JSTests/ChangeLog

   1 2016-12-09  JF Bastien  <jfbastien@apple.com>
   2
   3         WebAssembly JS API: implement start function
   4         https://bugs.webkit.org/show_bug.cgi?id=165150
   5
   6         Reviewed by Saam Barati.
   7
   8         * wasm/Builder.js: allow building a .Start()
   9         * wasm/Builder_WebAssemblyBinary.js:
  10         * wasm/js-api/test_Start.js: Added.
  11         (const.emitters.Start): serialize a start section
  12         * wasm/self-test/test_BuilderJSON.js: validate the start section's content
  13
  14 2016-12-09  Saam Barati  <sbarati@apple.com>
  15
  16         WebAssembly JS API: implement importing and defining Memory
  17         https://bugs.webkit.org/show_bug.cgi?id=164134
  18
  19         Reviewed by Keith Miller.
  20
  21         * wasm/Builder.js:
  22         (const._importMemoryContinuation.section):
  23         (const._importMemoryContinuation.assert):
  24         (const._importMemoryContinuation):
  25         (const._exportFunctionContinuation.const): Deleted.
  26         (const._exportFunctionContinuation): Deleted.
  27         * wasm/Builder_WebAssemblyBinary.js:
  28         (const.emitters.Import):
  29         * wasm/js-api/test_basic_api.js:
  30         (const.c.in.constructorProperties.switch):
  31         * wasm/js-api/test_memory.js: Added.
  32         (assert):
  33         (binaryShouldNotParse):
  34         (test):
  35         (test.testMemImportError):
  36         * wasm/js-api/test_memory_constructor.js: Added.
  37         (assert):
  38         (throw.new.Error):
  39         (testInvalidSize):
  40         (assert.testInvalidInitial):
  41         (testInvalidInitial.testInvalidMaximum):
  42         (testInvalidInitial):
  43         (testInvalidMaximum):
  44         * wasm/self-test/test_BuilderJSON.js:
  45
  46 2016-12-08  JF Bastien  <jfbastien@apple.com>
  47
  48         WebAssembly: JSC::link* shouldn't need a CodeBlock
  49         https://bugs.webkit.org/show_bug.cgi?id=165591
  50
  51         Reviewed by Keith Miller.
  52
  53         test that wasm -> JS works, including the IC
  54
  55         * wasm/js-api/test_Instance.js:
  56         (const.wasmModuleWhichImportJS):
  57         (MonomorphicImport):
  58         (Polyphic2Import):
  59         (Polyphic3Import):
  60         (VirtualImport):
  61
  62 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
  63
  64         Green the cloop bot by raising this threshold.
  65
  66         * mozilla/js1_5/Array/regress-101964.js:
  67
  68 2016-12-08  JF Bastien  <jfbastien@apple.com>
  69
  70         WebAssembly JS API: wire up Instance imports
  71         https://bugs.webkit.org/show_bug.cgi?id=165118
  72
  73         Reviewed by Saam Barati.
  74
  75         * wasm/js-api/test_Instance.js: add the test, disabled for now
  76
  77 2016-12-07  Keith Miller  <keith_miller@apple.com>
  78
  79         Add more missing trivial wasm ops.
  80         https://bugs.webkit.org/show_bug.cgi?id=165564
  81
  82         Add tests for drop and tee_local.
  83
  84         Reviewed by Geoffrey Garen.
  85
  86         * wasm/function-tests/drop.js: Added.
  87         * wasm/function-tests/nop.js: Added.
  88         * wasm/function-tests/tee-local.js: Added.
  89
  90 2016-12-06  Keith Miller  <keith_miller@apple.com>
  91
  92         Add support for truncation operators
  93         https://bugs.webkit.org/show_bug.cgi?id=165519
  94
  95         Reviewed by Geoffrey Garen.
  96
  97         * wasm/function-tests/i32-trunc-s-f32.js: Added.
  98         * wasm/function-tests/i32-trunc-s-f64.js: Added.
  99         * wasm/function-tests/i32-trunc-u-f32.js: Added.
 100         * wasm/function-tests/i32-trunc-u-f64.js: Added.
 101         * wasm/function-tests/i64-trunc-s-f32.js: Added.
 102         * wasm/function-tests/i64-trunc-s-f64.js: Added.
 103         * wasm/function-tests/i64-trunc-u-f32.js: Added.
 104         * wasm/function-tests/i64-trunc-u-f64.js: Added.
 105
 106 2016-12-06  Mark Lam  <mark.lam@apple.com>
 107
 108         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
 109         https://bugs.webkit.org/show_bug.cgi?id=165227
 110         <rdar://problem/29442665>
 111
 112         Reviewed by Saam Barati.
 113
 114         * stress/get-from-scope-dynamic-onto-proxy.js:
 115         - Updated error message.
 116
 117         * stress/proxy-dont-infinite-loop.js: Removed.
 118         * stress/proxy-json-path.js: Removed.
 119         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.
 120         - Removed these tests because the issue they are testing relies on being able to
 121           set Object.prototype.__proto__ to something else (which is now not possible).
 122
 123 2016-12-05  Caitlin Potter  <caitp@igalia.com>
 124
 125         [JSC] report unexpected token when "async" is followed by identifier
 126         https://bugs.webkit.org/show_bug.cgi?id=165091
 127
 128         Reviewed by Mark Lam.
 129
 130         * stress/bug-165091.js:
 131
 132 2016-12-05  Keith Miller  <keith_miller@apple.com>
 133
 134         Add Wasm i64 to i32 conversion.
 135         https://bugs.webkit.org/show_bug.cgi?id=165378
 136
 137         Reviewed by Filip Pizlo.
 138
 139         It turns out the wrap operation is just B3's Trunc.
 140
 141         * wasm/wasm.json:
 142
 143 2016-12-04  Keith Miller  <keith_miller@apple.com>
 144
 145         Add support for Wasm ctz and popcnt
 146         https://bugs.webkit.org/show_bug.cgi?id=165369
 147
 148         Reviewed by Saam Barati.
 149
 150         * wasm/function-tests/ctz.js: Added.
 151         * wasm/function-tests/popcnt.js: Added.
 152
 153 2016-12-03  JF Bastien  <jfbastien@apple.com>
 154
 155         WebAssembly: update binary format to 0xD version
 156         https://bugs.webkit.org/show_bug.cgi?id=165345
 157
 158         Reviewed by Keith Miller.
 159
 160         As described in the following PR: https://github.com/WebAssembly/design/pull/836
 161         Originally committed in r209175, reverted in r209242, and fixed in r209284.
 162
 163         * wasm/Builder.js:
 164         (const._normalizeFunctionSignature):
 165         * wasm/Builder_WebAssemblyBinary.js:
 166         (const.emitters.Type):
 167         (const.emitters.Code):
 168         * wasm/LowLevelBinary.js:
 169         (export.default.LowLevelBinary.prototype.block_type):
 170         (export.default.LowLevelBinary.prototype.inline_signature_type): Deleted.
 171         * wasm/WASM.js:
 172         * wasm/js-api/test_basic_api.js:
 173         * wasm/self-test/test_BuilderWebAssembly.js:
 174         (EmptyModule):
 175         (CustomSection):
 176         * wasm/self-test/test_WASM.js:
 177         * wasm/wasm.json:
 178
 179 2016-12-02  Keith Miller  <keith_miller@apple.com>
 180
 181         Add Wasm copysign
 182         https://bugs.webkit.org/show_bug.cgi?id=165355
 183
 184         Reviewed by Filip Pizlo.
 185
 186         * wasm/function-tests/copysign.js: Added.
 187
 188 2016-12-03  Commit Queue  <commit-queue@webkit.org>
 189
 190         Unreviewed, rolling out r209298.
 191         https://bugs.webkit.org/show_bug.cgi?id=165359
 192
 193         broke the build (Requested by smfr on #webkit).
 194
 195         Reverted changeset:
 196
 197         "Add Wasm copysign"
 198         https://bugs.webkit.org/show_bug.cgi?id=165355
 199         http://trac.webkit.org/changeset/209298
 200
 201 2016-12-02  Keith Miller  <keith_miller@apple.com>
 202
 203         Add Wasm copysign
 204         https://bugs.webkit.org/show_bug.cgi?id=165355
 205
 206         Reviewed by Filip Pizlo.
 207
 208         * wasm/function-tests/copysign.js: Added.
 209
 210 2016-12-02  Keith Miller  <keith_miller@apple.com>
 211
 212         Unreviewed, fix git having a breakdown over trying to reland a rollout.
 213
 214 2016-12-02  Keith Miller  <keith_miller@apple.com>
 215
 216         Add Wasm floating point nearest and trunc
 217         https://bugs.webkit.org/show_bug.cgi?id=165339
 218
 219         Reviewed by Saam Barati.
 220
 221         * wasm/function-tests/nearest.js: Added.
 222         * wasm/function-tests/trunc.js: Added.
 223
 224 2016-12-02  Caitlin Potter  <caitp@igalia.com>
 225
 226 [JSC] add additional bit to JSTokenType bitfield
 227         https://bugs.webkit.org/show_bug.cgi?id=165091
 228
 229         Reviewed by Geoffrey Garen.
 230
 231         * stress/bug-165091.js: Added.
 232         (shouldThrowSyntaxError):
 233
 234 2016-12-02  Commit Queue  <commit-queue@webkit.org>
 235
 236         Unreviewed, rolling out r209275 and r209276.
 237         https://bugs.webkit.org/show_bug.cgi?id=165348
 238
 239         "broke the arm build" (Requested by keith_miller on #webkit).
 240
 241         Reverted changesets:
 242
 243         "Add Wasm floating point nearest and trunc"
 244         https://bugs.webkit.org/show_bug.cgi?id=165339
 245         http://trac.webkit.org/changeset/209275
 246
 247         "Unreviewed, forgot to change instruction after renaming."
 248         http://trac.webkit.org/changeset/209276
 249
 250 2016-12-02  Keith Miller  <keith_miller@apple.com>
 251
 252         Add Wasm floating point nearest and trunc
 253         https://bugs.webkit.org/show_bug.cgi?id=165339
 254
 255         Reviewed by Filip Pizlo.
 256
 257         * wasm/function-tests/nearest.js: Added.
 258         * wasm/function-tests/trunc.js: Added.
 259
 260 2016-12-02  JF Bastien  <jfbastien@apple.com>
 261
 262         WebAssembly: revert patch causing odd breakage
 263         https://bugs.webkit.org/show_bug.cgi?id=165308
 264
 265         Unreviewed.
 266
 267         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
 268         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
 269
 270         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
 271
 272         * wasm/Builder.js:
 273         (const._normalizeFunctionSignature):
 274         * wasm/Builder_WebAssemblyBinary.js:
 275         (const.emitters.Type):
 276         (const.emitters.Code):
 277         * wasm/LowLevelBinary.js:
 278         (export.default.LowLevelBinary.prototype.inline_signature_type):
 279         (export.default.LowLevelBinary.prototype.block_type): Deleted.
 280         * wasm/WASM.js:
 281         * wasm/js-api/test_basic_api.js:
 282         * wasm/self-test/test_BuilderWebAssembly.js:
 283         (EmptyModule):
 284         (CustomSection):
 285         * wasm/self-test/test_WASM.js:
 286         * wasm/wasm.json:
 287
 288 2016-12-01  Ryan Haddad  <ryanhaddad@apple.com>
 289
 290         Skip flaky test ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js
 291         https://bugs.webkit.org/show_bug.cgi?id=162567
 292
 293         Reviewed by Saam Barati.
 294
 295         * ChakraCore.yaml:
 296
 297 2016-12-01  Keith Miller  <keith_miller@apple.com>
 298
 299         Add wasm int to floating point opcodes
 300         https://bugs.webkit.org/show_bug.cgi?id=165252
 301
 302         Reviewed by Geoffrey Garen.
 303
 304         Add tests for Wasm integral to floating point conversion opcodes.
 305
 306         * wasm/function-tests/int-to-floating-point.js: Added.
 307         * wasm/wasm.json:
 308
 309 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
 310
 311         Land a test case for <rdar://problem/27889416>
 312         https://bugs.webkit.org/show_bug.cgi?id=165272
 313
 314         Reviewed by Saam Barati.
 315
 316         * stress/marked-argument-buffer.js: Added.
 317         (allocate):
 318         (test.o.toString):
 319         (test):
 320
 321 2016-11-29  Per Arne Vollan  <pvollan@apple.com>
 322
 323         [Win] Skip failing JSC tests.
 324         https://bugs.webkit.org/show_bug.cgi?id=165140
 325
 326         Reviewed by Mark Lam.
 327
 328         * ChakraCore.yaml:
 329         * microbenchmarks/tan.js:
 330
 331 2016-11-30  JF Bastien  <jfbastien@apple.com>
 332
 333         WebAssembly builder: don't throw when checker not implemented
 334         https://bugs.webkit.org/show_bug.cgi?id=165219
 335
 336         Reviewed by Mark Lam.
 337
 338         We should perform whichever checks we've implemented, and assume the rest are OK until bug #163421 is fixed.
 339
 340         * wasm/Builder.js:
 341         * wasm/README.md:
 342         * wasm/function-tests/add-12.js:
 343         * wasm/function-tests/br-if-loop-less-than.js:
 344         * wasm/function-tests/brTableAsIf.js:
 345         * wasm/function-tests/brTableManyValues.js:
 346         * wasm/function-tests/brTableWithLoop.js:
 347         * wasm/function-tests/dumb-eq-if-then-else.js:
 348         * wasm/function-tests/dumb-less-than-fallthrough.js:
 349         * wasm/function-tests/dumb-less-than-ite.js:
 350         * wasm/function-tests/eqz.js:
 351         * wasm/function-tests/factorial.js:
 352         * wasm/function-tests/float-sub.js:
 353         * wasm/function-tests/i32-load.js:
 354         * wasm/function-tests/i32-load8-s.js:
 355         * wasm/function-tests/if-then-else-fallthrough.js:
 356         * wasm/function-tests/if-then-fallthrough.js:
 357         * wasm/function-tests/loop-mult.js:
 358         * wasm/function-tests/loop-sum.js:
 359         * wasm/function-tests/max.js:
 360         * wasm/function-tests/min.js:
 361         * wasm/function-tests/ret5.js:
 362         * wasm/function-tests/select.js:
 363         * wasm/self-test/test_BuilderJSON.js:
 364
 365 2016-11-29  JF Bastien  <jfbastien@apple.com>
 366
 367         WebAssembly JS API: improve Instance
 368         https://bugs.webkit.org/show_bug.cgi?id=164757
 369
 370         Reviewed by Keith Miller.
 371
 372         An Instance's `exports` property wasn't populated with exports.
 373
 374         A follow-up patch will do imports.
 375
 376         A few things of note:
 377
 378          - LowLevelBinary: support 3-byte integers.
 379          - LowLevelBinary: support proper UTF-8 2003 code points (instead of UTF-16).
 380
 381         * wasm/Builder.js:
 382         * wasm/Builder_WebAssemblyBinary.js: wire up exports, stub other things out some more
 383         (const.emitters.Export):
 384         * wasm/LowLevelBinary.js:
 385         (export.default.LowLevelBinary.prototype.uint24): add, used for UTF-8
 386         (export.default.LowLevelBinary.prototype.string): support UTF-8
 387         (export.default.LowLevelBinary.prototype.getUint24): add, used for UTF-8
 388         (export.default.LowLevelBinary.prototype.getVaruint1): was missing
 389         (export.default.LowLevelBinary.prototype.getString): support UTF-8
 390         (export.default.LowLevelBinary):
 391         * wasm/js-api/test_Instance.js: instance.exports.answer() // <-- this is where the magic of this entire patch is
 392         (ExportedAnswerI32):
 393         * wasm/js-api/test_basic_api.js: punt test to later
 394         (const.c.in.constructorProperties.switch):
 395         * wasm/self-test/test_BuilderWebAssembly.js: UTF-8
 396         (CustomSection):
 397         * wasm/self-test/test_LowLevelBinary_string.js: UTF-8 now works
 398         * wasm/self-test/test_LowLevelBinary_uint16.js: was missing one value
 399         * wasm/self-test/test_LowLevelBinary_uint24.js: Copied from JSTests/wasm/self-test/test_LowLevelBinary_uint8.js.
 400         * wasm/self-test/test_LowLevelBinary_uint8.js: was missing one value
 401         * wasm/self-test/test_LowLevelBinary_varuint1.js: Added.
 402         * wasm/utilities.js: this `dump` thing was useful
 403         (const._dump):
 404
 405 2016-11-29  Saam Barati  <sbarati@apple.com>
 406
 407         We should be able optimize the pattern where we spread a function's rest parameter to another call
 408         https://bugs.webkit.org/show_bug.cgi?id=163865
 409
 410         Reviewed by Filip Pizlo.
 411
 412         * microbenchmarks/default-derived-constructor.js: Added.
 413         (createClassHierarchy.let.currentClass):
 414         (createClassHierarchy):
 415         * stress/call-varargs-spread.js: Added.
 416         (assert):
 417         (bar):
 418         (foo):
 419         * stress/load-varargs-on-new-array-with-spread-convert-to-static-loads.js: Added.
 420         (assert):
 421         (baz):
 422         (bar):
 423         (foo):
 424         * stress/new-array-with-spread-with-normal-spread-and-phantom-spread.js: Added.
 425         (assert):
 426         (foo):
 427         (escape):
 428         (bar):
 429         * stress/phantom-new-array-with-spread-osr-exit.js: Added.
 430         (assert):
 431         (baz):
 432         (bar):
 433         (effects):
 434         (foo):
 435         * stress/phantom-spread-forward-varargs.js: Added.
 436         (assert):
 437         (test1.bar):
 438         (test1.foo):
 439         (test1):
 440         (test2.bar):
 441         (test2.foo):
 442         (test3.baz):
 443         (test3.bar):
 444         (test3.foo):
 445         (test4.baz):
 446         (test4.bar):
 447         (test4.foo):
 448         (test5.baz):
 449         (test5.bar):
 450         (test5.foo):
 451         * stress/phantom-spread-osr-exit.js: Added.
 452         (assert):
 453         (baz):
 454         (bar):
 455         (effects):
 456         (foo):
 457         * stress/spread-call-convert-to-static-call.js: Added.
 458         (assert):
 459         (baz):
 460         (bar):
 461         (foo):
 462         * stress/spread-forward-call-varargs-stack-overflow.js: Added.
 463         (assert):
 464         (identity):
 465         (bar):
 466         (foo):
 467         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol-2.js: Added.
 468         (assert):
 469         (baz.Array.prototype.Symbol.iterator):
 470         (baz):
 471         (bar):
 472         (foo):
 473         (test):
 474         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol.js: Added.
 475         (assert):
 476         (baz.Array.prototype.Symbol.iterator):
 477         (baz):
 478         (bar):
 479         (foo):
 480         * stress/spread-forward-varargs-stack-overflow.js: Added.
 481         (assert):
 482         (bar):
 483         (foo):
 484
 485 2016-11-29  Caitlin Potter  <caitp@igalia.com>
 486
 487         [JSC] always wrap AwaitExpression operand in a new Promise
 488         https://bugs.webkit.org/show_bug.cgi?id=165181
 489
 490         Reviewed by Yusuke Suzuki.
 491
 492         * stress/async-await-basic.js:
 493         (async.awaitedPromisesAreWrapped):
 494
 495 2016-11-29  Keith Miller  <keith_miller@apple.com>
 496
 497         Add simple way to implement Wasm ops that require more than one B3 opcode
 498         https://bugs.webkit.org/show_bug.cgi?id=165129
 499
 500         Reviewed by Geoffrey Garen.
 501
 502         * wasm/function-tests/eqz.js: Added.
 503         * wasm/function-tests/max.js: Added.
 504         * wasm/function-tests/min.js: Added.
 505         * wasm/wasm.json:
 506
 507 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 508
 509         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
 510         https://bugs.webkit.org/show_bug.cgi?id=164898
 511
 512         Reviewed by Darin Adler.
 513
 514         * stress/tagged-template-registry-key-collect.js: Added.
 515         (shouldBe):
 516         (tag):
 517         (i.eval):
 518         * stress/tagged-template-registry-key.js: Added.
 519         (shouldBe):
 520         (tag):
 521         (a):
 522         (b):
 523
 524 2016-11-20  Caitlin Potter  <caitp@igalia.com>
 525
 526         [JSC] speed up parsing of async functions
 527         https://bugs.webkit.org/show_bug.cgi?id=164808
 528
 529         Reviewed by Yusuke Suzuki.
 530
 531         Add tests for line terminator following "async" keyword in async
 532         function syntax.
 533
 534         * stress/async-await-syntax.js:
 535         (shouldBe):
 536
 537 2016-11-19  Mark Lam  <mark.lam@apple.com>
 538
 539         op_mod-* JSC tests needs a longer timeout too.
 540         https://bugs.webkit.org/show_bug.cgi?id=164994
 541
 542         Reviewed by Yusuke Suzuki.
 543
 544         * stress/op_mod-ConstVar.js:
 545         * stress/op_mod-VarConst.js:
 546         * stress/op_mod-VarVar.js:
 547
 548 2016-11-19  Mark Lam  <mark.lam@apple.com>
 549
 550         Add --timeoutMultiplier option to allow some tests more time to run.
 551         https://bugs.webkit.org/show_bug.cgi?id=164951
 552
 553         Reviewed by Yusuke Suzuki.
 554
 555         Extended the timeout for these tests by 50% more because they run quite slow on
 556         low-end machines.
 557
 558         * stress/op_div-ConstVar.js:
 559         * stress/op_div-VarConst.js:
 560         * stress/op_div-VarVar.js:
 561
 562 2016-11-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 563
 564         REGRESSION(r208867): JSC test failure: ChakraCore.yaml/ChakraCore/test/strict/05.arguments_sm.js.default
 565         https://bugs.webkit.org/show_bug.cgi?id=164929
 566
 567         Reviewed by Mark Lam.
 568
 569         ES2017 drops arguments.caller and JavaScriptCore is updated to meet the spec.
 570         This patch rebaselines the result of ChakraCore test for JSC.
 571
 572         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
 573
 574 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
 575
 576         Web Inspector: Generator functions should have a displayable name when shown in stack traces
 577         https://bugs.webkit.org/show_bug.cgi?id=164844
 578         <rdar://problem/29300697>
 579
 580         Reviewed by Yusuke Suzuki.
 581
 582         * stress/generator-function-name.js:
 583         Add another test now that we name the inner generator function
 584         that we do not break the lexical resolution of names.
 585
 586 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
 587
 588         [JSC] Drop arguments.caller
 589         https://bugs.webkit.org/show_bug.cgi?id=164859
 590
 591         Reviewed by Saam Barati.
 592
 593         * stress/strict-mode-arguments-caller.js: Added.
 594         (strictArguments):
 595         (shouldBe):
 596
 597 2016-11-17  Keith Miller  <keith_miller@apple.com>
 598
 599         Add rotate to Wasm
 600         https://bugs.webkit.org/show_bug.cgi?id=164871
 601
 602         Reviewed by Filip Pizlo.
 603
 604         * wasm/wasm.json:
 605
 606 2016-11-17  Keith Miller  <keith_miller@apple.com>
 607
 608         Add sqrt to Wasm
 609         https://bugs.webkit.org/show_bug.cgi?id=164877
 610
 611         Reviewed by Mark Lam.
 612
 613         B3 already has a Sqrt opcode we just need to map Wasm to it.
 614
 615         * wasm/wasm.json:
 616
 617 2016-11-17  Saam Barati  <sbarati@apple.com>
 618
 619         Remove async/await compile time flag and enable tests
 620         https://bugs.webkit.org/show_bug.cgi?id=164828
 621         <rdar://problem/28639334>
 622
 623         Reviewed by Yusuke Suzuki.
 624
 625         * stress/async-arrow-functions-lexical-arguments-binding.js:
 626         * stress/async-arrow-functions-lexical-new.target-binding.js:
 627         * stress/async-arrow-functions-lexical-super-binding.js:
 628         * stress/async-arrow-functions-lexical-this-binding.js:
 629         * stress/async-await-basic.js:
 630         * stress/async-await-long-loop.js:
 631         * stress/async-await-module-reserved-word.js:
 632         * stress/async-await-mozilla.js:
 633         (mozSyntaxErrors):
 634         * stress/async-await-reserved-word.js:
 635         * stress/async-await-syntax.js:
 636         * stress/async-await-throw-loop.js:
 637         * stress/async-function-create-nobaseline.js:
 638         * stress/async-function-create-optimized.js:
 639         * stress/async-function-declaration-sinking-no-double-allocate.js:
 640         * stress/async-function-declaration-sinking-osrexit.js:
 641         * stress/async-function-declaration-sinking-put.js:
 642         * stress/async-function-expression-sinking-no-double-allocate.js:
 643         * stress/async-function-expression-sinking-osrexit.js:
 644         * stress/async-function-expression-sinking-put.js:
 645         * test262.yaml:
 646
 647 2016-11-15  Mark Lam  <mark.lam@apple.com>
 648
 649         Make JSC test functions more robust.
 650         https://bugs.webkit.org/show_bug.cgi?id=164807
 651
 652         Reviewed by Keith Miller.
 653
 654         * stress/jsc-test-functions-should-be-more-robust.js: Added.
 655
 656 2016-11-15  Keith Miller  <keith_miller@apple.com>
 657
 658         B3 should support UDiv/UMod
 659         https://bugs.webkit.org/show_bug.cgi?id=164811
 660
 661         Reviewed by Filip Pizlo.
 662
 663         Link new instructions to wasm.
 664
 665         * wasm/wasm.json:
 666
 667 2016-11-15  Saam Barati  <sbarati@apple.com>
 668
 669         Debug JSC test timeout: stress/has-own-property-name-cache-symbols-and-strings.js.ftl-no-cjit-small-pool
 670         https://bugs.webkit.org/show_bug.cgi?id=163012
 671
 672         Unreviewed. This patch makes a test run for less time because it's timing out on the bots.
 673
 674         * stress/has-own-property-name-cache-symbols-and-strings.js:
 675
 676 2016-11-15  Mark Lam  <mark.lam@apple.com>
 677
 678         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
 679         https://bugs.webkit.org/show_bug.cgi?id=164781
 680         <rdar://problem/28418590>
 681
 682         Reviewed by Geoffrey Garen and Michael Saboff.
 683
 684         * stress/jsc-setImpureGetterDelegate-on-bad-type.js: Added.
 685
 686 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 687
 688         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
 689         https://bugs.webkit.org/show_bug.cgi?id=164727
 690
 691         Reviewed by Filip Pizlo.
 692
 693         * stress/check-dom-with-signature.js: Added.
 694         (shouldBe):
 695         (calling):
 696         (i.array.forEach):
 697
 698 2016-11-14  Caitlin Potter  <caitp@igalia.com>
 699
 700         [JSC] do not reference AwaitExpression Promises in async function Promise chain
 701         https://bugs.webkit.org/show_bug.cgi?id=164753
 702
 703         Reviewed by Yusuke Suzuki.
 704
 705         * asyncFunctionTests.yaml:
 706         * stress/async-await-long-loop.js: Added.
 707         (shouldBe):
 708         (async.longLoop):
 709         * stress/async-await-throw-loop.js: Added.
 710         (shouldBe):
 711         (async.thrower):
 712         (async.throwLoop):
 713
 714 2016-11-14  Keith Miller  <keith_miller@apple.com>
 715
 716         Add Wasm select
 717         https://bugs.webkit.org/show_bug.cgi?id=164743
 718
 719         Reviewed by Saam Barati.
 720
 721         * wasm/function-tests/select.js: Added.
 722
 723 2016-11-14  Caitlin Potter  <caitp@igalia.com>
 724
 725         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
 726         https://bugs.webkit.org/show_bug.cgi?id=164037
 727
 728         Reviewed by Yusuke Suzuki.
 729
 730         Add tests based on tests from https://trac.webkit.org/changeset/194216.
 731
 732         * asyncFunctionTests.yaml:
 733         * stress/async-function-create-nobaseline.js: Added.
 734         * stress/async-function-create-optimized.js: Added.
 735         * stress/async-function-declaration-sinking-no-double-allocate.js: Added.
 736         * stress/async-function-declaration-sinking-osrexit.js: Added.
 737         * stress/async-function-declaration-sinking-put.js: Added.
 738         * stress/async-function-expression-sinking-no-double-allocate.js: Added.
 739         * stress/async-function-expression-sinking-osrexit.js: Added.
 740         * stress/async-function-expression-sinking-put.js: Added.
 741
 742 2016-11-14  Mark Lam  <mark.lam@apple.com>
 743
 744         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
 745         https://bugs.webkit.org/show_bug.cgi?id=164701
 746         <rdar://problem/27462104>
 747
 748         Reviewed by Darin Adler.
 749
 750         * stress/string-prototype-charCodeAt-on-too-long-rope.js: Added.
 751
 752 2016-11-14  Mark Lam  <mark.lam@apple.com>
 753
 754         RegExpObject::exec/match should handle errors gracefully.
 755         https://bugs.webkit.org/show_bug.cgi?id=155145
 756         <rdar://problem/27435934>
 757
 758         Reviewed by Keith Miller.
 759
 760         * stress/regexp-prototype-exec-on-too-long-rope.js: Added.
 761         * stress/regexp-prototype-match-on-too-long-rope.js: Added.
 762         * stress/regexp-prototype-test-on-too-long-rope.js: Added.
 763
 764 2016-11-14  Mark Lam  <mark.lam@apple.com>
 765
 766         Enhance run-jsc-stress-test script to allow optional test specific options to be added for all test run configurations.
 767         https://bugs.webkit.org/show_bug.cgi?id=164695
 768
 769         Reviewed by Keith Miller.
 770
 771         Replace use of runMisc* test run configurations with equivalents.
 772
 773         * stress/licm-no-pre-header-nested.js:
 774         * stress/licm-no-pre-header.js:
 775         * stress/licm-pre-header-cannot-exit-nested.js:
 776         * stress/licm-pre-header-cannot-exit.js:
 777         * stress/make-dictionary-repatch.js:
 778         * stress/retry-cache-later.js:
 779         * stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js:
 780         * stress/slow-path-generator-updating-current-node-dfg.js:
 781         * stress/unshift-array-storage.js:
 782
 783 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
 784
 785         test262: DataView with explicit undefined byteLength should be the same as it not being present
 786         https://bugs.webkit.org/show_bug.cgi?id=164453
 787
 788         Reviewed by Darin Adler.
 789
 790         * stress/dataview-construct.js: Added.
 791         (assert):
 792         (shouldThrow):
 793         * test262.yaml:
 794
 795 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
 796
 797         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
 798         https://bugs.webkit.org/show_bug.cgi?id=164451
 799
 800         Reviewed by Darin Adler.
 801
 802         * test262.yaml:
 803
 804 2016-11-11  Saam Barati  <sbarati@apple.com>
 805
 806         We should have a more concise way of determining when we're varargs calling a function using rest parameters
 807         https://bugs.webkit.org/show_bug.cgi?id=164258
 808
 809         Reviewed by Yusuke Suzuki.
 810
 811         * microbenchmarks/call-using-spread.js: Added.
 812         (bar):
 813         (foo):
 814         * microbenchmarks/spread-large-array.js: Added.
 815         (foo):
 816         (arrays.push):
 817         * microbenchmarks/spread-small-array.js: Added.
 818         (foo):
 819         * stress/spread-array-iterator-watchpoint-2.js: Added.
 820         (foo):
 821         (arrayIterator.next):
 822         * stress/spread-array-iterator-watchpoint.js: Added.
 823         (foo):
 824         (Array.prototype.Symbol.iterator):
 825         * stress/spread-non-array.js: Added.
 826         (assert):
 827         (foo):
 828         (let.customIterator.Symbol.iterator):
 829         (bar):
 830
 831 2016-11-11  Keith Miller  <keith_miller@apple.com>
 832
 833         Relocate wasm tests and actually add them to the test runner
 834         https://bugs.webkit.org/show_bug.cgi?id=164668
 835
 836         Reviewed by Yusuke Suzuki.
 837
 838         This moves the Wasm tests from their current location down a level.
 839         Without relocating, the tests cannot properly be run by the wasm test runner.
 840
 841         * wasm.yaml:
 842         * wasm/Builder.js: Fix typos, yay lazy synatx checking!
 843         * wasm/LowLevelBinary.js: Fix typos, yay lazy synatx checking!
 844         (export.default.LowLevelBinary.prototype.get return):
 845         * wasm/function-tests/add-12.js: Renamed from JSTests/wasm/js-api/function-tests/add-12.js.
 846         * wasm/function-tests/br-if-loop-less-than.js: Renamed from JSTests/wasm/js-api/function-tests/br-if-loop-less-than.js.
 847         * wasm/function-tests/brTableAsIf.js: Renamed from JSTests/wasm/js-api/function-tests/brTableAsIf.js.
 848         * wasm/function-tests/brTableManyValues.js: Renamed from JSTests/wasm/js-api/function-tests/brTableManyValues.js.
 849         * wasm/function-tests/brTableWithLoop.js: Renamed from JSTests/wasm/js-api/function-tests/brTableWithLoop.js.
 850         * wasm/function-tests/dumb-eq-if-then-else.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-eq-if-then-else.js.
 851         * wasm/function-tests/dumb-less-than-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-fallthrough.js.
 852         * wasm/function-tests/dumb-less-than-ite.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-ite.js.
 853         * wasm/function-tests/factorial.js: Renamed from JSTests/wasm/js-api/function-tests/factorial.js.
 854         * wasm/function-tests/float-sub.js: Renamed from JSTests/wasm/js-api/function-tests/float-sub.js.
 855         * wasm/function-tests/i32-load.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load.js.
 856         * wasm/function-tests/i32-load8-s.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load8-s.js.
 857         * wasm/function-tests/if-then-else-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-else-fallthrough.js.
 858         * wasm/function-tests/if-then-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-fallthrough.js.
 859         * wasm/function-tests/loop-mult.js: Renamed from JSTests/wasm/js-api/function-tests/loop-mult.js.
 860         * wasm/function-tests/loop-sum.js: Renamed from JSTests/wasm/js-api/function-tests/loop-sum.js.
 861         * wasm/function-tests/ret5.js: Renamed from JSTests/wasm/js-api/function-tests/ret5.js.
 862         * wasm/self-test/test_BuilderJSON.js: Rebasline
 863
 864 2016-11-11  Keith Miller  <keith_miller@apple.com>
 865
 866         Move Wasm tests to JS
 867         https://bugs.webkit.org/show_bug.cgi?id=164611
 868
 869         Reviewed by Geoffrey Garen.
 870
 871         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
 872         ommited tests were earliest tests, which tested trivial things, like adding two
 873         constants. Some tests are ommited for other reasons, however. These are:
 874
 875         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
 876         Tests that would validate the memory of the module once wasm was done with it since that's
 877         not really possible in JS.
 878
 879         In order to make such a translation easier this patch also adds some features to the JS
 880         testing api:
 881
 882         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
 883         opcode. For example one can do:
 884             ...
 885             .Block("i32", b => b.I32Const(1) )
 886
 887         and the nested lambda will automatically have an end attached.
 888
 889         2) The JS testing api can now handle inline signature types.
 890
 891         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
 892
 893         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
 894         wasm.json without being remapped.
 895
 896         5) Add support for Memory and Function sections to the Builder.
 897
 898         6) Add support for local variables.
 899
 900         On the JSC side, we needed to expose a new function to validate the compiled wasm code
 901         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
 902         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
 903         number of functions in the blob and tests for each of those functions.
 904
 905         * wasm/Builder.js:
 906         (const._maybeRegisterType):
 907         (const): Deleted.
 908         (switch.typeof): Deleted.
 909         * wasm/Builder_WebAssemblyBinary.js:
 910         (const.emitters.Type):
 911         (const.emitters.Import):
 912         (const.emitters.Function):
 913         (const.emitters.Memory):
 914         (const.emitters.Code):
 915         (export.const.Binary):
 916         * wasm/LowLevelBinary.js:
 917         (export.default.LowLevelBinary.prototype.get return):
 918         (export.default.LowLevelBinary.prototype.varuint32):
 919         (export.default.LowLevelBinary.prototype.varint32):
 920         (export.default.LowLevelBinary.prototype.varuint1):
 921         (export.default.LowLevelBinary.prototype.varint7):
 922         (export.default.LowLevelBinary.prototype.varuint7):
 923         (export.default.LowLevelBinary.prototype.inline_signature_type):
 924         (export.default.LowLevelBinary.prototype.string):
 925         (export.default.LowLevelBinary.prototype.getVaruint32):
 926         (export.default.LowLevelBinary.prototype.getVarint32):
 927         (export.default.LowLevelBinary.prototype.getVaruint7):
 928         (export.default.LowLevelBinary.prototype.getString):
 929         (export.default.LowLevelBinary):
 930         (export.default.LowLevelBinary.prototype.varuint): Deleted.
 931         (export.default.LowLevelBinary.prototype.varint): Deleted.
 932         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
 933         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
 934         * wasm/js-api/test_old_tests.js: Added.
 935         (ret5):
 936         (brTableWithLoop):
 937         (brTableManyValues):
 938         (run.brTableManyValues.brTableAsIf):
 939         (ifThenFallthrough):
 940         (ifThenElseFallthrough):
 941         (dumbLessThanFallthrough):
 942         (run.dumbLessThanFallthrough.floatSub):
 943         (run.floatSub.add12):
 944         (run.add12.factorial):
 945         (i32load):
 946         (run.i32load.i32load8s):
 947         (run.i32load8s.dumbEqIfThenElse):
 948         (run.dumbEqIfThenElse.dumbEqIfThenElse):
 949         (run.dumbEqIfThenElse.dumbLessThanIfThenElse):
 950         (run.dumbLessThanIfThenElse.loopSum):
 951         (run.loopSum.loopMult):
 952         (brIfLoopLessThan):
 953         (run.brIfLoopLessThan.run):
 954         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
 955         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
 956
 957         * wasm/Builder.js:
 958         (const._maybeRegisterType):
 959         (const): Deleted.
 960         (switch.typeof): Deleted.
 961         * wasm/Builder_WebAssemblyBinary.js:
 962         (const.emitters.Type):
 963         (const.emitters.Import):
 964         (const.emitters.Function):
 965         (const.emitters.Memory):
 966         (const.emitters.Code):
 967         (export.const.Binary):
 968         * wasm/LowLevelBinary.js:
 969         (export.default.LowLevelBinary.prototype.get return):
 970         (export.default.LowLevelBinary.prototype.varuint32):
 971         (export.default.LowLevelBinary.prototype.varint32):
 972         (export.default.LowLevelBinary.prototype.varuint1):
 973         (export.default.LowLevelBinary.prototype.varint7):
 974         (export.default.LowLevelBinary.prototype.varuint7):
 975         (export.default.LowLevelBinary.prototype.inline_signature_type):
 976         (export.default.LowLevelBinary.prototype.string):
 977         (export.default.LowLevelBinary.prototype.getVaruint32):
 978         (export.default.LowLevelBinary.prototype.getVarint32):
 979         (export.default.LowLevelBinary.prototype.getVaruint7):
 980         (export.default.LowLevelBinary.prototype.getString):
 981         (export.default.LowLevelBinary):
 982         (export.default.LowLevelBinary.prototype.varuint): Deleted.
 983         (export.default.LowLevelBinary.prototype.varint): Deleted.
 984         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
 985         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
 986         * wasm/js-api/function-tests/add-12.js: Added.
 987         * wasm/js-api/function-tests/br-if-loop-less-than.js: Added.
 988         * wasm/js-api/function-tests/brTableAsIf.js: Added.
 989         * wasm/js-api/function-tests/brTableManyValues.js: Added.
 990         * wasm/js-api/function-tests/brTableWithLoop.js: Added.
 991         * wasm/js-api/function-tests/dumb-eq-if-then-else.js: Added.
 992         * wasm/js-api/function-tests/dumb-less-than-fallthrough.js: Added.
 993         * wasm/js-api/function-tests/dumb-less-than-ite.js: Added.
 994         * wasm/js-api/function-tests/factorial.js: Added.
 995         * wasm/js-api/function-tests/float-sub.js: Added.
 996         * wasm/js-api/function-tests/i32-load.js: Added.
 997         * wasm/js-api/function-tests/i32-load8-s.js: Added.
 998         * wasm/js-api/function-tests/if-then-else-fallthrough.js: Added.
 999         * wasm/js-api/function-tests/if-then-fallthrough.js: Added.
1000         * wasm/js-api/function-tests/loop-mult.js: Added.
1001         * wasm/js-api/function-tests/loop-sum.js: Added.
1002         * wasm/js-api/function-tests/ret5.js: Added.
1003         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
1004         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
1005
1006 2016-11-11  Saam Barati  <sbarati@apple.com>
1007
1008         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
1009         https://bugs.webkit.org/show_bug.cgi?id=164650
1010
1011         Reviewed by Geoffrey Garen.
1012
1013         * stress/dont-dead-lock-put-by-val-as-put-by-id.js: Added.
1014         (ident):
1015         (let.o.set foo):
1016         (foo):
1017
1018 2016-11-11  Chris Dumez  <cdumez@apple.com>
1019
1020         Unreviewed, rolling out r208584.
1021
1022         Seems to have regressed Speedometer by 1% on Mac
1023
1024         Reverted changeset:
1025
1026         "We should have a more concise way of determining when we're
1027         varargs calling a function using rest parameters"
1028         https://bugs.webkit.org/show_bug.cgi?id=164258
1029         http://trac.webkit.org/changeset/208584
1030
1031 2016-11-11  Chris Dumez  <cdumez@apple.com>
1032
1033         Unreviewed, rolling out r208117 and r208160.
1034
1035         Regressed Speedometer by >1.5%
1036
1037         Reverted changesets:
1038
1039         "We should have a way of profiling when a get_by_id is pure
1040         and to emit a PureGetById in the DFG/FTL"
1041         https://bugs.webkit.org/show_bug.cgi?id=163305
1042         http://trac.webkit.org/changeset/208117
1043
1044         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
1045         out"
1046         https://bugs.webkit.org/show_bug.cgi?id=164227
1047         http://trac.webkit.org/changeset/208160
1048
1049 2016-11-11  Saam Barati  <sbarati@apple.com>
1050
1051         We should have a more concise way of determining when we're varargs calling a function using rest parameters
1052         https://bugs.webkit.org/show_bug.cgi?id=164258
1053
1054         Reviewed by Yusuke Suzuki.
1055
1056         * microbenchmarks/call-using-spread.js: Added.
1057         (bar):
1058         (foo):
1059         * microbenchmarks/spread-large-array.js: Added.
1060         (foo):
1061         (arrays.push):
1062         * microbenchmarks/spread-small-array.js: Added.
1063         (foo):
1064         * stress/spread-array-iterator-watchpoint-2.js: Added.
1065         (foo):
1066         (arrayIterator.next):
1067         * stress/spread-array-iterator-watchpoint.js: Added.
1068         (foo):
1069         (Array.prototype.Symbol.iterator):
1070         * stress/spread-non-array.js: Added.
1071         (assert):
1072         (foo):
1073         (let.customIterator.Symbol.iterator):
1074         (bar):
1075
1076 2016-11-10  Mark Lam  <mark.lam@apple.com>
1077
1078         Fix broken have-a-bad-time-with-arguments.js test.
1079         https://bugs.webkit.org/show_bug.cgi?id=164626
1080
1081         Reviewed by Filip Pizlo.
1082
1083         But also saved a copy of the broken one as broken-have-a-bad-time-with-arguments-for-gc-testing.js
1084         because coincidentally, it stresses the GC in ways that help reveal bugs.
1085
1086         * stress/broken-have-a-bad-time-with-arguments-for-gc-testing.js: Added.
1087         (testFunction):
1088         (warmupFunction):
1089         (let.argsDeclIndex.in.argumentsDecls.let.indexToReturnIndex.in.indicesToReturn.let.insertElementActionIndex.in.insertElementActions.let.tierWarmupCountIndex.in.tierWarmupCounts.let.testArgsIndex.in.testArgsList.catch):
1090         * stress/have-a-bad-time-with-arguments.js:
1091
1092 2016-11-10  JF Bastien  <jfbastien@apple.com>
1093
1094         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
1095         https://bugs.webkit.org/show_bug.cgi?id=164597
1096
1097         Reviewed by Keith Miller.
1098
1099         Trim the array buffer before returning it: it's optimistically
1100         over-allocated to avoid growing all the time, but when parsed it
1101         can't have extra content.
1102
1103         * wasm/Builder_WebAssemblyBinary.js:
1104         (export.const.Binary):
1105         * wasm/LowLevelBinary.js:
1106         (export.default.LowLevelBinary.prototype.get return):
1107
1108 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
1109
1110         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
1111         https://bugs.webkit.org/show_bug.cgi?id=164450
1112
1113         Reviewed by Darin Adler.
1114
1115         * stress/dataview-typedarray-toindex.js: Added.
1116         Tests for all cases where ToIndex should be used.
1117
1118         * test262.yaml:
1119         New passing tests.
1120
1121 2016-11-10  Mark Lam  <mark.lam@apple.com>
1122
1123         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
1124         https://bugs.webkit.org/show_bug.cgi?id=164600
1125         <rdar://problem/28828676>
1126
1127         Reviewed by Filip Pizlo.
1128
1129         * stress/osr-exit-on-op-negate-should-no-fail-assertions.js: Added.
1130
1131 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1132
1133         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
1134         https://bugs.webkit.org/show_bug.cgi?id=164502
1135
1136         Reviewed by Saam Barati.
1137
1138         * stress/argument-intrinsic-basic.js: Added.
1139         (shouldBe):
1140         (builtin.createBuiltin):
1141         * stress/argument-intrinsic-inlining-with-result-escape.js: Added.
1142         (shouldBe):
1143         (builtin.createBuiltin):
1144         (escape):
1145         * stress/argument-intrinsic-nested-inlining.js: Added.
1146         (shouldBe):
1147         (builtin.createBuiltin):
1148         (builtinCaller1):
1149         (builtinCaller2):
1150         (escape):
1151         * stress/argument-intrinsic-not-convert-to-get-argument.js: Added.
1152         (shouldBe):
1153         (builtin.createBuiltin):
1154         * stress/argument-intrinsic-with-stack-write.js: Added.
1155         (shouldBe):
1156         (builtin.createBuiltin):
1157
1158 2016-11-09  Saam Barati  <sbarati@apple.com>
1159
1160         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
1161         https://bugs.webkit.org/show_bug.cgi?id=164464
1162         <rdar://problem/29131452>
1163
1164         Reviewed by Darin Adler.
1165
1166         * stress/math-max-min-no-arguments.js: Added.
1167         (assert):
1168         (min):
1169         (max):
1170         (test):
1171
1172 2016-11-09  Saam Barati  <sbarati@apple.com>
1173
1174         TypeProfiler and running GC collection on another thread don't play nicely with each other
1175         https://bugs.webkit.org/show_bug.cgi?id=164441
1176         <rdar://problem/29132174>
1177
1178         Reviewed by Geoffrey Garen.
1179
1180         * typeProfiler/type-profiler-gc.js: Added.
1181         (bar):
1182         (foo):
1183
1184 2016-11-04  Mark Lam  <mark.lam@apple.com>
1185
1186         Error description code should be able to handle Symbol values.
1187         https://bugs.webkit.org/show_bug.cgi?id=164436
1188         <rdar://problem/29115583>
1189
1190         Reviewed by Filip Pizlo and Saam Barati.
1191
1192         * stress/error-description-on-symbols-should-not-crash.js: Added.
1193
1194 2016-11-03  Geoffrey Garen  <ggaren@apple.com>
1195
1196         EvalCodeCache should not give up in strict mode and other cases
1197         https://bugs.webkit.org/show_bug.cgi?id=164357
1198
1199         Reviewed by Michael Saboff.
1200
1201         * microbenchmarks/eval-cached.js: Added. 45x faster now.
1202         * stress/eval-cached.js: Added. Try running the same eval text in a bunch
1203         of different scopes and verify that we access the right scope.
1204
1205 2016-11-04  JF Bastien  <jfbastien@apple.com>
1206
1207         WebAssembly JS API: implement more sections
1208         https://bugs.webkit.org/show_bug.cgi?id=164023
1209
1210         Reviewed by Keith Miller.
1211
1212         On the JSC side:
1213
1214          - Put in parser stubs for all WebAssembly sections.
1215          - Parse Import, Export sections.
1216          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
1217          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
1218          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
1219          - parseCode: avoid overflow through function size.
1220          - Remove all remainders of polyfill-prototype-1, and update license.
1221          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
1222
1223         On the Builder.js testing side:
1224
1225          - Implement Type, Import (function only), Export (function only) sections.
1226          - Check section order and uniqueness.
1227          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
1228          - Allow re-exporting an import.
1229
1230         * wasm/Builder.js: build type, import, and export sections
1231         (const._normalizeFunctionSignature):
1232         * wasm/Builder_WebAssemblyBinary.js: Added. Forked from Builder.js
1233         (const.emitters.Type):
1234         (const.emitters.Import):
1235         (const.emitters.Function):
1236         (const.emitters.Table):
1237         (const.emitters.Memory):
1238         (const.emitters.Global):
1239         (const.emitters.Export):
1240         (const.emitters.Start):
1241         (const.emitters.Element):
1242         (const.emitters.Code):
1243         (const.emitters.Data):
1244         (export.const.Binary):
1245         * wasm/LowLevelBinary.js: Add a few useful outputs
1246         (export.default.LowLevelBinary.prototype.varuint1):
1247         (export.default.LowLevelBinary.prototype.varint7):
1248         * wasm/WASM.js: value type and external kind helpers
1249         * wasm/assert.js: array element-wise equality comparison
1250         (const._eq):
1251         * wasm/js-api/test_Module.js:
1252         (ModuleWithImports):
1253         * wasm/self-test/test_BuilderJSON.js: many more tests for all the new Builder APIs, and update to some older tests which now require a Type section or rejiggered Function signature
1254         (const.assertOpThrows):
1255         (SectionsWithSameCustomName):
1256         (TwoTypeSections):
1257         (EmptyImportSection):
1258         (ImportBeforeTypeSections):
1259         * wasm/self-test/test_BuilderWebAssembly.js: remove a test which wasn't helpful and is now obsolete
1260         (CustomSection):
1261
1262 2016-11-03  Mark Lam  <mark.lam@apple.com>
1263
1264         ClonedArguments need to also support haveABadTime mode.
1265         https://bugs.webkit.org/show_bug.cgi?id=164200
1266         <rdar://problem/27211336>
1267
1268         Reviewed by Geoffrey Garen.
1269
1270         * stress/have-a-bad-time-with-arguments.js: Added.
1271
1272 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1273
1274         DFG plays fast and loose with the shadow values of a Phi
1275         https://bugs.webkit.org/show_bug.cgi?id=164309
1276
1277         Reviewed by Saam Barati.
1278
1279         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1280
1281         * stress/dfg-ssa-swap.js: Added.
1282         (foo):
1283
1284 2016-11-03  Commit Queue  <commit-queue@webkit.org>
1285
1286         Unreviewed, rolling out r208364.
1287         https://bugs.webkit.org/show_bug.cgi?id=164402
1288
1289         broke the build (Requested by smfr on #webkit).
1290
1291         Reverted changeset:
1292
1293         "DFG plays fast and loose with the shadow values of a Phi"
1294         https://bugs.webkit.org/show_bug.cgi?id=164309
1295         http://trac.webkit.org/changeset/208364
1296
1297 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1298
1299         DFG plays fast and loose with the shadow values of a Phi
1300         https://bugs.webkit.org/show_bug.cgi?id=164309
1301
1302         Reviewed by Saam Barati.
1303
1304         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1305
1306         * stress/dfg-ssa-swap.js: Added.
1307         (foo):
1308
1309 2016-11-03  Saam Barati  <sbarati@apple.com>
1310
1311         Asking for a value profile prediction should be defensive against not finding a value profile
1312         https://bugs.webkit.org/show_bug.cgi?id=164306
1313
1314         Reviewed by Mark Lam.
1315
1316         * stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js: Added.
1317         (let.o.set foo):
1318         (bar):
1319
1320 2016-11-02  Saam Barati  <sbarati@apple.com>
1321
1322         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
1323         https://bugs.webkit.org/show_bug.cgi?id=164301
1324
1325         Reviewed by Geoffrey Garen.
1326
1327         * stress/rest-parameter-allocation-elimination-watchpoints-2.js: Added.
1328         (assert):
1329         (foo):
1330         * stress/rest-parameter-allocation-elimination-watchpoints-3.js: Added.
1331         (assert):
1332         (foo):
1333         * stress/rest-parameter-allocation-elimination-watchpoints-4.js: Added.
1334         (assert):
1335         (foo):
1336         * stress/rest-parameter-allocation-elimination-watchpoints-5.js: Added.
1337         (assert):
1338         (foo):
1339         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Added.
1340         (assert):
1341         (foo):
1342         * stress/rest-parameter-allocation-elimination-watchpoints.js: Added.
1343         (assert):
1344         (foo):
1345
1346 2016-11-01  Saam Barati  <sbarati@apple.com>
1347
1348         We should be able to eliminate rest parameter allocations
1349         https://bugs.webkit.org/show_bug.cgi?id=163925
1350
1351         Reviewed by Filip Pizlo.
1352
1353         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1354         (assert):
1355         (test1.bar):
1356         (test1):
1357         (test2.jaz):
1358         (test2.jaz2.kaz):
1359         (test2.jaz2):
1360         (test2):
1361         (test3.foo):
1362         (test3.baz):
1363         (test3.jaz):
1364         (test3):
1365         (test4.baz):
1366         (test4.jaz):
1367         (test4):
1368         (test5.baz):
1369         (test5.jaz):
1370         (test5):
1371         (test6.baz):
1372         (test6.jaz):
1373         (test6):
1374         (test7.baz):
1375         (test7.jaz):
1376         (test7.check):
1377         (test7):
1378         (test8.baz):
1379         (test8.jaz):
1380         (test8.check):
1381         (test8):
1382         (test9.baz):
1383         (test9.jaz):
1384         (test9.check):
1385         (test9):
1386         (test10.baz):
1387         (test10.jaz):
1388         (test10):
1389         (test11.bar):
1390         (test11.foo):
1391         (test11.makeArguments):
1392         (test11.):
1393         (test12):
1394         (test12.bar):
1395         (test12.foo):
1396         (test12.makeArguments):
1397         (test12.):
1398         (test13.bar):
1399         (test13.top):
1400         (test13.foo):
1401         (test13.makeArguments):
1402         (test13.):
1403         (test13):
1404         (test14.bar):
1405         (test14.top):
1406         (test14.foo):
1407         (test14.makeArguments):
1408         (test14.):
1409         (test14):
1410         (test15.bar):
1411         (test15.top):
1412         (test15.foo):
1413         (test15.makeArguments):
1414         (test15.):
1415         (test15):
1416
1417 2016-11-01  Commit Queue  <commit-queue@webkit.org>
1418
1419         Unreviewed, rolling out r208208 and r208210.
1420         https://bugs.webkit.org/show_bug.cgi?id=164276
1421
1422         This change caused 28 JSC test failures. (Requested by
1423         ryanhaddad on #webkit).
1424
1425         Reverted changesets:
1426
1427         "We should be able to eliminate rest parameter allocations"
1428         https://bugs.webkit.org/show_bug.cgi?id=163925
1429         http://trac.webkit.org/changeset/208208
1430
1431         "Fix the EFL build."
1432         http://trac.webkit.org/changeset/208210
1433
1434 2016-10-31  Filip Pizlo  <fpizlo@apple.com>
1435
1436         JSC should support SharedArrayBuffer
1437         https://bugs.webkit.org/show_bug.cgi?id=163986
1438
1439         Reviewed by Keith Miller.
1440
1441         This adds our own test for the various corner cases of SharedArrayBuffer. This test is meant to
1442         check all of the things that don't require concurrency.
1443
1444         * stress/SharedArrayBuffer.js: Added.
1445         (checkAtomics):
1446         (shouldFail):
1447         (Symbol):
1448         (runAtomic):
1449
1450 2016-10-31  Saam Barati  <sbarati@apple.com>
1451
1452         We should be able to eliminate rest parameter allocations
1453         https://bugs.webkit.org/show_bug.cgi?id=163925
1454
1455         Reviewed by Filip Pizlo.
1456
1457         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1458         (assert):
1459         (test1.bar):
1460         (test1):
1461         (test2.jaz):
1462         (test2.jaz2.kaz):
1463         (test2.jaz2):
1464         (test2):
1465         (test3.foo):
1466         (test3.baz):
1467         (test3.jaz):
1468         (test3):
1469         (test4.baz):
1470         (test4.jaz):
1471         (test4):
1472         (test5.baz):
1473         (test5.jaz):
1474         (test5):
1475         (test6.baz):
1476         (test6.jaz):
1477         (test6):
1478         (test7.baz):
1479         (test7.jaz):
1480         (test7.check):
1481         (test7):
1482         (test8.baz):
1483         (test8.jaz):
1484         (test8.check):
1485         (test8):
1486         (test9.baz):
1487         (test9.jaz):
1488         (test9.check):
1489         (test9):
1490         (test10.baz):
1491         (test10.jaz):
1492         (test10):
1493         (test11.bar):
1494         (test11.foo):
1495         (test11.makeArguments):
1496         (test11.):
1497         (test12):
1498         (test12.bar):
1499         (test12.foo):
1500         (test12.makeArguments):
1501         (test12.):
1502         (test13.bar):
1503         (test13.top):
1504         (test13.foo):
1505         (test13.makeArguments):
1506         (test13.):
1507         (test13):
1508         (test14.bar):
1509         (test14.top):
1510         (test14.foo):
1511         (test14.makeArguments):
1512         (test14.):
1513         (test14):
1514         (test15.bar):
1515         (test15.top):
1516         (test15.foo):
1517         (test15.makeArguments):
1518         (test15.):
1519         (test15):
1520
1521 2016-10-31  Saam Barati  <sbarati@apple.com>
1522
1523         Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing out
1524         https://bugs.webkit.org/show_bug.cgi?id=164227
1525
1526         Unreviewed timeout fix.
1527
1528         * microbenchmarks/pure-get-by-id-cse-2.js:
1529
1530 2016-10-31  Keith Miller  <keith_miller@apple.com>
1531
1532         autogenerated files from wasm.json should be in derived sources.
1533         https://bugs.webkit.org/show_bug.cgi?id=164152
1534
1535         Reviewed by Filip Pizlo.
1536
1537         Delete generation script since it is no longer used.
1538
1539         * wasm/generate-wasmops-header.js: Removed.
1540
1541 2016-10-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1542
1543         [JSC] JSON.stringify should handle Proxy which is non JSArray but isArray is true
1544         https://bugs.webkit.org/show_bug.cgi?id=164123
1545
1546         Reviewed by Mark Lam.
1547
1548         * stress/json-stringify-with-non-jsarray-array.js: Added.
1549         (shouldBe):
1550         (shouldBe.JSON.stringify.new.Proxy):
1551
1552 2016-10-29  Saam Barati  <sbarati@apple.com>
1553
1554         We should have a way of profiling when a get_by_id is pure and to emit a PureGetById in the DFG/FTL
1555         https://bugs.webkit.org/show_bug.cgi?id=163305
1556
1557         Reviewed by Keith Miller.
1558
1559         * microbenchmarks/pure-get-by-id-cse-2.js: Added.
1560         (foo):
1561         * microbenchmarks/pure-get-by-id-cse.js: Added.
1562         (foo):
1563         * stress/pure-get-by-id-cse-correctness.js: Added.
1564         (assert):
1565         (foo):
1566         * stress/pure-get-by-id-on-non-object.js: Added.
1567         (assert):
1568         (foo):
1569
1570 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1571
1572         Skip JSTests/microbenchmarks/dense-set.js on memory limited devices
1573         https://bugs.webkit.org/show_bug.cgi?id=164128
1574
1575         Reviewed by Mark Lam.
1576
1577         * microbenchmarks/dense-set.js:
1578
1579 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1580
1581         [JSC] implement runtime for async functions
1582         https://bugs.webkit.org/show_bug.cgi?id=163760
1583
1584         Reviewed by Yusuke Suzuki.
1585
1586         * stress/async-await-basic.js: Added.
1587         (shouldBe):
1588         (shouldBeAsync):
1589         (shouldThrow):
1590         (shouldThrowAsync):
1591         (shouldThrowSyntaxError):
1592         (let.AsyncFunction.async):
1593         (async.asyncFunctionForProto):
1594         (Object.getPrototypeOf.async):
1595         (Object.getPrototypeOf.async.method):
1596         (async):
1597         (async.method):
1598         (async.asyncNonConstructorDecl):
1599         (shouldThrow.new.async):
1600         (shouldThrow.new.async.nonConstructor):
1601         (async.asyncDecl):
1602         (async.f):
1603         (MyError):
1604         (async.asyncDeclThrower):
1605         (shouldThrowAsync.async):
1606         (resolveLater):
1607         (rejectLater):
1608         (async.resumeAfterNormal):
1609         (O.async.resumeAfterNormal):
1610         (resumeAfterNormalArrow.async):
1611         (async.resumeAfterThrow):
1612         (O.async.resumeAfterThrow):
1613         (resumeAfterThrowArrow.async):
1614         (catch):
1615         * stress/async-await-module-reserved-word.js: Added.
1616         (shouldThrow):
1617         (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
1618         (checkModuleSyntaxError.String.raw.await):
1619         (checkModuleSyntaxError.String.raw.async.await):
1620         (SyntaxError.Cannot.declare.named):
1621         * stress/async-await-mozilla.js: Added.
1622         (shouldBe):
1623         (shouldBeAsync):
1624         (shouldThrow):
1625         (shouldThrowAsync):
1626         (assert):
1627         (shouldThrowSyntaxError):
1628         (mozSemantics.async.empty):
1629         (mozSemantics.async.simpleReturn):
1630         (mozSemantics.async.simpleAwait):
1631         (mozSemantics.async.simpleAwaitAsync):
1632         (mozSemantics.async.returnOtherAsync):
1633         (mozSemantics.async.simpleThrower):
1634         (mozSemantics.async.delegatedThrower):
1635         (mozSemantics.async.tryCatch):
1636         (mozSemantics.async.tryCatchThrow):
1637         (mozSemantics.async.wellFinally):
1638         (mozSemantics.async.finallyMayFail):
1639         (mozSemantics.async.embedded.async.inner):
1640         (mozSemantics.async.embedded):
1641         (mozSemantics.async.fib):
1642         (mozSemantics.async.isOdd.async.isEven):
1643         (mozSemantics.async.isOdd):
1644         (mozSemantics.hardcoreFib.async.fib2):
1645         (mozSemantics.namedAsyncExpr.async.simple):
1646         (mozSemantics.async.executionOrder.async.first):
1647         (mozSemantics.async.executionOrder.async.second):
1648         (mozSemantics.async.executionOrder.async.third):
1649         (mozSemantics.async.executionOrder):
1650         (mozSemantics.async.miscellaneous):
1651         (mozSemantics.thrower):
1652         (mozSemantics.async.defaultArgs):
1653         (mozSemantics.shouldThrow):
1654         (mozSemantics):
1655         (mozMethods.X):
1656         (mozMethods.X.prototype.async.getValue):
1657         (mozMethods.X.prototype.setValue):
1658         (mozMethods.X.prototype.async.increment):
1659         (mozMethods.X.prototype.async.getBaseClassName):
1660         (mozMethods.X.async.getStaticValue):
1661         (mozMethods.Y.prototype.async.getBaseClassName):
1662         (mozMethods.Y):
1663         (mozFunctionNameInferrence.async.test):
1664         (mozSyntaxErrors):
1665         * stress/async-await-reserved-word.js: Added.
1666         (assert):
1667         (shouldThrowSyntaxError):
1668         (AsyncFunction.async):
1669         * stress/async_arrow_functions_lexical_arguments_binding.js: Added.
1670         (shouldBe):
1671         (shouldBeAsync):
1672         (shouldThrowAsync):
1673         (noArgumentsArrow2.async):
1674         * stress/async_arrow_functions_lexical_new.target_binding.js: Added.
1675         (shouldBe):
1676         (shouldBeAsync):
1677         (shouldThrowAsync):
1678         (C1):
1679         (C2):
1680         (shouldThrowAsync.async):
1681         * stress/async_arrow_functions_lexical_super_binding.js: Added.
1682         (shouldBe):
1683         (shouldBeAsync):
1684         (BaseClass.prototype.baseClassValue):
1685         (BaseClass.prototype.get property):
1686         (BaseClass):
1687         (ChildClass.prototype.asyncSuperProp):
1688         (ChildClass.prototype.asyncSuperProp2):
1689         (ChildClass):
1690         (ChildClass2):
1691         * stress/async_arrow_functions_lexical_this_binding.js: Added.
1692         (shouldBe):
1693         (shouldBeAsync):
1694         (d.y):
1695
1696 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1697
1698         Skip 2 JS stress tests on memory limited devices
1699         https://bugs.webkit.org/show_bug.cgi?id=164125
1700
1701         Unreviewed quick fix to unbreak JSCOnly ARM bots as soon as possible.
1702
1703         * stress/joined-strings-should-not-exceed-max-string-length.js:
1704         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1705
1706 2016-10-27  Caitlin Potter  <caitp@igalia.com>
1707
1708         [JSC] forbid lexical redeclaration of generator formal parameters
1709         https://bugs.webkit.org/show_bug.cgi?id=163930
1710
1711         Reviewed by Yusuke Suzuki.
1712
1713         * stress/async-await-syntax.js:
1714         * stress/generator-syntax.js:
1715         (testSyntaxError.gen):
1716         (testSyntaxError.arguments):
1717         (testSyntaxError.eval):
1718         * test262.yaml:
1719
1720 2016-10-26  JF Bastien  <jfbastien@apple.com>
1721
1722         WebAssembly API: implement Instance
1723
1724         As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-objects
1725
1726          - Take ownership of Wasm::Plan's compilation result when successfully creating a JSWebAssemblyModule object.
1727          - Construct a basic Instance with a Module.
1728          - Handle second argument (importObject) of WebAssembly.Instance.
1729          - Add reference text from the spec to WebAssembly.Module's code.
1730          - Expose and test an empty 'exports' ModuleNamespaceObject on WebAssembly.Instance.
1731
1732         The implementation isn't complete yet: it relies on further work for which I've filed bugs.
1733
1734         WebAssembly API: implement Instance
1735         https://bugs.webkit.org/show_bug.cgi?id=163998
1736
1737         Reviewed by Keith Miller.
1738
1739         * wasm/js-api/test_Instance.js: Added.
1740         (EmptyModule): use the Builder, create the simplest Module possible, and create an Instance from it
1741         * wasm/js-api/test_basic_api.js:
1742         (const.c.in.constructorProperties.switch): basic tests of the API
1743
1744 2016-10-26  Mark Lam  <mark.lam@apple.com>
1745
1746         JSGenericTypedArrayView::set() should check for exceptions.
1747         https://bugs.webkit.org/show_bug.cgi?id=164007
1748         <rdar://problem/28853775>
1749
1750         Reviewed by Filip Pizlo.
1751
1752         * stress/typed-array-view-set-should-not-crash-on-exception.js: Added.
1753
1754 2016-10-25  Mark Lam  <mark.lam@apple.com>
1755
1756         String.prototype.replace() should throw an OutOfMemoryError when using too much memory.
1757         https://bugs.webkit.org/show_bug.cgi?id=163996
1758         <rdar://problem/28263117>
1759
1760         Reviewed by Geoffrey Garen.
1761
1762         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: Added.
1763
1764 2016-10-25  Mark Lam  <mark.lam@apple.com>
1765
1766         JSStringJoiner::joinedLength() should limit joined string lengths to INT_MAX.
1767         https://bugs.webkit.org/show_bug.cgi?id=163937
1768         <rdar://problem/28642990>
1769
1770         Reviewed by Geoffrey Garen.
1771
1772         * stress/joined-strings-should-not-exceed-max-string-length.js: Added.
1773
1774 2016-10-25  JF Bastien  <jfbastien@apple.com>
1775
1776         WebAssembly JS API: simple Module test
1777         https://bugs.webkit.org/show_bug.cgi?id=163963
1778
1779         Reviewed by Filip Pizlo.
1780
1781         * wasm/LowLevelBinary.js:
1782         (export.default.LowLevelBinary.prototype.get return): get the ArrayBuffer
1783         (export.default.LowLevelBinary.prototype.hexdump): Deleted.
1784         (export.default.LowLevelBinary.prototype._maybeGrow): Deleted.
1785         * wasm/js-api/test_Module.js: Added.
1786         (EmptyModule): The most basic module possible
1787
1788 2016-10-25  JF Bastien  <jfbastien@apple.com>
1789
1790         WebAssembly JS API: implement Module
1791
1792         This implementation allows us to:
1793          - Syncrhonously create a WebAssembly.Module with a typed array.
1794          - Creates a compilation plan.
1795          - Parse the Module and creates corresponding code.
1796          - Throw WebAssembly.CompileError with mildly helpful [*] error messages on
1797            failure.
1798
1799         Consult the API documentation for expected behavior: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodule-constructor
1800
1801         For now the implementation discards the generated code.
1802
1803         The next steps will be:
1804          - Expose a Module's exports.
1805          - Implement WebAssembly.Instance, which allows instantiating and running a
1806            compiled Module.
1807          - Beef up the testing infrastructure under JSTests/wasm so that more complex
1808            modules can be created and tested (instead of writing the bits by hand).
1809
1810         This patch also:
1811          - Adds assert.instanceof in assert.js.
1812          - Refactors Wasm::Parser and friends to accept const uint8_t* as well as a
1813            Vector, to avoid copying when invoked synchronously.
1814          - Remove useless Structure from some of the wasm constructors: they're already
1815            on the JSGlobalObject, visited properly and all.
1816          - Fix off-by-one error in parsing: Parser::parseUInt32 failed if the integer
1817            was exactly at end of file.
1818
1819          [*] On error messages while parsing: I filed https://bugs.webkit.org/show_bug.cgi?id=163919
1820
1821         WebAssembly JS API: implement Module
1822         https://bugs.webkit.org/show_bug.cgi?id=163903
1823
1824         Reviewed by Keith Miller.
1825
1826         * wasm/assert.js: use underscore in name, and remove when exporting to avoid clasing with builtin names
1827         (const._notUndef):
1828         (const._isUndef):
1829         (const._eq):
1830         (const._ge):
1831         (const._throws):
1832         * wasm/js-api/test_basic_api.js: test the WebAssembly.Module API
1833         (const.c.in.constructorProperties.switch):
1834
1835 2016-10-25  Keith Miller  <keith_miller@apple.com>
1836
1837         Add trivial Wasm conversion opcodes
1838         https://bugs.webkit.org/show_bug.cgi?id=163950
1839
1840         Reviewed by Filip Pizlo.
1841
1842         This patch differentiates between Wasm opcodes that are trivially mapped to a B3 opcode and
1843         those that are not.  Some of the Wasm opcodes that are currently a non-simple opcode will
1844         become simple as we add B3 opcodes for Wasm operations.  The remaining opcodes will need to
1845         be added via patchpoints in a later patch.
1846
1847         * wasm/generate-wasmops-header.js:
1848         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.Wasm.inline.bool.isSimple):
1849         * wasm/wasm.json:
1850
1851 2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1852
1853         Arrow functions with concise bodies cannot return regular expressions
1854         https://bugs.webkit.org/show_bug.cgi?id=163162
1855
1856         Reviewed by Filip Pizlo.
1857
1858         * ChakraCore/test/Operators/instanceof.baseline-jsc:
1859         * ChakraCore/test/Regex/nul_character.baseline-jsc:
1860         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
1861         * stress/parse-regexp-as-token.js: Added.
1862         (shouldBe):
1863
1864 2016-10-24  Keith Miller  <keith_miller@apple.com>
1865
1866         Wasm should support floating point operations.
1867         https://bugs.webkit.org/show_bug.cgi?id=163770
1868
1869         Reviewed by Michael Saboff.
1870
1871         Add appropriate b3op names for floating point wasm bytecodes, where they exist.
1872         Also, fix some WASM => Wasm in WasmOps.h generator script that I missed
1873         the first time I made the change.
1874
1875         * wasm/generate-wasmops-header.js:
1876         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.template.typename.Int.inline.bool.isValidOpType): Deleted.
1877         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.BinaryOpType): Deleted.
1878         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.UnaryOpType): Deleted.
1879         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType): Deleted.
1880         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType): Deleted.
1881         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.undef.CREATE_ENUM_VALUE.inline.bool.isControlOp): Deleted.
1882         * wasm/wasm.json:
1883
1884 2016-10-21  Saam Barati  <sbarati@apple.com>
1885
1886         SpeculativeJIT::compileTryGetById needs to pass in NeedsToSpill along both the cell speculation and untyped speculation path
1887         https://bugs.webkit.org/show_bug.cgi?id=163622
1888
1889         Reviewed by Yusuke Suzuki.
1890
1891         * stress/try-get-by-id-should-spill-registers-dfg.js: Added.
1892         (let.f.createBuiltin):
1893
1894 2016-10-21  Caitlin Potter  <caitp@igalia.com>
1895
1896         [JSC] don't crash when arguments to `new Function()` produce unexpected AST
1897         https://bugs.webkit.org/show_bug.cgi?id=163748
1898
1899         Reviewed by Mark Lam.
1900
1901         * stress/regress-163748.js: Added.
1902         (assert):
1903         (shouldThrowSyntaxError):
1904         (GeneratorFunction):
1905
1906 2016-10-20  Keith Miller  <keith_miller@apple.com>
1907
1908         Add support for WASM calls
1909         https://bugs.webkit.org/show_bug.cgi?id=161727
1910
1911         Reviewed by Filip Pizlo and Michael Saboff.
1912
1913         Add members of the Call category to the WASMOps special group.
1914
1915         * wasm/generate-wasmops-header.js:
1916
1917 2016-10-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1918
1919         [JSC] Drop isEnvironmentRecord type info flag and use JSType information instead
1920         https://bugs.webkit.org/show_bug.cgi?id=163761
1921
1922         Reviewed by Keith Miller.
1923
1924         * modules/string-prototype-module-scope.js: Added.
1925         (shouldBe):
1926         (catch):
1927         (refer):
1928         * stress/string-prototype-scopes-global-lexical-environment-strict.js: Added.
1929         (shouldBe):
1930         (catch):
1931         * stress/string-prototype-scopes-global-lexical-environment.js: Added.
1932         (shouldBe):
1933         (catch):
1934         * stress/string-prototype-scopes-strict.js: Added.
1935         (shouldBe):
1936         (catch):
1937         (try.refer):
1938         (refer):
1939         * stress/string-prototype-scopes.js: Added.
1940         (shouldBe):
1941         (catch):
1942         (try.refer):
1943         (refer):
1944         (object.toString):
1945         (with):
1946
1947 2016-10-20  JF Bastien  <jfbastien@apple.com>
1948
1949         WebAssembly API: implement exception constructors properly
1950
1951          - Rename WebAssemblyObject to JSWebAssembly for consistency.
1952          - WebAssembly object now has its own prototype: add WebAssemblyPrototype, and
1953            use it to register JSWebAssembly's function properties through auto-generated
1954            .lut.h, instead of manually.
1955          - The error constructors used to throw (e.g. `new WebAssembly.CompileError()`).
1956          - Register WebAssembly's constructors from the global object, and hold a
1957            reference to their structure and prototype so that invoking the constructor
1958            can use the structure directly from the global object.
1959          - Add a prototype base field to global object creation. Previous ones all had
1960            Object's prototype as their base, but WebAssembly's error constructors have
1961            Error as their base.
1962          - Test for the error object's correctness.
1963          - Add missing #if ENABLE(WEBASSEMBLY)
1964
1965         WebAssembly API: implement exception constructors properly
1966         https://bugs.webkit.org/show_bug.cgi?id=163699
1967
1968         Reviewed by Keith Miller.
1969
1970         * wasm/js-api/test_basic_api.js:
1971         (const.c.in.constructorProperties): more tests
1972
1973 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1974
1975         [JSC] disallow references to `await` in AsyncFunction formal parameters
1976         https://bugs.webkit.org/show_bug.cgi?id=163694
1977
1978         Reviewed by Saam Barati.
1979
1980         * stress/async-await-syntax.js:
1981
1982 2016-10-20  Keith Miller  <keith_miller@apple.com>
1983
1984         Invalid assertion in arguments elimination
1985         https://bugs.webkit.org/show_bug.cgi?id=163740
1986         <rdar://problem/27911462>
1987
1988         Reviewed by Michael Saboff.
1989
1990         * stress/direct-arguments-osr-entry.js: Added.
1991         (foo.):
1992         (foo):
1993
1994 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1995
1996         [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
1997         https://bugs.webkit.org/show_bug.cgi?id=163714
1998
1999         Reviewed by Mark Lam.
2000
2001         Add missing test coverage that dynamically created
2002         JSGeneratorFunctions can not be constructed.
2003
2004         * stress/generator-function-constructor.js:
2005         (shouldThrow):
2006
2007 2016-10-19  JF Bastien  <jfbastien@apple.com>
2008
2009         JavaScript WebAssembly API: baby steps
2010
2011          - Expand WebAssembly constructors into their own files. This requires a lot of
2012            boilerplate, as well as adding the .lut.h files. All of the
2013            JSWebAssembly*.{h,cpp}, as well as Constructor and Prototype files, are
2014            currently the same between the 4 specified WebAssembly constructors. It'll be
2015            easy to implement individual functions on constructed objects as per the
2016            spec, and have each of these files diverge. The error constructors are also
2017            similar, except that their instance derives from ErrorInstance.
2018          - Use constructor macro when initializing the global object.
2019          - Dramatically improve testing of the WebAssembly API by checking for
2020            properties specified in the spec [*].
2021          - Clean up assert.js' exception testing.
2022          - Fix a copy-paste bug in wasm.json: floating-point const return values were
2023            swapped.
2024
2025         [*] https://github.com/WebAssembly/design/blob/master/JS.md
2026
2027         Implement more of the JavaScript WebAssembly API
2028         https://bugs.webkit.org/show_bug.cgi?id=163571
2029
2030         Reviewed by Keith Miller.
2031
2032         * wasm/assert.js:
2033         (export.const.isUndef): add this useful helper
2034         (export.const.throws): fold other throw checks into this one, and check message as well
2035         * wasm/js-api/test_basic_api.js:
2036         (const.checkOwnPropertyDescriptor): check own property descriptor follows the spec
2037         * wasm/self-test/test_BuilderJSON.js:
2038         (const.assertOpThrows): use new assert API
2039         (CheckedOpcodeArgumentsTooMany): ditto
2040         (CheckedOpcodeArgumentsNotEnough): ditto
2041         (CallInvalid): ditto
2042         (I32ConstInvalid): ditto
2043         (F32ConstInvalid): ditto (and this caugth the JSON copy-paste bug)
2044         (F64ConstInvalid): ditto
2045         * wasm/self-test/test_LowLevelBinary_varint.js: use new assert API
2046         * wasm/self-test/test_LowLevelBinary_varuint.js: use new assert API
2047         * wasm/utilities.js: add "global" object, used in basic API test (to access global.WebAssembly).
2048         * wasm/wasm.json: fix copy-paste
2049
2050 2016-10-19  Caitlin Potter  <caitp@igalia.com>
2051
2052         [JSC] forbid "use strict" directive in generator functions with non-simple parameters
2053         https://bugs.webkit.org/show_bug.cgi?id=163683
2054
2055         Reviewed by Geoffrey Garen.
2056
2057         Update various generator*-non-simple-param.js tests to be passing.
2058
2059         * test262.yaml:
2060
2061 2016-10-18  Mark Lam  <mark.lam@apple.com>
2062
2063         Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
2064         https://bugs.webkit.org/show_bug.cgi?id=154377
2065         <rdar://problem/27330808>
2066
2067         Reviewed by Filip Pizlo and Saam Barati.
2068
2069         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.
2070
2071 2016-10-18  Keith Miller  <keith_miller@apple.com>
2072
2073         GetByVal to GetById conversion in the DFG is incorrect for getters with control flow
2074         https://bugs.webkit.org/show_bug.cgi?id=163629
2075
2076         Reviewed by Yusuke Suzuki.
2077
2078         * stress/get-by-val-to-id-with-getter.js: Added.
2079         (foo):
2080         (o.get hello):
2081
2082 2016-10-15  Filip Pizlo  <fpizlo@apple.com>
2083
2084         DFG and FTL should be able to use DirectCall ICs when they proved the callee or its executable
2085         https://bugs.webkit.org/show_bug.cgi?id=163371
2086
2087         Reviewed by Geoffrey Garen and Saam Barati.
2088
2089         Add microbenchmarks for all of the cases that this patch optimizes.
2090
2091         * microbenchmarks/direct-call-arity-mismatch.js: Added.
2092         (foo):
2093         (bar):
2094         * microbenchmarks/direct-call.js: Added.
2095         (foo):
2096         (bar):
2097         * microbenchmarks/direct-construct-arity-mismatch.js: Added.
2098         (Foo):
2099         (bar):
2100         * microbenchmarks/direct-construct.js: Added.
2101         (Foo):
2102         (bar):
2103         * microbenchmarks/direct-tail-call-arity-mismatch.js: Added.
2104         (foo):
2105         (bar):
2106         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js: Added.
2107         (foo):
2108         (bar):
2109         (baz):
2110         * microbenchmarks/direct-tail-call-inlined-caller.js: Added.
2111         (foo):
2112         (bar):
2113         (baz):
2114         * microbenchmarks/direct-tail-call.js: Added.
2115         (foo):
2116         (bar):
2117
2118 2016-10-18  Caitlin Potter  <caitp@igalia.com>
2119
2120         [JSC] ES6 Method functions should not have prototype
2121         https://bugs.webkit.org/show_bug.cgi?id=162530
2122
2123         Reviewed by Saam Barati.
2124
2125         Fix test262 expectations about MethodDefinitions
2126
2127         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
2128         * stress/reflect-set.js:
2129         * test262.yaml:
2130
2131 2016-10-17  Keith Miller  <keith_miller@apple.com>
2132
2133         Add support for WASM Memory.
2134         https://bugs.webkit.org/show_bug.cgi?id=161710
2135
2136         Reviewed by Geoffrey Garen.
2137
2138         Add store and load opcodes to wasm.json. Additionally, add new
2139         enums for those opcodes in the generator.
2140
2141         * stress/wasm/generate-wasmops-header.js:
2142         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType):
2143         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType):
2144
2145 2016-10-17  Saam Barati  <sbarati@apple.com>
2146
2147         Add more tests for the double->String conversion in ValueAdd constant folding
2148         https://bugs.webkit.org/show_bug.cgi?id=163517
2149
2150         Reviewed by Yusuke Suzuki.
2151
2152         * microbenchmarks/string-add-constant-folding.js:
2153         (test):
2154
2155 2016-10-17  JF Bastien  <jfbastien@apple.com>
2156
2157         WebAssembly JS API: implement basic stub
2158
2159         Implement the global WebAssembly JavaScript object, and its constructor +
2160         function properties as described in:
2161           https://github.com/WebAssembly/design/blob/master/JS.md
2162
2163         These don't do anything at the moment, the parent bug will take care of adding
2164         more functionality and associated tests.
2165
2166         WebAssembly JS API: implement basic stub
2167         https://bugs.webkit.org/show_bug.cgi?id=163404
2168
2169         Reviewed by Keith Miller.
2170
2171         * wasm.yaml:
2172         * wasm/js-api/test_basic_api.js: Added.
2173         (const.f.of.functionProperties.WebAssembly.f.undefined.throw.new.Error.Couldn.const.c.of.constructorProperties.WebAssembly.c.undefined.throw.new.Error.Couldn):
2174         (const.c.of.constructorProperties.catch):
2175
2176 2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2177
2178         [DOMJIT] Use DOMJIT::Patchpoint in IC
2179         https://bugs.webkit.org/show_bug.cgi?id=163223
2180
2181         Reviewed by Saam Barati.
2182
2183         * stress/domjit-exception-ic.js: Added.
2184         (shouldBe):
2185         (access):
2186         * stress/domjit-exception.js: Added.
2187         (shouldBe):
2188         (access):
2189         * stress/domjit-getter-complex-with-incorrect-object.js: Added.
2190         (shouldThrow):
2191         (access):
2192         (i.shouldThrow):
2193         * stress/domjit-getter-complex.js: Added.
2194         (shouldBe):
2195         (access):
2196         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js: Added.
2197         (assert):
2198         (bar):
2199         (foo):
2200
2201 2016-10-15  Saam Barati  <sbarati@apple.com>
2202
2203         Assertion failed under operationToLowerCase with a rope with zero length
2204         https://bugs.webkit.org/show_bug.cgi?id=163314
2205
2206         Reviewed by Mark Lam.
2207
2208         * stress/to-lower-case-intrinsic-on-empty-rope.js: Added.
2209         (assert):
2210         (returnRope.helper):
2211         (returnRope):
2212         (lower):
2213
2214 2016-10-14  Benjamin Poulain  <bpoulain@apple.com>
2215
2216         [JSC] op_negate should with any type
2217         https://bugs.webkit.org/show_bug.cgi?id=162587
2218
2219         Reviewed by Saam Barati.
2220
2221         * stress/arith-abs-to-arith-negate-range-optimizaton.js: Added.
2222         Cover OSR Exits when converting Math.abs() into ArithNegate.
2223
2224         * stress/arith-negate-on-various-types.js: Added.
2225         Cover ArithNegate with all types.
2226
2227 2016-10-14  JF Bastien  <jfbastien@apple.com>
2228
2229         Basic WebAssembly testing
2230
2231         Create a small DSL in JavaScript which can build WebAssembly binary modules based on the JSON description of the format as described in:
2232         https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md
2233
2234         This DSL can then be used to write small text description of valid and invalid WebAssembly binaries, making testing the JSC implementation much easier.
2235
2236         Details and example in README.md.
2237
2238         Basic WebAssembly testing
2239         https://bugs.webkit.org/show_bug.cgi?id=163267
2240
2241         Reviewed by Keith Miller.
2242
2243         * stress/wasm/wasm.json: Removed.
2244         * wasm.yaml: Added.
2245         * wasm/Builder.js: Added.
2246         (const._isValidValue):
2247         (const._BuildWebAssemblyBinary):
2248         (export.default.Builder):
2249         (export.default.Builder.prototype.setChecked):
2250         (export.default.Builder.prototype.setPreamble):
2251         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2252         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
2253         (export.default.Builder.prototype._registerSectionBuilders):
2254         (export.default.Builder.prototype._addSection):
2255         (export.default.Builder.prototype.optimize):
2256         (export.default.Builder.prototype.json):
2257         (export.default.Builder.prototype.AsmJS):
2258         (export.default.Builder.prototype.WebAssembly):
2259         * wasm/LowLevelBinary.js: Added.
2260         (const._getterRangeCheck):
2261         (const._hexdump):
2262         (export.default.LowLevelBinary):
2263         (export.default.LowLevelBinary.prototype.newPatchable):
2264         (export.default.LowLevelBinary.prototype.hexdump):
2265         (export.default.LowLevelBinary.prototype._maybeGrow):
2266         (export.default.LowLevelBinary.prototype._push8):
2267         (export.default.LowLevelBinary.prototype.uint8):
2268         (export.default.LowLevelBinary.prototype.uint16):
2269         (export.default.LowLevelBinary.prototype.uint32):
2270         (export.default.LowLevelBinary.prototype.varuint):
2271         (export.default.LowLevelBinary.prototype.varint):
2272         (export.default.LowLevelBinary.prototype.varuint7):
2273         (export.default.LowLevelBinary.prototype.string):
2274         (export.default.LowLevelBinary.prototype.getSize):
2275         (export.default.LowLevelBinary.prototype.getUint8):
2276         (export.default.LowLevelBinary.prototype.getUint16):
2277         (export.default.LowLevelBinary.prototype.getUint32):
2278         (export.default.LowLevelBinary.prototype.getVaruint):
2279         (export.default.LowLevelBinary.prototype.getVarint):
2280         (export.default.LowLevelBinary.prototype.getVaruint7):
2281         (export.default.LowLevelBinary.prototype.getString):
2282         (PatchableLowLevelBinary):
2283         (PatchableLowLevelBinary.prototype._push8):
2284         (PatchableLowLevelBinary.prototype.apply):
2285         * wasm/README.md: Added.
2286         * wasm/WASM.js: Added.
2287         * wasm/assert.js: Added.
2288         (export.const.notUndef):
2289         (export.const.eq):
2290         (export.const.ge):
2291         (export.const.throwsError):
2292         (export.const.throwsRangeError):
2293         * wasm/generate-wasmops-header.js: Renamed from JSTests/stress/wasm/generate-wasmops-header.js.
2294         * wasm/self-test/test_BuilderJSON.js: Added.
2295         (const.assertOpThrows):
2296         (EmptyModule):
2297         (CustomMagicNumber):
2298         (CustomVersion):
2299         (CustomSection):
2300         (CustomSectionAllBytes):
2301         (CustomSectionInvalidByte):
2302         (TwoCustomSections):
2303         (EmptyCodeSection):
2304         (CodeSectionWithEmptyFunction):
2305         (CodeSectionWithEmptyFunctionWithParameters):
2306         (InvalidFunctionParameters):
2307         (SimpleFunction):
2308         (TwoSimpleFunctions):
2309         (TwoBuildersAtTheSameTime):
2310         (CheckedOpcodeArgumentsTooMany):
2311         (CheckedOpcodeArgumentsNotEnough):
2312         (CallNoArguments):
2313         (CallInvalid):
2314         (I32ConstInvalid):
2315         (F32ConstInvalid):
2316         (F64ConstInvalid):
2317         (CallManyFromStack):
2318         (OpcodeAdd):
2319         (OpcodeUnreachable):
2320         (OpcodeUnreachableCombinations):
2321         (OpcodeSelect):
2322         * wasm/self-test/test_BuilderWebAssembly.js: Added.
2323         (EmptyModule):
2324         (CustomSection):
2325         (Basic):
2326         * wasm/self-test/test_LowLevelBinary_encode.js: Added.
2327         * wasm/self-test/test_LowLevelBinary_string.js: Added.
2328         * wasm/self-test/test_LowLevelBinary_uint16.js: Added.
2329         * wasm/self-test/test_LowLevelBinary_uint32.js: Added.
2330         * wasm/self-test/test_LowLevelBinary_uint8.js: Added.
2331         * wasm/self-test/test_LowLevelBinary_varint.js: Added.
2332         * wasm/self-test/test_LowLevelBinary_varuint.js: Added.
2333         * wasm/self-test/test_LowLevelBinary_varuint7.js: Added.
2334         * wasm/self-test/test_WASM.js: Added.
2335         * wasm/test.sh: Added.
2336         * wasm/utilities.js: Added.
2337         (const._read.filename.switch):
2338         (const._load.filename.switch):
2339         (const._json.filename.switch):
2340         * wasm/wasm.json: Added.
2341
2342 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2343
2344         test262: @isConstructor incorrectly thinks Math.cos is a constructor
2345         https://bugs.webkit.org/show_bug.cgi?id=163437
2346
2347         Reviewed by Saam Barati.
2348
2349         * stress/is-constructor.js: Added.
2350         (assert):
2351         (prototype.assert):
2352         New test to cover the @isConstructor builtin.
2353
2354         * test262.yaml:
2355         Test now passes.
2356
2357 2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
2358
2359         Unreviewed, rolling out r207322.
2360
2361         This change caused JSC test failures
2362
2363         Reverted changeset:
2364
2365         "Fix Array.prototype.splice ES6 compliance."
2366         https://bugs.webkit.org/show_bug.cgi?id=163372
2367         http://trac.webkit.org/changeset/207322
2368
2369 2016-10-14  Mark Lam  <mark.lam@apple.com>
2370
2371         JSON.parse should not modify frozen objects.
2372         https://bugs.webkit.org/show_bug.cgi?id=163430
2373
2374         Reviewed by Saam Barati.
2375
2376         * stress/json-parse-on-frozen-object.js: Added.
2377
2378 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2379
2380         test262: Failure with RegExp.prototype.compile when pattern is undefined
2381         https://bugs.webkit.org/show_bug.cgi?id=163431
2382
2383         Reviewed by Yusuke Suzuki.
2384
2385         * test262.yaml:
2386
2387 2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
2388
2389         Exception message for expressions with multiple bracket accesses is inconsistent / incorrect
2390         https://bugs.webkit.org/show_bug.cgi?id=163426
2391
2392         Reviewed by Geoffrey Garen.
2393
2394         * ChakraCore/test/Error/CallNonFunction_3.baseline-jsc:
2395         * ChakraCore/test/Object/null.baseline-jsc:
2396         * stress/exception-in-to-property-key-should-be-handled-early.js:
2397         Better exception messages.
2398
2399 2016-10-13  Mark Lam  <mark.lam@apple.com>
2400
2401         Fix Array.prototype.splice ES6 compliance.
2402         https://bugs.webkit.org/show_bug.cgi?id=163372
2403
2404         Reviewed by Geoffrey Garen and Yusuke Suzuki.
2405
2406         * stress/array-splice-on-frozen-object.js: Added.
2407
2408 2016-10-12  Keith Miller  <keith_miller@apple.com>
2409
2410         Handle non-function, non-undefined comparator in Array.prototype.sort
2411         https://bugs.webkit.org/show_bug.cgi?id=163085
2412
2413         Reviewed by Yusuke Suzuki.
2414
2415         * ChakraCore/test/Array/array_sort.baseline-jsc:
2416         * stress/array-sort-bad-comparator.js: Added.
2417         (test):
2418
2419 2016-10-12  Mark Lam  <mark.lam@apple.com>
2420
2421         Array.prototype.slice should not modify frozen objects.
2422         https://bugs.webkit.org/show_bug.cgi?id=163338
2423
2424         Reviewed by Filip Pizlo.
2425
2426         * stress/array-slice-on-frozen-object.js: Added.
2427
2428 2016-10-11  Mark Lam  <mark.lam@apple.com>
2429
2430         Array.prototype.concat should not modify frozen objects.
2431         https://bugs.webkit.org/show_bug.cgi?id=163302
2432
2433         Reviewed by Filip Pizlo.
2434
2435         * stress/array-concat-on-frozen-object.js: Added.
2436
2437 2016-10-11  Saam Barati  <sbarati@apple.com>
2438
2439         ValueAdd should be constant folded if the operands are constant String,Primitive or Primitive,String
2440         https://bugs.webkit.org/show_bug.cgi?id=163182
2441
2442         Reviewed by Filip Pizlo.
2443
2444         * microbenchmarks/string-add-constant-folding.js: Added.
2445         (assert):
2446         (runTests):
2447         (add):
2448         (test):
2449
2450 2016-10-07  Mark Lam  <mark.lam@apple.com>
2451
2452         Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
2453         https://bugs.webkit.org/show_bug.cgi?id=163160
2454
2455         Reviewed by Saam Barati.
2456
2457         * stress/object-freeze-with-proxy-preventExtensions.js: Added.
2458         * stress/object-seal-with-proxy-preventExtensions.js: Added.
2459
2460 2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2461
2462         [DOMJIT] Add initial CheckDOM and CallDOM implementations
2463         https://bugs.webkit.org/show_bug.cgi?id=162941
2464
2465         Reviewed by Filip Pizlo.
2466
2467         * stress/domjit-getter-poly.js: Added.
2468         (shouldBe):
2469         (access):
2470         * stress/domjit-getter-proto.js: Added.
2471         (shouldBe):
2472         (access):
2473         * stress/domjit-getter-super-poly.js: Added.
2474         (shouldBe):
2475         (access):
2476         * stress/domjit-getter.js: Added.
2477         (shouldBe):
2478         (access):
2479
2480 2016-10-04  Saam Barati  <sbarati@apple.com>
2481
2482         String.prototype.toLowerCase should be a DFG/FTL intrinsic
2483         https://bugs.webkit.org/show_bug.cgi?id=162887
2484
2485         Reviewed by Filip Pizlo and Yusuke Suzuki.
2486
2487         * microbenchmarks/to-lower-case.js: Added.
2488         (assert):
2489         (foo):
2490         (bar):
2491         * stress/to-lower-case.js: Added.
2492         (assert):
2493         (foo):
2494
2495 2016-10-04  JF Bastien  <jfbastien@apple.com>
2496
2497         WebAssembly: handle a few corner cases
2498         https://bugs.webkit.org/show_bug.cgi?id=162884
2499
2500         Reviewed by Keith Miller.
2501
2502         * stress/wasm/generate-wasmops-header.js:
2503         (const.opcodeIterator): max opcode value
2504
2505 2016-10-03  JF Bastien  <jfbastien@apple.com>
2506
2507         Auto-generate WASMOps.h, share with testing JSON file
2508         https://bugs.webkit.org/show_bug.cgi?id=162870
2509
2510         Reviewed by Keith Miller.
2511
2512         * stress/wasm/to-c++.js: Added. Generates WASMOps.h, siilar to the current one but with more data.
2513         (const.opcode_iterator):
2514         (opcode_macroizer):
2515         * stress/wasm/wasm.json: Added. Data from 0xC binary format version.
2516
2517 2016-10-03  Saam Barati  <sbarati@apple.com>
2518
2519         MapHash should speculate on the type of its child node
2520         https://bugs.webkit.org/show_bug.cgi?id=161922
2521
2522         Reviewed by Filip Pizlo.
2523
2524         * microbenchmarks/map-key-well-typed.js: Added.
2525         (assert):
2526         (intKey):
2527         (doubleKey):
2528         (objectKey):
2529         (stringKey):
2530         (booleanKey):
2531         (symbolKey):
2532         (cellKey):
2533         (assert.doubleKey):
2534         (assert.booleanKey):
2535
2536 2016-10-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2537
2538         [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
2539         https://bugs.webkit.org/show_bug.cgi?id=162849
2540
2541         Reviewed by Geoffrey Garen.
2542
2543         * test262.yaml:
2544
2545 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2546
2547         [ES6] Align attributes of Generator related properties to spec
2548         https://bugs.webkit.org/show_bug.cgi?id=162839
2549
2550         Reviewed by Saam Barati.
2551
2552         * test262.yaml:
2553
2554 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2555
2556         [ES6] GeneratorFunction constructor should instantiate generator function
2557         https://bugs.webkit.org/show_bug.cgi?id=162838
2558
2559         Reviewed by Saam Barati.
2560
2561         * stress/generator-function-constructor-is-subclassible.js: Added.
2562         (shouldBe):
2563         (GeneratorFunction):
2564         (prototype.hello):
2565         * stress/generator-function-constructor.js:
2566         * test262.yaml:
2567
2568 2016-09-30  Saam Barati  <sbarati@apple.com>
2569
2570         Arrow functions should not allow duplicate parameter names
2571         https://bugs.webkit.org/show_bug.cgi?id=162741
2572
2573         Reviewed by Filip Pizlo.
2574
2575         * test262.yaml:
2576
2577 2016-09-30  Saam Barati  <sbarati@apple.com>
2578
2579         Make some microbenchmarks run for less time.
2580
2581         Rubber stamped by Filip Pizlo.
2582
2583         * microbenchmarks/bound-function-construction-performance.js:
2584         (foo):
2585         * microbenchmarks/getter-richards-try-catch.js:
2586
2587 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2588
2589         Arrow functions do not infer name from computed property but normal functions do
2590         https://bugs.webkit.org/show_bug.cgi?id=162720
2591
2592         Reviewed by Saam Barati.
2593
2594         * stress/inferred-names.js:
2595
2596 2016-09-29  Mark Lam  <mark.lam@apple.com>
2597
2598         Break some slow running tests into smaller bits so they don't time out.
2599         https://bugs.webkit.org/show_bug.cgi?id=162743
2600
2601         Reviewed by Keith Miller.
2602
2603         The following tests have shown to be slow running:
2604             op_div.js
2605             op_lshift.js
2606             op_mod.js
2607             op_mul.js
2608             op_rshift.js
2609             op_sub.js
2610             op_urshift
2611
2612         These tests auto-generate permutations of values to apply to binary operations.
2613         They also test the operations with 3 permutations of value types:
2614             1. VarVar - both operands variables
2615             2. VarConst - variable operand 1, constant / literal operand 2
2616             3. ConstVar - constant / literal operand 1, variable operand 2
2617
2618         We can prevent these tests from timing out by breaking each up to only run 1 of
2619         the 3 permutations of value types.
2620
2621         * stress/op_div-ConstVar.js: Added.
2622         * stress/op_div-VarConst.js: Added.
2623         * stress/op_div-VarVar.js: Copied from JSTests/stress/op_div.js.
2624         (o1.valueOf): Deleted.
2625         * stress/op_div.js: Removed.
2626         * stress/op_lshift-ConstVar.js: Added.
2627         * stress/op_lshift-VarConst.js: Added.
2628         * stress/op_lshift-VarVar.js: Copied from JSTests/stress/op_lshift.js.
2629         (o1.valueOf): Deleted.
2630         * stress/op_lshift.js: Removed.
2631         * stress/op_mod-ConstVar.js: Added.
2632         * stress/op_mod-VarConst.js: Added.
2633         * stress/op_mod-VarVar.js: Copied from JSTests/stress/op_mod.js.
2634         (o1.valueOf): Deleted.
2635         * stress/op_mod.js: Removed.
2636         * stress/op_mul-ConstVar.js: Added.
2637         * stress/op_mul-VarConst.js: Added.
2638         * stress/op_mul-VarVar.js: Copied from JSTests/stress/op_mul.js.
2639         (o1.valueOf): Deleted.
2640         * stress/op_mul.js: Removed.
2641         * stress/op_rshift-ConstVar.js: Added.
2642         * stress/op_rshift-VarConst.js: Added.
2643         * stress/op_rshift-VarVar.js: Copied from JSTests/stress/op_rshift.js.
2644         (o1.valueOf): Deleted.
2645         * stress/op_rshift.js: Removed.
2646         * stress/op_sub-ConstVar.js: Added.
2647         * stress/op_sub-VarConst.js: Added.
2648         * stress/op_sub-VarVar.js: Copied from JSTests/stress/op_sub.js.
2649         (o1.valueOf): Deleted.
2650         * stress/op_sub.js: Removed.
2651         * stress/op_urshift-ConstVar.js: Added.
2652         * stress/op_urshift-VarConst.js: Added.
2653         * stress/op_urshift-VarVar.js: Copied from JSTests/stress/op_urshift.js.
2654         (o1.valueOf): Deleted.
2655         * stress/op_urshift.js: Removed.
2656         * stress/resources/binary-op-values.js: Added.
2657         (o1.valueOf):
2658
2659 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2660
2661         test262: class and function names should be inferred in assignment
2662         https://bugs.webkit.org/show_bug.cgi?id=146262
2663
2664         Reviewed by Saam Barati.
2665
2666         * stress/arrowfunction-name.js: Added.
2667         Quick tests for arrow function names.
2668
2669         * stress/inferred-names.js: Added.
2670         General test for inferred function names.
2671
2672         * test262.yaml:
2673         Pass many tests checking inferred function names.
2674
2675 2016-09-29  Saam Barati  <sbarati@apple.com>
2676
2677         We don't properly propagate non-simple-parameter-list when parsing a setter
2678         https://bugs.webkit.org/show_bug.cgi?id=160483
2679
2680         Reviewed by Joseph Pecoraro.
2681
2682         * test262.yaml:
2683
2684 2016-09-28  Saam Barati  <sbarati@apple.com>
2685
2686         stringProtoFuncRepeatCharacter will return `null` when it should not
2687         https://bugs.webkit.org/show_bug.cgi?id=161944
2688
2689         Reviewed by Yusuke Suzuki.
2690
2691         * stress/pad-start-calls-repeat-character-with-double.js: Added.
2692         (logLinesWithContext):
2693
2694 2016-09-27  Filip Pizlo  <fpizlo@apple.com>
2695
2696         B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
2697         https://bugs.webkit.org/show_bug.cgi?id=162644
2698
2699         Reviewed by Keith Miller.
2700
2701         * stress/chill-mod-chill-mod.js: Added.
2702         (foo):
2703
2704 2016-09-26  Csaba Osztrogonác  <oszi@inf.u-szeged.hu>
2705
2706         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2707         https://bugs.webkit.org/show_bug.cgi?id=162386
2708
2709         Unreviewed, relanding r206317 after typo fix.
2710
2711         * stress/string-joining-long-strings-should-not-crash.js:
2712
2713 2016-09-24  Caitlin Potter  <caitp@igalia.com>
2714
2715         [JSTests] fix test262 expectations following r206333
2716         https://bugs.webkit.org/show_bug.cgi?id=162533
2717
2718         Reviewed by Yusuke Suzuki.
2719
2720         * test262.yaml:
2721
2722 2016-09-23  Caitlin Potter  <caitp@igalia.com>
2723
2724         [JSC] Implement parsing of Async Functions
2725         https://bugs.webkit.org/show_bug.cgi?id=161409
2726
2727         Reviewed by Yusuke Suzuki.
2728
2729         * stress/async-await-syntax.js: Added.
2730         (testSyntax):
2731         (testSyntaxError):
2732         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2733         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2734         (testTopLevelAsyncAwaitSyntaxStrictMode):
2735         (testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2736         (testNestedAsyncAwaitSyntax.async):
2737         (testNestedAsyncAwaitSyntax.foo):
2738         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2739
2740 2016-09-23  Ryan Haddad  <ryanhaddad@apple.com>
2741
2742         Unreviewed, rolling out r206317.
2743
2744         This change caused timeouts on El Capitan Release JSC tests
2745
2746         Reverted changeset:
2747
2748         "Skip stress/string-joining-long-strings-should-not-crash.js
2749         on memory limited devices"
2750         https://bugs.webkit.org/show_bug.cgi?id=162386
2751         http://trac.webkit.org/changeset/206317
2752
2753 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2754
2755         Skip mozilla-tests.yaml/js1_5/Array/regress-157652 on memory limited devices
2756         https://bugs.webkit.org/show_bug.cgi?id=162381
2757
2758         Reviewed by Mark Lam.
2759
2760         * mozilla/mozilla-tests.yaml:
2761
2762 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2763
2764         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2765         https://bugs.webkit.org/show_bug.cgi?id=162386
2766
2767         Reviewed by Mark Lam.
2768
2769         * stress/string-joining-long-strings-should-not-crash.js:
2770
2771 2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
2772
2773         [JSC] Use an inline cache to generate op_negate
2774         https://bugs.webkit.org/show_bug.cgi?id=162371
2775
2776         Reviewed by Saam Barati.
2777
2778         * stress/op-negate-inline-cache.js: Added.
2779
2780 2016-09-22  Mark Lam  <mark.lam@apple.com>
2781
2782         Array.prototype.join should do overflow checks on string joins.
2783         https://bugs.webkit.org/show_bug.cgi?id=162459
2784
2785         Reviewed by Saam Barati.
2786
2787         * stress/array-join-on-strings-need-overflow-checks.js: Added.
2788         (assert):
2789         (catch):
2790
2791 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
2792
2793         test262: Function length should be number of parameters before parameters with default values
2794         https://bugs.webkit.org/show_bug.cgi?id=162377
2795
2796         Reviewed by Saam Barati.
2797
2798         * stress/es6-default-parameters.js:
2799         Add our own tests for function lengths with default parameters.
2800
2801         * test262.yaml:
2802         We now pass all dflt-length tests.
2803
2804 2016-09-20  Benjamin Poulain  <bpoulain@apple.com>
2805
2806         [JSC] Do not use EagerRun on tests counting recompilation
2807         https://bugs.webkit.org/show_bug.cgi?id=162248
2808
2809         Reviewed by Geoffrey Garen.
2810
2811         This patch adds defaultNoEagerRun to all the tests
2812         for which recompilation is the symptom of a bug.
2813         The reason is that an OSR Exit can be unrelated to the tested
2814         nodes when we are running in Eager mode.
2815
2816         * stress/arith-abs-on-various-types.js:
2817         * stress/arith-ceil-on-various-types.js:
2818         * stress/arith-clz32-on-various-types.js:
2819         * stress/arith-cos-on-various-types.js:
2820         * stress/arith-floor-on-various-types.js:
2821         * stress/arith-fround-on-various-types.js:
2822         * stress/arith-log-on-various-types.js:
2823         * stress/arith-round-on-various-types.js:
2824         * stress/arith-sin-on-various-types.js:
2825         * stress/arith-sqrt-on-various-types.js:
2826         * stress/arith-tan-on-various-types.js:
2827         * stress/arith-trunc-on-various-types.js:
2828
2829         * stress/compare-strict-eq-on-various-types.js:
2830         (testAllTypesCall):
2831         The value 2 came from the other tests.
2832         CompareStrictEq supports many more cases, the worst case
2833         is bool->int->int52->number->polymorphic.
2834
2835 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
2836
2837         Make MarkedBlock state tracking support overlapped allocation and marking state
2838         https://bugs.webkit.org/show_bug.cgi?id=161581
2839
2840         Reviewed by Geoffrey Garen.
2841
2842         Add a microbenchmark for why we want to reclaim empty blocks from other allocators.
2843
2844         * microbenchmarks/switching-size-classes.js: Added.
2845
2846 2016-09-20  Saam Barati  <sbarati@apple.com>
2847
2848         Unreviewed, added test for x86 32-bit failure for HasOwnProperty node in DFG.
2849
2850         * stress/has-own-property-called-on-non-object.js: Added.
2851         (let.objs):
2852         (new.String):
2853         (foo):
2854
2855 2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2856
2857         [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
2858         https://bugs.webkit.org/show_bug.cgi?id=162253
2859
2860         Reviewed by Sam Weinig.
2861
2862         * microbenchmarks/is-symbol-mixed.js: Added.
2863         (isSymbol):
2864         (i.let.pair.of.list.String):
2865         * microbenchmarks/is-symbol.js: Added.
2866         (isSymbol):
2867
2868 2016-09-19  Saam Barati  <sbarati@apple.com>
2869
2870         Make HasOwnProperty faster
2871         https://bugs.webkit.org/show_bug.cgi?id=161708
2872
2873         Reviewed by Geoffrey Garen.
2874
2875         * microbenchmarks/has-own-property-name-cache.js: Added.
2876         (foo):
2877         * stress/has-own-property-cache-basics.js: Added.
2878         (assert):
2879         (foo):
2880         * stress/has-own-property-name-cache-string-keys.js: Added.
2881         (assert):
2882         (foo):
2883         * stress/has-own-property-name-cache-symbol-keys.js: Added.
2884         (assert):
2885         (foo):
2886         * stress/has-own-property-name-cache-symbols-and-strings.js: Added.
2887         (assert):
2888         (foo):
2889
2890 2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
2891
2892         [JSC] Make the rounding-related nodes support any type
2893         https://bugs.webkit.org/show_bug.cgi?id=161895
2894
2895         Reviewed by Geoffrey Garen.
2896
2897         * stress/arith-ceil-on-various-types.js: Added.
2898         * stress/arith-floor-on-various-types.js: Added.
2899         * stress/arith-round-on-various-types.js: Added.
2900         * stress/arith-trunc-on-various-types.js: Added.
2901
2902 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
2903
2904         [JSC] Do not need to use defineProperty to define methods for object literals
2905         https://bugs.webkit.org/show_bug.cgi?id=162111
2906
2907         Reviewed by Saam Barati.
2908
2909         * stress/object-literal-methods.js: Added.
2910         (shouldBe):
2911         (throw.new.Error.let.object.get name):
2912         (throw.new.Error):
2913         (shouldBe.let.object.get name):
2914         (shouldBe.let.object.get prototype):
2915         (shouldBe.let.object.get 42):
2916
2917 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2918
2919         [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
2920         https://bugs.webkit.org/show_bug.cgi?id=162000
2921
2922         Reviewed by Filip Pizlo.
2923
2924         * microbenchmarks/is-array-for-array.js: Added.
2925         (isArray):
2926         * microbenchmarks/is-array-for-mixed-case.js: Added.
2927         (isArray):
2928         * microbenchmarks/is-array-for-non-array-object.js: Added.
2929         (isArray):
2930         * microbenchmarks/is-array-for-proxy.js: Added.
2931         (isArray):
2932         (isArray.proxy.throw.new.Error.isArray):
2933         (isArray.proxy.throw.new.Error):
2934
2935 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2936
2937         Unreviewed, gardening test262 results
2938
2939         Some tests are now passed with JSC, but marked as failed.
2940
2941         * test262.yaml:
2942
2943 2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
2944
2945         test262: Various Constructors length properties should be configurable
2946         https://bugs.webkit.org/show_bug.cgi?id=161998
2947
2948         Reviewed by Saam Barati.
2949
2950         * test262.yaml:
2951
2952 2016-09-15  Commit Queue  <commit-queue@webkit.org>
2953
2954         Unreviewed, rolling out r205931.
2955         https://bugs.webkit.org/show_bug.cgi?id=162021
2956
2957         Tests for this change fail on 32-bit JSC bots (Requested by
2958         ryanhaddad on #webkit).
2959
2960         Reverted changeset:
2961
2962         "[JSC] Make the rounding-related nodes support any type"
2963         https://bugs.webkit.org/show_bug.cgi?id=161895
2964         http://trac.webkit.org/changeset/205931
2965
2966 2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
2967
2968         test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
2969         https://bugs.webkit.org/show_bug.cgi?id=162013
2970
2971         Reviewed by Saam Barati.
2972
2973         * stress/es6-default-parameters.js:
2974         * test262.yaml:
2975
2976 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2977
2978         ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
2979         https://bugs.webkit.org/show_bug.cgi?id=162003
2980
2981         Reviewed by Saam Barati.
2982
2983         * stress/spread-calling.js:
2984         * test262.yaml:
2985
2986 2016-09-14  Michael Saboff  <msaboff@apple.com>
2987
2988         YARR doesn't check for invalid flags for literal regular expressions
2989         https://bugs.webkit.org/show_bug.cgi?id=161995
2990
2991         Reviewed by Mark Lam.
2992
2993         New test.
2994
2995         * stress/regress-161995.js: Added.
2996         (testStatic):
2997         (catch):
2998
2999 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3000
3001         test262: TypedArray constructors length should be 3 and configurable
3002         https://bugs.webkit.org/show_bug.cgi?id=161955
3003
3004         Reviewed by Mark Lam.
3005
3006         * test262.yaml:
3007
3008 2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
3009
3010         [JSC] Make the rounding-related nodes support any type
3011         https://bugs.webkit.org/show_bug.cgi?id=161895
3012
3013         Reviewed by Geoffrey Garen.
3014
3015         * stress/arith-ceil-on-various-types.js: Added.
3016         * stress/arith-floor-on-various-types.js: Added.
3017         * stress/arith-round-on-various-types.js: Added.
3018         * stress/arith-trunc-on-various-types.js: Added.
3019
3020 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3021
3022         TaggedTemplateString function calls should emit tail position calls
3023         https://bugs.webkit.org/show_bug.cgi?id=161948
3024
3025         Reviewed by Yusuke Suzuki.
3026
3027         * stress/tail-call-recognize.js:
3028         (runTests):
3029         Ensure a tagged template string function call is tail call.
3030
3031         * test262.yaml:
3032         These now pass.
3033
3034 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3035
3036         test262: Array.prototype.slice should always set length
3037         https://bugs.webkit.org/show_bug.cgi?id=161953
3038
3039         Reviewed by Mark Lam.
3040
3041         * test262.yaml:
3042
3043 2016-09-13  JF Bastien  <jfbastien@apple.com>
3044
3045         Support jsc shell builtin `read`
3046         https://bugs.webkit.org/show_bug.cgi?id=161662
3047
3048         Reviewed by Keith Miller.
3049
3050         * stress/jsc-read.js: Added.
3051         (test): test `read` and `readFile` shell builtins, in string and binary mode.
3052
3053 2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
3054
3055         ES6: Classes: Should be allowed to create a static method with name "arguments"
3056         https://bugs.webkit.org/show_bug.cgi?id=152985
3057
3058         Reviewed by Keith Miller.
3059
3060         * test262.yaml:
3061
3062 2016-09-12  Saam Barati  <sbarati@apple.com>
3063
3064         Speed up Function.prototype.bind a bit by making it a builtin
3065         https://bugs.webkit.org/show_bug.cgi?id=161879
3066
3067         Reviewed by Filip Pizlo.
3068
3069         * microbenchmarks/function-bind-inlining.js: Added.
3070         (assert):
3071         (test):
3072         (test2):
3073         (foo):
3074         * microbenchmarks/function-bind-no-inlining.js: Added.
3075         (assert):
3076         (test):
3077         (test2):
3078         (foo):
3079
3080 2016-09-12  Saam Barati  <sbarati@apple.com>
3081
3082         HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
3083         https://bugs.webkit.org/show_bug.cgi?id=161640
3084
3085         Reviewed by Geoffrey Garen.
3086
3087         * microbenchmarks/map-rehash.js: Added.
3088         * stress/map-delete.js: Added.
3089         (assert):
3090         * stress/map-rehash-2.js: Added.
3091         (assert):
3092         * stress/map-rehash.js: Added.
3093         (assert):
3094
3095 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3096
3097         Unreviewed, fix tests for different libm environments
3098         https://bugs.webkit.org/show_bug.cgi?id=161857
3099
3100         * stress/ftl-arithtan.js:
3101
3102 2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
3103
3104         [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
3105         https://bugs.webkit.org/show_bug.cgi?id=161671
3106
3107         Reviewed by Geoffrey Garen.
3108
3109         * stress/get-array-length-on-undecided.js: Added.
3110
3111 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3112
3113         [DFG][FTL] Add ArithTan
3114         https://bugs.webkit.org/show_bug.cgi?id=161857
3115
3116         Reviewed by Filip Pizlo.
3117
3118         * microbenchmarks/tan.js: Added.
3119         * stress/arith-tan-on-various-types.js: Added.
3120         (let.validInputTypedTestCases.validInputTestCases.map):
3121         (isIdentical):
3122         (opaqueTanNoArgument):
3123         (testNoArgument):
3124         (opaqueAllTypesTan):
3125         (testAllTypesCall):
3126         (testTangleTypeCall):
3127         (testConstant):
3128         (opaqueTanForSideEffects):
3129         (testSideEffect.let.testObject.valueOf):
3130         (testSideEffect):
3131         (opaqueTanForCSE):
3132         (testCSE.let.testObject.valueOf):
3133         (testCSE):
3134         (opaqueTanForDCE):
3135         (testDCE.let.testObject.valueOf):
3136         (testDCE):
3137         (testException.opaqueTanWithException):
3138         (testException):
3139         * stress/ftl-arithtan.js: Added.
3140         (foo):
3141
3142 2016-09-12  Saam Barati  <sbarati@apple.com>
3143
3144         MapHash should do constant folding when it has a constant argument and its legal to hash that value
3145         https://bugs.webkit.org/show_bug.cgi?id=161639
3146
3147         Reviewed by Filip Pizlo.
3148
3149         * microbenchmarks/map-constant-key.js: Added.
3150         (assert):
3151         (test):
3152         (foo):
3153
3154 2016-09-12  Michael Saboff  <msaboff@apple.com>
3155
3156         JSC test timeout: ChakraCore.yaml/ChakraCore/test/Bugs/bug56026_trycatch.js.default
3157         https://bugs.webkit.org/show_bug.cgi?id=161863
3158
3159         Reviewed by Saam Barati.
3160
3161         * ChakraCore.yaml:
3162         Disabled Bugs/bug56026_trycatch.js.
3163
3164 2016-09-09  Michael Saboff  <msaboff@apple.com>
3165
3166         Unreviewed, rolling r205759 back in with a fix.
3167
3168         The expectation file, JSTests/ChakraCore/test/Lib/tostring.baseline-jsc,
3169         should be named "toString.baseline-jsc".
3170
3171         * ChakraCore/test/Lib/toString.baseline-jsc: Copied from JSTests/ChakraCore/test/Lib/tostring.baseline-jsc.
3172         * ChakraCore/test/Lib/tostring.baseline-jsc: Removed.
3173
3174 2016-09-09  Michael Saboff  <msaboff@apple.com>
3175
3176         Disable three flakey Chakra Tests
3177         https://bugs.webkit.org/show_bug.cgi?id=161807
3178
3179         Reviewed by Saam Barati.
3180
3181         * ChakraCore.yaml: Disabled the flakey tests
3182         ChakraCore/test/Array/protoLookup_native.js
3183         ChakraCore/test/LetConst/delete.js
3184         ChakraCore/test/fieldopts/fieldhoist_sideeffect.js
3185
3186 2016-09-08  Saam Barati  <sbarati@apple.com>
3187
3188         We should inline operationConvertJSValueToBoolean into JIT code
3189         https://bugs.webkit.org/show_bug.cgi?id=161729
3190
3191         Reviewed by Filip Pizlo.
3192
3193         * stress/value-to-boolean.js: Added.
3194         (assert):
3195         (test1):
3196         (test2):
3197         (test3):
3198
3199 2016-09-08  Mark Lam  <mark.lam@apple.com>
3200
3201         REGRESSION (r205569?): 32-bit JSC test timeout: stress/rest-parameter-many-arguments.js.dfg-maximal-flush-validate-no-cjit
3202         https://bugs.webkit.org/show_bug.cgi?id=161756
3203
3204         Reviewed by Saam Barati.
3205
3206         It looks like the 32-bit JSC bot is just too slow at running this test with the
3207         dfg-maximal-flush-validate-no-cjit configuration.  We'll try excluding that
3208         configuration.
3209
3210         * stress/rest-parameter-many-arguments.js:
3211
3212 2016-09-08  JF Bastien  <jfbastien@apple.com>
3213
3214         Delete older WebAssembly tests
3215         https://bugs.webkit.org/show_bug.cgi?id=161758
3216
3217         Reviewed by Filip Pizlo.
3218
3219         They're not running, rely on the older polyfill prototype, and the older code was deleted in: https://trac.webkit.org/changeset/204180
3220
3221         * stress/wasm-arithmetic-float32.js: Removed.
3222         * stress/wasm-arithmetic-float64.js: Removed.
3223         * stress/wasm-arithmetic-int32.js: Removed.
3224         * stress/wasm-calls.js: Removed.
3225         * stress/wasm-comma.js: Removed.
3226         * stress/wasm-control-flow.js: Removed.
3227         * stress/wasm-globals.js: Removed.
3228         * stress/wasm-linear-memory.js: Removed.
3229         * stress/wasm-locals.js: Removed.
3230         * stress/wasm-relational.js: Removed.
3231         * stress/wasm-type-conversion.js: Removed.
3232         * stress/wasm/arithmetic-float32.wasm: Removed.
3233         * stress/wasm/arithmetic-float64.wasm: Removed.
3234         * stress/wasm/arithmetic-int32.wasm: Removed.
3235         * stress/wasm/calls.wasm: Removed.
3236         * stress/wasm/comma.wasm: Removed.
3237         * stress/wasm/control-flow.wasm: Removed.
3238         * stress/wasm/globals.wasm: Removed.
3239         * stress/wasm/linear-memory.wasm: Removed.
3240         * stress/wasm/locals.wasm: Removed.
3241         * stress/wasm/relational.wasm: Removed.
3242         * stress/wasm/type-conversion.wasm: Removed.
3243
3244 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
3245
3246         [Win] Exception fuzz tests fail
3247         https://bugs.webkit.org/show_bug.cgi?id=140928
3248
3249         Reviewed by Mark Lam.
3250
3251         Unskip tests.
3252
3253         * exceptionFuzz.yaml:
3254
3255 2016-09-06  Saam Barati  <sbarati@apple.com>
3256
3257         ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
3258         https://bugs.webkit.org/show_bug.cgi?id=161558
3259
3260         Reviewed by Benjamin Poulain.
3261
3262         * stress/proxy-get-prototype-of.js:
3263         * stress/proxy-set-prototype-of.js:
3264         (let.handler.setPrototypeOf): Deleted.
3265         * stress/proxy-underscore-proto.js: Added.
3266         (assert):
3267
3268 2016-09-06  Saam Barati  <sbarati@apple.com>
3269
3270         Make JSMap and JSSet faster
3271         https://bugs.webkit.org/show_bug.cgi?id=160989
3272
3273         Reviewed by Filip Pizlo.
3274
3275         * microbenchmarks/dense-set.js: Added.
3276         (bench):
3277         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3278         (bar):
3279         (foo):
3280         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3281         (bar):
3282         (foo):
3283         * microbenchmarks/large-map-iteration.js: Added.
3284         (bar):
3285         (foo):
3286         * microbenchmarks/map-get-get-cse.js: Added.
3287         (bar):
3288         (foo):
3289         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3290         (bar):
3291         (foo):
3292         * microbenchmarks/sparse-set.js: Added.
3293         (bench):
3294         * stress/map-cse-correctness.js: Added.
3295         (assert):
3296         (testHas):
3297         (testGet):
3298         (foo):
3299         * stress/map-iteration.js: Added.
3300         (assert):
3301         (test1):
3302         (test2):
3303         (test3):
3304         (test4):
3305         (test5):
3306         (test6):
3307         (test7):
3308         (test8):
3309         (test9):
3310         (test10):
3311         (test11):
3312         (test12):
3313         (test13):
3314         (test14):
3315         (test15):
3316         (test16):
3317         (test17):
3318         (test18):
3319
3320 2016-09-06  Benjamin Poulain  <bpoulain@apple.com>
3321
3322         [JSC] Make ArithClz32 work with Cell arguments
3323         https://bugs.webkit.org/show_bug.cgi?id=161369
3324
3325         Reviewed by Geoffrey Garen.
3326
3327         * stress/arith-clz32-on-various-types.js: Added.
3328
3329 2016-09-06  Commit Queue  <commit-queue@webkit.org>
3330
3331         Unreviewed, rolling out r205504.
3332         https://bugs.webkit.org/show_bug.cgi?id=161645
3333
3334         Broke the iOS device build (Requested by ryanhaddad on
3335         #webkit).
3336
3337         Reverted changeset:
3338
3339         "Make JSMap and JSSet faster"
3340         https://bugs.webkit.org/show_bug.cgi?id=160989
3341         http://trac.webkit.org/changeset/205504
3342
3343 2016-09-06  Saam Barati  <sbarati@apple.com>
3344
3345         Make JSMap and JSSet faster
3346         https://bugs.webkit.org/show_bug.cgi?id=160989
3347
3348         Reviewed by Filip Pizlo.
3349
3350         * microbenchmarks/dense-set.js: Added.
3351         (bench):
3352         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3353         (bar):
3354         (foo):
3355         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3356         (bar):
3357         (foo):
3358         * microbenchmarks/large-map-iteration.js: Added.
3359         (bar):
3360         (foo):
3361         * microbenchmarks/map-get-get-cse.js: Added.
3362         (bar):
3363         (foo):
3364         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3365         (bar):
3366         (foo):
3367         * microbenchmarks/sparse-set.js: Added.
3368         (bench):
3369         * stress/map-cse-correctness.js: Added.
3370         (assert):
3371         (testHas):
3372         (testGet):
3373         (foo):
3374         * stress/map-iteration.js: Added.
3375         (assert):
3376         (test1):
3377         (test2):
3378         (test3):
3379         (test4):
3380         (test5):
3381         (test6):
3382         (test7):
3383         (test8):
3384         (test9):
3385         (test10):
3386         (test11):
3387         (test12):
3388         (test13):
3389         (test14):
3390         (test15):
3391         (test16):
3392         (test17):
3393         (test18):
3394
3395 2016-08-31  Filip Pizlo  <fpizlo@apple.com>
3396
3397         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3398         https://bugs.webkit.org/show_bug.cgi?id=160125
3399
3400         Reviewed by Geoffrey Garen and Keith Miller.
3401
3402         Most of the things I did properly covered by existing tests, but I found some simple cases of
3403         unshifting that had sketchy coverage.
3404
3405         * stress/array-storage-array-unshift.js: Added.
3406         * stress/contiguous-array-unshift.js: Added.
3407         * stress/double-array-unshift.js: Added.
3408         * stress/int32-array-unshift.js: Added.
3409
3410 2016-09-02  Michael Saboff  <msaboff@apple.com>
3411
3412         Unreviewed fix after importing Chakra test
3413
3414         * ChakraCore.yaml: Skipped ChakraCore/test/UnifiedRegex/crazy.js because the original
3415         test contained tab characters.  I removed the tabs before landing.  This test depended
3416         on the tab characters and now fails after they were removed.
3417         test.
3418
3419 2016-09-01  Michael Saboff  <msaboff@apple.com>
3420
3421         Import Chakra tests to JSC
3422         https://bugs.webkit.org/show_bug.cgi?id=154697
3423
3424         Reviewed by Saam Barati.
3425
3426         Added Chakra tests.  All these tests are under Chakra/test.  This is the same layout
3427         for tests in the Chakra tree.
3428
3429         Created a ChakraCore.yaml file to be used with run-jsc-stress-tests.  This file contains
3430         the tests that are run when the original Chakra runtests.py script is run.  That script
3431         is the test driver for *nix platforms and does not attempt to run all tests or all
3432         variations of tests.  The runtest.py driver consults rlexe.xml files in each test
3433         subdirectory to determine the test to run, the options to pass to the test and how to
3434         determine pass/fail of the test.  With runtests.py as the start, tests that didn't
3435         pass directly where either skipped, with a message describing why or through
3436         adjustments to the test infrastructure, as described below, where made to pass.
3437
3438         The only modification to the test infrastrucutre are:
3439
3440          1) Added simple mapping of Chakra expected exception text to JSC expected text in
3441             test/UnitTestFramework/UnitTestFramework.js.  It would make sense to also
3442             map some JSC specific exception text to more generic text for the cases where
3443             that text contains indetifier names or other source specific strings and the
3444             Chakra equivolent exception texts are generic.
3445
3446          2) Created JSC specific expected text files where it is clear that the text work
3447             as expected on JSC but the test output is different.  Typically the differences
3448             fall into three categories, different exception output, different output from
3449             toString() of a function, slight numeric differences, and test that rely on
3450             iteration order.
3451
3452          3) Stripped the CR's from the CR-LF line terminations of the files.
3453
3454         No actual test .js files were modified.
3455
3456         * ChakraCore: Added.
3457         * ChakraCore.yaml: Added.
3458         * ChakraCore/CONTRIBUTING.md: Added.
3459         * ChakraCore/LICENSE.txt: Added.
3460         * ChakraCore/README.md: Added.
3461         * ChakraCore/THIRD-PARTY-NOTICES.txt: Added.
3462         * ChakraCore/test: Added this directory and the tests included therein.
3463
3464 2016-09-01  JF Bastien  <jfbastien@apple.com>
3465
3466         GetByIdWithThis/GetByValWithThis should have ValueProfiles so that they can predict their result types
3467         https://bugs.webkit.org/show_bug.cgi?id=160922
3468
3469         Reviewed by Keith Miller.
3470
3471         Benchmark GetBy{Id,Val}WithThis in monomorphic and polymorphic uses.
3472         The value profile is used by the calc functions, which do some mild math with the result.
3473         These benchmarks get ~4% faster with value profiling.
3474
3475         * microbenchmarks/super-get-by-id-with-this-monomorphic.js: Added.
3476         (A):
3477         (A.prototype.set value):
3478         (A.prototype.get value):
3479         (B.prototype.set value):
3480         (B.prototype.get value):
3481         (B):
3482         (const.bench):
3483         * microbenchmarks/super-get-by-id-with-this-polymorphic.js: Added.
3484         (A):
3485         (A.prototype.set value):
3486         (A.prototype.get value):
3487         (B.prototype.set value):
3488         (B.prototype.get value):
3489         (B):
3490         (const.bench):
3491         * microbenchmarks/super-get-by-val-with-this-monomorphic.js: Added.
3492         (value):
3493         (A):
3494         (A.prototype.set v):
3495         (A.prototype.get v):
3496         (B.prototype.set v):
3497         (B.prototype.get v):
3498         (B):
3499         (const.bench):
3500         * microbenchmarks/super-get-by-val-with-this-polymorphic.js: Added.
3501         (value):
3502         (A):
3503         (A.prototype.set v):
3504         (A.prototype.get v):
3505         (B.prototype.set v):
3506         (B.prototype.get v):
3507         (B):
3508         (const.bench):
3509
3510 2016-09-01  Benjamin Poulain  <bpoulain@apple.com>
3511
3512         arith-abs-on-various-types.js is flaky
3513
3514         Unreviewed.
3515
3516         * stress/arith-abs-on-various-types.js:
3517         Two compilation is too small for the worst case.
3518         Math.abs() can be typed integer->number->untyped if we are very unlucky.
3519
3520 2016-09-01  Filip Pizlo  <fpizlo@apple.com>
3521
3522         ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases
3523         https://bugs.webkit.org/show_bug.cgi?id=161492
3524
3525         Reviewed by Mark Lam.
3526
3527         This bug affected function->activation references but not object->object field references,
3528         because object->object field references are !neededForMaterialization(). So, the object
3529         test always passed but the activation/function test used to always fail. It passes now.
3530
3531         * stress/materialize-activation-referenced-from-phantom-function.js: Added.
3532         (bar):
3533         (inc):
3534         (dec):
3535         (foo):
3536         (test):
3537         * stress/materialize-object-referenced-from-phantom-object.js: Added.
3538         (bar):
3539         (foo):
3540         (test):
3541
3542 2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3543
3544         stress/random-53bit.js.ftl-no-cjit-no-inline-validate sometimes fails
3545         https://bugs.webkit.org/show_bug.cgi?id=161436
3546
3547         Reviewed by Filip Pizlo.
3548
3549         The test checks Math.random() correctly produces 53bit random values.
3550         The test can fail by design, but this should be fairly rare.
3551
3552         However, when introducing, we wrap the `test()` with 1e4 to ensure the FTL compilation, and this
3553         increases the failure rate. By increasing the MAX in the test, we make the failures much more rare case.
3554
3555         And we also add getRandomSeed() and setRandomSeed(seed) JSC shell helpers to dump more useful information
3556         and reproduce the situation easily.
3557
3558         * stress/random-53bit.js:
3559         (test):
3560
3561 2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
3562
3563         [JSC] Improve ArithAbs with polymorphic input
3564         https://bugs.webkit.org/show_bug.cgi?id=161286
3565
3566         Reviewed by Saam Barati.
3567
3568         * stress/arith-abs-on-various-types.js: Added.
3569         New tests.
3570
3571         * stress/arith-cos-on-various-types.js:
3572         * stress/arith-fround-on-various-types.js:
3573         * stress/arith-log-on-various-types.js:
3574         * stress/arith-sin-on-various-types.js:
3575         * stress/arith-sqrt-on-various-types.js:
3576         Extend the existing tests to cover the DCE case.
3577
3578 2016-08-26  Benjamin Poulain  <benjamin@webkit.org>
3579
3580         [JSC] Implement CompareStrictEq(String, Untyped) in FTL
3581         https://bugs.webkit.org/show_bug.cgi?id=161229
3582
3583         Reviewed by Geoffrey Garen.
3584
3585         * stress/compare-strict-eq-on-various-types.js: Added.
3586
3587 2016-08-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3588
3589         [ES6] newPromiseCapabilities should check the given argument is constructor
3590         https://bugs.webkit.org/show_bug.cgi?id=161226
3591
3592         Reviewed by Mark Lam.
3593
3594         The arrow function should not be a constructor. So the error should be raised.
3595
3596         * stress/new-promise-capabilities-requires-constructor.js: Added.
3597         (shouldThrow):
3598
3599 2016-08-25  Benjamin Poulain  <bpoulain@apple.com>
3600
3601         [JSC] Clean up the abstract interpreter for cos/sin/sqrt/fround/log
3602         https://bugs.webkit.org/show_bug.cgi?id=161181
3603
3604         Reviewed by Geoffrey Garen.
3605
3606         Extend the tests to constants.
3607         Add no-argument cases where needed.
3608
3609         * stress/arith-cos-on-various-types.js:
3610         * stress/arith-fround-on-various-types.js:
3611         * stress/arith-log-on-various-types.js:
3612         * stress/arith-sin-on-various-types.js:
3613         * stress/arith-sqrt-on-various-types.js:
3614
3615 2016-08-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3616
3617         [DFG][FTL] Implement ES6 Generators in DFG / FTL
3618         https://bugs.webkit.org/show_bug.cgi?id=152723
3619
3620         Reviewed by Filip Pizlo.
3621
3622         * stress/generator-fib-ftl-and-array.js: Added.
3623         (fib):
3624         * stress/generator-fib-ftl-and-object.js: Added.
3625         (fib):
3626         * stress/generator-fib-ftl-and-string.js: Added.
3627         (fib):
3628         * stress/generator-fib-ftl.js: Added.
3629         (fib):
3630         * stress/generator-frame-empty.js: Added.
3631         (shouldThrow):
3632         (shouldThrow.fib):
3633         * stress/generator-reduced-save-point-put-to-scope.js: Added.
3634         (shouldBe):
3635         (gen):
3636         * stress/generator-transfer-register-beyond-mutiple-yields.js: Added.
3637         (shouldBe):
3638         (gen):
3639
3640 2016-08-25  JF Bastien  <jfbastien@apple.com>
3641
3642         TryGetById should have a ValueProfile so that it can predict its output type
3643         https://bugs.webkit.org/show_bug.cgi?id=160921
3644
3645         Reviewed by Saam Barati.
3646
3647         * microbenchmarks/try-get-by-id-basic.js: Added.
3648         (const.check):
3649         (const.bench.f.const.fooPlusBar.createBuiltin):
3650         * microbenchmarks/try-get-by-id-polymorphic.js: Added.
3651         (const.check):
3652         (fooPlusBar.createBuiltin):
3653         (bench):
3654
3655 2016-08-25  Caio Lima  <ticaiolima@gmail.com>
3656
3657         NewRegexp should not prevent inlining
3658         https://bugs.webkit.org/show_bug.cgi?id=154808
3659
3660         Reviewed by Geoffrey Garen.
3661
3662         Added test where functions with NewRegExp can be inlined right now.
3663
3664         * stress/new-regex-inline.js: Added.
3665         (assert):
3666         (testRegexpInline):
3667         (toInlineGlobal):
3668         (withRegexp):
3669         (inlineRegexpNotGlobal):
3670         (toInlineRecursive):
3671         (regexpContainsRecursive):
3672
3673 2016-08-24  Benjamin Poulain  <benjamin@webkit.org>
3674
3675         [JSC] Make FRound work with any type
3676         https://bugs.webkit.org/show_bug.cgi?id=161129
3677
3678         Reviewed by Geoffrey Garen.
3679
3680         * stress/arith-fround-on-various-types.js: Added.
3681
3682 2016-08-24  Filip Pizlo  <fpizlo@apple.com>
3683
3684         Unreviewed, roll out r204901, r204897, r204866, r204856, r204854.
3685
3686         * stress/array-storage-array-unshift.js: Removed.
3687         * stress/contiguous-array-unshift.js: Removed.
3688         * stress/double-array-unshift.js: Removed.
3689         * stress/int32-array-unshift.js: Removed.
3690
3691 2016-08-24  Skachkov Oleksandr  <gskachkov@gmail.com>
3692
3693         [ES2016] Allow assignment in for-in head in not-strict mode
3694         https://bugs.webkit.org/show_bug.cgi?id=160955
3695
3696         Reviewed by Saam Barati.
3697
3698         * stress/for-in-tests.js:
3699         (foo):
3700         (boo):
3701         (catch):
3702
3703 2016-08-23  Benjamin Poulain  <benjamin@webkit.org>
3704
3705         [JSC] Make ArithLog works with any type
3706         https://bugs.webkit.org/show_bug.cgi?id=161110
3707
3708         Reviewed by Geoffrey Garen.
3709
3710         * stress/arith-log-on-various-types.js: Added.
3711
3712 2016-08-23  Saam Barati  <sbarati@apple.com>
3713
3714         JSC should have a "microbenchmarks" directory instead of "regress" directory
3715         https://bugs.webkit.org/show_bug.cgi?id=161096
3716