41e5a41ff55250d724ab7eca2d06b41e7d65619d
[WebKit-https.git] / JSTests / ChangeLog
1 2017-09-14  Saam Barati  <sbarati@apple.com>
2
3         It should be valid to exit before each set when doing arity fixup when inlining
4         https://bugs.webkit.org/show_bug.cgi?id=176948
5
6         Reviewed by Keith Miller.
7
8         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
9         (baz):
10         (bar):
11         (foo):
12
13 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
14
15         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
16         https://bugs.webkit.org/show_bug.cgi?id=176867
17
18         Reviewed by Sam Weinig.
19
20         * microbenchmarks/object-get-own-property-symbols.js: Added.
21         (test):
22
23 2017-09-13  Mark Lam  <mark.lam@apple.com>
24
25         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
26         https://bugs.webkit.org/show_bug.cgi?id=176888
27         <rdar://problem/34381832>
28
29         Not reviewed.
30
31         * stress/op_mod-ConstVar.js:
32         * stress/op_mod-VarConst.js:
33         * stress/op_mod-VarVar.js:
34
35 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
36
37         Skip 3 op_mod tests on Debug JSC bots.
38         https://bugs.webkit.org/show_bug.cgi?id=176630
39
40         Unreviewed test gardening.
41
42         * stress/op_mod-ConstVar.js:
43         * stress/op_mod-VarConst.js:
44         * stress/op_mod-VarVar.js:
45
46 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
47
48         [JSC] Fix Array allocation in Object.keys
49         https://bugs.webkit.org/show_bug.cgi?id=176826
50
51         Reviewed by Saam Barati.
52
53         * stress/object-own-property-keys.js: Added.
54         (shouldBe):
55
56 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
57
58         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
59         https://bugs.webkit.org/show_bug.cgi?id=176010
60
61         Reviewed by Filip Pizlo.
62
63         * microbenchmarks/weak-map-key.js: Added.
64         (assert):
65         (objectKey):
66         (let.start.Date.now):
67
68 2017-09-12  Mark Lam  <mark.lam@apple.com>
69
70         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
71         https://bugs.webkit.org/show_bug.cgi?id=176630
72
73         Reviewed by JF Bastien.
74
75         Debug builds are just slow, and these tests do a lot.  They pass when I run them
76         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
77         a speculative fix for the bots that are seeing these fail.
78
79         I also undid the skipping of the op_mod tests for debug builds.
80
81         * stress/op_div-ConstVar.js:
82         * stress/op_div-VarConst.js:
83         * stress/op_div-VarVar.js:
84         * stress/op_mod-ConstVar.js:
85         * stress/op_mod-VarConst.js:
86         * stress/op_mod-VarVar.js:
87
88 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
89
90         Skip stress/value-to-boolean.js on Debug bots.
91         https://bugs.webkit.org/show_bug.cgi?id=176787
92
93         Unreviewed test gardening.
94
95         * stress/value-to-boolean.js:
96
97 2017-09-11  Mark Lam  <mark.lam@apple.com>
98
99         Change test expectation for test262/test/language/statements/try/tco-catch.js
100         https://bugs.webkit.org/show_bug.cgi?id=176749
101
102         Rubber stamped by Keith Miller.
103
104         It's been failing since at least r221821.  I'm changing the test expectation to
105         fail to green the bots while I investigate some more.
106
107         * test262.yaml:
108
109 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
110
111         Unreviewed, rolling out r221854.
112
113         The test added with this change fails on 32-bit JSC bots.
114
115         Reverted changeset:
116
117         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
118         https://bugs.webkit.org/show_bug.cgi?id=176010
119         http://trac.webkit.org/changeset/221854
120
121 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
122
123         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
124         https://bugs.webkit.org/show_bug.cgi?id=176010
125
126         Reviewed by Filip Pizlo.
127
128         * microbenchmarks/weak-map-key.js: Added.
129         (assert):
130         (objectKey):
131         (let.start.Date.now):
132
133 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
134
135         [JSC] Optimize Object.keys by using careful array allocation
136         https://bugs.webkit.org/show_bug.cgi?id=176654
137
138         Reviewed by Darin Adler.
139
140         * microbenchmarks/object-keys.js: Added.
141         (test):
142
143 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
144
145         Error should compute .stack and friends lazily
146         https://bugs.webkit.org/show_bug.cgi?id=176645
147
148         Reviewed by Saam Barati.
149
150         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
151         * microbenchmarks/new-error.js: Added.
152         * microbenchmarks/throw.js: Added.
153
154 2017-09-09  Mark Lam  <mark.lam@apple.com>
155
156         [Re-landing] Use JIT probes for DFG OSR exit.
157         https://bugs.webkit.org/show_bug.cgi?id=175144
158         <rdar://problem/33437050>
159
160         Not reviewed.  Original patch reviewed by Saam Barati.
161
162         Disable these tests for debug builds because they run too slow with the new OSR exit.
163
164         * stress/op_mod-ConstVar.js:
165         * stress/op_mod-VarConst.js:
166         * stress/op_mod-VarVar.js:
167
168 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
169
170         [DFG] NewArrayWithSize(size)'s size does not care negative zero
171         https://bugs.webkit.org/show_bug.cgi?id=176300
172
173         Reviewed by Saam Barati.
174
175         * stress/new-array-with-size-div.js: Added.
176         (shouldBe):
177         (test):
178         (i.i):
179
180 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
181
182         [DFG] PutByVal with Array::Generic is too generic
183         https://bugs.webkit.org/show_bug.cgi?id=176345
184
185         Reviewed by Filip Pizlo.
186
187         * stress/object-assign-symbols.js: Added.
188         (shouldBe):
189         (test):
190         * stress/object-assign.js: Added.
191         (shouldBe):
192         (test):
193         (i.shouldBe.JSON.stringify.test):
194
195 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
196
197         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
198         https://bugs.webkit.org/show_bug.cgi?id=176590
199
200         Reviewed by Saam Barati.
201
202         * microbenchmarks/object-iterate-symbols.js: Added.
203         (test):
204         * microbenchmarks/object-iterate.js: Added.
205         (test):
206         * stress/object-iterate-symbols.js: Added.
207         (shouldBe):
208         (test):
209         * stress/object-iterate.js: Added.
210         (shouldBe):
211         (test):
212
213 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
214
215         [Win32] 10 JSC stress tests are failing.
216         https://bugs.webkit.org/show_bug.cgi?id=176538
217
218         Reviewed by Mark Lam.
219
220         Skip tests on Windows to make the bots green.
221
222         * ChakraCore.yaml:
223         * stress/date-relaxed.js:
224
225 2017-09-06  Mark Lam  <mark.lam@apple.com>
226
227         constructGenericTypedArrayViewWithArguments() is missing an exception check.
228         https://bugs.webkit.org/show_bug.cgi?id=176485
229         <rdar://problem/33898874>
230
231         Reviewed by Keith Miller.
232
233         * stress/regress-176485.js: Added.
234
235 2017-09-05  Saam Barati  <sbarati@apple.com>
236
237         isNotCellSpeculation is wrong with respect to SpecEmpty
238         https://bugs.webkit.org/show_bug.cgi?id=176429
239
240         Reviewed by Michael Saboff.
241
242         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
243         (Foo):
244
245 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
246
247         test262: Completion values for control flow do not match the spec
248         https://bugs.webkit.org/show_bug.cgi?id=171265
249
250         Reviewed by Saam Barati.
251
252         * stress/completion-value.js:
253         Condensed test for completion values in top level statements.
254
255         * stress/super-get-by-id.js:
256         ClassDeclaration when evaled no longer produce values. Convert
257         these to ClassExpressions so they produce the class value.
258         
259         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
260         This is a progression for currect spec behavior.
261
262         * mozilla/mozilla-tests.yaml:
263         This test is now outdated, so mark it as failing for that reason.
264
265         * test262.yaml:
266         Passing all "cptn" completion value tests.
267
268 2017-09-04  Saam Barati  <sbarati@apple.com>
269
270         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
271         https://bugs.webkit.org/show_bug.cgi?id=176317
272
273         Reviewed by Keith Miller.
274
275         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
276         (Foo):
277
278 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
279
280         [DFG][FTL] Efficiently execute number#toString()
281         https://bugs.webkit.org/show_bug.cgi?id=170007
282
283         Reviewed by Keith Miller.
284
285         * microbenchmarks/number-to-string-strength-reduction.js: Added.
286         (test):
287         * microbenchmarks/number-to-string-with-radix-10.js: Added.
288         (test):
289         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
290         (test):
291         * microbenchmarks/number-to-string-with-radix.js: Added.
292         (test):
293         * stress/number-to-string-strength-reduction.js: Added.
294         (shouldBe):
295         (test):
296         * stress/number-to-string-with-radix-10.js: Added.
297         (shouldBe):
298         (test):
299         * stress/number-to-string-with-radix-cse.js: Added.
300         (shouldBe):
301         (test):
302         * stress/number-to-string-with-radix-invalid.js: Added.
303         (shouldThrow):
304         * stress/number-to-string-with-radix-watchpoint.js: Added.
305         (shouldBe):
306         (test):
307         (i.i.1e3.Number.prototype.toString):
308         * stress/number-to-string-with-radix.js: Added.
309         (shouldBe):
310         (test):
311
312 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
313
314         [DFG] Relax arity requirement
315         https://bugs.webkit.org/show_bug.cgi?id=175523
316
317         Reviewed by Saam Barati.
318
319         * stress/arity-mismatch-arguments-length.js: Added.
320         (shouldBe):
321         (test1):
322         (test):
323         * stress/arity-mismatch-get-argument.js: Added.
324         (shouldBe):
325         (builtin.createBuiltin):
326         (test):
327         * stress/arity-mismatch-inlining-extra-slots.js: Added.
328         (shouldBe):
329         (inlineTarget):
330         (test):
331         * stress/arity-mismatch-inlining.js: Added.
332         (shouldBe):
333         (inlineTarget):
334         (test):
335         * stress/arity-mismatch-rest.js: Added.
336         (shouldBe):
337         (test2):
338         (test1):
339         (test):
340
341 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
342
343         [JSC] Fix "name" and "length" of Proxy revoke function
344         https://bugs.webkit.org/show_bug.cgi?id=176155
345
346         Reviewed by Mark Lam.
347
348         * test262.yaml:
349
350 2017-08-31  Saam Barati  <sbarati@apple.com>
351
352         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
353         https://bugs.webkit.org/show_bug.cgi?id=176206
354
355         Reviewed by Keith Miller.
356
357         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
358         (a):
359         (b):
360         (foo):
361
362 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
363
364         Skip two slow JSC tests after r221422.
365
366         Unreviewed test gardening.
367
368         * stress/regexp-prototype-match-on-too-long-rope.js:
369         * stress/regexp-prototype-test-on-too-long-rope.js:
370
371 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
372
373         Unreviewed, skipping slow tests.
374         
375         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
376         work differently now.
377
378         * stress/regexp-prototype-exec-on-too-long-rope.js:
379         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
380
381 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
382
383         [JSC] Use reifying system for "name" property of builtin JSFunction
384         https://bugs.webkit.org/show_bug.cgi?id=175260
385
386         Reviewed by Saam Barati.
387
388         * stress/accessors-get-set-prefix.js:
389         * stress/builtin-function-name.js: Added.
390         (shouldBe):
391         (shouldThrow):
392         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
393         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
394         * stress/private-name-as-anonymous-builtin.js: Added.
395         (shouldBe):
396         (NotPromise):
397
398 2017-08-30  Saam Barati  <sbarati@apple.com>
399
400         Unreviewed. Make test stop printing.
401
402         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
403
404 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
405
406         Unreviewed, rolling out r221327.
407
408         This change caused test262 failures.
409
410         Reverted changeset:
411
412         "[JSC] Use reifying system for "name" property of builtin
413         JSFunction"
414         https://bugs.webkit.org/show_bug.cgi?id=175260
415         http://trac.webkit.org/changeset/221327
416
417 2017-08-30  Saam Barati  <sbarati@apple.com>
418
419         semicolon is being interpreted as an = in the LiteralParser
420         https://bugs.webkit.org/show_bug.cgi?id=176114
421
422         Reviewed by Oliver Hunt.
423
424         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
425         * stress/resources/literal-parser-test-case.js: Added.
426
427 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
428
429         [ESNext] Async iteration - Implement async iteration statement: for-await-of
430         https://bugs.webkit.org/show_bug.cgi?id=166698
431
432         Reviewed by Yusuke Suzuki.
433
434         * stress/async-iteration-for-await-of-syntax.js: Added.
435         (assert):
436         (checkSyntax):
437         (checkSyntaxError):
438         (checkSimpleAsyncGeneratorSloppyMode):
439         (checkSimpleAsyncGeneratorStrictMode):
440         (checkNestedAsyncGenerators):
441         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
442         * stress/async-iteration-for-await-of.js: Added.
443         (assert):
444         (async.foo):
445         (async.boo):
446         (const.boo.async):
447
448 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
449
450         [JSC] Use reifying system for "name" property of builtin JSFunction
451         https://bugs.webkit.org/show_bug.cgi?id=175260
452
453         Reviewed by Saam Barati.
454
455         * stress/accessors-get-set-prefix.js:
456         * stress/builtin-function-name.js: Added.
457         (shouldBe):
458         (shouldThrow):
459         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
460         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
461
462 2017-08-25  Saam Barati  <sbarati@apple.com>
463
464         Support compiling catch in the DFG
465         https://bugs.webkit.org/show_bug.cgi?id=174590
466         <rdar://problem/34047845>
467
468         Reviewed by Filip Pizlo.
469
470         * microbenchmarks/delta-blue-try-catch.js: Added.
471         (exception):
472         (value):
473         (OrderedCollection):
474         (OrderedCollection.prototype.add):
475         (OrderedCollection.prototype.at):
476         (OrderedCollection.prototype.size):
477         (OrderedCollection.prototype.removeFirst):
478         (OrderedCollection.prototype.remove):
479         (Strength):
480         (Strength.stronger):
481         (Strength.weaker):
482         (Strength.weakestOf):
483         (Strength.strongest):
484         (Strength.prototype.nextWeaker):
485         (Constraint):
486         (Constraint.prototype.addConstraint):
487         (Constraint.prototype.satisfy):
488         (Constraint.prototype.destroyConstraint):
489         (Constraint.prototype.isInput):
490         (UnaryConstraint):
491         (UnaryConstraint.prototype.addToGraph):
492         (UnaryConstraint.prototype.chooseMethod):
493         (UnaryConstraint.prototype.isSatisfied):
494         (UnaryConstraint.prototype.markInputs):
495         (UnaryConstraint.prototype.output):
496         (UnaryConstraint.prototype.recalculate):
497         (UnaryConstraint.prototype.markUnsatisfied):
498         (UnaryConstraint.prototype.inputsKnown):
499         (UnaryConstraint.prototype.removeFromGraph):
500         (StayConstraint):
501         (StayConstraint.prototype.execute):
502         (EditConstraint.prototype.isInput):
503         (EditConstraint.prototype.execute):
504         (BinaryConstraint):
505         (BinaryConstraint.prototype.chooseMethod):
506         (BinaryConstraint.prototype.addToGraph):
507         (BinaryConstraint.prototype.isSatisfied):
508         (BinaryConstraint.prototype.markInputs):
509         (BinaryConstraint.prototype.input):
510         (BinaryConstraint.prototype.output):
511         (BinaryConstraint.prototype.recalculate):
512         (BinaryConstraint.prototype.markUnsatisfied):
513         (BinaryConstraint.prototype.inputsKnown):
514         (BinaryConstraint.prototype.removeFromGraph):
515         (ScaleConstraint):
516         (ScaleConstraint.prototype.addToGraph):
517         (ScaleConstraint.prototype.removeFromGraph):
518         (ScaleConstraint.prototype.markInputs):
519         (ScaleConstraint.prototype.execute):
520         (ScaleConstraint.prototype.recalculate):
521         (EqualityConstraint):
522         (EqualityConstraint.prototype.execute):
523         (Variable):
524         (Variable.prototype.addConstraint):
525         (Variable.prototype.removeConstraint):
526         (Planner):
527         (Planner.prototype.incrementalAdd):
528         (Planner.prototype.incrementalRemove):
529         (Planner.prototype.newMark):
530         (Planner.prototype.makePlan):
531         (Planner.prototype.extractPlanFromConstraints):
532         (Planner.prototype.addPropagate):
533         (Planner.prototype.removePropagateFrom):
534         (Planner.prototype.addConstraintsConsumingTo):
535         (Plan):
536         (Plan.prototype.addConstraint):
537         (Plan.prototype.size):
538         (Plan.prototype.constraintAt):
539         (Plan.prototype.execute):
540         (chainTest):
541         (projectionTest):
542         (change):
543         (deltaBlue):
544         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
545         (assert):
546         (Numbers):
547         (Numbers.prototype.next):
548         (return.Transpose):
549         (return.Transpose.prototype.next):
550         (transpose):
551         (verifyEven):
552         (verifyString):
553         (foo):
554         (runIterators):
555         * microbenchmarks/try-catch-word-count.js: Added.
556         (let.assert):
557         (EOF):
558         (let.texts):
559         (let.o.apply):
560         (foo):
561         (bar):
562         (f):
563         (run):
564         (test1):
565         (test2):
566         (test3):
567         (fn):
568         (A):
569         (B):
570         (A.prototype.getValue):
571         (B.prototype.getParentValue):
572         (strlen):
573         (sum.0):
574         (test):
575         (result.test.o):
576         (set add.set add):
577         (set forEach):
578         (stringHash):
579         (set if):
580         (testFunction):
581         (set delete.set has.set add):
582         * stress/catch-set-argument-speculation-failure.js: Added.
583         (o):
584         (e):
585         (e2):
586         (escape):
587         (baz):
588         (noInline.run):
589         (noInline):
590         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
591         (foo):
592         (e):
593         (baz):
594         (bar):
595
596 2017-08-24  Commit Queue  <commit-queue@webkit.org>
597
598         Unreviewed, rolling out r221119, r221124, and r221143.
599         https://bugs.webkit.org/show_bug.cgi?id=175973
600
601         "I think it regressed JSBench by 20%" (Requested by saamyjoon
602         on #webkit).
603
604         Reverted changesets:
605
606         "Support compiling catch in the DFG"
607         https://bugs.webkit.org/show_bug.cgi?id=174590
608         http://trac.webkit.org/changeset/221119
609
610         "Unreviewed, build fix in GTK port"
611         https://bugs.webkit.org/show_bug.cgi?id=174590
612         http://trac.webkit.org/changeset/221124
613
614         "DFG::JITCode::osrEntry should get sorted since we perform a
615         binary search on it"
616         https://bugs.webkit.org/show_bug.cgi?id=175893
617         http://trac.webkit.org/changeset/221143
618
619 2017-08-24  Michael Saboff  <msaboff@apple.com>
620
621         Add support for RegExp "dotAll" flag
622         https://bugs.webkit.org/show_bug.cgi?id=175924
623
624         Reviewed by Keith Miller.
625
626         Updated tests for new dotAll ('s' flag) changes.
627
628         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
629         * stress/static-getter-in-names.js:
630
631 2017-08-24  Mark Lam  <mark.lam@apple.com>
632
633         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
634         https://bugs.webkit.org/show_bug.cgi?id=175940
635         <rdar://problem/29003921>
636
637         Reviewed by Saam Barati.
638
639         * stress/regress-164081.js: Added.
640         (shouldEqual):
641         (testcase):
642
643 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
644
645         Skip flaky JSC test stress/test-finally.js.
646         https://bugs.webkit.org/show_bug.cgi?id=160283
647
648         Unreviewed test gardening.
649
650         * stress/test-finally.js:
651
652 2017-08-23  Saam Barati  <sbarati@apple.com>
653
654         Support compiling catch in the DFG
655         https://bugs.webkit.org/show_bug.cgi?id=174590
656
657         Reviewed by Filip Pizlo.
658
659         * microbenchmarks/delta-blue-try-catch.js: Added.
660         (exception):
661         (value):
662         (OrderedCollection):
663         (OrderedCollection.prototype.add):
664         (OrderedCollection.prototype.at):
665         (OrderedCollection.prototype.size):
666         (OrderedCollection.prototype.removeFirst):
667         (OrderedCollection.prototype.remove):
668         (Strength):
669         (Strength.stronger):
670         (Strength.weaker):
671         (Strength.weakestOf):
672         (Strength.strongest):
673         (Strength.prototype.nextWeaker):
674         (Constraint):
675         (Constraint.prototype.addConstraint):
676         (Constraint.prototype.satisfy):
677         (Constraint.prototype.destroyConstraint):
678         (Constraint.prototype.isInput):
679         (UnaryConstraint):
680         (UnaryConstraint.prototype.addToGraph):
681         (UnaryConstraint.prototype.chooseMethod):
682         (UnaryConstraint.prototype.isSatisfied):
683         (UnaryConstraint.prototype.markInputs):
684         (UnaryConstraint.prototype.output):
685         (UnaryConstraint.prototype.recalculate):
686         (UnaryConstraint.prototype.markUnsatisfied):
687         (UnaryConstraint.prototype.inputsKnown):
688         (UnaryConstraint.prototype.removeFromGraph):
689         (StayConstraint):
690         (StayConstraint.prototype.execute):
691         (EditConstraint.prototype.isInput):
692         (EditConstraint.prototype.execute):
693         (BinaryConstraint):
694         (BinaryConstraint.prototype.chooseMethod):
695         (BinaryConstraint.prototype.addToGraph):
696         (BinaryConstraint.prototype.isSatisfied):
697         (BinaryConstraint.prototype.markInputs):
698         (BinaryConstraint.prototype.input):
699         (BinaryConstraint.prototype.output):
700         (BinaryConstraint.prototype.recalculate):
701         (BinaryConstraint.prototype.markUnsatisfied):
702         (BinaryConstraint.prototype.inputsKnown):
703         (BinaryConstraint.prototype.removeFromGraph):
704         (ScaleConstraint):
705         (ScaleConstraint.prototype.addToGraph):
706         (ScaleConstraint.prototype.removeFromGraph):
707         (ScaleConstraint.prototype.markInputs):
708         (ScaleConstraint.prototype.execute):
709         (ScaleConstraint.prototype.recalculate):
710         (EqualityConstraint):
711         (EqualityConstraint.prototype.execute):
712         (Variable):
713         (Variable.prototype.addConstraint):
714         (Variable.prototype.removeConstraint):
715         (Planner):
716         (Planner.prototype.incrementalAdd):
717         (Planner.prototype.incrementalRemove):
718         (Planner.prototype.newMark):
719         (Planner.prototype.makePlan):
720         (Planner.prototype.extractPlanFromConstraints):
721         (Planner.prototype.addPropagate):
722         (Planner.prototype.removePropagateFrom):
723         (Planner.prototype.addConstraintsConsumingTo):
724         (Plan):
725         (Plan.prototype.addConstraint):
726         (Plan.prototype.size):
727         (Plan.prototype.constraintAt):
728         (Plan.prototype.execute):
729         (chainTest):
730         (projectionTest):
731         (change):
732         (deltaBlue):
733         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
734         (assert):
735         (Numbers):
736         (Numbers.prototype.next):
737         (return.Transpose):
738         (return.Transpose.prototype.next):
739         (transpose):
740         (verifyEven):
741         (verifyString):
742         (foo):
743         (runIterators):
744         * microbenchmarks/try-catch-word-count.js: Added.
745         (let.assert):
746         (EOF):
747         (let.texts):
748         (let.o.apply):
749         (foo):
750         (bar):
751         (f):
752         (run):
753         (test1):
754         (test2):
755         (test3):
756         (fn):
757         (A):
758         (B):
759         (A.prototype.getValue):
760         (B.prototype.getParentValue):
761         (strlen):
762         (sum.0):
763         (test):
764         (result.test.o):
765         (set add.set add):
766         (set forEach):
767         (stringHash):
768         (set if):
769         (testFunction):
770         (set delete.set has.set add):
771         * stress/catch-set-argument-speculation-failure.js: Added.
772         (o):
773         (e):
774         (e2):
775         (escape):
776         (baz):
777         (noInline.run):
778         (noInline):
779         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
780         (foo):
781         (e):
782         (baz):
783         (bar):
784
785 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
786
787         [JSC] Optimize Map iteration with intrinsic
788         https://bugs.webkit.org/show_bug.cgi?id=174355
789
790         Reviewed by Saam Barati.
791
792         * stress/map-iterator-result-should-have-expected-shape.js: Added.
793         (shouldBe):
794         (throw.new.Error):
795         * stress/set-iterator-result-should-have-expected-shape.js: Added.
796         (shouldBe):
797         (throw.new.Error.let.iterator.set Symbol):
798         (throw.new.Error.set add):
799         (let.iterator.set Symbol):
800
801 2017-08-23  Robin Morisset  <rmorisset@apple.com>
802
803         Add a micro-benchmark for checking that accessing a variable within a 'with'
804         block does not automatically prevent type prediction.
805         https://bugs.webkit.org/show_bug.cgi?id=175738
806
807         Reviewed by Saam Barati.
808
809         * stress/with_and_arith.js: Added.
810         (with):
811
812 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
813
814         [ESNext] Async iteration - Implement Async Generator - runtime
815         https://bugs.webkit.org/show_bug.cgi?id=175240
816
817         Reviewed by Yusuke Suzuki.
818
819         * stress/async-iteration-async-from-sync.js: Added.
820         (assert):
821         (const.Logger):
822         (this.fullfilled):
823         (this.fullfilledDone):
824         (this.rejected):
825         (this.catched):
826         (this.isFinal):
827         (_assertLogger):
828         (const.assertLogger):
829         (const.getPromise.promiseHolder.return.new.Promise):
830         (foo):
831         (async.boo):
832         (bar):
833         (async.baz):
834         (async.goo):
835         * stress/async-iteration-basic.js: Added.
836         (assert):
837         (const.Logger):
838         (this.fullfilled):
839         (this.fullfilledDone):
840         (this.rejected):
841         (this.catched):
842         (this.isFinal):
843         (_assertLogger):
844         (const.assertLogger):
845         (const.getPromise.promiseHolder.return.new.Promise):
846         (async.generator):
847         (iterator.next.then):
848         (async.baz):
849         (async.boo):
850         (async.foo):
851         (async.goo):
852         (A.prototype.async.foo):
853         (A.prototype.async.boo):
854         (A):
855         (asyncGenExp.async):
856         (async.joo):
857         (j.next.then):
858         (then):
859         (async.koo):
860         (async.loo):
861         (async.moo):
862         (async.noo):
863         (async.ooo):
864         (async.roo):
865         (async.poo):
866         (async.soo):
867         (async.too):
868         * stress/async-iteration-evaluation.js: Added.
869         (assert):
870         (async.foo):
871         (catch):
872         * stress/async-iteration-syntax.js:
873         * stress/async-iteration-yield-promise.js: Added.
874         (assert):
875         (const.Logger):
876         (this.fullfilled):
877         (this.fullfilledDone):
878         (this.rejected):
879         (this.catched):
880         (this.isFinal):
881         (_assertLogger):
882         (const.assertLogger):
883         (const.getPromise.promiseHolder.return.new.Promise):
884         (async.foo):
885         (async.boo):
886         (async.bar):
887         * stress/async-iteration-yield-star-interface.js: Added.
888         (assert):
889         (const.getPromise.promiseHolder.return.new.Promise):
890         (const.Logger):
891         (this.fullfilled):
892         (this.fullfilledDone):
893         (this.rejected):
894         (this.catched):
895         (this.custom):
896         (this.isFinal):
897         (_assertLogger):
898         (const.assertLogger):
899         (let.asyncIter.Symbol.asyncIterator):
900         (let.asyncIter.next):
901         (let.asyncIter.throw):
902         (let.asyncIter.return):
903         (async.foo):
904         (asyncIter.Symbol.asyncIterator):
905         (asyncIter.next):
906         (async.boo):
907         (asyncIter.return):
908         (async.bar):
909         (async.baz):
910         (async.foobar):
911         * stress/async-iteration-yield-star.js: Added.
912         (assert):
913         (const.Logger):
914         (this.fullfilled):
915         (this.fullfilledDone):
916         (this.rejected):
917         (this.catched):
918         (this.custom):
919         (this.isFinal):
920         (_assertLogger):
921         (const.assertLogger):
922         (const.getPromise.promiseHolder.return.new.Promise):
923         (async.foo):
924         (async.boo):
925         (async.bar):
926         (async.baz):
927         (async.joo):
928         (async.goo):
929         (async.koo):
930         (async.loo):
931         (let.asyncIter.Symbol.asyncIterator):
932         (let.asyncIter.next):
933         (let.asyncIter.throw):
934         (let.asyncIter.return):
935         (async.moo):
936         (async.noo):
937         * test262.yaml:
938
939 2017-08-23  JF Bastien  <jfbastien@apple.com>
940
941         Fix printing in test
942
943         Unreviewed: fixing verbosity, shouldn't have been there.
944
945         * wasm/regress/175693.js:
946         (else.else):
947         (catch):
948
949 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
950
951         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
952         https://bugs.webkit.org/show_bug.cgi?id=172543
953
954         Unreviewed test gardening.
955
956         * microbenchmarks/generator-with-several-types.js:
957
958 2017-08-17  JF Bastien  <jfbastien@apple.com>
959
960         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
961         https://bugs.webkit.org/show_bug.cgi?id=175693
962         <rdar://problem/33952443>
963
964         Reviewed by Saam Barati.
965
966         Add a regression directory for WebAssembly tests.
967
968         * wasm.yaml:
969         * wasm/regress/175693.js: Added.
970         (else.else):
971         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
972         (catch):
973         * wasm/regress/175693.wasm: Added.
974
975 2017-08-15  Robin Morisset  <rmorisset@apple.com>
976
977         Support the 'with' keyword in FTL.
978         https://bugs.webkit.org/show_bug.cgi?id=175585
979
980         Reviewed by Saam Barati.
981
982         Also improve the JSTest/stress/with.js file to test
983         what happens when non-objects are passed to with.
984
985         * stress/with.js:
986         (foo):
987         (i.catch):
988         (i.with): Deleted.
989
990 2017-08-14  Keith Miller  <keith_miller@apple.com>
991
992         Add testing tool to lie to the DFG about profiles
993         https://bugs.webkit.org/show_bug.cgi?id=175487
994
995         Reviewed by Saam Barati.
996
997         * stress/compare-eq-incomplete-profile.js: Added.
998         (const.test.createBuiltin):
999
1000 2017-08-14  Robin Morisset  <rmorisset@apple.com>
1001
1002         Support the with keyword in DFG
1003         https://bugs.webkit.org/show_bug.cgi?id=175470
1004
1005         Reviewed by Saam Barati.
1006
1007         Added a new stress-test for the 'with' keyword, that caught a bug in a
1008         previous version of this code.
1009
1010         * stress/with.js: Added.
1011         (i.with):
1012
1013 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
1014
1015         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
1016         https://bugs.webkit.org/show_bug.cgi?id=175544
1017
1018         Unreviewed test gardening.
1019
1020         * ChakraCore.yaml:
1021
1022 2017-08-09  Caitlin Potter  <caitp@igalia.com>
1023
1024         Early error on ANY operator before new.target
1025         https://bugs.webkit.org/show_bug.cgi?id=157970
1026
1027         Reviewed by Saam Barati.
1028
1029         Instead of throwing if any unary operator precedes new.target, only
1030         throw if the unary operator updates the reference.
1031
1032         The following become legal in JSC:
1033
1034         ```
1035         !new.target
1036         ~new.target
1037         typeof new.target
1038         delete new.target
1039         void new.target
1040         ```
1041
1042         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
1043
1044         * stress/new-target-syntax-errors.js:
1045         * stress/new-target.js:
1046
1047 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
1048
1049         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
1050         https://bugs.webkit.org/show_bug.cgi?id=175255
1051
1052         Unreviewed test gardening.
1053
1054         * stress/regress-169783.js:
1055         * wasm/stress/oom.js:
1056
1057 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1058
1059         REGRESSION: 2 test262/test/language/statements/async-function failures
1060         https://bugs.webkit.org/show_bug.cgi?id=175334
1061
1062         Reviewed by Yusuke Suzuki.
1063
1064         Add @skip parameters to tests, and remove test for async iterator from 
1065         async await syntax test because it is already covered by async-iterator-syntax.js
1066
1067         * stress/async-await-syntax.js:
1068         * stress/async-iteration-syntax.js:
1069
1070 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1071
1072         Unreviewed, gardening test262 for Promise resolve / reject function length
1073         https://bugs.webkit.org/show_bug.cgi?id=175333
1074
1075         * test262.yaml:
1076
1077 2017-08-07  Robin Morisset  <rmorisset@apple.com>
1078
1079         GetOwnProperty of TypedArray indexed fields is wrongly configurable
1080         https://bugs.webkit.org/show_bug.cgi?id=175307
1081
1082         Reviewed by Saam Barati.
1083
1084         * stress/typedarray-getownproperty-not-configurable.js: Added.
1085         (assert):
1086         (foo):
1087
1088 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1089
1090         Promise resolve and reject function should have length = 1
1091         https://bugs.webkit.org/show_bug.cgi?id=175242
1092
1093         Reviewed by Saam Barati.
1094
1095         * stress/builtin-function-length.js: Added.
1096         (shouldBe):
1097         (shouldThrow):
1098         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1099         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1100
1101 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
1102
1103         [ESNext] Async iteration - Implement Async Generator - parser
1104         https://bugs.webkit.org/show_bug.cgi?id=175210
1105
1106         Reviewed by Yusuke Suzuki.
1107
1108         * stress/async-await-syntax.js:
1109         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1110         * stress/async-iteration-syntax.js: Added.
1111         (assert):
1112         (checkSyntax):
1113         (checkSyntaxError):
1114         (checkSimpleAsyncGeneratorSloppyMode):
1115         (checkSimpleAsyncGeneratorStrictMode):
1116         (checkNestedAsyncGenerators):
1117         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
1118         * stress/generator-class-methods-syntax.js:
1119
1120 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1121
1122         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
1123         https://bugs.webkit.org/show_bug.cgi?id=175150
1124
1125         Unreviewed test gardening.
1126
1127         * wasm/js-api/test_memory_constructor.js:
1128
1129 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1130
1131         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
1132         https://bugs.webkit.org/show_bug.cgi?id=175100
1133
1134         Reviewed by Mark Lam.
1135
1136         The JSC test JSTests/wasm/stress/oom.js tries to use all the
1137         available memory until an out of memory exception happens.
1138
1139         The Linux kernel is more tuned for server workloads than for GUI
1140         responsiveness. When a process tries to use a lot of memory, Linux
1141         will do its best to serve the request. This usually translates to
1142         free physical RAM by writing to disk dirty pages and/or moving out
1143         less recently used pages to swap (disk storage).
1144         Meanwhile it does this, the system will become unresponsive and this
1145         leads to freezes that can last even some minutes on the worst cases.
1146
1147         Therefore, let's skip this test on Linux as it will cause more harm
1148         than good on the Linux bots or on the machines of Linux developers.
1149
1150         * wasm/stress/oom.js:
1151
1152 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1153
1154         [JSC] Remove unnecessary print from stress\promise-finally.js test
1155         https://bugs.webkit.org/show_bug.cgi?id=175015
1156
1157         Reviewed by Yusuke Suzuki.
1158
1159         * stress/promise-finally.js:
1160         (p.finally):
1161         (then):
1162
1163 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1164
1165         Unreviewed, update test262 results for optional catch binding
1166
1167         * test262.yaml:
1168
1169 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1170
1171         [JSC] Support optional catch binding
1172         https://bugs.webkit.org/show_bug.cgi?id=174981
1173
1174         Reviewed by Saam Barati.
1175
1176         * stress/optional-catch-binding-syntax.js: Added.
1177         (testSyntax):
1178         (testSyntaxError):
1179         (catch.catch):
1180         * stress/optional-catch-binding.js: Added.
1181         (shouldBe):
1182         (throwException):
1183
1184 2017-07-28  Mark Lam  <mark.lam@apple.com>
1185
1186         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
1187         https://bugs.webkit.org/show_bug.cgi?id=174948
1188         <rdar://problem/33495680>
1189
1190         Reviewed by Filip Pizlo.
1191
1192         * stress/regress-174948.js: Added.
1193
1194 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
1195
1196         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
1197         https://bugs.webkit.org/show_bug.cgi?id=174900
1198
1199         Reviewed by Saam Barati.
1200
1201         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
1202         (sideEffect):
1203         (args):
1204         (test):
1205
1206 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1207
1208         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
1209         https://bugs.webkit.org/show_bug.cgi?id=171637
1210
1211         Reviewed by Darin Adler.
1212
1213         * stress/domjit-getter-complex-with-incorrect-object.js:
1214         (i.shouldThrow):
1215         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
1216         (shouldBe):
1217         (i.shouldThrow):
1218
1219 2017-07-26  JF Bastien  <jfbastien@apple.com>
1220
1221         WebAssembly: test throwing out of the start function
1222         https://bugs.webkit.org/show_bug.cgi?id=165714
1223         <rdar://problem/29760251>
1224
1225         Reviewed by Keith Miller.
1226
1227         * wasm/assert.js:
1228         * wasm/function-tests/trap-from-start.js: Added.
1229         (StartTraps):
1230         * wasm/function-tests/trap-from-start-async.js: Added.
1231         (async.StartTrapsAsync):
1232
1233 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1234
1235         [FTL] Arguments elimination is suppressed by unreachable blocks
1236         https://bugs.webkit.org/show_bug.cgi?id=174352
1237
1238         Reviewed by Filip Pizlo.
1239
1240         * stress/arguments-elimination-force-exit.js: Added.
1241         (shouldBe):
1242         (strict):
1243         (sloppy):
1244         * stress/arguments-elimination-throw.js: Added.
1245         (shouldBe):
1246         (shouldThrow):
1247         (sloppy):
1248         (isArguments):
1249
1250 2017-07-13  Mark Lam  <mark.lam@apple.com>
1251
1252         Add some additional test cases for bug 170896.
1253         https://bugs.webkit.org/show_bug.cgi?id=174491
1254
1255         Reviewed by Filip Pizlo.
1256
1257         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
1258         * stress/regress-170896-with-double-shape-profile.js: Added.
1259         (test):
1260         * stress/regress-170896-with-int32-shape-profile.js: Added.
1261         (test):
1262         * stress/regress-170896.js: Removed.
1263
1264 2017-07-13  Saam Barati  <sbarati@apple.com>
1265
1266         Missing exception check in JSObject::hasInstance
1267         https://bugs.webkit.org/show_bug.cgi?id=174455
1268         <rdar://problem/31384608>
1269
1270         Reviewed by Mark Lam.
1271
1272         * stress/has-instance-exception-check.js: Added.
1273         (assert):
1274         (let.getter.Object.getOwnPropertyDescriptor.get foo):
1275
1276 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
1277
1278         [ESnext] Implement Object Spread
1279         https://bugs.webkit.org/show_bug.cgi?id=167963
1280
1281         Reviewed by Saam Barati.
1282
1283         * stress/obj-rest-destructuring-order.js: Added.
1284         (assert):
1285         (o.get z):
1286         (o.get a):
1287         * stress/obj-spread-order.js: Added.
1288         (assert):
1289         (o.get z):
1290         (o.get a):
1291         * stress/object-spread.js: Added.
1292         (let.assert):
1293         (assert.sameValue):
1294         (let.o.get a):
1295         (let.obj.get c):
1296         (cthulhu.get x):
1297         (let.obj.set c):
1298         (calls.o.get z):
1299         (calls.o.get a):
1300         (try.let.obj.get foo):
1301         (get calls):
1302
1303 2017-07-12  Saam Barati  <sbarati@apple.com>
1304
1305         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
1306         https://bugs.webkit.org/show_bug.cgi?id=174411
1307         <rdar://problem/31696186>
1308
1309         Reviewed by Mark Lam.
1310
1311         * stress/generic-arguments-correct-delete-behavior.js: Added.
1312         (assert):
1313         (makeTest):
1314
1315 2017-07-07  Mark Lam  <mark.lam@apple.com>
1316
1317         \n\r is not the same as \r\n.
1318         https://bugs.webkit.org/show_bug.cgi?id=173053
1319
1320         Reviewed by Keith Miller.
1321
1322         * stress/regress-173053.js: Added.
1323         * stress/template-literal-line-terminators.js:
1324
1325 2017-07-06  Saam Barati  <sbarati@apple.com>
1326
1327         We are missing places where we invalidate the for-in context
1328         https://bugs.webkit.org/show_bug.cgi?id=174184
1329
1330         Reviewed by Geoffrey Garen.
1331
1332         * stress/for-in-invalidate-context-weird-assignments.js: Added.
1333         (assert):
1334         (test):
1335
1336 2017-07-05  Saam Barati  <sbarati@apple.com>
1337
1338         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
1339         https://bugs.webkit.org/show_bug.cgi?id=174188
1340         <rdar://problem/30581423>
1341
1342         Reviewed by Mark Lam.
1343
1344         * stress/new-array-having-a-bad-time-double.js: Added.
1345         (assert):
1346         (foo):
1347
1348 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1349
1350         WTF::StringImpl::copyChars segfaults when built with GCC 7
1351         https://bugs.webkit.org/show_bug.cgi?id=173407
1352
1353         Reviewed by Andreas Kling.
1354
1355         * stress/string-repeat-copy-chars-crash.js: Added.
1356         (shouldBe):
1357
1358 2017-07-03  Saam Barati  <sbarati@apple.com>
1359
1360         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
1361
1362         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1363
1364 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1365
1366         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
1367
1368         It requires too much memory.
1369
1370         * stress/dont-reserve-huge-capacity-lexer.js:
1371
1372 2017-06-30  Michael Saboff  <msaboff@apple.com>
1373
1374         Skip a test on ARM64 platform since we run out of address space.
1375
1376         Rubber stamped by Saam Barati.
1377
1378         * stress/dont-reserve-huge-capacity-lexer.js:
1379
1380 2017-06-30  Michael Saboff  <msaboff@apple.com>
1381
1382         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
1383         https://bugs.webkit.org/show_bug.cgi?id=174044
1384
1385         Reviewed by Oliver Hunt.
1386
1387         New regression test.
1388
1389         * stress/regress-174044.js: Added.
1390         (test1):
1391         (test2):
1392
1393 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
1394
1395         RegExpCachedResult::setInput should reify left and right contexts
1396         https://bugs.webkit.org/show_bug.cgi?id=173818
1397
1398         Reviewed by Keith Miller.
1399
1400         * stress/right-left-context-invalidated-by-input.js: Added.
1401         (test.validateContexts):
1402         (test):
1403
1404 2017-06-29  Saam Barati  <sbarati@apple.com>
1405
1406         Calculating postCapacity in unshiftCountSlowCase is wrong
1407         https://bugs.webkit.org/show_bug.cgi?id=173992
1408         <rdar://problem/32283199>
1409
1410         Reviewed by Keith Miller.
1411
1412         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
1413         (temp):
1414
1415 2017-06-29  Commit Queue  <commit-queue@webkit.org>
1416
1417         Unreviewed, rolling out r218512.
1418         https://bugs.webkit.org/show_bug.cgi?id=173981
1419
1420         "It changes the behavior of the JS API's JSEvaluateScript
1421         which breaks TurboTax" (Requested by saamyjoon on #webkit).
1422
1423         Reverted changeset:
1424
1425         "test262: Completion values for control flow do not match the
1426         spec"
1427         https://bugs.webkit.org/show_bug.cgi?id=171265
1428         http://trac.webkit.org/changeset/218512
1429
1430 2017-06-27  JF Bastien  <jfbastien@apple.com>
1431
1432         WebAssembly: running out of executable memory should throw OoM
1433         https://bugs.webkit.org/show_bug.cgi?id=171537
1434         <rdar://problem/32963338>
1435
1436         Reviewed by Saam Barati.
1437
1438         * wasm.yaml:
1439         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
1440         (const.invoke):
1441         (failCount.0.catch):
1442         (failCount.0.module.undefined.catch):
1443         * wasm/lowExecutableMemory/exports-oom.js: Added.
1444         (const.type):
1445         (const.params):
1446         (const.randomProgram):
1447         (failCount.0.catch):
1448         (failCount.0.module.undefined.catch):
1449         * wasm/lowExecutableMemory/imports-oom.js: Added.
1450         (const.type):
1451         (const.params):
1452         (const.randomProgram):
1453         (f.imports.push):
1454         (failCount.0.catch):
1455         (failCount.0.module.undefined.catch):
1456
1457 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
1458
1459         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
1460         https://bugs.webkit.org/show_bug.cgi?id=167962
1461
1462         Reviewed by Saam Barati.
1463
1464         * stress/object-rest-deconstruct.js: Added.
1465         (let.assert):
1466         (let.assertPropDescriptor):
1467         (catch):
1468         (get 3):
1469         (foo):
1470         (let.src.get y):
1471         (let.src.set y):
1472         (let.gen):
1473
1474 2017-06-27  Saam Barati  <sbarati@apple.com>
1475
1476         Function constructor needs to follow the spec and validate parameters and body independently
1477         https://bugs.webkit.org/show_bug.cgi?id=173303
1478         <rdar://problem/32732526>
1479
1480         Reviewed by Keith Miller.
1481
1482         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1483         * stress/function-constructor-semantics.js: Added.
1484         (assert):
1485         (hasSyntaxError):
1486         (foo):
1487         (async.foo):
1488         (testError):
1489         (testOK.toString):
1490         (toString):
1491
1492 2017-06-26  Saam Barati  <sbarati@apple.com>
1493
1494         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
1495         https://bugs.webkit.org/show_bug.cgi?id=173740
1496
1497         Reviewed by Mark Lam.
1498
1499         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
1500         (Array.prototype.Symbol.iterator):
1501
1502 2017-06-26  Saam Barati  <sbarati@apple.com>
1503
1504         Skip a test on 32-bit platforms since we run out of address space.
1505
1506         Rubber stamped by Mark Lam.
1507
1508         * stress/dont-reserve-huge-capacity-lexer.js:
1509
1510 2017-06-26  Saam Barati  <sbarati@apple.com>
1511
1512         Crash in JSC::Lexer<unsigned char>::setCode
1513         https://bugs.webkit.org/show_bug.cgi?id=172754
1514
1515         Reviewed by Mark Lam.
1516
1517         * stress/dont-reserve-huge-capacity-lexer.js: Added.
1518         (catch):
1519
1520 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1521
1522         [JSC] Clean up Object.entries implementation
1523         https://bugs.webkit.org/show_bug.cgi?id=173759
1524
1525         Reviewed by Sam Weinig.
1526
1527         * microbenchmarks/object-entries.js: Added.
1528         (test):
1529
1530 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
1531
1532         Remove Reflect.enumerate
1533         https://bugs.webkit.org/show_bug.cgi?id=173806
1534
1535         Reviewed by Yusuke Suzuki.
1536
1537         * ChakraCore.yaml:
1538         * es6.yaml:
1539         These tests now fail because they use Reflect.enumerate.
1540
1541         * test262.yaml:
1542         This test now passes, it checked that Reflect.enumerate is undefined!
1543
1544         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
1545         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
1546
1547         * stress/reflect-enumerate.js: Removed.
1548         Remove a test solely for Reflect.enumerate.
1549
1550 2017-06-22  Saam Barati  <sbarati@apple.com>
1551
1552         ValueRep(DoubleRep(@v)) can not simply convert to @v
1553         https://bugs.webkit.org/show_bug.cgi?id=173687
1554         <rdar://problem/32855563>
1555
1556         Reviewed by Mark Lam.
1557
1558         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
1559         (i.catch):
1560
1561 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1562
1563         [JSC] Object.values should be implemented in C++
1564         https://bugs.webkit.org/show_bug.cgi?id=173703
1565
1566         Reviewed by Sam Weinig.
1567
1568         * microbenchmarks/object-keys-map-values.js: Added.
1569         (test):
1570         * microbenchmarks/object-values.js: Added.
1571         (test):
1572         * stress/object-values-changing-properties.js: Added.
1573         (shouldBe):
1574         (throw.new.Error.let.source.get x):
1575         (throw.new.Error):
1576         (shouldBe.let.handler.get order):
1577         (get let):
1578         (shouldBe.let.handler.get return):
1579         (let.handler.get order):
1580
1581 2017-06-21  Saam Barati  <sbarati@apple.com>
1582
1583         eval virtual call is incorrect in the baseline JIT
1584         https://bugs.webkit.org/show_bug.cgi?id=173587
1585         <rdar://problem/32867897>
1586
1587         Reviewed by Michael Saboff.
1588
1589         * stress/do-eval-virtual-call-correctly.js: Added.
1590         (assert):
1591         (f):
1592         (i.test):
1593         (catch):
1594
1595 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
1596
1597         Update test262 test expectations after r218581.
1598
1599         Unreviewed test gardening.
1600
1601         * test262.yaml:
1602
1603 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
1604
1605         Revert changes in bug#160417 about extending `null` not being a derived class
1606         https://bugs.webkit.org/show_bug.cgi?id=169293
1607
1608         Reviewed by Saam Barati.
1609
1610         * stress/class-derived-from-null.js:
1611         (assertThrow):
1612         (test1):
1613         (test2):
1614         (test3):
1615         (test4):
1616         (test5):
1617         (test6):
1618
1619 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1620
1621         [DFG] More ArrayIndexOf fixups for various types
1622         https://bugs.webkit.org/show_bug.cgi?id=173176
1623
1624         Reviewed by Saam Barati.
1625
1626         * stress/array-indexof-arraystorage.js: Added.
1627         (shouldBe):
1628         (indexOfInt32Other):
1629         (indexOfInt32Cell):
1630         (indexOfInt32Boolean):
1631         (indexOfDoubleOther):
1632         (indexOfDoubleCell):
1633         (indexOfDoubleBoolean):
1634         (indexOfInt32):
1635         (indexOfDouble):
1636         * stress/array-indexof-constant-folding.js: Added.
1637         (shouldBe):
1638         (indexOfInt32Other):
1639         (indexOfInt32Cell):
1640         (indexOfInt32Boolean):
1641         (indexOfDoubleOther):
1642         (indexOfDoubleCell):
1643         (indexOfDoubleBoolean):
1644         * stress/array-indexof-hole-and-other.js: Added.
1645         (shouldBe):
1646         (indexOf):
1647         * stress/array-indexof-other.js: Added.
1648         (shouldBe):
1649         (indexOfInt32):
1650         (indexOfDouble):
1651         (indexOfString):
1652         (indexOfObject):
1653         * stress/array-indexof-symbol.js: Added.
1654         (shouldBe):
1655         (indexOfInt32):
1656         (indexOfDouble):
1657         (indexOfString):
1658         (indexOfObject):
1659
1660 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
1661
1662         test262: Completion values for control flow do not match the spec
1663         https://bugs.webkit.org/show_bug.cgi?id=171265
1664
1665         Reviewed by Saam Barati.
1666
1667         * stress/completion-value.js:
1668         Condensed test for completion values in top level statements.
1669
1670         * stress/super-get-by-id.js:
1671         ClassDeclaration when evaled no longer produce values. Convert
1672         these to ClassExpressions so they produce the class value.
1673         
1674         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1675         This is a progression for currect spec behavior.
1676
1677         * mozilla/mozilla-tests.yaml:
1678         This test is now outdated, so mark it as failing for that reason.
1679
1680         * test262.yaml:
1681         Passing all "cptn" completion value tests.
1682
1683 2017-06-17  Keith Miller  <keith_miller@apple.com>
1684
1685         ArrayBuffer constructor needs to create subclass structures before its buffer
1686         https://bugs.webkit.org/show_bug.cgi?id=173510
1687
1688         Reviewed by Yusuke Suzuki.
1689
1690         * test262.yaml:
1691
1692 2017-06-17  Keith Miller  <keith_miller@apple.com>
1693
1694         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
1695         https://bugs.webkit.org/show_bug.cgi?id=173506
1696
1697         Reviewed by Ryosuke Niwa.
1698
1699         Re-baseline tests.
1700
1701         * ChakraCore/test/Function/apply3.baseline-jsc:
1702         * test262.yaml:
1703
1704 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1705
1706         [JSC] Add fast path for Object.assign
1707         https://bugs.webkit.org/show_bug.cgi?id=173416
1708
1709         Reviewed by Mark Lam.
1710
1711         * stress/object-assign-changing-properties.js: Added.
1712         (shouldBe):
1713         (throw.new.Error.let.source.get x):
1714         (throw.new.Error):
1715         (shouldBe.let.source.get x):
1716         (shouldBe.let.target.set x):
1717         (shouldBe.let.target.get x):
1718         * stress/object-assign-proxy.js: Added.
1719         (shouldBe):
1720         (throw.new.Error.let.handler.get order):
1721
1722 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1723
1724         [JSC] Implement Object.assign in C++
1725         https://bugs.webkit.org/show_bug.cgi?id=173414
1726
1727         Reviewed by Saam Barati.
1728
1729         * stress/object-assign-string-first.js: Added.
1730         (shouldBe):
1731         (source.get Symbol):
1732         (source.get 1):
1733         (source.get cocoa):
1734
1735 2017-06-14  JF Bastien  <jfbastien@apple.com>
1736
1737         WebAssembly: remove empty test files
1738         https://bugs.webkit.org/show_bug.cgi?id=173382
1739
1740         Reviewed by Saam Barati.
1741
1742         The following files:
1743                 JSTests/wasm/function-tests/call-indirect-params.js
1744                 JSTests/wasm/function-tests/call-indirect.js
1745                 JSTests/wasm/js-api/call-indirect-results.js
1746         Were changed to empty files in https://trac.webkit.org/changeset/209771
1747
1748         They were testing call_indirect with the wrong semantics, before
1749         we implemented tables. That change implemented tables and
1750         therefore removed the erroneous tests.
1751
1752         We have a few tests for call_indirect which already do the right thing:
1753                 JSTests/wasm/function-tests/context-switch.js
1754                 JSTests/wasm/function-tests/exceptions.js
1755                 JSTests/wasm/function-tests/grow-memory-2.js
1756                 JSTests/wasm/function-tests/stack-overflow.js
1757                 JSTests/wasm/function-tests/table-basic-2.js
1758                 JSTests/wasm/function-tests/table-basic.js
1759                 JSTests/wasm/js-api/call-indirect.js
1760                 JSTests/wasm/js-api/table.js
1761                 JSTests/wasm/js-api/unique-signature.js
1762                 JSTests/wasm/js-api/wrapper-function.js
1763
1764         I also just imported the updated spec tests which, among other
1765         things, test call_indirect:
1766                 core/br.wast
1767                 core/br_table.wast
1768                 core/call_indirect.wast
1769                 core/func.wast
1770                 core/func_ptrs.wast
1771                 core/imports.wast
1772                 core/left-to-right.wast
1773                 core/linking.wast
1774                 core/nop.wast
1775                 core/return.wast
1776                 core/typecheck.wast
1777                 core/unreachable.wast
1778
1779         So I think it's OK to just delete the tests which should just have
1780         been deleted back when tables were added.
1781
1782         * wasm/function-tests/call-indirect-params.js: Removed.
1783         * wasm/function-tests/call-indirect.js: Removed.
1784         * wasm/js-api/call-indirect-results.js: Removed.
1785
1786 2017-06-13  JF Bastien  <jfbastien@apple.com>
1787
1788         WebAssembly: import updated spec tests
1789         https://bugs.webkit.org/show_bug.cgi?id=173287
1790         <rdar://problem/32725975>
1791
1792         Reviewed by Saam Barati.
1793
1794         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
1795         with a few modifications so things work.
1796
1797         Fix a bunch of bugs found through this process, and punt a few tests (which I
1798         marked as blocked by this bug).
1799
1800         Fixes:
1801
1802         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
1803         instead of byte alignment. It was also missing memory-alignment.js despite it
1804         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
1805         pass.
1806
1807         Tables can be imported or in a section. There can be only one, but sections can
1808         be empty. An Elements section can exist if there's no Table, as long as it is
1809         also empty.
1810
1811         Memories can be imported or in a section. There can be only one, but sections
1812         can be empty. A Data section can exist if there's no Memory, as long as it is
1813         also empty.
1814
1815         Prototypes: stringify without .prototype. in the string.
1816
1817         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
1818         not a final size, and throws a RangeError on failure, not a TypeError.
1819
1820         Fix compile / instantiate so the reject the promise if given an argument of the
1821         wrong type (instead of failing instantly).
1822
1823         Fix async on neuter test.
1824
1825         Element section shouldn't affect any Table if any of the elements are out of
1826         bounds. We need to process it in two passes.
1827
1828         Segment section shouldn't affect any Data if any of the segments are out of
1829         bounds. We need to process it in two passes.
1830
1831         Empty data segments are valid, but only when there is no memory. Their index
1832         still gets validated, and has to be zero.
1833
1834         Punts:
1835
1836         Error messages with context, the test seems overly restrictive but this is
1837         minor.
1838
1839         compile/instantiate/validate property descriptors.
1840
1841         UTF-8 bugs.
1842
1843         Temporarily disable NaN tests. We need to go back and implement the following
1844         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
1845         much as getting all the other tests passing.
1846
1847         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
1848         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
1849         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
1850         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
1851         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
1852         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
1853         why they're not allowed.
1854
1855         * wasm.yaml:
1856         * wasm/function-tests/i32-load8-s.js:
1857         * wasm/function-tests/memory-access-past-4gib.js:
1858         (const.op.of.WASM.opcodes):
1859         * wasm/function-tests/memory-alignment.js: Added.
1860         (const.op.of.WASM.opcodes):
1861         * wasm/function-tests/memory-section-and-import.js:
1862         * wasm/js-api/Module-compile.js:
1863         (async.testPromiseAPI):
1864         * wasm/js-api/dont-mmap-zero-byte-memory.js:
1865         (testMems):
1866         * wasm/js-api/element.js:
1867         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1868         * wasm/js-api/neutered-inputs.js:
1869         (const.testFunction): Deleted.
1870         (const.testConstructor): Deleted.
1871         * wasm/js-api/table.js:
1872         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1873         (new.WebAssembly.Module):
1874         (assert.throws):
1875         (assertBadTableImport):
1876         (assert.throws.WebAssembly.Table.prototype.grow):
1877         (assertBadTableInstance): Deleted.
1878         * wasm/js-api/test_Data.js:
1879         (DataSectionWithoutMemory):
1880         * wasm/spec-harness/index.js:
1881         (module):
1882         (uniqueTest): Deleted.
1883         (assert_invalid): Deleted.
1884         (assert_soft_invalid): Deleted.
1885         (register): Deleted.
1886         (call): Deleted.
1887         (get instance): Deleted.
1888         (exports): Deleted.
1889         (run): Deleted.
1890         (assert_unlinkable): Deleted.
1891         (assert_uninstantiable): Deleted.
1892         (assert_trap): Deleted.
1893         (try.f): Deleted.
1894         (catch): Deleted.
1895         (assert_exhaustion): Deleted.
1896         (assert_return): Deleted.
1897         (assert_return_nan): Deleted.
1898         * wasm/spec-harness/testharness.css: Removed.
1899         * wasm/spec-harness/testharness.js: Removed.
1900         * wasm/spec-harness/testharnessreport.js: Removed.
1901         * wasm/spec-harness/wasm-constants.js:
1902         (assertTraps):
1903         (assertWasmThrows):
1904         * wasm/spec-harness/wasm-module-builder.js:
1905         (Binary.prototype.emit_section):
1906         (Binary):
1907         (WasmFunctionBuilder.prototype.addBody):
1908         (WasmFunctionBuilder.prototype.end):
1909         (WasmFunctionBuilder):
1910         (WasmModuleBuilder.prototype.stringToBytes):
1911         (WasmModuleBuilder.prototype.addCustomSection):
1912         (WasmModuleBuilder.prototype.addFunctionTableInit):
1913         (WasmModuleBuilder.prototype.appendToTable):
1914         (WasmModuleBuilder.prototype.toArray):
1915         (WasmModuleBuilder.prototype.toBuffer):
1916         (WasmModuleBuilder.prototype.instantiate):
1917         (WasmModuleBuilder):
1918         * wasm/spec-tests/address.wast.js:
1919         * wasm/spec-tests/align.wast.js: Added.
1920         * wasm/spec-tests/binary.wast.js:
1921         * wasm/spec-tests/block.wast.js:
1922         * wasm/spec-tests/br.wast.js:
1923         * wasm/spec-tests/br_if.wast.js:
1924         * wasm/spec-tests/br_table.wast.js:
1925         * wasm/spec-tests/call.wast.js:
1926         * wasm/spec-tests/call_indirect.wast.js:
1927         * wasm/spec-tests/comments.wast.js:
1928         * wasm/spec-tests/const.wast.js: Added.
1929         * wasm/spec-tests/conversions.wast.js: Added.
1930         * wasm/spec-tests/custom_section.wast.js:
1931         * wasm/spec-tests/exports.wast.js:
1932         * wasm/spec-tests/f32.wast.js: Added.
1933         * wasm/spec-tests/f64.wast.js: Added.
1934         * wasm/spec-tests/fac.wast.js:
1935         * wasm/spec-tests/float_exprs.wast.js: Added.
1936         * wasm/spec-tests/float_misc.wast.js: Added.
1937         * wasm/spec-tests/func.wast.js:
1938         * wasm/spec-tests/globals.wast.js:
1939         * wasm/spec-tests/if.wast.js:
1940         * wasm/spec-tests/imports.wast.js:
1941         * wasm/spec-tests/inline-module.wast.js: Added.
1942         * wasm/spec-tests/jsapi.js:
1943         (testJSAPI.test):
1944         (testJSAPI):
1945         * wasm/spec-tests/labels.wast.js:
1946         * wasm/spec-tests/loop.wast.js:
1947         * wasm/spec-tests/memory.wast.js:
1948         * wasm/spec-tests/memory_trap.wast.js: Added.
1949         * wasm/spec-tests/names.wast.js:
1950         * wasm/spec-tests/nop.wast.js:
1951         * wasm/spec-tests/return.wast.js:
1952         * wasm/spec-tests/stack.wast.js:
1953         * wasm/spec-tests/token.wast.js: Added.
1954         * wasm/spec-tests/type.wast.js: Added.
1955         * wasm/spec-tests/typecheck.wast.js:
1956         * wasm/spec-tests/unreachable.wast.js:
1957         * wasm/spec-tests/unreached-invalid.wast.js:
1958         * wasm/spec-tests/unwind.wast.js:
1959         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
1960         * wasm/spec-tests/utf8-import-field.wast.js: Added.
1961         * wasm/spec-tests/utf8-import-module.wast.js: Added.
1962
1963 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
1964
1965         Unreviewed JSC test gardening.
1966
1967         * stress/check-string-ident.js:
1968         * stress/new-largeish-contiguous-array-with-size.js:
1969
1970 2017-06-13  Michael Saboff  <msaboff@apple.com>
1971
1972         DFG doesn't properly handle a property that is change to read only in a prototype
1973         https://bugs.webkit.org/show_bug.cgi?id=173321
1974
1975         Reviewed by Filip Pizlo.
1976
1977         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
1978         * stress/regress-173321.js: Added new regression test.
1979         (shouldBe):
1980         (SimpleObject):
1981         (test):
1982
1983 2017-06-12  Saam Barati  <sbarati@apple.com>
1984
1985         Update test262 test expectation since r218082 makes new tests pass.
1986
1987         * test262.yaml:
1988
1989 2017-06-12  Saam Barati  <sbarati@apple.com>
1990
1991         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
1992         https://bugs.webkit.org/show_bug.cgi?id=172957
1993         <rdar://problem/32602704>
1994
1995         Reviewed by Filip Pizlo.
1996
1997         * stress/spec-empty-flows-through-cell-checks.js: Added.
1998         (A):
1999         (B):
2000         (i.catch):
2001
2002 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
2003
2004         We incorrectly allow escaped characters in keyword tokens
2005         https://bugs.webkit.org/show_bug.cgi?id=171310
2006
2007         Reviewed by Yusuke Suzuki.
2008
2009         * stress/destructuring-assignment-syntax.js:
2010         * stress/error-messages-for-in-operator-should-not-crash.js:
2011         (catch):
2012         * stress/reserved-word-with-escape.js:
2013         (testSyntaxError.String.raw.v):
2014         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
2015         (testSyntaxError.String.raw.a):
2016         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
2017
2018 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2019
2020         [DFG] Add ArrayIndexOf intrinsic
2021         https://bugs.webkit.org/show_bug.cgi?id=172421
2022
2023         Reviewed by Saam Barati.
2024
2025         * stress/array-indexof-array-prototype-change.js: Added.
2026         (shouldBe):
2027         (indexOfInt32):
2028         * stress/array-indexof-have-a-bad-time-getter.js: Added.
2029         (shouldBe):
2030         (indexOfInt32):
2031         * stress/array-indexof-have-a-bad-time.js: Added.
2032         (shouldBe):
2033         (indexOfInt32):
2034         * stress/array-indexof-hole-with-prototype.js: Added.
2035         (shouldBe):
2036         (indexOf):
2037         * stress/array-indexof-hole.js: Added.
2038         (shouldBe):
2039         (indexOf):
2040         * stress/array-indexof-index.js: Added.
2041         (shouldBe):
2042         (indexOfInt32):
2043         (indexOfDouble):
2044         (indexOfString):
2045         (indexOfObject):
2046         (indexOfValue):
2047         * stress/array-indexof-negative-index.js: Added.
2048         (shouldBe):
2049         (indexOfInt32):
2050         (indexOfDouble):
2051         (indexOfString):
2052         (indexOfObject):
2053         (indexOfValue):
2054         * stress/array-indexof-non-int32-start-index.js: Added.
2055         (shouldBe):
2056         (indexOf):
2057         (object.valueOf):
2058         * stress/array-indexof-object-prototype-change.js: Added.
2059         (shouldBe):
2060         (indexOfInt32):
2061         * stress/array-indexof-object.js: Added.
2062         (shouldBe):
2063         (indexOf):
2064         * stress/array-indexof-original-array.js: Added.
2065         (shouldBe):
2066         (indexOfInt32):
2067         * stress/array-indexof-string.js: Added.
2068         (shouldBe):
2069         (indexOf):
2070         * stress/array-indexof-structure-change-convert.js: Added.
2071         (shouldBe):
2072         (indexOf):
2073         * stress/array-indexof-structure-change.js: Added.
2074         (shouldBe):
2075         (indexOf):
2076         * stress/array-indexof.js: Added.
2077         (shouldBe):
2078         (indexOf):
2079
2080 2017-06-11  Keith Miller  <keith_miller@apple.com>
2081
2082         TypedArray constructor with string shouldn't throw
2083         https://bugs.webkit.org/show_bug.cgi?id=173181
2084
2085         Reviewed by JF Bastien.
2086
2087         We should be coercing primitive arguments to numbers in the various
2088         TypedArray constructors.
2089
2090         * stress/typedarray-constructor.js:
2091
2092 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
2093
2094         Unreviewed, update test results part 3
2095         https://bugs.webkit.org/show_bug.cgi?id=173227
2096
2097         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
2098
2099 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2100
2101         Unreviewed, update test results part 2
2102         https://bugs.webkit.org/show_bug.cgi?id=173227
2103
2104         * test262.yaml:
2105
2106 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2107
2108         Unreviewed, update test results
2109         https://bugs.webkit.org/show_bug.cgi?id=173227
2110
2111         * microbenchmarks/string-prototype-search-observable-side-effects.js:
2112         * test262.yaml:
2113
2114 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2115
2116         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
2117         https://bugs.webkit.org/show_bug.cgi?id=173227
2118
2119         Reviewed by Mark Lam.
2120
2121         Update the test.
2122
2123         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
2124
2125 2017-06-08  Keith Miller  <keith_miller@apple.com>
2126
2127         WebAssembly: We should only create wrappers for functions that can be exported
2128         https://bugs.webkit.org/show_bug.cgi?id=173088
2129
2130         Reviewed by Saam Barati.
2131
2132         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
2133         on the old testWasmModuleFunctions api, which has been removed.
2134
2135         * wasm/function-tests/copysign.js: Removed.
2136         * wasm/function-tests/ctz.js: Removed.
2137         * wasm/function-tests/drop.js: Removed.
2138         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
2139         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
2140         * wasm/function-tests/dumb-less-than-ite.js: Removed.
2141         * wasm/function-tests/eqz.js: Removed.
2142         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
2143         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
2144         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
2145         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
2146         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
2147         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
2148         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
2149         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
2150         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
2151         * wasm/function-tests/if-then-fallthrough.js: Removed.
2152         * wasm/function-tests/int-to-floating-point.js: Removed.
2153         * wasm/function-tests/loop-mult.js:
2154         * wasm/function-tests/loop-sum.js:
2155         * wasm/function-tests/max.js: Removed.
2156         * wasm/function-tests/min.js: Removed.
2157         * wasm/function-tests/nearest.js: Removed.
2158         * wasm/function-tests/nop.js: Removed.
2159         * wasm/function-tests/popcnt.js: Removed.
2160         * wasm/function-tests/ret5.js:
2161         * wasm/function-tests/select.js: Removed.
2162         * wasm/function-tests/tee-local.js: Removed.
2163         * wasm/function-tests/trunc.js: Removed.
2164
2165 2017-06-07  JF Bastien  <jfbastien@apple.com>
2166
2167         WebAssembly: test imports and exports with 16-bit characters
2168         https://bugs.webkit.org/show_bug.cgi?id=165977
2169         <rdar://problem/29760130>
2170
2171         Reviewed by Saam Barati.
2172
2173         The output for import failure was improved, so many tests need to
2174         be updated here. Only one has new tests as noted below.
2175
2176         * wasm/function-tests/memory-import-and-grow.js:
2177         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
2178         (idxModule):
2179         * wasm/js-api/global-error.js:
2180         (new.Number):
2181         (assert.throws):
2182         * wasm/js-api/table.js:
2183         (assert.throws):
2184         (new.WebAssembly.Table):
2185         * wasm/js-api/test_memory.js:
2186         (test):
2187         * wasm/js-api/wasm-to-wasm-bad-signature.js:
2188         (BadSignatureDropStartParams.):
2189         (BadSignatureDropStartParams):
2190         (BadSignatureDropEndParams.):
2191         (BadSignatureSwapParam.):
2192         (BadSignatureRet.):
2193         * wasm/js-api/web-assembly-instantiate.js:
2194         (assert.asyncTest.async.test):
2195         (assert.asyncTest):
2196         * wasm/js-api/wrapper-function.js:
2197         (return.new.WebAssembly.Module):
2198
2199 2017-06-07  Mark Lam  <mark.lam@apple.com>
2200
2201         Restrict the regress-173035.js test to only run on Darwin x86-64.
2202         https://bugs.webkit.org/show_bug.cgi?id=173075
2203
2204         Reviewed by Saam Barati.
2205
2206         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
2207         this test will require to succeed.  Here's an example of this failure:
2208         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
2209
2210         Since the issue is due to allocation of a very large amount of memory, the test
2211         will probably fail on iOS and other platforms as well.  Hence, we should just
2212         skip this test for any platforms that is not Darwin x86-64.
2213
2214         * stress/regress-173035.js:
2215
2216 2017-06-07  Mark Lam  <mark.lam@apple.com>
2217
2218         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
2219         https://bugs.webkit.org/show_bug.cgi?id=168587
2220
2221         Not reviewed.
2222
2223         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
2224
2225         * stress/test-finally.js:
2226
2227 2017-06-06  Mark Lam  <mark.lam@apple.com>
2228
2229         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
2230         https://bugs.webkit.org/show_bug.cgi?id=173035
2231         <rdar://problem/32554593>
2232
2233         Reviewed by Geoffrey Garen and Filip Pizlo.
2234
2235         * stress/regress-173035.js: Added.
2236
2237 2017-06-06  Saam Barati  <sbarati@apple.com>
2238
2239         Make sure we restore SP when doing calls that could be to JS
2240         https://bugs.webkit.org/show_bug.cgi?id=172946
2241         <rdar://problem/32579026>
2242
2243         Reviewed by JF Bastien.
2244
2245         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
2246         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
2247         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
2248         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
2249         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
2250
2251 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
2252
2253         Unreviewed rollout r217807. Caused a test to crash.
2254
2255         * heapProfiler/class-names.js: Removed.
2256         * heapProfiler/driver/driver.js:
2257         (CheapHeapSnapshotNode):
2258         (CheapHeapSnapshot):
2259         (createCheapHeapSnapshot):
2260         (HeapSnapshot):
2261         (createHeapSnapshot):
2262         * typeProfiler/inheritance.js:
2263         (wrapper.A):
2264         (wrapper.B):
2265         (wrapper.C):
2266         (wrapper):
2267
2268 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
2269
2270         index out of bound in bytecodebasicblock
2271         https://bugs.webkit.org/show_bug.cgi?id=172963
2272
2273         Reviewed by Saam Barati and Mark Lam.
2274
2275         * stress/dfg-call-class-constructor.js: Added.
2276         (Foo):
2277         (i.catch):
2278
2279 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
2280
2281         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
2282         https://bugs.webkit.org/show_bug.cgi?id=172848
2283         <rdar://problem/25709212>
2284
2285         Reviewed by Saam Barati.
2286
2287         * typeProfiler/inheritance.js:
2288         Rewrite the test slightly for clarity. The hoisting was confusing.
2289
2290         * heapProfiler/class-names.js: Added.
2291         (MyES5Class):
2292         (MyES6Class):
2293         (MyES6Subclass):
2294         Test object types and improved class names.
2295
2296         * heapProfiler/driver/driver.js:
2297         (CheapHeapSnapshotNode):
2298         (CheapHeapSnapshot):
2299         (createCheapHeapSnapshot):
2300         (HeapSnapshot):
2301         (createHeapSnapshot):
2302         Update snapshot parsing from version 1 to version 2.
2303
2304 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2305
2306         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
2307         https://bugs.webkit.org/show_bug.cgi?id=168844
2308
2309         Reviewed by Saam Barati.
2310
2311         * modules/async-function-export.js: Added.
2312         (f):
2313         (export.async.f):
2314
2315 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2316
2317         ES2015 modules - Export default function hoisting
2318         https://bugs.webkit.org/show_bug.cgi?id=170174
2319
2320         Reviewed by Saam Barati.
2321
2322         This issue itself is solved by fixing function declaration hoisting rules.
2323         This patch just adds the specific test to modules tests to ensure the bug
2324         is fixed.
2325
2326         * modules/export-default-function-hoisting.js: Added.
2327         * modules/export-default-function-hoisting/cappuccino.js: Added.
2328         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
2329         * modules/export-default-function-hoisting/cocoa.js: Added.
2330         (export.default.drinkCocoa):
2331
2332 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2333
2334         Class Proxy can't be extended
2335         https://bugs.webkit.org/show_bug.cgi?id=169040
2336
2337         Reviewed by Saam Barati.
2338
2339         Adding tests that check correctness of Proxy to ES6 `class`
2340         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
2341
2342         * stress/proxy-class.js: Added.
2343         (assert):
2344         (throw.new.Error.SuperClass):
2345         (throw.new.Error.A):
2346         (throw.new.Error):
2347
2348 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2349
2350         [JSC] Implement String.prototype.concat in JS builtins
2351         https://bugs.webkit.org/show_bug.cgi?id=172798
2352
2353         Reviewed by Sam Weinig.
2354
2355         * microbenchmarks/string-concat-convert.js: Added.
2356         (test):
2357         * microbenchmarks/string-concat-long-convert.js: Added.
2358         (test):
2359         * microbenchmarks/string-concat-long.js: Added.
2360         (test):
2361         * microbenchmarks/string-concat.js: Added.
2362         (test):
2363
2364 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
2365
2366         Rolling out: Prevent async methods named 'function'
2367         https://bugs.webkit.org/show_bug.cgi?id=172776
2368
2369         Reviewed by Mark Lam.
2370
2371         * stress/async-await-syntax.js:
2372         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2373         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2374         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2375         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2376         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2377
2378 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
2379
2380         Skip flaky JSC test stress/test-finally.js
2381         https://bugs.webkit.org/show_bug.cgi?id=168587
2382
2383         Unreviewed test gardening.
2384
2385         * stress/test-finally.js:
2386
2387 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2388
2389         Prevent async methods named 'function' in Object literal
2390         https://bugs.webkit.org/show_bug.cgi?id=172660
2391
2392         Reviewed by Saam Barati.
2393
2394         * stress/async-await-syntax.js:
2395         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2396
2397 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2398
2399         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
2400         https://bugs.webkit.org/show_bug.cgi?id=171274
2401
2402         Reviewed by Saam Barati.
2403
2404         * stress/async-arrow-functions-lexical-binding-in-class.js:
2405         (shouldBeAsync):
2406         (shouldBeAsyncAndStoreBind):
2407         (promise.new.Promise):
2408         (ChildClass4):
2409         (ChildClass4.prototype.classValue):
2410         (ChildClass4.prototype.get classProperty):
2411         * stress/async-arrow-functions-lexical-super-binding.js:
2412         (A):
2413         (const.childA1.new.prototype.var.f.async):
2414         (const.childA1.new.var):
2415         (const.childA1.new):
2416         (const.childA2.new.prototype.var.f.async):
2417         (const.childA2.new.var):
2418         (const.childA2.new):
2419         (const.childA3.new.prototype.var.f.async):
2420         (const.childA3.new.var):
2421         (const.childA3.new):
2422         (try.childA4.new.prototype.var.f.async):
2423         (try.childA4.new.var):
2424         (try.childA4.new):
2425         (catch):
2426         (const.childA5.new.prototype.var.f.async):
2427         (const.childA5.new.var):
2428         (const.childA5.new):
2429         (checkClass):
2430         (checkClass.new.prototype.var.f.async):
2431         (checkClass.new.var):
2432         (checkClass.new):
2433         (checkClass.new.prototype.method):
2434         (checkClass.new.prototype.prop):
2435
2436 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2437
2438         [JSC] Map and Set constructors should have fast path for cloning
2439         https://bugs.webkit.org/show_bug.cgi?id=172413
2440
2441         Reviewed by Saam Barati.
2442
2443         * stress/map-clone-instance-iterator-change.js: Added.
2444         (shouldBe):
2445         (map.Symbol.iterator):
2446         * stress/map-clone-iterator-change.js: Added.
2447         (shouldBe):
2448         (Map.prototype.Symbol.iterator):
2449         * stress/map-clone-next-change.js: Added.
2450         (shouldBe):
2451         (map.Symbol.iterator.__proto__.next):
2452         * stress/map-clone.js: Added.
2453         (shouldBe):
2454         (Map.prototype):
2455         * stress/map-inherit-set.js: Added.
2456         (shouldBe):
2457         (DerivedMap):
2458         (set for):
2459         * stress/set-clone-instance-iterator-change.js: Added.
2460         (shouldBe):
2461         (set Symbol.iterator):
2462         * stress/set-clone-iterator-change.js: Added.
2463         (shouldBe):
2464         (set Set.prototype.Symbol.iterator):
2465         * stress/set-clone-next-change.js: Added.
2466         (shouldBe):
2467         (set Symbol.iterator.__proto__.next):
2468         * stress/set-clone.js: Added.
2469         (shouldBe):
2470         (set Set.prototype.add):
2471         * stress/set-inherit-add.js: Added.
2472         (shouldBe):
2473         (DerivedSet.set add):
2474
2475 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
2476
2477         Unreviewed, rolling out r217458.
2478
2479         This change caused 55 JSC test failures.
2480
2481         Reverted changeset:
2482
2483         "Date should use historical data if it's available."
2484         https://bugs.webkit.org/show_bug.cgi?id=172592
2485         http://trac.webkit.org/changeset/217458
2486
2487 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2488
2489         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
2490         https://bugs.webkit.org/show_bug.cgi?id=167805
2491
2492         Reviewed by Saam Barati.
2493
2494         * modules/module-jit-reachability.js: Added.
2495
2496 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
2497
2498         Prevent async methods named 'function'
2499         https://bugs.webkit.org/show_bug.cgi?id=172598
2500
2501         Reviewed by Mark Lam.
2502
2503         * stress/async-await-syntax.js:
2504         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2505         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2506         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2507         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2508         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2509
2510 2017-05-25  Keith Miller  <keith_miller@apple.com>
2511
2512         Date should use historical data if it's available.
2513         https://bugs.webkit.org/show_bug.cgi?id=172592
2514
2515         Reviewed by Mark Lam.
2516
2517         Remove parts of the date tests that rely on the absence of
2518         historical data in Date.
2519
2520         * mozilla/ecma/Date/15.9.5.31-1.js:
2521         (getTestCases):
2522         * mozilla/ecma/Date/15.9.5.35-1.js:
2523         (getTestCases):
2524
2525 2017-05-25  Saam Barati  <sbarati@apple.com>
2526
2527         Our for-in optimization in the bytecode generator does its static analysis incorrectly
2528         https://bugs.webkit.org/show_bug.cgi?id=172532
2529         <rdar://problem/32369452>
2530
2531         Reviewed by Mark Lam.
2532
2533         * stress/for-in-invalidation-for-any-write.js: Added.
2534         (assert):
2535         (test):
2536         (test.i):
2537
2538 2017-05-25  Mark Lam  <mark.lam@apple.com>
2539
2540         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
2541         https://bugs.webkit.org/show_bug.cgi?id=172548
2542         <rdar://problem/31458393>
2543
2544         Reviewed by Filip Pizlo.
2545
2546         * stress/regress-172548.patch: Added.
2547
2548 2017-05-23  Saam Barati  <sbarati@apple.com>
2549
2550         We should not mmap zero bytes for a memory in Wasm
2551         https://bugs.webkit.org/show_bug.cgi?id=172528
2552         <rdar://problem/32257076>
2553
2554         Reviewed by Mark Lam.
2555
2556         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
2557         (testMems):
2558
2559 2017-05-23  Saam Barati  <sbarati@apple.com>
2560
2561         CFGSimplificationPhase should not merge a block with itself
2562         https://bugs.webkit.org/show_bug.cgi?id=172508
2563         <rdar://problem/28424006>
2564
2565         Reviewed by Keith Miller.
2566
2567         * stress/dont-crash-in-cfg-simplification.js: Added.
2568         (bar):
2569         (baz):
2570         (foo):
2571
2572 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2573
2574         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
2575         https://bugs.webkit.org/show_bug.cgi?id=172216
2576
2577         Reviewed by Saam Barati.
2578
2579         * stress/array-storage-get-by-val.js: Added.
2580         (shouldBe):
2581         (testOutOfBound):
2582         (testInBound):
2583         (testSlowPutOutOfBound):
2584         (testSlowPutInBound):
2585
2586 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2587
2588         Unreviewed, fix commented out tests
2589         https://bugs.webkit.org/show_bug.cgi?id=172225
2590
2591         * stress/get-by-val-string.js:
2592         (object.43):
2593         (Hello):
2594         (Hello.prototype.get 42):
2595         (Hello.prototype.43):
2596         (Derived):
2597         (shouldBe):
2598         (throw.new.Error): Deleted.
2599
2600 2017-05-21  Saam Barati  <sbarati@apple.com>
2601
2602         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
2603         https://bugs.webkit.org/show_bug.cgi?id=171041
2604         <rdar://problem/32082516>
2605
2606         Reviewed by Yusuke Suzuki.
2607
2608         * stress/lexical-scoping-for-loop.js: Added.
2609         (assert):
2610         (test1):
2611         (test2):
2612         (test3):
2613         (test4):
2614         (test5):
2615         (test6):
2616         (let.test7):
2617         (let.test8):
2618         (let.test9):
2619         (let.test10):
2620         (let.test11):
2621         (let.test12):
2622
2623 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2624
2625         [JSC] Make get_by_val & string "499" to number 499
2626         https://bugs.webkit.org/show_bug.cgi?id=172225
2627
2628         Reviewed by Saam Barati.
2629
2630         * stress/get-by-val-string.js: Added.
2631         (shouldBe):
2632         (shouldThrow):
2633         (object.43):
2634         (Hello):
2635         (Hello.prototype.get 42):
2636         (Hello.prototype.43):
2637         (Derived):
2638
2639 2017-05-19  Mark Lam  <mark.lam@apple.com>
2640
2641         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2642         https://bugs.webkit.org/show_bug.cgi?id=172383
2643         <rdar://problem/31418651>
2644
2645         Reviewed by Filip Pizlo.
2646
2647         * stress/regress-172383.js: Added.
2648
2649 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
2650
2651         Unreviewed, rolling out r217156.
2652
2653         This change broke the iOS build.
2654
2655         Reverted changeset:
2656
2657         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
2658         result registers."
2659         https://bugs.webkit.org/show_bug.cgi?id=172383
2660         http://trac.webkit.org/changeset/217156
2661
2662 2017-05-19  Mark Lam  <mark.lam@apple.com>
2663
2664         Add missing exception check.
2665         https://bugs.webkit.org/show_bug.cgi?id=172346
2666         <rdar://problem/32289640>
2667
2668         Reviewed by Geoffrey Garen.
2669
2670         * stress/regress-172346.js: Added.
2671
2672 2017-05-19  Mark Lam  <mark.lam@apple.com>
2673
2674         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2675         https://bugs.webkit.org/show_bug.cgi?id=172383
2676         <rdar://problem/31418651>
2677
2678         Reviewed by Filip Pizlo.
2679
2680         * stress/regress-172383.js: Added.
2681
2682 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
2683
2684         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
2685         https://bugs.webkit.org/show_bug.cgi?id=172369
2686
2687         Reviewed by Mark Lam.
2688
2689         * stress/undecided-concat.js: Added.
2690
2691 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2692
2693         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2694         https://bugs.webkit.org/show_bug.cgi?id=172098
2695
2696         Reviewed by Saam Barati.
2697
2698         * stress/check-sub-class.js: Added.
2699         (shouldBe):
2700         (shouldThrow):
2701         (calling):
2702         (array.forEach):
2703         (i.array.forEach):
2704
2705 2017-05-18  JF Bastien  <jfbastien@apple.com>
2706
2707         WebAssembly: exports is a getter
2708         https://bugs.webkit.org/show_bug.cgi?id=172129
2709
2710         Reviewed by Saam Barati.
2711
2712         Update test to reflect new semantics.
2713
2714         * wasm/js-api/test_basic_api.js:
2715         (const.c.in.constructorProperties.switch):
2716
2717 2017-05-18  Saam Barati  <sbarati@apple.com>
2718
2719         Proxy's [[Get]] passes incorrect receiver
2720         https://bugs.webkit.org/show_bug.cgi?id=164849
2721         <rdar://problem/31767058>
2722
2723         Reviewed by Yusuke Suzuki.
2724
2725         * stress/proxy-get-set-correct-receiver.js: Added.
2726         (assert):
2727         (test):
2728         (test.let.target.set prop):
2729         (test.let.target.get prop):
2730         (test.get let):
2731         * stress/proxy-set.js:
2732         (let.target.get x):
2733         * stress/reflect-set-proxy-set.js:
2734         (let.target.get x):
2735         * stress/reflect-set-receiver-proxy-set.js:
2736         (let.target.get x):
2737
2738 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2739
2740         Constructor calls set this too early
2741         https://bugs.webkit.org/show_bug.cgi?id=172302
2742
2743         Reviewed by Saam Barati.
2744         
2745         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
2746         wrong.
2747
2748         * stress/construct-overwritten-variable.js: Added.
2749         (new.x.x):
2750         * stress/construct-spread-overwritten-variable-2.js: Added.
2751         (new.x.x):
2752         * stress/construct-spread-overwritten-variable.js: Added.
2753         (new.x.x):
2754
2755 2017-05-18  Saam Barati  <sbarati@apple.com>
2756
2757         WebAssembly: perform stack checks
2758         https://bugs.webkit.org/show_bug.cgi?id=165546
2759         <rdar://problem/29760307>
2760
2761         Reviewed by Filip Pizlo.
2762
2763         * wasm.yaml:
2764         * wasm/function-tests/factorial.js:
2765         * wasm/function-tests/float-sub.js:
2766         * wasm/function-tests/stack-overflow.js: Added.
2767         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2768         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2769         (assertOverflows.makeInstance):
2770         (assertOverflows.makeInstance2):
2771         (assertOverflows.assertThrows):
2772         (assertOverflows):
2773         (assertThrows.test.makeSignature):
2774         (assertThrows.test.makeInstance):
2775         (assertThrows.test):
2776         (assertThrows):
2777
2778 2017-05-18  Keith Miller  <keith_miller@apple.com>
2779
2780         WebAssembly API: test with neutered inputs
2781         https://bugs.webkit.org/show_bug.cgi?id=163899
2782
2783         Reviewed by JF Bastien.
2784
2785         * wasm/js-api/neutered-inputs.js: Added.
2786         (const.testFunction):
2787         (const.testConstructor):
2788         * wasm/js-api/test_basic_api.js:
2789         (const.c.in.constructorProperties.switch):
2790
2791 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2792
2793         DFG inlining should be hardened for the no-result case
2794         https://bugs.webkit.org/show_bug.cgi?id=172290
2795
2796         Reviewed by Saam Barati.
2797
2798         * stress/array-constructor-no-result.js: Added.
2799         (foo):
2800         * stress/pow-no-result.js: Added.
2801         (foo):
2802
2803 2017-05-18  Commit Queue  <commit-queue@webkit.org>
2804
2805         Unreviewed, rolling out r217031, r217032, and r217037.
2806         https://bugs.webkit.org/show_bug.cgi?id=172293
2807
2808         cause linking errors in Windows (Requested by yusukesuzuki on
2809         #webkit).
2810
2811         Reverted changesets:
2812
2813         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
2814         https://bugs.webkit.org/show_bug.cgi?id=172098
2815         http://trac.webkit.org/changeset/217031
2816
2817         "Unreviewed, rebaseline for newly added ClassInfo"
2818         https://bugs.webkit.org/show_bug.cgi?id=172098
2819         http://trac.webkit.org/changeset/217032
2820
2821         "Unreviewed, fix debug and non-JIT build"
2822         https://bugs.webkit.org/show_bug.cgi?id=172098
2823         http://trac.webkit.org/changeset/217037
2824
2825 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2826
2827         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2828         https://bugs.webkit.org/show_bug.cgi?id=172098
2829
2830         Reviewed by Saam Barati.
2831
2832         * stress/check-sub-class.js: Added.
2833         (shouldBe):
2834         (shouldThrow):
2835         (calling):
2836         (array.forEach):
2837         (i.array.forEach):
2838
2839 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2840
2841         Unreviewed, address mlam's review feedback.
2842
2843         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
2844
2845 2017-05-17  Saam Barati  <sbarati@apple.com>
2846
2847         We don't do context switches for Wasm->Wasm call indirect
2848         https://bugs.webkit.org/show_bug.cgi?id=172188
2849         <rdar://problem/32231828>
2850
2851         Reviewed by Keith Miller.
2852
2853         * wasm/function-tests/context-switch.js: Added.
2854         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2855         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
2856         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
2857         (makeInstance):
2858         (makeInstance2):
2859         (assert.eq.makeInstance):
2860         (assert.eq.makeInstance2):
2861         (assert.eq):
2862
2863 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2864
2865         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
2866         https://bugs.webkit.org/show_bug.cgi?id=172208
2867
2868         Reviewed by Saam Barati.
2869
2870         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
2871         (foo):
2872         (bar):
2873         (baz):
2874
2875 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2876
2877         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
2878         https://bugs.webkit.org/show_bug.cgi?id=172115
2879
2880         Reviewed by Saam Barati.
2881
2882         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
2883         (shouldBe):
2884         (unknown):
2885         (readWord1):
2886         (readWord2):
2887         (readWord3):
2888         (readWord4):
2889
2890 2017-05-16  JF Bastien  <jfbastien@apple.com>
2891
2892         WebAssembly: add memory fuzzer
2893         https://bugs.webkit.org/show_bug.cgi?id=169976
2894         <rdar://problem/31965328>
2895
2896         Reviewed by Keith Miller.
2897
2898         * wasm/fuzz/memory.js: Added.
2899         (const.insert):
2900         (const.action.string_appeared_here):
2901         (const.performAction):
2902         (catch):
2903
2904 2017-05-16  JF Bastien  <jfbastien@apple.com>
2905
2906         WebAssembly: validate load / store alignment
2907         https://bugs.webkit.org/show_bug.cgi?id=168836
2908         <rdar://problem/31965349>
2909
2910         Reviewed by Keith Miller.
2911
2912         * wasm/WASM.js: fix regular expression greed
2913         * wasm/function-tests/memory-alignment.js: Added.
2914         (const.op.of.WASM.opcodes):
2915         * wasm/wasm.json: fix formatting
2916
2917 2017-05-15  Mark Lam  <mark.lam@apple.com>
2918
2919         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
2920         https://bugs.webkit.org/show_bug.cgi?id=172147
2921
2922         Rubber-stamped by Saam Barati.
2923
2924         * stress/object-rest-deconstruct.js: Removed.
2925         * stress/object-spread.js: Removed.
2926
2927 2017-05-11  JF Bastien  <jfbastien@apple.com>
2928
2929         WebAssembly: stop supporting 0xD
2930         https://bugs.webkit.org/show_bug.cgi?id=168788
2931         <rdar://problem/31880922>
2932
2933         Reviewed by Saam Barati.
2934
2935         Test that only version 1 is supported.
2936
2937         * wasm/js-api/version.js: Added.
2938
2939 2017-05-10  JF Bastien  <jfbastien@apple.com>
2940
2941         WebAssemby: builder doesn't do Memory section maximum correctly
2942         https://bugs.webkit.org/show_bug.cgi?id=171931
2943
2944         Reviewed by Keith Miller.
2945
2946         * wasm/Builder.js:
2947         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
2948         * wasm/Builder_WebAssemblyBinary.js:
2949         (const.emitters.Memory):
2950         * wasm/function-tests/memory-grow-invalid.js: Added.
2951
2952 2017-05-10  JF Bastien  <jfbastien@apple.com>
2953
2954         WebAssembly: support name section
2955         https://bugs.webkit.org/show_bug.cgi?id=171263
2956
2957         Reviewed by Keith Miller.
2958
2959         * wasm/function-tests/nameSection.js: Added.
2960         (const.compile):
2961         * wasm/function-tests/nameSection.wasm: Added.
2962         * wasm/function-tests/stack-trace.js: Update format
2963
2964 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
2965
2966         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
2967         https://bugs.webkit.org/show_bug.cgi?id=171801
2968
2969         Reviewed by Michael Saboff.
2970         
2971         These tests used to crash. The prefix and postfix tests cover different paths, except
2972         postfix-ignored goes down the same path as prefix due to an optimization.
2973
2974         * stress/for-in-postfix-ignored-index.js: Added.
2975         (foo):
2976         * stress/for-in-postfix-index.js: Added.
2977         (foo):
2978         * stress/for-in-prefix-index.js: Added.
2979         (foo):
2980
2981 2017-05-08  Mark Lam  <mark.lam@apple.com>
2982
2983         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
2984         https://bugs.webkit.org/show_bug.cgi?id=171786
2985         <rdar://problem/32051023>
2986
2987         Reviewed by Saam Barati.
2988
2989         * stress/bug-171786.js: Added.
2990
2991 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2992
2993         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
2994         https://bugs.webkit.org/show_bug.cgi?id=171543
2995
2996         Reviewed by Saam Barati.
2997
2998         * stress/arrowfunction-lexical-bind-supercall-4.js:
2999         (J):
3000         (K):
3001
3002 2017-05-05  Saam Barati  <sbarati@apple.com>
3003
3004         putDirectIndex does not properly do defineOwnProperty
3005         https://bugs.webkit.org/show_bug.cgi?id=171591
3006         <rdar://problem/31735695>
3007
3008         Reviewed by Geoffrey Garen.
3009
3010         * stress/array-prototype-splice-making-typed-array.js:
3011         (test):
3012         * stress/array-species-config-array-constructor.js:
3013         (shouldThrow):
3014         (test):
3015         * stress/put-direct-index-broken-2.js: Added.
3016         (assert):
3017         (test):
3018         (makeLengthWritable):
3019         (set get restoreOldDesc):
3020         * stress/put-direct-index-broken.js: Added.
3021         (whatToTest):
3022         (tryRunning):
3023         (tryItOut):
3024         * stress/put-indexed-getter-setter.js: Added.
3025         (foo.X.prototype.set 7):
3026         (foo.X.prototype.get 7):
3027         (foo.X):
3028         (foo):
3029
3030 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
3031
3032         [JSC] Math unary functions should be handled by DFG
3033         https://bugs.webkit.org/show_bug.cgi?id=171269
3034
3035         Reviewed by Saam Barati.
3036
3037         * stress/arith-acos-on-various-types.js: Added.
3038         (let.validInputTypedTestCases.validInputTestCases.map):
3039         (isIdentical):
3040         (opaqueACosNoArgument):
3041         (testNoArgument):
3042         (opaqueAllTypesACos):
3043         (testAllTypesCall):
3044         (testSingleTypeCall):
3045         (testConstant):
3046         (opaqueACosForSideEffects):
3047         (testSideEffect.let.testObject.valueOf):
3048         (testSideEffect):
3049         (opaqueACosForCSE):
3050         (testCSE.let.testObject.valueOf):
3051         (testCSE):
3052         (opaqueACosForDCE):
3053         (testDCE.let.testObject.valueOf):
3054         (testDCE):
3055         (testException.opaqueACosWithException):
3056         (testException):
3057         * stress/arith-acosh-on-various-types.js: Added.
3058         (let.validInputTypedTestCases.validInputTestCases.map):
3059         (isIdentical):
3060         (opaqueACoshNoArgument):
3061         (testNoArgument):
3062         (opaqueAllTypesACosh):
3063         (testAllTypesCall):
3064         (testSingleTypeCall):
3065         (testConstant):
3066         (opaqueACoshForSideEffects):
3067         (testSideEffect.let.testObject.valueOf):
3068         (testSideEffect):
3069         (opaqueACoshForCSE):
3070         (testCSE.let.testObject.valueOf):
3071         (testCSE):
3072         (opaqueACoshForDCE):
3073         (testDCE.let.testObject.valueOf):
3074         (testDCE):
3075         (testException.opaqueACoshWithException):
3076         (testException):
3077         * stress/arith-asin-on-various-types.js: Added.
3078         (let.validInputTypedTestCases.validInputTestCases.map):
3079         (isIdentical):
3080         (opaqueASinNoArgument):
3081         (testNoArgument):
3082         (opaqueAllTypesASin):
3083         (testAllTypesCall):
3084         (testSingleTypeCall):
3085         (testConstant):
3086         (opaqueASinForSideEffects):
3087         (testSideEffect.let.testObject.valueOf):
3088         (testSideEffect):
3089         (opaqueASinForCSE):
3090         (testCSE.let.testObject.valueOf):
3091         (testCSE):
3092         (opaqueASinForDCE):
3093         (testDCE.let.testObject.valueOf):
3094         (testDCE):
3095         (testException.opaqueASinWithException):
3096         (testException):
3097         * stress/arith-asinh-on-various-types.js: Added.
3098         (let.validInputTypedTestCases.validInputTestCases.map):
3099         (isIdentical):
3100         (opaqueASinhNoArgument):
3101         (testNoArgument):
3102         (opaqueAllTypesASinh):
3103         (testAllTypesCall):
3104         (testSingleTypeCall):
3105         (testConstant):
3106         (opaqueASinhForSideEffects):
3107         (testSideEffect.let.testObject.valueOf):
3108         (testSideEffect):
3109         (opaqueASinhForCSE):
3110         (testCSE.let.testObject.valueOf):
3111         (testCSE):
3112         (opaqueASinhForDCE):
3113         (testDCE.let.testObject.valueOf):
3114         (testDCE):
3115         (testException.opaqueASinhWithException):
3116         (testException):
3117         * stress/arith-atan-on-various-types.js: Added.
3118         (let.validInputTypedTestCases.validInputTestCases.map):
3119         (isIdentical):
3120         (opaqueATanNoArgument):
3121         (testNoArgument):
3122         (opaqueAllTypesATan):
3123         (testAllTypesCall):
3124         (testSingleTypeCall):
3125         (testConstant):
3126         (opaqueATanForSideEffects):
3127         (testSideEffect.let.testObject.valueOf):
3128         (testSideEffect):
3129         (opaqueATanForCSE):
3130         (testCSE.let.testObject.valueOf):
3131         (testCSE):
3132         (opaqueATanForDCE):
3133         (testDCE.let.testObject.valueOf):
3134         (testDCE):
3135         (testException.opaqueATanWithException):
3136         (testException):
3137         * stress/arith-atanh-on-various-types.js: Added.
3138         (let.validInputTypedTestCases.validInputTestCases.map):
3139         (isIdentical):
3140         (opaqueATanhNoArgument):
3141         (testNoArgument):
3142         (opaqueAllTypesATanh):
3143         (testAllTypesCall):
3144         (testSingleTypeCall):
3145         (testConstant):
3146         (opaqueATanhForSideEffects):
3147         (testSideEffect.let.testObject.valueOf):
3148         (testSideEffect):
3149         (opaqueATanhForCSE):
3150         (testCSE.let.testObject.valueOf):
3151         (testCSE):
3152         (opaqueATanhForDCE):
3153         (testDCE.let.testObject.valueOf):
3154         (testDCE):
3155         (testException.opaqueATanhWithException):
3156         (testException):
3157         * stress/arith-cbrt-on-various-types.js: Added.
3158         (let.validInputTypedTestCases.validInputTestCases.map):
3159         (isIdentical):
3160         (opaqueCbrtNoArgument):
3161         (testNoArgument):
3162         (opaqueAllTypesCbrt):
3163         (testAllTypesCall):
3164         (testSingleTypeCall):
3165         (testConstant):
3166         (opaqueCbrtForSideEffects):
3167         (testSideEffect.let.testObject.valueOf):
3168         (testSideEffect):
3169         (opaqueCbrtForCSE):
3170         (testCSE.let.testObject.valueOf):
3171         (testCSE):
3172         (opaqueCbrtForDCE):
3173         (testDCE.let.testObject.valueOf):
3174         (testDCE):
3175         (testException.opaqueCbrtWithException):
3176         (testException):
3177         * stress/arith-cosh-on-various-types.js: Added.
3178         (let.validInputTypedTestCases.validInputTestCases.map):
3179         (isIdentical):
3180         (opaqueCoshNoArgument):
3181         (testNoArgument):
3182         (opaqueAllTypesCosh):
3183         (testAllTypesCall):
3184         (testSingleTypeCall):
3185         (testConstant):
3186         (opaqueCoshForSideEffects):
3187         (testSideEffect.let.testObject.valueOf):
3188         (testSideEffect):
3189         (opaqueCoshForCSE):
3190         (testCSE.let.testObject.valueOf):
3191         (testCSE):
3192         (opaqueCoshForDCE):
3193         (testDCE.let.testObject.valueOf):
3194         (testDCE):
3195         (testException.opaqueCoshWithException):
3196         (testException):
3197         * stress/arith-expm1-on-various-types.js: Added.
3198         (let.validInputTypedTestCases.validInputTestCases.map):
3199         (isIdentical):
3200         (opaqueExpm1NoArgument):
3201         (testNoArgument):
3202         (opaqueAllTypesExpm1):
3203         (testAllTypesCall):
3204         (testSingleTypeCall):
3205         (testConstant):
3206         (opaqueExpm1ForSideEffects):
3207         (testSideEffect.let.testObject.valueOf):
3208         (testSideEffect):
3209         (opaqueExpm1ForCSE):
3210         (testCSE.let.testObject.valueOf):
3211         (testCSE):
3212         (opaqueExpm1ForDCE):
3213         (testDCE.let.testObject.valueOf):
3214         (testDCE):
3215         (testException.opaqueExpm1WithException):
3216         (testException):
3217         * stress/arith-log10-on-various-types.js: Added.
3218         (let.validInputTypedTestCases.validInputTestCases.map):
3219         (isIdentical):
3220         (opaqueLog10NoArgument):
3221         (testNoArgument):
3222         (opaqueAllTypesLog10):
3223         (testAllTypesCall):
3224         (testSingleTypeCall):
3225         (testConstant):
3226         (opaqueLog10ForSideEffects):
3227         (testSideEffect.let.testObject.valueOf):
3228         (testSideEffect):
3229         (opaqueLog10ForCSE):
3230         (testCSE.let.testObject.valueOf):
3231         (testCSE):
3232         (opaqueLog10ForDCE):
3233         (testDCE.let.testObject.valueOf):
3234         (testDCE):
3235         (testException.opaqueLog10WithException):
3236         (testException):
3237         * stress/arith-log2-on-various-types.js: Added.
3238         (let.validInputTypedTestCases.validInputTestCases.map):
3239         (isIdentical):
3240         (opaqueLog2NoArgument):
3241         (testNoArgument):
3242         (opaqueAllTypesLog2):
3243         (testAllTypesCall):
3244         (testSingleTypeCall):
3245         (testConstant):
3246         (opaqueLog2ForSideEffects):
3247         (testSideEffect.let.testObject.valueOf):
3248         (testSideEffect):
3249         (opaqueLog2ForCSE):
3250         (testCSE.let.testObject.valueOf):
3251         (testCSE):
3252         (opaqueLog2ForDCE):
3253         (testDCE.let.testObject.valueOf):
3254         (testDCE):
3255         (testException.opaqueLog2WithException):
3256         (testException):
3257         * stress/arith-sinh-on-various-types.js: Added.
3258         (let.validInputTypedTestCases.validInputTestCases.map):
3259         (isIdentical):
3260         (opaqueSinhNoArgument):
3261         (testNoArgument):
3262         (opaqueAllTypesSinh):
3263         (testAllTypesCall):
3264         (testSingleTypeCall):
3265         (testConstant):
3266         (opaqueSinhForSideEffects):
3267         (testSideEffect.let.testObject.valueOf):
3268         (testSideEffect):
3269         (opaqueSinhForCSE):
3270         (testCSE.let.testObject.valueOf):
3271         (testCSE):
3272         (opaqueSinhForDCE):
3273         (testDCE.let.testObject.valueOf):
3274         (testDCE):
3275         (testException.opaqueSinhWithException):
3276         (testException):
3277         * stress/arith-tan-on-various-types.js:
3278         (isIdentical):
3279         * stress/arith-tanh-on-various-types.js: Added.
3280         (let.validInputTypedTestCases.validInputTestCases.map):
3281         (isIdentical):
3282         (opaqueTanhNoArgument):
3283         (testNoArgument):
3284         (opaqueAllTypesTanh):
3285         (testAllTypesCall):
3286         (testSingleTypeCall):
3287         (testConstant):
3288         (opaqueTanhForSideEffects):
3289         (testSideEffect.let.testObject.valueOf):
3290         (testSideEffect):
3291         (opaqueTanhForCSE):
3292         (testCSE.let.testObject.valueOf):
3293         (testCSE):
3294         (opaqueTanhForDCE):
3295         (testDCE.let.testObject.valueOf):
3296         (testDCE):
3297         (testException.opaqueTanhWithException):
3298         (testException):
3299
3300 2017-05-03  Keith Miller  <keith_miller@apple.com>
3301
3302         Array.prototype.sort should also allow a null comparator
3303         https://bugs.webkit.org/show_bug.cgi?id=171621
3304
3305         Reviewed by Michael Saboff.
3306
3307         Add test to make it less likely we revert to the incompatable behavior.
3308         Also, fix now incorrect tests.
3309
3310         * ChakraCore/test/Array/array_sort.baseline-jsc:
3311         * stress/array-sort-bad-comparator.js:
3312         (test):
3313         * stress/sort-null-comparator.js: Added.
3314         (assertEq):
3315
3316 2017-05-03  Caitlin Potter  <caitp@igalia.com>
3317
3318         [JSC] remove unneeded asyncFunctionTests.yaml
3319         https://bugs.webkit.org/show_bug.cgi?id=171611
3320
3321         Reviewed by Yusuke Suzuki.
3322
3323         Async functions have shipped, and those tests are run as part of
3324         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
3325
3326         * asyncFunctionTests.yaml: Removed.
3327         * stress/async-await-long-loop.js:
3328         * stress/async-await-throw-loop.js:
3329
3330 2017-05-03  Keith Miller  <keith_miller@apple.com>
3331
3332         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
3333         https://bugs.webkit.org/show_bug.cgi?id=47825
3334
3335         Reviewed by Saam Barati.
3336
3337         * stress/sorting-boolean-result-comparator.js: Added.
3338         (checkArray):
3339
3340 2017-05-02  David Kilzer  <ddkilzer@apple.com>
3341
3342         check-webkit-style should keep JavaScript test functions in sync
3343         <https://webkit.org/b/171424>
3344
3345         Reviewed by Joseph Pecoraro.
3346
3347         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
3348         and shouldThrow() in sync with other copies of these methods.
3349
3350         * stress/resources/standalone-pre.js:
3351         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
3352         variables with underscore.
3353         (shouldThrow): Fix whitespace.
3354
3355 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3356
3357         We initialize functions too early in an eval
3358         https://bugs.webkit.org/show_bug.cgi?id=161099
3359
3360         Reviewed by Saam Barati.
3361
3362         * stress/eval-func-decl-with-let-const-class.js: Added.
3363
3364 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3365
3366         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3367         https://bugs.webkit.org/show_bug.cgi?id=163208
3368
3369         Reviewed by Saam Barati.
3370
3371         * stress/eval-func-decl-block-scoping-reassign.js: Added.
3372         (assert):
3373         (throw.new.Error.f):
3374         (throw.new.Error):
3375         * stress/eval-func-decl-block-with-remove.js: Added.
3376         (assert):
3377         (foo.boo):
3378         (foo):
3379         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3380         (assert):
3381         (assertThrow):
3382         (foo):
3383         (boo):
3384         (joo):
3385         (koo):
3386         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3387         (assert):
3388         (assertThrow):
3389         (foo):
3390         (boo):
3391         (hoo):
3392         (joo):
3393         (koo):
3394         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3395         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3396         (assert):
3397         (assertThrow):
3398         (foo):
3399         (boo):
3400         (goo):
3401         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3402         (assert):
3403         (assertThrow):
3404         (foo):
3405         (boo):
3406         (boo.let.val2):
3407         (boo.let.val3):
3408         * stress/eval-func-decl-in-frozen-global.js: Added.
3409         (assert):
3410         (assertThrow):
3411         (throw.new.Error):
3412         (Object.freeze):
3413         * stress/eval-func-decl-in-global-of-eval.js: Added.
3414         (assert):
3415         (assertThrow):
3416         (bar):
3417         (baz):
3418         (foobar):
3419         * stress/eval-func-decl-in-global.js: Added.
3420         (assert):
3421         (assertThrow):
3422         * stress/eval-func-decl-in-if.js: Added.
3423         (assert):
3424         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3425         (assert):
3426         (assertThrow):
3427         (foo):
3428         (boo):
3429         (foobar):
3430         (hoo):
3431         (joo):
3432         (koo):
3433         (loo):
3434         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3435         (assert):
3436         (assertThrow):
3437         (foo):
3438         (boo):
3439         (goo):
3440         * stress/variable-under-tdz-eval-tricky.js:
3441         (assert):
3442         * test262.yaml:
3443
3444 2017-04-27  Mark Lam  <mark.lam@apple.com>
3445
3446         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
3447         https://bugs.webkit.org/show_bug.cgi?id=171404
3448         <rdar://problem/31876178>
3449
3450         Reviewed by Saam Barati.
3451
3452         * stress/js-fixed-array-out-of-memory.js: Added.
3453
3454 2017-04-27  David Kilzer  <ddkilzer@apple.com>
3455
3456         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
3457         <https://webkit.org/b/171362>
3458         <rdar://problem/31867686>
3459
3460         Reviewed by Joseph Pecoraro.
3461
3462         * stress/resources/standalone-pre.js:
3463         (shouldBe):
3464         (shouldNotThrow):
3465         (shouldThrow):
3466         - Update shouldBe() to accept anonymous function arguments.
3467           (The shouldNotBe() function was never copied over.)
3468         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
3469           function arguments (which were missed in r202609 for Bug
3470           159232).
3471
3472 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3473
3474         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
3475         https://bugs.webkit.org/show_bug.cgi?id=171262
3476
3477         Reviewed by Saam Barati.
3478
3479         * stress/spread-outer-create-rest.js: Added.
3480         (assert):
3481         (foo):
3482         (bar):
3483         (baz):
3484
3485 2017-04-26  Saam Barati  <sbarati@apple.com>
3486
3487         Print Wasm function index in stack trace
3488         https://bugs.webkit.org/show_bug.cgi?id=171349
3489
3490         Reviewed by JF Bastien.
3491
3492         * wasm/function-tests/stack-trace.js: Added.
3493         (import.Builder.from.string_appeared_here.assert):
3494         (let.imp):
3495         * wasm/function-tests/trap-after-cross-instance-call.js:
3496         (wasmFrameCountFromError):
3497         * wasm/function-tests/trap-load-2.js:
3498         (wasmFrameCountFromError):
3499         * wasm/function-tests/trap-load.js:
3500         (wasmFrameCountFromError):
3501
3502 2017-04-26  Saam Barati  <sbarati@apple.com>
3503
3504         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
3505         https://bugs.webkit.org/show_bug.cgi?id=170924
3506         <rdar://problem/31721052>
3507
3508         Reviewed by Mark Lam.
3509
3510         * stress/error-message-for-function-base-not-found.js: Added.
3511         (assert):
3512         (throw.new.Error):
3513         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
3514         (catch):
3515
3516 2017-04-26  Keith Miller  <keith_miller@apple.com>
3517
3518         WebAssembly: Implement tier up
3519         https://bugs.webkit.org/show_bug.cgi?id=170134
3520
3521         Reviewed by Filip Pizlo.
3522
3523         * wasm/function-tests/trap-after-cross-instance-call.js:
3524         * wasm/tier-up/js-to-wasm.js: Added.
3525         (async.test):
3526         * wasm/tier-up/wasm-to-wasm.js: Added.
3527         (async.test):
3528
3529 2017-04-26  Caitlin Potter  <caitp@igalia.com>
3530
3531         [JSC] Object.keys() must discard property names with no PropertyDescriptor
3532         https://bugs.webkit.org/show_bug.cgi?id=171291
3533
3534         Reviewed by Yusuke Suzuki.
3535
3536         * es6/Proxy_ownKeys_duplicates.js:
3537         * stress/proxy-own-keys.js:
3538         (let.handler.getOwnPropertyDescriptor):
3539         (let.handler.ownKeys):
3540
3541 2017-04-25  Commit Queue  <commit-queue@webkit.org>
3542
3543         Unreviewed, rolling out r215476.
3544         https://bugs.webkit.org/show_bug.cgi?id=171304
3545
3546         "It broke JSBench" (Requested by saamyjoon on #webkit).
3547
3548         Reverted changeset:
3549
3550         "[ES6]. Implement Annex B.3.3 function hoisting rules for
3551         eval"
3552         https://bugs.webkit.org/show_bug.cgi?id=163208
3553         http://trac.webkit.org/changeset/215476
3554
3555 2017-04-25  Saam Barati  <sbarati@apple.com>
3556
3557         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
3558         https://bugs.webkit.org/show_bug.cgi?id=171150
3559         <rdar://problem/31771880>
3560
3561         Reviewed by Sam Weinig.
3562
3563         * stress/spread-optimized-properly.js: Added.
3564         (assert):
3565         (test):
3566         (shallowEq):
3567         (makeArrayIterator):
3568         (test.bar):
3569         (test.callback):
3570         (test.arr.__proto__.Symbol.iterator):
3571         (test.arr.Symbol.iterator):
3572         (test.get bar):
3573         (test.hackedNext):
3574         (test.test):
3575         (test.):
3576
3577 2017-04-25  Mark Lam  <mark.lam@apple.com>
3578
3579         [Follow up] Array.prototype.slice() should ensure that end >= begin.
3580         https://bugs.webkit.org/show_bug.cgi?id=170989
3581         <rdar://problem/31705652>
3582
3583         Not reviewed.
3584
3585         Follow up to rename a test file that was accidentally named wrongly.
3586
3587         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
3588         * stress/regress-170989.patch: Removed.
3589
3590 2017-04-25  Mark Lam  <mark.lam@apple.com>
3591
3592         Array.prototype.slice() should ensure that end >= begin.
3593         https://bugs.webkit.org/show_bug.cgi?id=170989
3594         <rdar://problem/31705652>
3595
3596         Reviewed by Saam Barati.
3597
3598         * stress/regress-170989.patch: Added.
3599
3600 2017-04-25  Mark Lam  <mark.lam@apple.com>
3601
3602         Local CSE wrongly CSEs array accesses with different result types.
3603         https://bugs.webkit.org/show_bug.cgi?id=170990
3604         <rdar://problem/31705945>
3605
3606         Reviewed by Saam Barati.
3607
3608         * stress/regress-170990.js: Added.
3609
3610 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3611
3612         WebAssembly: exporting a property with a name that's a number doesn't work
3613         https://bugs.webkit.org/show_bug.cgi?id=168857
3614
3615         Reviewed by JF Bastien.
3616
3617         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
3618
3619         * wasm/js-api/test_Instance.js:
3620         (ExportedNumber):
3621
3622 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3623
3624         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
3625         https://bugs.webkit.org/show_bug.cgi?id=171190
3626
3627         Reviewed by Saam Barati.
3628
3629         * stress/async-await-syntax.js:
3630         * test262.yaml:
3631
3632 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3633
3634         [JSC] Use JSFixedArray directly when using call_varargs
3635         https://bugs.webkit.org/show_bug.cgi?id=171057
3636
3637         Reviewed by Saam Barati.
3638
3639         * stress/spread-capture-rest.js: Added.
3640         (shouldBe):
3641         (capture):
3642         (a):
3643         (b):
3644         * stress/spread-multi-layers.js: Added.
3645         (shouldBe):
3646         (a):
3647         (b):
3648         (c):
3649         (d):
3650         * stress/spread-non-varargs.js: Added.
3651         (shouldBe):
3652         (a):
3653         (b):
3654
3655 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3656
3657         test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
3658         https://bugs.webkit.org/show_bug.cgi?id=170897
3659
3660         Reviewed by Saam Barati.
3661
3662         * test262.yaml:
3663
3664 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3665
3666         Address some FIXMEs in JavaScript tests for bugs that have been fixed
3667         https://bugs.webkit.org/show_bug.cgi?id=171191
3668
3669         Reviewed by JF Bastien.
3670
3671         * stress/proxy-is-extensible.js:
3672
3673 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3674
3675         test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
3676         https://bugs.webkit.org/show_bug.cgi?id=171160
3677
3678         Reviewed by JF Bastien.
3679
3680         * stress/inferred-names.js:
3681         * test262.yaml:
3682
3683 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3684
3685         test262: test262/test/language/expressions/generators/yield-as-label.js
3686         https://bugs.webkit.org/show_bug.cgi?id=170979
3687
3688         Reviewed by Saam Barati.
3689
3690         * stress/async-await-module-reserved-word.js:
3691         * stress/async-await-reserved-word.js:
3692         Converge on "Cannot" instead of "Can't".
3693
3694         * catch-parameter-syntax.js:
3695         * yield-named-variable-generator.js:
3696         * yield-named-variable.js:
3697         * stress/yield-label-generator.js:
3698         * stress/yield-label.js:
3699         * stress/yield-reserved-word.js: Added.
3700         More complete list of when 'yield' is allowed.
3701
3702         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3703         * test262.yaml:
3704
3705 2017-04-23  Commit Queue  <commit-queue@webkit.org>
3706
3707         Unreviewed, rolling out r215674.
3708         https://bugs.webkit.org/show_bug.cgi?id=171212
3709
3710         Possible unintended commit. This patch was on the wrong bug.
3711         (Requested by JoePeck on #webkit).
3712
3713         Reverted changeset:
3714
3715         "test262: test262/test/language/expressions/generators/yield-
3716         as-label.js"
3717         https://bugs.webkit.org/show_bug.cgi?id=170979
3718         http://trac.webkit.org/changeset/215674
3719
3720 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3721
3722         test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
3723         https://bugs.webkit.org/show_bug.cgi?id=171197
3724
3725         Reviewed by Saam Barati.
3726
3727         * test262.yaml:
3728
3729 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3730
3731         test262: test262/test/language/expressions/generators/yield-as-label.js
3732         https://bugs.webkit.org/show_bug.cgi?id=170979
3733
3734         Reviewed by Saam Barati.
3735
3736         * stress/async-await-module-reserved-word.js:
3737         * stress/async-await-reserved-word.js:
3738         Converge on "Cannot" instead of "Can't".
3739
3740         * catch-parameter-syntax.js:
3741         * yield-named-variable-generator.js:
3742         * yield-named-variable.js:
3743         * stress/yield-label-generator.js:
3744         * stress/yield-label.js:
3745         * stress/yield-reserved-word.js: Added.
3746         More complete list of when 'yield' is allowed.
3747
3748         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3749         * test262.yaml:
3750
3751 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3752
3753         test262: test262/test/built-ins/Number/parseFloat.js
3754         https://bugs.webkit.org/show_bug.cgi?id=171193
3755
3756         Reviewed by Yusuke Suzuki.
3757
3758         * test262.yaml:
3759
3760 2017-04-22  JF Bastien  <jfbastien@apple.com>
3761
3762         WebAssembly: Module.exports, Module.imports, Module.customSections are wrong
3763         https://bugs.webkit.org/show_bug.cgi?id=171078
3764
3765         Reviewed by Saam Barati.
3766
3767         They're static properties of Module, not instance properties of a module.
3768         https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymoduleexports
3769
3770         * wasm/js-api/Module.customSection.js:
3771         (assert.throws.WebAssembly.Module.customSections):
3772         (assert.eq):
3773         (assert.throws.WebAssembly.Module.prototype.customSections): Deleted.
3774         * wasm/js-api/Module.exports.js:
3775         (assert.throws.WebAssembly.Module.exports):
3776         (assert.truthy):
3777         (assert.throws.WebAssembly.Module.prototype.exports): Deleted.
3778         * wasm/js-api/Module.imports.js:
3779         (assert.throws.WebAssembly.Module.imports):
3780         (assert.truthy):
3781         (assert.throws.WebAssembly.Module.prototype.imports): Deleted.
3782
3783 2017-04-21  JF Bastien  <jfbastien@apple.com>
3784
3785         Silence noisy test
3786
3787         Unreviewed, Fil / Michael and I talked about it in the corridor. I
3788         just forgot to set verbose to false before commit.
3789
3790         * wasm/stress/oom.js:
3791
3792 2017-04-20  Yusuke Suzuki  <utatane.tea@gmail.com>
3793
3794         [JSC][FTL] FTL should support Arrayify
3795         https://bugs.webkit.org/show_bug.cgi?id=169596
3796
3797         Reviewed by Saam Barati.
3798
3799         * stress/arrayify.js: Added.
3800         (arrayifyInt32):
3801         (arrayifyDouble):
3802         (arrayifyContiguous):
3803
3804 2017-04-20  Mark Lam  <mark.lam@apple.com>
3805
3806         virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
3807         https://bugs.webkit.org/show_bug.cgi?id=171079
3808         <rdar://problem/31684756>
3809
3810         Reviewed by Saam Barati.
3811
3812         * stress/regress-171079.js: Added.
3813
3814 2017-04-15  Filip Pizlo  <fpizlo@apple.com>
3815
3816         Optimize SharedArrayBuffer in the DFG+FTL
3817         https://bugs.webkit.org/show_bug.cgi?id=164108
3818
3819         Reviewed by Saam Barati.
3820         
3821         Added a fairly comprehensive test of the intrinsics. This creates a function for each possible
3822         combination of type and operation, and then first uses it nicely and then tries a bunch of
3823         erroneous conditions like OOB.
3824
3825         * stress/SharedArrayBuffer-opt.js: Added.
3826         (string_appeared_here.switch):
3827         (string_appeared_here.str):
3828         (runAtomic):
3829         (shouldFail):
3830         (Symbol):
3831         (string_appeared_here.a.of.arrays.m.of.atomics):
3832         * stress/SharedArrayBuffer.js:
3833
3834 2017-04-19  Mark Lam  <mark.lam@apple.com>
3835
3836         B3StackmapSpecial should handle when stackmap values are not recoverable from a Def'ed arg.
3837         https://bugs.webkit.org/show_bug.cgi?id=170973
3838         <rdar://problem/30318657>
3839
3840         Reviewed by Filip Pizlo.
3841
3842         * stress/regress-170973.js: Added.
3843
3844 2017-04-19  JF Bastien  <jfbastien@apple.com>
3845
3846         WebAssembly: limit slow memories
3847         https://bugs.webkit.org/show_bug.cgi?id=170825
3848
3849         Reviewed by Saam Barati.
3850
3851         * wasm.yaml:
3852         * wasm/stress/oom.js: Added.
3853         (try.true.WebAssemblyMemoryMode):
3854         (catch):
3855
3856 2017-04-19  JF Bastien  <jfbastien@apple.com>
3857
3858         WebAssembly: don't expose any WebAssembly JS object if JIT is off
3859         https://bugs.webkit.org/show_bug.cgi?id=170782
3860
3861         Reviewed by Saam Barati.
3862
3863         * wasm.yaml:
3864         * wasm/noJIT/noJIT.js: Added.
3865
3866 2017-04-18  Mark Lam  <mark.lam@apple.com>
3867
3868         r211670 broke double to int conversion.
3869         https://bugs.webkit.org/show_bug.cgi?id=170961
3870         <rdar://problem/31687696>
3871
3872         Reviewed by Yusuke Suzuki.
3873
3874         * microbenchmarks/double-to-int32.js: Added.
3875         * stress/to-int32-sensible2.js: Added.
3876
3877 2017-04-18  Oleksandr Skachkov  <gskachkov@gmail.com>
3878
3879         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3880         https://bugs.webkit.org/show_bug.cgi?id=163208
3881
3882         Reviewed by Saam Barati.
3883
3884         * stress/eval-func-decl-block-scoping-reassign.js: Added.
3885         (assert):
3886         (throw.new.Error.f):
3887         (throw.new.Error):
3888         * stress/eval-func-decl-block-with-remove.js: Added.
3889         (assert):
3890         (foo.boo):
3891         (foo):
3892         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3893         (assert):
3894         (assertThrow):
3895         (foo):
3896         (boo):
3897         (joo):
3898         (koo):
3899         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3900         (assert):
3901         (assertThrow):
3902         (foo):
3903         (boo):
3904         (hoo):
3905         (joo):
3906         (koo):
3907         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3908         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3909         (assert):
3910         (assertThrow):
3911         (foo):
3912         (boo):
3913         (goo):
3914         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3915         (assert):
3916         (assertThrow):
3917         (foo):
3918         (boo):
3919         (boo.let.val2):
3920         (boo.let.val3):
3921         * stress/eval-func-decl-in-frozen-global.js: Added.
3922         (assert):
3923         (assertThrow):
3924         (throw.new.Error):
3925         (Object.freeze):
3926         * stress/eval-func-decl-in-global-of-eval.js: Added.
3927         (assert):
3928         (assertThrow):
3929         (bar):
3930         (baz):
3931         (foobar):
3932         * stress/eval-func-decl-in-global.js: Added.
3933         (assert):
3934         (assertThrow):
3935         * stress/eval-func-decl-in-if.js: Added.
3936         (assert):
3937         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3938         (assert):
3939         (assertThrow):
3940         (foo):
3941         (boo):
3942         (foobar):
3943         (hoo):
3944         (joo):
3945         (koo):
3946         (loo):
3947         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3948         (assert):
3949         (assertThrow):
3950         (foo):
3951         (boo):
3952         (goo):
3953         * stress/variable-under-tdz-eval-tricky.js:
3954         (assert):
3955         * test262.yaml:
3956
3957 2017-04-18  Filip Pizlo  <fpizlo@apple.com>
3958
3959         wasm/function-tests/memory-multiagent times out sometimes
3960         https://bugs.webkit.org/show_bug.cgi?id=170958
3961
3962         Reviewed by Keith Miller.
3963         
3964         Add the ability to skip tests easily. Skip the test.
3965
3966         * wasm.yaml:
3967         * wasm/function-tests/memory-multiagent.js:
3968
3969 2017-04-18  Saam Barati  <sbarati@apple.com>
3970
3971         Follow up to debug build stack overflow in test after r215453
3972
3973         Rubber stamped by Mark Lam.
3974
3975         * stress/call-apply-exponential-bytecode-size.js: Decrease the call
3976         size to prevent stack overflow errors on debug builds.
3977
3978 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3979
3980         [DFG] Convert ValueAdd(Int32, String) => MakeRope(ToString(Int32), String)
3981         https://bugs.webkit.org/show_bug.cgi?id=170943
3982
3983         Reviewed by Geoffrey Garen.
3984
3985         * microbenchmarks/number-to-string-with-add-empty.js: Added.
3986         (toStringLeft):
3987         (toStringRight):
3988         * microbenchmarks/number-to-string-with-add-in-loop.js: Added.
3989         (toStringLeft):
3990         (toStringRight):
3991         * microbenchmarks/number-to-string-with-add.js: Added.
3992         (toStringLeft):
3993         (toStringRight):
3994         * stress/number-to-string-with-add.js: Added.
3995         (shouldBe):
3996         (toStringRight):
3997         (toStringLeftEmpty):
3998         (toStringRightEmpty):
3999
4000 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
4001
4002         [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
4003         https://bugs.webkit.org/show_bug.cgi?id=170940
4004
4005         Reviewed by Filip Pizlo.
4006
4007         * microbenchmarks/for-of-array.js: Added.
4008         (fn):
4009
4010 2017-04-17  Saam Barati  <sbarati@apple.com>
4011
4012         BytecodeGenerator ".call" and ".apply" is exponential in nesting depth
4013         https://bugs.webkit.org/show_bug.cgi?id=139847
4014         <rdar://problem/19321122>
4015
4016         Reviewed by Oliver Hunt.
4017
4018         * stress/call-apply-exponential-bytecode-size.js: Added.
4019         (assert):
4020         (const.inc):
4021         (const.inc2):
4022         (bar):
4023         (randomApplyOrCall):
4024         (baz):
4025         (jaz):
4026         (haz):
4027         (foo):
4028
4029 2017-04-17  Mark Lam  <mark.lam@apple.com>
4030
4031         JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
4032         https://bugs.webkit.org/show_bug.cgi?id=170896
4033         <rdar://problem/31651319>
4034
4035         Reviewed by JF Bastien and Keith Miller.
4036
4037         * stress/regress-170896.js: Added.
4038
4039 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4040
4041         test262: test262/test/built-ins/Object/prototype/toLocaleString/primitive_this_value.js
4042         https://bugs.webkit.org/show_bug.cgi?id=170882
4043
4044         Reviewed by Saam Barati.
4045
4046         * test262.yaml:
4047
4048 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4049
4050         test262: test262/test/built-ins/isNaN/toprimitive-not-callable-throws.js
4051         https://bugs.webkit.org/show_bug.cgi?id=170888
4052
4053         Reviewed by Saam Barati.
4054
4055         * stress/computed-accessor.js:
4056         * stress/eval-in-arrow-function.js:
4057         * stress/rest-elements.js:
4058         * stress/string-object-define-own-property.js:
4059         Remove unused shouldThrow.
4060
4061         * stress/symbol-toprimitive-errors.js: Added.
4062         Check for ToPrimitive TypeErrors.
4063
4064         * test262.yaml:
4065
4066 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4067
4068         test262: test262/test/language/expressions/tagged-template/template-object.js
4069         https://bugs.webkit.org/show_bug.cgi?id=170878
4070
4071         Reviewed by Saam Barati.
4072
4073         * stress/array-length-not-writable.js: Added.
4074         (assert):
4075         * test262.yaml:
4076
4077 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4078
4079         test262: test262/test/built-ins/Object/getOwnPropertyNames/15.2.3.4-4-44.js
4080         https://bugs.webkit.org/show_bug.cgi?id=170879
4081
4082         Reviewed by Saam Barati.
4083
4084         * ChakraCore/test/es5/enumerable.baseline-jsc:
4085         * test262.yaml:
4086
4087 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4088
4089         test262: test262/test/built-ins/Date/prototype/Symbol.toPrimitive/name.js
4090         https://bugs.webkit.org/show_bug.cgi?id=170884
4091
4092         Reviewed by Yusuke Suzuki.
4093
4094         * test262.yaml:
4095
4096 2017-04-15  Joseph Pecoraro  <pecoraro@apple.com>
4097
4098         test262: test262/test/language/global-code/new.target-arrow.js
4099         https://bugs.webkit.org/show_bug.cgi?id=170872
4100
4101         Reviewed by Saam Barati.
4102
4103         * stress/async-arrow-functions-lexical-new.target-binding.js:
4104         (shouldThrowAsync): Deleted.
4105         (shouldThrowAsync.async): Deleted.
4106         This code should have thrown a SyntaxError. Instead it was throwing
4107         a ReferenceError for the internal @newTargetLocal variable.
4108
4109         * stress/new-target-syntax-errors.js:
4110         Cover the arrow function in global code cases.
4111
4112         * ChakraCore.yaml:
4113         * ChakraCore/test/es6/globalLambdaNewTargetSyntaxError.baseline-jsc:
4114         We now pass with an expected SyntaxError. Our error message is different.
4115
4116         * test262.yaml:
4117
4118 2017-04-14  Saam Barati  <sbarati@apple.com>
4119
4120         ParseInt intrinsic in DFG backend doesn't properly flush its operands
4121         https://bugs.webkit.org/show_bug.cgi?id=170865
4122
4123         Reviewed by Mark Lam and Geoffrey Garen.
4124
4125         * stress/parse-int-intrinsic-dfg-backend-flush.js: Added.
4126         (assert):
4127         (foo):
4128
4129 2017-04-14  Caitlin Potter  <caitp@igalia.com>
4130
4131         [JSC] use ExpressionErrorClassifier for AwaitExpression operand
4132         https://bugs.webkit.org/show_bug.cgi?id=170844
4133
4134         Reviewed by Saam Barati.
4135
4136         * stress/regress-170732.js: Added.
4137
4138 2017-04-14  Oleksandr Skachkov  <gskachkov@gmail.com>
4139
4140         Safari 10.1 JSON.parse returns incorrect object for numeric keys with decimal values
4141         https://bugs.webkit.org/show_bug.cgi?id=170442
4142
4143         Reviewed by Yusuke Suzuki.
4144
4145         * stress/object-number-properties.js:
4146
4147 2017-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
4148
4149         [JSC] Date.parse should accept wider range of representation
4150         https://bugs.webkit.org/show_bug.cgi?id=170720
4151
4152         Reviewed by Darin Adler.
4153
4154         * stress/date-relaxed.js: Added.
4155         (shouldBe):
4156         (throw.new.Error):
4157
4158 2017-04-13  Mark Lam  <mark.lam@apple.com>
4159
4160         Should use flushDirect() when flushing the scopeRegister due to needsScopeRegister().
4161         https://bugs.webkit.org/show_bug.cgi?id=170661
4162         <rdar://problem/31579046>
4163
4164         Reviewed by Filip Pizlo.
4165
4166         * stress/regress-170661.js: Added.
4167
4168 2017-04-13  JF Bastien  <jfbastien@apple.com>
4169
4170         WebAssembly: manage memory better
4171         https://bugs.webkit.org/show_bug.cgi?id=170628
4172
4173         Reviewed by Keith Miller, Michael Saboff.
4174
4175         * wasm/Builder.js: move a helper out so tests can use it
4176         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
4177         * wasm/WASM.js: add utilities to classify opcodes
4178         (export.opcodes):
4179         (export.const.memoryAccessInfo.op.const.sign):
4180         * wasm/function-tests/memory-access-past-4gib.js: Added. This test
4181         fails before this patch.
4182         (const.op.of.WASM.opcodes):
4183         * wasm/function-tests/memory-many.js: Added. This simple tests
4184         just shouldn't crash. In verbose mode it's useful at determining
4185         if the GC falls behind or not.
4186         * wasm/function-tests/memory-multiagent.js: Added. Emulate postMessage.
4187         (const.startAgents.numAgentsToStart.a.agent.receiveBroadcast):
4188         (const.startAgents.numAgentsToStart.a.write.const.idx.Math.random):
4189         (const.broadcastToAgents):
4190         * wasm/js-api/extension-MemoryMode.js: verbose logging.
4191         (testMemoryNoMax):
4192         (testMemory):
4193         (testInstanceNoMemory):
4194         (testInstanceNoMax):
4195         (testInstance):
4196         * wasm/utilities.js: move a utility here.
4197
4198 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
4199
4200         test262: test262/test/built-ins/NativeErrors/EvalError/proto.js
4201         https://bugs.webkit.org/show_bug.cgi?id=170668
4202
4203         Reviewed by Keith Miller.
4204
4205         * ChakraCore.yaml:
4206         * ChakraCore/test/Lib/error.baseline-jsc: Added.
4207         This test does not match the spec.
4208
4209         * test262.yaml:
4210
4211 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
4212
4213         test262: test262/test/language/literals/regexp/u-dec-esc.js
4214         https://bugs.webkit.org/show_bug.cgi?id=170687
4215
4216         Reviewed by Michael Saboff.
4217
4218         * test262.yaml:
4219
4220 2017-04-11  Michael Saboff  <msaboff@apple.com>
4221
4222         Implement Object.isFrozen() and Object.isSealed() per ECMA spec
4223         https://bugs.webkit.org/show_bug.cgi?id=170753
4224
4225         Reviewed by Mark Lam.
4226
4227         Added JSC baseline and enabled defineIndexProperty test.
4228
4229         Note that JSC differs from Chakra in that a JSC doesn't use indexed
4230         properties placed on the Array prototype when sorting the indexed 
4231         properties of an Object.  This is behavior is considered undefined
4232         in the standard.
4233
4234         * ChakraCore.yaml:
4235         * ChakraCore/test/es5/defineIndexProperty.baseline-jsc: Added.
4236
4237 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
4238
4239         test262: test262/test/annexB/language/comments/multi-line-html-close.js
4240         https://bugs.webkit.org/show_bug.cgi?id=170648
4241
4242         Reviewed by Keith Miller.
4243
4244         * test262.yaml:
4245
4246 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
4247
4248         test262: test262/test/built-ins/Array/S15.4.3_A2.2.js
4249         https://bugs.webkit.org/show_bug.cgi?id=170652
4250
4251         Reviewed by Michael Saboff.
4252
4253         * stress/native-constructors-length.js: Added.
4254         (assertLengthDescriptorAttributes):
4255         Add a quick test for the length properties of all native constructors.
4256
4257         * ChakraCore/test/es5/enumerable.baseline-jsc:
4258         Rebaseline expectations for this test.
4259
4260         * test262.yaml:
4261
4262 2017-04-10  Keith Miller  <keith_miller@apple.com>
4263
4264         WebAssembly: Update spec tests
4265         https://bugs.webkit.org/show_bug.cgi?id=170683
4266
4267         Rubber-stamped by JF Bastien.
4268
4269         * wasm.yaml:
4270         * wasm/spec-tests/br_table.wast.js:
4271         * wasm/spec-tests/conversions.wast.js: Removed.
4272         * wasm/spec-tests/f32_bitwise.wast.js: Added.
4273         * wasm/spec-tests/f32_cmp.wast.js:
4274         * wasm/spec-tests/f64_bitwise.wast.js: Added.
4275         * wasm/spec-tests/f64_cmp.wast.js:
4276         * wasm/spec-tests/i32.wast.js:
4277         * wasm/spec-tests/i64.wast.js:
4278         * wasm/spec-tests/int_exprs.wast.js:
4279         * wasm/spec-tests/memory.wast.js:
4280
4281 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
4282
4283         test262: test262/test/annexB/language/expressions/object/__proto__-fn-name.js
4284         https://bugs.webkit.org/show_bug.cgi?id=170650
4285
4286         Reviewed by Saam Barati.
4287
4288         * stress/inferred-names.js:
4289         * test262.yaml:
4290
4291 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
4292
4293         test262: test262/test/annexB/language/literals/regexp/identity-escape.js
4294         https://bugs.webkit.org/show_bug.cgi?id=170651
4295
4296         Reviewed by Saam Barati.
4297
4298         * test262.yaml:
4299
4300 2017-04-07  Michael Saboff  <msaboff@apple.com>
4301
4302         Fix and enable ChakraCore/test/es6/ES6Function_bugs.js after r215072
4303         https://bugs.webkit.org/show_bug.cgi?id=170580
4304
4305         Reviewed by JF Bastien.
4306
4307         Commented out subtest that expects defineProperty("length") to a getter on a
4308         sealed function shouldn't throw.
4309
4310         * ChakraCore.yaml:
4311         * ChakraCore/test/es6/ES6Function_bugs.js:
4312
4313 2017-04-06  Michael Saboff  <msaboff@apple.com>
4314
4315         Cannot Object.seal() or Object.freeze() global "this"
4316         https://bugs.webkit.org/show_bug.cgi?id=170549
4317
4318         Reviewed by Mark Lam.
4319
4320         Enabled failing tests fixed by the corresponding code change:
4321             ChakraCore/test/LetConst/delete.js
4322             ChakraCore/test/LetConst/dop.js
4323             ChakraCore/test/LetConst/dop1.js
4324
4325         * ChakraCore.yaml:
4326         * ChakraCore/test/LetConst/dop.baseline-jsc: Added JSC specific expected output.
4327         * ChakraCore/test/LetConst/dop1.baseline-jsc: Added JSC specific expected output.
4328
4329 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
4330
4331         test262: ES2017 test progressions need updated expectations (arguments.caller removed)
4332         https://bugs.webkit.org/show_bug.cgi?id=170536
4333
4334         Reviewed by Mark Lam.
4335
4336         * test262.yaml:
4337         After r208867 the tests are out of date and are now expected to fail.
4338
4339 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
4340
4341         test262: Final rebaseline of existing tests, a few tests have started failing
4342         https://bugs.webkit.org/show_bug.cgi?id=170538
4343
4344         Reviewed by Mark Lam.
4345
4346         * test262.yaml:
4347         These tests started failing a while ago. Mark them as legitmate failures.
4348
4349 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
4350
4351         test262: Rebaseline expectations for now passing tests
4352         https://bugs.webkit.org/show_bug.cgi?id=170532
4353
4354         Reviewed by Ryosuke Niwa.
4355
4356         * test262.yaml:
4357         Update expectations for tests we are now passing.
4358
4359 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
4360
4361         test262: module test progressions need updated expectations (@@iterator changes)
4362         https://bugs.webkit.org/show_bug.cgi?id=170535
4363
4364         Reviewed by Saam Barati.
4365
4366         * test262.yaml:
4367         After r212430 the tests are out of date and are now expected to fail.
4368
4369 2017-04-05  Michael Saboff  <msaboff@apple.com>
4370
4371         Unreviewed rollout of r214642 as the test still intermittently fails.
4372
4373         Disabled ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js.
4374
4375         * ChakraCore.yaml:
4376
4377 2017-04-05  Michael Saboff  <msaboff@apple.com>
4378
4379         REGRESSION (Safari 10.1): Inserting elements into arrays fails when array contains very large numbers
4380         https://bugs.webkit.org/show_bug.cgi?id=170264
4381         <rdar://problem/31375593>
4382
4383         Rubber-stamped by Saam Barati.
4384
4385         The original bug was fixed in: https://trac.webkit.org/changeset/214714
4386         I'm just adding another test for good measure.
4387
4388         * stress/double-array-to-array-storage.js: Added.
4389         (assert):
4390
4391 2017-04-05  Keith Miller  <keith_miller@apple.com>
4392
4393         WebAssembly: We shouldn't need to pin size registers if we have a fast memory.
4394         https://bugs.webkit.org/show_bug.cgi?id=170504
4395
4396         Reviewed by Mark Lam.
4397
4398         * wasm/function-tests/trap-after-cross-instance-call.js: Added.
4399         (b.new.WebAssembly.Memory):
4400         (importObject.foo.bar):
4401         (wasmFrameCountFromError):
4402
4403 2017-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4404
4405         [JSC] Generate TemplateObjects at linking time
4406         https://bugs.webkit.org/show_bug.cgi?id=169743
4407
4408         Reviewed by Keith Miller.
4409
4410         * stress/template-string-tags-eval.js: Added.
4411         (shouldBe):
4412         (tag):
4413
4414 2017-04-04  Mark Lam  <mark.lam@apple.com>
4415
4416         On ARM64, DFG::SpeculativeJIT::compileArithMod() failed to ensure result is of DataFormatInt32.
4417         https://bugs.webkit.org/show_bug.cgi?id=170473
4418         <rdar://problem/29912391>
4419
4420         Reviewed by Saam Barati.
4421
4422         * stress/regress-170473.js: Added.
4423
4424 2017-04-03  Mark Lam  <mark.lam@apple.com>
4425
4426         Fix incorrect capacity delta calculation reported in SparseArrayValueMap::add().
4427         https://bugs.webkit.org/show_bug.cgi?id=170412
4428         <rdar://problem/29697336>
4429
4430         Reviewed by Filip Pizlo.
4431
4432         * stress/regress-170412.js: Added.
4433
4434 2017-04-03  Keith Miller  <keith_miller@apple.com>
4435
4436         WebAssembly: Update spec tests
4437         https://bugs.webkit.org/show_bug.cgi?id=170361
4438
4439         Rubber-stamped by Saam Barati.
4440
4441         Update the spec tests to run tests generated by the newer spec
4442         test builder wasm-spec/test/builder.py. This patch also adds the
4443         necessary harness code in spec-harness.js so we can run the tests.
4444
4445         * wasm.yaml:
4446         * wasm/import-spec-tests.rb:
4447         * wasm/spec-harness.js: Added.
4448         (import.string_appeared_here.then):
4449         (test):
4450         (promise_test):
4451         (let.assert_unreached):
4452         * wasm/spec-harness/index.js: Added.
4453         (let.testNum):
4454         (assertThrows):
4455         (_assert):
4456         (ValueResult):
4457         (ErrorResult):
4458         (Result.prototype.isError):
4459         (binary):
4460         (module):
4461         (uniqueTest):
4462         (assert_invalid):
4463         (assert_soft_invalid):
4464         (register):
4465         (call):
4466         (get instance):
4467         (exports):
4468         (run):
4469         (assert_unlinkable):
4470         (assert_uninstantiable):
4471         (assert_trap):
4472         (try.f):
4473         (catch):
4474         (assert_exhaustion):
4475         (assert_return):
4476         (assert_return_nan):
4477         * wasm/spec-harness/testharness.css: Added.
4478         (html):
4479         (#log .warning,):
4480         (#log .error,):
4481         (section#summary):
4482         (table#results):
4483         (table#results th:first-child,):
4484         (table#results th:last-child,):
4485         (table#results.assertions th:last-child,):
4486         (table#results th):
4487         (table#results td):
4488         (tr.pass > td:first-child):
4489         (tr.fail > td:first-child):
4490         (tr.timeout > td:first-child):
4491         (tr.notrun > td:first-child):
4492         (.pass > td:first-child, .fail > td:first-child, .timeout > td:first-child, .notrun > td:first-child):
4493         (table#results span):