4266d3eaf1d5aa540d626d8faca2335f7a339e38
[WebKit-https.git] / JSTests / ChangeLog
1 2016-12-09  JF Bastien  <jfbastien@apple.com>
2
3         WebAssembly JS API: implement start function
4         https://bugs.webkit.org/show_bug.cgi?id=165150
5
6         Reviewed by Saam Barati.
7
8         * wasm/Builder.js: allow building a .Start()
9         * wasm/Builder_WebAssemblyBinary.js:
10         * wasm/js-api/test_Start.js: Added.
11         (const.emitters.Start): serialize a start section
12         * wasm/self-test/test_BuilderJSON.js: validate the start section's content
13
14 2016-12-09  Saam Barati  <sbarati@apple.com>
15
16         WebAssembly JS API: implement importing and defining Memory
17         https://bugs.webkit.org/show_bug.cgi?id=164134
18
19         Reviewed by Keith Miller.
20
21         * wasm/Builder.js:
22         (const._importMemoryContinuation.section):
23         (const._importMemoryContinuation.assert):
24         (const._importMemoryContinuation):
25         (const._exportFunctionContinuation.const): Deleted.
26         (const._exportFunctionContinuation): Deleted.
27         * wasm/Builder_WebAssemblyBinary.js:
28         (const.emitters.Import):
29         * wasm/js-api/test_basic_api.js:
30         (const.c.in.constructorProperties.switch):
31         * wasm/js-api/test_memory.js: Added.
32         (assert):
33         (binaryShouldNotParse):
34         (test):
35         (test.testMemImportError):
36         * wasm/js-api/test_memory_constructor.js: Added.
37         (assert):
38         (throw.new.Error):
39         (testInvalidSize):
40         (assert.testInvalidInitial):
41         (testInvalidInitial.testInvalidMaximum):
42         (testInvalidInitial):
43         (testInvalidMaximum):
44         * wasm/self-test/test_BuilderJSON.js:
45
46 2016-12-08  JF Bastien  <jfbastien@apple.com>
47
48         WebAssembly: JSC::link* shouldn't need a CodeBlock
49         https://bugs.webkit.org/show_bug.cgi?id=165591
50
51         Reviewed by Keith Miller.
52
53         test that wasm -> JS works, including the IC
54
55         * wasm/js-api/test_Instance.js:
56         (const.wasmModuleWhichImportJS):
57         (MonomorphicImport):
58         (Polyphic2Import):
59         (Polyphic3Import):
60         (VirtualImport):
61
62 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
63
64         Green the cloop bot by raising this threshold.
65
66         * mozilla/js1_5/Array/regress-101964.js:
67
68 2016-12-08  JF Bastien  <jfbastien@apple.com>
69
70         WebAssembly JS API: wire up Instance imports
71         https://bugs.webkit.org/show_bug.cgi?id=165118
72
73         Reviewed by Saam Barati.
74
75         * wasm/js-api/test_Instance.js: add the test, disabled for now
76
77 2016-12-07  Keith Miller  <keith_miller@apple.com>
78
79         Add more missing trivial wasm ops.
80         https://bugs.webkit.org/show_bug.cgi?id=165564
81
82         Add tests for drop and tee_local.
83
84         Reviewed by Geoffrey Garen.
85
86         * wasm/function-tests/drop.js: Added.
87         * wasm/function-tests/nop.js: Added.
88         * wasm/function-tests/tee-local.js: Added.
89
90 2016-12-06  Keith Miller  <keith_miller@apple.com>
91
92         Add support for truncation operators
93         https://bugs.webkit.org/show_bug.cgi?id=165519
94
95         Reviewed by Geoffrey Garen.
96
97         * wasm/function-tests/i32-trunc-s-f32.js: Added.
98         * wasm/function-tests/i32-trunc-s-f64.js: Added.
99         * wasm/function-tests/i32-trunc-u-f32.js: Added.
100         * wasm/function-tests/i32-trunc-u-f64.js: Added.
101         * wasm/function-tests/i64-trunc-s-f32.js: Added.
102         * wasm/function-tests/i64-trunc-s-f64.js: Added.
103         * wasm/function-tests/i64-trunc-u-f32.js: Added.
104         * wasm/function-tests/i64-trunc-u-f64.js: Added.
105
106 2016-12-06  Mark Lam  <mark.lam@apple.com>
107
108         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
109         https://bugs.webkit.org/show_bug.cgi?id=165227
110         <rdar://problem/29442665>
111
112         Reviewed by Saam Barati.
113
114         * stress/get-from-scope-dynamic-onto-proxy.js:
115         - Updated error message.
116
117         * stress/proxy-dont-infinite-loop.js: Removed.
118         * stress/proxy-json-path.js: Removed.
119         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.
120         - Removed these tests because the issue they are testing relies on being able to
121           set Object.prototype.__proto__ to something else (which is now not possible).
122
123 2016-12-05  Caitlin Potter  <caitp@igalia.com>
124
125         [JSC] report unexpected token when "async" is followed by identifier 
126         https://bugs.webkit.org/show_bug.cgi?id=165091
127
128         Reviewed by Mark Lam.
129
130         * stress/bug-165091.js:
131
132 2016-12-05  Keith Miller  <keith_miller@apple.com>
133
134         Add Wasm i64 to i32 conversion.
135         https://bugs.webkit.org/show_bug.cgi?id=165378
136
137         Reviewed by Filip Pizlo.
138
139         It turns out the wrap operation is just B3's Trunc.
140
141         * wasm/wasm.json:
142
143 2016-12-04  Keith Miller  <keith_miller@apple.com>
144
145         Add support for Wasm ctz and popcnt
146         https://bugs.webkit.org/show_bug.cgi?id=165369
147
148         Reviewed by Saam Barati.
149
150         * wasm/function-tests/ctz.js: Added.
151         * wasm/function-tests/popcnt.js: Added.
152
153 2016-12-03  JF Bastien  <jfbastien@apple.com>
154
155         WebAssembly: update binary format to 0xD version
156         https://bugs.webkit.org/show_bug.cgi?id=165345
157
158         Reviewed by Keith Miller.
159
160         As described in the following PR: https://github.com/WebAssembly/design/pull/836
161         Originally committed in r209175, reverted in r209242, and fixed in r209284.
162
163         * wasm/Builder.js:
164         (const._normalizeFunctionSignature):
165         * wasm/Builder_WebAssemblyBinary.js:
166         (const.emitters.Type):
167         (const.emitters.Code):
168         * wasm/LowLevelBinary.js:
169         (export.default.LowLevelBinary.prototype.block_type):
170         (export.default.LowLevelBinary.prototype.inline_signature_type): Deleted.
171         * wasm/WASM.js:
172         * wasm/js-api/test_basic_api.js:
173         * wasm/self-test/test_BuilderWebAssembly.js:
174         (EmptyModule):
175         (CustomSection):
176         * wasm/self-test/test_WASM.js:
177         * wasm/wasm.json:
178
179 2016-12-02  Keith Miller  <keith_miller@apple.com>
180
181         Add Wasm copysign
182         https://bugs.webkit.org/show_bug.cgi?id=165355
183
184         Reviewed by Filip Pizlo.
185
186         * wasm/function-tests/copysign.js: Added.
187
188 2016-12-03  Commit Queue  <commit-queue@webkit.org>
189
190         Unreviewed, rolling out r209298.
191         https://bugs.webkit.org/show_bug.cgi?id=165359
192
193         broke the build (Requested by smfr on #webkit).
194
195         Reverted changeset:
196
197         "Add Wasm copysign"
198         https://bugs.webkit.org/show_bug.cgi?id=165355
199         http://trac.webkit.org/changeset/209298
200
201 2016-12-02  Keith Miller  <keith_miller@apple.com>
202
203         Add Wasm copysign
204         https://bugs.webkit.org/show_bug.cgi?id=165355
205
206         Reviewed by Filip Pizlo.
207
208         * wasm/function-tests/copysign.js: Added.
209
210 2016-12-02  Keith Miller  <keith_miller@apple.com>
211
212         Unreviewed, fix git having a breakdown over trying to reland a rollout.
213
214 2016-12-02  Keith Miller  <keith_miller@apple.com>
215
216         Add Wasm floating point nearest and trunc
217         https://bugs.webkit.org/show_bug.cgi?id=165339
218
219         Reviewed by Saam Barati.
220
221         * wasm/function-tests/nearest.js: Added.
222         * wasm/function-tests/trunc.js: Added.
223
224 2016-12-02  Caitlin Potter  <caitp@igalia.com>
225
226 [JSC] add additional bit to JSTokenType bitfield
227         https://bugs.webkit.org/show_bug.cgi?id=165091
228
229         Reviewed by Geoffrey Garen.
230
231         * stress/bug-165091.js: Added.
232         (shouldThrowSyntaxError):
233
234 2016-12-02  Commit Queue  <commit-queue@webkit.org>
235
236         Unreviewed, rolling out r209275 and r209276.
237         https://bugs.webkit.org/show_bug.cgi?id=165348
238
239         "broke the arm build" (Requested by keith_miller on #webkit).
240
241         Reverted changesets:
242
243         "Add Wasm floating point nearest and trunc"
244         https://bugs.webkit.org/show_bug.cgi?id=165339
245         http://trac.webkit.org/changeset/209275
246
247         "Unreviewed, forgot to change instruction after renaming."
248         http://trac.webkit.org/changeset/209276
249
250 2016-12-02  Keith Miller  <keith_miller@apple.com>
251
252         Add Wasm floating point nearest and trunc
253         https://bugs.webkit.org/show_bug.cgi?id=165339
254
255         Reviewed by Filip Pizlo.
256
257         * wasm/function-tests/nearest.js: Added.
258         * wasm/function-tests/trunc.js: Added.
259
260 2016-12-02  JF Bastien  <jfbastien@apple.com>
261
262         WebAssembly: revert patch causing odd breakage
263         https://bugs.webkit.org/show_bug.cgi?id=165308
264
265         Unreviewed.
266
267         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
268         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
269
270         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
271
272         * wasm/Builder.js:
273         (const._normalizeFunctionSignature):
274         * wasm/Builder_WebAssemblyBinary.js:
275         (const.emitters.Type):
276         (const.emitters.Code):
277         * wasm/LowLevelBinary.js:
278         (export.default.LowLevelBinary.prototype.inline_signature_type):
279         (export.default.LowLevelBinary.prototype.block_type): Deleted.
280         * wasm/WASM.js:
281         * wasm/js-api/test_basic_api.js:
282         * wasm/self-test/test_BuilderWebAssembly.js:
283         (EmptyModule):
284         (CustomSection):
285         * wasm/self-test/test_WASM.js:
286         * wasm/wasm.json:
287
288 2016-12-01  Ryan Haddad  <ryanhaddad@apple.com>
289
290         Skip flaky test ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js
291         https://bugs.webkit.org/show_bug.cgi?id=162567
292
293         Reviewed by Saam Barati.
294
295         * ChakraCore.yaml:
296
297 2016-12-01  Keith Miller  <keith_miller@apple.com>
298
299         Add wasm int to floating point opcodes
300         https://bugs.webkit.org/show_bug.cgi?id=165252
301
302         Reviewed by Geoffrey Garen.
303
304         Add tests for Wasm integral to floating point conversion opcodes.
305
306         * wasm/function-tests/int-to-floating-point.js: Added.
307         * wasm/wasm.json:
308
309 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
310
311         Land a test case for <rdar://problem/27889416>
312         https://bugs.webkit.org/show_bug.cgi?id=165272
313
314         Reviewed by Saam Barati.
315
316         * stress/marked-argument-buffer.js: Added.
317         (allocate):
318         (test.o.toString):
319         (test):
320
321 2016-11-29  Per Arne Vollan  <pvollan@apple.com>
322
323         [Win] Skip failing JSC tests.
324         https://bugs.webkit.org/show_bug.cgi?id=165140
325
326         Reviewed by Mark Lam.
327
328         * ChakraCore.yaml:
329         * microbenchmarks/tan.js:
330
331 2016-11-30  JF Bastien  <jfbastien@apple.com>
332
333         WebAssembly builder: don't throw when checker not implemented
334         https://bugs.webkit.org/show_bug.cgi?id=165219
335
336         Reviewed by Mark Lam.
337
338         We should perform whichever checks we've implemented, and assume the rest are OK until bug #163421 is fixed.
339
340         * wasm/Builder.js:
341         * wasm/README.md:
342         * wasm/function-tests/add-12.js:
343         * wasm/function-tests/br-if-loop-less-than.js:
344         * wasm/function-tests/brTableAsIf.js:
345         * wasm/function-tests/brTableManyValues.js:
346         * wasm/function-tests/brTableWithLoop.js:
347         * wasm/function-tests/dumb-eq-if-then-else.js:
348         * wasm/function-tests/dumb-less-than-fallthrough.js:
349         * wasm/function-tests/dumb-less-than-ite.js:
350         * wasm/function-tests/eqz.js:
351         * wasm/function-tests/factorial.js:
352         * wasm/function-tests/float-sub.js:
353         * wasm/function-tests/i32-load.js:
354         * wasm/function-tests/i32-load8-s.js:
355         * wasm/function-tests/if-then-else-fallthrough.js:
356         * wasm/function-tests/if-then-fallthrough.js:
357         * wasm/function-tests/loop-mult.js:
358         * wasm/function-tests/loop-sum.js:
359         * wasm/function-tests/max.js:
360         * wasm/function-tests/min.js:
361         * wasm/function-tests/ret5.js:
362         * wasm/function-tests/select.js:
363         * wasm/self-test/test_BuilderJSON.js:
364
365 2016-11-29  JF Bastien  <jfbastien@apple.com>
366
367         WebAssembly JS API: improve Instance
368         https://bugs.webkit.org/show_bug.cgi?id=164757
369
370         Reviewed by Keith Miller.
371
372         An Instance's `exports` property wasn't populated with exports.
373
374         A follow-up patch will do imports.
375
376         A few things of note:
377
378          - LowLevelBinary: support 3-byte integers.
379          - LowLevelBinary: support proper UTF-8 2003 code points (instead of UTF-16).
380
381         * wasm/Builder.js:
382         * wasm/Builder_WebAssemblyBinary.js: wire up exports, stub other things out some more
383         (const.emitters.Export):
384         * wasm/LowLevelBinary.js:
385         (export.default.LowLevelBinary.prototype.uint24): add, used for UTF-8
386         (export.default.LowLevelBinary.prototype.string): support UTF-8
387         (export.default.LowLevelBinary.prototype.getUint24): add, used for UTF-8
388         (export.default.LowLevelBinary.prototype.getVaruint1): was missing
389         (export.default.LowLevelBinary.prototype.getString): support UTF-8
390         (export.default.LowLevelBinary):
391         * wasm/js-api/test_Instance.js: instance.exports.answer() // <-- this is where the magic of this entire patch is
392         (ExportedAnswerI32):
393         * wasm/js-api/test_basic_api.js: punt test to later
394         (const.c.in.constructorProperties.switch):
395         * wasm/self-test/test_BuilderWebAssembly.js: UTF-8
396         (CustomSection):
397         * wasm/self-test/test_LowLevelBinary_string.js: UTF-8 now works
398         * wasm/self-test/test_LowLevelBinary_uint16.js: was missing one value
399         * wasm/self-test/test_LowLevelBinary_uint24.js: Copied from JSTests/wasm/self-test/test_LowLevelBinary_uint8.js.
400         * wasm/self-test/test_LowLevelBinary_uint8.js: was missing one value
401         * wasm/self-test/test_LowLevelBinary_varuint1.js: Added.
402         * wasm/utilities.js: this `dump` thing was useful
403         (const._dump):
404
405 2016-11-29  Saam Barati  <sbarati@apple.com>
406
407         We should be able optimize the pattern where we spread a function's rest parameter to another call
408         https://bugs.webkit.org/show_bug.cgi?id=163865
409
410         Reviewed by Filip Pizlo.
411
412         * microbenchmarks/default-derived-constructor.js: Added.
413         (createClassHierarchy.let.currentClass):
414         (createClassHierarchy):
415         * stress/call-varargs-spread.js: Added.
416         (assert):
417         (bar):
418         (foo):
419         * stress/load-varargs-on-new-array-with-spread-convert-to-static-loads.js: Added.
420         (assert):
421         (baz):
422         (bar):
423         (foo):
424         * stress/new-array-with-spread-with-normal-spread-and-phantom-spread.js: Added.
425         (assert):
426         (foo):
427         (escape):
428         (bar):
429         * stress/phantom-new-array-with-spread-osr-exit.js: Added.
430         (assert):
431         (baz):
432         (bar):
433         (effects):
434         (foo):
435         * stress/phantom-spread-forward-varargs.js: Added.
436         (assert):
437         (test1.bar):
438         (test1.foo):
439         (test1):
440         (test2.bar):
441         (test2.foo):
442         (test3.baz):
443         (test3.bar):
444         (test3.foo):
445         (test4.baz):
446         (test4.bar):
447         (test4.foo):
448         (test5.baz):
449         (test5.bar):
450         (test5.foo):
451         * stress/phantom-spread-osr-exit.js: Added.
452         (assert):
453         (baz):
454         (bar):
455         (effects):
456         (foo):
457         * stress/spread-call-convert-to-static-call.js: Added.
458         (assert):
459         (baz):
460         (bar):
461         (foo):
462         * stress/spread-forward-call-varargs-stack-overflow.js: Added.
463         (assert):
464         (identity):
465         (bar):
466         (foo):
467         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol-2.js: Added.
468         (assert):
469         (baz.Array.prototype.Symbol.iterator):
470         (baz):
471         (bar):
472         (foo):
473         (test):
474         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol.js: Added.
475         (assert):
476         (baz.Array.prototype.Symbol.iterator):
477         (baz):
478         (bar):
479         (foo):
480         * stress/spread-forward-varargs-stack-overflow.js: Added.
481         (assert):
482         (bar):
483         (foo):
484
485 2016-11-29  Caitlin Potter  <caitp@igalia.com>
486
487         [JSC] always wrap AwaitExpression operand in a new Promise
488         https://bugs.webkit.org/show_bug.cgi?id=165181
489
490         Reviewed by Yusuke Suzuki.
491
492         * stress/async-await-basic.js:
493         (async.awaitedPromisesAreWrapped):
494
495 2016-11-29  Keith Miller  <keith_miller@apple.com>
496
497         Add simple way to implement Wasm ops that require more than one B3 opcode
498         https://bugs.webkit.org/show_bug.cgi?id=165129
499
500         Reviewed by Geoffrey Garen.
501
502         * wasm/function-tests/eqz.js: Added.
503         * wasm/function-tests/max.js: Added.
504         * wasm/function-tests/min.js: Added.
505         * wasm/wasm.json:
506
507 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
508
509         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
510         https://bugs.webkit.org/show_bug.cgi?id=164898
511
512         Reviewed by Darin Adler.
513
514         * stress/tagged-template-registry-key-collect.js: Added.
515         (shouldBe):
516         (tag):
517         (i.eval):
518         * stress/tagged-template-registry-key.js: Added.
519         (shouldBe):
520         (tag):
521         (a):
522         (b):
523
524 2016-11-20  Caitlin Potter  <caitp@igalia.com>
525
526         [JSC] speed up parsing of async functions
527         https://bugs.webkit.org/show_bug.cgi?id=164808
528
529         Reviewed by Yusuke Suzuki.
530
531         Add tests for line terminator following "async" keyword in async
532         function syntax.
533
534         * stress/async-await-syntax.js:
535         (shouldBe):
536
537 2016-11-19  Mark Lam  <mark.lam@apple.com>
538
539         op_mod-* JSC tests needs a longer timeout too.
540         https://bugs.webkit.org/show_bug.cgi?id=164994
541
542         Reviewed by Yusuke Suzuki.
543
544         * stress/op_mod-ConstVar.js:
545         * stress/op_mod-VarConst.js:
546         * stress/op_mod-VarVar.js:
547
548 2016-11-19  Mark Lam  <mark.lam@apple.com>
549
550         Add --timeoutMultiplier option to allow some tests more time to run.
551         https://bugs.webkit.org/show_bug.cgi?id=164951
552
553         Reviewed by Yusuke Suzuki.
554
555         Extended the timeout for these tests by 50% more because they run quite slow on
556         low-end machines.
557
558         * stress/op_div-ConstVar.js:
559         * stress/op_div-VarConst.js:
560         * stress/op_div-VarVar.js:
561
562 2016-11-18  Yusuke Suzuki  <utatane.tea@gmail.com>
563
564         REGRESSION(r208867): JSC test failure: ChakraCore.yaml/ChakraCore/test/strict/05.arguments_sm.js.default
565         https://bugs.webkit.org/show_bug.cgi?id=164929
566
567         Reviewed by Mark Lam.
568
569         ES2017 drops arguments.caller and JavaScriptCore is updated to meet the spec.
570         This patch rebaselines the result of ChakraCore test for JSC.
571
572         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
573
574 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
575
576         Web Inspector: Generator functions should have a displayable name when shown in stack traces
577         https://bugs.webkit.org/show_bug.cgi?id=164844
578         <rdar://problem/29300697>
579
580         Reviewed by Yusuke Suzuki.
581
582         * stress/generator-function-name.js:
583         Add another test now that we name the inner generator function
584         that we do not break the lexical resolution of names.
585
586 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
587
588         [JSC] Drop arguments.caller
589         https://bugs.webkit.org/show_bug.cgi?id=164859
590
591         Reviewed by Saam Barati.
592
593         * stress/strict-mode-arguments-caller.js: Added.
594         (strictArguments):
595         (shouldBe):
596
597 2016-11-17  Keith Miller  <keith_miller@apple.com>
598
599         Add rotate to Wasm
600         https://bugs.webkit.org/show_bug.cgi?id=164871
601
602         Reviewed by Filip Pizlo.
603
604         * wasm/wasm.json:
605
606 2016-11-17  Keith Miller  <keith_miller@apple.com>
607
608         Add sqrt to Wasm
609         https://bugs.webkit.org/show_bug.cgi?id=164877
610
611         Reviewed by Mark Lam.
612
613         B3 already has a Sqrt opcode we just need to map Wasm to it.
614
615         * wasm/wasm.json:
616
617 2016-11-17  Saam Barati  <sbarati@apple.com>
618
619         Remove async/await compile time flag and enable tests
620         https://bugs.webkit.org/show_bug.cgi?id=164828
621         <rdar://problem/28639334>
622
623         Reviewed by Yusuke Suzuki.
624
625         * stress/async-arrow-functions-lexical-arguments-binding.js:
626         * stress/async-arrow-functions-lexical-new.target-binding.js:
627         * stress/async-arrow-functions-lexical-super-binding.js:
628         * stress/async-arrow-functions-lexical-this-binding.js:
629         * stress/async-await-basic.js:
630         * stress/async-await-long-loop.js:
631         * stress/async-await-module-reserved-word.js:
632         * stress/async-await-mozilla.js:
633         (mozSyntaxErrors):
634         * stress/async-await-reserved-word.js:
635         * stress/async-await-syntax.js:
636         * stress/async-await-throw-loop.js:
637         * stress/async-function-create-nobaseline.js:
638         * stress/async-function-create-optimized.js:
639         * stress/async-function-declaration-sinking-no-double-allocate.js:
640         * stress/async-function-declaration-sinking-osrexit.js:
641         * stress/async-function-declaration-sinking-put.js:
642         * stress/async-function-expression-sinking-no-double-allocate.js:
643         * stress/async-function-expression-sinking-osrexit.js:
644         * stress/async-function-expression-sinking-put.js:
645         * test262.yaml:
646
647 2016-11-15  Mark Lam  <mark.lam@apple.com>
648
649         Make JSC test functions more robust.
650         https://bugs.webkit.org/show_bug.cgi?id=164807
651
652         Reviewed by Keith Miller.
653
654         * stress/jsc-test-functions-should-be-more-robust.js: Added.
655
656 2016-11-15  Keith Miller  <keith_miller@apple.com>
657
658         B3 should support UDiv/UMod
659         https://bugs.webkit.org/show_bug.cgi?id=164811
660
661         Reviewed by Filip Pizlo.
662
663         Link new instructions to wasm.
664
665         * wasm/wasm.json:
666
667 2016-11-15  Saam Barati  <sbarati@apple.com>
668
669         Debug JSC test timeout: stress/has-own-property-name-cache-symbols-and-strings.js.ftl-no-cjit-small-pool
670         https://bugs.webkit.org/show_bug.cgi?id=163012
671
672         Unreviewed. This patch makes a test run for less time because it's timing out on the bots.
673
674         * stress/has-own-property-name-cache-symbols-and-strings.js:
675
676 2016-11-15  Mark Lam  <mark.lam@apple.com>
677
678         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
679         https://bugs.webkit.org/show_bug.cgi?id=164781
680         <rdar://problem/28418590>
681
682         Reviewed by Geoffrey Garen and Michael Saboff.
683
684         * stress/jsc-setImpureGetterDelegate-on-bad-type.js: Added.
685
686 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
687
688         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
689         https://bugs.webkit.org/show_bug.cgi?id=164727
690
691         Reviewed by Filip Pizlo.
692
693         * stress/check-dom-with-signature.js: Added.
694         (shouldBe):
695         (calling):
696         (i.array.forEach):
697
698 2016-11-14  Caitlin Potter  <caitp@igalia.com>
699
700         [JSC] do not reference AwaitExpression Promises in async function Promise chain
701         https://bugs.webkit.org/show_bug.cgi?id=164753
702
703         Reviewed by Yusuke Suzuki.
704
705         * asyncFunctionTests.yaml:
706         * stress/async-await-long-loop.js: Added.
707         (shouldBe):
708         (async.longLoop):
709         * stress/async-await-throw-loop.js: Added.
710         (shouldBe):
711         (async.thrower):
712         (async.throwLoop):
713
714 2016-11-14  Keith Miller  <keith_miller@apple.com>
715
716         Add Wasm select
717         https://bugs.webkit.org/show_bug.cgi?id=164743
718
719         Reviewed by Saam Barati.
720
721         * wasm/function-tests/select.js: Added.
722
723 2016-11-14  Caitlin Potter  <caitp@igalia.com>
724
725         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
726         https://bugs.webkit.org/show_bug.cgi?id=164037
727
728         Reviewed by Yusuke Suzuki.
729
730         Add tests based on tests from https://trac.webkit.org/changeset/194216.
731
732         * asyncFunctionTests.yaml:
733         * stress/async-function-create-nobaseline.js: Added.
734         * stress/async-function-create-optimized.js: Added.
735         * stress/async-function-declaration-sinking-no-double-allocate.js: Added.
736         * stress/async-function-declaration-sinking-osrexit.js: Added.
737         * stress/async-function-declaration-sinking-put.js: Added.
738         * stress/async-function-expression-sinking-no-double-allocate.js: Added.
739         * stress/async-function-expression-sinking-osrexit.js: Added.
740         * stress/async-function-expression-sinking-put.js: Added.
741
742 2016-11-14  Mark Lam  <mark.lam@apple.com>
743
744         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
745         https://bugs.webkit.org/show_bug.cgi?id=164701
746         <rdar://problem/27462104>
747
748         Reviewed by Darin Adler.
749
750         * stress/string-prototype-charCodeAt-on-too-long-rope.js: Added.
751
752 2016-11-14  Mark Lam  <mark.lam@apple.com>
753
754         RegExpObject::exec/match should handle errors gracefully.
755         https://bugs.webkit.org/show_bug.cgi?id=155145
756         <rdar://problem/27435934>
757
758         Reviewed by Keith Miller.
759
760         * stress/regexp-prototype-exec-on-too-long-rope.js: Added.
761         * stress/regexp-prototype-match-on-too-long-rope.js: Added.
762         * stress/regexp-prototype-test-on-too-long-rope.js: Added.
763
764 2016-11-14  Mark Lam  <mark.lam@apple.com>
765
766         Enhance run-jsc-stress-test script to allow optional test specific options to be added for all test run configurations.
767         https://bugs.webkit.org/show_bug.cgi?id=164695
768
769         Reviewed by Keith Miller.
770
771         Replace use of runMisc* test run configurations with equivalents.
772
773         * stress/licm-no-pre-header-nested.js:
774         * stress/licm-no-pre-header.js:
775         * stress/licm-pre-header-cannot-exit-nested.js:
776         * stress/licm-pre-header-cannot-exit.js:
777         * stress/make-dictionary-repatch.js:
778         * stress/retry-cache-later.js:
779         * stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js:
780         * stress/slow-path-generator-updating-current-node-dfg.js:
781         * stress/unshift-array-storage.js:
782
783 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
784
785         test262: DataView with explicit undefined byteLength should be the same as it not being present
786         https://bugs.webkit.org/show_bug.cgi?id=164453
787
788         Reviewed by Darin Adler.
789
790         * stress/dataview-construct.js: Added.
791         (assert):
792         (shouldThrow):
793         * test262.yaml:
794
795 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
796
797         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
798         https://bugs.webkit.org/show_bug.cgi?id=164451
799
800         Reviewed by Darin Adler.
801
802         * test262.yaml:
803
804 2016-11-11  Saam Barati  <sbarati@apple.com>
805
806         We should have a more concise way of determining when we're varargs calling a function using rest parameters
807         https://bugs.webkit.org/show_bug.cgi?id=164258
808
809         Reviewed by Yusuke Suzuki.
810
811         * microbenchmarks/call-using-spread.js: Added.
812         (bar):
813         (foo):
814         * microbenchmarks/spread-large-array.js: Added.
815         (foo):
816         (arrays.push):
817         * microbenchmarks/spread-small-array.js: Added.
818         (foo):
819         * stress/spread-array-iterator-watchpoint-2.js: Added.
820         (foo):
821         (arrayIterator.next):
822         * stress/spread-array-iterator-watchpoint.js: Added.
823         (foo):
824         (Array.prototype.Symbol.iterator):
825         * stress/spread-non-array.js: Added.
826         (assert):
827         (foo):
828         (let.customIterator.Symbol.iterator):
829         (bar):
830
831 2016-11-11  Keith Miller  <keith_miller@apple.com>
832
833         Relocate wasm tests and actually add them to the test runner
834         https://bugs.webkit.org/show_bug.cgi?id=164668
835
836         Reviewed by Yusuke Suzuki.
837
838         This moves the Wasm tests from their current location down a level.
839         Without relocating, the tests cannot properly be run by the wasm test runner.
840
841         * wasm.yaml:
842         * wasm/Builder.js: Fix typos, yay lazy synatx checking!
843         * wasm/LowLevelBinary.js: Fix typos, yay lazy synatx checking!
844         (export.default.LowLevelBinary.prototype.get return):
845         * wasm/function-tests/add-12.js: Renamed from JSTests/wasm/js-api/function-tests/add-12.js.
846         * wasm/function-tests/br-if-loop-less-than.js: Renamed from JSTests/wasm/js-api/function-tests/br-if-loop-less-than.js.
847         * wasm/function-tests/brTableAsIf.js: Renamed from JSTests/wasm/js-api/function-tests/brTableAsIf.js.
848         * wasm/function-tests/brTableManyValues.js: Renamed from JSTests/wasm/js-api/function-tests/brTableManyValues.js.
849         * wasm/function-tests/brTableWithLoop.js: Renamed from JSTests/wasm/js-api/function-tests/brTableWithLoop.js.
850         * wasm/function-tests/dumb-eq-if-then-else.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-eq-if-then-else.js.
851         * wasm/function-tests/dumb-less-than-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-fallthrough.js.
852         * wasm/function-tests/dumb-less-than-ite.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-ite.js.
853         * wasm/function-tests/factorial.js: Renamed from JSTests/wasm/js-api/function-tests/factorial.js.
854         * wasm/function-tests/float-sub.js: Renamed from JSTests/wasm/js-api/function-tests/float-sub.js.
855         * wasm/function-tests/i32-load.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load.js.
856         * wasm/function-tests/i32-load8-s.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load8-s.js.
857         * wasm/function-tests/if-then-else-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-else-fallthrough.js.
858         * wasm/function-tests/if-then-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-fallthrough.js.
859         * wasm/function-tests/loop-mult.js: Renamed from JSTests/wasm/js-api/function-tests/loop-mult.js.
860         * wasm/function-tests/loop-sum.js: Renamed from JSTests/wasm/js-api/function-tests/loop-sum.js.
861         * wasm/function-tests/ret5.js: Renamed from JSTests/wasm/js-api/function-tests/ret5.js.
862         * wasm/self-test/test_BuilderJSON.js: Rebasline
863
864 2016-11-11  Keith Miller  <keith_miller@apple.com>
865
866         Move Wasm tests to JS
867         https://bugs.webkit.org/show_bug.cgi?id=164611
868
869         Reviewed by Geoffrey Garen.
870
871         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
872         ommited tests were earliest tests, which tested trivial things, like adding two
873         constants. Some tests are ommited for other reasons, however. These are:
874
875         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
876         Tests that would validate the memory of the module once wasm was done with it since that's
877         not really possible in JS.
878
879         In order to make such a translation easier this patch also adds some features to the JS
880         testing api:
881
882         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
883         opcode. For example one can do:
884             ...
885             .Block("i32", b => b.I32Const(1) )
886
887         and the nested lambda will automatically have an end attached.
888
889         2) The JS testing api can now handle inline signature types.
890
891         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
892
893         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
894         wasm.json without being remapped.
895
896         5) Add support for Memory and Function sections to the Builder.
897
898         6) Add support for local variables.
899
900         On the JSC side, we needed to expose a new function to validate the compiled wasm code
901         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
902         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
903         number of functions in the blob and tests for each of those functions.
904
905         * wasm/Builder.js:
906         (const._maybeRegisterType):
907         (const): Deleted.
908         (switch.typeof): Deleted.
909         * wasm/Builder_WebAssemblyBinary.js:
910         (const.emitters.Type):
911         (const.emitters.Import):
912         (const.emitters.Function):
913         (const.emitters.Memory):
914         (const.emitters.Code):
915         (export.const.Binary):
916         * wasm/LowLevelBinary.js:
917         (export.default.LowLevelBinary.prototype.get return):
918         (export.default.LowLevelBinary.prototype.varuint32):
919         (export.default.LowLevelBinary.prototype.varint32):
920         (export.default.LowLevelBinary.prototype.varuint1):
921         (export.default.LowLevelBinary.prototype.varint7):
922         (export.default.LowLevelBinary.prototype.varuint7):
923         (export.default.LowLevelBinary.prototype.inline_signature_type):
924         (export.default.LowLevelBinary.prototype.string):
925         (export.default.LowLevelBinary.prototype.getVaruint32):
926         (export.default.LowLevelBinary.prototype.getVarint32):
927         (export.default.LowLevelBinary.prototype.getVaruint7):
928         (export.default.LowLevelBinary.prototype.getString):
929         (export.default.LowLevelBinary):
930         (export.default.LowLevelBinary.prototype.varuint): Deleted.
931         (export.default.LowLevelBinary.prototype.varint): Deleted.
932         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
933         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
934         * wasm/js-api/test_old_tests.js: Added.
935         (ret5):
936         (brTableWithLoop):
937         (brTableManyValues):
938         (run.brTableManyValues.brTableAsIf):
939         (ifThenFallthrough):
940         (ifThenElseFallthrough):
941         (dumbLessThanFallthrough):
942         (run.dumbLessThanFallthrough.floatSub):
943         (run.floatSub.add12):
944         (run.add12.factorial):
945         (i32load):
946         (run.i32load.i32load8s):
947         (run.i32load8s.dumbEqIfThenElse):
948         (run.dumbEqIfThenElse.dumbEqIfThenElse):
949         (run.dumbEqIfThenElse.dumbLessThanIfThenElse):
950         (run.dumbLessThanIfThenElse.loopSum):
951         (run.loopSum.loopMult):
952         (brIfLoopLessThan):
953         (run.brIfLoopLessThan.run):
954         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
955         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
956
957         * wasm/Builder.js:
958         (const._maybeRegisterType):
959         (const): Deleted.
960         (switch.typeof): Deleted.
961         * wasm/Builder_WebAssemblyBinary.js:
962         (const.emitters.Type):
963         (const.emitters.Import):
964         (const.emitters.Function):
965         (const.emitters.Memory):
966         (const.emitters.Code):
967         (export.const.Binary):
968         * wasm/LowLevelBinary.js:
969         (export.default.LowLevelBinary.prototype.get return):
970         (export.default.LowLevelBinary.prototype.varuint32):
971         (export.default.LowLevelBinary.prototype.varint32):
972         (export.default.LowLevelBinary.prototype.varuint1):
973         (export.default.LowLevelBinary.prototype.varint7):
974         (export.default.LowLevelBinary.prototype.varuint7):
975         (export.default.LowLevelBinary.prototype.inline_signature_type):
976         (export.default.LowLevelBinary.prototype.string):
977         (export.default.LowLevelBinary.prototype.getVaruint32):
978         (export.default.LowLevelBinary.prototype.getVarint32):
979         (export.default.LowLevelBinary.prototype.getVaruint7):
980         (export.default.LowLevelBinary.prototype.getString):
981         (export.default.LowLevelBinary):
982         (export.default.LowLevelBinary.prototype.varuint): Deleted.
983         (export.default.LowLevelBinary.prototype.varint): Deleted.
984         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
985         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
986         * wasm/js-api/function-tests/add-12.js: Added.
987         * wasm/js-api/function-tests/br-if-loop-less-than.js: Added.
988         * wasm/js-api/function-tests/brTableAsIf.js: Added.
989         * wasm/js-api/function-tests/brTableManyValues.js: Added.
990         * wasm/js-api/function-tests/brTableWithLoop.js: Added.
991         * wasm/js-api/function-tests/dumb-eq-if-then-else.js: Added.
992         * wasm/js-api/function-tests/dumb-less-than-fallthrough.js: Added.
993         * wasm/js-api/function-tests/dumb-less-than-ite.js: Added.
994         * wasm/js-api/function-tests/factorial.js: Added.
995         * wasm/js-api/function-tests/float-sub.js: Added.
996         * wasm/js-api/function-tests/i32-load.js: Added.
997         * wasm/js-api/function-tests/i32-load8-s.js: Added.
998         * wasm/js-api/function-tests/if-then-else-fallthrough.js: Added.
999         * wasm/js-api/function-tests/if-then-fallthrough.js: Added.
1000         * wasm/js-api/function-tests/loop-mult.js: Added.
1001         * wasm/js-api/function-tests/loop-sum.js: Added.
1002         * wasm/js-api/function-tests/ret5.js: Added.
1003         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
1004         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
1005
1006 2016-11-11  Saam Barati  <sbarati@apple.com>
1007
1008         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
1009         https://bugs.webkit.org/show_bug.cgi?id=164650
1010
1011         Reviewed by Geoffrey Garen.
1012
1013         * stress/dont-dead-lock-put-by-val-as-put-by-id.js: Added.
1014         (ident):
1015         (let.o.set foo):
1016         (foo):
1017
1018 2016-11-11  Chris Dumez  <cdumez@apple.com>
1019
1020         Unreviewed, rolling out r208584.
1021
1022         Seems to have regressed Speedometer by 1% on Mac
1023
1024         Reverted changeset:
1025
1026         "We should have a more concise way of determining when we're
1027         varargs calling a function using rest parameters"
1028         https://bugs.webkit.org/show_bug.cgi?id=164258
1029         http://trac.webkit.org/changeset/208584
1030
1031 2016-11-11  Chris Dumez  <cdumez@apple.com>
1032
1033         Unreviewed, rolling out r208117 and r208160.
1034
1035         Regressed Speedometer by >1.5%
1036
1037         Reverted changesets:
1038
1039         "We should have a way of profiling when a get_by_id is pure
1040         and to emit a PureGetById in the DFG/FTL"
1041         https://bugs.webkit.org/show_bug.cgi?id=163305
1042         http://trac.webkit.org/changeset/208117
1043
1044         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
1045         out"
1046         https://bugs.webkit.org/show_bug.cgi?id=164227
1047         http://trac.webkit.org/changeset/208160
1048
1049 2016-11-11  Saam Barati  <sbarati@apple.com>
1050
1051         We should have a more concise way of determining when we're varargs calling a function using rest parameters
1052         https://bugs.webkit.org/show_bug.cgi?id=164258
1053
1054         Reviewed by Yusuke Suzuki.
1055
1056         * microbenchmarks/call-using-spread.js: Added.
1057         (bar):
1058         (foo):
1059         * microbenchmarks/spread-large-array.js: Added.
1060         (foo):
1061         (arrays.push):
1062         * microbenchmarks/spread-small-array.js: Added.
1063         (foo):
1064         * stress/spread-array-iterator-watchpoint-2.js: Added.
1065         (foo):
1066         (arrayIterator.next):
1067         * stress/spread-array-iterator-watchpoint.js: Added.
1068         (foo):
1069         (Array.prototype.Symbol.iterator):
1070         * stress/spread-non-array.js: Added.
1071         (assert):
1072         (foo):
1073         (let.customIterator.Symbol.iterator):
1074         (bar):
1075
1076 2016-11-10  Mark Lam  <mark.lam@apple.com>
1077
1078         Fix broken have-a-bad-time-with-arguments.js test.
1079         https://bugs.webkit.org/show_bug.cgi?id=164626
1080
1081         Reviewed by Filip Pizlo.
1082
1083         But also saved a copy of the broken one as broken-have-a-bad-time-with-arguments-for-gc-testing.js
1084         because coincidentally, it stresses the GC in ways that help reveal bugs.
1085
1086         * stress/broken-have-a-bad-time-with-arguments-for-gc-testing.js: Added.
1087         (testFunction):
1088         (warmupFunction):
1089         (let.argsDeclIndex.in.argumentsDecls.let.indexToReturnIndex.in.indicesToReturn.let.insertElementActionIndex.in.insertElementActions.let.tierWarmupCountIndex.in.tierWarmupCounts.let.testArgsIndex.in.testArgsList.catch):
1090         * stress/have-a-bad-time-with-arguments.js:
1091
1092 2016-11-10  JF Bastien  <jfbastien@apple.com>
1093
1094         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
1095         https://bugs.webkit.org/show_bug.cgi?id=164597
1096
1097         Reviewed by Keith Miller.
1098
1099         Trim the array buffer before returning it: it's optimistically
1100         over-allocated to avoid growing all the time, but when parsed it
1101         can't have extra content.
1102
1103         * wasm/Builder_WebAssemblyBinary.js:
1104         (export.const.Binary):
1105         * wasm/LowLevelBinary.js:
1106         (export.default.LowLevelBinary.prototype.get return):
1107
1108 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
1109
1110         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
1111         https://bugs.webkit.org/show_bug.cgi?id=164450
1112
1113         Reviewed by Darin Adler.
1114
1115         * stress/dataview-typedarray-toindex.js: Added.
1116         Tests for all cases where ToIndex should be used.
1117
1118         * test262.yaml:
1119         New passing tests.
1120
1121 2016-11-10  Mark Lam  <mark.lam@apple.com>
1122
1123         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
1124         https://bugs.webkit.org/show_bug.cgi?id=164600
1125         <rdar://problem/28828676>
1126
1127         Reviewed by Filip Pizlo.
1128
1129         * stress/osr-exit-on-op-negate-should-no-fail-assertions.js: Added.
1130
1131 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1132
1133         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
1134         https://bugs.webkit.org/show_bug.cgi?id=164502
1135
1136         Reviewed by Saam Barati.
1137
1138         * stress/argument-intrinsic-basic.js: Added.
1139         (shouldBe):
1140         (builtin.createBuiltin):
1141         * stress/argument-intrinsic-inlining-with-result-escape.js: Added.
1142         (shouldBe):
1143         (builtin.createBuiltin):
1144         (escape):
1145         * stress/argument-intrinsic-nested-inlining.js: Added.
1146         (shouldBe):
1147         (builtin.createBuiltin):
1148         (builtinCaller1):
1149         (builtinCaller2):
1150         (escape):
1151         * stress/argument-intrinsic-not-convert-to-get-argument.js: Added.
1152         (shouldBe):
1153         (builtin.createBuiltin):
1154         * stress/argument-intrinsic-with-stack-write.js: Added.
1155         (shouldBe):
1156         (builtin.createBuiltin):
1157
1158 2016-11-09  Saam Barati  <sbarati@apple.com>
1159
1160         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
1161         https://bugs.webkit.org/show_bug.cgi?id=164464
1162         <rdar://problem/29131452>
1163
1164         Reviewed by Darin Adler.
1165
1166         * stress/math-max-min-no-arguments.js: Added.
1167         (assert):
1168         (min):
1169         (max):
1170         (test):
1171
1172 2016-11-09  Saam Barati  <sbarati@apple.com>
1173
1174         TypeProfiler and running GC collection on another thread don't play nicely with each other
1175         https://bugs.webkit.org/show_bug.cgi?id=164441
1176         <rdar://problem/29132174>
1177
1178         Reviewed by Geoffrey Garen.
1179
1180         * typeProfiler/type-profiler-gc.js: Added.
1181         (bar):
1182         (foo):
1183
1184 2016-11-04  Mark Lam  <mark.lam@apple.com>
1185
1186         Error description code should be able to handle Symbol values.
1187         https://bugs.webkit.org/show_bug.cgi?id=164436
1188         <rdar://problem/29115583>
1189
1190         Reviewed by Filip Pizlo and Saam Barati.
1191
1192         * stress/error-description-on-symbols-should-not-crash.js: Added.
1193
1194 2016-11-03  Geoffrey Garen  <ggaren@apple.com>
1195
1196         EvalCodeCache should not give up in strict mode and other cases
1197         https://bugs.webkit.org/show_bug.cgi?id=164357
1198
1199         Reviewed by Michael Saboff.
1200
1201         * microbenchmarks/eval-cached.js: Added. 45x faster now.
1202         * stress/eval-cached.js: Added. Try running the same eval text in a bunch
1203         of different scopes and verify that we access the right scope.
1204
1205 2016-11-04  JF Bastien  <jfbastien@apple.com>
1206
1207         WebAssembly JS API: implement more sections
1208         https://bugs.webkit.org/show_bug.cgi?id=164023
1209
1210         Reviewed by Keith Miller.
1211
1212         On the JSC side:
1213
1214          - Put in parser stubs for all WebAssembly sections.
1215          - Parse Import, Export sections.
1216          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
1217          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
1218          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
1219          - parseCode: avoid overflow through function size.
1220          - Remove all remainders of polyfill-prototype-1, and update license.
1221          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
1222
1223         On the Builder.js testing side:
1224
1225          - Implement Type, Import (function only), Export (function only) sections.
1226          - Check section order and uniqueness.
1227          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
1228          - Allow re-exporting an import.
1229
1230         * wasm/Builder.js: build type, import, and export sections
1231         (const._normalizeFunctionSignature):
1232         * wasm/Builder_WebAssemblyBinary.js: Added. Forked from Builder.js
1233         (const.emitters.Type):
1234         (const.emitters.Import):
1235         (const.emitters.Function):
1236         (const.emitters.Table):
1237         (const.emitters.Memory):
1238         (const.emitters.Global):
1239         (const.emitters.Export):
1240         (const.emitters.Start):
1241         (const.emitters.Element):
1242         (const.emitters.Code):
1243         (const.emitters.Data):
1244         (export.const.Binary):
1245         * wasm/LowLevelBinary.js: Add a few useful outputs
1246         (export.default.LowLevelBinary.prototype.varuint1):
1247         (export.default.LowLevelBinary.prototype.varint7):
1248         * wasm/WASM.js: value type and external kind helpers
1249         * wasm/assert.js: array element-wise equality comparison
1250         (const._eq):
1251         * wasm/js-api/test_Module.js:
1252         (ModuleWithImports):
1253         * wasm/self-test/test_BuilderJSON.js: many more tests for all the new Builder APIs, and update to some older tests which now require a Type section or rejiggered Function signature
1254         (const.assertOpThrows):
1255         (SectionsWithSameCustomName):
1256         (TwoTypeSections):
1257         (EmptyImportSection):
1258         (ImportBeforeTypeSections):
1259         * wasm/self-test/test_BuilderWebAssembly.js: remove a test which wasn't helpful and is now obsolete
1260         (CustomSection):
1261
1262 2016-11-03  Mark Lam  <mark.lam@apple.com>
1263
1264         ClonedArguments need to also support haveABadTime mode.
1265         https://bugs.webkit.org/show_bug.cgi?id=164200
1266         <rdar://problem/27211336>
1267
1268         Reviewed by Geoffrey Garen.
1269
1270         * stress/have-a-bad-time-with-arguments.js: Added.
1271
1272 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1273
1274         DFG plays fast and loose with the shadow values of a Phi
1275         https://bugs.webkit.org/show_bug.cgi?id=164309
1276
1277         Reviewed by Saam Barati.
1278         
1279         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1280
1281         * stress/dfg-ssa-swap.js: Added.
1282         (foo):
1283
1284 2016-11-03  Commit Queue  <commit-queue@webkit.org>
1285
1286         Unreviewed, rolling out r208364.
1287         https://bugs.webkit.org/show_bug.cgi?id=164402
1288
1289         broke the build (Requested by smfr on #webkit).
1290
1291         Reverted changeset:
1292
1293         "DFG plays fast and loose with the shadow values of a Phi"
1294         https://bugs.webkit.org/show_bug.cgi?id=164309
1295         http://trac.webkit.org/changeset/208364
1296
1297 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1298
1299         DFG plays fast and loose with the shadow values of a Phi
1300         https://bugs.webkit.org/show_bug.cgi?id=164309
1301
1302         Reviewed by Saam Barati.
1303         
1304         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1305
1306         * stress/dfg-ssa-swap.js: Added.
1307         (foo):
1308
1309 2016-11-03  Saam Barati  <sbarati@apple.com>
1310
1311         Asking for a value profile prediction should be defensive against not finding a value profile
1312         https://bugs.webkit.org/show_bug.cgi?id=164306
1313
1314         Reviewed by Mark Lam.
1315
1316         * stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js: Added.
1317         (let.o.set foo):
1318         (bar):
1319
1320 2016-11-02  Saam Barati  <sbarati@apple.com>
1321
1322         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
1323         https://bugs.webkit.org/show_bug.cgi?id=164301
1324
1325         Reviewed by Geoffrey Garen.
1326
1327         * stress/rest-parameter-allocation-elimination-watchpoints-2.js: Added.
1328         (assert):
1329         (foo):
1330         * stress/rest-parameter-allocation-elimination-watchpoints-3.js: Added.
1331         (assert):
1332         (foo):
1333         * stress/rest-parameter-allocation-elimination-watchpoints-4.js: Added.
1334         (assert):
1335         (foo):
1336         * stress/rest-parameter-allocation-elimination-watchpoints-5.js: Added.
1337         (assert):
1338         (foo):
1339         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Added.
1340         (assert):
1341         (foo):
1342         * stress/rest-parameter-allocation-elimination-watchpoints.js: Added.
1343         (assert):
1344         (foo):
1345
1346 2016-11-01  Saam Barati  <sbarati@apple.com>
1347
1348         We should be able to eliminate rest parameter allocations
1349         https://bugs.webkit.org/show_bug.cgi?id=163925
1350
1351         Reviewed by Filip Pizlo.
1352
1353         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1354         (assert):
1355         (test1.bar):
1356         (test1):
1357         (test2.jaz):
1358         (test2.jaz2.kaz):
1359         (test2.jaz2):
1360         (test2):
1361         (test3.foo):
1362         (test3.baz):
1363         (test3.jaz):
1364         (test3):
1365         (test4.baz):
1366         (test4.jaz):
1367         (test4):
1368         (test5.baz):
1369         (test5.jaz):
1370         (test5):
1371         (test6.baz):
1372         (test6.jaz):
1373         (test6):
1374         (test7.baz):
1375         (test7.jaz):
1376         (test7.check):
1377         (test7):
1378         (test8.baz):
1379         (test8.jaz):
1380         (test8.check):
1381         (test8):
1382         (test9.baz):
1383         (test9.jaz):
1384         (test9.check):
1385         (test9):
1386         (test10.baz):
1387         (test10.jaz):
1388         (test10):
1389         (test11.bar):
1390         (test11.foo):
1391         (test11.makeArguments):
1392         (test11.):
1393         (test12):
1394         (test12.bar):
1395         (test12.foo):
1396         (test12.makeArguments):
1397         (test12.):
1398         (test13.bar):
1399         (test13.top):
1400         (test13.foo):
1401         (test13.makeArguments):
1402         (test13.):
1403         (test13):
1404         (test14.bar):
1405         (test14.top):
1406         (test14.foo):
1407         (test14.makeArguments):
1408         (test14.):
1409         (test14):
1410         (test15.bar):
1411         (test15.top):
1412         (test15.foo):
1413         (test15.makeArguments):
1414         (test15.):
1415         (test15):
1416
1417 2016-11-01  Commit Queue  <commit-queue@webkit.org>
1418
1419         Unreviewed, rolling out r208208 and r208210.
1420         https://bugs.webkit.org/show_bug.cgi?id=164276
1421
1422         This change caused 28 JSC test failures. (Requested by
1423         ryanhaddad on #webkit).
1424
1425         Reverted changesets:
1426
1427         "We should be able to eliminate rest parameter allocations"
1428         https://bugs.webkit.org/show_bug.cgi?id=163925
1429         http://trac.webkit.org/changeset/208208
1430
1431         "Fix the EFL build."
1432         http://trac.webkit.org/changeset/208210
1433
1434 2016-10-31  Filip Pizlo  <fpizlo@apple.com>
1435
1436         JSC should support SharedArrayBuffer
1437         https://bugs.webkit.org/show_bug.cgi?id=163986
1438
1439         Reviewed by Keith Miller.
1440         
1441         This adds our own test for the various corner cases of SharedArrayBuffer. This test is meant to
1442         check all of the things that don't require concurrency.
1443
1444         * stress/SharedArrayBuffer.js: Added.
1445         (checkAtomics):
1446         (shouldFail):
1447         (Symbol):
1448         (runAtomic):
1449
1450 2016-10-31  Saam Barati  <sbarati@apple.com>
1451
1452         We should be able to eliminate rest parameter allocations
1453         https://bugs.webkit.org/show_bug.cgi?id=163925
1454
1455         Reviewed by Filip Pizlo.
1456
1457         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1458         (assert):
1459         (test1.bar):
1460         (test1):
1461         (test2.jaz):
1462         (test2.jaz2.kaz):
1463         (test2.jaz2):
1464         (test2):
1465         (test3.foo):
1466         (test3.baz):
1467         (test3.jaz):
1468         (test3):
1469         (test4.baz):
1470         (test4.jaz):
1471         (test4):
1472         (test5.baz):
1473         (test5.jaz):
1474         (test5):
1475         (test6.baz):
1476         (test6.jaz):
1477         (test6):
1478         (test7.baz):
1479         (test7.jaz):
1480         (test7.check):
1481         (test7):
1482         (test8.baz):
1483         (test8.jaz):
1484         (test8.check):
1485         (test8):
1486         (test9.baz):
1487         (test9.jaz):
1488         (test9.check):
1489         (test9):
1490         (test10.baz):
1491         (test10.jaz):
1492         (test10):
1493         (test11.bar):
1494         (test11.foo):
1495         (test11.makeArguments):
1496         (test11.):
1497         (test12):
1498         (test12.bar):
1499         (test12.foo):
1500         (test12.makeArguments):
1501         (test12.):
1502         (test13.bar):
1503         (test13.top):
1504         (test13.foo):
1505         (test13.makeArguments):
1506         (test13.):
1507         (test13):
1508         (test14.bar):
1509         (test14.top):
1510         (test14.foo):
1511         (test14.makeArguments):
1512         (test14.):
1513         (test14):
1514         (test15.bar):
1515         (test15.top):
1516         (test15.foo):
1517         (test15.makeArguments):
1518         (test15.):
1519         (test15):
1520
1521 2016-10-31  Saam Barati  <sbarati@apple.com>
1522
1523         Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing out
1524         https://bugs.webkit.org/show_bug.cgi?id=164227
1525
1526         Unreviewed timeout fix.
1527
1528         * microbenchmarks/pure-get-by-id-cse-2.js:
1529
1530 2016-10-31  Keith Miller  <keith_miller@apple.com>
1531
1532         autogenerated files from wasm.json should be in derived sources.
1533         https://bugs.webkit.org/show_bug.cgi?id=164152
1534
1535         Reviewed by Filip Pizlo.
1536
1537         Delete generation script since it is no longer used.
1538
1539         * wasm/generate-wasmops-header.js: Removed.
1540
1541 2016-10-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1542
1543         [JSC] JSON.stringify should handle Proxy which is non JSArray but isArray is true
1544         https://bugs.webkit.org/show_bug.cgi?id=164123
1545
1546         Reviewed by Mark Lam.
1547
1548         * stress/json-stringify-with-non-jsarray-array.js: Added.
1549         (shouldBe):
1550         (shouldBe.JSON.stringify.new.Proxy):
1551
1552 2016-10-29  Saam Barati  <sbarati@apple.com>
1553
1554         We should have a way of profiling when a get_by_id is pure and to emit a PureGetById in the DFG/FTL
1555         https://bugs.webkit.org/show_bug.cgi?id=163305
1556
1557         Reviewed by Keith Miller.
1558
1559         * microbenchmarks/pure-get-by-id-cse-2.js: Added.
1560         (foo):
1561         * microbenchmarks/pure-get-by-id-cse.js: Added.
1562         (foo):
1563         * stress/pure-get-by-id-cse-correctness.js: Added.
1564         (assert):
1565         (foo):
1566         * stress/pure-get-by-id-on-non-object.js: Added.
1567         (assert):
1568         (foo):
1569
1570 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1571
1572         Skip JSTests/microbenchmarks/dense-set.js on memory limited devices
1573         https://bugs.webkit.org/show_bug.cgi?id=164128
1574
1575         Reviewed by Mark Lam.
1576
1577         * microbenchmarks/dense-set.js:
1578
1579 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1580
1581         [JSC] implement runtime for async functions
1582         https://bugs.webkit.org/show_bug.cgi?id=163760
1583
1584         Reviewed by Yusuke Suzuki.
1585
1586         * stress/async-await-basic.js: Added.
1587         (shouldBe):
1588         (shouldBeAsync):
1589         (shouldThrow):
1590         (shouldThrowAsync):
1591         (shouldThrowSyntaxError):
1592         (let.AsyncFunction.async):
1593         (async.asyncFunctionForProto):
1594         (Object.getPrototypeOf.async):
1595         (Object.getPrototypeOf.async.method):
1596         (async):
1597         (async.method):
1598         (async.asyncNonConstructorDecl):
1599         (shouldThrow.new.async):
1600         (shouldThrow.new.async.nonConstructor):
1601         (async.asyncDecl):
1602         (async.f):
1603         (MyError):
1604         (async.asyncDeclThrower):
1605         (shouldThrowAsync.async):
1606         (resolveLater):
1607         (rejectLater):
1608         (async.resumeAfterNormal):
1609         (O.async.resumeAfterNormal):
1610         (resumeAfterNormalArrow.async):
1611         (async.resumeAfterThrow):
1612         (O.async.resumeAfterThrow):
1613         (resumeAfterThrowArrow.async):
1614         (catch):
1615         * stress/async-await-module-reserved-word.js: Added.
1616         (shouldThrow):
1617         (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
1618         (checkModuleSyntaxError.String.raw.await):
1619         (checkModuleSyntaxError.String.raw.async.await):
1620         (SyntaxError.Cannot.declare.named):
1621         * stress/async-await-mozilla.js: Added.
1622         (shouldBe):
1623         (shouldBeAsync):
1624         (shouldThrow):
1625         (shouldThrowAsync):
1626         (assert):
1627         (shouldThrowSyntaxError):
1628         (mozSemantics.async.empty):
1629         (mozSemantics.async.simpleReturn):
1630         (mozSemantics.async.simpleAwait):
1631         (mozSemantics.async.simpleAwaitAsync):
1632         (mozSemantics.async.returnOtherAsync):
1633         (mozSemantics.async.simpleThrower):
1634         (mozSemantics.async.delegatedThrower):
1635         (mozSemantics.async.tryCatch):
1636         (mozSemantics.async.tryCatchThrow):
1637         (mozSemantics.async.wellFinally):
1638         (mozSemantics.async.finallyMayFail):
1639         (mozSemantics.async.embedded.async.inner):
1640         (mozSemantics.async.embedded):
1641         (mozSemantics.async.fib):
1642         (mozSemantics.async.isOdd.async.isEven):
1643         (mozSemantics.async.isOdd):
1644         (mozSemantics.hardcoreFib.async.fib2):
1645         (mozSemantics.namedAsyncExpr.async.simple):
1646         (mozSemantics.async.executionOrder.async.first):
1647         (mozSemantics.async.executionOrder.async.second):
1648         (mozSemantics.async.executionOrder.async.third):
1649         (mozSemantics.async.executionOrder):
1650         (mozSemantics.async.miscellaneous):
1651         (mozSemantics.thrower):
1652         (mozSemantics.async.defaultArgs):
1653         (mozSemantics.shouldThrow):
1654         (mozSemantics):
1655         (mozMethods.X):
1656         (mozMethods.X.prototype.async.getValue):
1657         (mozMethods.X.prototype.setValue):
1658         (mozMethods.X.prototype.async.increment):
1659         (mozMethods.X.prototype.async.getBaseClassName):
1660         (mozMethods.X.async.getStaticValue):
1661         (mozMethods.Y.prototype.async.getBaseClassName):
1662         (mozMethods.Y):
1663         (mozFunctionNameInferrence.async.test):
1664         (mozSyntaxErrors):
1665         * stress/async-await-reserved-word.js: Added.
1666         (assert):
1667         (shouldThrowSyntaxError):
1668         (AsyncFunction.async):
1669         * stress/async_arrow_functions_lexical_arguments_binding.js: Added.
1670         (shouldBe):
1671         (shouldBeAsync):
1672         (shouldThrowAsync):
1673         (noArgumentsArrow2.async):
1674         * stress/async_arrow_functions_lexical_new.target_binding.js: Added.
1675         (shouldBe):
1676         (shouldBeAsync):
1677         (shouldThrowAsync):
1678         (C1):
1679         (C2):
1680         (shouldThrowAsync.async):
1681         * stress/async_arrow_functions_lexical_super_binding.js: Added.
1682         (shouldBe):
1683         (shouldBeAsync):
1684         (BaseClass.prototype.baseClassValue):
1685         (BaseClass.prototype.get property):
1686         (BaseClass):
1687         (ChildClass.prototype.asyncSuperProp):
1688         (ChildClass.prototype.asyncSuperProp2):
1689         (ChildClass):
1690         (ChildClass2):
1691         * stress/async_arrow_functions_lexical_this_binding.js: Added.
1692         (shouldBe):
1693         (shouldBeAsync):
1694         (d.y):
1695
1696 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1697
1698         Skip 2 JS stress tests on memory limited devices
1699         https://bugs.webkit.org/show_bug.cgi?id=164125
1700
1701         Unreviewed quick fix to unbreak JSCOnly ARM bots as soon as possible.
1702
1703         * stress/joined-strings-should-not-exceed-max-string-length.js:
1704         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1705
1706 2016-10-27  Caitlin Potter  <caitp@igalia.com>
1707
1708         [JSC] forbid lexical redeclaration of generator formal parameters
1709         https://bugs.webkit.org/show_bug.cgi?id=163930
1710
1711         Reviewed by Yusuke Suzuki.
1712
1713         * stress/async-await-syntax.js:
1714         * stress/generator-syntax.js:
1715         (testSyntaxError.gen):
1716         (testSyntaxError.arguments):
1717         (testSyntaxError.eval):
1718         * test262.yaml:
1719
1720 2016-10-26  JF Bastien  <jfbastien@apple.com>
1721
1722         WebAssembly API: implement Instance
1723
1724         As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-objects
1725
1726          - Take ownership of Wasm::Plan's compilation result when successfully creating a JSWebAssemblyModule object.
1727          - Construct a basic Instance with a Module.
1728          - Handle second argument (importObject) of WebAssembly.Instance.
1729          - Add reference text from the spec to WebAssembly.Module's code.
1730          - Expose and test an empty 'exports' ModuleNamespaceObject on WebAssembly.Instance.
1731
1732         The implementation isn't complete yet: it relies on further work for which I've filed bugs.
1733
1734         WebAssembly API: implement Instance
1735         https://bugs.webkit.org/show_bug.cgi?id=163998
1736
1737         Reviewed by Keith Miller.
1738
1739         * wasm/js-api/test_Instance.js: Added.
1740         (EmptyModule): use the Builder, create the simplest Module possible, and create an Instance from it
1741         * wasm/js-api/test_basic_api.js:
1742         (const.c.in.constructorProperties.switch): basic tests of the API
1743
1744 2016-10-26  Mark Lam  <mark.lam@apple.com>
1745
1746         JSGenericTypedArrayView::set() should check for exceptions.
1747         https://bugs.webkit.org/show_bug.cgi?id=164007
1748         <rdar://problem/28853775>
1749
1750         Reviewed by Filip Pizlo.
1751
1752         * stress/typed-array-view-set-should-not-crash-on-exception.js: Added.
1753
1754 2016-10-25  Mark Lam  <mark.lam@apple.com>
1755
1756         String.prototype.replace() should throw an OutOfMemoryError when using too much memory.
1757         https://bugs.webkit.org/show_bug.cgi?id=163996
1758         <rdar://problem/28263117>
1759
1760         Reviewed by Geoffrey Garen.
1761
1762         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: Added.
1763
1764 2016-10-25  Mark Lam  <mark.lam@apple.com>
1765
1766         JSStringJoiner::joinedLength() should limit joined string lengths to INT_MAX.
1767         https://bugs.webkit.org/show_bug.cgi?id=163937
1768         <rdar://problem/28642990>
1769
1770         Reviewed by Geoffrey Garen.
1771
1772         * stress/joined-strings-should-not-exceed-max-string-length.js: Added.
1773
1774 2016-10-25  JF Bastien  <jfbastien@apple.com>
1775
1776         WebAssembly JS API: simple Module test
1777         https://bugs.webkit.org/show_bug.cgi?id=163963
1778
1779         Reviewed by Filip Pizlo.
1780
1781         * wasm/LowLevelBinary.js:
1782         (export.default.LowLevelBinary.prototype.get return): get the ArrayBuffer
1783         (export.default.LowLevelBinary.prototype.hexdump): Deleted.
1784         (export.default.LowLevelBinary.prototype._maybeGrow): Deleted.
1785         * wasm/js-api/test_Module.js: Added.
1786         (EmptyModule): The most basic module possible
1787
1788 2016-10-25  JF Bastien  <jfbastien@apple.com>
1789
1790         WebAssembly JS API: implement Module
1791
1792         This implementation allows us to:
1793          - Syncrhonously create a WebAssembly.Module with a typed array.
1794          - Creates a compilation plan.
1795          - Parse the Module and creates corresponding code.
1796          - Throw WebAssembly.CompileError with mildly helpful [*] error messages on
1797            failure.
1798
1799         Consult the API documentation for expected behavior: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodule-constructor
1800
1801         For now the implementation discards the generated code.
1802
1803         The next steps will be:
1804          - Expose a Module's exports.
1805          - Implement WebAssembly.Instance, which allows instantiating and running a
1806            compiled Module.
1807          - Beef up the testing infrastructure under JSTests/wasm so that more complex
1808            modules can be created and tested (instead of writing the bits by hand).
1809
1810         This patch also:
1811          - Adds assert.instanceof in assert.js.
1812          - Refactors Wasm::Parser and friends to accept const uint8_t* as well as a
1813            Vector, to avoid copying when invoked synchronously.
1814          - Remove useless Structure from some of the wasm constructors: they're already
1815            on the JSGlobalObject, visited properly and all.
1816          - Fix off-by-one error in parsing: Parser::parseUInt32 failed if the integer
1817            was exactly at end of file.
1818
1819          [*] On error messages while parsing: I filed https://bugs.webkit.org/show_bug.cgi?id=163919
1820
1821         WebAssembly JS API: implement Module
1822         https://bugs.webkit.org/show_bug.cgi?id=163903
1823
1824         Reviewed by Keith Miller.
1825
1826         * wasm/assert.js: use underscore in name, and remove when exporting to avoid clasing with builtin names
1827         (const._notUndef):
1828         (const._isUndef):
1829         (const._eq):
1830         (const._ge):
1831         (const._throws):
1832         * wasm/js-api/test_basic_api.js: test the WebAssembly.Module API
1833         (const.c.in.constructorProperties.switch):
1834
1835 2016-10-25  Keith Miller  <keith_miller@apple.com>
1836
1837         Add trivial Wasm conversion opcodes
1838         https://bugs.webkit.org/show_bug.cgi?id=163950
1839
1840         Reviewed by Filip Pizlo.
1841
1842         This patch differentiates between Wasm opcodes that are trivially mapped to a B3 opcode and
1843         those that are not.  Some of the Wasm opcodes that are currently a non-simple opcode will
1844         become simple as we add B3 opcodes for Wasm operations.  The remaining opcodes will need to
1845         be added via patchpoints in a later patch.
1846
1847         * wasm/generate-wasmops-header.js:
1848         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.Wasm.inline.bool.isSimple):
1849         * wasm/wasm.json:
1850
1851 2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1852
1853         Arrow functions with concise bodies cannot return regular expressions
1854         https://bugs.webkit.org/show_bug.cgi?id=163162
1855
1856         Reviewed by Filip Pizlo.
1857
1858         * ChakraCore/test/Operators/instanceof.baseline-jsc:
1859         * ChakraCore/test/Regex/nul_character.baseline-jsc:
1860         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
1861         * stress/parse-regexp-as-token.js: Added.
1862         (shouldBe):
1863
1864 2016-10-24  Keith Miller  <keith_miller@apple.com>
1865
1866         Wasm should support floating point operations.
1867         https://bugs.webkit.org/show_bug.cgi?id=163770
1868
1869         Reviewed by Michael Saboff.
1870
1871         Add appropriate b3op names for floating point wasm bytecodes, where they exist.
1872         Also, fix some WASM => Wasm in WasmOps.h generator script that I missed
1873         the first time I made the change.
1874
1875         * wasm/generate-wasmops-header.js:
1876         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.template.typename.Int.inline.bool.isValidOpType): Deleted.
1877         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.BinaryOpType): Deleted.
1878         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.UnaryOpType): Deleted.
1879         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType): Deleted.
1880         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType): Deleted.
1881         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.undef.CREATE_ENUM_VALUE.inline.bool.isControlOp): Deleted.
1882         * wasm/wasm.json:
1883
1884 2016-10-21  Saam Barati  <sbarati@apple.com>
1885
1886         SpeculativeJIT::compileTryGetById needs to pass in NeedsToSpill along both the cell speculation and untyped speculation path
1887         https://bugs.webkit.org/show_bug.cgi?id=163622
1888
1889         Reviewed by Yusuke Suzuki.
1890
1891         * stress/try-get-by-id-should-spill-registers-dfg.js: Added.
1892         (let.f.createBuiltin):
1893
1894 2016-10-21  Caitlin Potter  <caitp@igalia.com>
1895
1896         [JSC] don't crash when arguments to `new Function()` produce unexpected AST
1897         https://bugs.webkit.org/show_bug.cgi?id=163748
1898
1899         Reviewed by Mark Lam.
1900
1901         * stress/regress-163748.js: Added.
1902         (assert):
1903         (shouldThrowSyntaxError):
1904         (GeneratorFunction):
1905
1906 2016-10-20  Keith Miller  <keith_miller@apple.com>
1907
1908         Add support for WASM calls
1909         https://bugs.webkit.org/show_bug.cgi?id=161727
1910
1911         Reviewed by Filip Pizlo and Michael Saboff.
1912
1913         Add members of the Call category to the WASMOps special group.
1914
1915         * wasm/generate-wasmops-header.js:
1916
1917 2016-10-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1918
1919         [JSC] Drop isEnvironmentRecord type info flag and use JSType information instead
1920         https://bugs.webkit.org/show_bug.cgi?id=163761
1921
1922         Reviewed by Keith Miller.
1923
1924         * modules/string-prototype-module-scope.js: Added.
1925         (shouldBe):
1926         (catch):
1927         (refer):
1928         * stress/string-prototype-scopes-global-lexical-environment-strict.js: Added.
1929         (shouldBe):
1930         (catch):
1931         * stress/string-prototype-scopes-global-lexical-environment.js: Added.
1932         (shouldBe):
1933         (catch):
1934         * stress/string-prototype-scopes-strict.js: Added.
1935         (shouldBe):
1936         (catch):
1937         (try.refer):
1938         (refer):
1939         * stress/string-prototype-scopes.js: Added.
1940         (shouldBe):
1941         (catch):
1942         (try.refer):
1943         (refer):
1944         (object.toString):
1945         (with):
1946
1947 2016-10-20  JF Bastien  <jfbastien@apple.com>
1948
1949         WebAssembly API: implement exception constructors properly
1950
1951          - Rename WebAssemblyObject to JSWebAssembly for consistency.
1952          - WebAssembly object now has its own prototype: add WebAssemblyPrototype, and
1953            use it to register JSWebAssembly's function properties through auto-generated
1954            .lut.h, instead of manually.
1955          - The error constructors used to throw (e.g. `new WebAssembly.CompileError()`).
1956          - Register WebAssembly's constructors from the global object, and hold a
1957            reference to their structure and prototype so that invoking the constructor
1958            can use the structure directly from the global object.
1959          - Add a prototype base field to global object creation. Previous ones all had
1960            Object's prototype as their base, but WebAssembly's error constructors have
1961            Error as their base.
1962          - Test for the error object's correctness.
1963          - Add missing #if ENABLE(WEBASSEMBLY)
1964
1965         WebAssembly API: implement exception constructors properly
1966         https://bugs.webkit.org/show_bug.cgi?id=163699
1967
1968         Reviewed by Keith Miller.
1969
1970         * wasm/js-api/test_basic_api.js:
1971         (const.c.in.constructorProperties): more tests
1972
1973 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1974
1975         [JSC] disallow references to `await` in AsyncFunction formal parameters
1976         https://bugs.webkit.org/show_bug.cgi?id=163694
1977
1978         Reviewed by Saam Barati.
1979
1980         * stress/async-await-syntax.js:
1981
1982 2016-10-20  Keith Miller  <keith_miller@apple.com>
1983
1984         Invalid assertion in arguments elimination
1985         https://bugs.webkit.org/show_bug.cgi?id=163740
1986         <rdar://problem/27911462>
1987
1988         Reviewed by Michael Saboff.
1989
1990         * stress/direct-arguments-osr-entry.js: Added.
1991         (foo.):
1992         (foo):
1993
1994 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1995
1996         [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
1997         https://bugs.webkit.org/show_bug.cgi?id=163714
1998
1999         Reviewed by Mark Lam.
2000
2001         Add missing test coverage that dynamically created
2002         JSGeneratorFunctions can not be constructed.
2003
2004         * stress/generator-function-constructor.js:
2005         (shouldThrow):
2006
2007 2016-10-19  JF Bastien  <jfbastien@apple.com>
2008
2009         JavaScript WebAssembly API: baby steps
2010
2011          - Expand WebAssembly constructors into their own files. This requires a lot of
2012            boilerplate, as well as adding the .lut.h files. All of the
2013            JSWebAssembly*.{h,cpp}, as well as Constructor and Prototype files, are
2014            currently the same between the 4 specified WebAssembly constructors. It'll be
2015            easy to implement individual functions on constructed objects as per the
2016            spec, and have each of these files diverge. The error constructors are also
2017            similar, except that their instance derives from ErrorInstance.
2018          - Use constructor macro when initializing the global object.
2019          - Dramatically improve testing of the WebAssembly API by checking for
2020            properties specified in the spec [*].
2021          - Clean up assert.js' exception testing.
2022          - Fix a copy-paste bug in wasm.json: floating-point const return values were
2023            swapped.
2024
2025         [*] https://github.com/WebAssembly/design/blob/master/JS.md
2026
2027         Implement more of the JavaScript WebAssembly API
2028         https://bugs.webkit.org/show_bug.cgi?id=163571
2029
2030         Reviewed by Keith Miller.
2031
2032         * wasm/assert.js:
2033         (export.const.isUndef): add this useful helper
2034         (export.const.throws): fold other throw checks into this one, and check message as well
2035         * wasm/js-api/test_basic_api.js:
2036         (const.checkOwnPropertyDescriptor): check own property descriptor follows the spec
2037         * wasm/self-test/test_BuilderJSON.js:
2038         (const.assertOpThrows): use new assert API
2039         (CheckedOpcodeArgumentsTooMany): ditto
2040         (CheckedOpcodeArgumentsNotEnough): ditto
2041         (CallInvalid): ditto
2042         (I32ConstInvalid): ditto
2043         (F32ConstInvalid): ditto (and this caugth the JSON copy-paste bug)
2044         (F64ConstInvalid): ditto
2045         * wasm/self-test/test_LowLevelBinary_varint.js: use new assert API
2046         * wasm/self-test/test_LowLevelBinary_varuint.js: use new assert API
2047         * wasm/utilities.js: add "global" object, used in basic API test (to access global.WebAssembly).
2048         * wasm/wasm.json: fix copy-paste
2049
2050 2016-10-19  Caitlin Potter  <caitp@igalia.com>
2051
2052         [JSC] forbid "use strict" directive in generator functions with non-simple parameters
2053         https://bugs.webkit.org/show_bug.cgi?id=163683
2054
2055         Reviewed by Geoffrey Garen.
2056
2057         Update various generator*-non-simple-param.js tests to be passing.
2058
2059         * test262.yaml:
2060
2061 2016-10-18  Mark Lam  <mark.lam@apple.com>
2062
2063         Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
2064         https://bugs.webkit.org/show_bug.cgi?id=154377
2065         <rdar://problem/27330808>
2066
2067         Reviewed by Filip Pizlo and Saam Barati.
2068
2069         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.
2070
2071 2016-10-18  Keith Miller  <keith_miller@apple.com>
2072
2073         GetByVal to GetById conversion in the DFG is incorrect for getters with control flow
2074         https://bugs.webkit.org/show_bug.cgi?id=163629
2075
2076         Reviewed by Yusuke Suzuki.
2077
2078         * stress/get-by-val-to-id-with-getter.js: Added.
2079         (foo):
2080         (o.get hello):
2081
2082 2016-10-15  Filip Pizlo  <fpizlo@apple.com>
2083
2084         DFG and FTL should be able to use DirectCall ICs when they proved the callee or its executable
2085         https://bugs.webkit.org/show_bug.cgi?id=163371
2086
2087         Reviewed by Geoffrey Garen and Saam Barati.
2088         
2089         Add microbenchmarks for all of the cases that this patch optimizes.
2090
2091         * microbenchmarks/direct-call-arity-mismatch.js: Added.
2092         (foo):
2093         (bar):
2094         * microbenchmarks/direct-call.js: Added.
2095         (foo):
2096         (bar):
2097         * microbenchmarks/direct-construct-arity-mismatch.js: Added.
2098         (Foo):
2099         (bar):
2100         * microbenchmarks/direct-construct.js: Added.
2101         (Foo):
2102         (bar):
2103         * microbenchmarks/direct-tail-call-arity-mismatch.js: Added.
2104         (foo):
2105         (bar):
2106         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js: Added.
2107         (foo):
2108         (bar):
2109         (baz):
2110         * microbenchmarks/direct-tail-call-inlined-caller.js: Added.
2111         (foo):
2112         (bar):
2113         (baz):
2114         * microbenchmarks/direct-tail-call.js: Added.
2115         (foo):
2116         (bar):
2117
2118 2016-10-18  Caitlin Potter  <caitp@igalia.com>
2119
2120         [JSC] ES6 Method functions should not have prototype
2121         https://bugs.webkit.org/show_bug.cgi?id=162530
2122
2123         Reviewed by Saam Barati.
2124
2125         Fix test262 expectations about MethodDefinitions
2126
2127         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
2128         * stress/reflect-set.js:
2129         * test262.yaml:
2130
2131 2016-10-17  Keith Miller  <keith_miller@apple.com>
2132
2133         Add support for WASM Memory.
2134         https://bugs.webkit.org/show_bug.cgi?id=161710
2135
2136         Reviewed by Geoffrey Garen.
2137
2138         Add store and load opcodes to wasm.json. Additionally, add new
2139         enums for those opcodes in the generator.
2140
2141         * stress/wasm/generate-wasmops-header.js:
2142         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType):
2143         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType):
2144
2145 2016-10-17  Saam Barati  <sbarati@apple.com>
2146
2147         Add more tests for the double->String conversion in ValueAdd constant folding
2148         https://bugs.webkit.org/show_bug.cgi?id=163517
2149
2150         Reviewed by Yusuke Suzuki.
2151
2152         * microbenchmarks/string-add-constant-folding.js:
2153         (test):
2154
2155 2016-10-17  JF Bastien  <jfbastien@apple.com>
2156
2157         WebAssembly JS API: implement basic stub
2158
2159         Implement the global WebAssembly JavaScript object, and its constructor +
2160         function properties as described in:
2161           https://github.com/WebAssembly/design/blob/master/JS.md
2162
2163         These don't do anything at the moment, the parent bug will take care of adding
2164         more functionality and associated tests.
2165
2166         WebAssembly JS API: implement basic stub
2167         https://bugs.webkit.org/show_bug.cgi?id=163404
2168
2169         Reviewed by Keith Miller.
2170
2171         * wasm.yaml:
2172         * wasm/js-api/test_basic_api.js: Added.
2173         (const.f.of.functionProperties.WebAssembly.f.undefined.throw.new.Error.Couldn.const.c.of.constructorProperties.WebAssembly.c.undefined.throw.new.Error.Couldn):
2174         (const.c.of.constructorProperties.catch):
2175
2176 2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2177
2178         [DOMJIT] Use DOMJIT::Patchpoint in IC
2179         https://bugs.webkit.org/show_bug.cgi?id=163223
2180
2181         Reviewed by Saam Barati.
2182
2183         * stress/domjit-exception-ic.js: Added.
2184         (shouldBe):
2185         (access):
2186         * stress/domjit-exception.js: Added.
2187         (shouldBe):
2188         (access):
2189         * stress/domjit-getter-complex-with-incorrect-object.js: Added.
2190         (shouldThrow):
2191         (access):
2192         (i.shouldThrow):
2193         * stress/domjit-getter-complex.js: Added.
2194         (shouldBe):
2195         (access):
2196         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js: Added.
2197         (assert):
2198         (bar):
2199         (foo):
2200
2201 2016-10-15  Saam Barati  <sbarati@apple.com>
2202
2203         Assertion failed under operationToLowerCase with a rope with zero length
2204         https://bugs.webkit.org/show_bug.cgi?id=163314
2205
2206         Reviewed by Mark Lam.
2207
2208         * stress/to-lower-case-intrinsic-on-empty-rope.js: Added.
2209         (assert):
2210         (returnRope.helper):
2211         (returnRope):
2212         (lower):
2213
2214 2016-10-14  Benjamin Poulain  <bpoulain@apple.com>
2215
2216         [JSC] op_negate should with any type
2217         https://bugs.webkit.org/show_bug.cgi?id=162587
2218
2219         Reviewed by Saam Barati.
2220
2221         * stress/arith-abs-to-arith-negate-range-optimizaton.js: Added.
2222         Cover OSR Exits when converting Math.abs() into ArithNegate.
2223
2224         * stress/arith-negate-on-various-types.js: Added.
2225         Cover ArithNegate with all types.
2226
2227 2016-10-14  JF Bastien  <jfbastien@apple.com>
2228
2229         Basic WebAssembly testing
2230
2231         Create a small DSL in JavaScript which can build WebAssembly binary modules based on the JSON description of the format as described in:
2232         https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md
2233
2234         This DSL can then be used to write small text description of valid and invalid WebAssembly binaries, making testing the JSC implementation much easier.
2235
2236         Details and example in README.md.
2237
2238         Basic WebAssembly testing
2239         https://bugs.webkit.org/show_bug.cgi?id=163267
2240
2241         Reviewed by Keith Miller.
2242
2243         * stress/wasm/wasm.json: Removed.
2244         * wasm.yaml: Added.
2245         * wasm/Builder.js: Added.
2246         (const._isValidValue):
2247         (const._BuildWebAssemblyBinary):
2248         (export.default.Builder):
2249         (export.default.Builder.prototype.setChecked):
2250         (export.default.Builder.prototype.setPreamble):
2251         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2252         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
2253         (export.default.Builder.prototype._registerSectionBuilders):
2254         (export.default.Builder.prototype._addSection):
2255         (export.default.Builder.prototype.optimize):
2256         (export.default.Builder.prototype.json):
2257         (export.default.Builder.prototype.AsmJS):
2258         (export.default.Builder.prototype.WebAssembly):
2259         * wasm/LowLevelBinary.js: Added.
2260         (const._getterRangeCheck):
2261         (const._hexdump):
2262         (export.default.LowLevelBinary):
2263         (export.default.LowLevelBinary.prototype.newPatchable):
2264         (export.default.LowLevelBinary.prototype.hexdump):
2265         (export.default.LowLevelBinary.prototype._maybeGrow):
2266         (export.default.LowLevelBinary.prototype._push8):
2267         (export.default.LowLevelBinary.prototype.uint8):
2268         (export.default.LowLevelBinary.prototype.uint16):
2269         (export.default.LowLevelBinary.prototype.uint32):
2270         (export.default.LowLevelBinary.prototype.varuint):
2271         (export.default.LowLevelBinary.prototype.varint):
2272         (export.default.LowLevelBinary.prototype.varuint7):
2273         (export.default.LowLevelBinary.prototype.string):
2274         (export.default.LowLevelBinary.prototype.getSize):
2275         (export.default.LowLevelBinary.prototype.getUint8):
2276         (export.default.LowLevelBinary.prototype.getUint16):
2277         (export.default.LowLevelBinary.prototype.getUint32):
2278         (export.default.LowLevelBinary.prototype.getVaruint):
2279         (export.default.LowLevelBinary.prototype.getVarint):
2280         (export.default.LowLevelBinary.prototype.getVaruint7):
2281         (export.default.LowLevelBinary.prototype.getString):
2282         (PatchableLowLevelBinary):
2283         (PatchableLowLevelBinary.prototype._push8):
2284         (PatchableLowLevelBinary.prototype.apply):
2285         * wasm/README.md: Added.
2286         * wasm/WASM.js: Added.
2287         * wasm/assert.js: Added.
2288         (export.const.notUndef):
2289         (export.const.eq):
2290         (export.const.ge):
2291         (export.const.throwsError):
2292         (export.const.throwsRangeError):
2293         * wasm/generate-wasmops-header.js: Renamed from JSTests/stress/wasm/generate-wasmops-header.js.
2294         * wasm/self-test/test_BuilderJSON.js: Added.
2295         (const.assertOpThrows):
2296         (EmptyModule):
2297         (CustomMagicNumber):
2298         (CustomVersion):
2299         (CustomSection):
2300         (CustomSectionAllBytes):
2301         (CustomSectionInvalidByte):
2302         (TwoCustomSections):
2303         (EmptyCodeSection):
2304         (CodeSectionWithEmptyFunction):
2305         (CodeSectionWithEmptyFunctionWithParameters):
2306         (InvalidFunctionParameters):
2307         (SimpleFunction):
2308         (TwoSimpleFunctions):
2309         (TwoBuildersAtTheSameTime):
2310         (CheckedOpcodeArgumentsTooMany):
2311         (CheckedOpcodeArgumentsNotEnough):
2312         (CallNoArguments):
2313         (CallInvalid):
2314         (I32ConstInvalid):
2315         (F32ConstInvalid):
2316         (F64ConstInvalid):
2317         (CallManyFromStack):
2318         (OpcodeAdd):
2319         (OpcodeUnreachable):
2320         (OpcodeUnreachableCombinations):
2321         (OpcodeSelect):
2322         * wasm/self-test/test_BuilderWebAssembly.js: Added.
2323         (EmptyModule):
2324         (CustomSection):
2325         (Basic):
2326         * wasm/self-test/test_LowLevelBinary_encode.js: Added.
2327         * wasm/self-test/test_LowLevelBinary_string.js: Added.
2328         * wasm/self-test/test_LowLevelBinary_uint16.js: Added.
2329         * wasm/self-test/test_LowLevelBinary_uint32.js: Added.
2330         * wasm/self-test/test_LowLevelBinary_uint8.js: Added.
2331         * wasm/self-test/test_LowLevelBinary_varint.js: Added.
2332         * wasm/self-test/test_LowLevelBinary_varuint.js: Added.
2333         * wasm/self-test/test_LowLevelBinary_varuint7.js: Added.
2334         * wasm/self-test/test_WASM.js: Added.
2335         * wasm/test.sh: Added.
2336         * wasm/utilities.js: Added.
2337         (const._read.filename.switch):
2338         (const._load.filename.switch):
2339         (const._json.filename.switch):
2340         * wasm/wasm.json: Added.
2341
2342 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2343
2344         test262: @isConstructor incorrectly thinks Math.cos is a constructor
2345         https://bugs.webkit.org/show_bug.cgi?id=163437
2346
2347         Reviewed by Saam Barati.
2348
2349         * stress/is-constructor.js: Added.
2350         (assert):
2351         (prototype.assert):
2352         New test to cover the @isConstructor builtin.
2353
2354         * test262.yaml:
2355         Test now passes.
2356
2357 2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
2358
2359         Unreviewed, rolling out r207322.
2360
2361         This change caused JSC test failures
2362
2363         Reverted changeset:
2364
2365         "Fix Array.prototype.splice ES6 compliance."
2366         https://bugs.webkit.org/show_bug.cgi?id=163372
2367         http://trac.webkit.org/changeset/207322
2368
2369 2016-10-14  Mark Lam  <mark.lam@apple.com>
2370
2371         JSON.parse should not modify frozen objects.
2372         https://bugs.webkit.org/show_bug.cgi?id=163430
2373
2374         Reviewed by Saam Barati.
2375
2376         * stress/json-parse-on-frozen-object.js: Added.
2377
2378 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2379
2380         test262: Failure with RegExp.prototype.compile when pattern is undefined
2381         https://bugs.webkit.org/show_bug.cgi?id=163431
2382
2383         Reviewed by Yusuke Suzuki.
2384
2385         * test262.yaml:
2386
2387 2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
2388
2389         Exception message for expressions with multiple bracket accesses is inconsistent / incorrect
2390         https://bugs.webkit.org/show_bug.cgi?id=163426
2391
2392         Reviewed by Geoffrey Garen.
2393
2394         * ChakraCore/test/Error/CallNonFunction_3.baseline-jsc:
2395         * ChakraCore/test/Object/null.baseline-jsc:
2396         * stress/exception-in-to-property-key-should-be-handled-early.js:
2397         Better exception messages.
2398
2399 2016-10-13  Mark Lam  <mark.lam@apple.com>
2400
2401         Fix Array.prototype.splice ES6 compliance.
2402         https://bugs.webkit.org/show_bug.cgi?id=163372
2403
2404         Reviewed by Geoffrey Garen and Yusuke Suzuki.
2405
2406         * stress/array-splice-on-frozen-object.js: Added.
2407
2408 2016-10-12  Keith Miller  <keith_miller@apple.com>
2409
2410         Handle non-function, non-undefined comparator in Array.prototype.sort
2411         https://bugs.webkit.org/show_bug.cgi?id=163085
2412
2413         Reviewed by Yusuke Suzuki.
2414
2415         * ChakraCore/test/Array/array_sort.baseline-jsc:
2416         * stress/array-sort-bad-comparator.js: Added.
2417         (test):
2418
2419 2016-10-12  Mark Lam  <mark.lam@apple.com>
2420
2421         Array.prototype.slice should not modify frozen objects.
2422         https://bugs.webkit.org/show_bug.cgi?id=163338
2423
2424         Reviewed by Filip Pizlo.
2425
2426         * stress/array-slice-on-frozen-object.js: Added.
2427
2428 2016-10-11  Mark Lam  <mark.lam@apple.com>
2429
2430         Array.prototype.concat should not modify frozen objects.
2431         https://bugs.webkit.org/show_bug.cgi?id=163302
2432
2433         Reviewed by Filip Pizlo.
2434
2435         * stress/array-concat-on-frozen-object.js: Added.
2436
2437 2016-10-11  Saam Barati  <sbarati@apple.com>
2438
2439         ValueAdd should be constant folded if the operands are constant String,Primitive or Primitive,String
2440         https://bugs.webkit.org/show_bug.cgi?id=163182
2441
2442         Reviewed by Filip Pizlo.
2443
2444         * microbenchmarks/string-add-constant-folding.js: Added.
2445         (assert):
2446         (runTests):
2447         (add):
2448         (test):
2449
2450 2016-10-07  Mark Lam  <mark.lam@apple.com>
2451
2452         Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
2453         https://bugs.webkit.org/show_bug.cgi?id=163160
2454
2455         Reviewed by Saam Barati.
2456
2457         * stress/object-freeze-with-proxy-preventExtensions.js: Added.
2458         * stress/object-seal-with-proxy-preventExtensions.js: Added.
2459
2460 2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2461
2462         [DOMJIT] Add initial CheckDOM and CallDOM implementations
2463         https://bugs.webkit.org/show_bug.cgi?id=162941
2464
2465         Reviewed by Filip Pizlo.
2466
2467         * stress/domjit-getter-poly.js: Added.
2468         (shouldBe):
2469         (access):
2470         * stress/domjit-getter-proto.js: Added.
2471         (shouldBe):
2472         (access):
2473         * stress/domjit-getter-super-poly.js: Added.
2474         (shouldBe):
2475         (access):
2476         * stress/domjit-getter.js: Added.
2477         (shouldBe):
2478         (access):
2479
2480 2016-10-04  Saam Barati  <sbarati@apple.com>
2481
2482         String.prototype.toLowerCase should be a DFG/FTL intrinsic
2483         https://bugs.webkit.org/show_bug.cgi?id=162887
2484
2485         Reviewed by Filip Pizlo and Yusuke Suzuki.
2486
2487         * microbenchmarks/to-lower-case.js: Added.
2488         (assert):
2489         (foo):
2490         (bar):
2491         * stress/to-lower-case.js: Added.
2492         (assert):
2493         (foo):
2494
2495 2016-10-04  JF Bastien  <jfbastien@apple.com>
2496
2497         WebAssembly: handle a few corner cases
2498         https://bugs.webkit.org/show_bug.cgi?id=162884
2499
2500         Reviewed by Keith Miller.
2501
2502         * stress/wasm/generate-wasmops-header.js:
2503         (const.opcodeIterator): max opcode value
2504
2505 2016-10-03  JF Bastien  <jfbastien@apple.com>
2506
2507         Auto-generate WASMOps.h, share with testing JSON file
2508         https://bugs.webkit.org/show_bug.cgi?id=162870
2509
2510         Reviewed by Keith Miller.
2511
2512         * stress/wasm/to-c++.js: Added. Generates WASMOps.h, siilar to the current one but with more data.
2513         (const.opcode_iterator):
2514         (opcode_macroizer):
2515         * stress/wasm/wasm.json: Added. Data from 0xC binary format version.
2516
2517 2016-10-03  Saam Barati  <sbarati@apple.com>
2518
2519         MapHash should speculate on the type of its child node
2520         https://bugs.webkit.org/show_bug.cgi?id=161922
2521
2522         Reviewed by Filip Pizlo.
2523
2524         * microbenchmarks/map-key-well-typed.js: Added.
2525         (assert):
2526         (intKey):
2527         (doubleKey):
2528         (objectKey):
2529         (stringKey):
2530         (booleanKey):
2531         (symbolKey):
2532         (cellKey):
2533         (assert.doubleKey):
2534         (assert.booleanKey):
2535
2536 2016-10-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2537
2538         [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
2539         https://bugs.webkit.org/show_bug.cgi?id=162849
2540
2541         Reviewed by Geoffrey Garen.
2542
2543         * test262.yaml:
2544
2545 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2546
2547         [ES6] Align attributes of Generator related properties to spec
2548         https://bugs.webkit.org/show_bug.cgi?id=162839
2549
2550         Reviewed by Saam Barati.
2551
2552         * test262.yaml:
2553
2554 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2555
2556         [ES6] GeneratorFunction constructor should instantiate generator function
2557         https://bugs.webkit.org/show_bug.cgi?id=162838
2558
2559         Reviewed by Saam Barati.
2560
2561         * stress/generator-function-constructor-is-subclassible.js: Added.
2562         (shouldBe):
2563         (GeneratorFunction):
2564         (prototype.hello):
2565         * stress/generator-function-constructor.js:
2566         * test262.yaml:
2567
2568 2016-09-30  Saam Barati  <sbarati@apple.com>
2569
2570         Arrow functions should not allow duplicate parameter names
2571         https://bugs.webkit.org/show_bug.cgi?id=162741
2572
2573         Reviewed by Filip Pizlo.
2574
2575         * test262.yaml:
2576
2577 2016-09-30  Saam Barati  <sbarati@apple.com>
2578
2579         Make some microbenchmarks run for less time.
2580
2581         Rubber stamped by Filip Pizlo.
2582
2583         * microbenchmarks/bound-function-construction-performance.js:
2584         (foo):
2585         * microbenchmarks/getter-richards-try-catch.js:
2586
2587 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2588
2589         Arrow functions do not infer name from computed property but normal functions do
2590         https://bugs.webkit.org/show_bug.cgi?id=162720
2591
2592         Reviewed by Saam Barati.
2593
2594         * stress/inferred-names.js:
2595
2596 2016-09-29  Mark Lam  <mark.lam@apple.com>
2597
2598         Break some slow running tests into smaller bits so they don't time out.
2599         https://bugs.webkit.org/show_bug.cgi?id=162743
2600
2601         Reviewed by Keith Miller.
2602
2603         The following tests have shown to be slow running:
2604             op_div.js
2605             op_lshift.js
2606             op_mod.js
2607             op_mul.js
2608             op_rshift.js
2609             op_sub.js
2610             op_urshift
2611
2612         These tests auto-generate permutations of values to apply to binary operations.
2613         They also test the operations with 3 permutations of value types:
2614             1. VarVar - both operands variables
2615             2. VarConst - variable operand 1, constant / literal operand 2
2616             3. ConstVar - constant / literal operand 1, variable operand 2
2617
2618         We can prevent these tests from timing out by breaking each up to only run 1 of
2619         the 3 permutations of value types.
2620
2621         * stress/op_div-ConstVar.js: Added.
2622         * stress/op_div-VarConst.js: Added.
2623         * stress/op_div-VarVar.js: Copied from JSTests/stress/op_div.js.
2624         (o1.valueOf): Deleted.
2625         * stress/op_div.js: Removed.
2626         * stress/op_lshift-ConstVar.js: Added.
2627         * stress/op_lshift-VarConst.js: Added.
2628         * stress/op_lshift-VarVar.js: Copied from JSTests/stress/op_lshift.js.
2629         (o1.valueOf): Deleted.
2630         * stress/op_lshift.js: Removed.
2631         * stress/op_mod-ConstVar.js: Added.
2632         * stress/op_mod-VarConst.js: Added.
2633         * stress/op_mod-VarVar.js: Copied from JSTests/stress/op_mod.js.
2634         (o1.valueOf): Deleted.
2635         * stress/op_mod.js: Removed.
2636         * stress/op_mul-ConstVar.js: Added.
2637         * stress/op_mul-VarConst.js: Added.
2638         * stress/op_mul-VarVar.js: Copied from JSTests/stress/op_mul.js.
2639         (o1.valueOf): Deleted.
2640         * stress/op_mul.js: Removed.
2641         * stress/op_rshift-ConstVar.js: Added.
2642         * stress/op_rshift-VarConst.js: Added.
2643         * stress/op_rshift-VarVar.js: Copied from JSTests/stress/op_rshift.js.
2644         (o1.valueOf): Deleted.
2645         * stress/op_rshift.js: Removed.
2646         * stress/op_sub-ConstVar.js: Added.
2647         * stress/op_sub-VarConst.js: Added.
2648         * stress/op_sub-VarVar.js: Copied from JSTests/stress/op_sub.js.
2649         (o1.valueOf): Deleted.
2650         * stress/op_sub.js: Removed.
2651         * stress/op_urshift-ConstVar.js: Added.
2652         * stress/op_urshift-VarConst.js: Added.
2653         * stress/op_urshift-VarVar.js: Copied from JSTests/stress/op_urshift.js.
2654         (o1.valueOf): Deleted.
2655         * stress/op_urshift.js: Removed.
2656         * stress/resources/binary-op-values.js: Added.
2657         (o1.valueOf):
2658
2659 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2660
2661         test262: class and function names should be inferred in assignment
2662         https://bugs.webkit.org/show_bug.cgi?id=146262
2663
2664         Reviewed by Saam Barati.
2665
2666         * stress/arrowfunction-name.js: Added.
2667         Quick tests for arrow function names.
2668
2669         * stress/inferred-names.js: Added.
2670         General test for inferred function names.
2671
2672         * test262.yaml:
2673         Pass many tests checking inferred function names.
2674
2675 2016-09-29  Saam Barati  <sbarati@apple.com>
2676
2677         We don't properly propagate non-simple-parameter-list when parsing a setter
2678         https://bugs.webkit.org/show_bug.cgi?id=160483
2679
2680         Reviewed by Joseph Pecoraro.
2681
2682         * test262.yaml:
2683
2684 2016-09-28  Saam Barati  <sbarati@apple.com>
2685
2686         stringProtoFuncRepeatCharacter will return `null` when it should not
2687         https://bugs.webkit.org/show_bug.cgi?id=161944
2688
2689         Reviewed by Yusuke Suzuki.
2690
2691         * stress/pad-start-calls-repeat-character-with-double.js: Added.
2692         (logLinesWithContext):
2693
2694 2016-09-27  Filip Pizlo  <fpizlo@apple.com>
2695
2696         B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
2697         https://bugs.webkit.org/show_bug.cgi?id=162644
2698
2699         Reviewed by Keith Miller.
2700
2701         * stress/chill-mod-chill-mod.js: Added.
2702         (foo):
2703
2704 2016-09-26  Csaba Osztrogonác  <oszi@inf.u-szeged.hu>
2705
2706         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2707         https://bugs.webkit.org/show_bug.cgi?id=162386
2708
2709         Unreviewed, relanding r206317 after typo fix.
2710
2711         * stress/string-joining-long-strings-should-not-crash.js:
2712
2713 2016-09-24  Caitlin Potter  <caitp@igalia.com>
2714
2715         [JSTests] fix test262 expectations following r206333
2716         https://bugs.webkit.org/show_bug.cgi?id=162533
2717
2718         Reviewed by Yusuke Suzuki.
2719
2720         * test262.yaml:
2721
2722 2016-09-23  Caitlin Potter  <caitp@igalia.com>
2723
2724         [JSC] Implement parsing of Async Functions
2725         https://bugs.webkit.org/show_bug.cgi?id=161409
2726
2727         Reviewed by Yusuke Suzuki.
2728
2729         * stress/async-await-syntax.js: Added.
2730         (testSyntax):
2731         (testSyntaxError):
2732         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2733         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2734         (testTopLevelAsyncAwaitSyntaxStrictMode):
2735         (testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2736         (testNestedAsyncAwaitSyntax.async):
2737         (testNestedAsyncAwaitSyntax.foo):
2738         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2739
2740 2016-09-23  Ryan Haddad  <ryanhaddad@apple.com>
2741
2742         Unreviewed, rolling out r206317.
2743
2744         This change caused timeouts on El Capitan Release JSC tests
2745
2746         Reverted changeset:
2747
2748         "Skip stress/string-joining-long-strings-should-not-crash.js
2749         on memory limited devices"
2750         https://bugs.webkit.org/show_bug.cgi?id=162386
2751         http://trac.webkit.org/changeset/206317
2752
2753 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2754
2755         Skip mozilla-tests.yaml/js1_5/Array/regress-157652 on memory limited devices
2756         https://bugs.webkit.org/show_bug.cgi?id=162381
2757
2758         Reviewed by Mark Lam.
2759
2760         * mozilla/mozilla-tests.yaml:
2761
2762 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2763
2764         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2765         https://bugs.webkit.org/show_bug.cgi?id=162386
2766
2767         Reviewed by Mark Lam.
2768
2769         * stress/string-joining-long-strings-should-not-crash.js:
2770
2771 2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
2772
2773         [JSC] Use an inline cache to generate op_negate
2774         https://bugs.webkit.org/show_bug.cgi?id=162371
2775
2776         Reviewed by Saam Barati.
2777
2778         * stress/op-negate-inline-cache.js: Added.
2779
2780 2016-09-22  Mark Lam  <mark.lam@apple.com>
2781
2782         Array.prototype.join should do overflow checks on string joins.
2783         https://bugs.webkit.org/show_bug.cgi?id=162459
2784
2785         Reviewed by Saam Barati.
2786
2787         * stress/array-join-on-strings-need-overflow-checks.js: Added.
2788         (assert):
2789         (catch):
2790
2791 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
2792
2793         test262: Function length should be number of parameters before parameters with default values
2794         https://bugs.webkit.org/show_bug.cgi?id=162377
2795
2796         Reviewed by Saam Barati.
2797
2798         * stress/es6-default-parameters.js:
2799         Add our own tests for function lengths with default parameters.
2800
2801         * test262.yaml:
2802         We now pass all dflt-length tests.
2803
2804 2016-09-20  Benjamin Poulain  <bpoulain@apple.com>
2805
2806         [JSC] Do not use EagerRun on tests counting recompilation
2807         https://bugs.webkit.org/show_bug.cgi?id=162248
2808
2809         Reviewed by Geoffrey Garen.
2810
2811         This patch adds defaultNoEagerRun to all the tests
2812         for which recompilation is the symptom of a bug.
2813         The reason is that an OSR Exit can be unrelated to the tested
2814         nodes when we are running in Eager mode.
2815
2816         * stress/arith-abs-on-various-types.js:
2817         * stress/arith-ceil-on-various-types.js:
2818         * stress/arith-clz32-on-various-types.js:
2819         * stress/arith-cos-on-various-types.js:
2820         * stress/arith-floor-on-various-types.js:
2821         * stress/arith-fround-on-various-types.js:
2822         * stress/arith-log-on-various-types.js:
2823         * stress/arith-round-on-various-types.js:
2824         * stress/arith-sin-on-various-types.js:
2825         * stress/arith-sqrt-on-various-types.js:
2826         * stress/arith-tan-on-various-types.js:
2827         * stress/arith-trunc-on-various-types.js:
2828
2829         * stress/compare-strict-eq-on-various-types.js:
2830         (testAllTypesCall):
2831         The value 2 came from the other tests.
2832         CompareStrictEq supports many more cases, the worst case
2833         is bool->int->int52->number->polymorphic.
2834
2835 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
2836
2837         Make MarkedBlock state tracking support overlapped allocation and marking state
2838         https://bugs.webkit.org/show_bug.cgi?id=161581
2839
2840         Reviewed by Geoffrey Garen.
2841         
2842         Add a microbenchmark for why we want to reclaim empty blocks from other allocators.
2843
2844         * microbenchmarks/switching-size-classes.js: Added.
2845
2846 2016-09-20  Saam Barati  <sbarati@apple.com>
2847
2848         Unreviewed, added test for x86 32-bit failure for HasOwnProperty node in DFG.
2849
2850         * stress/has-own-property-called-on-non-object.js: Added.
2851         (let.objs):
2852         (new.String):
2853         (foo):
2854
2855 2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2856
2857         [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
2858         https://bugs.webkit.org/show_bug.cgi?id=162253
2859
2860         Reviewed by Sam Weinig.
2861
2862         * microbenchmarks/is-symbol-mixed.js: Added.
2863         (isSymbol):
2864         (i.let.pair.of.list.String):
2865         * microbenchmarks/is-symbol.js: Added.
2866         (isSymbol):
2867
2868 2016-09-19  Saam Barati  <sbarati@apple.com>
2869
2870         Make HasOwnProperty faster
2871         https://bugs.webkit.org/show_bug.cgi?id=161708
2872
2873         Reviewed by Geoffrey Garen.
2874
2875         * microbenchmarks/has-own-property-name-cache.js: Added.
2876         (foo):
2877         * stress/has-own-property-cache-basics.js: Added.
2878         (assert):
2879         (foo):
2880         * stress/has-own-property-name-cache-string-keys.js: Added.
2881         (assert):
2882         (foo):
2883         * stress/has-own-property-name-cache-symbol-keys.js: Added.
2884         (assert):
2885         (foo):
2886         * stress/has-own-property-name-cache-symbols-and-strings.js: Added.
2887         (assert):
2888         (foo):
2889
2890 2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
2891
2892         [JSC] Make the rounding-related nodes support any type
2893         https://bugs.webkit.org/show_bug.cgi?id=161895
2894
2895         Reviewed by Geoffrey Garen.
2896
2897         * stress/arith-ceil-on-various-types.js: Added.
2898         * stress/arith-floor-on-various-types.js: Added.
2899         * stress/arith-round-on-various-types.js: Added.
2900         * stress/arith-trunc-on-various-types.js: Added.
2901
2902 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
2903
2904         [JSC] Do not need to use defineProperty to define methods for object literals
2905         https://bugs.webkit.org/show_bug.cgi?id=162111
2906
2907         Reviewed by Saam Barati.
2908
2909         * stress/object-literal-methods.js: Added.
2910         (shouldBe):
2911         (throw.new.Error.let.object.get name):
2912         (throw.new.Error):
2913         (shouldBe.let.object.get name):
2914         (shouldBe.let.object.get prototype):
2915         (shouldBe.let.object.get 42):
2916
2917 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2918
2919         [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
2920         https://bugs.webkit.org/show_bug.cgi?id=162000
2921
2922         Reviewed by Filip Pizlo.
2923
2924         * microbenchmarks/is-array-for-array.js: Added.
2925         (isArray):
2926         * microbenchmarks/is-array-for-mixed-case.js: Added.
2927         (isArray):
2928         * microbenchmarks/is-array-for-non-array-object.js: Added.
2929         (isArray):
2930         * microbenchmarks/is-array-for-proxy.js: Added.
2931         (isArray):
2932         (isArray.proxy.throw.new.Error.isArray):
2933         (isArray.proxy.throw.new.Error):
2934
2935 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2936
2937         Unreviewed, gardening test262 results
2938
2939         Some tests are now passed with JSC, but marked as failed.
2940
2941         * test262.yaml:
2942
2943 2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
2944
2945         test262: Various Constructors length properties should be configurable
2946         https://bugs.webkit.org/show_bug.cgi?id=161998
2947
2948         Reviewed by Saam Barati.
2949
2950         * test262.yaml:
2951
2952 2016-09-15  Commit Queue  <commit-queue@webkit.org>
2953
2954         Unreviewed, rolling out r205931.
2955         https://bugs.webkit.org/show_bug.cgi?id=162021
2956
2957         Tests for this change fail on 32-bit JSC bots (Requested by
2958         ryanhaddad on #webkit).
2959
2960         Reverted changeset:
2961
2962         "[JSC] Make the rounding-related nodes support any type"
2963         https://bugs.webkit.org/show_bug.cgi?id=161895
2964         http://trac.webkit.org/changeset/205931
2965
2966 2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
2967
2968         test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
2969         https://bugs.webkit.org/show_bug.cgi?id=162013
2970
2971         Reviewed by Saam Barati.
2972
2973         * stress/es6-default-parameters.js:
2974         * test262.yaml:
2975
2976 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2977
2978         ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
2979         https://bugs.webkit.org/show_bug.cgi?id=162003
2980
2981         Reviewed by Saam Barati.
2982
2983         * stress/spread-calling.js:
2984         * test262.yaml:
2985
2986 2016-09-14  Michael Saboff  <msaboff@apple.com>
2987
2988         YARR doesn't check for invalid flags for literal regular expressions
2989         https://bugs.webkit.org/show_bug.cgi?id=161995
2990
2991         Reviewed by Mark Lam.
2992
2993         New test.
2994
2995         * stress/regress-161995.js: Added.
2996         (testStatic):
2997         (catch):
2998
2999 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3000
3001         test262: TypedArray constructors length should be 3 and configurable
3002         https://bugs.webkit.org/show_bug.cgi?id=161955
3003
3004         Reviewed by Mark Lam.
3005
3006         * test262.yaml:
3007
3008 2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
3009
3010         [JSC] Make the rounding-related nodes support any type
3011         https://bugs.webkit.org/show_bug.cgi?id=161895
3012
3013         Reviewed by Geoffrey Garen.
3014
3015         * stress/arith-ceil-on-various-types.js: Added.
3016         * stress/arith-floor-on-various-types.js: Added.
3017         * stress/arith-round-on-various-types.js: Added.
3018         * stress/arith-trunc-on-various-types.js: Added.
3019
3020 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3021
3022         TaggedTemplateString function calls should emit tail position calls
3023         https://bugs.webkit.org/show_bug.cgi?id=161948
3024
3025         Reviewed by Yusuke Suzuki.
3026
3027         * stress/tail-call-recognize.js:
3028         (runTests):
3029         Ensure a tagged template string function call is tail call.
3030
3031         * test262.yaml:
3032         These now pass.
3033
3034 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3035
3036         test262: Array.prototype.slice should always set length
3037         https://bugs.webkit.org/show_bug.cgi?id=161953
3038
3039         Reviewed by Mark Lam.
3040
3041         * test262.yaml:
3042
3043 2016-09-13  JF Bastien  <jfbastien@apple.com>
3044
3045         Support jsc shell builtin `read`
3046         https://bugs.webkit.org/show_bug.cgi?id=161662
3047
3048         Reviewed by Keith Miller.
3049
3050         * stress/jsc-read.js: Added.
3051         (test): test `read` and `readFile` shell builtins, in string and binary mode.
3052
3053 2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
3054
3055         ES6: Classes: Should be allowed to create a static method with name "arguments"
3056         https://bugs.webkit.org/show_bug.cgi?id=152985
3057
3058         Reviewed by Keith Miller.
3059
3060         * test262.yaml:
3061
3062 2016-09-12  Saam Barati  <sbarati@apple.com>
3063
3064         Speed up Function.prototype.bind a bit by making it a builtin
3065         https://bugs.webkit.org/show_bug.cgi?id=161879
3066
3067         Reviewed by Filip Pizlo.
3068
3069         * microbenchmarks/function-bind-inlining.js: Added.
3070         (assert):
3071         (test):
3072         (test2):
3073         (foo):
3074         * microbenchmarks/function-bind-no-inlining.js: Added.
3075         (assert):
3076         (test):
3077         (test2):
3078         (foo):
3079
3080 2016-09-12  Saam Barati  <sbarati@apple.com>
3081
3082         HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
3083         https://bugs.webkit.org/show_bug.cgi?id=161640
3084
3085         Reviewed by Geoffrey Garen.
3086
3087         * microbenchmarks/map-rehash.js: Added.
3088         * stress/map-delete.js: Added.
3089         (assert):
3090         * stress/map-rehash-2.js: Added.
3091         (assert):
3092         * stress/map-rehash.js: Added.
3093         (assert):
3094
3095 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3096
3097         Unreviewed, fix tests for different libm environments
3098         https://bugs.webkit.org/show_bug.cgi?id=161857
3099
3100         * stress/ftl-arithtan.js:
3101
3102 2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
3103
3104         [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
3105         https://bugs.webkit.org/show_bug.cgi?id=161671
3106
3107         Reviewed by Geoffrey Garen.
3108
3109         * stress/get-array-length-on-undecided.js: Added.
3110
3111 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3112
3113         [DFG][FTL] Add ArithTan
3114         https://bugs.webkit.org/show_bug.cgi?id=161857
3115
3116         Reviewed by Filip Pizlo.
3117
3118         * microbenchmarks/tan.js: Added.
3119         * stress/arith-tan-on-various-types.js: Added.
3120         (let.validInputTypedTestCases.validInputTestCases.map):
3121         (isIdentical):
3122         (opaqueTanNoArgument):
3123         (testNoArgument):
3124         (opaqueAllTypesTan):
3125         (testAllTypesCall):
3126         (testTangleTypeCall):
3127         (testConstant):
3128         (opaqueTanForSideEffects):
3129         (testSideEffect.let.testObject.valueOf):
3130         (testSideEffect):
3131         (opaqueTanForCSE):
3132         (testCSE.let.testObject.valueOf):
3133         (testCSE):
3134         (opaqueTanForDCE):
3135         (testDCE.let.testObject.valueOf):
3136         (testDCE):
3137         (testException.opaqueTanWithException):
3138         (testException):
3139         * stress/ftl-arithtan.js: Added.
3140         (foo):
3141
3142 2016-09-12  Saam Barati  <sbarati@apple.com>
3143
3144         MapHash should do constant folding when it has a constant argument and its legal to hash that value
3145         https://bugs.webkit.org/show_bug.cgi?id=161639
3146
3147         Reviewed by Filip Pizlo.
3148
3149         * microbenchmarks/map-constant-key.js: Added.
3150         (assert):
3151         (test):
3152         (foo):
3153
3154 2016-09-12  Michael Saboff  <msaboff@apple.com>
3155
3156         JSC test timeout: ChakraCore.yaml/ChakraCore/test/Bugs/bug56026_trycatch.js.default
3157         https://bugs.webkit.org/show_bug.cgi?id=161863
3158
3159         Reviewed by Saam Barati.
3160
3161         * ChakraCore.yaml:
3162         Disabled Bugs/bug56026_trycatch.js.
3163
3164 2016-09-09  Michael Saboff  <msaboff@apple.com>
3165
3166         Unreviewed, rolling r205759 back in with a fix.
3167
3168         The expectation file, JSTests/ChakraCore/test/Lib/tostring.baseline-jsc,
3169         should be named "toString.baseline-jsc".
3170
3171         * ChakraCore/test/Lib/toString.baseline-jsc: Copied from JSTests/ChakraCore/test/Lib/tostring.baseline-jsc.
3172         * ChakraCore/test/Lib/tostring.baseline-jsc: Removed.
3173
3174 2016-09-09  Michael Saboff  <msaboff@apple.com>
3175
3176         Disable three flakey Chakra Tests
3177         https://bugs.webkit.org/show_bug.cgi?id=161807
3178
3179         Reviewed by Saam Barati.
3180
3181         * ChakraCore.yaml: Disabled the flakey tests
3182         ChakraCore/test/Array/protoLookup_native.js
3183         ChakraCore/test/LetConst/delete.js
3184         ChakraCore/test/fieldopts/fieldhoist_sideeffect.js
3185
3186 2016-09-08  Saam Barati  <sbarati@apple.com>
3187
3188         We should inline operationConvertJSValueToBoolean into JIT code
3189         https://bugs.webkit.org/show_bug.cgi?id=161729
3190
3191         Reviewed by Filip Pizlo.
3192
3193         * stress/value-to-boolean.js: Added.
3194         (assert):
3195         (test1):
3196         (test2):
3197         (test3):
3198
3199 2016-09-08  Mark Lam  <mark.lam@apple.com>
3200
3201         REGRESSION (r205569?): 32-bit JSC test timeout: stress/rest-parameter-many-arguments.js.dfg-maximal-flush-validate-no-cjit
3202         https://bugs.webkit.org/show_bug.cgi?id=161756
3203
3204         Reviewed by Saam Barati.
3205
3206         It looks like the 32-bit JSC bot is just too slow at running this test with the
3207         dfg-maximal-flush-validate-no-cjit configuration.  We'll try excluding that
3208         configuration.
3209
3210         * stress/rest-parameter-many-arguments.js:
3211
3212 2016-09-08  JF Bastien  <jfbastien@apple.com>
3213
3214         Delete older WebAssembly tests
3215         https://bugs.webkit.org/show_bug.cgi?id=161758
3216
3217         Reviewed by Filip Pizlo.
3218
3219         They're not running, rely on the older polyfill prototype, and the older code was deleted in: https://trac.webkit.org/changeset/204180
3220
3221         * stress/wasm-arithmetic-float32.js: Removed.
3222         * stress/wasm-arithmetic-float64.js: Removed.
3223         * stress/wasm-arithmetic-int32.js: Removed.
3224         * stress/wasm-calls.js: Removed.
3225         * stress/wasm-comma.js: Removed.
3226         * stress/wasm-control-flow.js: Removed.
3227         * stress/wasm-globals.js: Removed.
3228         * stress/wasm-linear-memory.js: Removed.
3229         * stress/wasm-locals.js: Removed.
3230         * stress/wasm-relational.js: Removed.
3231         * stress/wasm-type-conversion.js: Removed.
3232         * stress/wasm/arithmetic-float32.wasm: Removed.
3233         * stress/wasm/arithmetic-float64.wasm: Removed.
3234         * stress/wasm/arithmetic-int32.wasm: Removed.
3235         * stress/wasm/calls.wasm: Removed.
3236         * stress/wasm/comma.wasm: Removed.
3237         * stress/wasm/control-flow.wasm: Removed.
3238         * stress/wasm/globals.wasm: Removed.
3239         * stress/wasm/linear-memory.wasm: Removed.
3240         * stress/wasm/locals.wasm: Removed.
3241         * stress/wasm/relational.wasm: Removed.
3242         * stress/wasm/type-conversion.wasm: Removed.
3243
3244 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
3245
3246         [Win] Exception fuzz tests fail
3247         https://bugs.webkit.org/show_bug.cgi?id=140928
3248
3249         Reviewed by Mark Lam.
3250
3251         Unskip tests.
3252
3253         * exceptionFuzz.yaml:
3254
3255 2016-09-06  Saam Barati  <sbarati@apple.com>
3256
3257         ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
3258         https://bugs.webkit.org/show_bug.cgi?id=161558
3259
3260         Reviewed by Benjamin Poulain.
3261
3262         * stress/proxy-get-prototype-of.js:
3263         * stress/proxy-set-prototype-of.js:
3264         (let.handler.setPrototypeOf): Deleted.
3265         * stress/proxy-underscore-proto.js: Added.
3266         (assert):
3267
3268 2016-09-06  Saam Barati  <sbarati@apple.com>
3269
3270         Make JSMap and JSSet faster
3271         https://bugs.webkit.org/show_bug.cgi?id=160989
3272
3273         Reviewed by Filip Pizlo.
3274
3275         * microbenchmarks/dense-set.js: Added.
3276         (bench):
3277         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3278         (bar):
3279         (foo):
3280         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3281         (bar):
3282         (foo):
3283         * microbenchmarks/large-map-iteration.js: Added.
3284         (bar):
3285         (foo):
3286         * microbenchmarks/map-get-get-cse.js: Added.
3287         (bar):
3288         (foo):
3289         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3290         (bar):
3291         (foo):
3292         * microbenchmarks/sparse-set.js: Added.
3293         (bench):
3294         * stress/map-cse-correctness.js: Added.
3295         (assert):
3296         (testHas):
3297         (testGet):
3298         (foo):
3299         * stress/map-iteration.js: Added.
3300         (assert):
3301         (test1):
3302         (test2):
3303         (test3):
3304         (test4):
3305         (test5):
3306         (test6):
3307         (test7):
3308         (test8):
3309         (test9):
3310         (test10):
3311         (test11):
3312         (test12):
3313         (test13):
3314         (test14):
3315         (test15):
3316         (test16):
3317         (test17):
3318         (test18):
3319
3320 2016-09-06  Benjamin Poulain  <bpoulain@apple.com>
3321
3322         [JSC] Make ArithClz32 work with Cell arguments
3323         https://bugs.webkit.org/show_bug.cgi?id=161369
3324
3325         Reviewed by Geoffrey Garen.
3326
3327         * stress/arith-clz32-on-various-types.js: Added.
3328
3329 2016-09-06  Commit Queue  <commit-queue@webkit.org>
3330
3331         Unreviewed, rolling out r205504.
3332         https://bugs.webkit.org/show_bug.cgi?id=161645
3333
3334         Broke the iOS device build (Requested by ryanhaddad on
3335         #webkit).
3336
3337         Reverted changeset:
3338
3339         "Make JSMap and JSSet faster"
3340         https://bugs.webkit.org/show_bug.cgi?id=160989
3341         http://trac.webkit.org/changeset/205504
3342
3343 2016-09-06  Saam Barati  <sbarati@apple.com>
3344
3345         Make JSMap and JSSet faster
3346         https://bugs.webkit.org/show_bug.cgi?id=160989
3347
3348         Reviewed by Filip Pizlo.
3349
3350         * microbenchmarks/dense-set.js: Added.
3351         (bench):
3352         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3353         (bar):
3354         (foo):
3355         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3356         (bar):
3357         (foo):
3358         * microbenchmarks/large-map-iteration.js: Added.
3359         (bar):
3360         (foo):
3361         * microbenchmarks/map-get-get-cse.js: Added.
3362         (bar):
3363         (foo):
3364         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3365         (bar):
3366         (foo):
3367         * microbenchmarks/sparse-set.js: Added.
3368         (bench):
3369         * stress/map-cse-correctness.js: Added.
3370         (assert):
3371         (testHas):
3372         (testGet):
3373         (foo):
3374         * stress/map-iteration.js: Added.
3375         (assert):
3376         (test1):
3377         (test2):
3378         (test3):
3379         (test4):
3380         (test5):
3381         (test6):
3382         (test7):
3383         (test8):
3384         (test9):
3385         (test10):
3386         (test11):
3387         (test12):
3388         (test13):
3389         (test14):
3390         (test15):
3391         (test16):
3392         (test17):
3393         (test18):
3394
3395 2016-08-31  Filip Pizlo  <fpizlo@apple.com>
3396
3397         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3398         https://bugs.webkit.org/show_bug.cgi?id=160125
3399
3400         Reviewed by Geoffrey Garen and Keith Miller.
3401         
3402         Most of the things I did properly covered by existing tests, but I found some simple cases of
3403         unshifting that had sketchy coverage.
3404
3405         * stress/array-storage-array-unshift.js: Added.
3406         * stress/contiguous-array-unshift.js: Added.
3407         * stress/double-array-unshift.js: Added.
3408         * stress/int32-array-unshift.js: Added.
3409
3410 2016-09-02  Michael Saboff  <msaboff@apple.com>
3411
3412         Unreviewed fix after importing Chakra test
3413
3414         * ChakraCore.yaml: Skipped ChakraCore/test/UnifiedRegex/crazy.js because the original
3415         test contained tab characters.  I removed the tabs before landing.  This test depended
3416         on the tab characters and now fails after they were removed.
3417         test.
3418
3419 2016-09-01  Michael Saboff  <msaboff@apple.com>
3420
3421         Import Chakra tests to JSC
3422         https://bugs.webkit.org/show_bug.cgi?id=154697
3423
3424         Reviewed by Saam Barati.
3425
3426         Added Chakra tests.  All these tests are under Chakra/test.  This is the same layout
3427         for tests in the Chakra tree.
3428
3429         Created a ChakraCore.yaml file to be used with run-jsc-stress-tests.  This file contains
3430         the tests that are run when the original Chakra runtests.py script is run.  That script
3431         is the test driver for *nix platforms and does not attempt to run all tests or all
3432         variations of tests.  The runtest.py driver consults rlexe.xml files in each test
3433         subdirectory to determine the test to run, the options to pass to the test and how to
3434         determine pass/fail of the test.  With runtests.py as the start, tests that didn't
3435         pass directly where either skipped, with a message describing why or through 
3436         adjustments to the test infrastructure, as described below, where made to pass.
3437         
3438         The only modification to the test infrastrucutre are:
3439
3440          1) Added simple mapping of Chakra expected exception text to JSC expected text in
3441             test/UnitTestFramework/UnitTestFramework.js.  It would make sense to also
3442             map some JSC specific exception text to more generic text for the cases where
3443             that text contains indetifier names or other source specific strings and the
3444             Chakra equivolent exception texts are generic.  
3445  
3446          2) Created JSC specific expected text files where it is clear that the text work
3447             as expected on JSC but the test output is different.  Typically the differences
3448             fall into three categories, different exception output, different output from
3449             toString() of a function, slight numeric differences, and test that rely on
3450             iteration order.
3451
3452          3) Stripped the CR's from the CR-LF line terminations of the files.  
3453
3454         No actual test .js files were modified.
3455
3456         * ChakraCore: Added.
3457         * ChakraCore.yaml: Added.
3458         * ChakraCore/CONTRIBUTING.md: Added.
3459         * ChakraCore/LICENSE.txt: Added.
3460         * ChakraCore/README.md: Added.
3461         * ChakraCore/THIRD-PARTY-NOTICES.txt: Added.
3462         * ChakraCore/test: Added this directory and the tests included therein.
3463
3464 2016-09-01  JF Bastien  <jfbastien@apple.com>
3465
3466         GetByIdWithThis/GetByValWithThis should have ValueProfiles so that they can predict their result types
3467         https://bugs.webkit.org/show_bug.cgi?id=160922
3468
3469         Reviewed by Keith Miller.
3470
3471         Benchmark GetBy{Id,Val}WithThis in monomorphic and polymorphic uses.
3472         The value profile is used by the calc functions, which do some mild math with the result.
3473         These benchmarks get ~4% faster with value profiling.
3474
3475         * microbenchmarks/super-get-by-id-with-this-monomorphic.js: Added.
3476         (A):
3477         (A.prototype.set value):
3478         (A.prototype.get value):
3479         (B.prototype.set value):
3480         (B.prototype.get value):
3481         (B):
3482         (const.bench):
3483         * microbenchmarks/super-get-by-id-with-this-polymorphic.js: Added.
3484         (A):
3485         (A.prototype.set value):
3486         (A.prototype.get value):
3487         (B.prototype.set value):
3488         (B.prototype.get value):
3489         (B):
3490         (const.bench):
3491         * microbenchmarks/super-get-by-val-with-this-monomorphic.js: Added.
3492         (value):
3493         (A):
3494         (A.prototype.set v):
3495         (A.prototype.get v):
3496         (B.prototype.set v):
3497         (B.prototype.get v):
3498         (B):
3499         (const.bench):
3500         * microbenchmarks/super-get-by-val-with-this-polymorphic.js: Added.
3501         (value):
3502         (A):
3503         (A.prototype.set v):
3504         (A.prototype.get v):
3505         (B.prototype.set v):
3506         (B.prototype.get v):
3507         (B):
3508         (const.bench):
3509
3510 2016-09-01  Benjamin Poulain  <bpoulain@apple.com>
3511
3512         arith-abs-on-various-types.js is flaky
3513
3514         Unreviewed.
3515
3516         * stress/arith-abs-on-various-types.js:
3517         Two compilation is too small for the worst case.
3518         Math.abs() can be typed integer->number->untyped if we are very unlucky.
3519
3520 2016-09-01  Filip Pizlo  <fpizlo@apple.com>
3521
3522         ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases
3523         https://bugs.webkit.org/show_bug.cgi?id=161492
3524
3525         Reviewed by Mark Lam.
3526         
3527         This bug affected function->activation references but not object->object field references,
3528         because object->object field references are !neededForMaterialization(). So, the object
3529         test always passed but the activation/function test used to always fail. It passes now.
3530
3531         * stress/materialize-activation-referenced-from-phantom-function.js: Added.
3532         (bar):
3533         (inc):
3534         (dec):
3535         (foo):
3536         (test):
3537         * stress/materialize-object-referenced-from-phantom-object.js: Added.
3538         (bar):
3539         (foo):
3540         (test):
3541
3542 2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3543
3544         stress/random-53bit.js.ftl-no-cjit-no-inline-validate sometimes fails
3545         https://bugs.webkit.org/show_bug.cgi?id=161436
3546
3547         Reviewed by Filip Pizlo.
3548
3549         The test checks Math.random() correctly produces 53bit random values.
3550         The test can fail by design, but this should be fairly rare.
3551
3552         However, when introducing, we wrap the `test()` with 1e4 to ensure the FTL compilation, and this
3553         increases the failure rate. By increasing the MAX in the test, we make the failures much more rare case.
3554
3555         And we also add getRandomSeed() and setRandomSeed(seed) JSC shell helpers to dump more useful information
3556         and reproduce the situation easily.
3557
3558         * stress/random-53bit.js:
3559         (test):
3560
3561 2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
3562
3563         [JSC] Improve ArithAbs with polymorphic input
3564         https://bugs.webkit.org/show_bug.cgi?id=161286
3565
3566         Reviewed by Saam Barati.
3567
3568         * stress/arith-abs-on-various-types.js: Added.
3569         New tests.
3570
3571         * stress/arith-cos-on-various-types.js:
3572         * stress/arith-fround-on-various-types.js:
3573         * stress/arith-log-on-various-types.js:
3574         * stress/arith-sin-on-various-types.js:
3575         * stress/arith-sqrt-on-various-types.js:
3576         Extend the existing tests to cover the DCE case.
3577
3578 2016-08-26  Benjamin Poulain  <benjamin@webkit.org>
3579
3580         [JSC] Implement CompareStrictEq(String, Untyped) in FTL
3581         https://bugs.webkit.org/show_bug.cgi?id=161229
3582
3583         Reviewed by Geoffrey Garen.
3584
3585         * stress/compare-strict-eq-on-various-types.js: Added.
3586
3587 2016-08-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3588
3589         [ES6] newPromiseCapabilities should check the given argument is constructor
3590         https://bugs.webkit.org/show_bug.cgi?id=161226
3591
3592         Reviewed by Mark Lam.
3593
3594         The arrow function should not be a constructor. So the error should be raised.
3595
3596         * stress/new-promise-capabilities-requires-constructor.js: Added.
3597         (shouldThrow):
3598
3599 2016-08-25  Benjamin Poulain  <bpoulain@apple.com>
3600
3601         [JSC] Clean up the abstract interpreter for cos/sin/sqrt/fround/log
3602         https://bugs.webkit.org/show_bug.cgi?id=161181
3603
3604         Reviewed by Geoffrey Garen.
3605
3606         Extend the tests to constants.
3607         Add no-argument cases where needed.
3608
3609         * stress/arith-cos-on-various-types.js:
3610         * stress/arith-fround-on-various-types.js:
3611         * stress/arith-log-on-various-types.js:
3612         * stress/arith-sin-on-various-types.js:
3613         * stress/arith-sqrt-on-various-types.js:
3614
3615 2016-08-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3616
3617         [DFG][FTL] Implement ES6 Generators in DFG / FTL
3618         https://bugs.webkit.org/show_bug.cgi?id=152723
3619
3620         Reviewed by Filip Pizlo.
3621
3622         * stress/generator-fib-ftl-and-array.js: Added.
3623         (fib):
3624         * stress/generator-fib-ftl-and-object.js: Added.
3625         (fib):
3626         * stress/generator-fib-ftl-and-string.js: Added.
3627         (fib):
3628         * stress/generator-fib-ftl.js: Added.
3629         (fib):
3630         * stress/generator-frame-empty.js: Added.
3631         (shouldThrow):
3632         (shouldThrow.fib):
3633         * stress/generator-reduced-save-point-put-to-scope.js: Added.
3634         (shouldBe):
3635         (gen):
3636         * stress/generator-transfer-register-beyond-mutiple-yields.js: Added.
3637         (shouldBe):
3638         (gen):
3639
3640 2016-08-25  JF Bastien  <jfbastien@apple.com>
3641
3642         TryGetById should have a ValueProfile so that it can predict its output type
3643         https://bugs.webkit.org/show_bug.cgi?id=160921
3644
3645         Reviewed by Saam Barati.
3646
3647         * microbenchmarks/try-get-by-id-basic.js: Added.
3648         (const.check):
3649         (const.bench.f.const.fooPlusBar.createBuiltin):
3650         * microbenchmarks/try-get-by-id-polymorphic.js: Added.
3651         (const.check):
3652         (fooPlusBar.createBuiltin):
3653         (bench):
3654
3655 2016-08-25  Caio Lima  <ticaiolima@gmail.com>
3656
3657         NewRegexp should not prevent inlining
3658         https://bugs.webkit.org/show_bug.cgi?id=154808
3659
3660         Reviewed by Geoffrey Garen.
3661
3662         Added test where functions with NewRegExp can be inlined right now.
3663
3664         * stress/new-regex-inline.js: Added.
3665         (assert):
3666         (testRegexpInline):
3667         (toInlineGlobal):
3668         (withRegexp):
3669         (inlineRegexpNotGlobal):
3670         (toInlineRecursive):
3671         (regexpContainsRecursive):
3672
3673 2016-08-24  Benjamin Poulain  <benjamin@webkit.org>
3674
3675         [JSC] Make FRound work with any type
3676         https://bugs.webkit.org/show_bug.cgi?id=161129
3677
3678         Reviewed by Geoffrey Garen.
3679
3680         * stress/arith-fround-on-various-types.js: Added.
3681
3682 2016-08-24  Filip Pizlo  <fpizlo@apple.com>
3683
3684         Unreviewed, roll out r204901, r204897, r204866, r204856, r204854.
3685
3686         * stress/array-storage-array-unshift.js: Removed.
3687         * stress/contiguous-array-unshift.js: Removed.
3688         * stress/double-array-unshift.js: Removed.
3689         * stress/int32-array-unshift.js: Removed.
3690
3691 2016-08-24  Skachkov Oleksandr  <gskachkov@gmail.com>
3692
3693         [ES2016] Allow assignment in for-in head in not-strict mode
3694         https://bugs.webkit.org/show_bug.cgi?id=160955
3695
3696         Reviewed by Saam Barati.
3697
3698         * stress/for-in-tests.js:
3699         (foo):
3700         (boo):
3701         (catch):
3702
3703 2016-08-23  Benjamin Poulain  <benjamin@webkit.org>
3704
3705         [JSC] Make ArithLog works with any type
3706         https://bugs.webkit.org/show_bug.cgi?id=161110
3707
3708         Reviewed by Geoffrey Garen.
3709
3710         * stress/arith-log-on-various-types.js: Added.
3711
3712 2016-08-23  Saam Barati  <sbarati@apple.com>
3713
3714         JSC should have a "microbenchmarks" directory instead of "regress" directory
3715         https://bugs.webkit.org/show_bug.cgi?id=161096
3716
3717         Rubber stamped by Mark Lam.
3718
3719         * microbenchmarks: Copied from LayoutTests/js/regress/script-tests.
3720
3721 2016-08-23  Keith Miller  <keith_miller@apple.com>
3722
3723         %TypedArray%.prototype.slice needs to check that the source and destination have not been detached.
3724         https://bugs.webkit.org/show_bug.cgi?id=161031
3725         <rdar://problem/27937019>
3726
3727         Reviewed by Geoffrey Garen.
3728
3729         * stress/typedarray-slice.js:
3730         (get let):
3731         (get try):
3732         (testSpeciesWithTransferring):
3733
3734 2016-08-22  Filip Pizlo  <fpizlo@apple.com>
3735
3736         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3737         https://bugs.webkit.org/show_bug.cgi?id=160125
3738
3739         Reviewed by Geoffrey Garen.
3740         
3741         Most of the things I did properly covered by existing tests, but I found some simple cases of
3742         unshifting that had sketchy coverage.
3743
3744         * stress/array-storage-array-unshift.js: Added.
3745         * stress/contiguous-array-unshift.js: Added.
3746         * stress/double-array-unshift.js: Added.
3747         * stress/int32-array-unshift.js: Added.
3748
3749 2016-08-23  Keith Miller  <keith_miller@apple.com>
3750
3751         Update/add new test262 tests
3752         https://bugs.webkit.org/show_bug.cgi?id=161098
3753
3754         Reviewed by Saam Barati.
3755
3756         * test262.yaml:
3757         * test262/test/annexB/language/statements/for-in/bare-initializer.js: Added.
3758         * test262/test/annexB/language/statements/for-in/const-initializer.js: Added.
3759         * test262/test/annexB/language/statements/for-in/let-initializer.js: Added.
3760         * test262/test/annexB/language/statements/for-in/nonstrict-initializer.js: Added.
3761         (a):
3762         * test262/test/annenxB/language/statements/for-in/strict-initializer.js: Added.
3763         * test262/test/annexB/language/statements/for-in/var-arraybindingpattern-initializer.js: Added.
3764         * test262/test/annexB/language/statements/for-in/var-objectbindingpattern-initializer.js: Added.
3765         * test262/test/built-ins/AsyncFunction/AsyncFunction-construct.js: Added.
3766         (AsyncFunction.async.foo):
3767         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-extensible.js: Added.
3768         (AsyncFunction.async):
3769         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-subclass.js: Added.
3770         (async.foo):
3771         * test262/test/built-ins/AsyncFunction/AsyncFunction-length.js: Added.
3772         (AsyncFunction.async.foo):
3773         * test262/test/built-ins/AsyncFunction/AsyncFunction-name.js: Added.
3774         (AsyncFunction.async.foo):
3775         * test262/test/built-ins/AsyncFunction/AsyncFunction-prototype.js: Added.
3776         (AsyncFunction.async.foo):
3777         * test262/test/built-ins/AsyncFunction/AsyncFunction.js: Added.
3778         (AsyncFunction.async.foo):
3779         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-is-extensible.js: Added.
3780         (AsyncFunction.async.foo):
3781         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-prototype.js: Added.
3782         (AsyncFunction.async.foo):
3783         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-to-string.js: Added.
3784         (AsyncFunction.async.foo):
3785         * test262/test/built-ins/AsyncFunction/instance-construct.js: Added.
3786         (async.foo):
3787         * test262/test/built-ins/AsyncFunction/instance-has-name.js: Added.
3788         (async.foo):
3789         * test262/test/built-ins/AsyncFunction/instance-length.js: Added.
3790         (async.l0):
3791         (async.l1):
3792         (async.l2):
3793         * test262/test/built-ins/AsyncFunction/instance-prototype-property.js: Added.
3794         (async.foo):
3795         * test262/test/built-ins/AsyncFunction/is-not-a-global.js: Added.
3796         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-integer-byteoffset.js.
3797         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-before-outofrange-byteoffset.js:
3798         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-integer-byteoffset.js.
3799         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-before-outofrange-byteoffset.js:
3800         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-integer-byteoffset.js.
3801         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-before-outofrange-byteoffset.js:
3802         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-integer-byteoffset.js.
3803         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-before-outofrange-byteoffset.js:
3804         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-integer-byteoffset.js.
3805         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-before-outofrange-byteoffset.js:
3806         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-integer-byteoffset.js.
3807         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-before-outofrange-byteoffset.js:
3808         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-integer-byteoffset.js.
3809         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-before-outofrange-byteoffset.js:
3810         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-integer-byteoffset.js.
3811         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-before-outofrange-byteoffset.js:
3812         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-integer-byteoffset.js.
3813         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-before-outofrange-byteoffset.js:
3814         * test262/test/built-ins/DataView/prototype/setFloat32/index-check-before-value-conversion.js:
3815         * test262/test/built-ins/DataView/prototype/setFloat32/range-check-after-value-conversion.js:
3816         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-integer-byteoffset.js.
3817         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-before-outofrange-byteoffset.js:
3818         * test262/test/built-ins/DataView/prototype/setFloat64/index-check-before-value-conversion.js:
3819         * test262/test/built-ins/DataView/prototype/setFloat64/range-check-after-value-conversion.js:
3820         * test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-integer-byteoffset.js.
3821         * test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-before-outofrange-byteoffset.js:
3822         * test262/test/built-ins/DataView/prototype/setInt16/index-check-before-value-conversion.js:
3823         * test262/test/built-ins/DataView/prototype/setInt16/range-check-after-value-conversion.js:
3824         * test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-after-integer-byteoffset.js.
3825         * test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-before-outofrange-byteoffset.js:
3826         * test262/test/built-ins/DataView/prototype/setInt32/index-check-before-value-conversion.js:
3827         * test262/test/built-ins/DataView/prototype/setInt32/range-check-after-value-conversion.js:
3828         * test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-after-integer-byteoffset.js.
3829         * test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-before-outofrange-byteoffset.js:
3830         * test262/test/built-ins/DataView/prototype/setInt8/index-check-before-value-conversion.js:
3831         * test262/test/built-ins/DataView/prototype/setInt8/range-check-after-value-conversion.js:
3832         * test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-after-integer-byteoffset.js.
3833         * test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-before-outofrange-byteoffset.js:
3834         * test262/test/built-ins/DataView/prototype/setUint16/index-check-before-value-conversion.js:
3835         * test262/test/built-ins/DataView/prototype/setUint16/range-check-after-value-conversion.js:
3836         * test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-after-integer-byteoffset.js.
3837         * test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-before-outofrange-byteoffset.js:
3838         * test262/test/built-ins/DataView/prototype/setUint32/index-check-before-value-conversion.js:
3839         * test262/test/built-ins/DataView/prototype/setUint32/range-check-after-value-conversion.js:
3840         * test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-after-integer-byteoffset.js.
3841         * test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-before-outofrange-byteoffset.js:
3842         * test262/test/built-ins/DataView/prototype/setUint8/index-check-before-value-conversion.js:
3843         * test262/test/built-ins/DataView/prototype/setUint8/range-check-after-value-conversion.js:
3844         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-boundtarget-bound.js: Added.
3845         (A):
3846         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-boundtarget.js: Added.
3847         (A):
3848         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-self-new.js: Added.
3849         (A):
3850         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-self-reflect.js: Added.
3851         (A):
3852         * test262/test/built-ins/Function/prototype/toString/AsyncFunction.js: Added.
3853         (async.f):
3854         * test262/test/built-ins/Function/prototype/toString/async-function-declaration.js: Added.
3855         (async.f):
3856         * test262/test/built-ins/Function/prototype/toString/async-function-expression.js: Added.
3857         (let.f.async.f):
3858         * test262/test/built-ins/Function/prototype/toString/async-method.js: Added.
3859         (let.f.async.f):
3860         (let.g.async.string_appeared_here):
3861         * test262/test/built-ins/JSON/parse/reviver-array-define-prop-err.js: Added.
3862         (defineProperty):
3863         * test262/test/built-ins/JSON/parse/reviver-array-delete-err.js: Added.
3864         (deleteProperty):
3865         * test262/test/built-ins/JSON/parse/reviver-array-length-coerce-err.js: Added.
3866         (uncoercible.valueOf):
3867         (get if):
3868         * test262/test/built-ins/JSON/parse/reviver-array-length-get-err.js: Added.
3869         (get if):
3870         * test262/test/built-ins/JSON/parse/reviver-call-err.js: Added.
3871         * test262/test/built-ins/JSON/parse/reviver-get-name-err.js: Added.
3872         (thrower):
3873         * test262/test/built-ins/JSON/parse/reviver-object-define-prop-err.js: Added.
3874         (defineProperty):
3875         * test262/test/built-ins/JSON/parse/reviver-object-delete-err.js: Added.
3876         (deleteProperty):
3877         * test262/test/built-ins/JSON/parse/reviver-object-own-keys-err.js: Added.
3878         (ownKeys):
3879         * test262/test/built-ins/Number/prototype/toExponential/infinity.js: Added.
3880         * test262/test/built-ins/Number/prototype/toExponential/nan.js: Added.
3881         * test262/test/built-ins/Number/prototype/toExponential/prop-desc.js: Added.
3882         * test262/test/built-ins/Number/prototype/toExponential/return-abrupt-tointeger-fractiondigits-symbol.js: Added.
3883         * test262/test/built-ins/Number/prototype/toExponential/return-abrupt-tointeger-fractiondigits.js: Added.
3884         (fd1.valueOf):
3885         (fd2.toString):
3886         * test262/test/built-ins/Number/prototype/toExponential/return-values.js: Added.
3887         * test262/test/built-ins/Number/prototype/toExponential/this-is-0-fractiondigits-is-0.js: Added.
3888         * test262/test/built-ins/Number/prototype/toExponential/this-is-0-fractiondigits-is-not-0.js: Added.
3889         * test262/test/built-ins/Number/prototype/toExponential/this-type-not-number-or-number-object.js: Added.
3890         * test262/test/built-ins/Number/prototype/toExponential/tointeger-fractiondigits.js: Added.
3891         * test262/test/built-ins/Number/prototype/toExponential/undefined-fractiondigits.js: Added.
3892         * test262/test/built-ins/Object/getOwnPropertyDescriptors/duplicate-keys.js:
3893         * test262/test/built-ins/Object/getOwnPropertyDescriptors/proxy-undefined-descriptor.js: Added.
3894         (badProxyHandlers.allowProxyTraps.getOwnPropertyDescriptor):
3895         (badProxyHandlers.allowProxyTraps.ownKeys):
3896         * test262/test/built-ins/Proxy/setPrototypeOf/boolean-trap-result-extensible-target.js: Removed.
3897         (setPrototypeOf): Deleted.
3898         * test262/test/built-ins/Proxy/setPrototypeOf/internals-call-order.js: Added.
3899         (target.new.Proxy.Object.create.isExtensible):
3900         (target.new.Proxy.Object.create.getPrototypeOf):
3901         (target.new.Proxy.Object.create):
3902         (setPrototypeOf):
3903         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-target-not-same-target-prototype.js:
3904         (setPrototypeOf):
3905         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-target-same-target-prototype.js:
3906         (setPrototypeOf):
3907         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-trap-is-false-return-false.js: Removed.
3908         (setPrototypeOf): Deleted.
3909         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-get-trap.js: Added.
3910         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-isextensible-target.js: Added.
3911         (isExtensible):
3912         (setPrototypeOf):
3913         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-target-getprototypeof.js: Added.
3914         (getPrototypeOf):
3915         (setPrototypeOf):
3916         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-trap.js: Renamed from JSTests/test262/test/built-ins/Proxy/setPrototypeOf/return-is-abrupt.js.
3917         (setPrototypeOf):
3918         * test262/test/built-ins/Proxy/setPrototypeOf/return-is-abrupt.js:
3919         (setPrototypeOf): Deleted.
3920         * test262/test/built-ins/Proxy/setPrototypeOf/toboolean-trap-result-false.js: Added.
3921         (isExtensible):
3922         (setPrototypeOf):
3923         * test262/test/built-ins/Proxy/setPrototypeOf/toboolean-trap-result-true-target-is-extensible.js: Added.
3924         (isExtensible):
3925         (getPrototypeOf):
3926         (setPrototypeOf):
3927         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable.js:
3928         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-undefined-or-null.js: Added.
3929         (setPrototypeOf):
3930         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-undefined.js: Removed.
3931         * test262/test/built-ins/RegExp/lastIndex.js: Added.
3932         * test262/test/built-ins/RegExp/prototype/global/15.10.7.2-1.js: Removed.
3933         * test262/test/built-ins/RegExp/prototype/global/this-val-invalid-obj.js: Added.
3934         (get Object):
3935         * test262/test/built-ins/RegExp/prototype/global/this-val-non-obj.js: Added.
3936         (get Object):
3937         * test262/test/built-ins/RegExp/prototype/global/this-val-regexp-prototype.js: Added.
3938         * test262/test/built-ins/RegExp/prototype/ignoreCase/15.10.7.3-1.js: Removed.
3939         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-invalid-obj.js: Added.
3940         (get Object):
3941         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-non-obj.js: Added.
3942         (get Object):
3943         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-regexp-prototype.js: Added.
3944         * test262/test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-1.js: Removed.
3945         * test262/test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-2.js: Removed.
3946         * test262/test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A8.js: Removed.
3947         (__re.hasOwnProperty): Deleted.
3948         (__re.propertyIsEnumerable): Deleted.
3949         (count.0): Deleted.
3950         * test262/test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A9.js: Removed.
3951         (__re.hasOwnProperty): Deleted.
3952         (catch): Deleted.
3953         * test262/test/built-ins/RegExp/prototype/multiline/15.10.7.4-1.js: Removed.
3954         * test262/test/built-ins/RegExp/prototype/multiline/this-val-invalid-obj.js: Added.
3955         (get Object):
3956         * test262/test/built-ins/RegExp/prototype/multiline/this-val-non-obj.js: Added.
3957         (get Object):
3958         * test262/test/built-ins/RegExp/prototype/multiline/this-val-regexp-prototype.js: Added.
3959         * test262/test/built-ins/RegExp/prototype/no-regexp-matcher.js: Added.
3960         * test262/test/built-ins/RegExp/prototype/source/15.10.7.1-1.js: Removed.
3961         * test262/test/built-ins/RegExp/prototype/source/this-val-invalid-obj.js: Added.
3962         (get Object):
3963         * test262/test/built-ins/RegExp/prototype/source/this-val-non-obj.js: Added.
3964         (get Object):
3965         * test262/test/built-ins/RegExp/prototype/source/this-val-regexp-prototype.js: Added.
3966         * test262/test/built-ins/RegExp/prototype/source/value-empty.js: Added.
3967         * test262/test/built-ins/RegExp/prototype/source/value-line-terminator.js: Added.
3968         * test262/test/built-ins/RegExp/prototype/source/value-u.js: Added.
3969         * test262/test/built-ins/RegExp/prototype/source/value.js: Added.
3970         * test262/test/built-ins/RegExp/prototype/sticky/this-val-invalid-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-invalid-obj.js.
3971         * test262/test/built-ins/RegExp/prototype/sticky/this-val-non-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-non-obj.js.
3972         * test262/test/built-ins/RegExp/prototype/sticky/this-val-regexp-prototype.js: Added.
3973         * test262/test/built-ins/RegExp/prototype/sticky/this-val-regexp.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-regexp.js.
3974         * test262/test/built-ins/RegExp/prototype/unicode/this-val-invalid-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-invald-obj.js.
3975         * test262/test/built-ins/RegExp/prototype/unicode/this-val-non-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-non-obj.js.
3976         * test262/test/built-ins/RegExp/prototype/unicode/this-val-regexp-prototype.js: Added.
3977         * test262/test/built-ins/RegExp/prototype/unicode/this-val-regexp.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-regexp.js.
3978         * test262/test/built-ins/String/numeric-properties.js: Added.
3979         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/date-is-infinity-throws.js: Added.
3980         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/date-is-nan-throws.js: Added.
3981         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/formatToParts.js: Added.
3982         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/length.js: Added.
3983         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/main.js: Added.
3984         (reduce):
3985         (compareFTPtoFormat):
3986         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/name.js: Added.
3987         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/return-abrupt-tonumber-date.js: Added.
3988         (obj1.valueOf):
3989         (obj2.toString):
3990         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/this-has-not-internal-throws.js: Added.
3991         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/this-is-not-object-throws.js: Added.
3992         * test262/test/intl402/NumberFormat/prototype/formatToParts/formatToParts.js: Added.
3993         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js: Added.
3994         * test262/test/intl402/NumberFormat/prototype/formatToParts/main.js: Added.
3995         (reduce):
3996         (compareFTPtoFormat):
3997         * test262/test/intl402/NumberFormat/prototype/formatToParts/name.js: Added.
3998         * test262/test/intl402/NumberFormat/prototype/formatToParts/return-abrupt-tonumber.js: Added.
3999         (obj1.valueOf):
4000         (obj2.toString):
4001         * test262/test/intl402/NumberFormat/prototype/formatToParts/this-has-not-internal-throws.js: Added.
4002         * test262/test/intl402/NumberFormat/prototype/formatToParts/this-is-not-object-throws.js: Added.
4003         * test262/test/language/arguments-object/10.6-10-c-ii-2-s.js:
4004         (foo): Deleted.
4005         * test262/test/language/arguments-object/unmapped/via-params-dflt.js: Added.
4006         (dflt):
4007         * test262/test/language/arguments-object/unmapped/via-params-dstr.js: Added.
4008         (dstr):
4009         * test262/test/language/arguments-object/unmapped/via-params-rest.js: Added.
4010         (rest):
4011         * test262/test/language/arguments-object/unmapped/via-strict.js: Renamed from JSTests/test262/test/language/arguments-object/10.6-10-c-ii-2-s.js.
4012         (foo):
4013         * test262/test/language/block-scope/syntax/redeclaration-global/allowed-to-redeclare-function-declaration-with-function-declaration.js:
4014         (f): Deleted.
4015         * test262/test/language/eval-code/direct/super-call-arrow.js: Added.
4016         (catch):
4017         * test262/test/language/eval-code/direct/super-call-fn.js: Added.
4018         (f):
4019         * test262/test/language/eval-code/direct/super-call.js: Added.
4020         (catch):
4021         * test262/test/language/eval-code/direct/super-prop-arrow.js: Added.
4022         (catch):
4023         * test262/test/language/eval-code/direct/super-prop-method.js: Added.
4024         (o.method):
4025         * test262/test/language/eval-code/direct/super-prop.js: Added.
4026         (catch):
4027         * test262/test/language/eval-code/indirect/super-call.js: Added.
4028         (catch):
4029         (try.m):
4030         * test262/test/language/eval-code/indirect/super-prop.js: Added.
4031         (catch):
4032         (try.m):
4033         * test262/test/language/expressions/arrow-function/params-trailing-comma-length.js: Added.
4034         (assert.sameValue):
4035         * test262/test/language/expressions/arrow-function/params-trailing-comma.js: Added.
4036         * test262/test/language/expressions/async-arrow-function/arrow-returns-promise.js: Added.
4037         (p.then):
4038         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-NSPL-with-USD.js: Added.
4039         (async):
4040         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-arguments-in-formal-parameters.js: Added.
4041         (async):
4042         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-await-in-formals-default.js: Added.
4043         (async):
4044         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-await-in-formals.js: Added.
4045         (async):
4046         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-body-contains-super-call.js: Added.
4047         (async):
4048         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-body-contains-super-property.js: Added.
4049         (async):
4050         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-duplicate-parameters.js: Added.
4051         (async):
4052         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-eval-in-formal-parameters.js: Added.
4053         (async):
4054         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-body-duplicate.js: Added.
4055         (async):
4056         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-contains-super-call.js: Added.
4057         (async.foo.super):
4058         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-contains-super-property.js: Added.
4059         (async):
4060         * test262/test/language/expressions/async-function/early-errors-expression-NSPL-with-USD.js: Added.
4061         (async):
4062         * test262/test/language/expressions/async-function/early-errors-expression-binding-identifier-arguments.js: Added.
4063         (async.arguments):
4064         * test262/test/language/expressions/async-function/early-errors-expression-binding-identifier-eval.js: Added.
4065         (async.eval):
4066         * test262/test/language/expressions/async-function/early-errors-expression-body-contains-super-call.js: Added.
4067         (async.foo):
4068         * test262/test/language/expressions/async-function/early-errors-expression-body-contains-super-property.js: Added.
4069         (async.foo):
4070         * test262/test/language/expressions/async-function/early-errors-expression-eval-in-formal-parameters.js: Added.
4071         (async.foo):
4072         * test262/test/language/expressions/async-function/early-errors-expression-formals-body-duplicate.js: Added.
4073         (async.foo):
4074         * test262/test/language/expressions/async-function/early-errors-expression-formals-contains-super-call.js: Added.
4075         (async.foo):
4076         * test262/test/language/expressions/async-function/early-errors-expression-formals-contains-super-property.js: Added.
4077         (async.foo):
4078         * test262/test/language/expressions/async-function/early-errors-expression-not-simple-assignment-target.js: Added.
4079         (async.foo):
4080         * test262/test/language/expressions/async-function/expression-returns-promise.js: Added.
4081         (p.async):
4082         * test262/test/language/expressions/async-function/syntax-expression-is-PrimaryExpression.js: Added.
4083         (async.foo):
4084         * test262/test/language/expressions/await/await-BindingIdentifier-in-global.js: Added.
4085         (async.await):
4086         * test262/test/language/expressions/await/await-BindingIdentifier-nested.js: Added.
4087         (async.foo.await):
4088         (async.foo):
4089         * test262/test/language/expressions/await/await-awaits-thenable-not-callable.js: Added.
4090         (async.foo):
4091         * test262/test/language/expressions/await/await-awaits-thenables-that-throw.js: Added.
4092         (thenable.then):
4093         (async.foo):
4094         * test262/test/language/expressions/await/await-awaits-thenables.js: Added.
4095         (thenable.then):
4096         (async.foo):
4097         * test262/test/language/expressions/await/await-in-function.js: Added.
4098         (foo):
4099         * test262/test/language/expressions/await/await-in-generator.js: Added.
4100         (foo):
4101         * test262/test/language/expressions/await/await-in-global.js: Added.
4102         * test262/test/language/expressions/await/await-in-nested-function.js: Added.
4103         (async.foo.bar):
4104         (async.foo):
4105         * test262/test/language/expressions/await/await-in-nested-generator.js: Added.
4106         (async.foo.bar):
4107         (async.foo):
4108         * test262/test/language/expressions/await/await-throws-rejections.js: Added.
4109         (async.foo):
4110         * test262/test/language/expressions/await/early-errors-await-not-simple-assignment-target.js: Added.
4111         (async.foo):
4112         * test262/test/language/expressions/await/no-operand.js: Added.
4113         (async.foo):
4114         * test262/test/language/expressions/await/syntax-await-has-UnaryExpression-with-MultiplicativeExpression.js: Added.
4115         (async.foo):
4116         * test262/test/language/expressions/await/syntax-await-has-UnaryExpression.js: Added.
4117         (async.foo):
4118         * test262/test/language/expressions/call/trailing-comma.js: Added.
4119         (foo):
4120         * test262/test/language/expressions/function/arguments-with-arguments-fn.js: Added.
4121         (f):
4122         * test262/test/language/expressions/function/arguments-with-arguments-lex.js: Added.
4123         (f):
4124         * test262/test/language/expressions/function/params-trailing-comma-arguments.js: Added.
4125         (f1):
4126         (f2):
4127         * test262/test/language/expressions/function/params-trailing-comma-length.js: Added.
4128         (assert.sameValue):
4129         * test262/test/language/expressions/function/params-trailing-comma.js: Added.
4130         * test262/test/language/expressions/generators/arguments-with-arguments-fn.js: Added.
4131         (g):
4132         * test262/test/language/expressions/generators/arguments-with-arguments-lex.js: Added.
4133         (g):
4134         * test262/test/language/expressions/generators/params-trailing-comma-arguments.js: Added.
4135         (f1):
4136         (f2):
4137         * test262/test/language/expressions/generators/params-trailing-comma-length.js: Added.
4138         (assert.sameValue):
4139         * test262/test/language/expressions/generators/params-trailing-comma.js: Added.
4140         * test262/test/language/expressions/object/computed-property-evaluation-order.js: Added.
4141         * test262/test/language/expressions/object/method-definition/async-super-call-body.js: Added.
4142         (sup.method):
4143         (child.async.method):
4144         * test262/test/language/expressions/object/method-definition/async-super-call-param.js: Added.
4145         (sup.method):
4146         (child.async.method.x.super.method):
4147         * test262/test/language/expressions/object/method-definition/early-errors-object-method-NSPL-with-USD.js: Added.
4148         (foo):
4149         * test262/test/language/expressions/object/method-definition/early-errors-object-method-arguments-in-formal-parameters.js: Added.
4150         (async.foo):
4151         * test262/test/language/expressions/object/method-definition/early-errors-object-method-await-in-formals-default.js: Added.
4152         (async.foo):
4153         * test262/test/language/expressions/object/method-definition/early-errors-object-method-await-in-formals.js: Added.
4154         (async.foo):
4155         * test262/test/language/expressions/object/method-definition/early-errors-object-method-body-contains-super-call.js: Added.
4156         (async.foo):
4157         * test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js: Added.
4158         (async.foo):
4159         * test262/test/language/expressions/object/method-definition/early-errors-object-method-eval-in-formal-parameters.js: Added.
4160         (async.foo):
4161         * test262/test/language/expressions/object/method-definition/early-errors-object-method-formals-body-duplicate.js: Added.
4162         (async.foo):
4163         * test262/test/language/expressions/object/method-definition/early-errors-object-method-formals-contains-super-call.js: Added.
4164         (async.foo.foo.super):
4165         * test262/test/language/expressions/object/method-definition/object-method-returns-promise.js: Added.
4166         (obj.async.method):
4167         * test262/test/language/expressions/object/method-definition/params-trailing-comma-arguments.js: Added.
4168         (obj.f1):
4169         (obj.f2):
4170         * test262/test/language/expressions/object/method-definition/params-trailing-comma-length.js: Added.
4171         (obj.one):
4172         (obj.two):
4173         * test262/test/language/expressions/object/method-definition/params-trailing-comma-rest.js: Added.
4174         (m):
4175         * test262/test/language/expressions/object/method-definition/params-trailing-comma.js: Added.
4176         (one):
4177         (two):
4178         * test262/test/language/global-code/decl-func-dup.js: Renamed from JSTests/test262/test/language/block-scope/syntax/redeclaration-global/allowed-to-redeclare-function-declaration-with-function-declaration.js.
4179         (f):
4180         * test262/test/language/global-code/decl-func.js: Added.
4181         (brandNew):
4182         * test262/test/language/global-code/decl-lex-configurable-global.js: Added.
4183         * test262/test/language/global-code/decl-lex-deletion.js: Added.
4184         (test262class):
4185         * test262/test/language/global-code/decl-lex-restricted-global.js: Added.
4186         * test262/test/language/global-code/decl-lex.js: Added.
4187         (test262class):
4188         * test262/test/language/global-code/decl-var.js: Added.
4189         * test262/test/language/global-code/return.js: Added.
4190         * test262/test/language/global-code/script-decl-func-dups.js: Added.
4191         * test262/test/language/global-code/script-decl-func-err-non-configurable.js: Added.
4192         * test262/test/language/global-code/script-decl-func-err-non-extensible.js: Added.
4193         * test262/test/language/global-code/script-decl-func.js: Added.
4194         * test262/test/language/global-code/script-decl-lex-deletion.js: Added.
4195         * test262/test/language/global-code/script-decl-lex-lex.js: Added.
4196         (test262Class):
4197         * test262/test/language/global-code/script-decl-lex-restricted-global.js: Added.
4198         * test262/test/language/global-code/script-decl-lex-var.js: Added.
4199         (test262Fn):
4200         * test262/test/language/global-code/script-decl-lex.js: Added.
4201         * test262/test/language/global-code/script-decl-var-collision.js: Added.
4202         (test262Class):
4203         * test262/test/language/global-code/script-decl-var-err.js: Added.
4204         * test262/test/language/global-code/script-decl-var.js: Added.
4205         * test262/test/language/global-code/super-call-arrow.js: Added.
4206         * test262/test/language/global-code/super-call.js: Added.
4207         * test262/test/language/global-code/super-prop-arrow.js: Added.
4208         * test262/test/language/global-code/super-prop.js: Added.
4209         * test262/test/language/global-code/yield-non-strict.js: Added.
4210         (catch):
4211         * test262/test/language/global-code/yield-strict.js: Added.
4212         * test262/test/language/literals/regexp/lastIndex.js: Added.
4213         * test262/test/language/literals/regexp/u-unicode-esc-bounds.js:
4214         * test262/test/language/literals/regexp/y-assertion-start.js: Added.
4215         * test262/test/language/module-code/instn-star-err-not-found-faulty_FIXTURE.js:
4216         * test262/test/language/module-code/instn-star-err-not-found.js:
4217         * test262/test/language/module-code/namespace/internals/get-own-property-str-found-init.js:
4218         * test262/test/language/module-code/parse-err-return.js: Added.
4219         * test262/test/language/module-code/parse-err-yield.js: Added.
4220         * test262/test/language/rest-parameters/params-trailing-comma-rest.js: Added.
4221         * test262/test/language/statements/async-function/declaration-returns-promise.js: Added.
4222         (async.foo):
4223         * test262/test/language/statements/async-function/early-errors-declaration-NSPL-with-USD.js: Added.
4224         (async.foo):
4225         * test262/test/language/statements/async-function/early-errors-declaration-arguments-in-formal-parameters.js: Added.
4226         (async.foo):
4227         * test262/test/language/statements/async-function/early-errors-declaration-await-in-formals-default.js: Added.
4228         (async.foo):
4229         * test262/test/language/statements/async-function/early-errors-declaration-await-in-formals.js: Added.
4230         (async.foo):
4231         * test262/test/language/statements/async-function/early-errors-declaration-binding-identifier-arguments.js: Added.
4232         (async.arguments):
4233         * test262/test/language/statements/async-function/early-errors-declaration-binding-identifier-eval.js: Added.
4234         (async.eval):
4235         * test262/test/language/statements/async-function/early-errors-declaration-body-contains-super-call.js: Added.
4236         (async.foo):
4237         * test262/test/language/statements/async-function/early-errors-declaration-body-contains-super-property.js: Added.
4238         (async.foo):
4239         * test262/test/language/statements/async-function/early-errors-declaration-duplicate-parameters.js: Added.
4240         (async.foo):
4241         * test262/test/language/statements/async-function/early-errors-declaration-eval-in-formal-parameters.js: Added.
4242         (async.foo):
4243         * test262/test/language/statements/async-function/early-errors-declaration-formals-body-duplicate.js: Added.
4244         (async.foo):
4245         * test262/test/language/statements/async-function/early-errors-declaration-formals-contains-super-call.js: Added.
4246         (async.foo):
4247         * test262/test/language/statements/async-function/early-errors-declaration-formals-contains-super-property.js: Added.
4248         (async.foo):
4249         * test262/test/language/statements/async-function/early-errors-no-async-generator.js: Added.
4250         (async.foo):
4251         * test262/test/language/statements/async-function/evaluation-body-that-returns-after-await.js: Added.
4252         (async.foo):
4253         (foo.then):
4254         * test262/test/language/statements/async-function/evaluation-body-that-returns.js: Added.
4255         (async.foo):
4256         (foo.then):
4257         * test262/test/language/statements/async-function/evaluation-body-that-throws-after-await.js: Added.
4258         (async.foo):
4259         (foo.then):
4260         * test262/test/language/statements/async-function/evaluation-body-that-throws.js: Added.
4261         (async.foo):
4262         (foo.then):
4263         * test262/test/language/statements/async-function/evaluation-body.js: Added.
4264         (async.foo):
4265         * test262/test/language/statements/async-function/evaluation-default-that-throws.js: Added.
4266         (async.foo):
4267         (foo.then):
4268         * test262/test/language/statements/async-function/evaluation-mapped-arguments.js: Added.
4269         (async.foo):
4270         * test262/test/language/statements/async-function/evaluation-this-value-global.js: Added.
4271         (async.foo):
4272         * test262/test/language/statements/async-function/evaluation-this-value-passed.js: Added.
4273         (async.foo):
4274         * test262/test/language/statements/async-function/evaluation-unmapped-arguments.js: Added.
4275         (async.foo):
4276         * test262/test/language/statements/async-function/syntax-declaration-line-terminators-allowed.js: Added.
4277         (async.foo):
4278         * test262/test/language/statements/async-function/syntax-declaration-no-line-terminator.js: Added.
4279         (async.foo):
4280         * test262/test/language/statements/async-function/syntax-declaration.js: Added.
4281         (async.foo):
4282         (foo.then):
4283         * test262/test/language/statements/class/definition/class-method-returns-promise.js: Added.
4284         (Foo.prototype.async.method):
4285         (Foo):
4286         * test262/test/language/statements/class/definition/early-errors-class-method-NSPL-with-USD.js: Added.
4287         (Foo.prototype.async.bar):
4288         (Foo):
4289         * test262/test/language/statements/class/definition/early-errors-class-method-arguments-in-formal-parameters.js: Added.
4290         (Foo.prototype.async.foo):
4291         (Foo):
4292         * test262/test/language/statements/class/definition/early-errors-class-method-await-in-formals-default.js: Added.
4293         (Foo.prototype.async.foo):
4294         (Foo):
4295         * test262/test/language/statements/class/definition/early-errors-class-method-await-in-formals.js: Added.
4296         (Foo.prototype.async.foo):
4297         (Foo):
4298         * test262/test/language/statements/class/definition/early-errors-class-method-body-contains-super-call.js: Added.
4299         (Foo.prototype.async.foo):
4300         (Foo):
4301         * test262/test/language/statements/class/definition/early-errors-class-method-duplicate-parameters.js: Added.
4302         (Foo.prototype.async.foo):
4303         (Foo):
4304         * test262/test/language/statements/class/definition/early-errors-class-method-eval-in-formal-parameters.js: Added.
4305         (Foo.prototype.async.foo):
4306         (Foo):
4307         * test262/test/language/stateme