JSTests/ChangeLog

   1 2017-11-28  JF Bastien  <jfbastien@apple.com>
   2
   3         Strict and sloppy functions shouldn't share structure
   4         https://bugs.webkit.org/show_bug.cgi?id=180103
   5         <rdar://problem/35667847>
   6
   7         Reviewed by Saam Barati.
   8
   9         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
  10         because the IC was wrong.
  11         (foo):
  12         (bar):
  13         (baz):
  14         (catch):
  15         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
  16         in this patch, but may as well test odd strict mode corner cases.
  17         (bar):
  18         (baz):
  19         (catch):
  20         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
  21         (foo):
  22         (bar):
  23         (baz):
  24         (catch):
  25         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
  26         next file, but with invalidation of the FunctionExecutable's
  27         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
  28         slower path.
  29         (foo):
  30         (bar.const.x):
  31         (bar.const.y):
  32         (bar):
  33         (catch):
  34         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
  35         strict nesting works correctly.
  36         (foo):
  37         (bar.baz):
  38         (bar):
  39         * stress/strict-function-structure.js: Added. The test used to
  40         assert in objectProtoFuncHasOwnProperty.
  41         (foo):
  42         (bar):
  43         (baz):
  44         * stress/strict-nested-function-structure.js: Added. Nesting.
  45         (foo):
  46         (bar):
  47         (baz.boo):
  48         (baz):
  49
  50 2017-11-29  Robin Morisset  <rmorisset@apple.com>
  51
  52         The recursive tail call optimisation is wrong on closures
  53         https://bugs.webkit.org/show_bug.cgi?id=179835
  54
  55         Reviewed by Saam Barati.
  56
  57         * stress/closure-recursive-tail-call.js: Added.
  58         (makeClosure):
  59
  60 2017-11-27  JF Bastien  <jfbastien@apple.com>
  61
  62         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
  63         https://bugs.webkit.org/show_bug.cgi?id=180051
  64         <rdar://problem/35614371>
  65
  66         Reviewed by Saam Barati.
  67
  68         * stress/rest-parameter-negative.js: Added.
  69         (__f_5484):
  70         (catch):
  71         (__f_5485):
  72         (__v_22598.catch):
  73
  74 2017-11-27  Saam Barati  <sbarati@apple.com>
  75
  76         Spread can escape when CreateRest does not
  77         https://bugs.webkit.org/show_bug.cgi?id=180057
  78         <rdar://problem/35676119>
  79
  80         Reviewed by JF Bastien.
  81
  82         * stress/spread-escapes-but-create-rest-does-not.js: Added.
  83         (assert):
  84         (getProperties):
  85         (theFunc):
  86         (let.obj.valueOf):
  87
  88 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
  89
  90         [DFG] Add NormalizeMapKey DFG IR
  91         https://bugs.webkit.org/show_bug.cgi?id=179912
  92
  93         Reviewed by Saam Barati.
  94
  95         * stress/map-untyped-normalize-cse.js: Added.
  96         (shouldBe):
  97         (test):
  98         * stress/map-untyped-normalize.js: Added.
  99         (shouldBe):
 100         (test):
 101         * stress/set-untyped-normalize-cse.js: Added.
 102         (shouldBe):
 103         (set return.set has.set has):
 104         * stress/set-untyped-normalize.js: Added.
 105         (shouldBe):
 106         (set return.set has):
 107
 108 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
 109
 110         [FTL] Support DeleteById and DeleteByVal
 111         https://bugs.webkit.org/show_bug.cgi?id=180022
 112
 113         Reviewed by Saam Barati.
 114
 115         * stress/delete-by-id.js: Added.
 116         (shouldBe):
 117         (test1):
 118         (test2):
 119         * stress/delete-by-val-ftl.js: Added.
 120         (shouldBe):
 121         (test1):
 122         (test2):
 123
 124 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
 125
 126         [DFG] Introduce {Set,Map,WeakMap}Fields
 127         https://bugs.webkit.org/show_bug.cgi?id=179925
 128
 129         Reviewed by Saam Barati.
 130
 131         * stress/map-set-clobber-map-get.js: Added.
 132         (shouldBe):
 133         (test):
 134         * stress/map-set-does-not-clobber-set-has.js: Added.
 135         (shouldBe):
 136         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
 137         (shouldBe):
 138         (test):
 139         * stress/set-add-clobber-set-has.js: Added.
 140         (shouldBe):
 141         * stress/set-add-does-not-clobber-map-get.js: Added.
 142         (shouldBe):
 143
 144 2017-11-24  Mark Lam  <mark.lam@apple.com>
 145
 146         Move unsafe jsc shell test functions to the $vm object.
 147         https://bugs.webkit.org/show_bug.cgi?id=179980
 148
 149         Reviewed by Yusuke Suzuki.
 150
 151         * controlFlowProfiler/driver/driver.js:
 152         * controlFlowProfiler/execution-count.js:
 153         * controlFlowProfiler/if-statement.js:
 154         * controlFlowProfiler/loop-statements.js:
 155         * controlFlowProfiler/switch-statements.js:
 156         * controlFlowProfiler/test-jit.js:
 157         * exceptionFuzz/3d-cube.js:
 158         * exceptionFuzz/date-format-xparb.js:
 159         * exceptionFuzz/earley-boyer.js:
 160         * heapProfiler/basic-edges.js:
 161         * heapProfiler/property-edge-types.js:
 162         * microbenchmarks/try-get-by-id-basic.js:
 163         * microbenchmarks/try-get-by-id-polymorphic.js:
 164         * modules/namespace-object-try-get.js:
 165         * stress/argument-count-bytecode.js:
 166         * stress/argument-intrinsic-basic.js:
 167         * stress/argument-intrinsic-inlining-use-caller-arg.js:
 168         * stress/argument-intrinsic-inlining-with-result-escape.js:
 169         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
 170         * stress/argument-intrinsic-inlining-with-vararg.js:
 171         * stress/argument-intrinsic-nested-inlining.js:
 172         * stress/argument-intrinsic-not-convert-to-get-argument.js:
 173         * stress/argument-intrinsic-with-stack-write.js:
 174         * stress/arity-mismatch-get-argument.js:
 175         * stress/array-message-passing.js:
 176         * stress/array-push-with-force-exit.js:
 177         * stress/check-dom-with-signature.js:
 178         * stress/check-sub-class.js:
 179         * stress/compare-eq-incomplete-profile.js:
 180         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
 181         * stress/do-eval-virtual-call-correctly.js:
 182         * stress/dom-jit-with-poly-proto.js:
 183         * stress/domjit-exception-ic.js:
 184         * stress/domjit-exception.js:
 185         * stress/domjit-getter-complex-with-incorrect-object.js:
 186         * stress/domjit-getter-complex.js:
 187         * stress/domjit-getter-poly.js:
 188         * stress/domjit-getter-proto.js:
 189         * stress/domjit-getter-super-poly.js:
 190         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
 191         * stress/domjit-getter-type-check.js:
 192         * stress/domjit-getter.js:
 193         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
 194         * stress/for-in-proxy-target-changed-structure.js:
 195         * stress/for-in-proxy.js:
 196         * stress/generational-opaque-roots.js:
 197         * stress/global-const-redeclaration-setting-2.js:
 198         * stress/global-const-redeclaration-setting-3.js:
 199         * stress/global-const-redeclaration-setting-4.js:
 200         * stress/global-const-redeclaration-setting-5.js:
 201         * stress/global-const-redeclaration-setting.js:
 202         * stress/import-basic.js:
 203         * stress/import-from-eval.js:
 204         * stress/import-reject-with-exception.js:
 205         * stress/import-syntax.js:
 206         * stress/impure-get-own-property-slot-inline-cache.js:
 207         * stress/is-constructor.js:
 208         * stress/istypedarrayview-intrinsic.js:
 209         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
 210         * stress/jsc-test-functions-should-be-more-robust.js:
 211         * stress/object-toString-with-proxy.js:
 212         * stress/poly-proto-custom-value-and-accessor.js:
 213         * stress/proxy-inline-cache.js:
 214         * stress/re-execute-error-module.js:
 215         * stress/regress-150532.js:
 216         * stress/regress-156992.js:
 217         * stress/regress-179619.js:
 218         * stress/resources/shadow-chicken-support.js:
 219         * stress/runtime-array.js:
 220         * stress/sampling-profiler-microtasks.js:
 221         * stress/shadow-chicken-enabled.js:
 222         * stress/spread-correct-global-object-on-exception.js:
 223         * stress/super-get-by-id.js:
 224         * stress/tailCallForwardArguments.js:
 225         * stress/to-object-intrinsic-boolean-edge.js:
 226         * stress/to-object-intrinsic-null-or-undefined-edge.js:
 227         * stress/to-object-intrinsic-number-edge.js:
 228         * stress/to-object-intrinsic-object-edge.js:
 229         * stress/to-object-intrinsic-string-edge.js:
 230         * stress/to-object-intrinsic-symbol-edge.js:
 231         * stress/to-object-intrinsic.js:
 232         * stress/try-catch-custom-getter-as-get-by-id.js:
 233         * stress/try-get-by-id-poly-proto.js:
 234         * stress/try-get-by-id-should-spill-registers-dfg.js:
 235         * stress/try-get-by-id.js:
 236         * typeProfiler/arrow-functions.js:
 237         * typeProfiler/basic.js:
 238         * typeProfiler/captured.js:
 239         * typeProfiler/classes.js:
 240         * typeProfiler/dfg-jit-optimizations.js:
 241         * typeProfiler/dictionary-mode.js:
 242         * typeProfiler/es6-block-scoping.js:
 243         * typeProfiler/es6-classes.js:
 244         * typeProfiler/inheritance.js:
 245         * typeProfiler/int52-dfg.js:
 246         * typeProfiler/loop.js:
 247         * typeProfiler/optional-fields.js:
 248         * typeProfiler/overflow.js:
 249         * typeProfiler/return.js:
 250         * typeProfiler/symbol.js:
 251         * typeProfiler/weird-prototype-chain.js:
 252
 253 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 254
 255         [DFG][FTL] Support MapSet / SetAdd intrinsics
 256         https://bugs.webkit.org/show_bug.cgi?id=179858
 257
 258         Reviewed by Saam Barati.
 259
 260         * microbenchmarks/map-has-and-set.js: Added.
 261         (test):
 262         * stress/map-set-check-failure.js: Added.
 263         (shouldBe):
 264         (shouldThrow):
 265         (target):
 266         * stress/map-set-cse.js: Added.
 267         (shouldBe):
 268         (test):
 269         * stress/set-add-check-failure.js: Added.
 270         (shouldBe):
 271         (shouldThrow):
 272         (set shouldThrow):
 273         * stress/set-add-cse.js: Added.
 274         (shouldBe):
 275
 276 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 277
 278         [JSC] Allow poly proto for intrinsic getters
 279         https://bugs.webkit.org/show_bug.cgi?id=179550
 280
 281         Reviewed by Saam Barati.
 282
 283         This change is also tested by existing tests.
 284
 285             1. stress/intrinsic-getter-with-poly-proto.js
 286             2. stress/poly-proto-intrinsic-getter-correctness.js
 287
 288         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
 289         (shouldBe):
 290         (makePolyProtoObject.foo.C):
 291         (makePolyProtoObject.foo):
 292         (makePolyProtoObject):
 293         (target):
 294         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
 295         (shouldBe):
 296         (makePolyProtoObject.foo.C):
 297         (makePolyProtoObject.foo):
 298         (makePolyProtoObject):
 299         (target):
 300
 301 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
 302
 303         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
 304         https://bugs.webkit.org/show_bug.cgi?id=179744
 305
 306         Reviewed by Michael Catanzaro.
 307
 308         This test uses too much memory for our buildbots on these platforms
 309         and gets OOM-killed.
 310
 311         * stress/unshiftCountSlowCase-correct-postCapacity.js:
 312         Skip if $memoryLimited and linux.
 313
 314 2017-11-17  JF Bastien  <jfbastien@apple.com>
 315
 316         WebAssembly JS API: throw when a promise can't be created
 317         https://bugs.webkit.org/show_bug.cgi?id=179826
 318         <rdar://problem/35455813>
 319
 320         Reviewed by Mark Lam.
 321
 322         Test WebAssembly.{compile,instantiate} where promise creation
 323         fails because of a stack overflow.
 324
 325         * wasm/js-api/promise-stack-overflow.js: Added.
 326         (const.runNearStackLimit.f.const.t):
 327         (async.testCompile):
 328         (async.testInstantiate):
 329
 330 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
 331
 332         Unreviewed, mark regress-178385.js as memory exhausting
 333
 334         * stress/regress-178385.js:
 335
 336 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
 337
 338         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
 339
 340         Unreviewed test gardening.
 341
 342         * test262.yaml:
 343
 344 2017-11-16  Robin Morisset  <rmorisset@apple.com>
 345
 346         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
 347         https://bugs.webkit.org/show_bug.cgi?id=179763
 348         <rdar://problem/35550513>
 349
 350         Reviewed by Keith Miller.
 351
 352         Just adding a slightly cleaned-up version of the original fuzzer-found test.
 353
 354         * stress/tdz-this-in-try-catch.js: Added.
 355         (__v_6388):
 356         (__v_6392):
 357
 358 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 359
 360         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
 361         https://bugs.webkit.org/show_bug.cgi?id=179594
 362
 363         Reviewed by Saam Barati.
 364
 365         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
 366         (shouldBe):
 367         (args):
 368         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
 369         (shouldBe):
 370         (args):
 371
 372 2017-11-14  Saam Barati  <sbarati@apple.com>
 373
 374         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
 375         https://bugs.webkit.org/show_bug.cgi?id=179639
 376         <rdar://problem/35513018>
 377
 378         Reviewed by JF Bastien.
 379
 380         * wasm/function-tests/grow-memory-cause-gc.js: Added.
 381         (escape):
 382         (i.func):
 383
 384 2017-11-13  Mark Lam  <mark.lam@apple.com>
 385
 386         Add more overflow check book-keeping for MarkedArgumentBuffer.
 387         https://bugs.webkit.org/show_bug.cgi?id=179634
 388         <rdar://problem/35492517>
 389
 390         Reviewed by Saam Barati.
 391
 392         * stress/regress-179634.js: Added.
 393
 394 2017-11-13  Mark Lam  <mark.lam@apple.com>
 395
 396         Make the jsc shell loadGetterFromGetterSetter() function more robust.
 397         https://bugs.webkit.org/show_bug.cgi?id=179619
 398         <rdar://problem/35492518>
 399
 400         Reviewed by Saam Barati.
 401
 402         * stress/regress-179619.js: Added.
 403
 404 2017-11-12  Mark Lam  <mark.lam@apple.com>
 405
 406         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
 407         https://bugs.webkit.org/show_bug.cgi?id=179562
 408         <rdar://problem/35467022>
 409
 410         Reviewed by Saam Barati.
 411
 412         * regress-179562.js: Added.
 413
 414 2017-11-08  Saam Barati  <sbarati@apple.com>
 415
 416         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
 417         https://bugs.webkit.org/show_bug.cgi?id=177792
 418
 419         Reviewed by Yusuke Suzuki.
 420
 421         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
 422         (assert):
 423         (foo.Foo.prototype.ensureX):
 424         (foo.Foo):
 425         (foo):
 426         (access):
 427
 428 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
 429
 430         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
 431         https://bugs.webkit.org/show_bug.cgi?id=178592
 432
 433         Unreviewed test gardening.
 434
 435         * test262.yaml:
 436
 437 2017-11-08  Robin Morisset  <rmorisset@apple.com>
 438
 439         Turn recursive tail calls into loops
 440         https://bugs.webkit.org/show_bug.cgi?id=176601
 441
 442         Reviewed by Saam Barati.
 443
 444         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
 445
 446         Add some simple test that computes factorial in several ways, and other trivial computations.
 447         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
 448         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
 449         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
 450         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
 451
 452         * stress/inline-call-to-recursive-tail-call.js: Added.
 453         (factorial.aux):
 454         (factorial):
 455         (factorial2.aux2):
 456         (factorial2.id):
 457         (factorial2):
 458         (factorial3.aux3):
 459         (factorial3):
 460         (aux4):
 461         (factorial4):
 462         (foo):
 463         (auxBar):
 464         (bar):
 465         (test):
 466
 467 2017-11-07  Mark Lam  <mark.lam@apple.com>
 468
 469         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
 470         https://bugs.webkit.org/show_bug.cgi?id=179355
 471         <rdar://problem/35263053>
 472
 473         Reviewed by Saam Barati.
 474
 475         * stress/regress-179355.js: Added.
 476
 477 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
 478
 479         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
 480         https://bugs.webkit.org/show_bug.cgi?id=144458
 481
 482         Reviewed by Saam Barati.
 483
 484         * microbenchmarks/dfg-internal-function-call.js: Added.
 485         (target):
 486         * microbenchmarks/dfg-internal-function-construct.js: Added.
 487         (target):
 488         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
 489         (target):
 490         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
 491         (target):
 492         * stress/dfg-internal-function-call.js: Added.
 493         (shouldBe):
 494         (target):
 495         * stress/dfg-internal-function-construct.js: Added.
 496         (shouldBe):
 497         (target):
 498         * stress/internal-function-call.js: Added.
 499         (shouldBe):
 500         * stress/internal-function-construct.js: Added.
 501         (shouldBe):
 502
 503 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
 504
 505         [Win] Skip stress/regress-178385.js.
 506         https://bugs.webkit.org/show_bug.cgi?id=179298
 507
 508         Unreviewed test gardening.
 509
 510         * stress/regress-178385.js:
 511
 512 2017-11-03  Keith Miller  <keith_miller@apple.com>
 513
 514         Add test for ic with side effects
 515         https://bugs.webkit.org/show_bug.cgi?id=179268
 516
 517         Reviewed by Saam Barati.
 518
 519         * stress/put-inline-cache-side-effects.js: Added.
 520         (let.i.of.objs.keys):
 521         (f):
 522
 523 2017-11-03  Mark Lam  <mark.lam@apple.com>
 524
 525         CachedCall (and its clients) needs overflow checks.
 526         https://bugs.webkit.org/show_bug.cgi?id=179185
 527
 528         Reviewed by JF Bastien.
 529
 530         * stress/regress-179185.js: Added.
 531
 532 2017-11-02  Michael Saboff  <msaboff@apple.com>
 533
 534         DFG needs to handle code motion of code in for..in loop bodies
 535         https://bugs.webkit.org/show_bug.cgi?id=179212
 536
 537         Reviewed by Keith Miller.
 538
 539         New regression test.
 540
 541         * stress/for-in-side-effects.js: Added.
 542         (getPrototypeOf):
 543         (reset):
 544         (testWithoutFTL.f):
 545         (testWithoutFTL):
 546         (testWithFTL.f):
 547         (testWithFTL):
 548
 549 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
 550
 551         AI does not correctly model the clobber case of ArithClz32
 552         https://bugs.webkit.org/show_bug.cgi?id=179188
 553
 554         Reviewed by Michael Saboff.
 555
 556         * stress/arith-clz32-effects.js: Added.
 557         (foo):
 558         (valueOf):
 559
 560 2017-11-01  Michael Saboff  <msaboff@apple.com>
 561
 562         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
 563         https://bugs.webkit.org/show_bug.cgi?id=179140
 564
 565         Reviewed by Saam Barati.
 566
 567         New regression test.
 568
 569         * stress/regress-179140.js: Added.
 570         (testWithoutFTL):
 571         (testWithFTL):
 572
 573 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 574
 575         [JSC] Introduce @toObject
 576         https://bugs.webkit.org/show_bug.cgi?id=178726
 577
 578         Reviewed by Saam Barati.
 579
 580         * stress/array-copywithin.js:
 581         (shouldThrow):
 582         * stress/object-constructor-boolean-edge.js: Added.
 583         (shouldBe):
 584         (test):
 585         * stress/object-constructor-global.js: Added.
 586         (shouldBe):
 587         * stress/object-constructor-null-edge.js: Added.
 588         (shouldBe):
 589         (test):
 590         * stress/object-constructor-number-edge.js: Added.
 591         (shouldBe):
 592         (test):
 593         * stress/object-constructor-object-edge.js: Added.
 594         (shouldBe):
 595         (test):
 596         (i.arg):
 597         * stress/object-constructor-string-edge.js: Added.
 598         (shouldBe):
 599         (test):
 600         * stress/object-constructor-symbol-edge.js: Added.
 601         (shouldBe):
 602         (test):
 603         * stress/object-constructor-undefined-edge.js: Added.
 604         (shouldBe):
 605         (test):
 606         * stress/symbol-array-from.js: Added.
 607         (shouldBe):
 608         * stress/to-object-intrinsic-boolean-edge.js: Added.
 609         (shouldBe):
 610         (builtin.createBuiltin):
 611         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
 612         (shouldThrow):
 613         * stress/to-object-intrinsic-number-edge.js: Added.
 614         (shouldBe):
 615         (builtin.createBuiltin):
 616         * stress/to-object-intrinsic-object-edge.js: Added.
 617         (shouldBe):
 618         (builtin.createBuiltin):
 619         (i.arg):
 620         * stress/to-object-intrinsic-string-edge.js: Added.
 621         (shouldBe):
 622         (builtin.createBuiltin):
 623         * stress/to-object-intrinsic-symbol-edge.js: Added.
 624         (shouldBe):
 625         (builtin.createBuiltin):
 626         * stress/to-object-intrinsic.js: Added.
 627         (shouldBe):
 628         (shouldThrow):
 629         (builtin.createBuiltin):
 630
 631 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
 632
 633         [DFG][FTL] Introduce StringSlice
 634         https://bugs.webkit.org/show_bug.cgi?id=178934
 635
 636         Reviewed by Saam Barati.
 637
 638         * microbenchmarks/string-slice-empty.js: Added.
 639         (slice):
 640         * microbenchmarks/string-slice-one-char.js: Added.
 641         (slice):
 642         * microbenchmarks/string-slice.js: Added.
 643         (slice):
 644
 645 2017-10-26  Michael Saboff  <msaboff@apple.com>
 646
 647         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
 648         https://bugs.webkit.org/show_bug.cgi?id=178890
 649
 650         Reviewed by Keith Miller.
 651
 652         New regression test.
 653
 654         * stress/regress-178890.js: Added.
 655
 656 2017-10-26  Mark Lam  <mark.lam@apple.com>
 657
 658         JSRopeString::RopeBuilder::append() should check for overflows.
 659         https://bugs.webkit.org/show_bug.cgi?id=178385
 660         <rdar://problem/35027468>
 661
 662         Reviewed by Saam Barati.
 663
 664         * stress/regress-178385.js: Added.
 665
 666 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
 667
 668         Unreviewed, rolling out r223961.
 669
 670         The change that required this has been rolled out.
 671
 672         Reverted changeset:
 673
 674         "Mark test262.yaml/test262/test/language/statements/try/tco-
 675         catch.js as passing."
 676         https://bugs.webkit.org/show_bug.cgi?id=178592
 677         https://trac.webkit.org/changeset/223961
 678
 679 2017-10-25  Commit Queue  <commit-queue@webkit.org>
 680
 681         Unreviewed, rolling out r223691 and r223729.
 682         https://bugs.webkit.org/show_bug.cgi?id=178834
 683
 684         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
 685         by rniwa on #webkit).
 686
 687         Reverted changesets:
 688
 689         "Turn recursive tail calls into loops"
 690         https://bugs.webkit.org/show_bug.cgi?id=176601
 691         https://trac.webkit.org/changeset/223691
 692
 693         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
 694         comparison is always false due to limited range of data type
 695         [-Wtype-limits]"
 696         https://bugs.webkit.org/show_bug.cgi?id=178543
 697         https://trac.webkit.org/changeset/223729
 698
 699 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
 700
 701         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
 702         https://bugs.webkit.org/show_bug.cgi?id=178592
 703
 704         Unreviewed test gardening.
 705
 706         * test262.yaml:
 707
 708 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
 709
 710         [FTL] Support NewStringObject
 711         https://bugs.webkit.org/show_bug.cgi?id=178737
 712
 713         Reviewed by Saam Barati.
 714
 715         * stress/new-string-object.js: Added.
 716         (shouldBe):
 717         (test):
 718
 719 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 720
 721         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
 722         https://bugs.webkit.org/show_bug.cgi?id=178308
 723
 724         Reviewed by Mark Lam.
 725
 726         * test262.yaml:
 727
 728 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 729
 730         [JSC] Use fastJoin in Array#toString
 731         https://bugs.webkit.org/show_bug.cgi?id=178062
 732
 733         Reviewed by Darin Adler.
 734
 735         * microbenchmarks/contiguous-array-to-string.js: Added.
 736         (target):
 737         * microbenchmarks/double-array-to-string.js: Added.
 738         (target):
 739         * microbenchmarks/int32-array-to-string.js: Added.
 740         (target):
 741
 742 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
 743
 744         stress/check-string-ident.js is improperly skipped
 745         https://bugs.webkit.org/show_bug.cgi?id=178642
 746
 747         Reviewed by Saam Barati.
 748
 749         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
 750         since it enforces the run-jsc-stress-tests script to still set up the
 751         test to run, despite the skip directive that's used before.
 752
 753 2017-10-20  Mark Lam  <mark.lam@apple.com>
 754
 755         Add a test case for r214334.
 756         https://bugs.webkit.org/show_bug.cgi?id=169941
 757         <rdar://problem/31221258>
 758
 759         Reviewed by JF Bastien.
 760
 761         * stress/regress-169941.js: Added.
 762
 763 2017-10-19  JF Bastien  <jfbastien@apple.com>
 764
 765         WebAssembly: no VM / JS version of everything but Instance
 766         https://bugs.webkit.org/show_bug.cgi?id=177473
 767
 768         Reviewed by Filip Pizlo, Saam Barati.
 769
 770         - Exceeding max on memory growth now returns a range error as per
 771         spec. This is a (very minor) breaking change: it used to throw OOM
 772         error. Update the corresponding test.
 773
 774         * wasm/js-api/memory-grow.js:
 775         (assertEq):
 776         * wasm/js-api/table.js:
 777         (assert.throws):
 778
 779 2017-10-19  Mark Lam  <mark.lam@apple.com>
 780
 781         Stringifier::appendStringifiedValue() is missing an exception check.
 782         https://bugs.webkit.org/show_bug.cgi?id=178386
 783         <rdar://problem/35027610>
 784
 785         Reviewed by Saam Barati.
 786
 787         * stress/regress-178386.js: Added.
 788
 789 2017-10-19  Michael Saboff  <msaboff@apple.com>
 790
 791         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
 792         https://bugs.webkit.org/show_bug.cgi?id=178521
 793
 794         Reviewed by JF Bastien.
 795
 796         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
 797         now passes with the current version (5.0) of the Emoji spec.
 798
 799 2017-10-19  Robin Morisset  <rmorisset@apple.com>
 800
 801         Turn recursive tail calls into loops
 802         https://bugs.webkit.org/show_bug.cgi?id=176601
 803
 804         Reviewed by Saam Barati.
 805
 806         Add some simple test that computes factorial in several ways, and other trivial computations.
 807         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
 808         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
 809         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
 810         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
 811
 812         * stress/inline-call-to-recursive-tail-call.js: Added.
 813         (factorial.aux):
 814         (factorial):
 815         (factorial2.aux):
 816         (factorial2.id):
 817         (factorial2):
 818         (factorial3.aux):
 819         (factorial3):
 820         (aux):
 821         (factorial4):
 822         (test):
 823
 824 2017-10-18  Mark Lam  <mark.lam@apple.com>
 825
 826         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
 827         https://bugs.webkit.org/show_bug.cgi?id=177600
 828         <rdar://problem/34710985>
 829
 830         Reviewed by Saam Barati.
 831
 832         * stress/regress-177600.js: Added.
 833
 834 2017-10-18  Mark Lam  <mark.lam@apple.com>
 835
 836         The compiler should always register a structure when it adds its transitionWatchPointSet.
 837         https://bugs.webkit.org/show_bug.cgi?id=178420
 838         <rdar://problem/34814024>
 839
 840         Reviewed by Saam Barati and Filip Pizlo.
 841
 842         * stress/regress-178420.js: Added.
 843         (new.Array.10000.map):
 844
 845 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 846
 847         [JSC] __proto__ getter should be fast
 848         https://bugs.webkit.org/show_bug.cgi?id=178067
 849
 850         Reviewed by Saam Barati.
 851
 852         * stress/dfg-object-proto-accessor.js: Added.
 853         (shouldBe):
 854         (shouldThrow):
 855         (target):
 856         * stress/dfg-object-proto-getter.js: Added.
 857         (shouldBe):
 858         (shouldThrow):
 859         (target):
 860         * stress/dfg-object-prototype-of.js: Added.
 861         (shouldBe):
 862         (shouldThrow):
 863         (target):
 864         * stress/dfg-reflect-get-prototype-of.js: Added.
 865         (shouldBe):
 866         (shouldThrow):
 867         (target):
 868         * stress/intrinsic-getter-with-poly-proto.js: Added.
 869         (shouldBe):
 870         (makePolyProtoObject.foo.C):
 871         (makePolyProtoObject.foo):
 872         (makePolyProtoObject):
 873         (target):
 874         * stress/object-get-prototype-of-filtered.js: Added.
 875         (shouldBe):
 876         (shouldThrow):
 877         (target):
 878         (i.Cocoa):
 879         * stress/object-get-prototype-of-mono-proto.js: Added.
 880         (shouldBe):
 881         (makePolyProtoObject.foo.C):
 882         (makePolyProtoObject.foo):
 883         (makePolyProtoObject):
 884         (target):
 885         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 886         (shouldBe):
 887         (makePolyProtoObject.foo.C):
 888         (makePolyProtoObject.foo):
 889         (makePolyProtoObject):
 890         (target):
 891         * stress/object-get-prototype-of-poly-proto.js: Added.
 892         (shouldBe):
 893         (makePolyProtoObject.foo.C):
 894         (makePolyProtoObject.foo):
 895         (makePolyProtoObject):
 896         (target):
 897         * stress/object-proto-getter-filtered.js: Added.
 898         (shouldBe):
 899         (shouldThrow):
 900         (target):
 901         (i.Cocoa):
 902         * stress/object-proto-getter-poly-mono-proto.js: Added.
 903         (shouldBe):
 904         (makePolyProtoObject.foo.C):
 905         (makePolyProtoObject.foo):
 906         (makePolyProtoObject):
 907         (target):
 908         * stress/object-proto-getter-poly-proto.js: Added.
 909         (shouldBe):
 910         (makePolyProtoObject.foo.C):
 911         (makePolyProtoObject.foo):
 912         (makePolyProtoObject):
 913         (target):
 914         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 915         * stress/string-proto.js: Added.
 916         (shouldBe):
 917         (target):
 918
 919 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
 920
 921         Unreviewed, rolling out r223523.
 922
 923         A test for this change is failing on debug JSC bots.
 924
 925         Reverted changeset:
 926
 927         "[JSC] __proto__ getter should be fast"
 928         https://bugs.webkit.org/show_bug.cgi?id=178067
 929         https://trac.webkit.org/changeset/223523
 930
 931 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
 932
 933         [JSC] __proto__ getter should be fast
 934         https://bugs.webkit.org/show_bug.cgi?id=178067
 935
 936         Reviewed by Saam Barati.
 937
 938         * stress/dfg-object-proto-accessor.js: Added.
 939         (shouldBe):
 940         (shouldThrow):
 941         (target):
 942         * stress/dfg-object-proto-getter.js: Added.
 943         (shouldBe):
 944         (shouldThrow):
 945         (target):
 946         * stress/dfg-object-prototype-of.js: Added.
 947         (shouldBe):
 948         (shouldThrow):
 949         (target):
 950         * stress/dfg-reflect-get-prototype-of.js: Added.
 951         (shouldBe):
 952         (shouldThrow):
 953         (target):
 954         * stress/object-get-prototype-of-filtered.js: Added.
 955         (shouldBe):
 956         (shouldThrow):
 957         (target):
 958         (i.Cocoa):
 959         * stress/object-get-prototype-of-mono-proto.js: Added.
 960         (shouldBe):
 961         (makePolyProtoObject.foo.C):
 962         (makePolyProtoObject.foo):
 963         (makePolyProtoObject):
 964         (target):
 965         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 966         (shouldBe):
 967         (makePolyProtoObject.foo.C):
 968         (makePolyProtoObject.foo):
 969         (makePolyProtoObject):
 970         (target):
 971         * stress/object-get-prototype-of-poly-proto.js: Added.
 972         (shouldBe):
 973         (makePolyProtoObject.foo.C):
 974         (makePolyProtoObject.foo):
 975         (makePolyProtoObject):
 976         (target):
 977         * stress/object-proto-getter-filtered.js: Added.
 978         (shouldBe):
 979         (shouldThrow):
 980         (target):
 981         (i.Cocoa):
 982         * stress/object-proto-getter-poly-mono-proto.js: Added.
 983         (shouldBe):
 984         (makePolyProtoObject.foo.C):
 985         (makePolyProtoObject.foo):
 986         (makePolyProtoObject):
 987         (target):
 988         * stress/object-proto-getter-poly-proto.js: Added.
 989         (shouldBe):
 990         (makePolyProtoObject.foo.C):
 991         (makePolyProtoObject.foo):
 992         (makePolyProtoObject):
 993         (target):
 994         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 995         * stress/string-proto.js: Added.
 996         (shouldBe):
 997         (target):
 998
 999 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1000
1001         Reland "Add Above/Below comparisons for UInt32 patterns"
1002         https://bugs.webkit.org/show_bug.cgi?id=177281
1003
1004         Reviewed by Saam Barati.
1005
1006         * stress/uint32-comparison-jump.js: Added.
1007         (shouldBe):
1008         (above):
1009         (aboveOrEqual):
1010         (below):
1011         (belowOrEqual):
1012         (notAbove):
1013         (notAboveOrEqual):
1014         (notBelow):
1015         (notBelowOrEqual):
1016         * stress/uint32-comparison.js: Added.
1017         (shouldBe):
1018         (above):
1019         (aboveOrEqual):
1020         (below):
1021         (belowOrEqual):
1022         (aboveTest):
1023         (aboveOrEqualTest):
1024         (belowTest):
1025         (belowOrEqualTest):
1026
1027 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1028
1029         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1030         https://bugs.webkit.org/show_bug.cgi?id=178210
1031
1032         Reviewed by Saam Barati.
1033
1034         * wasm/function-tests/trap-from-start-async.js:
1035         (async.StartTrapsAsync):
1036         * wasm/function-tests/trap-from-start.js:
1037         (StartTraps):
1038         * wasm/js-api/web-assembly-function.js:
1039         (assert.eq.Object.getPrototypeOf):
1040         * wasm/js-api/wrapper-function.js:
1041         (return.new.WebAssembly.Module):
1042         (assert.throws.makeInstance): Deleted.
1043         (assert.throws.Bar): Deleted.
1044         (assert.throws): Deleted.
1045
1046 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1047
1048         Enable gigacage on iOS
1049         https://bugs.webkit.org/show_bug.cgi?id=177586
1050
1051         Reviewed by JF Bastien.
1052
1053         Add tests for when Gigacage gets runtime disabled.
1054
1055         * stress/disable-gigacage-arrays.js: Added.
1056         (foo):
1057         * stress/disable-gigacage-strings.js: Added.
1058         (foo):
1059         * stress/disable-gigacage-typed-arrays.js: Added.
1060         (foo):
1061
1062 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1063
1064         import.meta should not be assignable
1065         https://bugs.webkit.org/show_bug.cgi?id=178202
1066
1067         Reviewed by Saam Barati.
1068
1069         * modules/import-meta-assignment.js: Added.
1070         (shouldThrow):
1071         (SyntaxError.import.meta.can.shouldThrow):
1072
1073 2017-10-11  Saam Barati  <sbarati@apple.com>
1074
1075         Unreviewed. Actually skip certain type profiler tests in debug.
1076
1077         * typeProfiler.yaml:
1078         * typeProfiler/deltablue-for-of.js:
1079         * typeProfiler/getter-richards.js:
1080
1081 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1082
1083         Unreviewed, rolling out r223113 and r223121.
1084         https://bugs.webkit.org/show_bug.cgi?id=178182
1085
1086         Reintroduced 20% regression on Kraken (Requested by rniwa on
1087         #webkit).
1088
1089         Reverted changesets:
1090
1091         "Enable gigacage on iOS"
1092         https://bugs.webkit.org/show_bug.cgi?id=177586
1093         https://trac.webkit.org/changeset/223113
1094
1095         "Use one virtual allocation for all gigacages and their
1096         runways"
1097         https://bugs.webkit.org/show_bug.cgi?id=178050
1098         https://trac.webkit.org/changeset/223121
1099
1100 2017-10-11  Michael Saboff  <msaboff@apple.com>
1101
1102         Disable test262 named capture group tests with direct unicode names and with references before definitions
1103         https://bugs.webkit.org/show_bug.cgi?id=178177
1104
1105         Reviewed by Keith Miller.
1106
1107         Bugs to track fixing these test are:
1108         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1109             "Add support in named capture group identifiers for direct surrogate pairs"
1110         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1111             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1112
1113         * test262.yaml:
1114
1115 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1116
1117         Object properties are undefined in super.call() but not in this.call()
1118         https://bugs.webkit.org/show_bug.cgi?id=177230
1119
1120         Reviewed by Saam Barati.
1121
1122         * stress/super-call-function-subclass.js: Added.
1123         (assert):
1124         (A.prototype.t):
1125         (A):
1126         * stress/super-dot-call-and-apply.js: Added.
1127         (assert):
1128         (A):
1129         (A.prototype.call):
1130         (A.prototype.apply):
1131         (B.prototype.testSuper):
1132         (B):
1133         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1134         (D.prototype.testSuper):
1135         (D):
1136
1137 2017-10-10  Saam Barati  <sbarati@apple.com>
1138
1139         The prototype cache should be aware of the Executable it generates a Structure for
1140         https://bugs.webkit.org/show_bug.cgi?id=177907
1141
1142         Reviewed by Filip Pizlo.
1143
1144         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1145         (assert):
1146         (foo.C):
1147         (foo):
1148         (bar.C):
1149         (bar):
1150         (access):
1151         (makeLongChain):
1152         (accessY):
1153
1154 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1155
1156         `async` should be able to be used as an imported binding name
1157         https://bugs.webkit.org/show_bug.cgi?id=176573
1158
1159         Reviewed by Saam Barati.
1160
1161         * modules/import-default-async.js: Added.
1162         * modules/import-named-async-as.js: Added.
1163         * modules/import-named-async.js: Added.
1164         * modules/import-named-async/target.js: Added.
1165         * modules/import-namespace-async.js: Added.
1166         * test262.yaml:
1167
1168 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1169
1170         Enable gigacage on iOS
1171         https://bugs.webkit.org/show_bug.cgi?id=177586
1172
1173         Reviewed by JF Bastien.
1174
1175         Add tests for when Gigacage gets runtime disabled.
1176
1177         * stress/disable-gigacage-arrays.js: Added.
1178         (foo):
1179         * stress/disable-gigacage-strings.js: Added.
1180         (foo):
1181         * stress/disable-gigacage-typed-arrays.js: Added.
1182         (foo):
1183
1184 2017-10-09  Michael Saboff  <msaboff@apple.com>
1185
1186         Implement RegExp Unicode property escapes
1187         https://bugs.webkit.org/show_bug.cgi?id=172069
1188
1189         Reviewed by JF Bastien.
1190
1191         Enabled Unicode Property tests.
1192
1193         * test262.yaml:
1194
1195 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1196
1197         Unreviewed, rolling out r223015 and r223025.
1198         https://bugs.webkit.org/show_bug.cgi?id=178093
1199
1200         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1201         #webkit).
1202
1203         Reverted changesets:
1204
1205         "Enable gigacage on iOS"
1206         https://bugs.webkit.org/show_bug.cgi?id=177586
1207         http://trac.webkit.org/changeset/223015
1208
1209         "Unreviewed, disable Gigacage on ARM64 Linux"
1210         https://bugs.webkit.org/show_bug.cgi?id=177586
1211         http://trac.webkit.org/changeset/223025
1212
1213 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1214
1215         Update expectations for test262 tests that pass after r223043.
1216         https://bugs.webkit.org/show_bug.cgi?id=176685
1217
1218         Unreviewed test gardening.
1219
1220         * test262.yaml:
1221
1222 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1223
1224         Unreviewed, rolling out r223022.
1225
1226         This change introduced 18 test262 failures.
1227
1228         Reverted changeset:
1229
1230         "`async` should be able to be used as an imported binding
1231         name"
1232         https://bugs.webkit.org/show_bug.cgi?id=176573
1233         http://trac.webkit.org/changeset/223022
1234
1235 2017-10-09  Saam Barati  <sbarati@apple.com>
1236
1237         3 poly-proto JSC tests timing out on debug after r222827
1238         https://bugs.webkit.org/show_bug.cgi?id=177880
1239         <rdar://problem/34817122>
1240
1241         Unreviewed.
1242
1243         I'm skipping these type profiler tests on debug since they are long running.
1244
1245         * typeProfiler/deltablue-for-of.js:
1246         * typeProfiler/getter-richards.js:
1247
1248 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1249
1250         Safari 10 /11 problem with if (!await get(something)).
1251         https://bugs.webkit.org/show_bug.cgi?id=176685
1252
1253         Reviewed by Saam Barati.
1254
1255         * stress/async-await-basic.js:
1256         (awaitEpression.async):
1257         * stress/async-await-syntax.js:
1258         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1259         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1260
1261 2017-10-08  Saam Barati  <sbarati@apple.com>
1262
1263         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1264
1265         * typeProfiler/deltablue-for-of.js:
1266         * typeProfiler/getter-richards.js:
1267
1268 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1269
1270         `async` should be able to be used as an imported binding name
1271         https://bugs.webkit.org/show_bug.cgi?id=176573
1272
1273         Reviewed by Darin Adler.
1274
1275         * modules/import-default-async.js: Added.
1276         * modules/import-named-async-as.js: Added.
1277         * modules/import-named-async.js: Added.
1278         * modules/import-named-async/target.js: Added.
1279         * modules/import-namespace-async.js: Added.
1280
1281 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1282
1283         Enable gigacage on iOS
1284         https://bugs.webkit.org/show_bug.cgi?id=177586
1285
1286         Reviewed by JF Bastien.
1287
1288         Add tests for when Gigacage gets runtime disabled.
1289
1290         * stress/disable-gigacage-arrays.js: Added.
1291         (foo):
1292         * stress/disable-gigacage-strings.js: Added.
1293         (foo):
1294         * stress/disable-gigacage-typed-arrays.js: Added.
1295         (foo):
1296
1297 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1298
1299         Unreviewed, rolling out r222791 and r222873.
1300         https://bugs.webkit.org/show_bug.cgi?id=178031
1301
1302         Caused crashes with workers/wasm LayoutTests (Requested by
1303         ryanhaddad on #webkit).
1304
1305         Reverted changesets:
1306
1307         "WebAssembly: no VM / JS version of everything but Instance"
1308         https://bugs.webkit.org/show_bug.cgi?id=177473
1309         http://trac.webkit.org/changeset/222791
1310
1311         "WebAssembly: address no VM / JS follow-ups"
1312         https://bugs.webkit.org/show_bug.cgi?id=177887
1313         http://trac.webkit.org/changeset/222873
1314
1315 2017-10-05  Saam Barati  <sbarati@apple.com>
1316
1317         Make sure all prototypes under poly proto get added into the VM's prototype map
1318         https://bugs.webkit.org/show_bug.cgi?id=177909
1319
1320         Reviewed by Keith Miller.
1321
1322         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1323         (assert):
1324         (foo.C):
1325         (foo):
1326         (set x):
1327
1328 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1329
1330         [JSC] Introduce import.meta
1331         https://bugs.webkit.org/show_bug.cgi?id=177703
1332
1333         Reviewed by Filip Pizlo.
1334
1335         * modules/import-meta-syntax.js: Added.
1336         (shouldThrow):
1337         (shouldNotThrow):
1338         * modules/import-meta.js: Added.
1339         * modules/import-meta/cocoa.js: Added.
1340         * modules/resources/assert.js:
1341         (export.shouldNotThrow):
1342         * stress/import-syntax.js:
1343
1344 2017-10-04  Saam Barati  <sbarati@apple.com>
1345
1346         Make pertinent AccessCases watch the poly proto watchpoint
1347         https://bugs.webkit.org/show_bug.cgi?id=177765
1348
1349         Reviewed by Keith Miller.
1350
1351         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1352         (assert):
1353         (foo.C):
1354         (foo):
1355         (validate):
1356         * stress/poly-proto-clear-stub.js: Added.
1357         (assert):
1358         (foo.C):
1359         (foo):
1360
1361 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1362
1363         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1364
1365         Unreviewed test gardening.
1366
1367         * test262.yaml:
1368
1369 2017-10-04  Saam Barati  <sbarati@apple.com>
1370
1371         3 poly-proto JSC tests timing out on debug after r222827
1372         https://bugs.webkit.org/show_bug.cgi?id=177880
1373
1374         Rubber stamped by Mark Lam.
1375
1376         * microbenchmarks/poly-proto-access.js:
1377         * typeProfiler/deltablue-for-of.js:
1378         * typeProfiler/getter-richards.js:
1379
1380 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1381
1382         Unreviewed, marking tco-catch.js as a failure after test262 update
1383         https://bugs.webkit.org/show_bug.cgi?id=177859
1384
1385         * test262.yaml:
1386
1387 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1388
1389         Unreviewed, marking one async iterator test262 test failed
1390         https://bugs.webkit.org/show_bug.cgi?id=177859
1391
1392         * test262.yaml:
1393
1394 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1395
1396         [Test262] Update Test262 to Oct 4 version
1397         https://bugs.webkit.org/show_bug.cgi?id=177859
1398
1399         Reviewed by Sam Weinig.
1400
1401         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1402         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1403
1404         * test262.yaml:
1405         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1406         (checkSequence):
1407         * test262/harness/typeCoercion.js:
1408         (testCoercibleToIndexZero):
1409         (testCoercibleToIndexOne):
1410         (testCoercibleToIndexFromIndex):
1411         (testNotCoercibleToIndex.testPrimitiveValue):
1412         (testNotCoercibleToInteger):
1413         (testCoercibleToBigIntZero.testPrimitiveValue):
1414         (testCoercibleToBigIntZero):
1415         (testCoercibleToBigIntOne.testPrimitiveValue):
1416         (testCoercibleToBigIntOne):
1417         (testPrimitiveValue):
1418         (testCoercibleToBigIntFromBigInt):
1419         (testNotCoercibleToBigInt.testPrimitiveValue):
1420         (testNotCoercibleToBigInt.testStringValue):
1421         (testNotCoercibleToBigInt):
1422         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1423         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1424         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1425         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1426         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1427         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1428         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1429         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1430         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1431         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1432         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1433         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1434         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1435         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1436         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1437         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1438         (testCoercibleToBigIntZero):
1439         (testCoercibleToBigIntOne):
1440         (testNotCoercibleToBigInt):
1441         (MyError): Deleted.
1442         (valueOf): Deleted.
1443         (toString): Deleted.
1444         (Symbol.toPrimitive): Deleted.
1445         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1446         (testCoercibleToIndexZero):
1447         (testCoercibleToIndexOne):
1448         (testNotCoercibleToIndex):
1449         (MyError): Deleted.
1450         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1451         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1452         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1453         (BigInt.asIntN.valueOf): Deleted.
1454         (BigInt.asIntN.toString): Deleted.
1455         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1456         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1457         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1458         (testCoercibleToBigIntZero):
1459         (testCoercibleToBigIntOne):
1460         (testNotCoercibleToBigInt):
1461         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1462         (testCoercibleToIndexZero):
1463         (testCoercibleToIndexOne):
1464         (testNotCoercibleToIndex):
1465         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1466         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1467         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1468         (bits.valueOf):
1469         (bigint.valueOf):
1470         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1471         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1472         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1473         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1474         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1475         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1476         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1477         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1478         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1479         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1480         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1481         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1482         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1483         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1484         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1485         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1486         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1487         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1488         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1489         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1490         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1491         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1492         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1493         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1494         (replacer):
1495         (BigInt.prototype.toJSON):
1496         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1497         (replacer):
1498         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1499         (BigInt.prototype.toJSON):
1500         * test262/test/built-ins/JSON/stringify/bigint.js:
1501         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1502         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1503         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1504         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1505         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1506         * test262/test/built-ins/Object/proto-from-ctor.js:
1507         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1508         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1509         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1510         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1511         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1512         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1513         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1514         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1515         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1516         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1517         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1518         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1519         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1520         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1521         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1522         * test262/test/built-ins/Proxy/get-fn-realm.js:
1523         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1524         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1525         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1526         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1527         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1528         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1529         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1530         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1531         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1532         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1533         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1534         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1535         (i6.replace):
1536         (i6b.replace):
1537         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1538         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1539         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1540         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1541         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1542         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1543         * test262/test/built-ins/RegExp/u180e.js: Added.
1544         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1545         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1546         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1547         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1548         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1549         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1550         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1551         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1552         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1553         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1554         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1555         * test262/test/built-ins/String/prototype/endsWith/length.js:
1556         * test262/test/built-ins/String/prototype/endsWith/name.js:
1557         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1558         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1559         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1560         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1561         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1562         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1563         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1564         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1565         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1566         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1567         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1568         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1569         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1570         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1571         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1572         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1573         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1574         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1575         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1576         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1577         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1578         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1579         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1580         * test262/test/built-ins/String/prototype/includes/includes.js:
1581         * test262/test/built-ins/String/prototype/includes/length.js:
1582         * test262/test/built-ins/String/prototype/includes/name.js:
1583         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1584         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1585         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1586         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1587         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1588         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1589         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1590         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1591         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1592         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1593         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1594         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1595         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1596         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1597         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1598         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1599         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1600         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1601         * test262/test/built-ins/String/prototype/trim/u180e.js:
1602         * test262/test/built-ins/Symbol/for/cross-realm.js:
1603         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1604         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1605         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1606         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1607         * test262/test/built-ins/Symbol/match/cross-realm.js:
1608         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1609         * test262/test/built-ins/Symbol/search/cross-realm.js:
1610         * test262/test/built-ins/Symbol/species/cross-realm.js:
1611         * test262/test/built-ins/Symbol/split/cross-realm.js:
1612         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1613         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1614         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1615         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1616         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1617         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1618         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1619         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1620         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1621         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1622         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1623         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1624         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1625         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1626         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1627         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1628         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1629         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1630         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1631         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1632         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1633         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1634         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1635         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1636         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1637         * test262/test/language/eval-code/indirect/realm.js:
1638         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1639         (o.get z):
1640         (o.get a):
1641         * test262/test/language/expressions/call/eval-realm-indirect.js:
1642         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1643         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1644         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1645         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1646         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1647         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1648         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1649         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1650         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1651         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1652         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1653         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1654         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1655         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1656         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1657         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1658         * test262/test/language/expressions/less-than/bigint-and-number.js:
1659         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1660         * test262/test/language/expressions/super/realm.js:
1661         * test262/test/language/expressions/tagged-template/cache-realm.js:
1662         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1663         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1664         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1665         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1666         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1667         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1668         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1669         (o.get z):
1670         (o.get a):
1671         * test262/test/language/statements/for-of/iterator-next-reference.js:
1672         (next):
1673         (iterator.next): Deleted.
1674         (x.of.iterable.): Deleted.
1675         (x.of.iterable.get return): Deleted.
1676         (x.of.iterable.iterator.next): Deleted.
1677         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1678         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1679         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1680         * test262/test/language/white-space/mongolian-vowel-separator.js:
1681         * test262/test262-Revision.txt:
1682
1683 2017-10-03  Saam Barati  <sbarati@apple.com>
1684
1685         Implement polymorphic prototypes
1686         https://bugs.webkit.org/show_bug.cgi?id=176391
1687
1688         Reviewed by Filip Pizlo.
1689
1690         * microbenchmarks/poly-proto-access.js: Added.
1691         (assert):
1692         (foo.C):
1693         (foo.C.prototype.get bar):
1694         (foo):
1695         (bar):
1696         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1697         (assert):
1698         (makePolyProtoObject.foo.C):
1699         (makePolyProtoObject.foo):
1700         (makePolyProtoObject):
1701         (performSet):
1702         * microbenchmarks/poly-proto-setter-speed.js: Added.
1703         (assert):
1704         (makePolyProtoObject.foo.C):
1705         (makePolyProtoObject.foo.C.prototype.set p):
1706         (makePolyProtoObject.foo):
1707         (makePolyProtoObject):
1708         (performSet):
1709         * stress/constructor-with-return.js:
1710         (i.tests.forEach.Constructor):
1711         (i.tests.forEach):
1712         (tests.forEach.Constructor): Deleted.
1713         (tests.forEach): Deleted.
1714         * stress/dom-jit-with-poly-proto.js: Added.
1715         (assert):
1716         (makePolyProtoObject.foo.C):
1717         (makePolyProtoObject.foo):
1718         (makePolyProtoObject):
1719         (validate):
1720         * stress/poly-proto-custom-value-and-accessor.js: Added.
1721         (assert):
1722         (makePolyProtoObject.foo.C):
1723         (makePolyProtoObject.foo):
1724         (makePolyProtoObject):
1725         (items.forEach):
1726         (set get for):
1727         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1728         (assert):
1729         (makePolyProtoObject.foo.C):
1730         (makePolyProtoObject.foo):
1731         (makePolyProtoObject):
1732         (foo):
1733         * stress/poly-proto-miss.js: Added.
1734         (makePolyProtoInstanceWithNullPrototype.foo.C):
1735         (makePolyProtoInstanceWithNullPrototype.foo):
1736         (makePolyProtoInstanceWithNullPrototype):
1737         (assert):
1738         (validate):
1739         * stress/poly-proto-op-in-caching.js: Added.
1740         (assert):
1741         (makePolyProtoObject.foo.C):
1742         (makePolyProtoObject.foo):
1743         (makePolyProtoObject):
1744         (validate):
1745         (validate2):
1746         * stress/poly-proto-put-transition.js: Added.
1747         (assert):
1748         (makePolyProtoObject.foo.C):
1749         (makePolyProtoObject.foo):
1750         (makePolyProtoObject):
1751         (performSet):
1752         (i.obj.__proto__.set p):
1753         * stress/poly-proto-set-prototype.js: Added.
1754         (assert):
1755         (let.alternateProto.get x):
1756         (let.alternateProto2.get y):
1757         (let.alternateProto2.get x):
1758         (foo.C):
1759         (foo):
1760         (validate):
1761         * stress/poly-proto-setter.js: Added.
1762         (assert):
1763         (makePolyProtoObject.foo.C):
1764         (makePolyProtoObject.foo.C.prototype.set p):
1765         (makePolyProtoObject.foo.C.prototype.get p):
1766         (makePolyProtoObject.foo):
1767         (makePolyProtoObject):
1768         (performSet):
1769         * stress/poly-proto-using-inheritance.js: Added.
1770         (assert):
1771         (foo.C):
1772         (foo.C.prototype.get baz):
1773         (foo):
1774         (bar.C):
1775         (bar):
1776         (validate):
1777         * stress/primitive-poly-proto.js: Added.
1778         (makePolyProtoInstance.foo.C):
1779         (makePolyProtoInstance.foo):
1780         (makePolyProtoInstance):
1781         (assert):
1782         (validate):
1783         * stress/prototype-is-not-js-object.js: Added.
1784         (foo.bar):
1785         (foo):
1786         (assert):
1787         (validate):
1788         * stress/try-get-by-id-poly-proto.js: Added.
1789         (assert):
1790         (makePolyProtoObject.foo.C):
1791         (makePolyProtoObject.foo):
1792         (makePolyProtoObject):
1793         (tryGetByIdText):
1794         (x.__proto__.get bar):
1795         (validate):
1796         * typeProfiler/overflow.js:
1797
1798 2017-10-03  JF Bastien  <jfbastien@apple.com>
1799
1800         WebAssembly: no VM / JS version of everything but Instance
1801         https://bugs.webkit.org/show_bug.cgi?id=177473
1802
1803         Reviewed by Filip Pizlo.
1804
1805         - Exceeding max on memory growth now returns a range error as per
1806         spec. This is a (very minor) breaking change: it used to throw OOM
1807         error. Update the corresponding test.
1808
1809         * wasm/js-api/memory-grow.js:
1810         (assertEq):
1811         * wasm/js-api/table.js:
1812         (assert.throws):
1813
1814 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1815
1816         Skip JSC test stress/regress-159779-2.js on debug.
1817         https://bugs.webkit.org/show_bug.cgi?id=177204
1818
1819         Unreviewed test gardening.
1820
1821         * stress/regress-159779-2.js:
1822
1823 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1824
1825         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1826         https://bugs.webkit.org/show_bug.cgi?id=175642
1827
1828         Reviewed by Darin Adler.
1829
1830         * ChakraCore/test/Function/apply3.baseline-jsc:
1831
1832 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1833
1834         Unreviewed, rolling out r222564.
1835         https://bugs.webkit.org/show_bug.cgi?id=177720
1836
1837         "It regressed JetStream by 2% on iOS caused by a 50%
1838         regression on the bigfib subtest" (Requested by saamyjoon on
1839         #webkit).
1840
1841         Reverted changeset:
1842
1843         "Add Above/Below comparisons for UInt32 patterns"
1844         https://bugs.webkit.org/show_bug.cgi?id=177281
1845         http://trac.webkit.org/changeset/222564
1846
1847 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1848
1849         [DFG] Support ArrayPush with multiple args
1850         https://bugs.webkit.org/show_bug.cgi?id=175823
1851
1852         Reviewed by Saam Barati.
1853
1854         * microbenchmarks/array-push-0.js: Added.
1855         (arrayPush0):
1856         * microbenchmarks/array-push-1.js: Added.
1857         (arrayPush1):
1858         * microbenchmarks/array-push-2.js: Added.
1859         (arrayPush2):
1860         * microbenchmarks/array-push-3.js: Added.
1861         (arrayPush3):
1862         * stress/array-push-multiple-contiguous.js: Added.
1863         (shouldBe):
1864         (test):
1865         * stress/array-push-multiple-double-nan.js: Added.
1866         (shouldBe):
1867         (test):
1868         * stress/array-push-multiple-double.js: Added.
1869         (shouldBe):
1870         (test):
1871         * stress/array-push-multiple-int32.js: Added.
1872         (shouldBe):
1873         (test):
1874         * stress/array-push-multiple-many-contiguous.js: Added.
1875         (shouldBe):
1876         (test):
1877         * stress/array-push-multiple-many-double.js: Added.
1878         (shouldBe):
1879         (test):
1880         * stress/array-push-multiple-many-int32.js: Added.
1881         (shouldBe):
1882         (test):
1883         * stress/array-push-multiple-many-storage.js: Added.
1884         (shouldBe):
1885         (test):
1886         * stress/array-push-multiple-storage.js: Added.
1887         (shouldBe):
1888         (test):
1889         * stress/array-push-with-force-exit.js: Added.
1890         (target.createBuiltin):
1891
1892 2017-09-29  Saam Barati  <sbarati@apple.com>
1893
1894         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1895         https://bugs.webkit.org/show_bug.cgi?id=177639
1896
1897         Reviewed by Geoffrey Garen.
1898
1899         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1900         (assert):
1901         (Class):
1902         (items.forEach):
1903         (set get for):
1904
1905 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1906
1907         Unreviewed, rolling out r222563, r222565, and r222581.
1908         https://bugs.webkit.org/show_bug.cgi?id=177675
1909
1910         "It causes a crash when playing youtube videos" (Requested by
1911         saamyjoon on #webkit).
1912
1913         Reverted changesets:
1914
1915         "[DFG] Support ArrayPush with multiple args"
1916         https://bugs.webkit.org/show_bug.cgi?id=175823
1917         http://trac.webkit.org/changeset/222563
1918
1919         "Unreviewed, build fix after r222563"
1920         https://bugs.webkit.org/show_bug.cgi?id=175823
1921         http://trac.webkit.org/changeset/222565
1922
1923         "Unreviewed, fix x86 breaking due to exhausted registers"
1924         https://bugs.webkit.org/show_bug.cgi?id=175823
1925         http://trac.webkit.org/changeset/222581
1926
1927 2017-09-28  Mark Lam  <mark.lam@apple.com>
1928
1929         test262: Unexpected passes after r222617 and r222618.
1930         https://bugs.webkit.org/show_bug.cgi?id=177622
1931         <rdar://problem/34725960>
1932
1933         Reviewed by Saam Barati.
1934
1935         Update test262.yaml for tests that are now passing.
1936
1937         * test262.yaml:
1938
1939 2017-09-27  Michael Saboff  <msaboff@apple.com>
1940
1941         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1942         https://bugs.webkit.org/show_bug.cgi?id=177570
1943
1944         Reviewed by Filip Pizlo.
1945
1946         New regression test.
1947
1948         * stress/regress-177570.js: Added.
1949
1950 2017-09-28  Michael Saboff  <msaboff@apple.com>
1951
1952         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1953         https://bugs.webkit.org/show_bug.cgi?id=177423
1954
1955         Reviewed by Mark Lam.
1956
1957         Updated regression test.
1958
1959         * stress/regress-177423.js:
1960         (catch):
1961
1962 2017-09-27  Mark Lam  <mark.lam@apple.com>
1963
1964         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1965         https://bugs.webkit.org/show_bug.cgi?id=177584
1966         <rdar://problem/34463903>
1967
1968         Reviewed by Saam Barati.
1969
1970         * stress/regress-177584.js: Added.
1971         (assertEqual):
1972         (Array.prototype.Symbol.species):
1973
1974 2017-09-27  Saam Barati  <sbarati@apple.com>
1975
1976         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1977         https://bugs.webkit.org/show_bug.cgi?id=177523
1978
1979         Reviewed by Mark Lam.
1980
1981         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1982         (assert):
1983         (Test):
1984         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1985         (addMethods):
1986         (i.Test.prototype.propName):
1987
1988 2017-09-27  Mark Lam  <mark.lam@apple.com>
1989
1990         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1991         https://bugs.webkit.org/show_bug.cgi?id=177423
1992         <rdar://problem/34621320>
1993
1994         Reviewed by Keith Miller.
1995
1996         * stress/regress-177423.js: Added.
1997
1998 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1999
2000         Add Above/Below comparisons for UInt32 patterns
2001         https://bugs.webkit.org/show_bug.cgi?id=177281
2002
2003         Reviewed by Saam Barati.
2004
2005         * stress/uint32-comparison-jump.js: Added.
2006         (shouldBe):
2007         (above):
2008         (aboveOrEqual):
2009         (below):
2010         (belowOrEqual):
2011         (notAbove):
2012         (notAboveOrEqual):
2013         (notBelow):
2014         (notBelowOrEqual):
2015         * stress/uint32-comparison.js: Added.
2016         (shouldBe):
2017         (above):
2018         (aboveOrEqual):
2019         (below):
2020         (belowOrEqual):
2021         (aboveTest):
2022         (aboveOrEqualTest):
2023         (belowTest):
2024         (belowOrEqualTest):
2025
2026 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2027
2028         [DFG] Support ArrayPush with multiple args
2029         https://bugs.webkit.org/show_bug.cgi?id=175823
2030
2031         Reviewed by Saam Barati.
2032
2033         * microbenchmarks/array-push-0.js: Added.
2034         (arrayPush0):
2035         * microbenchmarks/array-push-1.js: Added.
2036         (arrayPush1):
2037         * microbenchmarks/array-push-2.js: Added.
2038         (arrayPush2):
2039         * microbenchmarks/array-push-3.js: Added.
2040         (arrayPush3):
2041         * stress/array-push-multiple-contiguous.js: Added.
2042         (shouldBe):
2043         (test):
2044         * stress/array-push-multiple-double-nan.js: Added.
2045         (shouldBe):
2046         (test):
2047         * stress/array-push-multiple-double.js: Added.
2048         (shouldBe):
2049         (test):
2050         * stress/array-push-multiple-int32.js: Added.
2051         (shouldBe):
2052         (test):
2053         * stress/array-push-multiple-many-contiguous.js: Added.
2054         (shouldBe):
2055         (test):
2056         * stress/array-push-multiple-many-double.js: Added.
2057         (shouldBe):
2058         (test):
2059         * stress/array-push-multiple-many-int32.js: Added.
2060         (shouldBe):
2061         (test):
2062         * stress/array-push-multiple-many-storage.js: Added.
2063         (shouldBe):
2064         (test):
2065         * stress/array-push-multiple-storage.js: Added.
2066         (shouldBe):
2067         (test):
2068
2069 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2070
2071         Unreviewed, rolling out r222518.
2072         https://bugs.webkit.org/show_bug.cgi?id=177507
2073
2074         Break the High Sierra build (Requested by yusukesuzuki on
2075         #webkit).
2076
2077         Reverted changeset:
2078
2079         "Add Above/Below comparisons for UInt32 patterns"
2080         https://bugs.webkit.org/show_bug.cgi?id=177281
2081         http://trac.webkit.org/changeset/222518
2082
2083 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2084
2085         Add Above/Below comparisons for UInt32 patterns
2086         https://bugs.webkit.org/show_bug.cgi?id=177281
2087
2088         Reviewed by Saam Barati.
2089
2090         * stress/uint32-comparison-jump.js: Added.
2091         (shouldBe):
2092         (above):
2093         (aboveOrEqual):
2094         (below):
2095         (belowOrEqual):
2096         (notAbove):
2097         (notAboveOrEqual):
2098         (notBelow):
2099         (notBelowOrEqual):
2100         * stress/uint32-comparison.js: Added.
2101         (shouldBe):
2102         (above):
2103         (aboveOrEqual):
2104         (below):
2105         (belowOrEqual):
2106         (aboveTest):
2107         (aboveOrEqualTest):
2108         (belowTest):
2109         (belowOrEqualTest):
2110
2111 2017-09-23  Keith Miller  <keith_miller@apple.com>
2112
2113         Fix infinite looping test262 test
2114         https://bugs.webkit.org/show_bug.cgi?id=177412
2115
2116         Reviewed by Yusuke Suzuki.
2117
2118         This test was poorly designed since failing it would cause the vm
2119         to inifinite loop. I've fixed it locally and will fix it on github pending
2120         the results of next weeks tc39 meeting.
2121
2122         * test262.yaml:
2123         * test262/test/language/statements/for-of/iterator-next-reference.js:
2124
2125 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2126
2127         test262: $.agent became $262.agent in test262 update
2128         https://bugs.webkit.org/show_bug.cgi?id=177407
2129
2130         Reviewed by Yusuke Suzuki.
2131
2132         * test262.yaml:
2133         ~320 tests pass now that we correctly make $262 available.
2134
2135 2017-09-22  Keith Miller  <keith_miller@apple.com>
2136
2137         Speculatively change iteration protocall to use the same next function
2138         https://bugs.webkit.org/show_bug.cgi?id=175653
2139
2140         Reviewed by Saam Barati.
2141
2142         Change test to match the new iteration behavior.
2143
2144         * stress/spread-optimized-properly.js:
2145
2146 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2147
2148         [DFG][FTL] Profile array vector length for array allocation
2149         https://bugs.webkit.org/show_bug.cgi?id=177051
2150
2151         Reviewed by Saam Barati.
2152
2153         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2154         (target):
2155
2156 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2157
2158         Unreviewed, rolling out r222380.
2159         https://bugs.webkit.org/show_bug.cgi?id=177352
2160
2161         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2162         #webkit).
2163
2164         Reverted changeset:
2165
2166         "[DFG][FTL] Profile array vector length for array allocation"
2167         https://bugs.webkit.org/show_bug.cgi?id=177051
2168         http://trac.webkit.org/changeset/222380
2169
2170 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2171
2172         [DFG][FTL] Profile array vector length for array allocation
2173         https://bugs.webkit.org/show_bug.cgi?id=177051
2174
2175         Reviewed by Saam Barati.
2176
2177         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2178         (target):
2179
2180 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2181
2182         Skip new hanging test262 tests.
2183         https://bugs.webkit.org/show_bug.cgi?id=177326
2184
2185         Unreviewed test gardening.
2186
2187         * test262.yaml:
2188
2189 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2190
2191         Mark 6 test262 tests as passing.
2192         https://bugs.webkit.org/show_bug.cgi?id=177307
2193
2194         Unreviewed test gardening.
2195
2196         * test262.yaml:
2197
2198 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2199
2200         Unreviewed follow-up to r222311.
2201
2202         * test262/harness/sta.js:
2203         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2204         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2205         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2206         * test262/test/built-ins/Array/from/elements-added-after.js:
2207         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2208         * test262/test/built-ins/Array/from/elements-updated-after.js:
2209         * test262/test/built-ins/Array/from/from-array.js:
2210         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2211         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2212         * test262/test/built-ins/Array/from/source-array-boundary.js:
2213         * test262/test/built-ins/Array/from/source-object-constructor.js:
2214         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2215         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2216         * test262/test/built-ins/Array/from/source-object-length.js:
2217         * test262/test/built-ins/Array/from/source-object-missing.js:
2218         * test262/test/built-ins/Array/from/source-object-without.js:
2219         * test262/test/built-ins/Array/from/this-null.js:
2220         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2221         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2222         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2223         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2224         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2225         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2226         * test262/test/language/literals/string/7.8.4-1gs.js:
2227         Fix some files that I failed to update when I applied my patch.
2228
2229 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2230
2231         Update test262 tests
2232         https://bugs.webkit.org/show_bug.cgi?id=177220
2233
2234         Reviewed by Saam Barati and Yusuke Suzuki.
2235
2236         * test262.yaml:
2237         * test262/test262-Revision.txt:
2238         New rebaselined expectations for all tests.
2239
2240         * test262/*:
2241         Updated.
2242
2243 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2244
2245         [DFG] Remove ToThis more aggressively
2246         https://bugs.webkit.org/show_bug.cgi?id=177056
2247
2248         Reviewed by Saam Barati.
2249
2250         * stress/generator-with-this-strict.js: Added.
2251         (shouldBe):
2252         (generator):
2253         (target):
2254         * stress/generator-with-this.js: Added.
2255         (shouldBe):
2256         (generator):
2257         (target):
2258
2259 2017-09-17  Michael Saboff  <msaboff@apple.com>
2260
2261         https://bugs.webkit.org/show_bug.cgi?id=177038
2262         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2263
2264         Reviewed by JF Bastien.
2265
2266         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2267         as it dies using too much memory.
2268
2269 2017-09-15  Saam Barati  <sbarati@apple.com>
2270
2271         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2272         https://bugs.webkit.org/show_bug.cgi?id=176981
2273
2274         Reviewed by Yusuke Suzuki.
2275
2276         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2277         (assert):
2278         (verify):
2279         (func):
2280         (const.bar.createBuiltin):
2281
2282 2017-09-14  Saam Barati  <sbarati@apple.com>
2283
2284         It should be valid to exit before each set when doing arity fixup when inlining
2285         https://bugs.webkit.org/show_bug.cgi?id=176948
2286
2287         Reviewed by Keith Miller.
2288
2289         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2290         (baz):
2291         (bar):
2292         (foo):
2293
2294 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2295
2296         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2297         https://bugs.webkit.org/show_bug.cgi?id=176867
2298
2299         Reviewed by Sam Weinig.
2300
2301         * microbenchmarks/object-get-own-property-symbols.js: Added.
2302         (test):
2303
2304 2017-09-13  Mark Lam  <mark.lam@apple.com>
2305
2306         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2307         https://bugs.webkit.org/show_bug.cgi?id=176888
2308         <rdar://problem/34381832>
2309
2310         Not reviewed.
2311
2312         * stress/op_mod-ConstVar.js:
2313         * stress/op_mod-VarConst.js:
2314         * stress/op_mod-VarVar.js:
2315
2316 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2317
2318         Skip 3 op_mod tests on Debug JSC bots.
2319         https://bugs.webkit.org/show_bug.cgi?id=176630
2320
2321         Unreviewed test gardening.
2322
2323         * stress/op_mod-ConstVar.js:
2324         * stress/op_mod-VarConst.js:
2325         * stress/op_mod-VarVar.js:
2326
2327 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2328
2329         [JSC] Fix Array allocation in Object.keys
2330         https://bugs.webkit.org/show_bug.cgi?id=176826
2331
2332         Reviewed by Saam Barati.
2333
2334         * stress/object-own-property-keys.js: Added.
2335         (shouldBe):
2336
2337 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2338
2339         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2340         https://bugs.webkit.org/show_bug.cgi?id=176010
2341
2342         Reviewed by Filip Pizlo.
2343
2344         * microbenchmarks/weak-map-key.js: Added.
2345         (assert):
2346         (objectKey):
2347         (let.start.Date.now):
2348
2349 2017-09-12  Mark Lam  <mark.lam@apple.com>
2350
2351         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2352         https://bugs.webkit.org/show_bug.cgi?id=176630
2353
2354         Reviewed by JF Bastien.
2355
2356         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2357         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2358         a speculative fix for the bots that are seeing these fail.
2359
2360         I also undid the skipping of the op_mod tests for debug builds.
2361
2362         * stress/op_div-ConstVar.js:
2363         * stress/op_div-VarConst.js:
2364         * stress/op_div-VarVar.js:
2365         * stress/op_mod-ConstVar.js:
2366         * stress/op_mod-VarConst.js:
2367         * stress/op_mod-VarVar.js:
2368
2369 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2370
2371         Skip stress/value-to-boolean.js on Debug bots.
2372         https://bugs.webkit.org/show_bug.cgi?id=176787
2373
2374         Unreviewed test gardening.
2375
2376         * stress/value-to-boolean.js:
2377
2378 2017-09-11  Mark Lam  <mark.lam@apple.com>
2379
2380         Change test expectation for test262/test/language/statements/try/tco-catch.js
2381         https://bugs.webkit.org/show_bug.cgi?id=176749
2382
2383         Rubber stamped by Keith Miller.
2384
2385         It's been failing since at least r221821.  I'm changing the test expectation to
2386         fail to green the bots while I investigate some more.
2387
2388         * test262.yaml:
2389
2390 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2391
2392         Unreviewed, rolling out r221854.
2393
2394         The test added with this change fails on 32-bit JSC bots.
2395
2396         Reverted changeset:
2397
2398         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2399         https://bugs.webkit.org/show_bug.cgi?id=176010
2400         http://trac.webkit.org/changeset/221854
2401
2402 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2403
2404         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2405         https://bugs.webkit.org/show_bug.cgi?id=176010
2406
2407         Reviewed by Filip Pizlo.
2408
2409         * microbenchmarks/weak-map-key.js: Added.
2410         (assert):
2411         (objectKey):
2412         (let.start.Date.now):
2413
2414 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2415
2416         [JSC] Optimize Object.keys by using careful array allocation
2417         https://bugs.webkit.org/show_bug.cgi?id=176654
2418
2419         Reviewed by Darin Adler.
2420
2421         * microbenchmarks/object-keys.js: Added.
2422         (test):
2423
2424 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2425
2426         Error should compute .stack and friends lazily
2427         https://bugs.webkit.org/show_bug.cgi?id=176645
2428
2429         Reviewed by Saam Barati.
2430
2431         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2432         * microbenchmarks/new-error.js: Added.
2433         * microbenchmarks/throw.js: Added.
2434
2435 2017-09-09  Mark Lam  <mark.lam@apple.com>
2436
2437         [Re-landing] Use JIT probes for DFG OSR exit.
2438         https://bugs.webkit.org/show_bug.cgi?id=175144
2439         <rdar://problem/33437050>
2440
2441         Not reviewed.  Original patch reviewed by Saam Barati.
2442
2443         Disable these tests for debug builds because they run too slow with the new OSR exit.
2444
2445         * stress/op_mod-ConstVar.js:
2446         * stress/op_mod-VarConst.js:
2447         * stress/op_mod-VarVar.js:
2448
2449 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2450
2451         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2452         https://bugs.webkit.org/show_bug.cgi?id=176300
2453
2454         Reviewed by Saam Barati.
2455
2456         * stress/new-array-with-size-div.js: Added.
2457         (shouldBe):
2458         (test):
2459         (i.i):
2460
2461 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2462
2463         [DFG] PutByVal with Array::Generic is too generic
2464         https://bugs.webkit.org/show_bug.cgi?id=176345
2465
2466         Reviewed by Filip Pizlo.
2467
2468         * stress/object-assign-symbols.js: Added.
2469         (shouldBe):
2470         (test):
2471         * stress/object-assign.js: Added.
2472         (shouldBe):
2473         (test):
2474         (i.shouldBe.JSON.stringify.test):
2475
2476 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2477
2478         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2479         https://bugs.webkit.org/show_bug.cgi?id=176590
2480
2481         Reviewed by Saam Barati.
2482
2483         * microbenchmarks/object-iterate-symbols.js: Added.
2484         (test):
2485         * microbenchmarks/object-iterate.js: Added.
2486         (test):
2487         * stress/object-iterate-symbols.js: Added.
2488         (shouldBe):
2489         (test):
2490         * stress/object-iterate.js: Added.
2491         (shouldBe):
2492         (test):
2493
2494 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2495
2496         [Win32] 10 JSC stress tests are failing.
2497         https://bugs.webkit.org/show_bug.cgi?id=176538
2498
2499         Reviewed by Mark Lam.
2500
2501         Skip tests on Windows to make the bots green.
2502
2503         * ChakraCore.yaml:
2504         * stress/date-relaxed.js:
2505
2506 2017-09-06  Mark Lam  <mark.lam@apple.com>
2507
2508         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2509         https://bugs.webkit.org/show_bug.cgi?id=176485
2510         <rdar://problem/33898874>
2511
2512         Reviewed by Keith Miller.
2513
2514         * stress/regress-176485.js: Added.
2515
2516 2017-09-05  Saam Barati  <sbarati@apple.com>
2517
2518         isNotCellSpeculation is wrong with respect to SpecEmpty
2519         https://bugs.webkit.org/show_bug.cgi?id=176429
2520
2521         Reviewed by Michael Saboff.
2522
2523         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2524         (Foo):
2525
2526 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2527
2528         test262: Completion values for control flow do not match the spec
2529         https://bugs.webkit.org/show_bug.cgi?id=171265
2530
2531         Reviewed by Saam Barati.
2532
2533         * stress/completion-value.js:
2534         Condensed test for completion values in top level statements.
2535
2536         * stress/super-get-by-id.js:
2537         ClassDeclaration when evaled no longer produce values. Convert
2538         these to ClassExpressions so they produce the class value.
2539
2540         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2541         This is a progression for currect spec behavior.
2542
2543         * mozilla/mozilla-tests.yaml:
2544         This test is now outdated, so mark it as failing for that reason.
2545
2546         * test262.yaml:
2547         Passing all "cptn" completion value tests.
2548
2549 2017-09-04  Saam Barati  <sbarati@apple.com>
2550
2551         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2552         https://bugs.webkit.org/show_bug.cgi?id=176317
2553
2554         Reviewed by Keith Miller.
2555
2556         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2557         (Foo):
2558
2559 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2560
2561         [DFG][FTL] Efficiently execute number#toString()
2562         https://bugs.webkit.org/show_bug.cgi?id=170007
2563
2564         Reviewed by Keith Miller.
2565
2566         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2567         (test):
2568         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2569         (test):
2570         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2571         (test):
2572         * microbenchmarks/number-to-string-with-radix.js: Added.
2573         (test):
2574         * stress/number-to-string-strength-reduction.js: Added.
2575         (shouldBe):
2576         (test):
2577         * stress/number-to-string-with-radix-10.js: Added.
2578         (shouldBe):
2579         (test):
2580         * stress/number-to-string-with-radix-cse.js: Added.
2581         (shouldBe):
2582         (test):
2583         * stress/number-to-string-with-radix-invalid.js: Added.
2584         (shouldThrow):
2585         * stress/number-to-string-with-radix-watchpoint.js: Added.
2586         (shouldBe):
2587         (test):
2588         (i.i.1e3.Number.prototype.toString):
2589         * stress/number-to-string-with-radix.js: Added.
2590         (shouldBe):
2591         (test):
2592
2593 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2594
2595         [DFG] Relax arity requirement
2596         https://bugs.webkit.org/show_bug.cgi?id=175523
2597
2598         Reviewed by Saam Barati.
2599
2600         * stress/arity-mismatch-arguments-length.js: Added.
2601         (shouldBe):
2602         (test1):
2603         (test):
2604         * stress/arity-mismatch-get-argument.js: Added.
2605         (shouldBe):
2606         (builtin.createBuiltin):
2607         (test):
2608         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2609         (shouldBe):
2610         (inlineTarget):
2611         (test):
2612         * stress/arity-mismatch-inlining.js: Added.
2613         (shouldBe):
2614         (inlineTarget):
2615         (test):
2616         * stress/arity-mismatch-rest.js: Added.
2617         (shouldBe):
2618         (test2):
2619         (test1):
2620         (test):
2621
2622 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2623
2624         [JSC] Fix "name" and "length" of Proxy revoke function
2625         https://bugs.webkit.org/show_bug.cgi?id=176155
2626
2627         Reviewed by Mark Lam.
2628
2629         * test262.yaml:
2630
2631 2017-08-31  Saam Barati  <sbarati@apple.com>
2632
2633         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2634         https://bugs.webkit.org/show_bug.cgi?id=176206
2635
2636         Reviewed by Keith Miller.
2637
2638         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2639         (a):
2640         (b):
2641         (foo):
2642
2643 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2644
2645         Skip two slow JSC tests after r221422.
2646
2647         Unreviewed test gardening.
2648
2649         * stress/regexp-prototype-match-on-too-long-rope.js:
2650         * stress/regexp-prototype-test-on-too-long-rope.js:
2651
2652 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2653
2654         Unreviewed, skipping slow tests.
2655
2656         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2657         work differently now.
2658
2659         * stress/regexp-prototype-exec-on-too-long-rope.js:
2660         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2661
2662 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2663
2664         [JSC] Use reifying system for "name" property of builtin JSFunction
2665         https://bugs.webkit.org/show_bug.cgi?id=175260
2666
2667         Reviewed by Saam Barati.
2668
2669         * stress/accessors-get-set-prefix.js:
2670         * stress/builtin-function-name.js: Added.
2671         (shouldBe):
2672         (shouldThrow):
2673         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2674         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2675         * stress/private-name-as-anonymous-builtin.js: Added.
2676         (shouldBe):
2677         (NotPromise):
2678
2679 2017-08-30  Saam Barati  <sbarati@apple.com>
2680
2681         Unreviewed. Make test stop printing.
2682
2683         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2684
2685 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2686
2687         Unreviewed, rolling out r221327.
2688
2689         This change caused test262 failures.
2690
2691         Reverted changeset:
2692
2693         "[JSC] Use reifying system for "name" property of builtin
2694         JSFunction"
2695         https://bugs.webkit.org/show_bug.cgi?id=175260
2696         http://trac.webkit.org/changeset/221327
2697
2698 2017-08-30  Saam Barati  <sbarati@apple.com>
2699
2700         semicolon is being interpreted as an = in the LiteralParser
2701         https://bugs.webkit.org/show_bug.cgi?id=176114
2702
2703         Reviewed by Oliver Hunt.
2704
2705         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2706         * stress/resources/literal-parser-test-case.js: Added.
2707
2708 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2709
2710         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2711         https://bugs.webkit.org/show_bug.cgi?id=166698
2712
2713         Reviewed by Yusuke Suzuki.
2714
2715         * stress/async-iteration-for-await-of-syntax.js: Added.
2716         (assert):
2717         (checkSyntax):
2718         (checkSyntaxError):
2719         (checkSimpleAsyncGeneratorSloppyMode):
2720         (checkSimpleAsyncGeneratorStrictMode):
2721         (checkNestedAsyncGenerators):
2722         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2723         * stress/async-iteration-for-await-of.js: Added.
2724         (assert):
2725         (async.foo):
2726         (async.boo):
2727         (const.boo.async):
2728
2729 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2730
2731         [JSC] Use reifying system for "name" property of builtin JSFunction
2732         https://bugs.webkit.org/show_bug.cgi?id=175260
2733
2734         Reviewed by Saam Barati.
2735
2736         * stress/accessors-get-set-prefix.js:
2737         * stress/builtin-function-name.js: Added.
2738         (shouldBe):
2739         (shouldThrow):
2740         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2741         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2742
2743 2017-08-25  Saam Barati  <sbarati@apple.com>
2744
2745         Support compiling catch in the DFG
2746         https://bugs.webkit.org/show_bug.cgi?id=174590
2747         <rdar://problem/34047845>
2748
2749         Reviewed by Filip Pizlo.
2750
2751         * microbenchmarks/delta-blue-try-catch.js: Added.
2752         (exception):
2753         (value):
2754         (OrderedCollection):
2755         (OrderedCollection.prototype.add):
2756         (OrderedCollection.prototype.at):
2757         (OrderedCollection.prototype.size):
2758         (OrderedCollection.prototype.removeFirst):
2759         (OrderedCollection.prototype.remove):
2760         (Strength):
2761         (Strength.stronger):
2762         (Strength.weaker):
2763         (Strength.weakestOf):
2764         (Strength.strongest):
2765         (Strength.prototype.nextWeaker):
2766         (Constraint):
2767         (Constraint.prototype.addConstraint):
2768         (Constraint.prototype.satisfy):
2769         (Constraint.prototype.destroyConstraint):
2770         (Constraint.prototype.isInput):
2771         (UnaryConstraint):
2772         (UnaryConstraint.prototype.addToGraph):
2773         (UnaryConstraint.prototype.chooseMethod):
2774         (UnaryConstraint.prototype.isSatisfied):
2775         (UnaryConstraint.prototype.markInputs):
2776         (UnaryConstraint.prototype.output):
2777         (UnaryConstraint.prototype.recalculate):
2778         (UnaryConstraint.prototype.markUnsatisfied):
2779         (UnaryConstraint.prototype.inputsKnown):
2780         (UnaryConstraint.prototype.removeFromGraph):
2781         (StayConstraint):
2782         (StayConstraint.prototype.execute):
2783         (EditConstraint.prototype.isInput):
2784         (EditConstraint.prototype.execute):
2785         (BinaryConstraint):
2786         (BinaryConstraint.prototype.chooseMethod):
2787         (BinaryConstraint.prototype.addToGraph):
2788         (BinaryConstraint.prototype.isSatisfied):
2789         (BinaryConstraint.prototype.markInputs):
2790         (BinaryConstraint.prototype.input):
2791         (BinaryConstraint.prototype.output):
2792         (BinaryConstraint.prototype.recalculate):
2793         (BinaryConstraint.prototype.markUnsatisfied):
2794         (BinaryConstraint.prototype.inputsKnown):
2795         (BinaryConstraint.prototype.removeFromGraph):
2796         (ScaleConstraint):
2797         (ScaleConstraint.prototype.addToGraph):
2798         (ScaleConstraint.prototype.removeFromGraph):
2799         (ScaleConstraint.prototype.markInputs):
2800         (ScaleConstraint.prototype.execute):
2801         (ScaleConstraint.prototype.recalculate):
2802         (EqualityConstraint):
2803         (EqualityConstraint.prototype.execute):
2804         (Variable):
2805         (Variable.prototype.addConstraint):
2806         (Variable.prototype.removeConstraint):
2807         (Planner):
2808         (Planner.prototype.incrementalAdd):
2809         (Planner.prototype.incrementalRemove):
2810         (Planner.prototype.newMark):
2811         (Planner.prototype.makePlan):
2812         (Planner.prototype.extractPlanFromConstraints):
2813         (Planner.prototype.addPropagate):
2814         (Planner.prototype.removePropagateFrom):
2815         (Planner.prototype.addConstraintsConsumingTo):
2816         (Plan):
2817         (Plan.prototype.addConstraint):
2818         (Plan.prototype.size):
2819         (Plan.prototype.constraintAt):
2820         (Plan.prototype.execute):
2821         (chainTest):
2822         (projectionTest):
2823         (change):
2824         (deltaBlue):
2825         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2826         (assert):
2827         (Numbers):
2828         (Numbers.prototype.next):
2829         (return.Transpose):
2830         (return.Transpose.prototype.next):
2831         (transpose):
2832         (verifyEven):
2833         (verifyString):
2834         (foo):
2835         (runIterators):
2836         * microbenchmarks/try-catch-word-count.js: Added.
2837         (let.assert):
2838         (EOF):
2839         (let.texts):
2840         (let.o.apply):
2841         (foo):
2842         (bar):
2843         (f):
2844         (run):
2845         (test1):
2846         (test2):
2847         (test3):
2848         (fn):
2849         (A):
2850         (B):
2851         (A.prototype.getValue):
2852         (B.prototype.getParentValue):
2853         (strlen):
2854         (sum.0):
2855         (test):
2856         (result.test.o):
2857         (set add.set add):
2858         (set forEach):
2859         (stringHash):
2860         (set if):
2861         (testFunction):
2862         (set delete.set has.set add):
2863         * stress/catch-set-argument-speculation-failure.js: Added.
2864         (o):
2865         (e):
2866         (e2):
2867         (escape):
2868         (baz):
2869         (noInline.run):
2870         (noInline):
2871         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2872         (foo):
2873         (e):
2874         (baz):
2875         (bar):
2876
2877 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2878
2879         Unreviewed, rolling out r221119, r221124, and r221143.
2880         https://bugs.webkit.org/show_bug.cgi?id=175973
2881
2882         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2883         on #webkit).
2884
2885         Reverted changesets:
2886
2887         "Support compiling catch in the DFG"
2888         https://bugs.webkit.org/show_bug.cgi?id=174590
2889         http://trac.webkit.org/changeset/221119
2890
2891         "Unreviewed, build fix in GTK port"
2892         https://bugs.webkit.org/show_bug.cgi?id=174590
2893         http://trac.webkit.org/changeset/221124
2894
2895         "DFG::JITCode::osrEntry should get sorted since we perform a
2896         binary search on it"
2897         https://bugs.webkit.org/show_bug.cgi?id=175893
2898         http://trac.webkit.org/changeset/221143
2899
2900 2017-08-24  Michael Saboff  <msaboff@apple.com>
2901
2902         Add support for RegExp "dotAll" flag
2903         https://bugs.webkit.org/show_bug.cgi?id=175924
2904
2905         Reviewed by Keith Miller.
2906
2907         Updated tests for new dotAll ('s' flag) changes.
2908
2909         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2910         * stress/static-getter-in-names.js:
2911
2912 2017-08-24  Mark Lam  <mark.lam@apple.com>
2913
2914         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2915         https://bugs.webkit.org/show_bug.cgi?id=175940
2916         <rdar://problem/29003921>
2917
2918         Reviewed by Saam Barati.
2919
2920         * stress/regress-164081.js: Added.
2921         (shouldEqual):
2922         (testcase):
2923
2924 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2925
2926         Skip flaky JSC test stress/test-finally.js.
2927         https://bugs.webkit.org/show_bug.cgi?id=160283
2928
2929         Unreviewed test gardening.
2930
2931         * stress/test-finally.js:
2932
2933 2017-08-23  Saam Barati  <sbarati@apple.com>
2934
2935         Support compiling catch in the DFG
2936         https://bugs.webkit.org/show_bug.cgi?id=174590
2937
2938         Reviewed by Filip Pizlo.
2939
2940         * microbenchmarks/delta-blue-try-catch.js: Added.
2941         (exception):
2942         (value):
2943         (OrderedCollection):
2944         (OrderedCollection.prototype.add):
2945         (OrderedCollection.prototype.at):
2946         (OrderedCollection.prototype.size):
2947         (OrderedCollection.prototype.removeFirst):
2948         (OrderedCollection.prototype.remove):
2949         (Strength):
2950         (Strength.stronger):
2951         (Strength.weaker):
2952         (Strength.weakestOf):
2953         (Strength.strongest):
2954         (Strength.prototype.nextWeaker):
2955         (Constraint):
2956         (Constraint.prototype.addConstraint):
2957         (Constraint.prototype.satisfy):
2958         (Constraint.prototype.destroyConstraint):
2959         (Constraint.prototype.isInput):
2960         (UnaryConstraint):
2961         (UnaryConstraint.prototype.addToGraph):
2962         (UnaryConstraint.prototype.chooseMethod):
2963         (UnaryConstraint.prototype.isSatisfied):
2964         (UnaryConstraint.prototype.markInputs):
2965         (UnaryConstraint.prototype.output):
2966         (UnaryConstraint.prototype.recalculate):
2967         (UnaryConstraint.prototype.markUnsatisfied):
2968         (UnaryConstraint.prototype.inputsKnown):
2969         (UnaryConstraint.prototype.removeFromGraph):
2970         (StayConstraint):
2971         (StayConstraint.prototype.execute):
2972         (EditConstraint.prototype.isInput):
2973         (EditConstraint.prototype.execute):
2974         (BinaryConstraint):
2975         (BinaryConstraint.prototype.chooseMethod):
2976         (BinaryConstraint.prototype.addToGraph):
2977         (BinaryConstraint.prototype.isSatisfied):
2978         (BinaryConstraint.prototype.markInputs):
2979         (BinaryConstraint.prototype.input):
2980         (BinaryConstraint.prototype.output):
2981         (BinaryConstraint.prototype.recalculate):
2982         (BinaryConstraint.prototype.markUnsatisfied):
2983         (BinaryConstraint.prototype.inputsKnown):
2984         (BinaryConstraint.prototype.removeFromGraph):
2985         (ScaleConstraint):
2986         (ScaleConstraint.prototype.addToGraph):
2987         (ScaleConstraint.prototype.removeFromGraph):
2988         (ScaleConstraint.prototype.markInputs):
2989         (ScaleConstraint.prototype.execute):
2990         (ScaleConstraint.prototype.recalculate):
2991         (EqualityConstraint):
2992         (EqualityConstraint.prototype.execute):
2993         (Variable):
2994         (Variable.prototype.addConstraint):
2995         (Variable.prototype.removeConstraint):
2996         (Planner):
2997         (Planner.prototype.incrementalAdd):
2998         (Planner.prototype.incrementalRemove):
2999         (Planner.prototype.newMark):
3000         (Planner.prototype.makePlan):
3001         (Planner.prototype.extractPlanFromConstraints):
3002         (Planner.prototype.addPropagate):
3003         (Planner.prototype.removePropagateFrom):
3004         (Planner.prototype.addConstraintsConsumingTo):
3005         (Plan):
3006         (Plan.prototype.addConstraint):
3007         (Plan.prototype.size):
3008         (Plan.prototype.constraintAt):
3009         (Plan.prototype.execute):
3010         (chainTest):
3011         (projectionTest):
3012         (change):
3013         (deltaBlue):
3014         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3015         (assert):
3016         (Numbers):
3017         (Numbers.prototype.next):
3018         (return.Transpose):
3019         (return.Transpose.prototype.next):
3020         (transpose):
3021         (verifyEven):
3022         (verifyString):
3023         (foo):
3024         (runIterators):
3025         * microbenchmarks/try-catch-word-count.js: Added.
3026         (let.assert):
3027         (EOF):
3028         (let.texts):
3029         (let.o.apply):
3030         (foo):
3031         (bar):
3032         (f):
3033         (run):
3034         (test1):
3035         (test2):
3036         (test3):
3037         (fn):
3038         (A):
3039         (B):
3040         (A.prototype.getValue):
3041         (B.prototype.getParentValue):
3042         (strlen):
3043         (sum.0):
3044         (test):
3045         (result.test.o):
3046         (set add.set add):
3047         (set forEach):
3048         (stringHash):
3049         (set if):
3050         (testFunction):
3051         (set delete.set has.set add):
3052         * stress/catch-set-argument-speculation-failure.js: Added.
3053         (o):
3054         (e):
3055         (e2):
3056         (escape):
3057         (baz):
3058         (noInline.run):
3059         (noInline):
3060         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3061         (foo):
3062         (e):
3063         (baz):
3064         (bar):
3065
3066 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3067
3068         [JSC] Optimize Map iteration with intrinsic
3069         https://bugs.webkit.org/show_bug.cgi?id=174355
3070
3071         Reviewed by Saam Barati.
3072
3073         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3074         (shouldBe):
3075         (throw.new.Error):
3076         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3077         (shouldBe):
3078         (throw.new.Error.let.iterator.set Symbol):
3079         (throw.new.Error.set add):
3080         (let.iterator.set Symbol):
3081
3082 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3083
3084         Add a micro-benchmark for checking that accessing a variable within a 'with'
3085         block does not automatically prevent type prediction.
3086         https://bugs.webkit.org/show_bug.cgi?id=175738
3087
3088         Reviewed by Saam Barati.
3089
3090         * stress/with_and_arith.js: Added.
3091         (with):
3092
3093 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3094
3095         [ESNext] Async iteration - Implement Async Generator - runtime
3096         https://bugs.webkit.org/show_bug.cgi?id=175240
3097
3098         Reviewed by Yusuke Suzuki.
3099
3100         * stress/async-iteration-async-from-sync.js: Added.
3101         (assert):
3102         (const.Logger):
3103         (this.fullfilled):
3104         (this.fullfilledDone):
3105         (this.rejected):
3106         (this.catched):
3107         (this.isFinal):
3108         (_assertLogger):
3109         (const.assertLogger):
3110         (const.getPromise.promiseHolder.return.new.Promise):
3111         (foo):
3112         (async.boo):
3113         (bar):
3114         (async.baz):
3115         (async.goo):
3116         * stress/async-iteration-basic.js: Added.
3117         (assert):
3118         (const.Logger):
3119         (this.fullfilled):
3120         (this.fullfilledDone):
3121         (this.rejected):
3122         (this.catched):
3123         (this.isFinal):
3124         (_assertLogger):
3125         (const.assertLogger):
3126         (const.getPromise.promiseHolder.return.new.Promise):
3127         (async.generator):
3128         (iterator.next.then):
3129         (async.baz):
3130         (async.boo):
3131         (async.foo):
3132         (async.goo):
3133         (A.prototype.async.foo):
3134         (A.prototype.async.boo):
3135         (A):
3136         (asyncGenExp.async):
3137         (async.joo):
3138         (j.next.then):
3139         (then):
3140         (async.koo):
3141         (async.loo):
3142         (async.moo):
3143         (async.noo):
3144         (async.ooo):
3145         (async.roo):
3146         (async.poo):
3147         (async.soo):
3148         (async.too):
3149         * stress/async-iteration-evaluation.js: Added.
3150         (assert):
3151         (async.foo):
3152         (catch):
3153         * stress/async-iteration-syntax.js:
3154         * stress/async-iteration-yield-promise.js: Added.
3155         (assert):
3156         (const.Logger):
3157         (this.fullfilled):
3158         (this.fullfilledDone):
3159         (this.rejected):
3160         (this.catched):
3161         (this.isFinal):
3162         (_assertLogger):
3163         (const.assertLogger):
3164         (const.getPromise.promiseHolder.return.new.Promise):
3165         (async.foo):
3166         (async.boo):
3167         (async.bar):
3168         * stress/async-iteration-yield-star-interface.js: Added.
3169         (assert):
3170         (const.getPromise.promiseHolder.return.new.Promise):
3171         (const.Logger):
3172         (this.fullfilled):
3173         (this.fullfilledDone):
3174         (this.rejected):
3175         (this.catched):
3176         (this.custom):
3177         (this.isFinal):
3178         (_assertLogger):
3179         (const.assertLogger):
3180         (let.asyncIter.Symbol.asyncIterator):
3181         (let.asyncIter.next):
3182         (let.asyncIter.throw):
3183         (let.asyncIter.return):
3184         (async.foo):
3185         (asyncIter.Symbol.asyncIterator):
3186         (asyncIter.next):
3187         (async.boo):
3188         (asyncIter.return):
3189         (async.bar):
3190         (async.baz):
3191         (async.foobar):
3192         * stress/async-iteration-yield-star.js: Added.
3193         (assert):
3194         (const.Logger):
3195         (this.fullfilled):
3196         (this.fullfilledDone):
3197         (this.rejected):
3198         (this.catched):
3199         (this.custom):
3200         (this.isFinal):
3201         (_assertLogger):
3202         (const.assertLogger):
3203         (const.getPromise.promiseHolder.return.new.Promise):
3204         (async.foo):
3205         (async.boo):
3206         (async.bar):
3207         (async.baz):
3208         (async.joo):
3209         (async.goo):
3210         (async.koo):
3211         (async.loo):
3212         (let.asyncIter.Symbol.asyncIterator):
3213         (let.asyncIter.next):
3214         (let.asyncIter.throw):
3215         (let.asyncIter.return):
3216         (async.moo):
3217         (async.noo):
3218         * test262.yaml:
3219
3220 2017-08-23  JF Bastien  <jfbastien@apple.com>
3221
3222         Fix printing in test
3223
3224         Unreviewed: fixing verbosity, shouldn't have been there.
3225
3226         * wasm/regress/175693.js:
3227         (else.else):
3228         (catch):
3229
3230 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3231
3232         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3233         https://bugs.webkit.org/show_bug.cgi?id=172543
3234
3235         Unreviewed test gardening.
3236
3237         * microbenchmarks/generator-with-several-types.js:
3238
3239 2017-08-17  JF Bastien  <jfbastien@apple.com>
3240
3241         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3242         https://bugs.webkit.org/show_bug.cgi?id=175693
3243         <rdar://problem/33952443>
3244
3245         Reviewed by Saam Barati.
3246
3247         Add a regression directory for WebAssembly tests.
3248
3249         * wasm.yaml:
3250         * wasm/regress/175693.js: Added.
3251         (else.else):
3252         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3253         (catch):
3254         * wasm/regress/175693.wasm: Added.
3255
3256 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3257
3258         Support the 'with' keyword in FTL.
3259         https://bugs.webkit.org/show_bug.cgi?id=175585
3260
3261         Reviewed by Saam Barati.
3262
3263         Also improve the JSTest/stress/with.js file to test
3264         what happens when non-objects are passed to with.
3265
3266         * stress/with.js:
3267         (foo):
3268         (i.catch):
3269         (i.with): Deleted.
3270
3271 2017-08-14  Keith Miller  <keith_miller@apple.com>
3272
3273         Add testing tool to lie to the DFG about profiles
3274         https://bugs.webkit.org/show_bug.cgi?id=175487
3275
3276         Reviewed by Saam Barati.
3277
3278         * stress/compare-eq-incomplete-profile.js: Added.
3279         (const.test.createBuiltin):
3280
3281 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3282
3283         Support the with keyword in DFG
3284         https://bugs.webkit.org/show_bug.cgi?id=175470
3285
3286         Reviewed by Saam Barati.
3287
3288         Added a new stress-test for the 'with' keyword, that caught a bug in a
3289         previous version of this code.
3290
3291         * stress/with.js: Added.
3292         (i.with):
3293
3294 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3295
3296         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3297         https://bugs.webkit.org/show_bug.cgi?id=175544
3298
3299         Unreviewed test gardening.
3300
3301         * ChakraCore.yaml:
3302
3303 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3304
3305         Early error on ANY operator before new.target
3306         https://bugs.webkit.org/show_bug.cgi?id=157970
3307
3308         Reviewed by Saam Barati.
3309
3310         Instead of throwing if any unary operator precedes new.target, only
3311         throw if the unary operator updates the reference.
3312
3313         The following become legal in JSC:
3314
3315         ```
3316         !new.target
3317         ~new.target
3318         typeof new.target
3319         delete new.target
3320         void new.target
3321         ```
3322
3323         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3324
3325         * stress/new-target-syntax-errors.js:
3326         * stress/new-target.js:
3327
3328 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3329
3330         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3331         https://bugs.webkit.org/show_bug.cgi?id=175255
3332
3333         Unreviewed test gardening.
3334
3335         * stress/regress-169783.js:
3336         * wasm/stress/oom.js:
3337
3338 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3339
3340         REGRESSION: 2 test262/test/language/statements/async-function failures
3341         https://bugs.webkit.org/show_bug.cgi?id=175334
3342
3343         Reviewed by Yusuke Suzuki.
3344
3345         Add @skip parameters to tests, and remove test for async iterator from
3346         async await syntax test because it is already covered by async-iterator-syntax.js
3347
3348         * stress/async-await-syntax.js:
3349         * stress/async-iteration-syntax.js:
3350
3351 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3352
3353         Unreviewed, gardening test262 for Promise resolve / reject function length
3354         https://bugs.webkit.org/show_bug.cgi?id=175333
3355
3356         * test262.yaml:
3357
3358 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3359
3360         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3361         https://bugs.webkit.org/show_bug.cgi?id=175307
3362
3363         Reviewed by Saam Barati.
3364
3365         * stress/typedarray-getownproperty-not-configurable.js: Added.
3366         (assert):
3367         (foo):
3368
3369 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3370
3371         Promise resolve and reject function should have length = 1
3372         https://bugs.webkit.org/show_bug.cgi?id=175242
3373
3374         Reviewed by Saam Barati.
3375
3376         * stress/builtin-function-length.js: Added.
3377         (shouldBe):
3378         (shouldThrow):
3379         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3380         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3381
3382 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3383
3384         [ESNext] Async iteration - Implement Async Generator - parser
3385         https://bugs.webkit.org/show_bug.cgi?id=175210
3386
3387         Reviewed by Yusuke Suzuki.
3388
3389         * stress/async-await-syntax.js:
3390         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3391         * stress/async-iteration-syntax.js: Added.
3392         (assert):
3393         (checkSyntax):
3394         (checkSyntaxError):
3395         (checkSimpleAsyncGeneratorSloppyMode):
3396         (checkSimpleAsyncGeneratorStrictMode):
3397         (checkNestedAsyncGenerators):
3398         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3399         * stress/generator-class-methods-syntax.js:
3400
3401 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3402
3403         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3404         https://bugs.webkit.org/show_bug.cgi?id=175150
3405
3406         Unreviewed test gardening.
3407
3408         * wasm/js-api/test_memory_constructor.js:
3409
3410 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3411
3412         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3413         https://bugs.webkit.org/show_bug.cgi?id=175100
3414
3415         Reviewed by Mark Lam.
3416
3417         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3418         available memory until an out of memory exception happens.
3419
3420         The Linux kernel is more tuned for server workloads than for GUI
3421         responsiveness. When a process tries to use a lot of memory, Linux
3422         will do its best to serve the request. This usually translates to
3423         free physical RAM by writing to disk dirty pages and/or moving out
3424         less recently used pages to swap (disk storage).
3425         Meanwhile it does this, the system will become unresponsive and this
3426         leads to freezes that can last even some minutes on the worst cases.
3427
3428         Therefore, let's skip this test on Linux as it will cause more harm
3429         than good on the Linux bots or on the machines of Linux developers.
3430
3431         * wasm/stress/oom.js:
3432
3433 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3434
3435         [JSC] Remove unnecessary print from stress\promise-finally.js test
3436         https://bugs.webkit.org/show_bug.cgi?id=175015
3437
3438         Reviewed by Yusuke Suzuki.
3439
3440         * stress/promise-finally.js:
3441         (p.finally):
3442         (then):
3443
3444 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3445
3446         Unreviewed, update test262 results for optional catch binding
3447
3448         * test262.yaml:
3449
3450 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3451
3452         [JSC] Support optional catch binding
3453         https://bugs.webkit.org/show_bug.cgi?id=174981
3454
3455         Reviewed by Saam Barati.
3456
3457         * stress/optional-catch-binding-syntax.js: Added.
3458         (testSyntax):
3459         (testSyntaxError):
3460         (catch.catch):
3461         * stress/optional-catch-binding.js: Added.
3462         (shouldBe):
3463         (throwException):
3464
3465 2017-07-28  Mark Lam  <mark.lam@apple.com>
3466
3467         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3468         https://bugs.webkit.org/show_bug.cgi?id=174948
3469         <rdar://problem/33495680>
3470
3471         Reviewed by Filip Pizlo.
3472
3473         * stress/regress-174948.js: Added.
3474
3475 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3476
3477         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3478         https://bugs.webkit.org/show_bug.cgi?id=174900
3479
3480         Reviewed by Saam Barati.
3481
3482         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3483         (sideEffect):
3484         (args):
3485         (test):
3486
3487 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3488
3489         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3490         https://bugs.webkit.org/show_bug.cgi?id=171637
3491
3492         Reviewed by Darin Adler.
3493
3494         * stress/domjit-getter-complex-with-incorrect-object.js:
3495         (i.shouldThrow):
3496         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3497         (shouldBe):
3498         (i.shouldThrow):
3499
3500 2017-07-26  JF Bastien  <jfbastien@apple.com>
3501
3502         WebAssembly: test throwing out of the start function
3503         https://bugs.webkit.org/show_bug.cgi?id=165714
3504         <rdar://problem/29760251>
3505
3506         Reviewed by Keith Miller.
3507
3508         * wasm/assert.js:
3509         * wasm/function-tests/trap-from-start.js: Added.
3510         (StartTraps):
3511         * wasm/function-tests/trap-from-start-async.js: Added.
3512         (async.StartTrapsAsync):
3513
3514 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3515
3516         [FTL] Arguments elimination is suppressed by unreachable blocks
3517         https://bugs.webkit.org/show_bug.cgi?id=174352
3518
3519         Reviewed by Filip Pizlo.
3520
3521         * stress/arguments-elimination-force-exit.js: Added.
3522         (shouldBe):
3523         (strict):
3524         (sloppy):
3525         * stress/arguments-elimination-throw.js: Added.
3526         (shouldBe):
3527         (shouldThrow):
3528         (sloppy):
3529         (isArguments):
3530
3531 2017-07-13  Mark Lam  <mark.lam@apple.com>
3532
3533         Add some additional test cases for bug 170896.
3534         https://bugs.webkit.org/show_bug.cgi?id=174491
3535
3536         Reviewed by Filip Pizlo.
3537
3538         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3539         * stress/regress-170896-with-double-shape-profile.js: Added.
3540         (test):
3541         * stress/regress-170896-with-int32-shape-profile.js: Added.
3542         (test):
3543         * stress/regress-170896.js: Removed.
3544
3545 2017-07-13  Saam Barati  <sbarati@apple.com>
3546
3547         Missing exception check in JSObject::hasInstance
3548         https://bugs.webkit.org/show_bug.cgi?id=174455
3549         <rdar://problem/31384608>
3550
3551         Reviewed by Mark Lam.
3552
3553         * stress/has-instance-exception-check.js: Added.
3554         (assert):
3555         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3556
3557 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3558
3559         [ESnext] Implement Object Spread
3560         https://bugs.webkit.org/show_bug.cgi?id=167963
3561
3562         Reviewed by Saam Barati.
3563
3564         * stress/obj-rest-destructuring-order.js: Added.
3565         (assert):
3566         (o.get z):
3567         (o.get a):
3568         * stress/obj-spread-order.js: Added.
3569         (assert):
3570         (o.get z):
3571         (o.get a):
3572         * stress/object-spread.js: Added.
3573         (let.assert):
3574         (assert.sameValue):
3575         (let.o.get a):
3576         (let.obj.get c):
3577         (cthulhu.get x):
3578         (let.obj.set c):
3579         (calls.o.get z):
3580         (calls.o.get a):
3581         (try.let.obj.get foo):
3582         (get calls):
3583
3584 2017-07-12  Saam Barati  <sbarati@apple.com>
3585
3586         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3587         https://bugs.webkit.org/show_bug.cgi?id=174411
3588         <rdar://problem/31696186>
3589
3590         Reviewed by Mark Lam.
3591
3592         * stress/generic-arguments-correct-delete-behavior.js: Added.
3593         (assert):
3594         (makeTest):
3595
3596 2017-07-07  Mark Lam  <mark.lam@apple.com>
3597
3598         \n\r is not the same as \r\n.
3599         https://bugs.webkit.org/show_bug.cgi?id=173053
3600
3601         Reviewed by Keith Miller.
3602
3603         * stress/regress-173053.js: Added.
3604         * stress/template-literal-line-terminators.js:
3605
3606 2017-07-06  Saam Barati  <sbarati@apple.com>
3607
3608         We are missing places where we invalidate the for-in context
3609         https://bugs.webkit.org/show_bug.cgi?id=174184
3610
3611         Reviewed by Geoffrey Garen.
3612
3613         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3614         (assert):
3615         (test):
3616
3617 2017-07-05  Saam Barati  <sbarati@apple.com>
3618
3619         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3620         https://bugs.webkit.org/show_bug.cgi?id=174188
3621         <rdar://problem/30581423>
3622
3623         Reviewed by Mark Lam.
3624
3625         * stress/new-array-having-a-bad-time-double.js: Added.
3626         (assert):
3627         (foo):
3628
3629 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3630
3631         WTF::StringImpl::copyChars segfaults when built with GCC 7
3632         https://bugs.webkit.org/show_bug.cgi?id=173407
3633
3634         Reviewed by Andreas Kling.
3635
3636         * stress/string-repeat-copy-chars-crash.js: Added.
3637         (shouldBe):
3638
3639 2017-07-03  Saam Barati  <sbarati@apple.com>
3640
3641         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3642
3643         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3644
3645 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3646
3647         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3648
3649         It requires too much memory.
3650
3651         * stress/dont-reserve-huge-capacity-lexer.js:
3652
3653 2017-06-30  Michael Saboff  <msaboff@apple.com>
3654
3655         Skip a test on ARM64 platform since we run out of address space.
3656
3657         Rubber stamped by Saam Barati.
3658
3659         * stress/dont-reserve-huge-capacity-lexer.js:
3660
3661 2017-06-30  Michael Saboff  <msaboff@apple.com>
3662
3663         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3664         https://bugs.webkit.org/show_bug.cgi?id=174044
3665
3666         Reviewed by Oliver Hunt.
3667
3668         New regression test.
3669
3670         * stress/regress-174044.js: Added.
3671         (test1):
3672         (test2):
3673
3674 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3675
3676         RegExpCachedResult::setInput should reify left and right contexts
3677         https://bugs.webkit.org/show_bug.cgi?id=173818
3678
3679         Reviewed by Keith Miller.
3680
3681         * stress/right-left-context-invalidated-by-input.js: Added.
3682         (test.validateContexts):
3683         (test):
3684
3685 2017-06-29  Saam Barati  <sbarati@apple.com>
3686
3687         Calculating postCapacity in unshiftCountSlowCase is wrong
3688         https://bugs.webkit.org/show_bug.cgi?id=173992
3689         <rdar://problem/32283199>
3690
3691         Reviewed by Keith Miller.
3692
3693         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3694         (temp):
3695
3696 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3697
3698         Unreviewed, rolling out r218512.
3699         https://bugs.webkit.org/show_bug.cgi?id=173981
3700
3701         "It changes the behavior of the JS API's JSEvaluateScript
3702         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3703
3704         Reverted changeset:
3705
3706         "test262: Completion values for control flow do not match the
3707         spec"
3708         https://bugs.webkit.org/show_bug.cgi?id=171265
3709         http://trac.webkit.org/changeset/218512
3710
3711 2017-06-27  JF Bastien  <jfbastien@apple.com>
3712
3713         WebAssembly: running out of executable memory should throw OoM
3714         https://bugs.webkit.org/show_bug.cgi?id=171537
3715         <rdar://problem/32963338>
3716
3717         Reviewed by Saam Barati.
3718
3719         * wasm.yaml:
3720         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3721         (const.invoke):
3722         (failCount.0.catch):
3723         (failCount.0.module.undefined.catch):
3724         * wasm/lowExecutableMemory/exports-oom.js: Added.
3725         (const.type):
3726         (const.params):
3727         (const.randomProgram):
3728         (failCount.0.catch):
3729         (failCount.0.module.undefined.catch):
3730         * wasm/lowExecutableMemory/imports-oom.js: Added.
3731         (const.type):
3732         (const.params):
3733         (const.randomProgram):
3734         (f.imports.push):
3735         (failCount.0.catch):
3736         (failCount.0.module.undefined.catch):
3737
3738 2017-06-27  Caio Lima  <ticaiolima@gmail