JSTests/ChangeLog

   1 2018-05-04  Keith Miller  <keith_miller@apple.com>
   2
   3         isCacheableArrayLength should return true for undecided arrays
   4         https://bugs.webkit.org/show_bug.cgi?id=185309
   5
   6         Reviewed by Michael Saboff.
   7
   8         * stress/get-array-length-undecided.js: Added.
   9         (test):
  10
  11 2018-05-04  Dominik Infuehr  <dinfuehr@igalia.com>
  12
  13         Disable tests on systems with limited memory
  14         https://bugs.webkit.org/show_bug.cgi?id=185296
  15
  16         Reviewed by Saam Barati.
  17
  18         Test doesn't work with a limited amount of memory. I tried to reduce memory usage
  19         but then it was hard to reproduce the failure the test was originally made to test.
  20
  21         * stress/array-reverse-doesnt-clobber.js:
  22
  23 2018-05-03  Saam Barati  <sbarati@apple.com>
  24
  25         Don't prevent CreateThis being folded to NewObject when the structure is poly proto
  26         https://bugs.webkit.org/show_bug.cgi?id=185177
  27
  28         Reviewed by Filip Pizlo.
  29
  30         * microbenchmarks/construct-poly-proto-object.js: Added.
  31         (foo.A):
  32         (foo):
  33         * stress/allocation-sinking-new-object-with-poly-proto.js: Added.
  34         (foo.A):
  35         (foo):
  36         (makePolyProto):
  37         (bar):
  38         (baz):
  39
  40 2018-05-03  Michael Saboff  <msaboff@apple.com>
  41
  42         OSR entry pruning of Program Bytecodes doesn't take into account try/catch
  43         https://bugs.webkit.org/show_bug.cgi?id=185281
  44
  45         Reviewed by Saam Barati.
  46
  47         New regression test.
  48
  49         * stress/baseline-osrentry-catch-is-reachable.js: Added.
  50         (i.j.catch):
  51
  52 2018-05-03  Ryan Haddad  <ryanhaddad@apple.com>
  53
  54         Unreviewed, rolling out r231197.
  55
  56         The test added with this change crashes on the 32-bit JSC bot.
  57
  58         Reverted changeset:
  59
  60         "Correctly detect string overflow when using the 'Function'
  61         constructor"
  62         https://bugs.webkit.org/show_bug.cgi?id=184883
  63         https://trac.webkit.org/changeset/231197
  64
  65 2018-05-02  Filip Pizlo  <fpizlo@apple.com>
  66
  67         JSC should know how to cache custom getter accesses on the prototype chain
  68         https://bugs.webkit.org/show_bug.cgi?id=185213
  69
  70         Reviewed by Keith Miller.
  71
  72         * microbenchmarks/get-custom-getter.js: Added.
  73         (test):
  74
  75 2018-05-02  Robin Morisset  <rmorisset@apple.com>
  76
  77         emitCodeToGetArgumentsArrayLength should not crash on PhantomNewArrayWithSpread
  78         https://bugs.webkit.org/show_bug.cgi?id=183172
  79
  80         Reviewed by Filip Pizlo.
  81
  82         * stress/length-of-new-array-with-spread.js: Added.
  83         (foo):
  84         (bar):
  85         (baz):
  86
  87 2018-05-01  Yusuke Suzuki  <utatane.tea@gmail.com>
  88
  89         [JSC] Add SameValue DFG node
  90         https://bugs.webkit.org/show_bug.cgi?id=185065
  91
  92         Reviewed by Saam Barati.
  93
  94         * microbenchmarks/object-is.js: Added.
  95         (incognito):
  96         (sameValue):
  97         (test1):
  98         (test2):
  99         (test3):
 100         (test4):
 101         (test5):
 102         (test6):
 103         * stress/object-is.js: Added.
 104         (shouldBe):
 105         (is1):
 106         (is2):
 107         (is3):
 108         (is4):
 109         (is5):
 110         (is6):
 111         (is7):
 112         (is8):
 113         (is9):
 114         (is10):
 115         (is11):
 116         (is12):
 117         (is13):
 118         (is14):
 119         (is15):
 120
 121 2018-05-01  Robin Morisset  <rmorisset@apple.com>
 122
 123         Correctly detect string overflow when using the 'Function' constructor
 124         https://bugs.webkit.org/show_bug.cgi?id=184883
 125         <rdar://problem/36320331>
 126
 127         Reviewed by Filip Pizlo.
 128
 129         I put this regression test in the 'slowMicrobenchmarks' directory because it takes nearly 30s to run, and I am not sure where else to put it.
 130
 131         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
 132         (catch):
 133
 134 2018-05-01  Robin Morisset  <rmorisset@apple.com>
 135
 136         IntlObject.cpp::removeUnicodeLocaleExtension() should not touch locales that end in '-u'
 137         https://bugs.webkit.org/show_bug.cgi?id=185162
 138
 139         Reviewed by Filip Pizlo.
 140
 141         * stress/incomplete-unicode-locale.js: Added.
 142         (catch):
 143
 144 2018-05-01  Dominik Infuehr  <dinfuehr@igalia.com>
 145
 146         Add SetCallee as DFG-Operation
 147         https://bugs.webkit.org/show_bug.cgi?id=184582
 148
 149         Reviewed by Filip Pizlo.
 150
 151         Added test that runs into infinite loop without updating the callee and
 152         therefore emitting SetCallee in DFG for recursive tail calls.
 153
 154         * stress/closure-recursive-tail-call-infinite-loop.js: Added.
 155         (Foo):
 156         (second):
 157         (first):
 158         (return.closure):
 159         (createClosure):
 160
 161 2018-04-30  Saam Barati  <sbarati@apple.com>
 162
 163         ToString constant folds without preserving checks, causing us to break assumptions that the code would OSR exit
 164         https://bugs.webkit.org/show_bug.cgi?id=185149
 165         <rdar://problem/39455917>
 166
 167         Reviewed by Filip Pizlo.
 168
 169         * stress/keep-checks-when-converting-to-lazy-js-constant-in-strength-reduction.js: Added.
 170
 171 2018-04-29  Filip Pizlo  <fpizlo@apple.com>
 172
 173         LICM shouldn't hoist nodes if hoisted nodes exited in that code block
 174         https://bugs.webkit.org/show_bug.cgi?id=185126
 175
 176         Reviewed by Saam Barati.
 177
 178         I found this bug by accident when I was writing this test for something else.
 179
 180         This change also speeds up other benchmarks of this case that we already had. They are all called
 181         the licm-dragons tests.
 182
 183         * microbenchmarks/licm-dragons-two-structures.js: Added.
 184         (foo):
 185
 186 2018-04-29  Commit Queue  <commit-queue@webkit.org>
 187
 188         Unreviewed, rolling out r231137.
 189         https://bugs.webkit.org/show_bug.cgi?id=185118
 190
 191         It is breaking Test262 language/expressions/multiplication
 192         /order-of-evaluation.js (Requested by caiolima on #webkit).
 193
 194         Reverted changeset:
 195
 196         "[ESNext][BigInt] Implement support for "*" operation"
 197         https://bugs.webkit.org/show_bug.cgi?id=183721
 198         https://trac.webkit.org/changeset/231137
 199
 200 2018-04-28  Saam Barati  <sbarati@apple.com>
 201
 202         We don't model regexp effects properly
 203         https://bugs.webkit.org/show_bug.cgi?id=185059
 204         <rdar://problem/39736150>
 205
 206         Reviewed by Filip Pizlo.
 207
 208         * stress/regexp-exec-test-effectful-last-index.js: Added.
 209         (assert):
 210         (foo):
 211         (i.regexLastIndex.toString):
 212         (bar):
 213
 214 2018-04-28  Rick Waldron  <waldron.rick@gmail.com>
 215
 216         Token misspelled "tocken" in error message string
 217         https://bugs.webkit.org/show_bug.cgi?id=185030
 218
 219         Reviewed by Saam Barati.
 220
 221         * ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc: Fix typo "tocken" => "token"
 222         * stress/destructuring-assignment-syntax.js: Fix typo "tocken" => "token"
 223         * stress/error-messages-for-in-operator-should-not-crash.js: Fix typo "tocken" => "token"
 224         * stress/reserved-word-with-escape.js: Fix typo "tocken" => "token"
 225         (testSyntaxError.String.raw.v):
 226         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
 227         (testSyntaxError.String.raw.a):
 228
 229 2018-04-28  Caio Lima  <ticaiolima@gmail.com>
 230
 231         [ESNext][BigInt] Implement support for "*" operation
 232         https://bugs.webkit.org/show_bug.cgi?id=183721
 233
 234         Reviewed by Saam Barati.
 235
 236         * bigIntTests.yaml:
 237         * stress/big-int-mul-jit.js: Added.
 238         * stress/big-int-mul-to-primitive-precedence.js: Added.
 239         * stress/big-int-mul-to-primitive.js: Added.
 240         * stress/big-int-mul-type-error.js: Added.
 241         * stress/big-int-mul-wrapped-value.js: Added.
 242         * stress/big-int-multiplication.js: Added.
 243         * stress/big-int-multiply-memory-stress.js: Added.
 244
 245 2018-04-28  Commit Queue  <commit-queue@webkit.org>
 246
 247         Unreviewed, rolling out r231131.
 248         https://bugs.webkit.org/show_bug.cgi?id=185112
 249
 250         It is breaking Debug build due to unchecked exception
 251         (Requested by caiolima on #webkit).
 252
 253         Reverted changeset:
 254
 255         "[ESNext][BigInt] Implement support for "*" operation"
 256         https://bugs.webkit.org/show_bug.cgi?id=183721
 257         https://trac.webkit.org/changeset/231131
 258
 259 2018-04-27  Caio Lima  <ticaiolima@gmail.com>
 260
 261         [ESNext][BigInt] Implement support for "*" operation
 262         https://bugs.webkit.org/show_bug.cgi?id=183721
 263
 264         Reviewed by Saam Barati.
 265
 266         * bigIntTests.yaml:
 267         * stress/big-int-mul-jit.js: Added.
 268         * stress/big-int-mul-to-primitive-precedence.js: Added.
 269         * stress/big-int-mul-to-primitive.js: Added.
 270         * stress/big-int-mul-type-error.js: Added.
 271         * stress/big-int-mul-wrapped-value.js: Added.
 272         * stress/big-int-multiplication.js: Added.
 273         * stress/big-int-multiply-memory-stress.js: Added.
 274
 275 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
 276
 277         Unreviewed, rolling out r231086.
 278
 279         Caused JSC test failures due to an unchecked exception.
 280
 281         Reverted changeset:
 282
 283         "[ESNext][BigInt] Implement support for "*" operation"
 284         https://bugs.webkit.org/show_bug.cgi?id=183721
 285         https://trac.webkit.org/changeset/231086
 286
 287 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
 288
 289         Unreviewed test gardening, update expectations for test262/intl402/PluralRules tests after r231047.
 290
 291         * test262.yaml: Mark tests as passing.
 292
 293 2018-04-26  Caio Lima  <ticaiolima@gmail.com>
 294
 295         [ESNext][BigInt] Implement support for "*" operation
 296         https://bugs.webkit.org/show_bug.cgi?id=183721
 297
 298         Reviewed by Saam Barati.
 299
 300         * bigIntTests.yaml:
 301         * stress/big-int-mul-jit.js: Added.
 302         * stress/big-int-mul-to-primitive-precedence.js: Added.
 303         * stress/big-int-mul-to-primitive.js: Added.
 304         * stress/big-int-mul-type-error.js: Added.
 305         * stress/big-int-mul-wrapped-value.js: Added.
 306         * stress/big-int-multiplication.js: Added.
 307         * stress/big-int-multiply-memory-stress.js: Added.
 308
 309 2018-04-25  Robin Morisset  <rmorisset@apple.com>
 310
 311         In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
 312         https://bugs.webkit.org/show_bug.cgi?id=184773
 313         <rdar://problem/37773612>
 314
 315         Reviewed by Filip Pizlo.
 316
 317         This bug requires a race between the thread doing FTL compilation and the main thread, but it triggers in 100% of cases (before the fix) on my machine
 318         so I decided to add it to the stress tests nonetheless.
 319
 320         * stress/create-rest-while-having-a-bad-time.js: Added.
 321         (f):
 322         (g):
 323         (h):
 324
 325 2018-04-25  Keith Miller  <keith_miller@apple.com>
 326
 327         Add missing scope release to functionProtoFuncToString
 328         https://bugs.webkit.org/show_bug.cgi?id=184995
 329
 330         Reviewed by Saam Barati.
 331
 332         * stress/function-toString-arrow.js: Added.
 333         (async):
 334
 335 2018-04-24  Keith Miller  <keith_miller@apple.com>
 336
 337         fromCharCode is missing some exception checks
 338         https://bugs.webkit.org/show_bug.cgi?id=184952
 339
 340         Reviewed by Saam Barati.
 341
 342         * stress/fromCharCode-exception-check.js: Added.
 343         (get catch):
 344
 345 2018-04-24  Mark Lam  <mark.lam@apple.com>
 346
 347         Gardening: test fix after r230863.
 348         https://bugs.webkit.org/show_bug.cgi?id=184846
 349         <rdar://problem/39390672>
 350
 351         Not reviewed.
 352
 353         * stress/json-stringified-overflow-2.js:
 354         (catch):
 355         * stress/json-stringified-overflow.js:
 356         (catch):
 357
 358 2018-04-20  JF Bastien  <jfbastien@apple.com>
 359
 360         Handle more JSON stringify OOM
 361         https://bugs.webkit.org/show_bug.cgi?id=184846
 362         <rdar://problem/39390672>
 363
 364         Reviewed by Mark Lam.
 365
 366         * stress/json-stringified-overflow-2.js: Added. Same as the one
 367         below, but with a bigger input which will trigger a different code
 368         path.
 369         (catch):
 370         * stress/json-stringified-overflow.js: Modify the test to only
 371         catch OOM on stringification. not on string creation.
 372
 373 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 374
 375         [WebAssembly][Modules] Import tables in wasm modules
 376         https://bugs.webkit.org/show_bug.cgi?id=184738
 377
 378         Reviewed by JF Bastien.
 379
 380         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
 381         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
 382         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
 383         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
 384         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
 385         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
 386         * wasm/modules/wasm-imports-wasm-exports.js:
 387         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
 388         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
 389         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
 390         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
 391
 392 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 393
 394         [WebAssembly][Modules] Import globals from wasm modules
 395         https://bugs.webkit.org/show_bug.cgi?id=184736
 396
 397         Reviewed by JF Bastien.
 398
 399         * wasm.yaml:
 400         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
 401         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
 402         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
 403         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
 404         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
 405         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
 406         * wasm/modules/wasm-imports-wasm-exports.js:
 407         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
 408         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
 409         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
 410         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
 411
 412 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 413
 414         Unreviewed, reland r230697, r230720, and r230724.
 415         https://bugs.webkit.org/show_bug.cgi?id=184600
 416
 417         * wasm.yaml:
 418         * wasm/modules/constant.wasm: Added.
 419         * wasm/modules/constant.wat: Added.
 420         * wasm/modules/default-import-star-error.js: Added.
 421         (then):
 422         * wasm/modules/default-import-star-error/entry.wasm: Added.
 423         * wasm/modules/default-import-star-error/entry.wat: Added.
 424         * wasm/modules/default-import-star-error/t0.js: Added.
 425         * wasm/modules/default-import-star-error/t1.js: Added.
 426         * wasm/modules/default-import-star-error/t2.js: Added.
 427         (export.default.Cocoa):
 428         * wasm/modules/js-wasm-cycle.js: Added.
 429         * wasm/modules/js-wasm-cycle/entry.js: Added.
 430         (from.string_appeared_here.export.return42):
 431         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
 432         * wasm/modules/js-wasm-cycle/sum.wat: Added.
 433         * wasm/modules/js-wasm-function-namespace.js: Added.
 434         (assert.throws):
 435         * wasm/modules/js-wasm-function.js: Added.
 436         (assert.throws):
 437         * wasm/modules/js-wasm-global-namespace.js: Added.
 438         (assert.throws):
 439         * wasm/modules/js-wasm-global.js: Added.
 440         (assert.throws):
 441         * wasm/modules/js-wasm-memory-namespace.js: Added.
 442         (assert.throws):
 443         * wasm/modules/js-wasm-memory.js: Added.
 444         (assert.throws):
 445         * wasm/modules/js-wasm-start.js: Added.
 446         (then):
 447         * wasm/modules/js-wasm-table-namespace.js: Added.
 448         (assert.throws):
 449         * wasm/modules/js-wasm-table.js: Added.
 450         (assert.throws):
 451         * wasm/modules/memory.wasm: Added.
 452         * wasm/modules/memory.wat: Added.
 453         * wasm/modules/run-from-wasm.wasm: Added.
 454         * wasm/modules/run-from-wasm.wat: Added.
 455         * wasm/modules/run-from-wasm/check.js: Added.
 456         (export.check):
 457         * wasm/modules/start.wasm: Added.
 458         * wasm/modules/start.wat: Added.
 459         * wasm/modules/sum.wasm: Added.
 460         * wasm/modules/sum.wat: Added.
 461         * wasm/modules/table.wasm: Added.
 462         * wasm/modules/table.wat: Added.
 463         * wasm/modules/wasm-imports-js-exports.js: Added.
 464         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
 465         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
 466         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
 467         (export.sum):
 468         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
 469         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
 470         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
 471         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
 472         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
 473         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
 474         * wasm/modules/wasm-imports-wasm-exports.js: Added.
 475         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
 476         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
 477         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
 478         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
 479         * wasm/modules/wasm-js-cycle.js: Added.
 480         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
 481         * wasm/modules/wasm-js-cycle/entry.wat: Added.
 482         * wasm/modules/wasm-js-cycle/sum.js: Added.
 483         (from.string_appeared_here.export.sum):
 484         * wasm/modules/wasm-wasm-cycle.js: Added.
 485         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
 486         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
 487         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
 488         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
 489
 490 2018-04-17  Commit Queue  <commit-queue@webkit.org>
 491
 492         Unreviewed, rolling out r230697, r230720, and r230724.
 493         https://bugs.webkit.org/show_bug.cgi?id=184717
 494
 495         These caused multiple failures on the Test262 testers.
 496         (Requested by mlewis13 on #webkit).
 497
 498         Reverted changesets:
 499
 500         "[WebAssembly][Modules] Prototype wasm import"
 501         https://bugs.webkit.org/show_bug.cgi?id=184600
 502         https://trac.webkit.org/changeset/230697
 503
 504         "[WebAssembly][Modules] Implement function import from wasm
 505         modules"
 506         https://bugs.webkit.org/show_bug.cgi?id=184689
 507         https://trac.webkit.org/changeset/230720
 508
 509         "[JSC] Rename runWebAssembly to runWebAssemblySuite"
 510         https://bugs.webkit.org/show_bug.cgi?id=184703
 511         https://trac.webkit.org/changeset/230724
 512
 513 2018-04-17  JF Bastien  <jfbastien@apple.com>
 514
 515         A put is not an ExistingProperty put when we transition a structure because of an attributes change
 516         https://bugs.webkit.org/show_bug.cgi?id=184706
 517         <rdar://problem/38871451>
 518
 519         Reviewed by Saam Barati.
 520
 521         * stress/put-by-id-direct-strict-transition.js: Added.
 522         (const.foo):
 523         (j.const.obj.set hello):
 524         * stress/put-by-id-direct-transition.js: Added.
 525         (const.foo):
 526         (j.const.obj.set hello):
 527         * stress/put-getter-setter-by-id-strict-transition.js: Added.
 528         (const.foo):
 529         (j.const.obj.set hello):
 530         * stress/put-getter-setter-by-id-transition.js: Added.
 531         (const.foo):
 532         (j.const.obj.set hello):
 533
 534 2018-04-16  Filip Pizlo  <fpizlo@apple.com>
 535
 536         PutStackSinkingPhase should know that KillStack means ConflictingFlush
 537         https://bugs.webkit.org/show_bug.cgi?id=184672
 538
 539         Reviewed by Michael Saboff.
 540
 541         * stress/sink-put-stack-over-kill-stack.js: Added.
 542         (avocado_1):
 543         (apricot_0):
 544         (__c_0):
 545         (banana_2):
 546
 547 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
 548
 549         [JSC] Rename runWebAssembly to runWebAssemblySuite
 550         https://bugs.webkit.org/show_bug.cgi?id=184703
 551
 552         Reviewed by JF Bastien.
 553
 554         And add runWebAssembly as a command to simplely run wasm modules.
 555
 556         * wasm.yaml:
 557
 558 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
 559
 560         [WebAssembly][Modules] Implement function import from wasm modules
 561         https://bugs.webkit.org/show_bug.cgi?id=184689
 562
 563         Reviewed by JF Bastien.
 564
 565         * wasm.yaml:
 566         * wasm/modules/js-wasm-cycle.js: Added.
 567         * wasm/modules/js-wasm-cycle/entry.js: Added.
 568         (from.string_appeared_here.export.return42):
 569         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
 570         * wasm/modules/js-wasm-cycle/sum.wat: Added.
 571         * wasm/modules/run-from-wasm.wasm: Added.
 572         * wasm/modules/run-from-wasm.wat: Added.
 573         * wasm/modules/run-from-wasm/check.js: Added.
 574         (export.check):
 575         * wasm/modules/wasm-imports-js-exports.js: Added.
 576         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
 577         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
 578         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
 579         (export.sum):
 580         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
 581         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
 582         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
 583         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
 584         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
 585         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
 586         * wasm/modules/wasm-imports-wasm-exports.js: Added.
 587         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
 588         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
 589         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
 590         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
 591         * wasm/modules/wasm-js-cycle.js: Added.
 592         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
 593         * wasm/modules/wasm-js-cycle/entry.wat: Added.
 594         * wasm/modules/wasm-js-cycle/sum.js: Added.
 595         (from.string_appeared_here.export.sum):
 596         * wasm/modules/wasm-wasm-cycle.js: Added.
 597         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
 598         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
 599         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
 600         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
 601
 602 2018-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>
 603
 604         [WebAssembly][Modules] Prototype wasm import
 605         https://bugs.webkit.org/show_bug.cgi?id=184600
 606
 607         Reviewed by JF Bastien.
 608
 609         Add wasm and wat files since module loader want to load wasm files from FS.
 610         Currently, importing the other modules from wasm is not supported.
 611
 612         * wasm.yaml:
 613         * wasm/modules/constant.wasm: Added.
 614         * wasm/modules/constant.wat: Added.
 615         * wasm/modules/js-wasm-function-namespace.js: Added.
 616         (assert.throws):
 617         * wasm/modules/js-wasm-function.js: Added.
 618         (assert.throws):
 619         * wasm/modules/js-wasm-global-namespace.js: Added.
 620         (assert.throws):
 621         * wasm/modules/js-wasm-global.js: Added.
 622         (assert.throws):
 623         * wasm/modules/js-wasm-memory-namespace.js: Added.
 624         (assert.throws):
 625         * wasm/modules/js-wasm-memory.js: Added.
 626         (assert.throws):
 627         * wasm/modules/js-wasm-start.js: Added.
 628         (then):
 629         * wasm/modules/js-wasm-table-namespace.js: Added.
 630         (assert.throws):
 631         * wasm/modules/js-wasm-table.js: Added.
 632         (assert.throws):
 633         * wasm/modules/memory.wasm: Added.
 634         * wasm/modules/memory.wat: Added.
 635         * wasm/modules/start.wasm: Added.
 636         * wasm/modules/start.wat: Added.
 637         * wasm/modules/sum.wasm: Added.
 638         * wasm/modules/sum.wat: Added.
 639         * wasm/modules/table.wasm: Added.
 640         * wasm/modules/table.wat: Added.
 641
 642 2018-04-14  Filip Pizlo  <fpizlo@apple.com>
 643
 644         Function.prototype.caller shouldn't return generator bodies
 645         https://bugs.webkit.org/show_bug.cgi?id=184630
 646
 647         Reviewed by Yusuke Suzuki.
 648
 649         * stress/function-caller-async-arrow-function-body.js: Added.
 650         * stress/function-caller-async-function-body.js: Added.
 651         * stress/function-caller-async-generator-body.js: Added.
 652         * stress/function-caller-generator-body.js: Added.
 653         * stress/function-caller-generator-method-body.js: Added.
 654
 655 2018-04-12  Tomas Popela  <tpopela@redhat.com>
 656
 657         Unreviewed, skip JIT tests if it isn't enabled
 658
 659         See https://bugs.webkit.org/show_bug.cgi?id=182730.
 660
 661         * stress/big-int-spec-to-primitive.js:
 662         * stress/big-int-spec-to-this.js:
 663
 664 2018-04-10  Caio Lima  <ticaiolima@gmail.com>
 665
 666         [ESNext][BigInt] Add support for BigInt in SpeculatedType
 667         https://bugs.webkit.org/show_bug.cgi?id=182470
 668
 669         Reviewed by Saam Barati.
 670
 671         * stress/big-int-spec-to-primitive.js: Added.
 672         * stress/big-int-spec-to-this.js: Added.
 673         * stress/big-int-strict-equals-jit.js: Added.
 674         * stress/big-int-strict-spec-to-this.js: Added.
 675         * stress/big-int-type-of-proven-type.js: Added.
 676
 677 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
 678
 679         DFG AI and clobberize should agree with each other
 680         https://bugs.webkit.org/show_bug.cgi?id=184440
 681
 682         Reviewed by Saam Barati.
 683
 684         Add tests for all of the bugs I fixed.
 685
 686         * stress/direct-arguments-out-of-bounds-change-structure.js: Added.
 687         (foo):
 688         * stress/new-typed-array-cse-effects.js: Added.
 689         (foo):
 690         * stress/scoped-arguments-out-of-bounds-change-structure.js: Added.
 691         (foo.theO):
 692         (foo):
 693         * stress/string-from-char-code-change-structure-not-dead.js: Added.
 694         (foo):
 695         (i.valueOf):
 696         (weirdValue.valueOf):
 697         * stress/string-from-char-code-change-structure.js: Added.
 698         (foo):
 699         (i.valueOf):
 700         (weirdValue.valueOf):
 701
 702 2018-04-09  Leo Balter  <leonardo.balter@gmail.com>
 703
 704         Fix errant Test262 files CRLF to LF for consistency with the original source
 705         https://bugs.webkit.org/show_bug.cgi?id=184425
 706
 707         Reviewed by Yusuke Suzuki.
 708
 709         * test262/test/built-ins/Math/acosh/nan-returns.js:
 710         * test262/test/built-ins/Math/asinh/asinh-specialVals.js:
 711         * test262/test/built-ins/Math/atanh/atanh-specialVals.js:
 712         * test262/test/built-ins/Math/cbrt/cbrt-specialValues.js:
 713         * test262/test/built-ins/Math/cbrt/prop-desc.js:
 714         * test262/test/built-ins/Math/cosh/cosh-specialVals.js:
 715         * test262/test/built-ins/Math/expm1/expm1-specialVals.js:
 716         * test262/test/built-ins/Math/log10/Log10-specialVals.js:
 717         * test262/test/built-ins/Math/log2/log2-basicTests.js:
 718         * test262/test/built-ins/Math/sign/sign-specialVals.js:
 719         * test262/test/built-ins/Math/sinh/sinh-specialVals.js:
 720         * test262/test/built-ins/Math/tanh/tanh-specialVals.js:
 721         * test262/test/built-ins/Math/trunc/trunc-sampleTests.js:
 722         * test262/test/built-ins/Math/trunc/trunc-specialVals.js:
 723
 724 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 725
 726         Unreviewed, remove incorrect entry in test262.yaml
 727         https://bugs.webkit.org/show_bug.cgi?id=184266
 728
 729         * test262.yaml:
 730
 731 2018-04-08  Valerie Young  <valerie@bocoup.com>
 732
 733         [JSC] Update Test262 to April 6 version
 734         https://bugs.webkit.org/show_bug.cgi?id=184266
 735
 736         Rubber stamped by Yusuke Suzuki.
 737
 738 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 739
 740         [JSC] Introduce op_get_by_id_direct
 741         https://bugs.webkit.org/show_bug.cgi?id=183970
 742
 743         Reviewed by Filip Pizlo.
 744
 745         * stress/generator-prototype-copy.js: Added.
 746         (gen):
 747         (catch):
 748         Adopted JF's tests.
 749
 750         * stress/generator-type-check.js: Added.
 751         (shouldThrow):
 752         (foo2):
 753         (i.shouldThrow):
 754         * stress/get-by-id-direct-getter.js: Added.
 755         (shouldBe):
 756         (shouldThrow):
 757         (obj.get hello):
 758         (builtin.createBuiltin):
 759         (obj2.get length):
 760         * stress/get-by-id-direct.js: Added.
 761         (shouldBe):
 762         (shouldThrow):
 763         (builtin.createBuiltin):
 764         * test262.yaml:
 765         We fixed long-standing spec compatibility issue.
 766         As a result, this patch makes several test262 tests passed!
 767
 768
 769 2018-04-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 770
 771         Unreviewed, annotate test with @skip if $memoryLimited
 772         https://bugs.webkit.org/show_bug.cgi?id=183894
 773
 774         * stress/json-stringified-overflow.js:
 775
 776 2018-04-06  Alexey Proskuryakov  <ap@apple.com>
 777
 778         Add svn:eol-style to line-terminator-normalisation-CR.js
 779         https://bugs.webkit.org/show_bug.cgi?id=184341
 780
 781         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js: Added property svn:eol-style.
 782
 783 2018-04-06  Ross Kirsling  <ross.kirsling@sony.com>
 784
 785         Unreviewed, remove errant LF from existing test262 test for CR line endings.
 786
 787         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
 788
 789 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
 790
 791         Unreviewed, rolling out r230320.
 792
 793         Revert fix, as the root cause lies elsewhere.
 794
 795         Reverted changeset:
 796
 797         "[test262] Mark line-terminator-normalisation-CR.js as a
 798         binary file."
 799         https://bugs.webkit.org/show_bug.cgi?id=184341
 800         https://trac.webkit.org/changeset/230320
 801
 802 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
 803
 804         [test262] Mark line-terminator-normalisation-CR.js as a binary file.
 805         https://bugs.webkit.org/show_bug.cgi?id=184341
 806
 807         Reviewed by Yusuke Suzuki.
 808
 809         This test is all about CR line endings, but `svn-apply` can't deal with them.
 810         Treating the file as binary ensures that its contents never are never shown in a diff.
 811
 812         * .gitattributes: Added.
 813
 814 2018-04-05  Robin Morisset  <rmorisset@apple.com>
 815
 816         Fix testcase (missing try/catch).
 817         https://bugs.webkit.org/show_bug.cgi?id=183657
 818
 819         Unreviewed.
 820
 821         * stress/large-unshift-splice.js
 822
 823 2018-04-04  Filip Pizlo  <fpizlo@apple.com>
 824
 825         REGRESSION(r222563): removed DoubleReal type check causes tons of crashes because CSE has never known how to handle SaneChain
 826         https://bugs.webkit.org/show_bug.cgi?id=184319
 827
 828         Reviewed by Saam Barati.
 829
 830         * stress/array-push-nan-to-double-array-cse-sane-and-insane-chain.js: Added.
 831         (foo):
 832         (bar):
 833         * stress/array-push-nan-to-double-array.js: Added.
 834         (foo):
 835         (bar):
 836
 837 2018-04-03  Mark Lam  <mark.lam@apple.com>
 838
 839         Test js-fixed-array-out-of-memory.js should be excluded for memory limited devices.
 840         https://bugs.webkit.org/show_bug.cgi?id=184284
 841
 842         Reviewed by Saam Barati.
 843
 844         * stress/js-fixed-array-out-of-memory.js:
 845
 846 2018-03-31  Filip Pizlo  <fpizlo@apple.com>
 847
 848         JSC crash in JIT code with for-of loop and Array/Set iterators
 849         https://bugs.webkit.org/show_bug.cgi?id=183174
 850
 851         Reviewed by Saam Barati.
 852
 853         * microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: Added. This test shows that fixing the bug didn't break hoisting of GetByOffset with inferred types. I confirmed that if I did break it, this test slows down by >7x.
 854         (foo):
 855         * stress/hoist-get-by-offset-with-control-dependent-inferred-type.js: Added. This test shows that the bug is fixed.
 856         (f):
 857
 858 2018-03-30  JF Bastien  <jfbastien@apple.com>
 859
 860         WebAssembly: support DataView compilation
 861         https://bugs.webkit.org/show_bug.cgi?id=183342
 862
 863         Reviewed by Mark Lam.
 864
 865         Test WebAssembly compilation using a DataView with offset.
 866
 867         * wasm/regress/183342.js: Added.
 868         (attempt.catch):
 869
 870 2018-03-30  Filip Pizlo  <fpizlo@apple.com>
 871
 872         Bytecode generator should not get_from_scope something that may be a hole into a variable that is already live
 873         https://bugs.webkit.org/show_bug.cgi?id=184189
 874
 875         Reviewed by JF Bastien.
 876
 877         * stress/load-hole-from-scope-into-live-var.js: Added.
 878         (result.eval.try.switch):
 879         (catch):
 880
 881 2018-03-30  Ryan Haddad  <ryanhaddad@apple.com>
 882
 883         Unreviewed, rolling out r230102.
 884
 885         Caused assertion failures on JSC bots.
 886
 887         Reverted changeset:
 888
 889         "A stack overflow in the parsing of a builtin (called by
 890         createExecutable) cause a crash instead of a catchable js
 891         exception"
 892         https://bugs.webkit.org/show_bug.cgi?id=184074
 893         https://trac.webkit.org/changeset/230102
 894
 895 2018-03-30  Robin Morisset  <rmorisset@apple.com>
 896
 897         Inlining of a function that ends in op_unreachable in a non-tail position triggers an ASSERT
 898         https://bugs.webkit.org/show_bug.cgi?id=183812
 899
 900         Reviewed by Keith Miller.
 901
 902         * stress/inlining-unreachable-non-tail.js: Added.
 903         (foo.):
 904         (foo):
 905
 906 2018-03-30  Robin Morisset  <rmorisset@apple.com>
 907
 908         A stack overflow in the parsing of a builtin (called by createExecutable) cause a crash instead of a catchable js exception
 909         https://bugs.webkit.org/show_bug.cgi?id=184074
 910         <rdar://problem/37165897>
 911
 912         Reviewed by Keith Miller.
 913
 914         * stress/stack-overflow-while-parsing-builtin.js: Added.
 915         (f):
 916
 917 2018-03-30  Robin Morisset  <rmorisset@apple.com>
 918
 919         Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType
 920         https://bugs.webkit.org/show_bug.cgi?id=183657
 921
 922         Reviewed by Keith Miller.
 923
 924         * stress/large-unshift-splice.js: Added.
 925         (make_contig_arr):
 926
 927 2018-03-28  Robin Morisset  <rmorisset@apple.com>
 928
 929         appendQuotedJSONString stops on arithmetic overflow instead of propagating it upwards
 930         https://bugs.webkit.org/show_bug.cgi?id=183894
 931
 932         Reviewed by Saam Barati.
 933
 934         * stress/json-stringified-overflow.js: Added.
 935         (catch):
 936
 937 2018-03-26  Filip Pizlo  <fpizlo@apple.com>
 938
 939         DFG should know that CreateThis can be effectful
 940         https://bugs.webkit.org/show_bug.cgi?id=184013
 941
 942         Reviewed by Saam Barati.
 943
 944         * stress/create-this-property-change.js: Added.
 945         (Foo):
 946         (RealBar):
 947         (get if):
 948         * stress/create-this-structure-change-without-cse.js: Added.
 949         (Foo):
 950         (RealBar):
 951         (get if):
 952         * stress/create-this-structure-change.js: Added.
 953         (Foo):
 954         (RealBar):
 955         (get if):
 956
 957 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
 958
 959         [DFG] Introduces fused compare and jump
 960         https://bugs.webkit.org/show_bug.cgi?id=177100
 961
 962         Reviewed by Mark Lam.
 963
 964         * stress/fused-jeq-slow.js: Added.
 965         (shouldBe):
 966         (testJEQ):
 967         (testJNEQB):
 968         (testJEQB):
 969         (testJNEQF):
 970         (testJEQF):
 971         * stress/fused-jeq.js: Added.
 972         (shouldBe):
 973         (testJEQ):
 974         (testJNEQB):
 975         (testJEQB):
 976         (testJNEQF):
 977         (testJEQF):
 978         * stress/fused-jstricteq-slow.js: Added.
 979         (shouldBe):
 980         (testJSTRICTEQ):
 981         (testJNSTRICTEQB):
 982         (testJSTRICTEQB):
 983         (testJNSTRICTEQF):
 984         (testJSTRICTEQF):
 985         * stress/fused-jstricteq.js: Added.
 986         (shouldBe):
 987         (testJSTRICTEQ):
 988         (testJNSTRICTEQB):
 989         (testJSTRICTEQB):
 990         (testJNSTRICTEQF):
 991         (testJSTRICTEQF):
 992
 993 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
 994
 995         [JSC] Clear MustGenerate for ToString(Number) converted from NumberToStringWithRadix
 996         https://bugs.webkit.org/show_bug.cgi?id=183559
 997
 998         Reviewed by Mark Lam.
 999
1000         * stress/double-to-string-in-loop-removed.js: Added.
1001         (test):
1002         * stress/int32-to-string-in-loop-removed.js: Added.
1003         (test):
1004         * stress/int52-to-string-in-loop-removed.js: Added.
1005         (test):
1006
1007 2018-03-22  Michael Saboff  <msaboff@apple.com>
1008
1009         Race Condition in arrayProtoFuncReverse() causes wrong results or crash
1010         https://bugs.webkit.org/show_bug.cgi?id=183901
1011
1012         Reviewed by Keith Miller.
1013
1014         New test.
1015
1016         * stress/array-reverse-doesnt-clobber.js: Added.
1017         (testArrayReverse):
1018         (createArrayOfArrays):
1019         (createArrayStorage):
1020
1021 2018-03-21  Filip Pizlo  <fpizlo@apple.com>
1022
1023         ScopedArguments should do poisoning and index masking
1024         https://bugs.webkit.org/show_bug.cgi?id=183863
1025
1026         Reviewed by Mark Lam.
1027
1028         Adds another stress test of scoped arguments.
1029
1030         * stress/scoped-arguments-test.js: Added.
1031         (foo):
1032
1033 2018-03-20  Saam Barati  <sbarati@apple.com>
1034
1035         We need to do proper bookkeeping of exitOK when inserting constants when sinking NewArrayBuffer
1036         https://bugs.webkit.org/show_bug.cgi?id=183795
1037         <rdar://problem/38298694>
1038
1039         Reviewed by JF Bastien.
1040
1041         * stress/sink-phantom-new-array-buffer-exit-ok.js: Added.
1042         (foo):
1043         (bar):
1044
1045 2018-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1046
1047         [DFG][FTL] Add vectorLengthHint for NewArray
1048         https://bugs.webkit.org/show_bug.cgi?id=183694
1049
1050         Reviewed by Saam Barati.
1051
1052         * stress/vector-length-hint-array-constructor.js: Added.
1053         (shouldBe):
1054         (test):
1055         * stress/vector-length-hint-new-array.js: Added.
1056         (shouldBe):
1057         (test):
1058
1059 2018-03-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1060
1061         [DFG][FTL] Make ArraySlice(0) code tight
1062         https://bugs.webkit.org/show_bug.cgi?id=183590
1063
1064         Reviewed by Saam Barati.
1065
1066         * stress/array-slice-with-zero.js: Added.
1067         (shouldBe):
1068         (test):
1069         (test2):
1070         * stress/array-slice-zero-args.js: Added.
1071         (shouldBe):
1072         (test):
1073
1074 2018-03-14  Caitlin Potter  <caitp@igalia.com>
1075
1076         [JSC] fix order of evaluation for ClassDefinitionEvaluation
1077         https://bugs.webkit.org/show_bug.cgi?id=183523
1078
1079         Reviewed by Keith Miller.
1080
1081         Computed property names need to be evaluated in source order during class
1082         definition evaluation, as it's observable (and specified to work this way).
1083
1084         This change improves compatibility with Chromium.
1085
1086         * stress/class_elements.js: Added.
1087         (test):
1088         (test.C.prototype.effect):
1089         (test.C.effect):
1090         (test.C.prototype.get effect):
1091         (test.C.prototype.set effect):
1092         (test.C):
1093
1094 2018-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1095
1096         [DFG] AI should convert CreateThis to NewObject if the prototype object is proved
1097         https://bugs.webkit.org/show_bug.cgi?id=183310
1098
1099         Reviewed by Filip Pizlo.
1100
1101         * stress/ai-create-this-to-new-object-fire.js: Added.
1102         (assert):
1103         (test):
1104         (func):
1105         (check):
1106         (test.body.A):
1107         (test.body.B):
1108         (test.body):
1109         * stress/ai-create-this-to-new-object.js: Added.
1110         (assert):
1111         (test):
1112         (func):
1113         (check):
1114         (test.body.A):
1115         (test.body.B):
1116         (test.body):
1117
1118 2018-03-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1119
1120         [FTL] Drop NewRegexp for String.prototype.match with RegExp + global flag
1121         https://bugs.webkit.org/show_bug.cgi?id=181848
1122
1123         Reviewed by Sam Weinig.
1124
1125         * microbenchmarks/regexp-u-global-es5.js: Added.
1126         (fn):
1127         * microbenchmarks/regexp-u-global-es6.js: Added.
1128         (fn):
1129         * stress/materialized-regexp-has-correct-last-index-set-by-match-at-osr-exit.js: Added.
1130         (shouldBe):
1131         (test):
1132         (i.switch):
1133         * stress/materialized-regexp-has-correct-last-index-set-by-match.js: Added.
1134         (shouldBe):
1135         (test):
1136
1137 2018-03-07  Dominik Infuehr  <dinfuehr@igalia.com>
1138
1139         Disable test stress/var-injection-cache-invalidation.js on systems with limited memory
1140         https://bugs.webkit.org/show_bug.cgi?id=183334
1141
1142         Reviewed by Žan Doberšek.
1143
1144         * stress/var-injection-cache-invalidation.js:
1145
1146 2018-03-06  Dominik Infuehr  <dinfuehr@igalia.com>
1147
1148         [ARM] Disable tests that run out of memory
1149         https://bugs.webkit.org/show_bug.cgi?id=182699
1150
1151         Reviewed by Žan Doberšek.
1152
1153         Skip tests that run of of memory. Do not run
1154         modules/module-jit-reachability.js without LLInt to prevent
1155         running out of executable memory.
1156
1157         * modules.yaml:
1158         * modules/module-jit-reachability.js:
1159         * stress/has-own-property-name-cache-string-keys.js:
1160         * stress/has-own-property-name-cache-symbol-keys.js:
1161
1162 2018-03-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1163
1164         ASSERTION FAILED: matchContextualKeyword(m_vm->propertyNames->async)
1165         https://bugs.webkit.org/show_bug.cgi?id=183173
1166
1167         Reviewed by Saam Barati.
1168
1169         * stress/async-arrow-function-in-class-heritage.js: Added.
1170         (testSyntax):
1171         (testSyntaxError):
1172         (SyntaxError):
1173
1174 2018-03-01  Saam Barati  <sbarati@apple.com>
1175
1176         We need to clear cached structures when having a bad time
1177         https://bugs.webkit.org/show_bug.cgi?id=183256
1178         <rdar://problem/36245022>
1179
1180         Reviewed by Mark Lam.
1181
1182         * stress/having-a-bad-time-with-derived-arrays.js: Added.
1183         (assert):
1184         (defineSetter):
1185         (iterate):
1186         (doSlice):
1187
1188 2018-02-28  Yusuke Suzuki  <utatane.tea@gmail.com>
1189
1190         JSC crash with `import("")`
1191         https://bugs.webkit.org/show_bug.cgi?id=183175
1192
1193         Reviewed by Saam Barati.
1194
1195         * stress/import-with-empty-string.js: Added.
1196
1197 2018-02-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1198
1199         Unreviewed, skip FTL tests if FTL is disabled
1200         https://bugs.webkit.org/show_bug.cgi?id=183071
1201
1202         * stress/has-indexed-property-array-storage-ftl.js:
1203         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
1204
1205 2018-02-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1206
1207         [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
1208         https://bugs.webkit.org/show_bug.cgi?id=182965
1209
1210         Reviewed by Saam Barati.
1211
1212         * stress/put-by-val-array-storage.js: Added.
1213         (shouldBe):
1214         (testArrayStorageInBounds):
1215         * stress/put-by-val-direct-out-of-bounds-setter.js: Added.
1216         (shouldBe):
1217         (testInt32.createBuiltin):
1218         (set for):
1219         * stress/put-by-val-slow-put-array-storage.js: Added.
1220         (shouldBe):
1221         (testArrayStorageInBounds):
1222
1223 2018-02-26  Saam Barati  <sbarati@apple.com>
1224
1225         validateStackAccess should not validate if the offset is within the stack bounds
1226         https://bugs.webkit.org/show_bug.cgi?id=183067
1227         <rdar://problem/37749988>
1228
1229         Reviewed by Mark Lam.
1230
1231         * stress/dont-validate-stack-offset-in-b3-because-it-might-be-guarded-by-control-flow.js: Added.
1232         (assert):
1233         (test.a):
1234         (test.b):
1235         (test):
1236
1237 2018-02-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1238
1239         Unreviewed, skip FTL tests if FTL is disabled
1240         https://bugs.webkit.org/show_bug.cgi?id=183071
1241
1242         * stress/has-indexed-property-array-storage-ftl.js:
1243         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
1244
1245 2018-02-23  Saam Barati  <sbarati@apple.com>
1246
1247         Make Number.isInteger an intrinsic
1248         https://bugs.webkit.org/show_bug.cgi?id=183088
1249
1250         Reviewed by JF Bastien.
1251
1252         * stress/number-is-integer-intrinsic.js: Added.
1253
1254 2018-02-23  Oleksandr Skachkov  <gskachkov@gmail.com>
1255
1256         WebAssembly: cache memory address / size on instance
1257         https://bugs.webkit.org/show_bug.cgi?id=177305
1258
1259         Reviewed by JF Bastien.
1260
1261         * wasm/function-tests/memory-reuse.js: Added.
1262         (createWasmInstance):
1263         (doCheckTrap):
1264         (doMemoryGrow):
1265         (doCheck):
1266         (checkWasmInstancesWithSharedMemory):
1267
1268 2018-02-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1269
1270         [JSC] Implement $vm.ftlTrue function for FTL testing
1271         https://bugs.webkit.org/show_bug.cgi?id=183071
1272
1273         Reviewed by Mark Lam.
1274
1275         * stress/dead-fiat-value-to-int52-then-exit-not-double.js:
1276         (foo):
1277         * stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
1278         (foo):
1279         * stress/dead-fiat-value-to-int52.js:
1280         (foo):
1281         * stress/dead-osr-entry-value.js:
1282         (foo):
1283         * stress/fiat-value-to-int52-then-exit-not-double.js:
1284         (foo):
1285         * stress/fiat-value-to-int52-then-exit-not-int52.js:
1286         (foo):
1287         * stress/fiat-value-to-int52-then-fail-to-fold.js:
1288         (foo):
1289         * stress/fiat-value-to-int52-then-fold.js:
1290         (foo):
1291         * stress/fiat-value-to-int52.js:
1292         (foo):
1293         * stress/fold-based-on-int32-proof-mul-branch.js:
1294         (foo):
1295         * stress/fold-profiled-call-to-call.js:
1296         (foo):
1297         * stress/fold-to-double-constant-then-exit.js:
1298         (foo):
1299         * stress/fold-to-int52-constant-then-exit.js:
1300         (foo):
1301         * stress/fold-to-primitive-in-cfa.js:
1302         (foo):
1303         * stress/fold-to-primitive-to-identity-in-cfa.js:
1304         (foo):
1305         * stress/has-indexed-property-array-storage-ftl.js: Added.
1306         (shouldBe):
1307         (test1):
1308         (test2):
1309         * stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
1310         (shouldBe):
1311         (test1):
1312         (test2):
1313         * stress/int52-ai-add-then-filter-int32.js:
1314         (foo):
1315         * stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
1316         (foo):
1317         * stress/int52-ai-mul-then-filter-int32.js:
1318         (foo):
1319         * stress/int52-ai-neg-then-filter-int32.js:
1320         (foo):
1321         * stress/int52-ai-sub-then-filter-int32.js:
1322         (foo):
1323         * stress/licm-pre-header-cannot-exit-nested.js:
1324         (foo):
1325         * stress/licm-pre-header-cannot-exit.js:
1326         (foo):
1327         * stress/sparse-array-entry-update-144067.js:
1328         (useMemoryToTriggerGCs):
1329         * stress/test-spec-misc.js:
1330         (foo):
1331         * stress/tricky-array-bounds-checks.js:
1332         (foo):
1333
1334 2018-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1335
1336         [FTL] Support HasIndexedProperty for ArrayStorage and SlowPutArrayStorage
1337         https://bugs.webkit.org/show_bug.cgi?id=182792
1338
1339         Reviewed by Mark Lam.
1340
1341         * stress/has-indexed-property-array-storage.js: Added.
1342         (shouldBe):
1343         (test1):
1344         (test2):
1345         * stress/has-indexed-property-slow-put-array-storage.js: Added.
1346         (shouldBe):
1347         (test1):
1348         (test2):
1349
1350 2018-02-20  Saam Barati  <sbarati@apple.com>
1351
1352         DFG::VarargsForwardingPhase should eliminate getting argument length
1353         https://bugs.webkit.org/show_bug.cgi?id=182959
1354
1355         Reviewed by Keith Miller.
1356
1357         * microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js: Added.
1358
1359 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1360
1361         [FTL] Support ArrayPush for ArrayStorage
1362         https://bugs.webkit.org/show_bug.cgi?id=182782
1363
1364         Reviewed by Saam Barati.
1365
1366         Existing array-push-multiple-storage.js covers ArrayPush(ArrayStorage) multiple arguments case.
1367
1368         * stress/array-push-array-storage-beyond-int32.js: Added.
1369         (shouldBe):
1370         (test):
1371         * stress/array-push-array-storage.js: Added.
1372         (shouldBe):
1373         (test):
1374         * stress/array-push-multiple-array-storage-beyond-int32.js: Added.
1375         (shouldBe):
1376         (test):
1377         * stress/array-push-multiple-storage-continuous.js: Added.
1378         (shouldBe):
1379         (test):
1380
1381 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1382
1383         [FTL] Support ArrayPop for ArrayStorage
1384         https://bugs.webkit.org/show_bug.cgi?id=182783
1385
1386         Reviewed by Saam Barati.
1387
1388         * stress/array-pop-array-storage.js: Added.
1389         (shouldBe):
1390         (test):
1391
1392 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1393
1394         [FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
1395         https://bugs.webkit.org/show_bug.cgi?id=182731
1396
1397         Reviewed by Saam Barati.
1398
1399         * stress/arrayify-array-storage-array.js: Added.
1400         (shouldBe):
1401         (testArrayStorage):
1402         * stress/arrayify-array-storage-non-array.js: Added.
1403         (shouldBe):
1404         (testArrayStorage):
1405         * stress/arrayify-array-storage.js: Added.
1406         (shouldBe):
1407         (testArrayStorage):
1408         * stress/arrayify-slow-put-array-storage-pass-array-storage.js: Added.
1409         (shouldBe):
1410         (testArrayStorage):
1411         * stress/arrayify-slow-put-array-storage.js: Added.
1412         (shouldBe):
1413         (testArrayStorage):
1414
1415 2018-02-19  Saam Barati  <sbarati@apple.com>
1416
1417         Don't use JSFunction's allocation profile when getting the prototype can be effectful
1418         https://bugs.webkit.org/show_bug.cgi?id=182942
1419         <rdar://problem/37584764>
1420
1421         Reviewed by Mark Lam.
1422
1423         * stress/get-prototype-create-this-effectful.js: Added.
1424
1425 2018-02-16  Saam Barati  <sbarati@apple.com>
1426
1427         Fix bugs from r228411
1428         https://bugs.webkit.org/show_bug.cgi?id=182851
1429         <rdar://problem/37577732>
1430
1431         Reviewed by JF Bastien.
1432
1433         * stress/constant-folding-phase-insert-check-handle-varargs.js: Added.
1434
1435 2018-02-15  Filip Pizlo  <fpizlo@apple.com>
1436
1437         Unreviewed, roll out r228366 since it did not progress anything.
1438
1439         * stress/gc-error-stack.js: Removed.
1440         * stress/no-gc-error-stack.js: Removed.
1441
1442 2018-02-15  Tomas Popela  <tpopela@redhat.com>
1443
1444         Many stress tests fail with JIT disabled
1445         https://bugs.webkit.org/show_bug.cgi?id=182730
1446
1447         Reviewed by Saam Barati.
1448
1449         These tests are broken by design if the JIT is disabled - they test
1450         the return value of numberOfDFGCompiles(), which is always set to
1451         1000000.0 in TestRunnerUtils.cpp and makes the tests to fail.
1452
1453         * stress/arith-abs-on-various-types.js:
1454         * stress/arith-abs-to-arith-negate-range-optimizaton.js:
1455         * stress/arith-acos-on-various-types.js:
1456         * stress/arith-acosh-on-various-types.js:
1457         * stress/arith-asin-on-various-types.js:
1458         * stress/arith-asinh-on-various-types.js:
1459         * stress/arith-atan-on-various-types.js:
1460         * stress/arith-atanh-on-various-types.js:
1461         * stress/arith-cbrt-on-various-types.js:
1462         * stress/arith-ceil-on-various-types.js:
1463         * stress/arith-clz32-on-various-types.js:
1464         * stress/arith-cos-on-various-types.js:
1465         * stress/arith-cosh-on-various-types.js:
1466         * stress/arith-expm1-on-various-types.js:
1467         * stress/arith-floor-on-various-types.js:
1468         * stress/arith-fround-on-various-types.js:
1469         * stress/arith-log-on-various-types.js:
1470         * stress/arith-log10-on-various-types.js:
1471         * stress/arith-log2-on-various-types.js:
1472         * stress/arith-negate-on-various-types.js:
1473         * stress/arith-round-on-various-types.js:
1474         * stress/arith-sin-on-various-types.js:
1475         * stress/arith-sinh-on-various-types.js:
1476         * stress/arith-sqrt-on-various-types.js:
1477         * stress/arith-tan-on-various-types.js:
1478         * stress/arith-tanh-on-various-types.js:
1479         * stress/arith-trunc-on-various-types.js:
1480         * stress/compare-strict-eq-on-various-types.js:
1481
1482 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
1483
1484         Skip stress/new-largeish-contiguous-array-with-size.js on arm.
1485
1486         Unreviewed test gardening.
1487
1488         * stress/new-largeish-contiguous-array-with-size.js:
1489
1490 2018-02-14  Saam Barati  <sbarati@apple.com>
1491
1492         Setting a VMTrap shouldn't look at topCallFrame since that may imply we're in C code and holding the malloc lock
1493         https://bugs.webkit.org/show_bug.cgi?id=182801
1494
1495         Reviewed by Keith Miller.
1496
1497         * stress/watchdog-dont-malloc-when-in-c-code.js: Added.
1498
1499 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
1500
1501         Skip JSC test stress/activation-sink-default-value-tdz-error.js on debug.
1502         https://bugs.webkit.org/show_bug.cgi?id=182526
1503
1504         Unreviewed test gardening.
1505
1506         * stress/activation-sink-default-value-tdz-error.js:
1507
1508 2018-02-13  Saam Barati  <sbarati@apple.com>
1509
1510         putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
1511         https://bugs.webkit.org/show_bug.cgi?id=182755
1512         <rdar://problem/37080864>
1513
1514         Reviewed by Keith Miller.
1515
1516         * stress/always-enter-dictionary-indexing-mode-with-getter.js: Added.
1517         (test1.o.get 10005):
1518         (test1):
1519         (test2.o.get 1000):
1520         (test2):
1521
1522 2018-02-13  Caitlin Potter  <caitp@igalia.com>
1523
1524         [JSC] cache TaggedTemplate arrays by callsite rather than by contents
1525         https://bugs.webkit.org/show_bug.cgi?id=182717
1526
1527         Reviewed by Yusuke Suzuki.
1528
1529         https://github.com/tc39/ecma262/pull/890 imposes a change to template
1530         literals, to allow template callsite arrays to be collected when the
1531         code containing the tagged template call is collected. This spec change
1532         has received concensus and been ratified.
1533
1534         This change eliminates the eternal map associating template contents
1535         with arrays.
1536
1537         * stress/tagged-template-object-collect.js: Renamed from JSTests/stress/tagged-template-registry-key-collect.js.
1538         * stress/tagged-template-object.js: Renamed from JSTests/stress/tagged-template-registry-key.js.
1539         * stress/tagged-templates-identity.js:
1540         * stress/template-string-tags-eval.js:
1541         * test262.yaml:
1542
1543 2018-02-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1544
1545         Support GetArrayLength on ArrayStorage in the FTL
1546         https://bugs.webkit.org/show_bug.cgi?id=182625
1547
1548         Reviewed by Saam Barati.
1549
1550         * stress/array-storage-length.js: Added.
1551         (shouldBe):
1552         (testInBound):
1553         (testUncountable):
1554         (testSlowPutInBound):
1555         (testSlowPutUncountable):
1556         * stress/undecided-length.js: Added.
1557         (shouldBe):
1558         (test2):
1559
1560 2018-02-12  Saam Barati  <sbarati@apple.com>
1561
1562         DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
1563         https://bugs.webkit.org/show_bug.cgi?id=182706
1564         <rdar://problem/36833681>
1565
1566         Reviewed by Filip Pizlo.
1567
1568         * stress/get-array-length-phantom-new-array-buffer.js: Added.
1569         (effects):
1570         (foo):
1571
1572 2018-02-09  Filip Pizlo  <fpizlo@apple.com>
1573
1574         Don't waste memory for error.stack
1575         https://bugs.webkit.org/show_bug.cgi?id=182656
1576
1577         Reviewed by Saam Barati.
1578
1579         Tests the policy.
1580
1581         * stress/gc-error-stack.js: Added. Shows that the GC forgets frames now.
1582         * stress/no-gc-error-stack.js: Added. Shows that the GC won't forget things if you ask for the stack.
1583
1584 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1585
1586         [JSC] Update Test262 to Feb 9 version
1587         https://bugs.webkit.org/show_bug.cgi?id=182468
1588
1589         Reviewed by Saam Barati.
1590
1591 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1592
1593         Unreviewed, fix invalid line terminator in old test262 file part 2
1594         https://bugs.webkit.org/show_bug.cgi?id=182468
1595
1596         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1597
1598 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1599
1600         Unreviewed, fix invalid line terminator in old test262 file
1601         https://bugs.webkit.org/show_bug.cgi?id=182468
1602
1603         * test262/test/language/literals/regexp/7.8.5-1.js:
1604
1605 2018-02-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1606
1607         [JSC] Implement Array.prototype.flatMap and Array.prototype.flatten
1608         https://bugs.webkit.org/show_bug.cgi?id=182440
1609
1610         Reviewed by Darin Adler.
1611
1612         * stress/array-flatmap.js: Added.
1613         (shouldBe):
1614         (shouldBeArray):
1615         (shouldThrow):
1616         (var):
1617         * stress/array-flatten.js: Added.
1618         (shouldBe):
1619         (shouldBeArray):
1620         * test262.yaml:
1621         * test262/test/built-ins/Array/prototype/flatMap/depth-always-one.js:
1622         (3.flatMap):
1623         Pick test262 82c6148980332febe92a544a1fb653718e9fdb57 change.
1624
1625 2018-02-06  Keith Miller  <keith_miller@apple.com>
1626
1627         put_to_scope/get_from_scope should not cache lexical scopes when expecting a global object
1628         https://bugs.webkit.org/show_bug.cgi?id=182549
1629         <rdar://problem/36189995>
1630
1631         Reviewed by Saam Barati.
1632
1633         * stress/var-injection-cache-invalidation.js: Added.
1634         (allocateLotsOfThings):
1635         (test):
1636
1637 2018-02-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1638
1639         Unreviewed, follow up for test262 update
1640         https://bugs.webkit.org/show_bug.cgi?id=182288
1641
1642         * test262.yaml:
1643
1644 2018-02-02  Ryan Haddad  <ryanhaddad@apple.com>
1645
1646         Update test262 to Jan 30 version
1647         https://bugs.webkit.org/show_bug.cgi?id=182288
1648
1649         Unreviewed test gardening.
1650
1651         * test262.yaml: Remove entry for missing test language/expressions/assignment/white-space.js
1652
1653 2018-02-02  Saam Barati  <sbarati@apple.com>
1654
1655         When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
1656         https://bugs.webkit.org/show_bug.cgi?id=182368
1657         <rdar://problem/36932466>
1658
1659         Reviewed by Mark Lam.
1660
1661         * stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js: Added.
1662         (runNearStackLimit.t):
1663         (runNearStackLimit):
1664         (try.runNearStackLimit):
1665         (catch):
1666
1667 2018-02-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1668
1669         Update test262 to Jan 30 version
1670         https://bugs.webkit.org/show_bug.cgi?id=182288
1671
1672         Rubber stamped by Saam Barati.
1673
1674         This patch updates test262 to the latest one, Jan 30 version.
1675         Since added and changed files are too many, we cannot create ChangeLog.
1676         The following files are changed.
1677
1678         Several files are intentionally omitted due to merge failures. We should investigate how to merge files
1679         including some special line terminators (like u2028, u2029).
1680
1681         * test262.yaml:
1682         * test262/test262-Revision.txt:
1683         * test262/*:
1684
1685 2018-02-02  Guillaume Emont  <guijemont@igalia.com>
1686
1687         JSTests: Skip mozilla/js1_5/Array/regress-157652.js on all memory limited platforms
1688         https://bugs.webkit.org/show_bug.cgi?id=182411
1689
1690         Reviewed by Carlos Alberto Lopez Perez.
1691
1692         This is skipped only on arm memory limited platforms. Until recently
1693         it was not a problem on MIPS as the butterfly was not initialized. But
1694         since r227435, the butterfly is initialized in that test and therefore
1695         memory is allocated, and the test typically takes around 512M, which
1696         means it generally gets OOM-killed on the MIPS buildbot.
1697
1698         * mozilla/mozilla-tests.yaml:
1699
1700 2018-02-01  Mark Lam  <mark.lam@apple.com>
1701
1702         Fix broken bounds check in FTL's compileGetMyArgumentByVal().
1703         https://bugs.webkit.org/show_bug.cgi?id=182419
1704         <rdar://problem/37044945>
1705
1706         Reviewed by Saam Barati.
1707
1708         * stress/regress-182419.js: Added.
1709
1710 2018-02-01  Keith Miller  <keith_miller@apple.com>
1711
1712         Fix crashes due to mishandling custom sections.
1713         https://bugs.webkit.org/show_bug.cgi?id=182404
1714         <rdar://problem/36935863>
1715
1716         Reviewed by Saam Barati.
1717
1718         * wasm/Builder.js:
1719         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
1720         * wasm/js-api/validate.js:
1721         (assert.truthy):
1722
1723 2018-01-31  Saam Barati  <sbarati@apple.com>
1724
1725         JSC incorrectly interpreting script, sets Global Property instead of Global Lexical variable (LiteralParser / JSONP path)
1726         https://bugs.webkit.org/show_bug.cgi?id=182074
1727         <rdar://problem/36846261>
1728
1729         Reviewed by Mark Lam.
1730
1731         * stress/jsonp-program-evaluate-path-must-consider-global-lexical-environment.js: Added.
1732         (assert):
1733         (let.func):
1734         (let.o.foo):
1735         (varFunc):
1736
1737 2018-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1738
1739         Unreviewed, update test262 expects
1740         https://bugs.webkit.org/show_bug.cgi?id=182232
1741
1742         * test262.yaml:
1743
1744 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1745
1746         [JSC] Implement trimStart and trimEnd
1747         https://bugs.webkit.org/show_bug.cgi?id=182233
1748
1749         Reviewed by Mark Lam.
1750
1751         * stress/trim.js: Added.
1752         (shouldBe):
1753         (startTest):
1754         (endTest):
1755         (trimTest):
1756
1757 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1758
1759         [JSC] Relax line terminators in String to make JSON subset of JS
1760         https://bugs.webkit.org/show_bug.cgi?id=182232
1761
1762         Reviewed by Keith Miller.
1763
1764         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
1765         * stress/relaxed-line-terminators-in-string.js: Added.
1766         (shouldBe):
1767
1768 2018-01-29  Michael Saboff  <msaboff@apple.com>
1769
1770         REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
1771         https://bugs.webkit.org/show_bug.cgi?id=182249
1772
1773         Reviewed by Keith Miller.
1774
1775         New regression test.
1776
1777         * stress/compare-clobber-untypeduse.js: Added.
1778
1779 2018-01-29  Matt Lewis  <jlewis3@apple.com>
1780
1781         Unreviewed, rolling out r227725.
1782
1783         This caused internal failures.
1784
1785         Reverted changeset:
1786
1787         "JSC Sampling Profiler: Detect tester and testee when sampling
1788         in RegExp JIT"
1789         https://bugs.webkit.org/show_bug.cgi?id=152729
1790         https://trac.webkit.org/changeset/227725
1791
1792 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1793
1794         JSC Sampling Profiler: Detect tester and testee when sampling in RegExp JIT
1795         https://bugs.webkit.org/show_bug.cgi?id=152729
1796
1797         Reviewed by Saam Barati.
1798
1799         * stress/sampling-profiler-regexp.js: Added.
1800         (platformSupportsSamplingProfiler.test):
1801         (platformSupportsSamplingProfiler.baz):
1802         (platformSupportsSamplingProfiler):
1803
1804 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1805
1806         [DFG][FTL] WeakMap#set should have DFG node
1807         https://bugs.webkit.org/show_bug.cgi?id=180015
1808
1809         Reviewed by Saam Barati.
1810
1811         * stress/weakmap-set-change-get.js: Added.
1812         (shouldBe):
1813         (test):
1814         * stress/weakmap-set-cse.js: Added.
1815         (shouldBe):
1816         (test):
1817         * stress/weakset-add-change-get.js: Added.
1818         (shouldBe):
1819         * stress/weakset-add-cse.js: Added.
1820         (shouldBe):
1821
1822 2018-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1823
1824         DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
1825         https://bugs.webkit.org/show_bug.cgi?id=182213
1826
1827         Reviewed by Mark Lam.
1828
1829         * stress/int32-min-to-string.js: Added.
1830         (shouldBe):
1831         (test2):
1832         (test4):
1833         (test8):
1834         (test16):
1835         (test32):
1836         * stress/zero-to-string.js: Added.
1837         (shouldBe):
1838         (test2):
1839         (test4):
1840         (test8):
1841         (test16):
1842         (test32):
1843
1844 2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1845
1846         Add more module scope related tests with code evaluation by string
1847         https://bugs.webkit.org/show_bug.cgi?id=181983
1848
1849         Reviewed by Sam Weinig.
1850
1851         Add more module scope related tests. When the original tests are landed,
1852         we do not have browser integration. This patch adds more module scope tests
1853         with dynamically created script evaluation. We add tests with Function
1854         constructor, direct eval, indirect eval, setTimeout, setInterval, and event handlers.
1855
1856         * modules/scopes-eval.js: Added.
1857         (shouldBe):
1858         * modules/scopes.js:
1859         (shouldBe):
1860
1861 2018-01-23  Filip Pizlo  <fpizlo@apple.com>
1862
1863         Unreviewed, retire some microbenchmarks that are proportionately very slow. Benchmark running time should be proportional to their value. Microbenchmarks have little value, so they should be very fast.
1864
1865         * microbenchmarks/array-push-3.js: Removed.
1866         * microbenchmarks/bigswitch-indirect-symbol-or-undefined.js: Removed.
1867         * microbenchmarks/double-to-int32.js: Removed.
1868         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Removed.
1869         * microbenchmarks/ftl-polymorphic-bitand.js: Removed.
1870         * microbenchmarks/ftl-polymorphic-bitor.js: Removed.
1871         * microbenchmarks/ftl-polymorphic-bitxor.js: Removed.
1872         * microbenchmarks/ftl-polymorphic-lshift.js: Removed.
1873         * microbenchmarks/ftl-polymorphic-rshift.js: Removed.
1874         * microbenchmarks/ftl-polymorphic-sub.js: Removed.
1875         * microbenchmarks/ftl-polymorphic-urshift.js: Removed.
1876         * microbenchmarks/map-constant-key.js: Removed.
1877         * microbenchmarks/nested-function-parsing.js: Removed.
1878         * microbenchmarks/rest-parameter-allocation-elimination.js: Removed.
1879         * microbenchmarks/spread-large-array.js: Removed.
1880         * microbenchmarks/string-add-constant-folding.js: Removed.
1881         * microbenchmarks/to-lower-case.js: Removed.
1882         * microbenchmarks/undefined-property-access.js: Removed.
1883         * slowMicrobenchmarks/array-push-3.js: Copied from JSTests/microbenchmarks/array-push-3.js.
1884         * slowMicrobenchmarks/bigswitch-indirect-symbol-or-undefined.js: Copied from JSTests/microbenchmarks/bigswitch-indirect-symbol-or-undefined.js.
1885         * slowMicrobenchmarks/double-to-int32.js: Copied from JSTests/microbenchmarks/double-to-int32.js.
1886         * slowMicrobenchmarks/fake-iterators-that-throw-when-finished.js: Copied from JSTests/microbenchmarks/fake-iterators-that-throw-when-finished.js.
1887         * slowMicrobenchmarks/ftl-polymorphic-bitand.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitand.js.
1888         * slowMicrobenchmarks/ftl-polymorphic-bitor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitor.js.
1889         * slowMicrobenchmarks/ftl-polymorphic-bitxor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitxor.js.
1890         * slowMicrobenchmarks/ftl-polymorphic-lshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-lshift.js.
1891         * slowMicrobenchmarks/ftl-polymorphic-rshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-rshift.js.
1892         * slowMicrobenchmarks/ftl-polymorphic-sub.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-sub.js.
1893         * slowMicrobenchmarks/ftl-polymorphic-urshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-urshift.js.
1894         * slowMicrobenchmarks/map-constant-key.js: Copied from JSTests/microbenchmarks/map-constant-key.js.
1895         * slowMicrobenchmarks/nested-function-parsing.js: Copied from JSTests/microbenchmarks/nested-function-parsing.js.
1896         * slowMicrobenchmarks/rest-parameter-allocation-elimination.js: Copied from JSTests/microbenchmarks/rest-parameter-allocation-elimination.js.
1897         * slowMicrobenchmarks/spread-large-array.js: Copied from JSTests/microbenchmarks/spread-large-array.js.
1898         * slowMicrobenchmarks/string-add-constant-folding.js: Copied from JSTests/microbenchmarks/string-add-constant-folding.js.
1899         * slowMicrobenchmarks/to-lower-case.js: Copied from JSTests/microbenchmarks/to-lower-case.js.
1900         * slowMicrobenchmarks/undefined-property-access.js: Copied from JSTests/microbenchmarks/undefined-property-access.js.
1901
1902 2018-01-23  Robin Morisset  <rmorisset@apple.com>
1903
1904         Update the argument count in DFGByteCodeParser::handleRecursiveCall
1905         https://bugs.webkit.org/show_bug.cgi?id=181739
1906         <rdar://problem/36627662>
1907
1908         Reviewed by Saam Barati.
1909
1910         * stress/recursive-tail-call-with-different-argument-count.js: Added.
1911         (foo):
1912         (bar):
1913
1914 2018-01-22  Michael Saboff  <msaboff@apple.com>
1915
1916         DFG abstract interpreter needs to properly model effects of some Math ops
1917         https://bugs.webkit.org/show_bug.cgi?id=181886
1918
1919         Reviewed by Saam Barati.
1920
1921         New regression test.
1922
1923         * stress/arith-nodes-abstract-interpreter-untypeduse.js: Added.
1924         (test):
1925
1926 2018-01-20  Caio Lima  <ticaiolima@gmail.com>
1927
1928         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
1929         https://bugs.webkit.org/show_bug.cgi?id=181182
1930
1931         Reviewed by Darin Adler.
1932
1933         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
1934         * stress/big-int-prototype-to-string-exception.js: Added.
1935         * stress/big-int-prototype-to-string-wrong-values.js: Added.
1936         * stress/number-prototype-to-string-cast-overflow.js: Added.
1937         * stress/number-prototype-to-string-exception.js: Added.
1938         * stress/number-prototype-to-string-wrong-values.js: Added.
1939
1940 2018-01-19  Ryan Haddad  <ryanhaddad@apple.com>
1941
1942         Disable Atomics when SharedArrayBuffer isn’t enabled
1943         https://bugs.webkit.org/show_bug.cgi?id=181572
1944
1945         Unreviewed test gardening.
1946
1947         * test262.yaml: Skip tests that fail after this change.
1948
1949 2018-01-19  Saam Barati  <sbarati@apple.com>
1950
1951         Kill ArithNegate's ArithProfile assert inside BytecodeParser
1952         https://bugs.webkit.org/show_bug.cgi?id=181877
1953         <rdar://problem/36630552>
1954
1955         Reviewed by Mark Lam.
1956
1957         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js: Added.
1958         (runNearStackLimit):
1959         (f1):
1960         (f2):
1961         (f3):
1962         (i.catch):
1963         (i.try.runNearStackLimit):
1964         (catch):
1965
1966 2018-01-19  Saam Barati  <sbarati@apple.com>
1967
1968         Spread's effects are modeled incorrectly both in AI and in Clobberize
1969         https://bugs.webkit.org/show_bug.cgi?id=181867
1970         <rdar://problem/36290415>
1971
1972         Reviewed by Michael Saboff.
1973
1974         * stress/ai-needs-to-model-spreads-effects.js: Added.
1975         (try.p.Symbol.iterator):
1976         (try.go):
1977         (catch):
1978         * stress/clobberize-needs-to-model-spread-effects.js: Added.
1979         (assert):
1980         (foo):
1981         (a.Symbol.iterator):
1982
1983 2018-01-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1984
1985         Unreviewed, reduce count of iteration to fix timing out debug JSC test
1986         https://bugs.webkit.org/show_bug.cgi?id=181535
1987
1988         * stress/inserted-recovery-with-set-last-index.js:
1989
1990 2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1991
1992         [DFG][FTL] Introduce PhantomNewRegexp and RegExpExecNonGlobalOrSticky
1993         https://bugs.webkit.org/show_bug.cgi?id=181535
1994
1995         Reviewed by Saam Barati.
1996
1997         * stress/inserted-recovery-with-set-last-index.js: Added.
1998         (shouldBe):
1999         (foo):
2000         * stress/materialize-regexp-at-osr-exit.js: Added.
2001         (shouldBe):
2002         (test):
2003         * stress/materialize-regexp-cyclic-regexp-at-osr-exit.js: Added.
2004         (shouldBe):
2005         (test):
2006         * stress/materialize-regexp-cyclic-regexp.js: Added.
2007         (shouldBe):
2008         (test):
2009         (i.switch):
2010         * stress/materialize-regexp-cyclic.js: Added.
2011         (shouldBe):
2012         (test):
2013         (i.switch):
2014         * stress/materialize-regexp-referenced-from-phantom-regexp-cyclic.js: Added.
2015         (bar):
2016         (foo):
2017         (test):
2018         * stress/materialize-regexp-referenced-from-phantom-regexp.js: Added.
2019         (bar):
2020         (foo):
2021         (test):
2022         * stress/materialize-regexp.js: Added.
2023         (shouldBe):
2024         (test):
2025         * stress/phantom-regexp-regexp-exec.js: Added.
2026         (shouldBe):
2027         (test):
2028         * stress/phantom-regexp-string-match.js: Added.
2029         (shouldBe):
2030         (test):
2031         * stress/regexp-last-index-sinking.js: Added.
2032         (shouldBe):
2033         (test):
2034
2035 2018-01-17  Saam Barati  <sbarati@apple.com>
2036
2037         Disable Atomics when SharedArrayBuffer isn’t enabled
2038         https://bugs.webkit.org/show_bug.cgi?id=181572
2039         <rdar://problem/36553206>
2040
2041         Reviewed by Michael Saboff.
2042
2043         * stress/isLockFree.js:
2044
2045 2018-01-17  Saam Barati  <sbarati@apple.com>
2046
2047         DFG::Node::convertToConstant needs to clear the varargs flags
2048         https://bugs.webkit.org/show_bug.cgi?id=181697
2049         <rdar://problem/36497332>
2050
2051         Reviewed by Yusuke Suzuki.
2052
2053         * stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
2054         (doIndexOf):
2055         (bar):
2056         (i.bar):
2057
2058 2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>
2059
2060         Unreviewed, rolling out r226937.
2061
2062         Tests added with this change are failing due to a missing
2063         exception check.
2064
2065         Reverted changeset:
2066
2067         "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
2068         double to int32_t"
2069         https://bugs.webkit.org/show_bug.cgi?id=181182
2070         https://trac.webkit.org/changeset/226937
2071
2072 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
2073
2074         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
2075         https://bugs.webkit.org/show_bug.cgi?id=181182
2076
2077         Reviewed by Darin Adler.
2078
2079         * bigIntTests.yaml:
2080         * stress/big-int-constructor.js:
2081         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
2082         (assert):
2083         (assertThrowRangeError):
2084         * stress/number-prototype-to-string-cast-overflow.js: Added.
2085         (assert):
2086         (assertThrowRangeError):
2087
2088 2018-01-12  Saam Barati  <sbarati@apple.com>
2089
2090         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
2091         https://bugs.webkit.org/show_bug.cgi?id=181177
2092         <rdar://problem/36205704>
2093
2094         Reviewed by Yusuke Suzuki.
2095
2096         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
2097         (runNearStackLimit.t):
2098         (runNearStackLimit):
2099         (test.f):
2100         (test):
2101
2102 2018-01-12  Saam Barati  <sbarati@apple.com>
2103
2104         Each variant of a polymorphic inlined call should be exitOK at the top of the block
2105         https://bugs.webkit.org/show_bug.cgi?id=181562
2106         <rdar://problem/36445624>
2107
2108         Reviewed by Yusuke Suzuki.
2109
2110         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
2111         (f):
2112         (foo):
2113
2114 2018-01-11  Saam Barati  <sbarati@apple.com>
2115
2116         When inserting Unreachable in byte code parser we need to flush all the right things
2117         https://bugs.webkit.org/show_bug.cgi?id=181509
2118         <rdar://problem/36423110>
2119
2120         Reviewed by Mark Lam.
2121
2122         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
2123
2124 2018-01-11  Saam Barati  <sbarati@apple.com>
2125
2126         JITMathIC code in the FTL is wrong when code gets duplicated
2127         https://bugs.webkit.org/show_bug.cgi?id=181525
2128         <rdar://problem/36351993>
2129
2130         Reviewed by Michael Saboff and Keith Miller.
2131
2132         * stress/allow-math-ic-b3-code-duplication.js: Added.
2133
2134 2018-01-11  Saam Barati  <sbarati@apple.com>
2135
2136         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
2137         https://bugs.webkit.org/show_bug.cgi?id=181508
2138
2139         Reviewed by Yusuke Suzuki.
2140
2141         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
2142         (assert):
2143         (test1.foo):
2144         (test1):
2145         (test2.foo):
2146         (test2):
2147
2148 2018-01-09  Mark Lam  <mark.lam@apple.com>
2149
2150         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
2151         https://bugs.webkit.org/show_bug.cgi?id=181388
2152         <rdar://problem/36349351>
2153
2154         Reviewed by Saam Barati.
2155
2156         * stress/regress-181388.js: Added.
2157
2158 2018-01-08  JF Bastien  <jfbastien@apple.com>
2159
2160         WebAssembly: mask indexed accesses to Table
2161         https://bugs.webkit.org/show_bug.cgi?id=181412
2162         <rdar://problem/36363236>
2163
2164         Reviewed by Saam Barati.
2165
2166         Update error messages.
2167
2168         * wasm/js-api/table.js:
2169         (assert.throws.WebAssembly.Table.prototype.grow):
2170
2171 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
2172
2173         Disable SharedArrayBuffer tests missed in r226386.
2174         https://bugs.webkit.org/show_bug.cgi?id=181266
2175
2176         Unreviewed test gardening.
2177
2178         * test262.yaml:
2179
2180 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2181
2182         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
2183         https://bugs.webkit.org/show_bug.cgi?id=181321
2184
2185         Reviewed by Saam Barati.
2186
2187         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
2188         (shouldBe):
2189         (testFunction):
2190         * test262.yaml:
2191
2192 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
2193
2194         Unreviewed, attempt to fix test262 after r226386.
2195
2196         * test262.yaml:
2197
2198 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2199
2200         [DFG] Define defs for MapSet/SetAdd to participate in CSE
2201         https://bugs.webkit.org/show_bug.cgi?id=179911
2202
2203         Reviewed by Saam Barati.
2204
2205         In addition to these tests, map-set-cse.js and set-add-cse.js work.
2206
2207         * stress/map-set-change-get.js: Added.
2208         (shouldBe):
2209         (test):
2210         * stress/map-set-create-bucket.js: Added.
2211         (shouldBe):
2212         (test):
2213         * stress/set-add-create-bucket.js: Added.
2214         (shouldBe):
2215
2216 2018-01-03  Michael Saboff  <msaboff@apple.com>
2217
2218         Disable SharedArrayBuffers from Web API
2219         https://bugs.webkit.org/show_bug.cgi?id=181266
2220
2221         Reviewed by Saam Barati.
2222
2223         Disabled SharedArrayBuffer tests.
2224
2225         * stress/SharedArrayBuffer-opt.js:
2226         * stress/SharedArrayBuffer.js:
2227         * stress/array-buffer-byte-length.js:
2228         * stress/atomics-add-uint32.js:
2229         * stress/atomics-known-int-use.js:
2230         * stress/atomics-neg-zero.js:
2231         * stress/atomics-store-return.js:
2232         * stress/lars-sab-workers.js:
2233         * stress/regress-159779-1.js:
2234         * stress/regress-159779-2.js:
2235         * stress/regress-170473.js:
2236         * test262.yaml:
2237
2238 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
2239
2240         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
2241         https://bugs.webkit.org/show_bug.cgi?id=181258
2242
2243         Reviewed by Antonio Gomes.
2244
2245         * stress/big-int-constructor-gc.js:
2246         * stress/big-int-constructor-oom.js:
2247
2248 2018-01-03  Robin Morisset  <rmorisset@apple.com>
2249
2250         Inlining of a function that ends in op_unreachable crashes
2251         https://bugs.webkit.org/show_bug.cgi?id=181027
2252
2253         Reviewed by Filip Pizlo.
2254
2255         * stress/inlining-unreachable.js: Added.
2256         (bar):
2257         (baz):
2258         (i.catch):
2259
2260 2018-01-02  Saam Barati  <sbarati@apple.com>
2261
2262         Incorrect assertion inside AccessCase
2263         https://bugs.webkit.org/show_bug.cgi?id=181200
2264         <rdar://problem/35494754>
2265
2266         Reviewed by Yusuke Suzuki.
2267
2268         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
2269         (ctor):
2270         (theFunc):
2271         (run):
2272
2273 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
2274
2275         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
2276         https://bugs.webkit.org/show_bug.cgi?id=175359
2277
2278         Reviewed by Yusuke Suzuki.
2279
2280         * bigIntTests.yaml:
2281         * stress/big-int-as-key.js: Added.
2282         * stress/big-int-constructor-gc.js: Added.
2283         * stress/big-int-constructor-oom.js: Added.
2284         * stress/big-int-constructor-properties.js: Added.
2285         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
2286         * stress/big-int-constructor-prototype.js: Added.
2287         * stress/big-int-constructor.js: Added.
2288         * stress/big-int-function-apply.js:
2289         * stress/big-int-length.js: Added.
2290         * stress/big-int-prop-descriptor.js: Added.
2291         * stress/big-int-proto-constructor.js: Added.
2292         * stress/big-int-proto-name.js: Added.
2293         * stress/big-int-prototype-properties.js: Added.
2294         * stress/big-int-prototype-proto.js: Added.
2295         * stress/big-int-prototype-value-of.js: Added.
2296         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
2297         * stress/big-int-prototype-to-string-apply.js: Added.
2298         * stress/big-int-to-object.js: Added.
2299         * stress/big-int-to-string.js: Added.
2300
2301 2017-12-28  Saam Barati  <sbarati@apple.com>
2302
2303         Assertion used to determine if something is an async generator is wrong
2304         https://bugs.webkit.org/show_bug.cgi?id=181168
2305         <rdar://problem/35640560>
2306
2307         Reviewed by Yusuke Suzuki.
2308
2309         * stress/async-generator-assertion.js: Added.
2310
2311 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
2312
2313         Skip stress/splay-flash-access tests on memory limited platforms
2314         https://bugs.webkit.org/show_bug.cgi?id=181086
2315
2316         Reviewed by Carlos Alberto Lopez Perez.
2317
2318         These tests use about 185M of memory, and occasionally get OOM-killed
2319         on memory limited platforms.
2320
2321         * stress/splay-flash-access-1ms.js:
2322         * stress/splay-flash-access.js:
2323
2324 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
2325
2326         Skip slow jsc tests on embedded platforms
2327         https://bugs.webkit.org/show_bug.cgi?id=180937
2328
2329         Reviewed by Carlos Alberto Lopez Perez.
2330
2331         The tests typeProfiler/deltablue-for-of.js and
2332         typeProfiler/getter-richards.js take a very long time in the
2333         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
2334         thus always timeout. They should be skipped on these platforms.
2335
2336         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
2337         * typeProfiler/getter-richards.js: Skip on arm*/mips.
2338
2339 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2340
2341         [JSC] Do not check isValid() in op_new_regexp
2342         https://bugs.webkit.org/show_bug.cgi?id=180970
2343
2344         Reviewed by Saam Barati.
2345
2346         * stress/regexp-syntax-error-invalid-flags.js: Added.
2347         (shouldThrow):
2348
2349 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
2350
2351         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
2352         https://bugs.webkit.org/show_bug.cgi?id=180712
2353
2354         Reviewed by Michael Catanzaro.
2355
2356         stress/call-apply-exponential-bytecode-size.js crashes if the
2357         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
2358         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
2359         should skip the test on other platforms.
2360
2361         * stress/call-apply-exponential-bytecode-size.js:
2362
2363 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2364
2365         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
2366         https://bugs.webkit.org/show_bug.cgi?id=179762
2367
2368         Reviewed by Saam Barati.
2369
2370         * stress/call-varargs-double-new-array-buffer.js: Added.
2371         (assert):
2372         (bar):
2373         (foo):
2374         * stress/call-varargs-spread-new-array-buffer.js: Added.
2375         (assert):
2376         (bar):
2377         (foo):
2378         * stress/call-varargs-spread-new-array-buffer2.js: Added.
2379         (assert):
2380         (bar):
2381         (foo):
2382         * stress/forward-varargs-double-new-array-buffer.js: Added.
2383         (assert):
2384         (test.baz):
2385         (test.bar):
2386         (test.foo):
2387         (test):
2388         * stress/new-array-buffer-sinking-osrexit.js: Added.
2389         (target):
2390         (test):
2391         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
2392         (shouldBe):
2393         (test):
2394         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
2395         (shouldBe):
2396         (target):
2397         (test):
2398         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
2399         (assert):
2400         (test1.bar):
2401         (test1.foo):
2402         (test1):
2403         (test2.bar):
2404         (test2.foo):
2405         (test3.baz):
2406         (test3.bar):
2407         (test3.foo):
2408         (test4.baz):
2409         (test4.bar):
2410         (test4.foo):
2411         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
2412         (assert):
2413         (test.baz):
2414         (test.bar):
2415         (test.foo):
2416         (test):
2417         * stress/phantom-new-array-buffer-osr-exit.js: Added.
2418         (assert):
2419         (baz):
2420         (bar):
2421         (effects):
2422         (foo):
2423
2424 2017-12-14  Saam Barati  <sbarati@apple.com>
2425
2426         The CleanUp after LICM is erroneously removing a Check
2427         https://bugs.webkit.org/show_bug.cgi?id=180852
2428         <rdar://problem/36063494>
2429
2430         Reviewed by Filip Pizlo.
2431
2432         * stress/dont-run-cleanup-after-licm.js: Added.
2433
2434 2017-12-14  Michael Saboff  <msaboff@apple.com>
2435
2436         REGRESSION (r225695): Repro crash on yahoo login page
2437         https://bugs.webkit.org/show_bug.cgi?id=180761
2438
2439         Reviewed by JF Bastien.
2440
2441         New regression test.
2442
2443         * stress/regress-180761.js: Added.
2444
2445 2017-12-13  Keith Miller  <keith_miller@apple.com>
2446
2447         JSObjects should have a mask for loading indexed properties
2448         https://bugs.webkit.org/show_bug.cgi?id=180768
2449
2450         Reviewed by Mark Lam.
2451
2452         * stress/int16-put-by-val-in-and-out-of-bounds.js:
2453         (test):
2454
2455 2017-12-13  Saam Barati  <sbarati@apple.com>
2456
2457         Arrow functions need their own structure because they have different properties than sloppy functions
2458         https://bugs.webkit.org/show_bug.cgi?id=180779
2459         <rdar://problem/35814591>
2460
2461         Reviewed by Mark Lam.
2462
2463         * stress/arrow-function-needs-its-own-structure.js: Added.
2464         (assert):
2465         (readPrototype):
2466         (noInline.let.f1):
2467         (noInline):
2468
2469 2017-12-13  Saam Barati  <sbarati@apple.com>
2470
2471         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
2472         https://bugs.webkit.org/show_bug.cgi?id=163579
2473         <rdar://problem/35455798>
2474
2475         Reviewed by Mark Lam.
2476
2477         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
2478         (assert):
2479         (test1):
2480         (i.test1):
2481         (i.test1.C):
2482         (i.test1.async.foo):
2483         (i.test1.foo):
2484         (test2):
2485
2486 2017-12-13  Saam Barati  <sbarati@apple.com>
2487
2488         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
2489         https://bugs.webkit.org/show_bug.cgi?id=180734
2490         <rdar://problem/35640547>
2491
2492         Reviewed by Yusuke Suzuki.
2493
2494         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
2495         (__isPropertyOfType):
2496         (__getProperties):
2497         (__getObjects):
2498         (__getRandomObject):
2499         (theClass.):
2500         (theClass):
2501         (childClass):
2502         (counter.catch):
2503
2504 2017-12-12  Saam Barati  <sbarati@apple.com>
2505
2506         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
2507         https://bugs.webkit.org/show_bug.cgi?id=180725
2508         <rdar://problem/35970511>
2509
2510         Reviewed by Michael Saboff.
2511
2512         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
2513         (f1):
2514         (f2):
2515         (let.o2.valueOf):
2516
2517 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2518
2519         [JSC] Implement optimized WeakMap and WeakSet
2520         https://bugs.webkit.org/show_bug.cgi?id=179929
2521
2522         Reviewed by Saam Barati.
2523
2524         * microbenchmarks/weak-map-key.js:
2525         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
2526         (assert):
2527         (objectKey):
2528         (let.start.Date.now):
2529         * stress/basic-weakmap.js: Added.
2530         (shouldBe):
2531         (test):
2532         * stress/basic-weakset.js: Added.
2533         (shouldBe):
2534         (test.set new):
2535         * stress/weakmap-cse-set-break.js: Added.
2536         (shouldBe):
2537         (test):
2538         * stress/weakmap-cse.js: Added.
2539         (shouldBe):
2540         (test):
2541         * stress/weakmap-gc.js: Added.
2542         (test):
2543         * stress/weakset-cse-add-break.js: Added.
2544         (shouldBe):
2545         (test.set new):
2546         * stress/weakset-cse.js: Added.
2547         (shouldBe):
2548         (test.set new):
2549         * stress/weakset-gc.js: Added.
2550         (test.set add):
2551         (test.set new):
2552         (test):
2553
2554 2017-12-12  Saam Barati  <sbarati@apple.com>
2555
2556         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
2557         https://bugs.webkit.org/show_bug.cgi?id=180723
2558         <rdar://problem/35859726>
2559
2560         Reviewed by JF Bastien.
2561
2562         * stress/get-my-argument-by-val-constant-folding.js: Added.
2563         (test):
2564         (catch):
2565
2566 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
2567
2568         [ESNext][BigInt] Implement BigInt literals and JSBigInt
2569         https://bugs.webkit.org/show_bug.cgi?id=179000
2570
2571         Reviewed by Darin Adler and Yusuke Suzuki.
2572
2573         * bigIntTests.yaml: Added.
2574         * stress/big-int-literal-line-terminator.js: Added.
2575         * stress/big-int-literals.js: Added.
2576         * stress/big-int-operations-error.js: Added.
2577         * stress/big-int-type-of.js: Added.
2578         * stress/big-int-white-space-trailing-leading.js: Added.
2579         * stress/big-int-function-apply.js: Added.
2580
2581 2017-12-11  Saam Barati  <sbarati@apple.com>
2582
2583         We need to disableCaching() in ErrorInstance when we materialize properties
2584         https://bugs.webkit.org/show_bug.cgi?id=180343
2585         <rdar://problem/35833002>
2586
2587         Reviewed by Mark Lam.
2588
2589         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
2590         (assert):
2591         (makeError):
2592         (storeToStack):
2593         (storeToStackAlreadyMaterialized):
2594
2595 2017-12-05  JF Bastien  <jfbastien@apple.com>
2596
2597         WebAssembly: don't eagerly checksum
2598         https://bugs.webkit.org/show_bug.cgi?id=180441
2599         <rdar://problem/35156628>
2600
2601         Reviewed by Saam Barati.
2602
2603         Checksum is now disabled, so tests only have <?> as the module
2604         name.
2605
2606         * wasm/function-tests/nameSection.js:
2607         * wasm/function-tests/stack-overflow.js:
2608         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2609         (assertOverflows.assertThrows):
2610         (assertOverflows):
2611         * wasm/function-tests/stack-trace.js:
2612
2613 2017-12-04  JF Bastien  <jfbastien@apple.com>
2614
2615         Proxy all functions, except the $ objects
2616         https://bugs.webkit.org/show_bug.cgi?id=180375
2617
2618         Reviewed by Saam Barati.
2619
2620         It looks like this test may have broken some executions because I
2621         call some internal objects. Explicitly ignore objects whose name
2622         starts with "$" because it's a bad idea anyways.
2623
2624         * stress/proxy-all-the-parameters.js:
2625         (generateObjects):
2626         (get throw):
2627
2628 2017-12-04  Saam Barati  <sbarati@apple.com>
2629
2630         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
2631         https://bugs.webkit.org/show_bug.cgi?id=180366
2632         <rdar://problem/35685877>
2633
2634         Reviewed by Michael Saboff.
2635
2636         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
2637         (theParent):
2638         (test1.base.getParentStaticValue):
2639         (test1.base):
2640         (test1.__v_24888.prototype.set prop):
2641         (test1.__v_24888):
2642         (test2.base.getParentStaticValue):
2643         (test2.base):
2644         (test2.__v_24888.prototype.set prop):
2645         (test2.__v_24888):
2646         (test2):
2647
2648 2017-12-01  JF Bastien  <jfbastien@apple.com>
2649
2650         Try proxying all function arguments
2651         https://bugs.webkit.org/show_bug.cgi?id=180306
2652
2653         Reviewed by Saam Barati.
2654
2655         * stress/proxy-all-the-parameters.js: Added.
2656         (isPropertyOfType):
2657         (getProperties):
2658         (generateObjects):
2659         (getObjects):
2660         (getFunctions):
2661         (get throw):
2662         (let.o.of.getObjects.let.f.of.getFunctions.catch):
2663
2664 2017-12-01  JF Bastien  <jfbastien@apple.com>
2665
2666         JavaScriptCore: missing exception checks in Math functions that take more than one argument
2667         https://bugs.webkit.org/show_bug.cgi?id=180297
2668         <rdar://problem/35745556>
2669
2670         Reviewed by Mark Lam.
2671
2672         * stress/math-exceptions.js: Added.
2673         (get try):
2674         (catch):
2675
2676 2017-12-01  JF Bastien  <jfbastien@apple.com>
2677
2678         JavaScriptCore: add test for weird class static getters
2679         https://bugs.webkit.org/show_bug.cgi?id=180281
2680         <rdar://problem/35592139>
2681
2682         Reviewed by Mark Lam.
2683
2684         I fixed a bug for it in r224927 and didn't add a test. Do so.
2685
2686         * stress/class-static-get-weird.js: Added.
2687         (c.prototype.get name):
2688         (c):
2689         (c.prototype.get arguments):
2690         (c.prototype.get caller):
2691         (c.prototype.get length):
2692
2693 2017-12-01  Saam Barati  <sbarati@apple.com>
2694
2695         Having a bad time needs to handle ArrayClass indexing type as well
2696         https://bugs.webkit.org/show_bug.cgi?id=180274
2697         <rdar://problem/35667869>
2698
2699         Reviewed by Keith Miller and Mark Lam.
2700
2701         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
2702         (assert):
2703         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
2704         (assert):
2705
2706 2017-12-01  JF Bastien  <jfbastien@apple.com>
2707
2708         WebAssembly: restore cached stack limit after out-call
2709         https://bugs.webkit.org/show_bug.cgi?id=179106
2710         <rdar://problem/35337525>
2711
2712         Reviewed by Saam Barati.
2713
2714         * wasm/function-tests/double-instance.js: Added.
2715         (const.imp.boom):
2716         (const.imp.get callAnother):
2717
2718 2017-11-30  JF Bastien  <jfbastien@apple.com>
2719
2720         WebAssembly: improve stack trace
2721         https://bugs.webkit.org/show_bug.cgi?id=179343
2722
2723         Reviewed by Saam Barati.
2724
2725         Update the tests to follow the new format. Notably, SHA1 module
2726         hash is now included in traces, and stubs are properly identified.
2727
2728         * wasm/assert.js: Add an assertion which matches regular expressions.
2729         * wasm/function-tests/nameSection.js:
2730         * wasm/function-tests/stack-overflow.js:
2731         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2732         (assertOverflows.assertThrows.wasm.1):
2733         (assertOverflows.assertThrows.wasm.0):
2734         (assertOverflows.assertThrows):
2735         (assertOverflows):
2736         * wasm/function-tests/stack-trace.js:
2737         (import.Builder.from.string_appeared_here.assert): Deleted.
2738         * wasm/function-tests/trap-after-cross-instance-call.js:
2739         (wasmFrameCountFromError):
2740         * wasm/function-tests/trap-load-2.js:
2741         (wasmFrameCountFromError):
2742         * wasm/function-tests/trap-load.js:
2743         (wasmFrameCountFromError):
2744
2745 2017-11-30  Mark Lam  <mark.lam@apple.com>
2746
2747         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
2748         https://bugs.webkit.org/show_bug.cgi?id=180219
2749         <rdar://problem/35696536>
2750
2751         Reviewed by Filip Pizlo.
2752
2753         * stress/regress-180219.js: Added.
2754
2755 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2756
2757         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
2758         https://bugs.webkit.org/show_bug.cgi?id=180190
2759
2760         Reviewed by Mark Lam.
2761
2762         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
2763         (shouldBe):
2764         (test1):
2765         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
2766         (shouldBe):
2767         (test1):
2768         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
2769         (shouldBe):
2770         (test1):
2771         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
2772         (shouldBe):
2773         (test1):
2774         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
2775         (shouldBe):
2776         (test1):
2777         * stress/operation-in-may-have-negative-int32.js: Added.
2778         (shouldBe):
2779         (test2):
2780         * stress/operation-in-negative-int32-cast.js: Added.
2781         (shouldBe):
2782         (test1):
2783
2784 2017-11-28  JF Bastien  <jfbastien@apple.com>
2785
2786         Strict and sloppy functions shouldn't share structure
2787         https://bugs.webkit.org/show_bug.cgi?id=180103
2788         <rdar://problem/35667847>
2789
2790         Reviewed by Saam Barati.
2791
2792         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
2793         because the IC was wrong.
2794         (foo):
2795         (bar):
2796         (baz):
2797         (catch):
2798         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
2799         in this patch, but may as well test odd strict mode corner cases.
2800         (bar):
2801         (baz):
2802         (catch):
2803         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
2804         (foo):
2805         (bar):
2806         (baz):
2807         (catch):
2808         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
2809         next file, but with invalidation of the FunctionExecutable's
2810         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
2811         slower path.
2812         (foo):
2813         (bar.const.x):
2814         (bar.const.y):
2815         (bar):
2816         (catch):
2817         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
2818         strict nesting works correctly.
2819         (foo):
2820         (bar.baz):
2821         (bar):
2822         * stress/strict-function-structure.js: Added. The test used to
2823         assert in objectProtoFuncHasOwnProperty.
2824         (foo):
2825         (bar):
2826         (baz):
2827         * stress/strict-nested-function-structure.js: Added. Nesting.
2828         (foo):
2829         (bar):
2830         (baz.boo):
2831         (baz):
2832
2833 2017-11-29  Robin Morisset  <rmorisset@apple.com>
2834
2835         The recursive tail call optimisation is wrong on closures
2836         https://bugs.webkit.org/show_bug.cgi?id=179835
2837
2838         Reviewed by Saam Barati.
2839
2840         * stress/closure-recursive-tail-call.js: Added.
2841         (makeClosure):
2842
2843 2017-11-27  JF Bastien  <jfbastien@apple.com>
2844
2845         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
2846         https://bugs.webkit.org/show_bug.cgi?id=180051
2847         <rdar://problem/35614371>
2848
2849         Reviewed by Saam Barati.
2850
2851         * stress/rest-parameter-negative.js: Added.
2852         (__f_5484):
2853         (catch):
2854         (__f_5485):
2855         (__v_22598.catch):
2856
2857 2017-11-27  Saam Barati  <sbarati@apple.com>
2858
2859         Spread can escape when CreateRest does not
2860         https://bugs.webkit.org/show_bug.cgi?id=180057
2861         <rdar://problem/35676119>
2862
2863         Reviewed by JF Bastien.
2864
2865         * stress/spread-escapes-but-create-rest-does-not.js: Added.
2866         (assert):
2867         (getProperties):
2868         (theFunc):
2869         (let.obj.valueOf):
2870
2871 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2872
2873         [DFG] Add NormalizeMapKey DFG IR
2874         https://bugs.webkit.org/show_bug.cgi?id=179912
2875
2876         Reviewed by Saam Barati.
2877
2878         * stress/map-untyped-normalize-cse.js: Added.
2879         (shouldBe):
2880         (test):
2881         * stress/map-untyped-normalize.js: Added.
2882         (shouldBe):
2883         (test):
2884         * stress/set-untyped-normalize-cse.js: Added.
2885         (shouldBe):
2886         (set return.set has.set has):
2887         * stress/set-untyped-normalize.js: Added.
2888         (shouldBe):
2889         (set return.set has):
2890
2891 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2892
2893         [FTL] Support DeleteById and DeleteByVal
2894         https://bugs.webkit.org/show_bug.cgi?id=180022
2895
2896         Reviewed by Saam Barati.
2897
2898         * stress/delete-by-id.js: Added.
2899         (shouldBe):
2900         (test1):
2901         (test2):
2902         * stress/delete-by-val-ftl.js: Added.
2903         (shouldBe):
2904         (test1):
2905         (test2):
2906
2907 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2908
2909         [DFG] Introduce {Set,Map,WeakMap}Fields
2910         https://bugs.webkit.org/show_bug.cgi?id=179925
2911
2912         Reviewed by Saam Barati.
2913
2914         * stress/map-set-clobber-map-get.js: Added.
2915         (shouldBe):
2916         (test):
2917         * stress/map-set-does-not-clobber-set-has.js: Added.
2918         (shouldBe):
2919         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
2920         (shouldBe):
2921         (test):
2922         * stress/set-add-clobber-set-has.js: Added.
2923         (shouldBe):
2924         * stress/set-add-does-not-clobber-map-get.js: Added.
2925         (shouldBe):
2926
2927 2017-11-24  Mark Lam  <mark.lam@apple.com>
2928
2929         Move unsafe jsc shell test functions to the $vm object.
2930         https://bugs.webkit.org/show_bug.cgi?id=179980
2931
2932         Reviewed by Yusuke Suzuki.
2933
2934         * controlFlowProfiler/driver/driver.js:
2935         * controlFlowProfiler/execution-count.js:
2936         * controlFlowProfiler/if-statement.js:
2937         * controlFlowProfiler/loop-statements.js:
2938         * controlFlowProfiler/switch-statements.js:
2939         * controlFlowProfiler/test-jit.js:
2940         * exceptionFuzz/3d-cube.js:
2941         * exceptionFuzz/date-format-xparb.js:
2942         * exceptionFuzz/earley-boyer.js:
2943         * heapProfiler/basic-edges.js:
2944         * heapProfiler/property-edge-types.js:
2945         * microbenchmarks/try-get-by-id-basic.js:
2946         * microbenchmarks/try-get-by-id-polymorphic.js:
2947         * modules/namespace-object-try-get.js:
2948         * stress/argument-count-bytecode.js:
2949         * stress/argument-intrinsic-basic.js:
2950         * stress/argument-intrinsic-inlining-use-caller-arg.js:
2951         * stress/argument-intrinsic-inlining-with-result-escape.js:
2952         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
2953         * stress/argument-intrinsic-inlining-with-vararg.js:
2954         * stress/argument-intrinsic-nested-inlining.js:
2955         * stress/argument-intrinsic-not-convert-to-get-argument.js:
2956         * stress/argument-intrinsic-with-stack-write.js:
2957         * stress/arity-mismatch-get-argument.js:
2958         * stress/array-message-passing.js:
2959         * stress/array-push-with-force-exit.js:
2960         * stress/check-dom-with-signature.js:
2961         * stress/check-sub-class.js:
2962         * stress/compare-eq-incomplete-profile.js:
2963         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
2964         * stress/do-eval-virtual-call-correctly.js:
2965         * stress/dom-jit-with-poly-proto.js:
2966         * stress/domjit-exception-ic.js:
2967         * stress/domjit-exception.js:
2968         * stress/domjit-getter-complex-with-incorrect-object.js:
2969         * stress/domjit-getter-complex.js:
2970         * stress/domjit-getter-poly.js:
2971         * stress/domjit-getter-proto.js:
2972         * stress/domjit-getter-super-poly.js:
2973         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
2974         * stress/domjit-getter-type-check.js:
2975         * stress/domjit-getter.js:
2976         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
2977         * stress/for-in-proxy-target-changed-structure.js:
2978         * stress/for-in-proxy.js:
2979         * stress/generational-opaque-roots.js:
2980         * stress/global-const-redeclaration-setting-2.js:
2981         * stress/global-const-redeclaration-setting-3.js:
2982         * stress/global-const-redeclaration-setting-4.js:
2983         * stress/global-const-redeclaration-setting-5.js:
2984         * stress/global-const-redeclaration-setting.js:
2985         * stress/import-basic.js:
2986         * stress/import-from-eval.js:
2987         * stress/import-reject-with-exception.js:
2988         * stress/import-syntax.js:
2989         * stress/impure-get-own-property-slot-inline-cache.js:
2990         * stress/is-constructor.js:
2991         * stress/istypedarrayview-intrinsic.js:
2992         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
2993         * stress/jsc-test-functions-should-be-more-robust.js:
2994         * stress/object-toString-with-proxy.js:
2995         * stress/poly-proto-custom-value-and-accessor.js:
2996         * stress/proxy-inline-cache.js:
2997         * stress/re-execute-error-module.js:
2998         * stress/regress-150532.js:
2999         * stress/regress-156992.js:
3000         * stress/regress-179619.js:
3001         * stress/resources/shadow-chicken-support.js:
3002         * stress/runtime-array.js:
3003         * stress/sampling-profiler-microtasks.js:
3004         * stress/shadow-chicken-enabled.js:
3005         * stress/spread-correct-global-object-on-exception.js:
3006         * stress/super-get-by-id.js:
3007         * stress/tailCallForwardArguments.js:
3008         * stress/to-object-intrinsic-boolean-edge.js:
3009         * stress/to-object-intrinsic-null-or-undefined-edge.js:
3010         * stress/to-object-intrinsic-number-edge.js:
3011         * stress/to-object-intrinsic-object-edge.js:
3012         * stress/to-object-intrinsic-string-edge.js:
3013         * stress/to-object-intrinsic-symbol-edge.js:
3014         * stress/to-object-intrinsic.js:
3015         * stress/try-catch-custom-getter-as-get-by-id.js:
3016         * stress/try-get-by-id-poly-proto.js:
3017         * stress/try-get-by-id-should-spill-registers-dfg.js:
3018         * stress/try-get-by-id.js:
3019         * typeProfiler/arrow-functions.js:
3020         * typeProfiler/basic.js:
3021         * typeProfiler/captured.js:
3022         * typeProfiler/classes.js:
3023         * typeProfiler/dfg-jit-optimizations.js:
3024         * typeProfiler/dictionary-mode.js:
3025         * typeProfiler/es6-block-scoping.js:
3026         * typeProfiler/es6-classes.js:
3027         * typeProfiler/inheritance.js:
3028         * typeProfiler/int52-dfg.js:
3029         * typeProfiler/loop.js:
3030         * typeProfiler/optional-fields.js:
3031         * typeProfiler/overflow.js:
3032         * typeProfiler/return.js:
3033         * typeProfiler/symbol.js:
3034         * typeProfiler/weird-prototype-chain.js:
3035
3036 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3037
3038         [DFG][FTL] Support MapSet / SetAdd intrinsics
3039         https://bugs.webkit.org/show_bug.cgi?id=179858
3040
3041         Reviewed by Saam Barati.
3042
3043         * microbenchmarks/map-has-and-set.js: Added.
3044         (test):
3045         * stress/map-set-check-failure.js: Added.
3046         (shouldBe):
3047         (shouldThrow):
3048         (target):
3049         * stress/map-set-cse.js: Added.
3050         (shouldBe):
3051         (test):
3052         * stress/set-add-check-failure.js: Added.
3053         (shouldBe):
3054         (shouldThrow):
3055         (set shouldThrow):
3056         * stress/set-add-cse.js: Added.
3057         (shouldBe):
3058
3059 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3060
3061         [JSC] Allow poly proto for intrinsic getters
3062         https://bugs.webkit.org/show_bug.cgi?id=179550
3063
3064         Reviewed by Saam Barati.
3065
3066         This change is also tested by existing tests.
3067
3068             1. stress/intrinsic-getter-with-poly-proto.js
3069             2. stress/poly-proto-intrinsic-getter-correctness.js
3070
3071         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
3072         (shouldBe):
3073         (makePolyProtoObject.foo.C):
3074         (makePolyProtoObject.foo):
3075         (makePolyProtoObject):
3076         (target):
3077         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
3078         (shouldBe):
3079         (makePolyProtoObject.foo.C):
3080         (makePolyProtoObject.foo):
3081         (makePolyProtoObject):
3082         (target):
3083
3084 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
3085
3086         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
3087         https://bugs.webkit.org/show_bug.cgi?id=179744
3088
3089         Reviewed by Michael Catanzaro.
3090
3091         This test uses too much memory for our buildbots on these platforms
3092         and gets OOM-killed.
3093
3094         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3095         Skip if $memoryLimited and linux.
3096
3097 2017-11-17  JF Bastien  <jfbastien@apple.com>
3098
3099         WebAssembly JS API: throw when a promise can't be created
3100         https://bugs.webkit.org/show_bug.cgi?id=179826
3101         <rdar://problem/35455813>
3102
3103         Reviewed by Mark Lam.
3104
3105         Test WebAssembly.{compile,instantiate} where promise creation
3106         fails because of a stack overflow.
3107
3108         * wasm/js-api/promise-stack-overflow.js: Added.
3109         (const.runNearStackLimit.f.const.t):
3110         (async.testCompile):
3111         (async.testInstantiate):
3112
3113 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3114
3115         Unreviewed, mark regress-178385.js as memory exhausting
3116
3117         * stress/regress-178385.js:
3118
3119 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
3120
3121         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
3122
3123         Unreviewed test gardening.
3124
3125         * test262.yaml:
3126
3127 2017-11-16  Robin Morisset  <rmorisset@apple.com>
3128
3129         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
3130         https://bugs.webkit.org/show_bug.cgi?id=179763
3131         <rdar://problem/35550513>
3132
3133         Reviewed by Keith Miller.
3134
3135         Just adding a slightly cleaned-up version of the original fuzzer-found test.
3136
3137         * stress/tdz-this-in-try-catch.js: Added.
3138         (__v_6388):
3139         (__v_6392):
3140
3141 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
3142
3143         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
3144         https://bugs.webkit.org/show_bug.cgi?id=179594
3145
3146         Reviewed by Saam Barati.
3147
3148         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
3149         (shouldBe):
3150         (args):
3151         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
3152         (shouldBe):
3153         (args):
3154
3155 2017-11-14  Saam Barati  <sbarati@apple.com>
3156
3157         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
3158         https://bugs.webkit.org/show_bug.cgi?id=179639
3159         <rdar://problem/35513018>
3160
3161         Reviewed by JF Bastien.
3162
3163         * wasm/function-tests/grow-memory-cause-gc.js: Added.
3164         (escape):
3165         (i.func):
3166
3167 2017-11-13  Mark Lam  <mark.lam@apple.com>
3168
3169         Add more overflow check book-keeping for MarkedArgumentBuffer.
3170         https://bugs.webkit.org/show_bug.cgi?id=179634
3171         <rdar://problem/35492517>
3172
3173         Reviewed by Saam Barati.
3174
3175         * stress/regress-179634.js: Added.
3176
3177 2017-11-13  Mark Lam  <mark.lam@apple.com>
3178
3179         Make the jsc shell loadGetterFromGetterSetter() function more robust.
3180         https://bugs.webkit.org/show_bug.cgi?id=179619
3181         <rdar://problem/35492518>
3182
3183         Reviewed by Saam Barati.
3184
3185         * stress/regress-179619.js: Added.
3186
3187 2017-11-12  Mark Lam  <mark.lam@apple.com>
3188
3189         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
3190         https://bugs.webkit.org/show_bug.cgi?id=179562
3191         <rdar://problem/35467022>
3192
3193         Reviewed by Saam Barati.
3194
3195         * regress-179562.js: Added.
3196
3197 2017-11-08  Saam Barati  <sbarati@apple.com>
3198
3199         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
3200         https://bugs.webkit.org/show_bug.cgi?id=177792
3201
3202         Reviewed by Yusuke Suzuki.
3203
3204         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
3205         (assert):
3206         (foo.Foo.prototype.ensureX):
3207         (foo.Foo):
3208         (foo):
3209         (access):
3210
3211 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
3212
3213         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
3214         https://bugs.webkit.org/show_bug.cgi?id=178592
3215
3216         Unreviewed test gardening.
3217
3218         * test262.yaml:
3219
3220 2017-11-08  Robin Morisset  <rmorisset@apple.com>
3221
3222         Turn recursive tail calls into loops
3223         https://bugs.webkit.org/show_bug.cgi?id=176601
3224
3225         Reviewed by Saam Barati.
3226
3227         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
3228
3229         Add some simple test that computes factorial in several ways, and other trivial computations.
3230         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
3231         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
3232         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
3233         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
3234
3235         * stress/inline-call-to-recursive-tail-call.js: Added.
3236         (factorial.aux):
3237         (factorial):
3238         (factorial2.aux2):
3239         (factorial2.id):
3240         (factorial2):
3241         (factorial3.aux3):
3242         (factorial3):
3243         (aux4):
3244         (factorial4):
3245         (foo):
3246         (auxBar):
3247         (bar):
3248         (test):
3249
3250 2017-11-07  Mark Lam  <mark.lam@apple.com>
3251
3252         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
3253         https://bugs.webkit.org/show_bug.cgi?id=179355
3254         <rdar://problem/35263053>
3255
3256         Reviewed by Saam Barati.
3257
3258         * stress/regress-179355.js: Added.
3259
3260 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3261
3262         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
3263         https://bugs.webkit.org/show_bug.cgi?id=144458
3264
3265         Reviewed by Saam Barati.
3266
3267         * microbenchmarks/dfg-internal-function-call.js: Added.
3268         (target):
3269         * microbenchmarks/dfg-internal-function-construct.js: Added.
3270         (target):
3271         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
3272         (target):
3273         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
3274         (target):
3275         * stress/dfg-internal-function-call.js: Added.
3276         (shouldBe):
3277         (target):
3278         * stress/dfg-internal-function-construct.js: Added.
3279         (shouldBe):
3280         (target):
3281         * stress/internal-function-call.js: Added.
3282         (shouldBe):
3283         * stress/internal-function-construct.js: Added.
3284         (shouldBe):
3285
3286 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
3287
3288         [Win] Skip stress/regress-178385.js.
3289         https://bugs.webkit.org/show_bug.cgi?id=179298
3290
3291         Unreviewed test gardening.
3292
3293         * stress/regress-178385.js:
3294
3295 2017-11-03  Keith Miller  <keith_miller@apple.com>
3296
3297         Add test for ic with side effects
3298         https://bugs.webkit.org/show_bug.cgi?id=179268
3299
3300         Reviewed by Saam Barati.
3301
3302         * stress/put-inline-cache-side-effects.js: Added.
3303         (let.i.of.objs.keys):
3304         (f):
3305
3306 2017-11-03  Mark Lam  <mark.lam@apple.com>
3307
3308         CachedCall (and its clients) needs overflow checks.
3309         https://bugs.webkit.org/show_bug.cgi?id=179185
3310
3311         Reviewed by JF Bastien.
3312
3313         * stress/regress-179185.js: Added.
3314
3315 2017-11-02  Michael Saboff  <msaboff@apple.com>
3316
3317         DFG needs to handle code motion of code in for..in loop bodies
3318         https://bugs.webkit.org/show_bug.cgi?id=179212
3319
3320         Reviewed by Keith Miller.
3321
3322         New regression test.
3323
3324         * stress/for-in-side-effects.js: Added.
3325         (getPrototypeOf):
3326         (reset):
3327         (testWithoutFTL.f):
3328         (testWithoutFTL):
3329         (testWithFTL.f):
3330         (testWithFTL):
3331
3332 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
3333
3334         AI does not correctly model the clobber case of ArithClz32
3335         https://bugs.webkit.org/show_bug.cgi?id=179188
3336
3337         Reviewed by Michael Saboff.
3338
3339         * stress/arith-clz32-effects.js: Added.
3340         (foo):
3341         (valueOf):
3342
3343 2017-11-01  Michael Saboff  <msaboff@apple.com>
3344
3345         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
3346         https://bugs.webkit.org/show_bug.cgi?id=179140
3347
3348         Reviewed by Saam Barati.
3349
3350         New regression test.
3351
3352         * stress/regress-179140.js: Added.
3353         (testWithoutFTL):
3354         (testWithFTL):
3355
3356 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
3357
3358         [JSC] Introduce @toObject
3359         https://bugs.webkit.org/show_bug.cgi?id=178726
3360
3361         Reviewed by Saam Barati.
3362
3363         * stress/array-copywithin.js:
3364         (shouldThrow):
3365         * stress/object-constructor-boolean-edge.js: Added.
3366         (shouldBe):
3367         (test):
3368         * stress/object-constructor-global.js: Added.
3369         (shouldBe):
3370         * stress/object-constructor-null-edge.js: Added.
3371         (shouldBe):
3372         (test):
3373         * stress/object-constructor-number-edge.js: Added.
3374         (shouldBe):
3375         (test):
3376         * stress/object-constructor-object-edge.js: Added.
3377         (shouldBe):
3378         (test):
3379         (i.arg):
3380         * stress/object-constructor-string-edge.js: Added.
3381         (shouldBe):
3382         (test):
3383         * stress/object-constructor-symbol-edge.js: Added.
3384         (shouldBe):
3385         (test):
3386         * stress/object-constructor-undefined-edge.js: Added.
3387         (shouldBe):
3388         (test):
3389         * stress/symbol-array-from.js: Added.
3390         (shouldBe):
3391         * stress/to-object-intrinsic-boolean-edge.js: Added.
3392         (shouldBe):
3393         (builtin.createBuiltin):
3394         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
3395         (shouldThrow):
3396         * stress/to-object-intrinsic-number-edge.js: Added.
3397         (shouldBe):
3398         (builtin.createBuiltin):
3399         * stress/to-object-intrinsic-object-edge.js: Added.
3400         (shouldBe):
3401         (builtin.createBuiltin):
3402         (i.arg):
3403         * stress/to-object-intrinsic-string-edge.js: Added.
3404         (shouldBe):
3405         (builtin.createBuiltin):
3406         * stress/to-object-intrinsic-symbol-edge.js: Added.
3407         (shouldBe):
3408         (builtin.createBuiltin):
3409         * stress/to-object-intrinsic.js: Added.
3410         (shouldBe):
3411         (shouldThrow):
3412         (builtin.createBuiltin):
3413
3414 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3415
3416         [DFG][FTL] Introduce StringSlice
3417         https://bugs.webkit.org/show_bug.cgi?id=178934
3418
3419         Reviewed by Saam Barati.
3420
3421         * microbenchmarks/string-slice-empty.js: Added.
3422         (slice):
3423         * microbenchmarks/string-slice-one-char.js: Added.
3424         (slice):
3425         * microbenchmarks/string-slice.js: Added.
3426         (slice):
3427
3428 2017-10-26  Michael Saboff  <msaboff@apple.com>
3429
3430         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
3431         https://bugs.webkit.org/show_bug.cgi?id=178890
3432
3433         Reviewed by Keith Miller.
3434
3435         New regression test.
3436
3437         * stress/regress-178890.js: Added.
3438
3439 2017-10-26  Mark Lam  <mark.lam@apple.com>
3440
3441         JSRopeString::RopeBuilder::append() should check for overflows.
3442         https://bugs.webkit.org/show_bug.cgi?id=178385
3443         <rdar://problem/35027468>
3444
3445         Reviewed by Saam Barati.
3446
3447         * stress/regress-178385.js: Added.
3448
3449 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
3450
3451         Unreviewed, rolling out r223961.
3452
3453         The change that required this has been rolled out.
3454
3455         Reverted changeset:
3456
3457         "Mark test262.yaml/test262/test/language/statements/try/tco-
3458         catch.js as passing."
3459         https://bugs.webkit.org/show_bug.cgi?id=178592
3460         https://trac.webkit.org/changeset/223961
3461
3462 2017-10-25  Commit Queue  <commit-queue@webkit.org>
3463
3464         Unreviewed, rolling out r223691 and r223729.
3465         https://bugs.webkit.org/show_bug.cgi?id=178834
3466
3467         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
3468         by rniwa on #webkit).
3469
3470         Reverted changesets:
3471
3472         "Turn recursive tail calls into loops"
3473         https://bugs.webkit.org/show_bug.cgi?id=176601
3474         https://trac.webkit.org/changeset/223691
3475
3476         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
3477         comparison is always false due to limited range of data type
3478         [-Wtype-limits]"
3479         https://bugs.webkit.org/show_bug.cgi?id=178543
3480         https://trac.webkit.org/changeset/223729
3481
3482 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
3483
3484         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
3485         https://bugs.webkit.org/show_bug.cgi?id=178592
3486
3487         Unreviewed test gardening.
3488
3489         * test262.yaml:
3490
3491 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3492
3493         [FTL] Support NewStringObject
3494         https://bugs.webkit.org/show_bug.cgi?id=178737
3495
3496         Reviewed by Saam Barati.
3497
3498         * stress/new-string-object.js: Added.
3499         (shouldBe):
3500         (test):
3501
3502 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3503
3504         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
3505         https://bugs.webkit.org/show_bug.cgi?id=178308
3506
3507         Reviewed by Mark Lam.
3508
3509         * test262.yaml:
3510
3511 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3512
3513         [JSC] Use fastJoin in Array#toString
3514         https://bugs.webkit.org/show_bug.cgi?id=178062
3515
3516         Reviewed by Darin Adler.
3517
3518         * microbenchmarks/contiguous-array-to-string.js: Added.
3519         (target):
3520         * microbenchmarks/double-array-to-string.js: Added.
3521         (target):
3522         * microbenchmarks/int32-array-to-string.js: Added.
3523         (target):
3524
3525 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
3526
3527         stress/check-string-ident.js is improperly skipped
3528         https://bugs.webkit.org/show_bug.cgi?id=178642
3529
3530         Reviewed by Saam Barati.
3531
3532         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
3533         since it enforces the run-jsc-stress-tests script to still set up the
3534         test to run, despite the skip directive that's used before.
3535
3536 2017-10-20  Mark Lam  <mark.lam@apple.com>
3537
3538         Add a test case for r214334.
3539         https://bugs.webkit.org/show_bug.cgi?id=169941
3540         <rdar://problem/31221258>
3541
3542         Reviewed by JF Bastien.
3543
3544         * stress/regress-169941.js: Added.
3545
3546 2017-10-19  JF Bastien  <jfbastien@apple.com>
3547
3548         WebAssembly: no VM / JS version of everything but Instance
3549         https://bugs.webkit.org/show_bug.cgi?id=177473
3550
3551         Reviewed by Filip Pizlo, Saam Barati.
3552
3553         - Exceeding max on memory growth now returns a range error as per
3554         spec. This is a (very minor) breaking change: it used to throw OOM
3555         error. Update the corresponding test.
3556
3557         * wasm/js-api/memory-grow.js:
3558         (assertEq):
3559         * wasm/js-api/table.js:
3560         (assert.throws):
3561
3562 2017-10-19  Mark Lam  <mark.lam@apple.com>
3563
3564         Stringifier::appendStringifiedValue() is missing an exception check.
3565         https://bugs.webkit.org/show_bug.cgi?id=178386
3566         <rdar://problem/35027610>
3567
3568         Reviewed by Saam Barati.
3569
3570         * stress/regress-178386.js: Added.
3571
3572 2017-10-19  Michael Saboff  <msaboff@apple.com>
3573
3574         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
3575         https://bugs.webkit.org/show_bug.cgi?id=178521
3576
3577         Reviewed by JF Bastien.
3578
3579         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
3580         now passes with the current version (5.0) of the Emoji spec.
3581
3582 2017-10-19  Robin Morisset  <rmorisset@apple.com>
3583
3584         Turn recursive tail calls into loops
3585         https://bugs.webkit.org/show_bug.cgi?id=176601
3586
3587         Reviewed by Saam Barati.
3588
3589         Add some simple test that computes factorial in several ways, and other trivial computations.
3590         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
3591         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
3592         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
3593         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
3594
3595         * stress/inline-call-to-recursive-tail-call.js: Added.
3596         (factorial.aux):
3597         (factorial):
3598         (factorial2.aux):
3599         (factorial2.id):
3600         (factorial2):
3601         (factorial3.aux):
3602         (factorial3):
3603         (aux):
3604         (factorial4):
3605         (test):
3606
3607 2017-10-18  Mark Lam  <mark.lam@apple.com>
3608
3609         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
3610         https://bugs.webkit.org/show_bug.cgi?id=177600
3611         <rdar://problem/34710985>
3612
3613         Reviewed by Saam Barati.
3614
3615         * stress/regress-177600.js: Added.
3616
3617 2017-10-18  Mark Lam  <mark.lam@apple.com>
3618
3619         The compiler should always register a structure when it adds its transitionWatchPointSet.
3620         https://bugs.webkit.org/show_bug.cgi?id=178420
3621         <rdar://problem/34814024>
3622
3623         Reviewed by Saam Barati and Filip Pizlo.
3624
3625         * stress/regress-178420.js: Added.
3626         (new.Array.10000.map):
3627
3628 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3629
3630         [JSC] __proto__ getter should be fast
3631         https://bugs.webkit.org/show_bug.cgi?id=178067
3632
3633         Reviewed by Saam Barati.
3634
3635         * stress/dfg-object-proto-accessor.js: Added.
3636         (shouldBe):
3637         (shouldThrow):
3638         (target):
3639         * stress/dfg-object-proto-getter.js: Added.
3640         (shouldBe):
3641         (shouldThrow):
3642         (target):
3643         * stress/dfg-object-prototype-of.js: Added.
3644         (shouldBe):
3645         (shouldThrow):
3646         (target):
3647         * stress/dfg-reflect-get-prototype-of.js: Added.
3648         (shouldBe):
3649         (shouldThrow):
3650         (target):
3651         * stress/intrinsic-getter-with-poly-proto.js: Added.
3652         (shouldBe):
3653         (makePolyProtoObject.foo.C):
3654         (makePolyProtoObject.foo):
3655         (makePolyProtoObject):
3656         (target):
3657         * stress/object-get-prototype-of-filtered.js: Added.
3658         (shouldBe):
3659         (shouldThrow):
3660         (target):
3661         (i.Cocoa):
3662         * stress/object-get-prototype-of-mono-proto.js: Added.
3663         (shouldBe):
3664         (makePolyProtoObject.foo.C):
3665         (makePolyProtoObject.foo):
3666         (makePolyProtoObject):
3667         (target):
3668         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
3669         (shouldBe):
3670         (makePolyProtoObject.foo.C):
3671         (makePolyProtoObject.foo):
3672         (makePolyProtoObject):
3673         (target):
3674         * stress/object-get-prototype-of-poly-proto.js: Added.
3675         (shouldBe):
3676         (makePolyProtoObject.foo.C):
3677         (makePolyProtoObject.foo):
3678         (makePolyProtoObject):
3679         (target):
3680         * stress/object-proto-getter-filtered.js: Added.
3681         (shouldBe):
3682         (shouldThrow):
3683         (target):
3684         (i.Cocoa):
3685         * stress/object-proto-getter-poly-mono-proto.js: Added.
3686         (shouldBe):
3687         (makePolyProtoObject.foo.C):
3688         (makePolyProtoObject.foo):
3689         (makePolyProtoObject):
3690         (target):
3691         * stress/object-proto-getter-poly-proto.js: Added.
3692         (shouldBe):
3693         (makePolyProtoObject.foo.C):
3694         (makePolyProtoObject.foo):
3695         (makePolyProtoObject):
3696         (target):
3697         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
3698         * stress/string-proto.js: Added.
3699         (shouldBe):
3700         (target):
3701
3702 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
3703
3704         Unreviewed, rolling out r223523.
3705
3706         A test for this change is failing on debug JSC bots.
3707
3708         Reverted changeset:
3709
3710         "[JSC] __proto__ getter should be fast"
3711         https://bugs.webkit.org/show_bug.cgi?id=178067
3712         https://trac.webkit.org/changeset/223523
3713
3714 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3715
3716         [JSC] __proto__ getter should be fast
3717         https://bugs.webkit.org/show_bug.cgi?id=178067
3718
3719         Reviewed by Saam Barati.
3720
3721         * stress/dfg-object-proto-accessor.js: Added.
3722         (shouldBe):
3723         (shouldThrow):
3724         (target):
3725         * stress/dfg-object-proto-getter.js: Added.
3726         (shouldBe):
3727         (shouldThrow):
3728         (target):
3729         * stress/dfg-object-prototype-of.js: Added.
3730         (shouldBe):
3731         (shouldThrow):
3732         (target):
3733         * stress/dfg-reflect-get-prototype-of.js: Added.
3734         (shouldBe):
3735         (shouldThrow):
3736         (target):
3737         * stress/object-get-prototype-of-filtered.js: Added.
3738         (shouldBe):
3739         (shouldThrow):
3740         (target):
3741         (i.Cocoa):
3742         * stress/object-get-prototype-of-mono-proto.js: Added.
3743         (shouldBe):
3744         (makePolyProtoObject.foo.C):
3745         (makePolyProtoObject.foo):
3746         (makePolyProtoObject):
3747         (target):
3748         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
3749         (shouldBe):
3750         (makePolyProtoObject.foo.C):
3751         (makePolyProtoObject.foo):
3752         (makePolyProtoObject):
3753         (target):
3754         * stress/object-get-prototype-of-poly-proto.js: Added.