[BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt...
[WebKit-https.git] / JSTests / ChangeLog
1 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
2
3         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
4         https://bugs.webkit.org/show_bug.cgi?id=190836
5
6         Reviewed by Saam Barati.
7
8         * stress/big-int-out-of-memory-tests.js: Added.
9
10 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
11
12         U+180E is no longer a whitespace character
13         https://bugs.webkit.org/show_bug.cgi?id=191415
14
15         Reviewed by Saam Barati.
16
17         * ChakraCore/test/es5/regexSpace.baseline:
18         * ChakraCore/test/es6/unicode_whitespace.js:
19         Update tests to latest version.
20         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
21
22         * test262.yaml:
23         * test262/config.yaml:
24         * test262/expectations.yaml:
25         Update expectations.
26
27 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
28
29         [BigInt] Add support to BigInt into ValueAdd
30         https://bugs.webkit.org/show_bug.cgi?id=186177
31
32         Reviewed by Keith Miller.
33
34         * stress/big-int-negate-jit.js:
35         * stress/value-add-big-int-and-string.js: Added.
36         * stress/value-add-big-int-prediction-propagation.js: Added.
37         * stress/value-add-big-int-untyped.js: Added.
38
39 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
40
41         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
42         https://bugs.webkit.org/show_bug.cgi?id=191184
43
44         Reviewed by Saam Barati.
45
46         Most tests were failing due to timeouts, since they are too slow to
47         run on CLoop. The exceptions are:
48
49         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
50         dont-crash-on-stack-overflow-when-parsing-builtin.js and
51         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
52         to change the stack size since CLoop requires it to be page aligned.
53
54         * microbenchmarks/array-push-1.js:
55         * microbenchmarks/array-push-2.js:
56         * microbenchmarks/elidable-new-object-dag.js:
57         * microbenchmarks/elidable-new-object-roflcopter.js:
58         * microbenchmarks/elidable-new-object-tree.js:
59         * microbenchmarks/getter-richards.js:
60         * microbenchmarks/sinkable-new-object-dag.js:
61         * microbenchmarks/string-concat-long-convert.js:
62         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
63         * slowMicrobenchmarks/array-push-3.js:
64         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
65         * slowMicrobenchmarks/spread-small-array.js:
66         * slowMicrobenchmarks/undefined-property-access.js:
67         * stress/activation-sink-default-value-tdz-error.js:
68         * stress/activation-sink-default-value.js:
69         * stress/activation-sink-osrexit-default-value-tdz-error.js:
70         * stress/activation-sink-osrexit-default-value.js:
71         * stress/activation-sink-osrexit.js:
72         * stress/activation-sink.js:
73         * stress/allow-math-ic-b3-code-duplication.js:
74         * stress/array-push-multiple-int32.js:
75         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
76         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
77         * stress/arrowfunction-lexical-this-activation-sink.js:
78         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
79         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
80         * stress/elide-new-object-dag-then-exit.js:
81         * stress/materialize-regexp-cyclic.js:
82         * stress/new-regex-inline.js:
83         * stress/op_add.js:
84         * stress/op_bitand.js:
85         * stress/op_bitor.js:
86         * stress/op_bitxor.js:
87         * stress/op_div-ConstVar.js:
88         * stress/op_div-VarConst.js:
89         * stress/op_div-VarVar.js:
90         * stress/op_lshift-ConstVar.js:
91         * stress/op_lshift-VarConst.js:
92         * stress/op_lshift-VarVar.js:
93         * stress/op_mod-ConstVar.js:
94         * stress/op_mod-VarConst.js:
95         * stress/op_mod-VarVar.js:
96         * stress/op_mul-ConstVar.js:
97         * stress/op_mul-VarConst.js:
98         * stress/op_mul-VarVar.js:
99         * stress/op_rshift-ConstVar.js:
100         * stress/op_rshift-VarConst.js:
101         * stress/op_rshift-VarVar.js:
102         * stress/op_sub-ConstVar.js:
103         * stress/op_sub-VarConst.js:
104         * stress/op_sub-VarVar.js:
105         * stress/op_urshift-ConstVar.js:
106         * stress/op_urshift-VarConst.js:
107         * stress/op_urshift-VarVar.js:
108         * stress/proxy-get-set-correct-receiver.js:
109         * stress/regress-179562.js:
110         * stress/rest-parameter-many-arguments.js:
111         * stress/sampling-profiler-richards.js:
112         * stress/splay-flash-access-1ms.js:
113         * stress/tailCallForwardArguments.js:
114         * stress/typed-array-get-by-val-profiling.js:
115         * typeProfiler/getter-richards.js:
116
117 2018-11-06  Michael Saboff  <msaboff@apple.com>
118
119         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
120         https://bugs.webkit.org/show_bug.cgi?id=191271
121
122         Reviewed by Saam Barati.
123
124         Added more test cases and made all test cases run with the same deeply recursive stack
125         instead of finding that same point for each test case.
126
127         * stress/regexp-compile-oom.js:
128         (prototype.runTest):
129         (recurseAndTest):
130         (testList.push.new.TestAndExpectedException):
131
132 2018-11-05  Michael Saboff  <msaboff@apple.com>
133
134         Unreviewed build fix for linux.
135
136         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
137
138 2018-11-02  Michael Saboff  <msaboff@apple.com>
139
140         Rolling in r237753 with unreviewed build fix.
141
142         Fixed issues with DECLARE_THROW_SCOPE placement.
143
144 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
145
146         Unreviewed, rolling out r237753.
147
148         Introduced JSC test failures
149
150         Reverted changeset:
151
152         "Running out of stack space not properly handled in
153         RegExp::compile() and its callers"
154         https://bugs.webkit.org/show_bug.cgi?id=191206
155         https://trac.webkit.org/changeset/237753
156
157 2018-11-02  Michael Saboff  <msaboff@apple.com>
158
159         Running out of stack space not properly handled in RegExp::compile() and its callers
160         https://bugs.webkit.org/show_bug.cgi?id=191206
161
162         Reviewed by Filip Pizlo.
163
164         New regression test.
165
166         * stress/regexp-compile-oom.js: Added.
167         (recurseAndTest):
168
169 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
170
171         Skip tests on arm/mips that time out now we're running on CLoop
172
173         Unreviewed gardening.
174
175         Since the JIT is temporarily disabled on 32-bit platforms, these tests
176         time out on the bots and need to be disabled. There's more tests
177         disabled on arm because the timeout is longer on the mips bot (as the
178         device is slower to start with), so many of the tests don't time out
179         there.
180
181         * microbenchmarks/getter-richards.js: disable on arm and mips.
182         * stress/op_add.js: disable on arm.
183         * stress/op_bitand.js: disable on arm.
184         * stress/op_bitor.js: disable on arm.
185         * stress/op_bitxor.js: disable on arm.
186         * stress/op_lshift-ConstVar.js: disable on arm.
187         * stress/op_lshift-VarConst.js: disable on arm.
188         * stress/op_lshift-VarVar.js: disable on arm.
189         * stress/op_mod-ConstVar.js: disable on arm.
190         * stress/op_mod-VarConst.js: disable on arm.
191         * stress/op_mod-VarVar.js: disable on arm.
192         * stress/op_mul-ConstVar.js: disable on arm.
193         * stress/op_mul-VarConst.js: disable on arm.
194         * stress/op_mul-VarVar.js: disable on arm.
195         * stress/op_rshift-ConstVar.js: disable on arm.
196         * stress/op_rshift-VarConst.js: disable on arm.
197         * stress/op_rshift-VarVar.js: disable on arm.
198         * stress/op_sub-ConstVar.js: disable on arm.
199         * stress/op_sub-VarConst.js: disable on arm.
200         * stress/op_sub-VarVar.js: disable on arm.
201         * stress/op_urshift-ConstVar.js: disable on arm.
202         * stress/op_urshift-VarConst.js: disable on arm.
203         * stress/op_urshift-VarVar.js: disable on arm.
204         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
205         * stress/value-to-boolean.js: disable on arm and mips.
206
207 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
208
209         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
210         https://bugs.webkit.org/show_bug.cgi?id=191108
211         <rdar://problem/45690700>
212
213         Reviewed by Saam Barati.
214
215         * stress/wide-op_catch.js: Added.
216         (catch):
217
218 2018-10-29  Mark Lam  <mark.lam@apple.com>
219
220         Correctly detect string overflow when using the 'Function' constructor.
221         https://bugs.webkit.org/show_bug.cgi?id=184883
222         <rdar://problem/36320331>
223
224         Reviewed by Saam Barati.
225
226         I've verified that this passes on 32-bit as well.
227
228         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
229
230 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
231
232         Add support for GetStack FlushedDouble
233         https://bugs.webkit.org/show_bug.cgi?id=191012
234         <rdar://problem/45265141>
235
236         Reviewed by Saam Barati.
237
238         * stress/get-stack-double.js: Added.
239         (bar):
240         (noInline):
241
242 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
243
244         New bytecode format for JSC
245         https://bugs.webkit.org/show_bug.cgi?id=187373
246         <rdar://problem/44186758>
247
248         Reviewed by Filip Pizlo.
249
250         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
251
252         * stress/maximum-inline-capacity.js: Added.
253         (test1):
254         (test3.Foo):
255         (test3):
256
257 2018-10-26  Commit Queue  <commit-queue@webkit.org>
258
259         Unreviewed, rolling out r237479 and r237484.
260         https://bugs.webkit.org/show_bug.cgi?id=190978
261
262         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
263
264         Reverted changesets:
265
266         "New bytecode format for JSC"
267         https://bugs.webkit.org/show_bug.cgi?id=187373
268         https://trac.webkit.org/changeset/237479
269
270         "Gardening: Build fix after r237479."
271         https://bugs.webkit.org/show_bug.cgi?id=187373
272         https://trac.webkit.org/changeset/237484
273
274 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
275
276         New bytecode format for JSC
277         https://bugs.webkit.org/show_bug.cgi?id=187373
278         <rdar://problem/44186758>
279
280         Reviewed by Filip Pizlo.
281
282         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
283
284         * stress/maximum-inline-capacity.js: Added.
285         (test1):
286         (test3.Foo):
287         (test3):
288
289 2018-10-26  Mark Lam  <mark.lam@apple.com>
290
291         Fix missing edge cases with JSGlobalObjects having a bad time.
292         https://bugs.webkit.org/show_bug.cgi?id=189028
293         <rdar://problem/45204939>
294
295         Reviewed by Saam Barati.
296
297         * stress/regress-189028.js: Added.
298
299 2018-10-22  Mark Lam  <mark.lam@apple.com>
300
301         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
302         https://bugs.webkit.org/show_bug.cgi?id=190515
303         <rdar://problem/45222379>
304
305         Rubber-stamped by Saam Barati.
306
307         Adding another test.
308
309         * stress/regress-190515-2.js: Added.
310
311 2018-10-22  Mark Lam  <mark.lam@apple.com>
312
313         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
314         https://bugs.webkit.org/show_bug.cgi?id=190515
315         <rdar://problem/45222379>
316
317         Reviewed by Saam Barati.
318
319         * stress/regress-190515.js: Added.
320
321 2018-10-19  Commit Queue  <commit-queue@webkit.org>
322
323         Unreviewed, rolling out r237254.
324         https://bugs.webkit.org/show_bug.cgi?id=190760
325
326         "It regresses JetStream 2 by 5% on some iOS devices"
327         (Requested by saamyjoon on #webkit).
328
329         Reverted changeset:
330
331         "[JSC] JSC should have "parseFunction" to optimize Function
332         constructor"
333         https://bugs.webkit.org/show_bug.cgi?id=190340
334         https://trac.webkit.org/changeset/237254
335
336 2018-10-19  Saam Barati  <sbarati@apple.com>
337
338         vmCall should check if we exit before emitting an OSR exit due to exceptions
339         https://bugs.webkit.org/show_bug.cgi?id=190740
340         <rdar://problem/45220139>
341
342         Reviewed by Mark Lam.
343
344         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
345         (foo):
346
347 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
348
349         [ESNext][BigInt] Implement support for "^"
350         https://bugs.webkit.org/show_bug.cgi?id=186235
351
352         Reviewed by Yusuke Suzuki.
353
354         * stress/big-int-bitwise-xor-general.js: Added.
355         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
356         * stress/big-int-bitwise-xor-type-error.js: Added.
357         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
358
359 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
360
361         [BigInt] Add ValueSub into DFG
362         https://bugs.webkit.org/show_bug.cgi?id=186176
363
364         Reviewed by Yusuke Suzuki.
365
366         * stress/big-int-subtraction-jit.js:
367         * stress/value-sub-big-int-prediction-propagation.js: Added.
368         * stress/value-sub-big-int-untyped.js: Added.
369         * stress/value-sub-spec-none-case.js: Added.
370
371 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
372
373         [JSC] JSC should have "parseFunction" to optimize Function constructor
374         https://bugs.webkit.org/show_bug.cgi?id=190340
375
376         Reviewed by Mark Lam.
377
378         This patch fixes the line number of syntax errors raised by the Function constructor,
379         since we now parse the final code only once. And we no longer use block statement
380         for Function constructor's parsing.
381
382         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
383         * stress/function-cache-with-parameters-end-position.js: Added.
384         (shouldBe):
385         (shouldThrow):
386         (i.anonymous):
387         * stress/function-constructor-name.js: Added.
388         (shouldBe):
389         (GeneratorFunction):
390         (AsyncFunction.async):
391         (AsyncGeneratorFunction.async):
392         (anonymous):
393         (async.anonymous):
394         * test262/expectations.yaml:
395
396 2018-10-18  Commit Queue  <commit-queue@webkit.org>
397
398         Unreviewed, rolling out r237242.
399         https://bugs.webkit.org/show_bug.cgi?id=190701
400
401         it breaks "stress/sampling-profiler-basic.js" (Requested by
402         caiolima on #webkit).
403
404         Reverted changeset:
405
406         "[BigInt] Add ValueSub into DFG"
407         https://bugs.webkit.org/show_bug.cgi?id=186176
408         https://trac.webkit.org/changeset/237242
409
410 2018-10-17  Keith Miller  <keith_miller@apple.com>
411
412         AI does not clear Phantom allocation nodes.
413         https://bugs.webkit.org/show_bug.cgi?id=190694
414
415         Reviewed by Saam Barati.
416
417         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
418         (Day):
419         (DaysInYear):
420         (TimeInYear):
421         (TimeFromYear):
422         (DayFromYear):
423         (InLeapYear):
424         (YearFromTime):
425         (WeekDay):
426         (DaylightSavingTA):
427         (GetSecondSundayInMarch):
428         (TimeInMonth):
429
430 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
431
432         [BigInt] Add ValueSub into DFG
433         https://bugs.webkit.org/show_bug.cgi?id=186176
434
435         Reviewed by Yusuke Suzuki.
436
437         * stress/big-int-subtraction-jit.js:
438         * stress/value-sub-big-int-prediction-propagation.js: Added.
439         * stress/value-sub-big-int-untyped.js: Added.
440
441 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
442
443         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
444         https://bugs.webkit.org/show_bug.cgi?id=190611
445
446         Reviewed by Saam Barati.
447
448         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
449         to improve test runtime. On ARM/MIPS this test even timed out when running all
450         tests.
451
452         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
453         (test):
454
455 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
456
457         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
458
459         Unreviewed gardening.
460
461         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
462
463 2018-10-15  Saam barati  <sbarati@apple.com>
464
465         Emit fjcvtzs on ARM64E on Darwin
466         https://bugs.webkit.org/show_bug.cgi?id=184023
467
468         Reviewed by Yusuke Suzuki and Filip Pizlo.
469
470         * stress/double-to-int32-NaN.js: Added.
471         (assert):
472         (foo):
473
474 2018-10-15  Saam Barati  <sbarati@apple.com>
475
476         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
477         https://bugs.webkit.org/show_bug.cgi?id=190262
478         <rdar://problem/44986241>
479
480         Reviewed by Mark Lam.
481
482         * stress/array-prototype-concat-of-long-spliced-arrays.js:
483         (test):
484         * stress/slice-array-storage-with-holes.js: Added.
485         (main):
486
487 2018-10-15  Commit Queue  <commit-queue@webkit.org>
488
489         Unreviewed, rolling out r237054.
490         https://bugs.webkit.org/show_bug.cgi?id=190593
491
492         "this regressed JetStream 2 by 6% on iOS" (Requested by
493         saamyjoon on #webkit).
494
495         Reverted changeset:
496
497         "[JSC] JSC should have "parseFunction" to optimize Function
498         constructor"
499         https://bugs.webkit.org/show_bug.cgi?id=190340
500         https://trac.webkit.org/changeset/237054
501
502 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
503
504         [JSC] JSON.stringify can accept call-with-no-arguments
505         https://bugs.webkit.org/show_bug.cgi?id=190343
506
507         Reviewed by Mark Lam.
508
509         * stress/json-stringify-no-arguments.js: Added.
510         (shouldBe):
511
512 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
513
514         [JSC] JSC should have "parseFunction" to optimize Function constructor
515         https://bugs.webkit.org/show_bug.cgi?id=190340
516
517         Reviewed by Mark Lam.
518
519         This patch fixes the line number of syntax errors raised by the Function constructor,
520         since we now parse the final code only once. And we no longer use block statement
521         for Function constructor's parsing.
522
523         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
524         * stress/function-cache-with-parameters-end-position.js: Added.
525         (shouldBe):
526         (shouldThrow):
527         (i.anonymous):
528         * stress/function-constructor-name.js: Added.
529         (shouldBe):
530         (GeneratorFunction):
531         (AsyncFunction.async):
532         (AsyncGeneratorFunction.async):
533         (anonymous):
534         (async.anonymous):
535         * test262/expectations.yaml:
536
537 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
538
539         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
540         https://bugs.webkit.org/show_bug.cgi?id=190426
541
542         Unreviewed gardening.
543
544         * stress/sampling-profiler-richards.js:
545
546 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
547
548         [ESNext][BigInt] Implement support for "|"
549         https://bugs.webkit.org/show_bug.cgi?id=186229
550
551         Reviewed by Yusuke Suzuki.
552
553         * stress/big-int-bitwise-and-jit.js:
554         * stress/big-int-bitwise-or-general.js: Added.
555         * stress/big-int-bitwise-or-jit-untyped.js: Added.
556         * stress/big-int-bitwise-or-jit.js: Added.
557         * stress/big-int-bitwise-or-memory-stress.js: Added.
558         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
559         * stress/big-int-bitwise-or-type-error.js: Added.
560         * stress/big-int-bitwise-or-wrapped-value.js: Added.
561
562 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
563
564         Skip test on systems with limited memory
565         https://bugs.webkit.org/show_bug.cgi?id=190310
566
567         Invoking runDefault adds test to runlist, skipping the test in the next
568         line does not prevent the test from executing. Change order of lines such
569         that runDefault is only executed if test is not executed.
570
571         Reviewed by Mark Lam.
572
573         * stress/regress-190187.js:
574
575 2018-10-03  Saam barati  <sbarati@apple.com>
576
577         lowXYZ in FTLLower should always filter the type of the incoming edge
578         https://bugs.webkit.org/show_bug.cgi?id=189939
579         <rdar://problem/44407030>
580
581         Reviewed by Michael Saboff.
582
583         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
584         (foo):
585         (test):
586
587 2018-10-03  Mark Lam  <mark.lam@apple.com>
588
589         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
590         https://bugs.webkit.org/show_bug.cgi?id=190187
591         <rdar://problem/42512909>
592
593         Reviewed by Michael Saboff.
594
595         * stress/regress-190187.js: Added.
596
597 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
598
599         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
600         https://bugs.webkit.org/show_bug.cgi?id=190033
601
602         Reviewed by Yusuke Suzuki.
603
604         * stress/big-int-to-string.js:
605
606 2018-10-01  Mark Lam  <mark.lam@apple.com>
607
608         Function.toString() should also copy the source code Functions that are class definitions.
609         https://bugs.webkit.org/show_bug.cgi?id=190186
610         <rdar://problem/44733360>
611
612         Reviewed by Saam Barati.
613
614         * stress/regress-190186.js: Added.
615
616 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
617
618         Split NaN-check into separate test
619         https://bugs.webkit.org/show_bug.cgi?id=190010
620
621         Reviewed by Saam Barati.
622
623         DataView exposes NaN-representation, which is not necessarily the same on each
624         architecture. Therefore move the check of the NaN-representation into its own
625         file such that we can disable this test on MIPS where NaN-representation can be
626         different on older CPUs.
627
628         * stress/dataview-jit-set-nan.js: Added.
629         (assert):
630         (test.storeLittleEndian):
631         (test.storeBigEndian):
632         (test.store):
633         (test):
634         * stress/dataview-jit-set.js:
635         (test5):
636
637 2018-10-01  Commit Queue  <commit-queue@webkit.org>
638
639         Unreviewed, rolling out r236647.
640         https://bugs.webkit.org/show_bug.cgi?id=190124
641
642         Breaking test stress/big-int-to-string.js (Requested by
643         caiolima_ on #webkit).
644
645         Reverted changeset:
646
647         "[BigInt] BigInt.proptotype.toString is broken when radix is
648         power of 2"
649         https://bugs.webkit.org/show_bug.cgi?id=190033
650         https://trac.webkit.org/changeset/236647
651
652 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
653
654         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
655         https://bugs.webkit.org/show_bug.cgi?id=190033
656
657         Reviewed by Yusuke Suzuki.
658
659         * stress/big-int-to-string.js:
660
661 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
662
663         [ESNext][BigInt] Implement support for "&"
664         https://bugs.webkit.org/show_bug.cgi?id=186228
665
666         Reviewed by Yusuke Suzuki.
667
668         * stress/big-int-bitwise-and-general.js: Added.
669         (assert):
670         (assert.sameValue):
671         * stress/big-int-bitwise-and-jit.js: Added.
672         (let.assert.sameValue):
673         (bigIntBitAnd):
674         * stress/big-int-bitwise-and-memory-stress.js: Added.
675         (assert):
676         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
677         (assert.sameValue):
678         (let.o.Symbol.toPrimitive):
679         (catch):
680         * stress/big-int-bitwise-and-type-error.js: Added.
681         (assert):
682         (assertThrowTypeError):
683         (let.o.valueOf):
684         (o.valueOf):
685         (o.toString):
686         (o.Symbol.toPrimitive):
687         * stress/big-int-bitwise-and-wrapped-value.js: Added.
688         (assert.sameValue):
689         (testBitAnd):
690         (let.o.Symbol.toPrimitive):
691         (o.valueOf):
692         (o.toString):
693
694 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
695
696         JSC test stress/jsc-read.js doesn't support CRLF
697         https://bugs.webkit.org/show_bug.cgi?id=190063
698
699         Reviewed by Yusuke Suzuki.
700
701         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
702
703         * stress/jsc-read.js:
704         (test):
705
706 2018-09-27  Saam barati  <sbarati@apple.com>
707
708         Verify the contents of AssemblerBuffer on arm64e
709         https://bugs.webkit.org/show_bug.cgi?id=190057
710         <rdar://problem/38916630>
711
712         Reviewed by Mark Lam.
713
714         * stress/regress-189132.js:
715
716 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
717
718         Disable test without LLInt on ARMv7
719         https://bugs.webkit.org/show_bug.cgi?id=190037
720
721         Reviewed by Mark Lam.
722
723         Test runs out of executable memory on ARMv7, do not run
724         this test without LLInt enabled.
725
726         * stress/regress-169445.js:
727
728 2018-09-26  Keith Miller  <keith_miller@apple.com>
729
730         We should zero unused property storage when rebalancing array storage.
731         https://bugs.webkit.org/show_bug.cgi?id=188151
732
733         Reviewed by Michael Saboff.
734
735         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
736
737 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
738
739         [JSC] Optimize Array#lastIndexOf
740         https://bugs.webkit.org/show_bug.cgi?id=189780
741
742         Reviewed by Saam Barati.
743
744         * stress/array-lastindexof-array-prototype-trap.js: Added.
745         (shouldBe):
746         (AncestorArray.prototype.get 2):
747         (AncestorArray):
748         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
749         (shouldBe):
750         * stress/array-lastindexof-hole-nan.js: Added.
751         (shouldBe):
752         (throw.new.Error):
753         * stress/array-lastindexof-infinity.js: Added.
754         (shouldBe):
755         (throw.new.Error):
756         * stress/array-lastindexof-negative-zero.js: Added.
757         (shouldBe):
758         (throw.new.Error):
759         * stress/array-lastindexof-own-getter.js: Added.
760         (shouldBe):
761         (throw.new.Error.get array):
762         (get array):
763         * stress/array-lastindexof-prototype-trap.js: Added.
764         (shouldBe):
765         (DerivedArray.prototype.get 2):
766         (DerivedArray):
767
768 2018-09-25  Saam Barati  <sbarati@apple.com>
769
770         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
771         https://bugs.webkit.org/show_bug.cgi?id=189940
772         <rdar://problem/43640987>
773
774         Reviewed by Mark Lam.
775
776         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
777
778 2018-09-24  Saam Barati  <sbarati@apple.com>
779
780         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
781         https://bugs.webkit.org/show_bug.cgi?id=189922
782         <rdar://problem/44651275>
783
784         Reviewed by Mark Lam.
785
786         * stress/array-indexof-fast-path-effects.js: Added.
787         * stress/array-indexof-cached-length.js: Added.
788
789 2018-09-24  Saam barati  <sbarati@apple.com>
790
791         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
792         https://bugs.webkit.org/show_bug.cgi?id=189682
793         <rdar://problem/43557315>
794
795         Reviewed by Mark Lam.
796
797         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
798         (foo):
799
800 2018-09-22  Saam barati  <sbarati@apple.com>
801
802         The sampling should not use Strong<CodeBlock> in its machineLocation field
803         https://bugs.webkit.org/show_bug.cgi?id=189319
804
805         Reviewed by Filip Pizlo.
806
807         * stress/sampling-profiler-richards.js: Added.
808
809 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
810
811         [JSC] Optimize Array#indexOf in C++ runtime
812         https://bugs.webkit.org/show_bug.cgi?id=189507
813
814         Reviewed by Saam Barati.
815
816         * stress/array-indexof-array-prototype-trap.js: Added.
817         (shouldBe):
818         (AncestorArray.prototype.get 2):
819         (AncestorArray):
820         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
821         (shouldBe):
822         * stress/array-indexof-hole-nan.js: Added.
823         (shouldBe):
824         (throw.new.Error):
825         * stress/array-indexof-infinity.js: Added.
826         (shouldBe):
827         (throw.new.Error):
828         * stress/array-indexof-negative-zero.js: Added.
829         (shouldBe):
830         (throw.new.Error):
831         * stress/array-indexof-own-getter.js: Added.
832         (shouldBe):
833         (throw.new.Error.get array):
834         (get array):
835         * stress/array-indexof-prototype-trap.js: Added.
836         (shouldBe):
837         (DerivedArray.prototype.get 2):
838         (DerivedArray):
839
840 2018-09-19  Saam barati  <sbarati@apple.com>
841
842         AI rule for MultiPutByOffset executes its effects in the wrong order
843         https://bugs.webkit.org/show_bug.cgi?id=189757
844         <rdar://problem/43535257>
845
846         Reviewed by Michael Saboff.
847
848         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
849         (foo):
850         (Foo):
851         (g):
852
853 2018-09-17  Mark Lam  <mark.lam@apple.com>
854
855         Ensure that ForInContexts are invalidated if their loop local is over-written.
856         https://bugs.webkit.org/show_bug.cgi?id=189571
857         <rdar://problem/44402277>
858
859         Reviewed by Saam Barati.
860
861         * stress/regress-189571.js: Added.
862
863 2018-09-17  Saam barati  <sbarati@apple.com>
864
865         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
866         https://bugs.webkit.org/show_bug.cgi?id=189676
867         <rdar://problem/39682897>
868
869         Reviewed by Michael Saboff.
870
871         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
872         (A):
873         (K):
874         (i.catch):
875
876 2018-09-14  Saam barati  <sbarati@apple.com>
877
878         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
879         https://bugs.webkit.org/show_bug.cgi?id=189628
880         <rdar://problem/39481690>
881
882         Reviewed by Mark Lam.
883
884         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
885         (foo):
886
887 2018-09-11  Mark Lam  <mark.lam@apple.com>
888
889         Test for array initialization in arrayProtoFuncSplice.
890         https://bugs.webkit.org/show_bug.cgi?id=170253
891         <rdar://problem/31328773>
892
893         Rubber-stamped by Saam Barati.
894
895         * stress/regress-170253.js: Added.
896
897 2018-09-11  Mark Lam  <mark.lam@apple.com>
898
899         Test for IntlObject initialization.
900         https://bugs.webkit.org/show_bug.cgi?id=170251
901         <rdar://problem/31328419>
902
903         Rubber-stamped by Saam Barati.
904
905         * stress/regress-170251.js: Added.
906
907 2018-09-11  Mark Lam  <mark.lam@apple.com>
908
909         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
910         https://bugs.webkit.org/show_bug.cgi?id=169889
911         <rdar://problem/31155607>
912
913         Reviewed by Saam Barati.
914
915         * stress/regress-169889-array-concat.js: Added.
916         * stress/regress-169889-array-concat1.js: Added.
917         * stress/regress-169889-array-slice.js: Added.
918
919 2018-09-11  Mark Lam  <mark.lam@apple.com>
920
921         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
922         https://bugs.webkit.org/show_bug.cgi?id=169445
923         <rdar://problem/30957435>
924
925         Reviewed by Saam Barati.
926
927         * stress/regress-169445.js: Added.
928         (let.gun.eval.A):
929         (let.gun.eval.B.C):
930         (let.gun.eval.B.C.prototype.trigger):
931         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
932         (let.gun.eval.B):
933         (let.gun.eval):
934
935 == Rolled over to ChangeLog-2018-09-11 ==