-function failures
3701         https://bugs.webkit.org/show_bug.cgi?id=175334
3702
3703         Reviewed by Yusuke Suzuki.
3704
3705         Add @skip parameters to tests, and remove test for async iterator from 
3706         async await syntax test because it is already covered by async-iterator-syntax.js
3707
3708         * stress/async-await-syntax.js:
3709         * stress/async-iteration-syntax.js:
3710
3711 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3712
3713         Unreviewed, gardening test262 for Promise resolve / reject function length
3714         https://bugs.webkit.org/show_bug.cgi?id=175333
3715
3716         * test262.yaml:
3717
3718 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3719
3720         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3721         https://bugs.webkit.org/show_bug.cgi?id=175307
3722
3723         Reviewed by Saam Barati.
3724
3725         * stress/typedarray-getownproperty-not-configurable.js: Added.
3726         (assert):
3727         (foo):
3728
3729 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3730
3731         Promise resolve and reject function should have length = 1
3732         https://b