JSTests/ChangeLog

   1 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
   2
   3         [ESNext][BigInt] Implement BigInt literals and JSBigInt
   4         https://bugs.webkit.org/show_bug.cgi?id=179000
   5
   6         Reviewed by Darin Adler and Yusuke Suzuki.
   7
   8         * bigIntTests.yaml: Added.
   9         * stress/big-int-literal-line-terminator.js: Added.
  10         * stress/big-int-literals.js: Added.
  11         * stress/big-int-operations-error.js: Added.
  12         * stress/big-int-type-of.js: Added.
  13         * stress/big-int-white-space-trailing-leading.js: Added.
  14         * stress/big-int-function-apply.js: Added.
  15
  16 2017-12-11  Saam Barati  <sbarati@apple.com>
  17
  18         We need to disableCaching() in ErrorInstance when we materialize properties
  19         https://bugs.webkit.org/show_bug.cgi?id=180343
  20         <rdar://problem/35833002>
  21
  22         Reviewed by Mark Lam.
  23
  24         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
  25         (assert):
  26         (makeError):
  27         (storeToStack):
  28         (storeToStackAlreadyMaterialized):
  29
  30 2017-12-05  JF Bastien  <jfbastien@apple.com>
  31
  32         WebAssembly: don't eagerly checksum
  33         https://bugs.webkit.org/show_bug.cgi?id=180441
  34         <rdar://problem/35156628>
  35
  36         Reviewed by Saam Barati.
  37
  38         Checksum is now disabled, so tests only have <?> as the module
  39         name.
  40
  41         * wasm/function-tests/nameSection.js:
  42         * wasm/function-tests/stack-overflow.js:
  43         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
  44         (assertOverflows.assertThrows):
  45         (assertOverflows):
  46         * wasm/function-tests/stack-trace.js:
  47
  48 2017-12-04  JF Bastien  <jfbastien@apple.com>
  49
  50         Proxy all functions, except the $ objects
  51         https://bugs.webkit.org/show_bug.cgi?id=180375
  52
  53         Reviewed by Saam Barati.
  54
  55         It looks like this test may have broken some executions because I
  56         call some internal objects. Explicitly ignore objects whose name
  57         starts with "$" because it's a bad idea anyways.
  58
  59         * stress/proxy-all-the-parameters.js:
  60         (generateObjects):
  61         (get throw):
  62
  63 2017-12-04  Saam Barati  <sbarati@apple.com>
  64
  65         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
  66         https://bugs.webkit.org/show_bug.cgi?id=180366
  67         <rdar://problem/35685877>
  68
  69         Reviewed by Michael Saboff.
  70
  71         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
  72         (theParent):
  73         (test1.base.getParentStaticValue):
  74         (test1.base):
  75         (test1.__v_24888.prototype.set prop):
  76         (test1.__v_24888):
  77         (test2.base.getParentStaticValue):
  78         (test2.base):
  79         (test2.__v_24888.prototype.set prop):
  80         (test2.__v_24888):
  81         (test2):
  82
  83 2017-12-01  JF Bastien  <jfbastien@apple.com>
  84
  85         Try proxying all function arguments
  86         https://bugs.webkit.org/show_bug.cgi?id=180306
  87
  88         Reviewed by Saam Barati.
  89
  90         * stress/proxy-all-the-parameters.js: Added.
  91         (isPropertyOfType):
  92         (getProperties):
  93         (generateObjects):
  94         (getObjects):
  95         (getFunctions):
  96         (get throw):
  97         (let.o.of.getObjects.let.f.of.getFunctions.catch):
  98
  99 2017-12-01  JF Bastien  <jfbastien@apple.com>
 100
 101         JavaScriptCore: missing exception checks in Math functions that take more than one argument
 102         https://bugs.webkit.org/show_bug.cgi?id=180297
 103         <rdar://problem/35745556>
 104
 105         Reviewed by Mark Lam.
 106
 107         * stress/math-exceptions.js: Added.
 108         (get try):
 109         (catch):
 110
 111 2017-12-01  JF Bastien  <jfbastien@apple.com>
 112
 113         JavaScriptCore: add test for weird class static getters
 114         https://bugs.webkit.org/show_bug.cgi?id=180281
 115         <rdar://problem/35592139>
 116
 117         Reviewed by Mark Lam.
 118
 119         I fixed a bug for it in r224927 and didn't add a test. Do so.
 120
 121         * stress/class-static-get-weird.js: Added.
 122         (c.prototype.get name):
 123         (c):
 124         (c.prototype.get arguments):
 125         (c.prototype.get caller):
 126         (c.prototype.get length):
 127
 128 2017-12-01  Saam Barati  <sbarati@apple.com>
 129
 130         Having a bad time needs to handle ArrayClass indexing type as well
 131         https://bugs.webkit.org/show_bug.cgi?id=180274
 132         <rdar://problem/35667869>
 133
 134         Reviewed by Keith Miller and Mark Lam.
 135
 136         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
 137         (assert):
 138         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
 139         (assert):
 140
 141 2017-12-01  JF Bastien  <jfbastien@apple.com>
 142
 143         WebAssembly: restore cached stack limit after out-call
 144         https://bugs.webkit.org/show_bug.cgi?id=179106
 145         <rdar://problem/35337525>
 146
 147         Reviewed by Saam Barati.
 148
 149         * wasm/function-tests/double-instance.js: Added.
 150         (const.imp.boom):
 151         (const.imp.get callAnother):
 152
 153 2017-11-30  JF Bastien  <jfbastien@apple.com>
 154
 155         WebAssembly: improve stack trace
 156         https://bugs.webkit.org/show_bug.cgi?id=179343
 157
 158         Reviewed by Saam Barati.
 159
 160         Update the tests to follow the new format. Notably, SHA1 module
 161         hash is now included in traces, and stubs are properly identified.
 162
 163         * wasm/assert.js: Add an assertion which matches regular expressions.
 164         * wasm/function-tests/nameSection.js:
 165         * wasm/function-tests/stack-overflow.js:
 166         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
 167         (assertOverflows.assertThrows.wasm.1):
 168         (assertOverflows.assertThrows.wasm.0):
 169         (assertOverflows.assertThrows):
 170         (assertOverflows):
 171         * wasm/function-tests/stack-trace.js:
 172         (import.Builder.from.string_appeared_here.assert): Deleted.
 173         * wasm/function-tests/trap-after-cross-instance-call.js:
 174         (wasmFrameCountFromError):
 175         * wasm/function-tests/trap-load-2.js:
 176         (wasmFrameCountFromError):
 177         * wasm/function-tests/trap-load.js:
 178         (wasmFrameCountFromError):
 179
 180 2017-11-30  Mark Lam  <mark.lam@apple.com>
 181
 182         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
 183         https://bugs.webkit.org/show_bug.cgi?id=180219
 184         <rdar://problem/35696536>
 185
 186         Reviewed by Filip Pizlo.
 187
 188         * stress/regress-180219.js: Added.
 189
 190 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
 191
 192         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
 193         https://bugs.webkit.org/show_bug.cgi?id=180190
 194
 195         Reviewed by Mark Lam.
 196
 197         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
 198         (shouldBe):
 199         (test1):
 200         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
 201         (shouldBe):
 202         (test1):
 203         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
 204         (shouldBe):
 205         (test1):
 206         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
 207         (shouldBe):
 208         (test1):
 209         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
 210         (shouldBe):
 211         (test1):
 212         * stress/operation-in-may-have-negative-int32.js: Added.
 213         (shouldBe):
 214         (test2):
 215         * stress/operation-in-negative-int32-cast.js: Added.
 216         (shouldBe):
 217         (test1):
 218
 219 2017-11-28  JF Bastien  <jfbastien@apple.com>
 220
 221         Strict and sloppy functions shouldn't share structure
 222         https://bugs.webkit.org/show_bug.cgi?id=180103
 223         <rdar://problem/35667847>
 224
 225         Reviewed by Saam Barati.
 226
 227         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
 228         because the IC was wrong.
 229         (foo):
 230         (bar):
 231         (baz):
 232         (catch):
 233         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
 234         in this patch, but may as well test odd strict mode corner cases.
 235         (bar):
 236         (baz):
 237         (catch):
 238         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
 239         (foo):
 240         (bar):
 241         (baz):
 242         (catch):
 243         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
 244         next file, but with invalidation of the FunctionExecutable's
 245         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
 246         slower path.
 247         (foo):
 248         (bar.const.x):
 249         (bar.const.y):
 250         (bar):
 251         (catch):
 252         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
 253         strict nesting works correctly.
 254         (foo):
 255         (bar.baz):
 256         (bar):
 257         * stress/strict-function-structure.js: Added. The test used to
 258         assert in objectProtoFuncHasOwnProperty.
 259         (foo):
 260         (bar):
 261         (baz):
 262         * stress/strict-nested-function-structure.js: Added. Nesting.
 263         (foo):
 264         (bar):
 265         (baz.boo):
 266         (baz):
 267
 268 2017-11-29  Robin Morisset  <rmorisset@apple.com>
 269
 270         The recursive tail call optimisation is wrong on closures
 271         https://bugs.webkit.org/show_bug.cgi?id=179835
 272
 273         Reviewed by Saam Barati.
 274
 275         * stress/closure-recursive-tail-call.js: Added.
 276         (makeClosure):
 277
 278 2017-11-27  JF Bastien  <jfbastien@apple.com>
 279
 280         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
 281         https://bugs.webkit.org/show_bug.cgi?id=180051
 282         <rdar://problem/35614371>
 283
 284         Reviewed by Saam Barati.
 285
 286         * stress/rest-parameter-negative.js: Added.
 287         (__f_5484):
 288         (catch):
 289         (__f_5485):
 290         (__v_22598.catch):
 291
 292 2017-11-27  Saam Barati  <sbarati@apple.com>
 293
 294         Spread can escape when CreateRest does not
 295         https://bugs.webkit.org/show_bug.cgi?id=180057
 296         <rdar://problem/35676119>
 297
 298         Reviewed by JF Bastien.
 299
 300         * stress/spread-escapes-but-create-rest-does-not.js: Added.
 301         (assert):
 302         (getProperties):
 303         (theFunc):
 304         (let.obj.valueOf):
 305
 306 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 307
 308         [DFG] Add NormalizeMapKey DFG IR
 309         https://bugs.webkit.org/show_bug.cgi?id=179912
 310
 311         Reviewed by Saam Barati.
 312
 313         * stress/map-untyped-normalize-cse.js: Added.
 314         (shouldBe):
 315         (test):
 316         * stress/map-untyped-normalize.js: Added.
 317         (shouldBe):
 318         (test):
 319         * stress/set-untyped-normalize-cse.js: Added.
 320         (shouldBe):
 321         (set return.set has.set has):
 322         * stress/set-untyped-normalize.js: Added.
 323         (shouldBe):
 324         (set return.set has):
 325
 326 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
 327
 328         [FTL] Support DeleteById and DeleteByVal
 329         https://bugs.webkit.org/show_bug.cgi?id=180022
 330
 331         Reviewed by Saam Barati.
 332
 333         * stress/delete-by-id.js: Added.
 334         (shouldBe):
 335         (test1):
 336         (test2):
 337         * stress/delete-by-val-ftl.js: Added.
 338         (shouldBe):
 339         (test1):
 340         (test2):
 341
 342 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
 343
 344         [DFG] Introduce {Set,Map,WeakMap}Fields
 345         https://bugs.webkit.org/show_bug.cgi?id=179925
 346
 347         Reviewed by Saam Barati.
 348
 349         * stress/map-set-clobber-map-get.js: Added.
 350         (shouldBe):
 351         (test):
 352         * stress/map-set-does-not-clobber-set-has.js: Added.
 353         (shouldBe):
 354         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
 355         (shouldBe):
 356         (test):
 357         * stress/set-add-clobber-set-has.js: Added.
 358         (shouldBe):
 359         * stress/set-add-does-not-clobber-map-get.js: Added.
 360         (shouldBe):
 361
 362 2017-11-24  Mark Lam  <mark.lam@apple.com>
 363
 364         Move unsafe jsc shell test functions to the $vm object.
 365         https://bugs.webkit.org/show_bug.cgi?id=179980
 366
 367         Reviewed by Yusuke Suzuki.
 368
 369         * controlFlowProfiler/driver/driver.js:
 370         * controlFlowProfiler/execution-count.js:
 371         * controlFlowProfiler/if-statement.js:
 372         * controlFlowProfiler/loop-statements.js:
 373         * controlFlowProfiler/switch-statements.js:
 374         * controlFlowProfiler/test-jit.js:
 375         * exceptionFuzz/3d-cube.js:
 376         * exceptionFuzz/date-format-xparb.js:
 377         * exceptionFuzz/earley-boyer.js:
 378         * heapProfiler/basic-edges.js:
 379         * heapProfiler/property-edge-types.js:
 380         * microbenchmarks/try-get-by-id-basic.js:
 381         * microbenchmarks/try-get-by-id-polymorphic.js:
 382         * modules/namespace-object-try-get.js:
 383         * stress/argument-count-bytecode.js:
 384         * stress/argument-intrinsic-basic.js:
 385         * stress/argument-intrinsic-inlining-use-caller-arg.js:
 386         * stress/argument-intrinsic-inlining-with-result-escape.js:
 387         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
 388         * stress/argument-intrinsic-inlining-with-vararg.js:
 389         * stress/argument-intrinsic-nested-inlining.js:
 390         * stress/argument-intrinsic-not-convert-to-get-argument.js:
 391         * stress/argument-intrinsic-with-stack-write.js:
 392         * stress/arity-mismatch-get-argument.js:
 393         * stress/array-message-passing.js:
 394         * stress/array-push-with-force-exit.js:
 395         * stress/check-dom-with-signature.js:
 396         * stress/check-sub-class.js:
 397         * stress/compare-eq-incomplete-profile.js:
 398         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
 399         * stress/do-eval-virtual-call-correctly.js:
 400         * stress/dom-jit-with-poly-proto.js:
 401         * stress/domjit-exception-ic.js:
 402         * stress/domjit-exception.js:
 403         * stress/domjit-getter-complex-with-incorrect-object.js:
 404         * stress/domjit-getter-complex.js:
 405         * stress/domjit-getter-poly.js:
 406         * stress/domjit-getter-proto.js:
 407         * stress/domjit-getter-super-poly.js:
 408         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
 409         * stress/domjit-getter-type-check.js:
 410         * stress/domjit-getter.js:
 411         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
 412         * stress/for-in-proxy-target-changed-structure.js:
 413         * stress/for-in-proxy.js:
 414         * stress/generational-opaque-roots.js:
 415         * stress/global-const-redeclaration-setting-2.js:
 416         * stress/global-const-redeclaration-setting-3.js:
 417         * stress/global-const-redeclaration-setting-4.js:
 418         * stress/global-const-redeclaration-setting-5.js:
 419         * stress/global-const-redeclaration-setting.js:
 420         * stress/import-basic.js:
 421         * stress/import-from-eval.js:
 422         * stress/import-reject-with-exception.js:
 423         * stress/import-syntax.js:
 424         * stress/impure-get-own-property-slot-inline-cache.js:
 425         * stress/is-constructor.js:
 426         * stress/istypedarrayview-intrinsic.js:
 427         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
 428         * stress/jsc-test-functions-should-be-more-robust.js:
 429         * stress/object-toString-with-proxy.js:
 430         * stress/poly-proto-custom-value-and-accessor.js:
 431         * stress/proxy-inline-cache.js:
 432         * stress/re-execute-error-module.js:
 433         * stress/regress-150532.js:
 434         * stress/regress-156992.js:
 435         * stress/regress-179619.js:
 436         * stress/resources/shadow-chicken-support.js:
 437         * stress/runtime-array.js:
 438         * stress/sampling-profiler-microtasks.js:
 439         * stress/shadow-chicken-enabled.js:
 440         * stress/spread-correct-global-object-on-exception.js:
 441         * stress/super-get-by-id.js:
 442         * stress/tailCallForwardArguments.js:
 443         * stress/to-object-intrinsic-boolean-edge.js:
 444         * stress/to-object-intrinsic-null-or-undefined-edge.js:
 445         * stress/to-object-intrinsic-number-edge.js:
 446         * stress/to-object-intrinsic-object-edge.js:
 447         * stress/to-object-intrinsic-string-edge.js:
 448         * stress/to-object-intrinsic-symbol-edge.js:
 449         * stress/to-object-intrinsic.js:
 450         * stress/try-catch-custom-getter-as-get-by-id.js:
 451         * stress/try-get-by-id-poly-proto.js:
 452         * stress/try-get-by-id-should-spill-registers-dfg.js:
 453         * stress/try-get-by-id.js:
 454         * typeProfiler/arrow-functions.js:
 455         * typeProfiler/basic.js:
 456         * typeProfiler/captured.js:
 457         * typeProfiler/classes.js:
 458         * typeProfiler/dfg-jit-optimizations.js:
 459         * typeProfiler/dictionary-mode.js:
 460         * typeProfiler/es6-block-scoping.js:
 461         * typeProfiler/es6-classes.js:
 462         * typeProfiler/inheritance.js:
 463         * typeProfiler/int52-dfg.js:
 464         * typeProfiler/loop.js:
 465         * typeProfiler/optional-fields.js:
 466         * typeProfiler/overflow.js:
 467         * typeProfiler/return.js:
 468         * typeProfiler/symbol.js:
 469         * typeProfiler/weird-prototype-chain.js:
 470
 471 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 472
 473         [DFG][FTL] Support MapSet / SetAdd intrinsics
 474         https://bugs.webkit.org/show_bug.cgi?id=179858
 475
 476         Reviewed by Saam Barati.
 477
 478         * microbenchmarks/map-has-and-set.js: Added.
 479         (test):
 480         * stress/map-set-check-failure.js: Added.
 481         (shouldBe):
 482         (shouldThrow):
 483         (target):
 484         * stress/map-set-cse.js: Added.
 485         (shouldBe):
 486         (test):
 487         * stress/set-add-check-failure.js: Added.
 488         (shouldBe):
 489         (shouldThrow):
 490         (set shouldThrow):
 491         * stress/set-add-cse.js: Added.
 492         (shouldBe):
 493
 494 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 495
 496         [JSC] Allow poly proto for intrinsic getters
 497         https://bugs.webkit.org/show_bug.cgi?id=179550
 498
 499         Reviewed by Saam Barati.
 500
 501         This change is also tested by existing tests.
 502
 503             1. stress/intrinsic-getter-with-poly-proto.js
 504             2. stress/poly-proto-intrinsic-getter-correctness.js
 505
 506         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
 507         (shouldBe):
 508         (makePolyProtoObject.foo.C):
 509         (makePolyProtoObject.foo):
 510         (makePolyProtoObject):
 511         (target):
 512         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
 513         (shouldBe):
 514         (makePolyProtoObject.foo.C):
 515         (makePolyProtoObject.foo):
 516         (makePolyProtoObject):
 517         (target):
 518
 519 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
 520
 521         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
 522         https://bugs.webkit.org/show_bug.cgi?id=179744
 523
 524         Reviewed by Michael Catanzaro.
 525
 526         This test uses too much memory for our buildbots on these platforms
 527         and gets OOM-killed.
 528
 529         * stress/unshiftCountSlowCase-correct-postCapacity.js:
 530         Skip if $memoryLimited and linux.
 531
 532 2017-11-17  JF Bastien  <jfbastien@apple.com>
 533
 534         WebAssembly JS API: throw when a promise can't be created
 535         https://bugs.webkit.org/show_bug.cgi?id=179826
 536         <rdar://problem/35455813>
 537
 538         Reviewed by Mark Lam.
 539
 540         Test WebAssembly.{compile,instantiate} where promise creation
 541         fails because of a stack overflow.
 542
 543         * wasm/js-api/promise-stack-overflow.js: Added.
 544         (const.runNearStackLimit.f.const.t):
 545         (async.testCompile):
 546         (async.testInstantiate):
 547
 548 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
 549
 550         Unreviewed, mark regress-178385.js as memory exhausting
 551
 552         * stress/regress-178385.js:
 553
 554 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
 555
 556         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
 557
 558         Unreviewed test gardening.
 559
 560         * test262.yaml:
 561
 562 2017-11-16  Robin Morisset  <rmorisset@apple.com>
 563
 564         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
 565         https://bugs.webkit.org/show_bug.cgi?id=179763
 566         <rdar://problem/35550513>
 567
 568         Reviewed by Keith Miller.
 569
 570         Just adding a slightly cleaned-up version of the original fuzzer-found test.
 571
 572         * stress/tdz-this-in-try-catch.js: Added.
 573         (__v_6388):
 574         (__v_6392):
 575
 576 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 577
 578         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
 579         https://bugs.webkit.org/show_bug.cgi?id=179594
 580
 581         Reviewed by Saam Barati.
 582
 583         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
 584         (shouldBe):
 585         (args):
 586         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
 587         (shouldBe):
 588         (args):
 589
 590 2017-11-14  Saam Barati  <sbarati@apple.com>
 591
 592         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
 593         https://bugs.webkit.org/show_bug.cgi?id=179639
 594         <rdar://problem/35513018>
 595
 596         Reviewed by JF Bastien.
 597
 598         * wasm/function-tests/grow-memory-cause-gc.js: Added.
 599         (escape):
 600         (i.func):
 601
 602 2017-11-13  Mark Lam  <mark.lam@apple.com>
 603
 604         Add more overflow check book-keeping for MarkedArgumentBuffer.
 605         https://bugs.webkit.org/show_bug.cgi?id=179634
 606         <rdar://problem/35492517>
 607
 608         Reviewed by Saam Barati.
 609
 610         * stress/regress-179634.js: Added.
 611
 612 2017-11-13  Mark Lam  <mark.lam@apple.com>
 613
 614         Make the jsc shell loadGetterFromGetterSetter() function more robust.
 615         https://bugs.webkit.org/show_bug.cgi?id=179619
 616         <rdar://problem/35492518>
 617
 618         Reviewed by Saam Barati.
 619
 620         * stress/regress-179619.js: Added.
 621
 622 2017-11-12  Mark Lam  <mark.lam@apple.com>
 623
 624         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
 625         https://bugs.webkit.org/show_bug.cgi?id=179562
 626         <rdar://problem/35467022>
 627
 628         Reviewed by Saam Barati.
 629
 630         * regress-179562.js: Added.
 631
 632 2017-11-08  Saam Barati  <sbarati@apple.com>
 633
 634         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
 635         https://bugs.webkit.org/show_bug.cgi?id=177792
 636
 637         Reviewed by Yusuke Suzuki.
 638
 639         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
 640         (assert):
 641         (foo.Foo.prototype.ensureX):
 642         (foo.Foo):
 643         (foo):
 644         (access):
 645
 646 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
 647
 648         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
 649         https://bugs.webkit.org/show_bug.cgi?id=178592
 650
 651         Unreviewed test gardening.
 652
 653         * test262.yaml:
 654
 655 2017-11-08  Robin Morisset  <rmorisset@apple.com>
 656
 657         Turn recursive tail calls into loops
 658         https://bugs.webkit.org/show_bug.cgi?id=176601
 659
 660         Reviewed by Saam Barati.
 661
 662         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
 663
 664         Add some simple test that computes factorial in several ways, and other trivial computations.
 665         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
 666         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
 667         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
 668         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
 669
 670         * stress/inline-call-to-recursive-tail-call.js: Added.
 671         (factorial.aux):
 672         (factorial):
 673         (factorial2.aux2):
 674         (factorial2.id):
 675         (factorial2):
 676         (factorial3.aux3):
 677         (factorial3):
 678         (aux4):
 679         (factorial4):
 680         (foo):
 681         (auxBar):
 682         (bar):
 683         (test):
 684
 685 2017-11-07  Mark Lam  <mark.lam@apple.com>
 686
 687         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
 688         https://bugs.webkit.org/show_bug.cgi?id=179355
 689         <rdar://problem/35263053>
 690
 691         Reviewed by Saam Barati.
 692
 693         * stress/regress-179355.js: Added.
 694
 695 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
 696
 697         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
 698         https://bugs.webkit.org/show_bug.cgi?id=144458
 699
 700         Reviewed by Saam Barati.
 701
 702         * microbenchmarks/dfg-internal-function-call.js: Added.
 703         (target):
 704         * microbenchmarks/dfg-internal-function-construct.js: Added.
 705         (target):
 706         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
 707         (target):
 708         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
 709         (target):
 710         * stress/dfg-internal-function-call.js: Added.
 711         (shouldBe):
 712         (target):
 713         * stress/dfg-internal-function-construct.js: Added.
 714         (shouldBe):
 715         (target):
 716         * stress/internal-function-call.js: Added.
 717         (shouldBe):
 718         * stress/internal-function-construct.js: Added.
 719         (shouldBe):
 720
 721 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
 722
 723         [Win] Skip stress/regress-178385.js.
 724         https://bugs.webkit.org/show_bug.cgi?id=179298
 725
 726         Unreviewed test gardening.
 727
 728         * stress/regress-178385.js:
 729
 730 2017-11-03  Keith Miller  <keith_miller@apple.com>
 731
 732         Add test for ic with side effects
 733         https://bugs.webkit.org/show_bug.cgi?id=179268
 734
 735         Reviewed by Saam Barati.
 736
 737         * stress/put-inline-cache-side-effects.js: Added.
 738         (let.i.of.objs.keys):
 739         (f):
 740
 741 2017-11-03  Mark Lam  <mark.lam@apple.com>
 742
 743         CachedCall (and its clients) needs overflow checks.
 744         https://bugs.webkit.org/show_bug.cgi?id=179185
 745
 746         Reviewed by JF Bastien.
 747
 748         * stress/regress-179185.js: Added.
 749
 750 2017-11-02  Michael Saboff  <msaboff@apple.com>
 751
 752         DFG needs to handle code motion of code in for..in loop bodies
 753         https://bugs.webkit.org/show_bug.cgi?id=179212
 754
 755         Reviewed by Keith Miller.
 756
 757         New regression test.
 758
 759         * stress/for-in-side-effects.js: Added.
 760         (getPrototypeOf):
 761         (reset):
 762         (testWithoutFTL.f):
 763         (testWithoutFTL):
 764         (testWithFTL.f):
 765         (testWithFTL):
 766
 767 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
 768
 769         AI does not correctly model the clobber case of ArithClz32
 770         https://bugs.webkit.org/show_bug.cgi?id=179188
 771
 772         Reviewed by Michael Saboff.
 773
 774         * stress/arith-clz32-effects.js: Added.
 775         (foo):
 776         (valueOf):
 777
 778 2017-11-01  Michael Saboff  <msaboff@apple.com>
 779
 780         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
 781         https://bugs.webkit.org/show_bug.cgi?id=179140
 782
 783         Reviewed by Saam Barati.
 784
 785         New regression test.
 786
 787         * stress/regress-179140.js: Added.
 788         (testWithoutFTL):
 789         (testWithFTL):
 790
 791 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 792
 793         [JSC] Introduce @toObject
 794         https://bugs.webkit.org/show_bug.cgi?id=178726
 795
 796         Reviewed by Saam Barati.
 797
 798         * stress/array-copywithin.js:
 799         (shouldThrow):
 800         * stress/object-constructor-boolean-edge.js: Added.
 801         (shouldBe):
 802         (test):
 803         * stress/object-constructor-global.js: Added.
 804         (shouldBe):
 805         * stress/object-constructor-null-edge.js: Added.
 806         (shouldBe):
 807         (test):
 808         * stress/object-constructor-number-edge.js: Added.
 809         (shouldBe):
 810         (test):
 811         * stress/object-constructor-object-edge.js: Added.
 812         (shouldBe):
 813         (test):
 814         (i.arg):
 815         * stress/object-constructor-string-edge.js: Added.
 816         (shouldBe):
 817         (test):
 818         * stress/object-constructor-symbol-edge.js: Added.
 819         (shouldBe):
 820         (test):
 821         * stress/object-constructor-undefined-edge.js: Added.
 822         (shouldBe):
 823         (test):
 824         * stress/symbol-array-from.js: Added.
 825         (shouldBe):
 826         * stress/to-object-intrinsic-boolean-edge.js: Added.
 827         (shouldBe):
 828         (builtin.createBuiltin):
 829         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
 830         (shouldThrow):
 831         * stress/to-object-intrinsic-number-edge.js: Added.
 832         (shouldBe):
 833         (builtin.createBuiltin):
 834         * stress/to-object-intrinsic-object-edge.js: Added.
 835         (shouldBe):
 836         (builtin.createBuiltin):
 837         (i.arg):
 838         * stress/to-object-intrinsic-string-edge.js: Added.
 839         (shouldBe):
 840         (builtin.createBuiltin):
 841         * stress/to-object-intrinsic-symbol-edge.js: Added.
 842         (shouldBe):
 843         (builtin.createBuiltin):
 844         * stress/to-object-intrinsic.js: Added.
 845         (shouldBe):
 846         (shouldThrow):
 847         (builtin.createBuiltin):
 848
 849 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
 850
 851         [DFG][FTL] Introduce StringSlice
 852         https://bugs.webkit.org/show_bug.cgi?id=178934
 853
 854         Reviewed by Saam Barati.
 855
 856         * microbenchmarks/string-slice-empty.js: Added.
 857         (slice):
 858         * microbenchmarks/string-slice-one-char.js: Added.
 859         (slice):
 860         * microbenchmarks/string-slice.js: Added.
 861         (slice):
 862
 863 2017-10-26  Michael Saboff  <msaboff@apple.com>
 864
 865         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
 866         https://bugs.webkit.org/show_bug.cgi?id=178890
 867
 868         Reviewed by Keith Miller.
 869
 870         New regression test.
 871
 872         * stress/regress-178890.js: Added.
 873
 874 2017-10-26  Mark Lam  <mark.lam@apple.com>
 875
 876         JSRopeString::RopeBuilder::append() should check for overflows.
 877         https://bugs.webkit.org/show_bug.cgi?id=178385
 878         <rdar://problem/35027468>
 879
 880         Reviewed by Saam Barati.
 881
 882         * stress/regress-178385.js: Added.
 883
 884 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
 885
 886         Unreviewed, rolling out r223961.
 887
 888         The change that required this has been rolled out.
 889
 890         Reverted changeset:
 891
 892         "Mark test262.yaml/test262/test/language/statements/try/tco-
 893         catch.js as passing."
 894         https://bugs.webkit.org/show_bug.cgi?id=178592
 895         https://trac.webkit.org/changeset/223961
 896
 897 2017-10-25  Commit Queue  <commit-queue@webkit.org>
 898
 899         Unreviewed, rolling out r223691 and r223729.
 900         https://bugs.webkit.org/show_bug.cgi?id=178834
 901
 902         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
 903         by rniwa on #webkit).
 904
 905         Reverted changesets:
 906
 907         "Turn recursive tail calls into loops"
 908         https://bugs.webkit.org/show_bug.cgi?id=176601
 909         https://trac.webkit.org/changeset/223691
 910
 911         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
 912         comparison is always false due to limited range of data type
 913         [-Wtype-limits]"
 914         https://bugs.webkit.org/show_bug.cgi?id=178543
 915         https://trac.webkit.org/changeset/223729
 916
 917 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
 918
 919         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
 920         https://bugs.webkit.org/show_bug.cgi?id=178592
 921
 922         Unreviewed test gardening.
 923
 924         * test262.yaml:
 925
 926 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
 927
 928         [FTL] Support NewStringObject
 929         https://bugs.webkit.org/show_bug.cgi?id=178737
 930
 931         Reviewed by Saam Barati.
 932
 933         * stress/new-string-object.js: Added.
 934         (shouldBe):
 935         (test):
 936
 937 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 938
 939         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
 940         https://bugs.webkit.org/show_bug.cgi?id=178308
 941
 942         Reviewed by Mark Lam.
 943
 944         * test262.yaml:
 945
 946 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 947
 948         [JSC] Use fastJoin in Array#toString
 949         https://bugs.webkit.org/show_bug.cgi?id=178062
 950
 951         Reviewed by Darin Adler.
 952
 953         * microbenchmarks/contiguous-array-to-string.js: Added.
 954         (target):
 955         * microbenchmarks/double-array-to-string.js: Added.
 956         (target):
 957         * microbenchmarks/int32-array-to-string.js: Added.
 958         (target):
 959
 960 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
 961
 962         stress/check-string-ident.js is improperly skipped
 963         https://bugs.webkit.org/show_bug.cgi?id=178642
 964
 965         Reviewed by Saam Barati.
 966
 967         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
 968         since it enforces the run-jsc-stress-tests script to still set up the
 969         test to run, despite the skip directive that's used before.
 970
 971 2017-10-20  Mark Lam  <mark.lam@apple.com>
 972
 973         Add a test case for r214334.
 974         https://bugs.webkit.org/show_bug.cgi?id=169941
 975         <rdar://problem/31221258>
 976
 977         Reviewed by JF Bastien.
 978
 979         * stress/regress-169941.js: Added.
 980
 981 2017-10-19  JF Bastien  <jfbastien@apple.com>
 982
 983         WebAssembly: no VM / JS version of everything but Instance
 984         https://bugs.webkit.org/show_bug.cgi?id=177473
 985
 986         Reviewed by Filip Pizlo, Saam Barati.
 987
 988         - Exceeding max on memory growth now returns a range error as per
 989         spec. This is a (very minor) breaking change: it used to throw OOM
 990         error. Update the corresponding test.
 991
 992         * wasm/js-api/memory-grow.js:
 993         (assertEq):
 994         * wasm/js-api/table.js:
 995         (assert.throws):
 996
 997 2017-10-19  Mark Lam  <mark.lam@apple.com>
 998
 999         Stringifier::appendStringifiedValue() is missing an exception check.
1000         https://bugs.webkit.org/show_bug.cgi?id=178386
1001         <rdar://problem/35027610>
1002
1003         Reviewed by Saam Barati.
1004
1005         * stress/regress-178386.js: Added.
1006
1007 2017-10-19  Michael Saboff  <msaboff@apple.com>
1008
1009         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1010         https://bugs.webkit.org/show_bug.cgi?id=178521
1011
1012         Reviewed by JF Bastien.
1013
1014         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1015         now passes with the current version (5.0) of the Emoji spec.
1016
1017 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1018
1019         Turn recursive tail calls into loops
1020         https://bugs.webkit.org/show_bug.cgi?id=176601
1021
1022         Reviewed by Saam Barati.
1023
1024         Add some simple test that computes factorial in several ways, and other trivial computations.
1025         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1026         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1027         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1028         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1029
1030         * stress/inline-call-to-recursive-tail-call.js: Added.
1031         (factorial.aux):
1032         (factorial):
1033         (factorial2.aux):
1034         (factorial2.id):
1035         (factorial2):
1036         (factorial3.aux):
1037         (factorial3):
1038         (aux):
1039         (factorial4):
1040         (test):
1041
1042 2017-10-18  Mark Lam  <mark.lam@apple.com>
1043
1044         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1045         https://bugs.webkit.org/show_bug.cgi?id=177600
1046         <rdar://problem/34710985>
1047
1048         Reviewed by Saam Barati.
1049
1050         * stress/regress-177600.js: Added.
1051
1052 2017-10-18  Mark Lam  <mark.lam@apple.com>
1053
1054         The compiler should always register a structure when it adds its transitionWatchPointSet.
1055         https://bugs.webkit.org/show_bug.cgi?id=178420
1056         <rdar://problem/34814024>
1057
1058         Reviewed by Saam Barati and Filip Pizlo.
1059
1060         * stress/regress-178420.js: Added.
1061         (new.Array.10000.map):
1062
1063 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1064
1065         [JSC] __proto__ getter should be fast
1066         https://bugs.webkit.org/show_bug.cgi?id=178067
1067
1068         Reviewed by Saam Barati.
1069
1070         * stress/dfg-object-proto-accessor.js: Added.
1071         (shouldBe):
1072         (shouldThrow):
1073         (target):
1074         * stress/dfg-object-proto-getter.js: Added.
1075         (shouldBe):
1076         (shouldThrow):
1077         (target):
1078         * stress/dfg-object-prototype-of.js: Added.
1079         (shouldBe):
1080         (shouldThrow):
1081         (target):
1082         * stress/dfg-reflect-get-prototype-of.js: Added.
1083         (shouldBe):
1084         (shouldThrow):
1085         (target):
1086         * stress/intrinsic-getter-with-poly-proto.js: Added.
1087         (shouldBe):
1088         (makePolyProtoObject.foo.C):
1089         (makePolyProtoObject.foo):
1090         (makePolyProtoObject):
1091         (target):
1092         * stress/object-get-prototype-of-filtered.js: Added.
1093         (shouldBe):
1094         (shouldThrow):
1095         (target):
1096         (i.Cocoa):
1097         * stress/object-get-prototype-of-mono-proto.js: Added.
1098         (shouldBe):
1099         (makePolyProtoObject.foo.C):
1100         (makePolyProtoObject.foo):
1101         (makePolyProtoObject):
1102         (target):
1103         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1104         (shouldBe):
1105         (makePolyProtoObject.foo.C):
1106         (makePolyProtoObject.foo):
1107         (makePolyProtoObject):
1108         (target):
1109         * stress/object-get-prototype-of-poly-proto.js: Added.
1110         (shouldBe):
1111         (makePolyProtoObject.foo.C):
1112         (makePolyProtoObject.foo):
1113         (makePolyProtoObject):
1114         (target):
1115         * stress/object-proto-getter-filtered.js: Added.
1116         (shouldBe):
1117         (shouldThrow):
1118         (target):
1119         (i.Cocoa):
1120         * stress/object-proto-getter-poly-mono-proto.js: Added.
1121         (shouldBe):
1122         (makePolyProtoObject.foo.C):
1123         (makePolyProtoObject.foo):
1124         (makePolyProtoObject):
1125         (target):
1126         * stress/object-proto-getter-poly-proto.js: Added.
1127         (shouldBe):
1128         (makePolyProtoObject.foo.C):
1129         (makePolyProtoObject.foo):
1130         (makePolyProtoObject):
1131         (target):
1132         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1133         * stress/string-proto.js: Added.
1134         (shouldBe):
1135         (target):
1136
1137 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1138
1139         Unreviewed, rolling out r223523.
1140
1141         A test for this change is failing on debug JSC bots.
1142
1143         Reverted changeset:
1144
1145         "[JSC] __proto__ getter should be fast"
1146         https://bugs.webkit.org/show_bug.cgi?id=178067
1147         https://trac.webkit.org/changeset/223523
1148
1149 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1150
1151         [JSC] __proto__ getter should be fast
1152         https://bugs.webkit.org/show_bug.cgi?id=178067
1153
1154         Reviewed by Saam Barati.
1155
1156         * stress/dfg-object-proto-accessor.js: Added.
1157         (shouldBe):
1158         (shouldThrow):
1159         (target):
1160         * stress/dfg-object-proto-getter.js: Added.
1161         (shouldBe):
1162         (shouldThrow):
1163         (target):
1164         * stress/dfg-object-prototype-of.js: Added.
1165         (shouldBe):
1166         (shouldThrow):
1167         (target):
1168         * stress/dfg-reflect-get-prototype-of.js: Added.
1169         (shouldBe):
1170         (shouldThrow):
1171         (target):
1172         * stress/object-get-prototype-of-filtered.js: Added.
1173         (shouldBe):
1174         (shouldThrow):
1175         (target):
1176         (i.Cocoa):
1177         * stress/object-get-prototype-of-mono-proto.js: Added.
1178         (shouldBe):
1179         (makePolyProtoObject.foo.C):
1180         (makePolyProtoObject.foo):
1181         (makePolyProtoObject):
1182         (target):
1183         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1184         (shouldBe):
1185         (makePolyProtoObject.foo.C):
1186         (makePolyProtoObject.foo):
1187         (makePolyProtoObject):
1188         (target):
1189         * stress/object-get-prototype-of-poly-proto.js: Added.
1190         (shouldBe):
1191         (makePolyProtoObject.foo.C):
1192         (makePolyProtoObject.foo):
1193         (makePolyProtoObject):
1194         (target):
1195         * stress/object-proto-getter-filtered.js: Added.
1196         (shouldBe):
1197         (shouldThrow):
1198         (target):
1199         (i.Cocoa):
1200         * stress/object-proto-getter-poly-mono-proto.js: Added.
1201         (shouldBe):
1202         (makePolyProtoObject.foo.C):
1203         (makePolyProtoObject.foo):
1204         (makePolyProtoObject):
1205         (target):
1206         * stress/object-proto-getter-poly-proto.js: Added.
1207         (shouldBe):
1208         (makePolyProtoObject.foo.C):
1209         (makePolyProtoObject.foo):
1210         (makePolyProtoObject):
1211         (target):
1212         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1213         * stress/string-proto.js: Added.
1214         (shouldBe):
1215         (target):
1216
1217 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1218
1219         Reland "Add Above/Below comparisons for UInt32 patterns"
1220         https://bugs.webkit.org/show_bug.cgi?id=177281
1221
1222         Reviewed by Saam Barati.
1223
1224         * stress/uint32-comparison-jump.js: Added.
1225         (shouldBe):
1226         (above):
1227         (aboveOrEqual):
1228         (below):
1229         (belowOrEqual):
1230         (notAbove):
1231         (notAboveOrEqual):
1232         (notBelow):
1233         (notBelowOrEqual):
1234         * stress/uint32-comparison.js: Added.
1235         (shouldBe):
1236         (above):
1237         (aboveOrEqual):
1238         (below):
1239         (belowOrEqual):
1240         (aboveTest):
1241         (aboveOrEqualTest):
1242         (belowTest):
1243         (belowOrEqualTest):
1244
1245 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1246
1247         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1248         https://bugs.webkit.org/show_bug.cgi?id=178210
1249
1250         Reviewed by Saam Barati.
1251
1252         * wasm/function-tests/trap-from-start-async.js:
1253         (async.StartTrapsAsync):
1254         * wasm/function-tests/trap-from-start.js:
1255         (StartTraps):
1256         * wasm/js-api/web-assembly-function.js:
1257         (assert.eq.Object.getPrototypeOf):
1258         * wasm/js-api/wrapper-function.js:
1259         (return.new.WebAssembly.Module):
1260         (assert.throws.makeInstance): Deleted.
1261         (assert.throws.Bar): Deleted.
1262         (assert.throws): Deleted.
1263
1264 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1265
1266         Enable gigacage on iOS
1267         https://bugs.webkit.org/show_bug.cgi?id=177586
1268
1269         Reviewed by JF Bastien.
1270
1271         Add tests for when Gigacage gets runtime disabled.
1272
1273         * stress/disable-gigacage-arrays.js: Added.
1274         (foo):
1275         * stress/disable-gigacage-strings.js: Added.
1276         (foo):
1277         * stress/disable-gigacage-typed-arrays.js: Added.
1278         (foo):
1279
1280 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1281
1282         import.meta should not be assignable
1283         https://bugs.webkit.org/show_bug.cgi?id=178202
1284
1285         Reviewed by Saam Barati.
1286
1287         * modules/import-meta-assignment.js: Added.
1288         (shouldThrow):
1289         (SyntaxError.import.meta.can.shouldThrow):
1290
1291 2017-10-11  Saam Barati  <sbarati@apple.com>
1292
1293         Unreviewed. Actually skip certain type profiler tests in debug.
1294
1295         * typeProfiler.yaml:
1296         * typeProfiler/deltablue-for-of.js:
1297         * typeProfiler/getter-richards.js:
1298
1299 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1300
1301         Unreviewed, rolling out r223113 and r223121.
1302         https://bugs.webkit.org/show_bug.cgi?id=178182
1303
1304         Reintroduced 20% regression on Kraken (Requested by rniwa on
1305         #webkit).
1306
1307         Reverted changesets:
1308
1309         "Enable gigacage on iOS"
1310         https://bugs.webkit.org/show_bug.cgi?id=177586
1311         https://trac.webkit.org/changeset/223113
1312
1313         "Use one virtual allocation for all gigacages and their
1314         runways"
1315         https://bugs.webkit.org/show_bug.cgi?id=178050
1316         https://trac.webkit.org/changeset/223121
1317
1318 2017-10-11  Michael Saboff  <msaboff@apple.com>
1319
1320         Disable test262 named capture group tests with direct unicode names and with references before definitions
1321         https://bugs.webkit.org/show_bug.cgi?id=178177
1322
1323         Reviewed by Keith Miller.
1324
1325         Bugs to track fixing these test are:
1326         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1327             "Add support in named capture group identifiers for direct surrogate pairs"
1328         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1329             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1330
1331         * test262.yaml:
1332
1333 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1334
1335         Object properties are undefined in super.call() but not in this.call()
1336         https://bugs.webkit.org/show_bug.cgi?id=177230
1337
1338         Reviewed by Saam Barati.
1339
1340         * stress/super-call-function-subclass.js: Added.
1341         (assert):
1342         (A.prototype.t):
1343         (A):
1344         * stress/super-dot-call-and-apply.js: Added.
1345         (assert):
1346         (A):
1347         (A.prototype.call):
1348         (A.prototype.apply):
1349         (B.prototype.testSuper):
1350         (B):
1351         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1352         (D.prototype.testSuper):
1353         (D):
1354
1355 2017-10-10  Saam Barati  <sbarati@apple.com>
1356
1357         The prototype cache should be aware of the Executable it generates a Structure for
1358         https://bugs.webkit.org/show_bug.cgi?id=177907
1359
1360         Reviewed by Filip Pizlo.
1361
1362         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1363         (assert):
1364         (foo.C):
1365         (foo):
1366         (bar.C):
1367         (bar):
1368         (access):
1369         (makeLongChain):
1370         (accessY):
1371
1372 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1373
1374         `async` should be able to be used as an imported binding name
1375         https://bugs.webkit.org/show_bug.cgi?id=176573
1376
1377         Reviewed by Saam Barati.
1378
1379         * modules/import-default-async.js: Added.
1380         * modules/import-named-async-as.js: Added.
1381         * modules/import-named-async.js: Added.
1382         * modules/import-named-async/target.js: Added.
1383         * modules/import-namespace-async.js: Added.
1384         * test262.yaml:
1385
1386 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1387
1388         Enable gigacage on iOS
1389         https://bugs.webkit.org/show_bug.cgi?id=177586
1390
1391         Reviewed by JF Bastien.
1392
1393         Add tests for when Gigacage gets runtime disabled.
1394
1395         * stress/disable-gigacage-arrays.js: Added.
1396         (foo):
1397         * stress/disable-gigacage-strings.js: Added.
1398         (foo):
1399         * stress/disable-gigacage-typed-arrays.js: Added.
1400         (foo):
1401
1402 2017-10-09  Michael Saboff  <msaboff@apple.com>
1403
1404         Implement RegExp Unicode property escapes
1405         https://bugs.webkit.org/show_bug.cgi?id=172069
1406
1407         Reviewed by JF Bastien.
1408
1409         Enabled Unicode Property tests.
1410
1411         * test262.yaml:
1412
1413 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1414
1415         Unreviewed, rolling out r223015 and r223025.
1416         https://bugs.webkit.org/show_bug.cgi?id=178093
1417
1418         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1419         #webkit).
1420
1421         Reverted changesets:
1422
1423         "Enable gigacage on iOS"
1424         https://bugs.webkit.org/show_bug.cgi?id=177586
1425         http://trac.webkit.org/changeset/223015
1426
1427         "Unreviewed, disable Gigacage on ARM64 Linux"
1428         https://bugs.webkit.org/show_bug.cgi?id=177586
1429         http://trac.webkit.org/changeset/223025
1430
1431 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1432
1433         Update expectations for test262 tests that pass after r223043.
1434         https://bugs.webkit.org/show_bug.cgi?id=176685
1435
1436         Unreviewed test gardening.
1437
1438         * test262.yaml:
1439
1440 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1441
1442         Unreviewed, rolling out r223022.
1443
1444         This change introduced 18 test262 failures.
1445
1446         Reverted changeset:
1447
1448         "`async` should be able to be used as an imported binding
1449         name"
1450         https://bugs.webkit.org/show_bug.cgi?id=176573
1451         http://trac.webkit.org/changeset/223022
1452
1453 2017-10-09  Saam Barati  <sbarati@apple.com>
1454
1455         3 poly-proto JSC tests timing out on debug after r222827
1456         https://bugs.webkit.org/show_bug.cgi?id=177880
1457         <rdar://problem/34817122>
1458
1459         Unreviewed.
1460
1461         I'm skipping these type profiler tests on debug since they are long running.
1462
1463         * typeProfiler/deltablue-for-of.js:
1464         * typeProfiler/getter-richards.js:
1465
1466 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1467
1468         Safari 10 /11 problem with if (!await get(something)).
1469         https://bugs.webkit.org/show_bug.cgi?id=176685
1470
1471         Reviewed by Saam Barati.
1472
1473         * stress/async-await-basic.js:
1474         (awaitEpression.async):
1475         * stress/async-await-syntax.js:
1476         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1477         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1478
1479 2017-10-08  Saam Barati  <sbarati@apple.com>
1480
1481         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1482
1483         * typeProfiler/deltablue-for-of.js:
1484         * typeProfiler/getter-richards.js:
1485
1486 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1487
1488         `async` should be able to be used as an imported binding name
1489         https://bugs.webkit.org/show_bug.cgi?id=176573
1490
1491         Reviewed by Darin Adler.
1492
1493         * modules/import-default-async.js: Added.
1494         * modules/import-named-async-as.js: Added.
1495         * modules/import-named-async.js: Added.
1496         * modules/import-named-async/target.js: Added.
1497         * modules/import-namespace-async.js: Added.
1498
1499 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1500
1501         Enable gigacage on iOS
1502         https://bugs.webkit.org/show_bug.cgi?id=177586
1503
1504         Reviewed by JF Bastien.
1505
1506         Add tests for when Gigacage gets runtime disabled.
1507
1508         * stress/disable-gigacage-arrays.js: Added.
1509         (foo):
1510         * stress/disable-gigacage-strings.js: Added.
1511         (foo):
1512         * stress/disable-gigacage-typed-arrays.js: Added.
1513         (foo):
1514
1515 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1516
1517         Unreviewed, rolling out r222791 and r222873.
1518         https://bugs.webkit.org/show_bug.cgi?id=178031
1519
1520         Caused crashes with workers/wasm LayoutTests (Requested by
1521         ryanhaddad on #webkit).
1522
1523         Reverted changesets:
1524
1525         "WebAssembly: no VM / JS version of everything but Instance"
1526         https://bugs.webkit.org/show_bug.cgi?id=177473
1527         http://trac.webkit.org/changeset/222791
1528
1529         "WebAssembly: address no VM / JS follow-ups"
1530         https://bugs.webkit.org/show_bug.cgi?id=177887
1531         http://trac.webkit.org/changeset/222873
1532
1533 2017-10-05  Saam Barati  <sbarati@apple.com>
1534
1535         Make sure all prototypes under poly proto get added into the VM's prototype map
1536         https://bugs.webkit.org/show_bug.cgi?id=177909
1537
1538         Reviewed by Keith Miller.
1539
1540         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1541         (assert):
1542         (foo.C):
1543         (foo):
1544         (set x):
1545
1546 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1547
1548         [JSC] Introduce import.meta
1549         https://bugs.webkit.org/show_bug.cgi?id=177703
1550
1551         Reviewed by Filip Pizlo.
1552
1553         * modules/import-meta-syntax.js: Added.
1554         (shouldThrow):
1555         (shouldNotThrow):
1556         * modules/import-meta.js: Added.
1557         * modules/import-meta/cocoa.js: Added.
1558         * modules/resources/assert.js:
1559         (export.shouldNotThrow):
1560         * stress/import-syntax.js:
1561
1562 2017-10-04  Saam Barati  <sbarati@apple.com>
1563
1564         Make pertinent AccessCases watch the poly proto watchpoint
1565         https://bugs.webkit.org/show_bug.cgi?id=177765
1566
1567         Reviewed by Keith Miller.
1568
1569         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1570         (assert):
1571         (foo.C):
1572         (foo):
1573         (validate):
1574         * stress/poly-proto-clear-stub.js: Added.
1575         (assert):
1576         (foo.C):
1577         (foo):
1578
1579 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1580
1581         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1582
1583         Unreviewed test gardening.
1584
1585         * test262.yaml:
1586
1587 2017-10-04  Saam Barati  <sbarati@apple.com>
1588
1589         3 poly-proto JSC tests timing out on debug after r222827
1590         https://bugs.webkit.org/show_bug.cgi?id=177880
1591
1592         Rubber stamped by Mark Lam.
1593
1594         * microbenchmarks/poly-proto-access.js:
1595         * typeProfiler/deltablue-for-of.js:
1596         * typeProfiler/getter-richards.js:
1597
1598 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1599
1600         Unreviewed, marking tco-catch.js as a failure after test262 update
1601         https://bugs.webkit.org/show_bug.cgi?id=177859
1602
1603         * test262.yaml:
1604
1605 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1606
1607         Unreviewed, marking one async iterator test262 test failed
1608         https://bugs.webkit.org/show_bug.cgi?id=177859
1609
1610         * test262.yaml:
1611
1612 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1613
1614         [Test262] Update Test262 to Oct 4 version
1615         https://bugs.webkit.org/show_bug.cgi?id=177859
1616
1617         Reviewed by Sam Weinig.
1618
1619         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1620         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1621
1622         * test262.yaml:
1623         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1624         (checkSequence):
1625         * test262/harness/typeCoercion.js:
1626         (testCoercibleToIndexZero):
1627         (testCoercibleToIndexOne):
1628         (testCoercibleToIndexFromIndex):
1629         (testNotCoercibleToIndex.testPrimitiveValue):
1630         (testNotCoercibleToInteger):
1631         (testCoercibleToBigIntZero.testPrimitiveValue):
1632         (testCoercibleToBigIntZero):
1633         (testCoercibleToBigIntOne.testPrimitiveValue):
1634         (testCoercibleToBigIntOne):
1635         (testPrimitiveValue):
1636         (testCoercibleToBigIntFromBigInt):
1637         (testNotCoercibleToBigInt.testPrimitiveValue):
1638         (testNotCoercibleToBigInt.testStringValue):
1639         (testNotCoercibleToBigInt):
1640         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1641         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1642         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1643         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1644         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1645         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1646         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1647         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1648         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1649         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1650         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1651         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1652         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1653         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1654         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1655         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1656         (testCoercibleToBigIntZero):
1657         (testCoercibleToBigIntOne):
1658         (testNotCoercibleToBigInt):
1659         (MyError): Deleted.
1660         (valueOf): Deleted.
1661         (toString): Deleted.
1662         (Symbol.toPrimitive): Deleted.
1663         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1664         (testCoercibleToIndexZero):
1665         (testCoercibleToIndexOne):
1666         (testNotCoercibleToIndex):
1667         (MyError): Deleted.
1668         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1669         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1670         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1671         (BigInt.asIntN.valueOf): Deleted.
1672         (BigInt.asIntN.toString): Deleted.
1673         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1674         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1675         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1676         (testCoercibleToBigIntZero):
1677         (testCoercibleToBigIntOne):
1678         (testNotCoercibleToBigInt):
1679         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1680         (testCoercibleToIndexZero):
1681         (testCoercibleToIndexOne):
1682         (testNotCoercibleToIndex):
1683         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1684         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1685         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1686         (bits.valueOf):
1687         (bigint.valueOf):
1688         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1689         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1690         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1691         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1692         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1693         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1694         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1695         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1696         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1697         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1698         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1699         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1700         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1701         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1702         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1703         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1704         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1705         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1706         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1707         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1708         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1709         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1710         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1711         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1712         (replacer):
1713         (BigInt.prototype.toJSON):
1714         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1715         (replacer):
1716         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1717         (BigInt.prototype.toJSON):
1718         * test262/test/built-ins/JSON/stringify/bigint.js:
1719         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1720         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1721         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1722         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1723         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1724         * test262/test/built-ins/Object/proto-from-ctor.js:
1725         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1726         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1727         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1728         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1729         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1730         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1731         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1732         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1733         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1734         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1735         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1736         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1737         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1738         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1739         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1740         * test262/test/built-ins/Proxy/get-fn-realm.js:
1741         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1742         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1743         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1744         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1745         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1746         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1747         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1748         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1749         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1750         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1751         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1752         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1753         (i6.replace):
1754         (i6b.replace):
1755         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1756         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1757         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1758         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1759         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1760         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1761         * test262/test/built-ins/RegExp/u180e.js: Added.
1762         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1763         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1764         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1765         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1766         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1767         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1768         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1769         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1770         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1771         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1772         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1773         * test262/test/built-ins/String/prototype/endsWith/length.js:
1774         * test262/test/built-ins/String/prototype/endsWith/name.js:
1775         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1776         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1777         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1778         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1779         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1780         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1781         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1782         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1783         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1784         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1785         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1786         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1787         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1788         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1789         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1790         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1791         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1792         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1793         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1794         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1795         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1796         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1797         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1798         * test262/test/built-ins/String/prototype/includes/includes.js:
1799         * test262/test/built-ins/String/prototype/includes/length.js:
1800         * test262/test/built-ins/String/prototype/includes/name.js:
1801         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1802         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1803         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1804         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1805         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1806         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1807         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1808         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1809         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1810         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1811         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1812         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1813         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1814         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1815         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1816         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1817         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1818         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1819         * test262/test/built-ins/String/prototype/trim/u180e.js:
1820         * test262/test/built-ins/Symbol/for/cross-realm.js:
1821         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1822         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1823         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1824         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1825         * test262/test/built-ins/Symbol/match/cross-realm.js:
1826         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1827         * test262/test/built-ins/Symbol/search/cross-realm.js:
1828         * test262/test/built-ins/Symbol/species/cross-realm.js:
1829         * test262/test/built-ins/Symbol/split/cross-realm.js:
1830         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1831         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1832         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1833         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1834         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1835         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1836         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1837         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1838         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1839         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1840         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1841         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1842         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1843         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1844         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1845         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1846         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1847         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1848         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1849         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1850         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1851         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1852         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1853         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1854         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1855         * test262/test/language/eval-code/indirect/realm.js:
1856         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1857         (o.get z):
1858         (o.get a):
1859         * test262/test/language/expressions/call/eval-realm-indirect.js:
1860         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1861         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1862         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1863         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1864         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1865         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1866         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1867         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1868         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1869         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1870         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1871         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1872         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1873         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1874         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1875         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1876         * test262/test/language/expressions/less-than/bigint-and-number.js:
1877         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1878         * test262/test/language/expressions/super/realm.js:
1879         * test262/test/language/expressions/tagged-template/cache-realm.js:
1880         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1881         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1882         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1883         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1884         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1885         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1886         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1887         (o.get z):
1888         (o.get a):
1889         * test262/test/language/statements/for-of/iterator-next-reference.js:
1890         (next):
1891         (iterator.next): Deleted.
1892         (x.of.iterable.): Deleted.
1893         (x.of.iterable.get return): Deleted.
1894         (x.of.iterable.iterator.next): Deleted.
1895         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1896         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1897         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1898         * test262/test/language/white-space/mongolian-vowel-separator.js:
1899         * test262/test262-Revision.txt:
1900
1901 2017-10-03  Saam Barati  <sbarati@apple.com>
1902
1903         Implement polymorphic prototypes
1904         https://bugs.webkit.org/show_bug.cgi?id=176391
1905
1906         Reviewed by Filip Pizlo.
1907
1908         * microbenchmarks/poly-proto-access.js: Added.
1909         (assert):
1910         (foo.C):
1911         (foo.C.prototype.get bar):
1912         (foo):
1913         (bar):
1914         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1915         (assert):
1916         (makePolyProtoObject.foo.C):
1917         (makePolyProtoObject.foo):
1918         (makePolyProtoObject):
1919         (performSet):
1920         * microbenchmarks/poly-proto-setter-speed.js: Added.
1921         (assert):
1922         (makePolyProtoObject.foo.C):
1923         (makePolyProtoObject.foo.C.prototype.set p):
1924         (makePolyProtoObject.foo):
1925         (makePolyProtoObject):
1926         (performSet):
1927         * stress/constructor-with-return.js:
1928         (i.tests.forEach.Constructor):
1929         (i.tests.forEach):
1930         (tests.forEach.Constructor): Deleted.
1931         (tests.forEach): Deleted.
1932         * stress/dom-jit-with-poly-proto.js: Added.
1933         (assert):
1934         (makePolyProtoObject.foo.C):
1935         (makePolyProtoObject.foo):
1936         (makePolyProtoObject):
1937         (validate):
1938         * stress/poly-proto-custom-value-and-accessor.js: Added.
1939         (assert):
1940         (makePolyProtoObject.foo.C):
1941         (makePolyProtoObject.foo):
1942         (makePolyProtoObject):
1943         (items.forEach):
1944         (set get for):
1945         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1946         (assert):
1947         (makePolyProtoObject.foo.C):
1948         (makePolyProtoObject.foo):
1949         (makePolyProtoObject):
1950         (foo):
1951         * stress/poly-proto-miss.js: Added.
1952         (makePolyProtoInstanceWithNullPrototype.foo.C):
1953         (makePolyProtoInstanceWithNullPrototype.foo):
1954         (makePolyProtoInstanceWithNullPrototype):
1955         (assert):
1956         (validate):
1957         * stress/poly-proto-op-in-caching.js: Added.
1958         (assert):
1959         (makePolyProtoObject.foo.C):
1960         (makePolyProtoObject.foo):
1961         (makePolyProtoObject):
1962         (validate):
1963         (validate2):
1964         * stress/poly-proto-put-transition.js: Added.
1965         (assert):
1966         (makePolyProtoObject.foo.C):
1967         (makePolyProtoObject.foo):
1968         (makePolyProtoObject):
1969         (performSet):
1970         (i.obj.__proto__.set p):
1971         * stress/poly-proto-set-prototype.js: Added.
1972         (assert):
1973         (let.alternateProto.get x):
1974         (let.alternateProto2.get y):
1975         (let.alternateProto2.get x):
1976         (foo.C):
1977         (foo):
1978         (validate):
1979         * stress/poly-proto-setter.js: Added.
1980         (assert):
1981         (makePolyProtoObject.foo.C):
1982         (makePolyProtoObject.foo.C.prototype.set p):
1983         (makePolyProtoObject.foo.C.prototype.get p):
1984         (makePolyProtoObject.foo):
1985         (makePolyProtoObject):
1986         (performSet):
1987         * stress/poly-proto-using-inheritance.js: Added.
1988         (assert):
1989         (foo.C):
1990         (foo.C.prototype.get baz):
1991         (foo):
1992         (bar.C):
1993         (bar):
1994         (validate):
1995         * stress/primitive-poly-proto.js: Added.
1996         (makePolyProtoInstance.foo.C):
1997         (makePolyProtoInstance.foo):
1998         (makePolyProtoInstance):
1999         (assert):
2000         (validate):
2001         * stress/prototype-is-not-js-object.js: Added.
2002         (foo.bar):
2003         (foo):
2004         (assert):
2005         (validate):
2006         * stress/try-get-by-id-poly-proto.js: Added.
2007         (assert):
2008         (makePolyProtoObject.foo.C):
2009         (makePolyProtoObject.foo):
2010         (makePolyProtoObject):
2011         (tryGetByIdText):
2012         (x.__proto__.get bar):
2013         (validate):
2014         * typeProfiler/overflow.js:
2015
2016 2017-10-03  JF Bastien  <jfbastien@apple.com>
2017
2018         WebAssembly: no VM / JS version of everything but Instance
2019         https://bugs.webkit.org/show_bug.cgi?id=177473
2020
2021         Reviewed by Filip Pizlo.
2022
2023         - Exceeding max on memory growth now returns a range error as per
2024         spec. This is a (very minor) breaking change: it used to throw OOM
2025         error. Update the corresponding test.
2026
2027         * wasm/js-api/memory-grow.js:
2028         (assertEq):
2029         * wasm/js-api/table.js:
2030         (assert.throws):
2031
2032 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2033
2034         Skip JSC test stress/regress-159779-2.js on debug.
2035         https://bugs.webkit.org/show_bug.cgi?id=177204
2036
2037         Unreviewed test gardening.
2038
2039         * stress/regress-159779-2.js:
2040
2041 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2042
2043         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2044         https://bugs.webkit.org/show_bug.cgi?id=175642
2045
2046         Reviewed by Darin Adler.
2047
2048         * ChakraCore/test/Function/apply3.baseline-jsc:
2049
2050 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2051
2052         Unreviewed, rolling out r222564.
2053         https://bugs.webkit.org/show_bug.cgi?id=177720
2054
2055         "It regressed JetStream by 2% on iOS caused by a 50%
2056         regression on the bigfib subtest" (Requested by saamyjoon on
2057         #webkit).
2058
2059         Reverted changeset:
2060
2061         "Add Above/Below comparisons for UInt32 patterns"
2062         https://bugs.webkit.org/show_bug.cgi?id=177281
2063         http://trac.webkit.org/changeset/222564
2064
2065 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2066
2067         [DFG] Support ArrayPush with multiple args
2068         https://bugs.webkit.org/show_bug.cgi?id=175823
2069
2070         Reviewed by Saam Barati.
2071
2072         * microbenchmarks/array-push-0.js: Added.
2073         (arrayPush0):
2074         * microbenchmarks/array-push-1.js: Added.
2075         (arrayPush1):
2076         * microbenchmarks/array-push-2.js: Added.
2077         (arrayPush2):
2078         * microbenchmarks/array-push-3.js: Added.
2079         (arrayPush3):
2080         * stress/array-push-multiple-contiguous.js: Added.
2081         (shouldBe):
2082         (test):
2083         * stress/array-push-multiple-double-nan.js: Added.
2084         (shouldBe):
2085         (test):
2086         * stress/array-push-multiple-double.js: Added.
2087         (shouldBe):
2088         (test):
2089         * stress/array-push-multiple-int32.js: Added.
2090         (shouldBe):
2091         (test):
2092         * stress/array-push-multiple-many-contiguous.js: Added.
2093         (shouldBe):
2094         (test):
2095         * stress/array-push-multiple-many-double.js: Added.
2096         (shouldBe):
2097         (test):
2098         * stress/array-push-multiple-many-int32.js: Added.
2099         (shouldBe):
2100         (test):
2101         * stress/array-push-multiple-many-storage.js: Added.
2102         (shouldBe):
2103         (test):
2104         * stress/array-push-multiple-storage.js: Added.
2105         (shouldBe):
2106         (test):
2107         * stress/array-push-with-force-exit.js: Added.
2108         (target.createBuiltin):
2109
2110 2017-09-29  Saam Barati  <sbarati@apple.com>
2111
2112         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2113         https://bugs.webkit.org/show_bug.cgi?id=177639
2114
2115         Reviewed by Geoffrey Garen.
2116
2117         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2118         (assert):
2119         (Class):
2120         (items.forEach):
2121         (set get for):
2122
2123 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2124
2125         Unreviewed, rolling out r222563, r222565, and r222581.
2126         https://bugs.webkit.org/show_bug.cgi?id=177675
2127
2128         "It causes a crash when playing youtube videos" (Requested by
2129         saamyjoon on #webkit).
2130
2131         Reverted changesets:
2132
2133         "[DFG] Support ArrayPush with multiple args"
2134         https://bugs.webkit.org/show_bug.cgi?id=175823
2135         http://trac.webkit.org/changeset/222563
2136
2137         "Unreviewed, build fix after r222563"
2138         https://bugs.webkit.org/show_bug.cgi?id=175823
2139         http://trac.webkit.org/changeset/222565
2140
2141         "Unreviewed, fix x86 breaking due to exhausted registers"
2142         https://bugs.webkit.org/show_bug.cgi?id=175823
2143         http://trac.webkit.org/changeset/222581
2144
2145 2017-09-28  Mark Lam  <mark.lam@apple.com>
2146
2147         test262: Unexpected passes after r222617 and r222618.
2148         https://bugs.webkit.org/show_bug.cgi?id=177622
2149         <rdar://problem/34725960>
2150
2151         Reviewed by Saam Barati.
2152
2153         Update test262.yaml for tests that are now passing.
2154
2155         * test262.yaml:
2156
2157 2017-09-27  Michael Saboff  <msaboff@apple.com>
2158
2159         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2160         https://bugs.webkit.org/show_bug.cgi?id=177570
2161
2162         Reviewed by Filip Pizlo.
2163
2164         New regression test.
2165
2166         * stress/regress-177570.js: Added.
2167
2168 2017-09-28  Michael Saboff  <msaboff@apple.com>
2169
2170         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2171         https://bugs.webkit.org/show_bug.cgi?id=177423
2172
2173         Reviewed by Mark Lam.
2174
2175         Updated regression test.
2176
2177         * stress/regress-177423.js:
2178         (catch):
2179
2180 2017-09-27  Mark Lam  <mark.lam@apple.com>
2181
2182         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2183         https://bugs.webkit.org/show_bug.cgi?id=177584
2184         <rdar://problem/34463903>
2185
2186         Reviewed by Saam Barati.
2187
2188         * stress/regress-177584.js: Added.
2189         (assertEqual):
2190         (Array.prototype.Symbol.species):
2191
2192 2017-09-27  Saam Barati  <sbarati@apple.com>
2193
2194         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2195         https://bugs.webkit.org/show_bug.cgi?id=177523
2196
2197         Reviewed by Mark Lam.
2198
2199         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2200         (assert):
2201         (Test):
2202         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2203         (addMethods):
2204         (i.Test.prototype.propName):
2205
2206 2017-09-27  Mark Lam  <mark.lam@apple.com>
2207
2208         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2209         https://bugs.webkit.org/show_bug.cgi?id=177423
2210         <rdar://problem/34621320>
2211
2212         Reviewed by Keith Miller.
2213
2214         * stress/regress-177423.js: Added.
2215
2216 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2217
2218         Add Above/Below comparisons for UInt32 patterns
2219         https://bugs.webkit.org/show_bug.cgi?id=177281
2220
2221         Reviewed by Saam Barati.
2222
2223         * stress/uint32-comparison-jump.js: Added.
2224         (shouldBe):
2225         (above):
2226         (aboveOrEqual):
2227         (below):
2228         (belowOrEqual):
2229         (notAbove):
2230         (notAboveOrEqual):
2231         (notBelow):
2232         (notBelowOrEqual):
2233         * stress/uint32-comparison.js: Added.
2234         (shouldBe):
2235         (above):
2236         (aboveOrEqual):
2237         (below):
2238         (belowOrEqual):
2239         (aboveTest):
2240         (aboveOrEqualTest):
2241         (belowTest):
2242         (belowOrEqualTest):
2243
2244 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2245
2246         [DFG] Support ArrayPush with multiple args
2247         https://bugs.webkit.org/show_bug.cgi?id=175823
2248
2249         Reviewed by Saam Barati.
2250
2251         * microbenchmarks/array-push-0.js: Added.
2252         (arrayPush0):
2253         * microbenchmarks/array-push-1.js: Added.
2254         (arrayPush1):
2255         * microbenchmarks/array-push-2.js: Added.
2256         (arrayPush2):
2257         * microbenchmarks/array-push-3.js: Added.
2258         (arrayPush3):
2259         * stress/array-push-multiple-contiguous.js: Added.
2260         (shouldBe):
2261         (test):
2262         * stress/array-push-multiple-double-nan.js: Added.
2263         (shouldBe):
2264         (test):
2265         * stress/array-push-multiple-double.js: Added.
2266         (shouldBe):
2267         (test):
2268         * stress/array-push-multiple-int32.js: Added.
2269         (shouldBe):
2270         (test):
2271         * stress/array-push-multiple-many-contiguous.js: Added.
2272         (shouldBe):
2273         (test):
2274         * stress/array-push-multiple-many-double.js: Added.
2275         (shouldBe):
2276         (test):
2277         * stress/array-push-multiple-many-int32.js: Added.
2278         (shouldBe):
2279         (test):
2280         * stress/array-push-multiple-many-storage.js: Added.
2281         (shouldBe):
2282         (test):
2283         * stress/array-push-multiple-storage.js: Added.
2284         (shouldBe):
2285         (test):
2286
2287 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2288
2289         Unreviewed, rolling out r222518.
2290         https://bugs.webkit.org/show_bug.cgi?id=177507
2291
2292         Break the High Sierra build (Requested by yusukesuzuki on
2293         #webkit).
2294
2295         Reverted changeset:
2296
2297         "Add Above/Below comparisons for UInt32 patterns"
2298         https://bugs.webkit.org/show_bug.cgi?id=177281
2299         http://trac.webkit.org/changeset/222518
2300
2301 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2302
2303         Add Above/Below comparisons for UInt32 patterns
2304         https://bugs.webkit.org/show_bug.cgi?id=177281
2305
2306         Reviewed by Saam Barati.
2307
2308         * stress/uint32-comparison-jump.js: Added.
2309         (shouldBe):
2310         (above):
2311         (aboveOrEqual):
2312         (below):
2313         (belowOrEqual):
2314         (notAbove):
2315         (notAboveOrEqual):
2316         (notBelow):
2317         (notBelowOrEqual):
2318         * stress/uint32-comparison.js: Added.
2319         (shouldBe):
2320         (above):
2321         (aboveOrEqual):
2322         (below):
2323         (belowOrEqual):
2324         (aboveTest):
2325         (aboveOrEqualTest):
2326         (belowTest):
2327         (belowOrEqualTest):
2328
2329 2017-09-23  Keith Miller  <keith_miller@apple.com>
2330
2331         Fix infinite looping test262 test
2332         https://bugs.webkit.org/show_bug.cgi?id=177412
2333
2334         Reviewed by Yusuke Suzuki.
2335
2336         This test was poorly designed since failing it would cause the vm
2337         to inifinite loop. I've fixed it locally and will fix it on github pending
2338         the results of next weeks tc39 meeting.
2339
2340         * test262.yaml:
2341         * test262/test/language/statements/for-of/iterator-next-reference.js:
2342
2343 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2344
2345         test262: $.agent became $262.agent in test262 update
2346         https://bugs.webkit.org/show_bug.cgi?id=177407
2347
2348         Reviewed by Yusuke Suzuki.
2349
2350         * test262.yaml:
2351         ~320 tests pass now that we correctly make $262 available.
2352
2353 2017-09-22  Keith Miller  <keith_miller@apple.com>
2354
2355         Speculatively change iteration protocall to use the same next function
2356         https://bugs.webkit.org/show_bug.cgi?id=175653
2357
2358         Reviewed by Saam Barati.
2359
2360         Change test to match the new iteration behavior.
2361
2362         * stress/spread-optimized-properly.js:
2363
2364 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2365
2366         [DFG][FTL] Profile array vector length for array allocation
2367         https://bugs.webkit.org/show_bug.cgi?id=177051
2368
2369         Reviewed by Saam Barati.
2370
2371         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2372         (target):
2373
2374 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2375
2376         Unreviewed, rolling out r222380.
2377         https://bugs.webkit.org/show_bug.cgi?id=177352
2378
2379         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2380         #webkit).
2381
2382         Reverted changeset:
2383
2384         "[DFG][FTL] Profile array vector length for array allocation"
2385         https://bugs.webkit.org/show_bug.cgi?id=177051
2386         http://trac.webkit.org/changeset/222380
2387
2388 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2389
2390         [DFG][FTL] Profile array vector length for array allocation
2391         https://bugs.webkit.org/show_bug.cgi?id=177051
2392
2393         Reviewed by Saam Barati.
2394
2395         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2396         (target):
2397
2398 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2399
2400         Skip new hanging test262 tests.
2401         https://bugs.webkit.org/show_bug.cgi?id=177326
2402
2403         Unreviewed test gardening.
2404
2405         * test262.yaml:
2406
2407 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2408
2409         Mark 6 test262 tests as passing.
2410         https://bugs.webkit.org/show_bug.cgi?id=177307
2411
2412         Unreviewed test gardening.
2413
2414         * test262.yaml:
2415
2416 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2417
2418         Unreviewed follow-up to r222311.
2419
2420         * test262/harness/sta.js:
2421         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2422         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2423         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2424         * test262/test/built-ins/Array/from/elements-added-after.js:
2425         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2426         * test262/test/built-ins/Array/from/elements-updated-after.js:
2427         * test262/test/built-ins/Array/from/from-array.js:
2428         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2429         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2430         * test262/test/built-ins/Array/from/source-array-boundary.js:
2431         * test262/test/built-ins/Array/from/source-object-constructor.js:
2432         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2433         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2434         * test262/test/built-ins/Array/from/source-object-length.js:
2435         * test262/test/built-ins/Array/from/source-object-missing.js:
2436         * test262/test/built-ins/Array/from/source-object-without.js:
2437         * test262/test/built-ins/Array/from/this-null.js:
2438         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2439         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2440         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2441         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2442         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2443         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2444         * test262/test/language/literals/string/7.8.4-1gs.js:
2445         Fix some files that I failed to update when I applied my patch.
2446
2447 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2448
2449         Update test262 tests
2450         https://bugs.webkit.org/show_bug.cgi?id=177220
2451
2452         Reviewed by Saam Barati and Yusuke Suzuki.
2453
2454         * test262.yaml:
2455         * test262/test262-Revision.txt:
2456         New rebaselined expectations for all tests.
2457
2458         * test262/*:
2459         Updated.
2460
2461 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2462
2463         [DFG] Remove ToThis more aggressively
2464         https://bugs.webkit.org/show_bug.cgi?id=177056
2465
2466         Reviewed by Saam Barati.
2467
2468         * stress/generator-with-this-strict.js: Added.
2469         (shouldBe):
2470         (generator):
2471         (target):
2472         * stress/generator-with-this.js: Added.
2473         (shouldBe):
2474         (generator):
2475         (target):
2476
2477 2017-09-17  Michael Saboff  <msaboff@apple.com>
2478
2479         https://bugs.webkit.org/show_bug.cgi?id=177038
2480         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2481
2482         Reviewed by JF Bastien.
2483
2484         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2485         as it dies using too much memory.
2486
2487 2017-09-15  Saam Barati  <sbarati@apple.com>
2488
2489         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2490         https://bugs.webkit.org/show_bug.cgi?id=176981
2491
2492         Reviewed by Yusuke Suzuki.
2493
2494         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2495         (assert):
2496         (verify):
2497         (func):
2498         (const.bar.createBuiltin):
2499
2500 2017-09-14  Saam Barati  <sbarati@apple.com>
2501
2502         It should be valid to exit before each set when doing arity fixup when inlining
2503         https://bugs.webkit.org/show_bug.cgi?id=176948
2504
2505         Reviewed by Keith Miller.
2506
2507         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2508         (baz):
2509         (bar):
2510         (foo):
2511
2512 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2513
2514         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2515         https://bugs.webkit.org/show_bug.cgi?id=176867
2516
2517         Reviewed by Sam Weinig.
2518
2519         * microbenchmarks/object-get-own-property-symbols.js: Added.
2520         (test):
2521
2522 2017-09-13  Mark Lam  <mark.lam@apple.com>
2523
2524         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2525         https://bugs.webkit.org/show_bug.cgi?id=176888
2526         <rdar://problem/34381832>
2527
2528         Not reviewed.
2529
2530         * stress/op_mod-ConstVar.js:
2531         * stress/op_mod-VarConst.js:
2532         * stress/op_mod-VarVar.js:
2533
2534 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2535
2536         Skip 3 op_mod tests on Debug JSC bots.
2537         https://bugs.webkit.org/show_bug.cgi?id=176630
2538
2539         Unreviewed test gardening.
2540
2541         * stress/op_mod-ConstVar.js:
2542         * stress/op_mod-VarConst.js:
2543         * stress/op_mod-VarVar.js:
2544
2545 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2546
2547         [JSC] Fix Array allocation in Object.keys
2548         https://bugs.webkit.org/show_bug.cgi?id=176826
2549
2550         Reviewed by Saam Barati.
2551
2552         * stress/object-own-property-keys.js: Added.
2553         (shouldBe):
2554
2555 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2556
2557         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2558         https://bugs.webkit.org/show_bug.cgi?id=176010
2559
2560         Reviewed by Filip Pizlo.
2561
2562         * microbenchmarks/weak-map-key.js: Added.
2563         (assert):
2564         (objectKey):
2565         (let.start.Date.now):
2566
2567 2017-09-12  Mark Lam  <mark.lam@apple.com>
2568
2569         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2570         https://bugs.webkit.org/show_bug.cgi?id=176630
2571
2572         Reviewed by JF Bastien.
2573
2574         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2575         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2576         a speculative fix for the bots that are seeing these fail.
2577
2578         I also undid the skipping of the op_mod tests for debug builds.
2579
2580         * stress/op_div-ConstVar.js:
2581         * stress/op_div-VarConst.js:
2582         * stress/op_div-VarVar.js:
2583         * stress/op_mod-ConstVar.js:
2584         * stress/op_mod-VarConst.js:
2585         * stress/op_mod-VarVar.js:
2586
2587 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2588
2589         Skip stress/value-to-boolean.js on Debug bots.
2590         https://bugs.webkit.org/show_bug.cgi?id=176787
2591
2592         Unreviewed test gardening.
2593
2594         * stress/value-to-boolean.js:
2595
2596 2017-09-11  Mark Lam  <mark.lam@apple.com>
2597
2598         Change test expectation for test262/test/language/statements/try/tco-catch.js
2599         https://bugs.webkit.org/show_bug.cgi?id=176749
2600
2601         Rubber stamped by Keith Miller.
2602
2603         It's been failing since at least r221821.  I'm changing the test expectation to
2604         fail to green the bots while I investigate some more.
2605
2606         * test262.yaml:
2607
2608 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2609
2610         Unreviewed, rolling out r221854.
2611
2612         The test added with this change fails on 32-bit JSC bots.
2613
2614         Reverted changeset:
2615
2616         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2617         https://bugs.webkit.org/show_bug.cgi?id=176010
2618         http://trac.webkit.org/changeset/221854
2619
2620 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2621
2622         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2623         https://bugs.webkit.org/show_bug.cgi?id=176010
2624
2625         Reviewed by Filip Pizlo.
2626
2627         * microbenchmarks/weak-map-key.js: Added.
2628         (assert):
2629         (objectKey):
2630         (let.start.Date.now):
2631
2632 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2633
2634         [JSC] Optimize Object.keys by using careful array allocation
2635         https://bugs.webkit.org/show_bug.cgi?id=176654
2636
2637         Reviewed by Darin Adler.
2638
2639         * microbenchmarks/object-keys.js: Added.
2640         (test):
2641
2642 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2643
2644         Error should compute .stack and friends lazily
2645         https://bugs.webkit.org/show_bug.cgi?id=176645
2646
2647         Reviewed by Saam Barati.
2648
2649         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2650         * microbenchmarks/new-error.js: Added.
2651         * microbenchmarks/throw.js: Added.
2652
2653 2017-09-09  Mark Lam  <mark.lam@apple.com>
2654
2655         [Re-landing] Use JIT probes for DFG OSR exit.
2656         https://bugs.webkit.org/show_bug.cgi?id=175144
2657         <rdar://problem/33437050>
2658
2659         Not reviewed.  Original patch reviewed by Saam Barati.
2660
2661         Disable these tests for debug builds because they run too slow with the new OSR exit.
2662
2663         * stress/op_mod-ConstVar.js:
2664         * stress/op_mod-VarConst.js:
2665         * stress/op_mod-VarVar.js:
2666
2667 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2668
2669         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2670         https://bugs.webkit.org/show_bug.cgi?id=176300
2671
2672         Reviewed by Saam Barati.
2673
2674         * stress/new-array-with-size-div.js: Added.
2675         (shouldBe):
2676         (test):
2677         (i.i):
2678
2679 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2680
2681         [DFG] PutByVal with Array::Generic is too generic
2682         https://bugs.webkit.org/show_bug.cgi?id=176345
2683
2684         Reviewed by Filip Pizlo.
2685
2686         * stress/object-assign-symbols.js: Added.
2687         (shouldBe):
2688         (test):
2689         * stress/object-assign.js: Added.
2690         (shouldBe):
2691         (test):
2692         (i.shouldBe.JSON.stringify.test):
2693
2694 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2695
2696         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2697         https://bugs.webkit.org/show_bug.cgi?id=176590
2698
2699         Reviewed by Saam Barati.
2700
2701         * microbenchmarks/object-iterate-symbols.js: Added.
2702         (test):
2703         * microbenchmarks/object-iterate.js: Added.
2704         (test):
2705         * stress/object-iterate-symbols.js: Added.
2706         (shouldBe):
2707         (test):
2708         * stress/object-iterate.js: Added.
2709         (shouldBe):
2710         (test):
2711
2712 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2713
2714         [Win32] 10 JSC stress tests are failing.
2715         https://bugs.webkit.org/show_bug.cgi?id=176538
2716
2717         Reviewed by Mark Lam.
2718
2719         Skip tests on Windows to make the bots green.
2720
2721         * ChakraCore.yaml:
2722         * stress/date-relaxed.js:
2723
2724 2017-09-06  Mark Lam  <mark.lam@apple.com>
2725
2726         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2727         https://bugs.webkit.org/show_bug.cgi?id=176485
2728         <rdar://problem/33898874>
2729
2730         Reviewed by Keith Miller.
2731
2732         * stress/regress-176485.js: Added.
2733
2734 2017-09-05  Saam Barati  <sbarati@apple.com>
2735
2736         isNotCellSpeculation is wrong with respect to SpecEmpty
2737         https://bugs.webkit.org/show_bug.cgi?id=176429
2738
2739         Reviewed by Michael Saboff.
2740
2741         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2742         (Foo):
2743
2744 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2745
2746         test262: Completion values for control flow do not match the spec
2747         https://bugs.webkit.org/show_bug.cgi?id=171265
2748
2749         Reviewed by Saam Barati.
2750
2751         * stress/completion-value.js:
2752         Condensed test for completion values in top level statements.
2753
2754         * stress/super-get-by-id.js:
2755         ClassDeclaration when evaled no longer produce values. Convert
2756         these to ClassExpressions so they produce the class value.
2757
2758         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2759         This is a progression for currect spec behavior.
2760
2761         * mozilla/mozilla-tests.yaml:
2762         This test is now outdated, so mark it as failing for that reason.
2763
2764         * test262.yaml:
2765         Passing all "cptn" completion value tests.
2766
2767 2017-09-04  Saam Barati  <sbarati@apple.com>
2768
2769         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2770         https://bugs.webkit.org/show_bug.cgi?id=176317
2771
2772         Reviewed by Keith Miller.
2773
2774         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2775         (Foo):
2776
2777 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2778
2779         [DFG][FTL] Efficiently execute number#toString()
2780         https://bugs.webkit.org/show_bug.cgi?id=170007
2781
2782         Reviewed by Keith Miller.
2783
2784         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2785         (test):
2786         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2787         (test):
2788         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2789         (test):
2790         * microbenchmarks/number-to-string-with-radix.js: Added.
2791         (test):
2792         * stress/number-to-string-strength-reduction.js: Added.
2793         (shouldBe):
2794         (test):
2795         * stress/number-to-string-with-radix-10.js: Added.
2796         (shouldBe):
2797         (test):
2798         * stress/number-to-string-with-radix-cse.js: Added.
2799         (shouldBe):
2800         (test):
2801         * stress/number-to-string-with-radix-invalid.js: Added.
2802         (shouldThrow):
2803         * stress/number-to-string-with-radix-watchpoint.js: Added.
2804         (shouldBe):
2805         (test):
2806         (i.i.1e3.Number.prototype.toString):
2807         * stress/number-to-string-with-radix.js: Added.
2808         (shouldBe):
2809         (test):
2810
2811 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2812
2813         [DFG] Relax arity requirement
2814         https://bugs.webkit.org/show_bug.cgi?id=175523
2815
2816         Reviewed by Saam Barati.
2817
2818         * stress/arity-mismatch-arguments-length.js: Added.
2819         (shouldBe):
2820         (test1):
2821         (test):
2822         * stress/arity-mismatch-get-argument.js: Added.
2823         (shouldBe):
2824         (builtin.createBuiltin):
2825         (test):
2826         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2827         (shouldBe):
2828         (inlineTarget):
2829         (test):
2830         * stress/arity-mismatch-inlining.js: Added.
2831         (shouldBe):
2832         (inlineTarget):
2833         (test):
2834         * stress/arity-mismatch-rest.js: Added.
2835         (shouldBe):
2836         (test2):
2837         (test1):
2838         (test):
2839
2840 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2841
2842         [JSC] Fix "name" and "length" of Proxy revoke function
2843         https://bugs.webkit.org/show_bug.cgi?id=176155
2844
2845         Reviewed by Mark Lam.
2846
2847         * test262.yaml:
2848
2849 2017-08-31  Saam Barati  <sbarati@apple.com>
2850
2851         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2852         https://bugs.webkit.org/show_bug.cgi?id=176206
2853
2854         Reviewed by Keith Miller.
2855
2856         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2857         (a):
2858         (b):
2859         (foo):
2860
2861 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2862
2863         Skip two slow JSC tests after r221422.
2864
2865         Unreviewed test gardening.
2866
2867         * stress/regexp-prototype-match-on-too-long-rope.js:
2868         * stress/regexp-prototype-test-on-too-long-rope.js:
2869
2870 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2871
2872         Unreviewed, skipping slow tests.
2873
2874         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2875         work differently now.
2876
2877         * stress/regexp-prototype-exec-on-too-long-rope.js:
2878         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2879
2880 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2881
2882         [JSC] Use reifying system for "name" property of builtin JSFunction
2883         https://bugs.webkit.org/show_bug.cgi?id=175260
2884
2885         Reviewed by Saam Barati.
2886
2887         * stress/accessors-get-set-prefix.js:
2888         * stress/builtin-function-name.js: Added.
2889         (shouldBe):
2890         (shouldThrow):
2891         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2892         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2893         * stress/private-name-as-anonymous-builtin.js: Added.
2894         (shouldBe):
2895         (NotPromise):
2896
2897 2017-08-30  Saam Barati  <sbarati@apple.com>
2898
2899         Unreviewed. Make test stop printing.
2900
2901         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2902
2903 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2904
2905         Unreviewed, rolling out r221327.
2906
2907         This change caused test262 failures.
2908
2909         Reverted changeset:
2910
2911         "[JSC] Use reifying system for "name" property of builtin
2912         JSFunction"
2913         https://bugs.webkit.org/show_bug.cgi?id=175260
2914         http://trac.webkit.org/changeset/221327
2915
2916 2017-08-30  Saam Barati  <sbarati@apple.com>
2917
2918         semicolon is being interpreted as an = in the LiteralParser
2919         https://bugs.webkit.org/show_bug.cgi?id=176114
2920
2921         Reviewed by Oliver Hunt.
2922
2923         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2924         * stress/resources/literal-parser-test-case.js: Added.
2925
2926 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2927
2928         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2929         https://bugs.webkit.org/show_bug.cgi?id=166698
2930
2931         Reviewed by Yusuke Suzuki.
2932
2933         * stress/async-iteration-for-await-of-syntax.js: Added.
2934         (assert):
2935         (checkSyntax):
2936         (checkSyntaxError):
2937         (checkSimpleAsyncGeneratorSloppyMode):
2938         (checkSimpleAsyncGeneratorStrictMode):
2939         (checkNestedAsyncGenerators):
2940         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2941         * stress/async-iteration-for-await-of.js: Added.
2942         (assert):
2943         (async.foo):
2944         (async.boo):
2945         (const.boo.async):
2946
2947 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2948
2949         [JSC] Use reifying system for "name" property of builtin JSFunction
2950         https://bugs.webkit.org/show_bug.cgi?id=175260
2951
2952         Reviewed by Saam Barati.
2953
2954         * stress/accessors-get-set-prefix.js:
2955         * stress/builtin-function-name.js: Added.
2956         (shouldBe):
2957         (shouldThrow):
2958         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2959         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2960
2961 2017-08-25  Saam Barati  <sbarati@apple.com>
2962
2963         Support compiling catch in the DFG
2964         https://bugs.webkit.org/show_bug.cgi?id=174590
2965         <rdar://problem/34047845>
2966
2967         Reviewed by Filip Pizlo.
2968
2969         * microbenchmarks/delta-blue-try-catch.js: Added.
2970         (exception):
2971         (value):
2972         (OrderedCollection):
2973         (OrderedCollection.prototype.add):
2974         (OrderedCollection.prototype.at):
2975         (OrderedCollection.prototype.size):
2976         (OrderedCollection.prototype.removeFirst):
2977         (OrderedCollection.prototype.remove):
2978         (Strength):
2979         (Strength.stronger):
2980         (Strength.weaker):
2981         (Strength.weakestOf):
2982         (Strength.strongest):
2983         (Strength.prototype.nextWeaker):
2984         (Constraint):
2985         (Constraint.prototype.addConstraint):
2986         (Constraint.prototype.satisfy):
2987         (Constraint.prototype.destroyConstraint):
2988         (Constraint.prototype.isInput):
2989         (UnaryConstraint):
2990         (UnaryConstraint.prototype.addToGraph):
2991         (UnaryConstraint.prototype.chooseMethod):
2992         (UnaryConstraint.prototype.isSatisfied):
2993         (UnaryConstraint.prototype.markInputs):
2994         (UnaryConstraint.prototype.output):
2995         (UnaryConstraint.prototype.recalculate):
2996         (UnaryConstraint.prototype.markUnsatisfied):
2997         (UnaryConstraint.prototype.inputsKnown):
2998         (UnaryConstraint.prototype.removeFromGraph):
2999         (StayConstraint):
3000         (StayConstraint.prototype.execute):
3001         (EditConstraint.prototype.isInput):
3002         (EditConstraint.prototype.execute):
3003         (BinaryConstraint):
3004         (BinaryConstraint.prototype.chooseMethod):
3005         (BinaryConstraint.prototype.addToGraph):
3006         (BinaryConstraint.prototype.isSatisfied):
3007         (BinaryConstraint.prototype.markInputs):
3008         (BinaryConstraint.prototype.input):
3009         (BinaryConstraint.prototype.output):
3010         (BinaryConstraint.prototype.recalculate):
3011         (BinaryConstraint.prototype.markUnsatisfied):
3012         (BinaryConstraint.prototype.inputsKnown):
3013         (BinaryConstraint.prototype.removeFromGraph):
3014         (ScaleConstraint):
3015         (ScaleConstraint.prototype.addToGraph):
3016         (ScaleConstraint.prototype.removeFromGraph):
3017         (ScaleConstraint.prototype.markInputs):
3018         (ScaleConstraint.prototype.execute):
3019         (ScaleConstraint.prototype.recalculate):
3020         (EqualityConstraint):
3021         (EqualityConstraint.prototype.execute):
3022         (Variable):
3023         (Variable.prototype.addConstraint):
3024         (Variable.prototype.removeConstraint):
3025         (Planner):
3026         (Planner.prototype.incrementalAdd):
3027         (Planner.prototype.incrementalRemove):
3028         (Planner.prototype.newMark):
3029         (Planner.prototype.makePlan):
3030         (Planner.prototype.extractPlanFromConstraints):
3031         (Planner.prototype.addPropagate):
3032         (Planner.prototype.removePropagateFrom):
3033         (Planner.prototype.addConstraintsConsumingTo):
3034         (Plan):
3035         (Plan.prototype.addConstraint):
3036         (Plan.prototype.size):
3037         (Plan.prototype.constraintAt):
3038         (Plan.prototype.execute):
3039         (chainTest):
3040         (projectionTest):
3041         (change):
3042         (deltaBlue):
3043         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3044         (assert):
3045         (Numbers):
3046         (Numbers.prototype.next):
3047         (return.Transpose):
3048         (return.Transpose.prototype.next):
3049         (transpose):
3050         (verifyEven):
3051         (verifyString):
3052         (foo):
3053         (runIterators):
3054         * microbenchmarks/try-catch-word-count.js: Added.
3055         (let.assert):
3056         (EOF):
3057         (let.texts):
3058         (let.o.apply):
3059         (foo):
3060         (bar):
3061         (f):
3062         (run):
3063         (test1):
3064         (test2):
3065         (test3):
3066         (fn):
3067         (A):
3068         (B):
3069         (A.prototype.getValue):
3070         (B.prototype.getParentValue):
3071         (strlen):
3072         (sum.0):
3073         (test):
3074         (result.test.o):
3075         (set add.set add):
3076         (set forEach):
3077         (stringHash):
3078         (set if):
3079         (testFunction):
3080         (set delete.set has.set add):
3081         * stress/catch-set-argument-speculation-failure.js: Added.
3082         (o):
3083         (e):
3084         (e2):
3085         (escape):
3086         (baz):
3087         (noInline.run):
3088         (noInline):
3089         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3090         (foo):
3091         (e):
3092         (baz):
3093         (bar):
3094
3095 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3096
3097         Unreviewed, rolling out r221119, r221124, and r221143.
3098         https://bugs.webkit.org/show_bug.cgi?id=175973
3099
3100         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3101         on #webkit).
3102
3103         Reverted changesets:
3104
3105         "Support compiling catch in the DFG"
3106         https://bugs.webkit.org/show_bug.cgi?id=174590
3107         http://trac.webkit.org/changeset/221119
3108
3109         "Unreviewed, build fix in GTK port"
3110         https://bugs.webkit.org/show_bug.cgi?id=174590
3111         http://trac.webkit.org/changeset/221124
3112
3113         "DFG::JITCode::osrEntry should get sorted since we perform a
3114         binary search on it"
3115         https://bugs.webkit.org/show_bug.cgi?id=175893
3116         http://trac.webkit.org/changeset/221143
3117
3118 2017-08-24  Michael Saboff  <msaboff@apple.com>
3119
3120         Add support for RegExp "dotAll" flag
3121         https://bugs.webkit.org/show_bug.cgi?id=175924
3122
3123         Reviewed by Keith Miller.
3124
3125         Updated tests for new dotAll ('s' flag) changes.
3126
3127         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3128         * stress/static-getter-in-names.js:
3129
3130 2017-08-24  Mark Lam  <mark.lam@apple.com>
3131
3132         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3133         https://bugs.webkit.org/show_bug.cgi?id=175940
3134         <rdar://problem/29003921>
3135
3136         Reviewed by Saam Barati.
3137
3138         * stress/regress-164081.js: Added.
3139         (shouldEqual):
3140         (testcase):
3141
3142 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3143
3144         Skip flaky JSC test stress/test-finally.js.
3145         https://bugs.webkit.org/show_bug.cgi?id=160283
3146
3147         Unreviewed test gardening.
3148
3149         * stress/test-finally.js:
3150
3151 2017-08-23  Saam Barati  <sbarati@apple.com>
3152
3153         Support compiling catch in the DFG
3154         https://bugs.webkit.org/show_bug.cgi?id=174590
3155
3156         Reviewed by Filip Pizlo.
3157
3158         * microbenchmarks/delta-blue-try-catch.js: Added.
3159         (exception):
3160         (value):
3161         (OrderedCollection):
3162         (OrderedCollection.prototype.add):
3163         (OrderedCollection.prototype.at):
3164         (OrderedCollection.prototype.size):
3165         (OrderedCollection.prototype.removeFirst):
3166         (OrderedCollection.prototype.remove):
3167         (Strength):
3168         (Strength.stronger):
3169         (Strength.weaker):
3170         (Strength.weakestOf):
3171         (Strength.strongest):
3172         (Strength.prototype.nextWeaker):
3173         (Constraint):
3174         (Constraint.prototype.addConstraint):
3175         (Constraint.prototype.satisfy):
3176         (Constraint.prototype.destroyConstraint):
3177         (Constraint.prototype.isInput):
3178         (UnaryConstraint):
3179         (UnaryConstraint.prototype.addToGraph):
3180         (UnaryConstraint.prototype.chooseMethod):
3181         (UnaryConstraint.prototype.isSatisfied):
3182         (UnaryConstraint.prototype.markInputs):
3183         (UnaryConstraint.prototype.output):
3184         (UnaryConstraint.prototype.recalculate):
3185         (UnaryConstraint.prototype.markUnsatisfied):
3186         (UnaryConstraint.prototype.inputsKnown):
3187         (UnaryConstraint.prototype.removeFromGraph):
3188         (StayConstraint):
3189         (StayConstraint.prototype.execute):
3190         (EditConstraint.prototype.isInput):
3191         (EditConstraint.prototype.execute):
3192         (BinaryConstraint):
3193         (BinaryConstraint.prototype.chooseMethod):
3194         (BinaryConstraint.prototype.addToGraph):
3195         (BinaryConstraint.prototype.isSatisfied):
3196         (BinaryConstraint.prototype.markInputs):
3197         (BinaryConstraint.prototype.input):
3198         (BinaryConstraint.prototype.output):
3199         (BinaryConstraint.prototype.recalculate):
3200         (BinaryConstraint.prototype.markUnsatisfied):
3201         (BinaryConstraint.prototype.inputsKnown):
3202         (BinaryConstraint.prototype.removeFromGraph):
3203         (ScaleConstraint):
3204         (ScaleConstraint.prototype.addToGraph):
3205         (ScaleConstraint.prototype.removeFromGraph):
3206         (ScaleConstraint.prototype.markInputs):
3207         (ScaleConstraint.prototype.execute):
3208         (ScaleConstraint.prototype.recalculate):
3209         (EqualityConstraint):
3210         (EqualityConstraint.prototype.execute):
3211         (Variable):
3212         (Variable.prototype.addConstraint):
3213         (Variable.prototype.removeConstraint):
3214         (Planner):
3215         (Planner.prototype.incrementalAdd):
3216         (Planner.prototype.incrementalRemove):
3217         (Planner.prototype.newMark):
3218         (Planner.prototype.makePlan):
3219         (Planner.prototype.extractPlanFromConstraints):
3220         (Planner.prototype.addPropagate):
3221         (Planner.prototype.removePropagateFrom):
3222         (Planner.prototype.addConstraintsConsumingTo):
3223         (Plan):
3224         (Plan.prototype.addConstraint):
3225         (Plan.prototype.size):
3226         (Plan.prototype.constraintAt):
3227         (Plan.prototype.execute):
3228         (chainTest):
3229         (projectionTest):
3230         (change):
3231         (deltaBlue):
3232         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3233         (assert):
3234         (Numbers):
3235         (Numbers.prototype.next):
3236         (return.Transpose):
3237         (return.Transpose.prototype.next):
3238         (transpose):
3239         (verifyEven):
3240         (verifyString):
3241         (foo):
3242         (runIterators):
3243         * microbenchmarks/try-catch-word-count.js: Added.
3244         (let.assert):
3245         (EOF):
3246         (let.texts):
3247         (let.o.apply):
3248         (foo):
3249         (bar):
3250         (f):
3251         (run):
3252         (test1):
3253         (test2):
3254         (test3):
3255         (fn):
3256         (A):
3257         (B):
3258         (A.prototype.getValue):
3259         (B.prototype.getParentValue):
3260         (strlen):
3261         (sum.0):
3262         (test):
3263         (result.test.o):
3264         (set add.set add):
3265         (set forEach):
3266         (stringHash):
3267         (set if):
3268         (testFunction):
3269         (set delete.set has.set add):
3270         * stress/catch-set-argument-speculation-failure.js: Added.
3271         (o):
3272         (e):
3273         (e2):
3274         (escape):
3275         (baz):
3276         (noInline.run):
3277         (noInline):
3278         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3279         (foo):
3280         (e):
3281         (baz):
3282         (bar):
3283
3284 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3285
3286         [JSC] Optimize Map iteration with intrinsic
3287         https://bugs.webkit.org/show_bug.cgi?id=174355
3288
3289         Reviewed by Saam Barati.
3290
3291         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3292         (shouldBe):
3293         (throw.new.Error):
3294         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3295         (shouldBe):
3296         (throw.new.Error.let.iterator.set Symbol):
3297         (throw.new.Error.set add):
3298         (let.iterator.set Symbol):
3299
3300 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3301
3302         Add a micro-benchmark for checking that accessing a variable within a 'with'
3303         block does not automatically prevent type prediction.
3304         https://bugs.webkit.org/show_bug.cgi?id=175738
3305
3306         Reviewed by Saam Barati.
3307
3308         * stress/with_and_arith.js: Added.
3309         (with):
3310
3311 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3312
3313         [ESNext] Async iteration - Implement Async Generator - runtime
3314         https://bugs.webkit.org/show_bug.cgi?id=175240
3315
3316         Reviewed by Yusuke Suzuki.
3317
3318         * stress/async-iteration-async-from-sync.js: Added.
3319         (assert):
3320         (const.Logger):
3321         (this.fullfilled):
3322         (this.fullfilledDone):
3323         (this.rejected):
3324         (this.catched):
3325         (this.isFinal):
3326         (_assertLogger):
3327         (const.assertLogger):
3328         (const.getPromise.promiseHolder.return.new.Promise):
3329         (foo):
3330         (async.boo):
3331         (bar):
3332         (async.baz):
3333         (async.goo):
3334         * stress/async-iteration-basic.js: Added.
3335         (assert):
3336         (const.Logger):
3337         (this.fullfilled):
3338         (this.fullfilledDone):
3339         (this.rejected):
3340         (this.catched):
3341         (this.isFinal):
3342         (_assertLogger):
3343         (const.assertLogger):
3344         (const.getPromise.promiseHolder.return.new.Promise):
3345         (async.generator):
3346         (iterator.next.then):
3347         (async.baz):
3348         (async.boo):
3349         (async.foo):
3350         (async.goo):
3351         (A.prototype.async.foo):
3352         (A.prototype.async.boo):
3353         (A):
3354         (asyncGenExp.async):
3355         (async.joo):
3356         (j.next.then):
3357         (then):
3358         (async.koo):
3359         (async.loo):
3360         (async.moo):
3361         (async.noo):
3362         (async.ooo):
3363         (async.roo):
3364         (async.poo):
3365         (async.soo):
3366         (async.too):
3367         * stress/async-iteration-evaluation.js: Added.
3368         (assert):
3369         (async.foo):
3370         (catch):
3371         * stress/async-iteration-syntax.js:
3372         * stress/async-iteration-yield-promise.js: Added.
3373         (assert):
3374         (const.Logger):
3375         (this.fullfilled):
3376         (this.fullfilledDone):
3377         (this.rejected):
3378         (this.catched):
3379         (this.isFinal):
3380         (_assertLogger):
3381         (const.assertLogger):
3382         (const.getPromise.promiseHolder.return.new.Promise):
3383         (async.foo):
3384         (async.boo):
3385         (async.bar):
3386         * stress/async-iteration-yield-star-interface.js: Added.
3387         (assert):
3388         (const.getPromise.promiseHolder.return.new.Promise):
3389         (const.Logger):
3390         (this.fullfilled):
3391         (this.fullfilledDone):
3392         (this.rejected):
3393         (this.catched):
3394         (this.custom):
3395         (this.isFinal):
3396         (_assertLogger):
3397         (const.assertLogger):
3398         (let.asyncIter.Symbol.asyncIterator):
3399         (let.asyncIter.next):
3400         (let.asyncIter.throw):
3401         (let.asyncIter.return):
3402         (async.foo):
3403         (asyncIter.Symbol.asyncIterator):
3404         (asyncIter.next):
3405         (async.boo):
3406         (asyncIter.return):
3407         (async.bar):
3408         (async.baz):
3409         (async.foobar):
3410         * stress/async-iteration-yield-star.js: Added.
3411         (assert):
3412         (const.Logger):
3413         (this.fullfilled):
3414         (this.fullfilledDone):
3415         (this.rejected):
3416         (this.catched):
3417         (this.custom):
3418         (this.isFinal):
3419         (_assertLogger):
3420         (const.assertLogger):
3421         (const.getPromise.promiseHolder.return.new.Promise):
3422         (async.foo):
3423         (async.boo):
3424         (async.bar):
3425         (async.baz):
3426         (async.joo):
3427         (async.goo):
3428         (async.koo):
3429         (async.loo):
3430         (let.asyncIter.Symbol.asyncIterator):
3431         (let.asyncIter.next):
3432         (let.asyncIter.throw):
3433         (let.asyncIter.return):
3434         (async.moo):
3435         (async.noo):
3436         * test262.yaml:
3437
3438 2017-08-23  JF Bastien  <jfbastien@apple.com>
3439
3440         Fix printing in test
3441
3442         Unreviewed: fixing verbosity, shouldn't have been there.
3443
3444         * wasm/regress/175693.js:
3445         (else.else):
3446         (catch):
3447
3448 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3449
3450         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3451         https://bugs.webkit.org/show_bug.cgi?id=172543
3452
3453         Unreviewed test gardening.
3454
3455         * microbenchmarks/generator-with-several-types.js:
3456
3457 2017-08-17  JF Bastien  <jfbastien@apple.com>
3458
3459         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3460         https://bugs.webkit.org/show_bug.cgi?id=175693
3461         <rdar://problem/33952443>
3462
3463         Reviewed by Saam Barati.
3464
3465         Add a regression directory for WebAssembly tests.
3466
3467         * wasm.yaml:
3468         * wasm/regress/175693.js: Added.
3469         (else.else):
3470         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3471         (catch):
3472         * wasm/regress/175693.wasm: Added.
3473
3474 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3475
3476         Support the 'with' keyword in FTL.
3477         https://bugs.webkit.org/show_bug.cgi?id=175585
3478
3479         Reviewed by Saam Barati.
3480
3481         Also improve the JSTest/stress/with.js file to test
3482         what happens when non-objects are passed to with.
3483
3484         * stress/with.js:
3485         (foo):
3486         (i.catch):
3487         (i.with): Deleted.
3488
3489 2017-08-14  Keith Miller  <keith_miller@apple.com>
3490
3491         Add testing tool to lie to the DFG about profiles
3492         https://bugs.webkit.org/show_bug.cgi?id=175487
3493
3494         Reviewed by Saam Barati.
3495
3496         * stress/compare-eq-incomplete-profile.js: Added.
3497         (const.test.createBuiltin):
3498
3499 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3500
3501         Support the with keyword in DFG
3502         https://bugs.webkit.org/show_bug.cgi?id=175470
3503
3504         Reviewed by Saam Barati.
3505
3506         Added a new stress-test for the 'with' keyword, that caught a bug in a
3507         previous version of this code.
3508
3509         * stress/with.js: Added.
3510         (i.with):
3511
3512 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3513
3514         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3515         https://bugs.webkit.org/show_bug.cgi?id=175544
3516
3517         Unreviewed test gardening.
3518
3519         * ChakraCore.yaml:
3520
3521 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3522
3523         Early error on ANY operator before new.target
3524         https://bugs.webkit.org/show_bug.cgi?id=157970
3525
3526         Reviewed by Saam Barati.
3527
3528         Instead of throwing if any unary operator precedes new.target, only
3529         throw if the unary operator updates the reference.
3530
3531         The following become legal in JSC:
3532
3533         ```
3534         !new.target
3535         ~new.target
3536         typeof new.target
3537         delete new.target
3538         void new.target
3539         ```
3540
3541         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3542
3543         * stress/new-target-syntax-errors.js:
3544         * stress/new-target.js:
3545
3546 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3547
3548         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3549         https://bugs.webkit.org/show_bug.cgi?id=175255
3550
3551         Unreviewed test gardening.
3552
3553         * stress/regress-169783.js:
3554         * wasm/stress/oom.js:
3555
3556 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3557
3558         REGRESSION: 2 test262/test/language/statements/async-function failures
3559         https://bugs.webkit.org/show_bug.cgi?id=175334
3560
3561         Reviewed by Yusuke Suzuki.
3562
3563         Add @skip parameters to tests, and remove test for async iterator from
3564         async await syntax test because it is already covered by async-iterator-syntax.js
3565
3566         * stress/async-await-syntax.js:
3567         * stress/async-iteration-syntax.js:
3568
3569 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3570
3571         Unreviewed, gardening test262 for Promise resolve / reject function length
3572         https://bugs.webkit.org/show_bug.cgi?id=175333
3573
3574         * test262.yaml:
3575
3576 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3577
3578         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3579         https://bugs.webkit.org/show_bug.cgi?id=175307
3580
3581         Reviewed by Saam Barati.
3582
3583         * stress/typedarray-getownproperty-not-configurable.js: Added.
3584         (assert):
3585         (foo):
3586
3587 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3588
3589         Promise resolve and reject function should have length = 1
3590         https://bugs.webkit.org/show_bug.cgi?id=175242
3591
3592         Reviewed by Saam Barati.
3593
3594         * stress/builtin-function-length.js: Added.
3595         (shouldBe):
3596         (shouldThrow):
3597         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3598         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3599
3600 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3601
3602         [ESNext] Async iteration - Implement Async Generator - parser
3603         https://bugs.webkit.org/show_bug.cgi?id=175210
3604
3605         Reviewed by Yusuke Suzuki.
3606
3607         * stress/async-await-syntax.js:
3608         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3609         * stress/async-iteration-syntax.js: Added.
3610         (assert):
3611         (checkSyntax):
3612         (checkSyntaxError):
3613         (checkSimpleAsyncGeneratorSloppyMode):
3614         (checkSimpleAsyncGeneratorStrictMode):
3615         (checkNestedAsyncGenerators):
3616         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3617         * stress/generator-class-methods-syntax.js:
3618
3619 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3620
3621         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3622         https://bugs.webkit.org/show_bug.cgi?id=175150
3623
3624         Unreviewed test gardening.
3625
3626         * wasm/js-api/test_memory_constructor.js:
3627
3628 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3629
3630         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3631         https://bugs.webkit.org/show_bug.cgi?id=175100
3632
3633         Reviewed by Mark Lam.
3634
3635         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3636         available memory until an out of memory exception happens.
3637
3638         The Linux kernel is more tuned for server workloads than for GUI
3639         responsiveness. When a process tries to use a lot of memory, Linux
3640         will do its best to serve the request. This usually translates to
3641         free physical RAM by writing to disk dirty pages and/or moving out
3642         less recently used pages to swap (disk storage).
3643         Meanwhile it does this, the system will become unresponsive and this
3644         leads to freezes that can last even some minutes on the worst cases.
3645
3646         Therefore, let's skip this test on Linux as it will cause more harm
3647         than good on the Linux bots or on the machines of Linux developers.
3648
3649         * wasm/stress/oom.js:
3650
3651 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3652
3653         [JSC] Remove unnecessary print from stress\promise-finally.js test
3654         https://bugs.webkit.org/show_bug.cgi?id=175015
3655
3656         Reviewed by Yusuke Suzuki.
3657
3658         * stress/promise-finally.js:
3659         (p.finally):
3660         (then):
3661
3662 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3663
3664         Unreviewed, update test262 results for optional catch binding
3665
3666         * test262.yaml:
3667
3668 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3669
3670         [JSC] Support optional catch binding
3671         https://bugs.webkit.org/show_bug.cgi?id=174981
3672
3673         Reviewed by Saam Barati.
3674
3675         * stress/optional-catch-binding-syntax.js: Added.
3676         (testSyntax):
3677         (testSyntaxError):
3678         (catch.catch):
3679         * stress/optional-catch-binding.js: Added.
3680         (shouldBe):
3681         (throwException):
3682
3683 2017-07-28  Mark Lam  <mark.lam@apple.com>
3684
3685         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3686         https://bugs.webkit.org/show_bug.cgi?id=174948
3687         <rdar://problem/33495680>
3688
3689         Reviewed by Filip Pizlo.
3690
3691         * stress/regress-174948.js: Added.
3692
3693 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3694
3695         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3696         https://bugs.webkit.org/show_bug.cgi?id=174900
3697
3698         Reviewed by Saam Barati.
3699
3700         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3701         (sideEffect):
3702         (args):
3703         (test):
3704
3705 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3706
3707         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3708         https://bugs.webkit.org/show_bug.cgi?id=171637
3709
3710         Reviewed by Darin Adler.
3711
3712         * stress/domjit-getter-complex-with-incorrect-object.js:
3713         (i.shouldThrow):
3714         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3715         (shouldBe):
3716         (i.shouldThrow):
3717
3718 2017-07-26  JF Bastien  <jfbastien@apple.com>
3719
3720         WebAssembly: test throwing out of the start function
3721         https://bugs.webkit.org/show_bug.cgi?id=165714
3722         <rdar://problem/29760251>
3723
3724         Reviewed by Keith Miller.
3725
3726         * wasm/assert.js:
3727         * wasm/function-tests/trap-from-start.js: Added.
3728         (StartTraps):