53948b1898524474dc769a50bad9696918a8bdb4
[WebKit-https.git] / JSTests / ChangeLog
1 2017-12-01  JF Bastien  <jfbastien@apple.com>
2
3         JavaScriptCore: missing exception checks in Math functions that take more than one argument
4         https://bugs.webkit.org/show_bug.cgi?id=180297
5         <rdar://problem/35745556>
6
7         Reviewed by Mark Lam.
8
9         * stress/math-exceptions.js: Added.
10         (get try):
11         (catch):
12
13 2017-12-01  JF Bastien  <jfbastien@apple.com>
14
15         JavaScriptCore: add test for weird class static getters
16         https://bugs.webkit.org/show_bug.cgi?id=180281
17         <rdar://problem/35592139>
18
19         Reviewed by Mark Lam.
20
21         I fixed a bug for it in r224927 and didn't add a test. Do so.
22
23         * stress/class-static-get-weird.js: Added.
24         (c.prototype.get name):
25         (c):
26         (c.prototype.get arguments):
27         (c.prototype.get caller):
28         (c.prototype.get length):
29
30 2017-12-01  Saam Barati  <sbarati@apple.com>
31
32         Having a bad time needs to handle ArrayClass indexing type as well
33         https://bugs.webkit.org/show_bug.cgi?id=180274
34         <rdar://problem/35667869>
35
36         Reviewed by Keith Miller and Mark Lam.
37
38         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
39         (assert):
40         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
41         (assert):
42
43 2017-12-01  JF Bastien  <jfbastien@apple.com>
44
45         WebAssembly: restore cached stack limit after out-call
46         https://bugs.webkit.org/show_bug.cgi?id=179106
47         <rdar://problem/35337525>
48
49         Reviewed by Saam Barati.
50
51         * wasm/function-tests/double-instance.js: Added.
52         (const.imp.boom):
53         (const.imp.get callAnother):
54
55 2017-11-30  JF Bastien  <jfbastien@apple.com>
56
57         WebAssembly: improve stack trace
58         https://bugs.webkit.org/show_bug.cgi?id=179343
59
60         Reviewed by Saam Barati.
61
62         Update the tests to follow the new format. Notably, SHA1 module
63         hash is now included in traces, and stubs are properly identified.
64
65         * wasm/assert.js: Add an assertion which matches regular expressions.
66         * wasm/function-tests/nameSection.js:
67         * wasm/function-tests/stack-overflow.js:
68         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
69         (assertOverflows.assertThrows.wasm.1):
70         (assertOverflows.assertThrows.wasm.0):
71         (assertOverflows.assertThrows):
72         (assertOverflows):
73         * wasm/function-tests/stack-trace.js:
74         (import.Builder.from.string_appeared_here.assert): Deleted.
75         * wasm/function-tests/trap-after-cross-instance-call.js:
76         (wasmFrameCountFromError):
77         * wasm/function-tests/trap-load-2.js:
78         (wasmFrameCountFromError):
79         * wasm/function-tests/trap-load.js:
80         (wasmFrameCountFromError):
81
82 2017-11-30  Mark Lam  <mark.lam@apple.com>
83
84         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
85         https://bugs.webkit.org/show_bug.cgi?id=180219
86         <rdar://problem/35696536>
87
88         Reviewed by Filip Pizlo.
89
90         * stress/regress-180219.js: Added.
91
92 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
93
94         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
95         https://bugs.webkit.org/show_bug.cgi?id=180190
96
97         Reviewed by Mark Lam.
98
99         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
100         (shouldBe):
101         (test1):
102         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
103         (shouldBe):
104         (test1):
105         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
106         (shouldBe):
107         (test1):
108         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
109         (shouldBe):
110         (test1):
111         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
112         (shouldBe):
113         (test1):
114         * stress/operation-in-may-have-negative-int32.js: Added.
115         (shouldBe):
116         (test2):
117         * stress/operation-in-negative-int32-cast.js: Added.
118         (shouldBe):
119         (test1):
120
121 2017-11-28  JF Bastien  <jfbastien@apple.com>
122
123         Strict and sloppy functions shouldn't share structure
124         https://bugs.webkit.org/show_bug.cgi?id=180103
125         <rdar://problem/35667847>
126
127         Reviewed by Saam Barati.
128
129         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
130         because the IC was wrong.
131         (foo):
132         (bar):
133         (baz):
134         (catch):
135         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
136         in this patch, but may as well test odd strict mode corner cases.
137         (bar):
138         (baz):
139         (catch):
140         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
141         (foo):
142         (bar):
143         (baz):
144         (catch):
145         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
146         next file, but with invalidation of the FunctionExecutable's
147         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
148         slower path.
149         (foo):
150         (bar.const.x):
151         (bar.const.y):
152         (bar):
153         (catch):
154         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
155         strict nesting works correctly.
156         (foo):
157         (bar.baz):
158         (bar):
159         * stress/strict-function-structure.js: Added. The test used to
160         assert in objectProtoFuncHasOwnProperty.
161         (foo):
162         (bar):
163         (baz):
164         * stress/strict-nested-function-structure.js: Added. Nesting.
165         (foo):
166         (bar):
167         (baz.boo):
168         (baz):
169
170 2017-11-29  Robin Morisset  <rmorisset@apple.com>
171
172         The recursive tail call optimisation is wrong on closures
173         https://bugs.webkit.org/show_bug.cgi?id=179835
174
175         Reviewed by Saam Barati.
176
177         * stress/closure-recursive-tail-call.js: Added.
178         (makeClosure):
179
180 2017-11-27  JF Bastien  <jfbastien@apple.com>
181
182         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
183         https://bugs.webkit.org/show_bug.cgi?id=180051
184         <rdar://problem/35614371>
185
186         Reviewed by Saam Barati.
187
188         * stress/rest-parameter-negative.js: Added.
189         (__f_5484):
190         (catch):
191         (__f_5485):
192         (__v_22598.catch):
193
194 2017-11-27  Saam Barati  <sbarati@apple.com>
195
196         Spread can escape when CreateRest does not
197         https://bugs.webkit.org/show_bug.cgi?id=180057
198         <rdar://problem/35676119>
199
200         Reviewed by JF Bastien.
201
202         * stress/spread-escapes-but-create-rest-does-not.js: Added.
203         (assert):
204         (getProperties):
205         (theFunc):
206         (let.obj.valueOf):
207
208 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
209
210         [DFG] Add NormalizeMapKey DFG IR
211         https://bugs.webkit.org/show_bug.cgi?id=179912
212
213         Reviewed by Saam Barati.
214
215         * stress/map-untyped-normalize-cse.js: Added.
216         (shouldBe):
217         (test):
218         * stress/map-untyped-normalize.js: Added.
219         (shouldBe):
220         (test):
221         * stress/set-untyped-normalize-cse.js: Added.
222         (shouldBe):
223         (set return.set has.set has):
224         * stress/set-untyped-normalize.js: Added.
225         (shouldBe):
226         (set return.set has):
227
228 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
229
230         [FTL] Support DeleteById and DeleteByVal
231         https://bugs.webkit.org/show_bug.cgi?id=180022
232
233         Reviewed by Saam Barati.
234
235         * stress/delete-by-id.js: Added.
236         (shouldBe):
237         (test1):
238         (test2):
239         * stress/delete-by-val-ftl.js: Added.
240         (shouldBe):
241         (test1):
242         (test2):
243
244 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
245
246         [DFG] Introduce {Set,Map,WeakMap}Fields
247         https://bugs.webkit.org/show_bug.cgi?id=179925
248
249         Reviewed by Saam Barati.
250
251         * stress/map-set-clobber-map-get.js: Added.
252         (shouldBe):
253         (test):
254         * stress/map-set-does-not-clobber-set-has.js: Added.
255         (shouldBe):
256         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
257         (shouldBe):
258         (test):
259         * stress/set-add-clobber-set-has.js: Added.
260         (shouldBe):
261         * stress/set-add-does-not-clobber-map-get.js: Added.
262         (shouldBe):
263
264 2017-11-24  Mark Lam  <mark.lam@apple.com>
265
266         Move unsafe jsc shell test functions to the $vm object.
267         https://bugs.webkit.org/show_bug.cgi?id=179980
268
269         Reviewed by Yusuke Suzuki.
270
271         * controlFlowProfiler/driver/driver.js:
272         * controlFlowProfiler/execution-count.js:
273         * controlFlowProfiler/if-statement.js:
274         * controlFlowProfiler/loop-statements.js:
275         * controlFlowProfiler/switch-statements.js:
276         * controlFlowProfiler/test-jit.js:
277         * exceptionFuzz/3d-cube.js:
278         * exceptionFuzz/date-format-xparb.js:
279         * exceptionFuzz/earley-boyer.js:
280         * heapProfiler/basic-edges.js:
281         * heapProfiler/property-edge-types.js:
282         * microbenchmarks/try-get-by-id-basic.js:
283         * microbenchmarks/try-get-by-id-polymorphic.js:
284         * modules/namespace-object-try-get.js:
285         * stress/argument-count-bytecode.js:
286         * stress/argument-intrinsic-basic.js:
287         * stress/argument-intrinsic-inlining-use-caller-arg.js:
288         * stress/argument-intrinsic-inlining-with-result-escape.js:
289         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
290         * stress/argument-intrinsic-inlining-with-vararg.js:
291         * stress/argument-intrinsic-nested-inlining.js:
292         * stress/argument-intrinsic-not-convert-to-get-argument.js:
293         * stress/argument-intrinsic-with-stack-write.js:
294         * stress/arity-mismatch-get-argument.js:
295         * stress/array-message-passing.js:
296         * stress/array-push-with-force-exit.js:
297         * stress/check-dom-with-signature.js:
298         * stress/check-sub-class.js:
299         * stress/compare-eq-incomplete-profile.js:
300         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
301         * stress/do-eval-virtual-call-correctly.js:
302         * stress/dom-jit-with-poly-proto.js:
303         * stress/domjit-exception-ic.js:
304         * stress/domjit-exception.js:
305         * stress/domjit-getter-complex-with-incorrect-object.js:
306         * stress/domjit-getter-complex.js:
307         * stress/domjit-getter-poly.js:
308         * stress/domjit-getter-proto.js:
309         * stress/domjit-getter-super-poly.js:
310         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
311         * stress/domjit-getter-type-check.js:
312         * stress/domjit-getter.js:
313         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
314         * stress/for-in-proxy-target-changed-structure.js:
315         * stress/for-in-proxy.js:
316         * stress/generational-opaque-roots.js:
317         * stress/global-const-redeclaration-setting-2.js:
318         * stress/global-const-redeclaration-setting-3.js:
319         * stress/global-const-redeclaration-setting-4.js:
320         * stress/global-const-redeclaration-setting-5.js:
321         * stress/global-const-redeclaration-setting.js:
322         * stress/import-basic.js:
323         * stress/import-from-eval.js:
324         * stress/import-reject-with-exception.js:
325         * stress/import-syntax.js:
326         * stress/impure-get-own-property-slot-inline-cache.js:
327         * stress/is-constructor.js:
328         * stress/istypedarrayview-intrinsic.js:
329         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
330         * stress/jsc-test-functions-should-be-more-robust.js:
331         * stress/object-toString-with-proxy.js:
332         * stress/poly-proto-custom-value-and-accessor.js:
333         * stress/proxy-inline-cache.js:
334         * stress/re-execute-error-module.js:
335         * stress/regress-150532.js:
336         * stress/regress-156992.js:
337         * stress/regress-179619.js:
338         * stress/resources/shadow-chicken-support.js:
339         * stress/runtime-array.js:
340         * stress/sampling-profiler-microtasks.js:
341         * stress/shadow-chicken-enabled.js:
342         * stress/spread-correct-global-object-on-exception.js:
343         * stress/super-get-by-id.js:
344         * stress/tailCallForwardArguments.js:
345         * stress/to-object-intrinsic-boolean-edge.js:
346         * stress/to-object-intrinsic-null-or-undefined-edge.js:
347         * stress/to-object-intrinsic-number-edge.js:
348         * stress/to-object-intrinsic-object-edge.js:
349         * stress/to-object-intrinsic-string-edge.js:
350         * stress/to-object-intrinsic-symbol-edge.js:
351         * stress/to-object-intrinsic.js:
352         * stress/try-catch-custom-getter-as-get-by-id.js:
353         * stress/try-get-by-id-poly-proto.js:
354         * stress/try-get-by-id-should-spill-registers-dfg.js:
355         * stress/try-get-by-id.js:
356         * typeProfiler/arrow-functions.js:
357         * typeProfiler/basic.js:
358         * typeProfiler/captured.js:
359         * typeProfiler/classes.js:
360         * typeProfiler/dfg-jit-optimizations.js:
361         * typeProfiler/dictionary-mode.js:
362         * typeProfiler/es6-block-scoping.js:
363         * typeProfiler/es6-classes.js:
364         * typeProfiler/inheritance.js:
365         * typeProfiler/int52-dfg.js:
366         * typeProfiler/loop.js:
367         * typeProfiler/optional-fields.js:
368         * typeProfiler/overflow.js:
369         * typeProfiler/return.js:
370         * typeProfiler/symbol.js:
371         * typeProfiler/weird-prototype-chain.js:
372
373 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
374
375         [DFG][FTL] Support MapSet / SetAdd intrinsics
376         https://bugs.webkit.org/show_bug.cgi?id=179858
377
378         Reviewed by Saam Barati.
379
380         * microbenchmarks/map-has-and-set.js: Added.
381         (test):
382         * stress/map-set-check-failure.js: Added.
383         (shouldBe):
384         (shouldThrow):
385         (target):
386         * stress/map-set-cse.js: Added.
387         (shouldBe):
388         (test):
389         * stress/set-add-check-failure.js: Added.
390         (shouldBe):
391         (shouldThrow):
392         (set shouldThrow):
393         * stress/set-add-cse.js: Added.
394         (shouldBe):
395
396 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
397
398         [JSC] Allow poly proto for intrinsic getters
399         https://bugs.webkit.org/show_bug.cgi?id=179550
400
401         Reviewed by Saam Barati.
402
403         This change is also tested by existing tests.
404
405             1. stress/intrinsic-getter-with-poly-proto.js
406             2. stress/poly-proto-intrinsic-getter-correctness.js
407
408         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
409         (shouldBe):
410         (makePolyProtoObject.foo.C):
411         (makePolyProtoObject.foo):
412         (makePolyProtoObject):
413         (target):
414         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
415         (shouldBe):
416         (makePolyProtoObject.foo.C):
417         (makePolyProtoObject.foo):
418         (makePolyProtoObject):
419         (target):
420
421 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
422
423         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
424         https://bugs.webkit.org/show_bug.cgi?id=179744
425
426         Reviewed by Michael Catanzaro.
427
428         This test uses too much memory for our buildbots on these platforms
429         and gets OOM-killed.
430
431         * stress/unshiftCountSlowCase-correct-postCapacity.js:
432         Skip if $memoryLimited and linux.
433
434 2017-11-17  JF Bastien  <jfbastien@apple.com>
435
436         WebAssembly JS API: throw when a promise can't be created
437         https://bugs.webkit.org/show_bug.cgi?id=179826
438         <rdar://problem/35455813>
439
440         Reviewed by Mark Lam.
441
442         Test WebAssembly.{compile,instantiate} where promise creation
443         fails because of a stack overflow.
444
445         * wasm/js-api/promise-stack-overflow.js: Added.
446         (const.runNearStackLimit.f.const.t):
447         (async.testCompile):
448         (async.testInstantiate):
449
450 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
451
452         Unreviewed, mark regress-178385.js as memory exhausting
453
454         * stress/regress-178385.js:
455
456 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
457
458         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
459
460         Unreviewed test gardening.
461
462         * test262.yaml:
463
464 2017-11-16  Robin Morisset  <rmorisset@apple.com>
465
466         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
467         https://bugs.webkit.org/show_bug.cgi?id=179763
468         <rdar://problem/35550513>
469
470         Reviewed by Keith Miller.
471
472         Just adding a slightly cleaned-up version of the original fuzzer-found test.
473
474         * stress/tdz-this-in-try-catch.js: Added.
475         (__v_6388):
476         (__v_6392):
477
478 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
479
480         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
481         https://bugs.webkit.org/show_bug.cgi?id=179594
482
483         Reviewed by Saam Barati.
484
485         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
486         (shouldBe):
487         (args):
488         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
489         (shouldBe):
490         (args):
491
492 2017-11-14  Saam Barati  <sbarati@apple.com>
493
494         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
495         https://bugs.webkit.org/show_bug.cgi?id=179639
496         <rdar://problem/35513018>
497
498         Reviewed by JF Bastien.
499
500         * wasm/function-tests/grow-memory-cause-gc.js: Added.
501         (escape):
502         (i.func):
503
504 2017-11-13  Mark Lam  <mark.lam@apple.com>
505
506         Add more overflow check book-keeping for MarkedArgumentBuffer.
507         https://bugs.webkit.org/show_bug.cgi?id=179634
508         <rdar://problem/35492517>
509
510         Reviewed by Saam Barati.
511
512         * stress/regress-179634.js: Added.
513
514 2017-11-13  Mark Lam  <mark.lam@apple.com>
515
516         Make the jsc shell loadGetterFromGetterSetter() function more robust.
517         https://bugs.webkit.org/show_bug.cgi?id=179619
518         <rdar://problem/35492518>
519
520         Reviewed by Saam Barati.
521
522         * stress/regress-179619.js: Added.
523
524 2017-11-12  Mark Lam  <mark.lam@apple.com>
525
526         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
527         https://bugs.webkit.org/show_bug.cgi?id=179562
528         <rdar://problem/35467022>
529
530         Reviewed by Saam Barati.
531
532         * regress-179562.js: Added.
533
534 2017-11-08  Saam Barati  <sbarati@apple.com>
535
536         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
537         https://bugs.webkit.org/show_bug.cgi?id=177792
538
539         Reviewed by Yusuke Suzuki.
540
541         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
542         (assert):
543         (foo.Foo.prototype.ensureX):
544         (foo.Foo):
545         (foo):
546         (access):
547
548 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
549
550         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
551         https://bugs.webkit.org/show_bug.cgi?id=178592
552
553         Unreviewed test gardening.
554
555         * test262.yaml:
556
557 2017-11-08  Robin Morisset  <rmorisset@apple.com>
558
559         Turn recursive tail calls into loops
560         https://bugs.webkit.org/show_bug.cgi?id=176601
561
562         Reviewed by Saam Barati.
563
564         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
565
566         Add some simple test that computes factorial in several ways, and other trivial computations.
567         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
568         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
569         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
570         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
571
572         * stress/inline-call-to-recursive-tail-call.js: Added.
573         (factorial.aux):
574         (factorial):
575         (factorial2.aux2):
576         (factorial2.id):
577         (factorial2):
578         (factorial3.aux3):
579         (factorial3):
580         (aux4):
581         (factorial4):
582         (foo):
583         (auxBar):
584         (bar):
585         (test):
586
587 2017-11-07  Mark Lam  <mark.lam@apple.com>
588
589         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
590         https://bugs.webkit.org/show_bug.cgi?id=179355
591         <rdar://problem/35263053>
592
593         Reviewed by Saam Barati.
594
595         * stress/regress-179355.js: Added.
596
597 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
598
599         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
600         https://bugs.webkit.org/show_bug.cgi?id=144458
601
602         Reviewed by Saam Barati.
603
604         * microbenchmarks/dfg-internal-function-call.js: Added.
605         (target):
606         * microbenchmarks/dfg-internal-function-construct.js: Added.
607         (target):
608         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
609         (target):
610         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
611         (target):
612         * stress/dfg-internal-function-call.js: Added.
613         (shouldBe):
614         (target):
615         * stress/dfg-internal-function-construct.js: Added.
616         (shouldBe):
617         (target):
618         * stress/internal-function-call.js: Added.
619         (shouldBe):
620         * stress/internal-function-construct.js: Added.
621         (shouldBe):
622
623 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
624
625         [Win] Skip stress/regress-178385.js.
626         https://bugs.webkit.org/show_bug.cgi?id=179298
627
628         Unreviewed test gardening.
629
630         * stress/regress-178385.js:
631
632 2017-11-03  Keith Miller  <keith_miller@apple.com>
633
634         Add test for ic with side effects
635         https://bugs.webkit.org/show_bug.cgi?id=179268
636
637         Reviewed by Saam Barati.
638
639         * stress/put-inline-cache-side-effects.js: Added.
640         (let.i.of.objs.keys):
641         (f):
642
643 2017-11-03  Mark Lam  <mark.lam@apple.com>
644
645         CachedCall (and its clients) needs overflow checks.
646         https://bugs.webkit.org/show_bug.cgi?id=179185
647
648         Reviewed by JF Bastien.
649
650         * stress/regress-179185.js: Added.
651
652 2017-11-02  Michael Saboff  <msaboff@apple.com>
653
654         DFG needs to handle code motion of code in for..in loop bodies
655         https://bugs.webkit.org/show_bug.cgi?id=179212
656
657         Reviewed by Keith Miller.
658
659         New regression test.
660
661         * stress/for-in-side-effects.js: Added.
662         (getPrototypeOf):
663         (reset):
664         (testWithoutFTL.f):
665         (testWithoutFTL):
666         (testWithFTL.f):
667         (testWithFTL):
668
669 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
670
671         AI does not correctly model the clobber case of ArithClz32
672         https://bugs.webkit.org/show_bug.cgi?id=179188
673
674         Reviewed by Michael Saboff.
675
676         * stress/arith-clz32-effects.js: Added.
677         (foo):
678         (valueOf):
679
680 2017-11-01  Michael Saboff  <msaboff@apple.com>
681
682         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
683         https://bugs.webkit.org/show_bug.cgi?id=179140
684
685         Reviewed by Saam Barati.
686
687         New regression test.
688
689         * stress/regress-179140.js: Added.
690         (testWithoutFTL):
691         (testWithFTL):
692
693 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
694
695         [JSC] Introduce @toObject
696         https://bugs.webkit.org/show_bug.cgi?id=178726
697
698         Reviewed by Saam Barati.
699
700         * stress/array-copywithin.js:
701         (shouldThrow):
702         * stress/object-constructor-boolean-edge.js: Added.
703         (shouldBe):
704         (test):
705         * stress/object-constructor-global.js: Added.
706         (shouldBe):
707         * stress/object-constructor-null-edge.js: Added.
708         (shouldBe):
709         (test):
710         * stress/object-constructor-number-edge.js: Added.
711         (shouldBe):
712         (test):
713         * stress/object-constructor-object-edge.js: Added.
714         (shouldBe):
715         (test):
716         (i.arg):
717         * stress/object-constructor-string-edge.js: Added.
718         (shouldBe):
719         (test):
720         * stress/object-constructor-symbol-edge.js: Added.
721         (shouldBe):
722         (test):
723         * stress/object-constructor-undefined-edge.js: Added.
724         (shouldBe):
725         (test):
726         * stress/symbol-array-from.js: Added.
727         (shouldBe):
728         * stress/to-object-intrinsic-boolean-edge.js: Added.
729         (shouldBe):
730         (builtin.createBuiltin):
731         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
732         (shouldThrow):
733         * stress/to-object-intrinsic-number-edge.js: Added.
734         (shouldBe):
735         (builtin.createBuiltin):
736         * stress/to-object-intrinsic-object-edge.js: Added.
737         (shouldBe):
738         (builtin.createBuiltin):
739         (i.arg):
740         * stress/to-object-intrinsic-string-edge.js: Added.
741         (shouldBe):
742         (builtin.createBuiltin):
743         * stress/to-object-intrinsic-symbol-edge.js: Added.
744         (shouldBe):
745         (builtin.createBuiltin):
746         * stress/to-object-intrinsic.js: Added.
747         (shouldBe):
748         (shouldThrow):
749         (builtin.createBuiltin):
750
751 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
752
753         [DFG][FTL] Introduce StringSlice
754         https://bugs.webkit.org/show_bug.cgi?id=178934
755
756         Reviewed by Saam Barati.
757
758         * microbenchmarks/string-slice-empty.js: Added.
759         (slice):
760         * microbenchmarks/string-slice-one-char.js: Added.
761         (slice):
762         * microbenchmarks/string-slice.js: Added.
763         (slice):
764
765 2017-10-26  Michael Saboff  <msaboff@apple.com>
766
767         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
768         https://bugs.webkit.org/show_bug.cgi?id=178890
769
770         Reviewed by Keith Miller.
771
772         New regression test.
773
774         * stress/regress-178890.js: Added.
775
776 2017-10-26  Mark Lam  <mark.lam@apple.com>
777
778         JSRopeString::RopeBuilder::append() should check for overflows.
779         https://bugs.webkit.org/show_bug.cgi?id=178385
780         <rdar://problem/35027468>
781
782         Reviewed by Saam Barati.
783
784         * stress/regress-178385.js: Added.
785
786 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
787
788         Unreviewed, rolling out r223961.
789
790         The change that required this has been rolled out.
791
792         Reverted changeset:
793
794         "Mark test262.yaml/test262/test/language/statements/try/tco-
795         catch.js as passing."
796         https://bugs.webkit.org/show_bug.cgi?id=178592
797         https://trac.webkit.org/changeset/223961
798
799 2017-10-25  Commit Queue  <commit-queue@webkit.org>
800
801         Unreviewed, rolling out r223691 and r223729.
802         https://bugs.webkit.org/show_bug.cgi?id=178834
803
804         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
805         by rniwa on #webkit).
806
807         Reverted changesets:
808
809         "Turn recursive tail calls into loops"
810         https://bugs.webkit.org/show_bug.cgi?id=176601
811         https://trac.webkit.org/changeset/223691
812
813         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
814         comparison is always false due to limited range of data type
815         [-Wtype-limits]"
816         https://bugs.webkit.org/show_bug.cgi?id=178543
817         https://trac.webkit.org/changeset/223729
818
819 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
820
821         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
822         https://bugs.webkit.org/show_bug.cgi?id=178592
823
824         Unreviewed test gardening.
825
826         * test262.yaml:
827
828 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
829
830         [FTL] Support NewStringObject
831         https://bugs.webkit.org/show_bug.cgi?id=178737
832
833         Reviewed by Saam Barati.
834
835         * stress/new-string-object.js: Added.
836         (shouldBe):
837         (test):
838
839 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
840
841         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
842         https://bugs.webkit.org/show_bug.cgi?id=178308
843
844         Reviewed by Mark Lam.
845
846         * test262.yaml:
847
848 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
849
850         [JSC] Use fastJoin in Array#toString
851         https://bugs.webkit.org/show_bug.cgi?id=178062
852
853         Reviewed by Darin Adler.
854
855         * microbenchmarks/contiguous-array-to-string.js: Added.
856         (target):
857         * microbenchmarks/double-array-to-string.js: Added.
858         (target):
859         * microbenchmarks/int32-array-to-string.js: Added.
860         (target):
861
862 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
863
864         stress/check-string-ident.js is improperly skipped
865         https://bugs.webkit.org/show_bug.cgi?id=178642
866
867         Reviewed by Saam Barati.
868
869         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
870         since it enforces the run-jsc-stress-tests script to still set up the
871         test to run, despite the skip directive that's used before.
872
873 2017-10-20  Mark Lam  <mark.lam@apple.com>
874
875         Add a test case for r214334.
876         https://bugs.webkit.org/show_bug.cgi?id=169941
877         <rdar://problem/31221258>
878
879         Reviewed by JF Bastien.
880
881         * stress/regress-169941.js: Added.
882
883 2017-10-19  JF Bastien  <jfbastien@apple.com>
884
885         WebAssembly: no VM / JS version of everything but Instance
886         https://bugs.webkit.org/show_bug.cgi?id=177473
887
888         Reviewed by Filip Pizlo, Saam Barati.
889
890         - Exceeding max on memory growth now returns a range error as per
891         spec. This is a (very minor) breaking change: it used to throw OOM
892         error. Update the corresponding test.
893
894         * wasm/js-api/memory-grow.js:
895         (assertEq):
896         * wasm/js-api/table.js:
897         (assert.throws):
898
899 2017-10-19  Mark Lam  <mark.lam@apple.com>
900
901         Stringifier::appendStringifiedValue() is missing an exception check.
902         https://bugs.webkit.org/show_bug.cgi?id=178386
903         <rdar://problem/35027610>
904
905         Reviewed by Saam Barati.
906
907         * stress/regress-178386.js: Added.
908
909 2017-10-19  Michael Saboff  <msaboff@apple.com>
910
911         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
912         https://bugs.webkit.org/show_bug.cgi?id=178521
913
914         Reviewed by JF Bastien.
915
916         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
917         now passes with the current version (5.0) of the Emoji spec.
918
919 2017-10-19  Robin Morisset  <rmorisset@apple.com>
920
921         Turn recursive tail calls into loops
922         https://bugs.webkit.org/show_bug.cgi?id=176601
923
924         Reviewed by Saam Barati.
925
926         Add some simple test that computes factorial in several ways, and other trivial computations.
927         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
928         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
929         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
930         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
931
932         * stress/inline-call-to-recursive-tail-call.js: Added.
933         (factorial.aux):
934         (factorial):
935         (factorial2.aux):
936         (factorial2.id):
937         (factorial2):
938         (factorial3.aux):
939         (factorial3):
940         (aux):
941         (factorial4):
942         (test):
943
944 2017-10-18  Mark Lam  <mark.lam@apple.com>
945
946         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
947         https://bugs.webkit.org/show_bug.cgi?id=177600
948         <rdar://problem/34710985>
949
950         Reviewed by Saam Barati.
951
952         * stress/regress-177600.js: Added.
953
954 2017-10-18  Mark Lam  <mark.lam@apple.com>
955
956         The compiler should always register a structure when it adds its transitionWatchPointSet.
957         https://bugs.webkit.org/show_bug.cgi?id=178420
958         <rdar://problem/34814024>
959
960         Reviewed by Saam Barati and Filip Pizlo.
961
962         * stress/regress-178420.js: Added.
963         (new.Array.10000.map):
964
965 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
966
967         [JSC] __proto__ getter should be fast
968         https://bugs.webkit.org/show_bug.cgi?id=178067
969
970         Reviewed by Saam Barati.
971
972         * stress/dfg-object-proto-accessor.js: Added.
973         (shouldBe):
974         (shouldThrow):
975         (target):
976         * stress/dfg-object-proto-getter.js: Added.
977         (shouldBe):
978         (shouldThrow):
979         (target):
980         * stress/dfg-object-prototype-of.js: Added.
981         (shouldBe):
982         (shouldThrow):
983         (target):
984         * stress/dfg-reflect-get-prototype-of.js: Added.
985         (shouldBe):
986         (shouldThrow):
987         (target):
988         * stress/intrinsic-getter-with-poly-proto.js: Added.
989         (shouldBe):
990         (makePolyProtoObject.foo.C):
991         (makePolyProtoObject.foo):
992         (makePolyProtoObject):
993         (target):
994         * stress/object-get-prototype-of-filtered.js: Added.
995         (shouldBe):
996         (shouldThrow):
997         (target):
998         (i.Cocoa):
999         * stress/object-get-prototype-of-mono-proto.js: Added.
1000         (shouldBe):
1001         (makePolyProtoObject.foo.C):
1002         (makePolyProtoObject.foo):
1003         (makePolyProtoObject):
1004         (target):
1005         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1006         (shouldBe):
1007         (makePolyProtoObject.foo.C):
1008         (makePolyProtoObject.foo):
1009         (makePolyProtoObject):
1010         (target):
1011         * stress/object-get-prototype-of-poly-proto.js: Added.
1012         (shouldBe):
1013         (makePolyProtoObject.foo.C):
1014         (makePolyProtoObject.foo):
1015         (makePolyProtoObject):
1016         (target):
1017         * stress/object-proto-getter-filtered.js: Added.
1018         (shouldBe):
1019         (shouldThrow):
1020         (target):
1021         (i.Cocoa):
1022         * stress/object-proto-getter-poly-mono-proto.js: Added.
1023         (shouldBe):
1024         (makePolyProtoObject.foo.C):
1025         (makePolyProtoObject.foo):
1026         (makePolyProtoObject):
1027         (target):
1028         * stress/object-proto-getter-poly-proto.js: Added.
1029         (shouldBe):
1030         (makePolyProtoObject.foo.C):
1031         (makePolyProtoObject.foo):
1032         (makePolyProtoObject):
1033         (target):
1034         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1035         * stress/string-proto.js: Added.
1036         (shouldBe):
1037         (target):
1038
1039 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1040
1041         Unreviewed, rolling out r223523.
1042
1043         A test for this change is failing on debug JSC bots.
1044
1045         Reverted changeset:
1046
1047         "[JSC] __proto__ getter should be fast"
1048         https://bugs.webkit.org/show_bug.cgi?id=178067
1049         https://trac.webkit.org/changeset/223523
1050
1051 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1052
1053         [JSC] __proto__ getter should be fast
1054         https://bugs.webkit.org/show_bug.cgi?id=178067
1055
1056         Reviewed by Saam Barati.
1057
1058         * stress/dfg-object-proto-accessor.js: Added.
1059         (shouldBe):
1060         (shouldThrow):
1061         (target):
1062         * stress/dfg-object-proto-getter.js: Added.
1063         (shouldBe):
1064         (shouldThrow):
1065         (target):
1066         * stress/dfg-object-prototype-of.js: Added.
1067         (shouldBe):
1068         (shouldThrow):
1069         (target):
1070         * stress/dfg-reflect-get-prototype-of.js: Added.
1071         (shouldBe):
1072         (shouldThrow):
1073         (target):
1074         * stress/object-get-prototype-of-filtered.js: Added.
1075         (shouldBe):
1076         (shouldThrow):
1077         (target):
1078         (i.Cocoa):
1079         * stress/object-get-prototype-of-mono-proto.js: Added.
1080         (shouldBe):
1081         (makePolyProtoObject.foo.C):
1082         (makePolyProtoObject.foo):
1083         (makePolyProtoObject):
1084         (target):
1085         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1086         (shouldBe):
1087         (makePolyProtoObject.foo.C):
1088         (makePolyProtoObject.foo):
1089         (makePolyProtoObject):
1090         (target):
1091         * stress/object-get-prototype-of-poly-proto.js: Added.
1092         (shouldBe):
1093         (makePolyProtoObject.foo.C):
1094         (makePolyProtoObject.foo):
1095         (makePolyProtoObject):
1096         (target):
1097         * stress/object-proto-getter-filtered.js: Added.
1098         (shouldBe):
1099         (shouldThrow):
1100         (target):
1101         (i.Cocoa):
1102         * stress/object-proto-getter-poly-mono-proto.js: Added.
1103         (shouldBe):
1104         (makePolyProtoObject.foo.C):
1105         (makePolyProtoObject.foo):
1106         (makePolyProtoObject):
1107         (target):
1108         * stress/object-proto-getter-poly-proto.js: Added.
1109         (shouldBe):
1110         (makePolyProtoObject.foo.C):
1111         (makePolyProtoObject.foo):
1112         (makePolyProtoObject):
1113         (target):
1114         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1115         * stress/string-proto.js: Added.
1116         (shouldBe):
1117         (target):
1118
1119 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1120
1121         Reland "Add Above/Below comparisons for UInt32 patterns"
1122         https://bugs.webkit.org/show_bug.cgi?id=177281
1123
1124         Reviewed by Saam Barati.
1125
1126         * stress/uint32-comparison-jump.js: Added.
1127         (shouldBe):
1128         (above):
1129         (aboveOrEqual):
1130         (below):
1131         (belowOrEqual):
1132         (notAbove):
1133         (notAboveOrEqual):
1134         (notBelow):
1135         (notBelowOrEqual):
1136         * stress/uint32-comparison.js: Added.
1137         (shouldBe):
1138         (above):
1139         (aboveOrEqual):
1140         (below):
1141         (belowOrEqual):
1142         (aboveTest):
1143         (aboveOrEqualTest):
1144         (belowTest):
1145         (belowOrEqualTest):
1146
1147 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1148
1149         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1150         https://bugs.webkit.org/show_bug.cgi?id=178210
1151
1152         Reviewed by Saam Barati.
1153
1154         * wasm/function-tests/trap-from-start-async.js:
1155         (async.StartTrapsAsync):
1156         * wasm/function-tests/trap-from-start.js:
1157         (StartTraps):
1158         * wasm/js-api/web-assembly-function.js:
1159         (assert.eq.Object.getPrototypeOf):
1160         * wasm/js-api/wrapper-function.js:
1161         (return.new.WebAssembly.Module):
1162         (assert.throws.makeInstance): Deleted.
1163         (assert.throws.Bar): Deleted.
1164         (assert.throws): Deleted.
1165
1166 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1167
1168         Enable gigacage on iOS
1169         https://bugs.webkit.org/show_bug.cgi?id=177586
1170
1171         Reviewed by JF Bastien.
1172         
1173         Add tests for when Gigacage gets runtime disabled.
1174
1175         * stress/disable-gigacage-arrays.js: Added.
1176         (foo):
1177         * stress/disable-gigacage-strings.js: Added.
1178         (foo):
1179         * stress/disable-gigacage-typed-arrays.js: Added.
1180         (foo):
1181
1182 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1183
1184         import.meta should not be assignable
1185         https://bugs.webkit.org/show_bug.cgi?id=178202
1186
1187         Reviewed by Saam Barati.
1188
1189         * modules/import-meta-assignment.js: Added.
1190         (shouldThrow):
1191         (SyntaxError.import.meta.can.shouldThrow):
1192
1193 2017-10-11  Saam Barati  <sbarati@apple.com>
1194
1195         Unreviewed. Actually skip certain type profiler tests in debug.
1196
1197         * typeProfiler.yaml:
1198         * typeProfiler/deltablue-for-of.js:
1199         * typeProfiler/getter-richards.js:
1200
1201 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1202
1203         Unreviewed, rolling out r223113 and r223121.
1204         https://bugs.webkit.org/show_bug.cgi?id=178182
1205
1206         Reintroduced 20% regression on Kraken (Requested by rniwa on
1207         #webkit).
1208
1209         Reverted changesets:
1210
1211         "Enable gigacage on iOS"
1212         https://bugs.webkit.org/show_bug.cgi?id=177586
1213         https://trac.webkit.org/changeset/223113
1214
1215         "Use one virtual allocation for all gigacages and their
1216         runways"
1217         https://bugs.webkit.org/show_bug.cgi?id=178050
1218         https://trac.webkit.org/changeset/223121
1219
1220 2017-10-11  Michael Saboff  <msaboff@apple.com>
1221
1222         Disable test262 named capture group tests with direct unicode names and with references before definitions
1223         https://bugs.webkit.org/show_bug.cgi?id=178177
1224
1225         Reviewed by Keith Miller.
1226
1227         Bugs to track fixing these test are:
1228         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1229             "Add support in named capture group identifiers for direct surrogate pairs"
1230         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1231             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1232
1233         * test262.yaml:
1234
1235 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1236
1237         Object properties are undefined in super.call() but not in this.call()
1238         https://bugs.webkit.org/show_bug.cgi?id=177230
1239
1240         Reviewed by Saam Barati.
1241
1242         * stress/super-call-function-subclass.js: Added.
1243         (assert):
1244         (A.prototype.t):
1245         (A):
1246         * stress/super-dot-call-and-apply.js: Added.
1247         (assert):
1248         (A):
1249         (A.prototype.call):
1250         (A.prototype.apply):
1251         (B.prototype.testSuper):
1252         (B):
1253         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1254         (D.prototype.testSuper):
1255         (D):
1256
1257 2017-10-10  Saam Barati  <sbarati@apple.com>
1258
1259         The prototype cache should be aware of the Executable it generates a Structure for
1260         https://bugs.webkit.org/show_bug.cgi?id=177907
1261
1262         Reviewed by Filip Pizlo.
1263
1264         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1265         (assert):
1266         (foo.C):
1267         (foo):
1268         (bar.C):
1269         (bar):
1270         (access):
1271         (makeLongChain):
1272         (accessY):
1273
1274 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1275
1276         `async` should be able to be used as an imported binding name
1277         https://bugs.webkit.org/show_bug.cgi?id=176573
1278
1279         Reviewed by Saam Barati.
1280
1281         * modules/import-default-async.js: Added.
1282         * modules/import-named-async-as.js: Added.
1283         * modules/import-named-async.js: Added.
1284         * modules/import-named-async/target.js: Added.
1285         * modules/import-namespace-async.js: Added.
1286         * test262.yaml:
1287
1288 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1289
1290         Enable gigacage on iOS
1291         https://bugs.webkit.org/show_bug.cgi?id=177586
1292
1293         Reviewed by JF Bastien.
1294         
1295         Add tests for when Gigacage gets runtime disabled.
1296
1297         * stress/disable-gigacage-arrays.js: Added.
1298         (foo):
1299         * stress/disable-gigacage-strings.js: Added.
1300         (foo):
1301         * stress/disable-gigacage-typed-arrays.js: Added.
1302         (foo):
1303
1304 2017-10-09  Michael Saboff  <msaboff@apple.com>
1305
1306         Implement RegExp Unicode property escapes
1307         https://bugs.webkit.org/show_bug.cgi?id=172069
1308
1309         Reviewed by JF Bastien.
1310
1311         Enabled Unicode Property tests.
1312
1313         * test262.yaml:
1314
1315 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1316
1317         Unreviewed, rolling out r223015 and r223025.
1318         https://bugs.webkit.org/show_bug.cgi?id=178093
1319
1320         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1321         #webkit).
1322
1323         Reverted changesets:
1324
1325         "Enable gigacage on iOS"
1326         https://bugs.webkit.org/show_bug.cgi?id=177586
1327         http://trac.webkit.org/changeset/223015
1328
1329         "Unreviewed, disable Gigacage on ARM64 Linux"
1330         https://bugs.webkit.org/show_bug.cgi?id=177586
1331         http://trac.webkit.org/changeset/223025
1332
1333 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1334
1335         Update expectations for test262 tests that pass after r223043.
1336         https://bugs.webkit.org/show_bug.cgi?id=176685
1337
1338         Unreviewed test gardening.
1339
1340         * test262.yaml:
1341
1342 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1343
1344         Unreviewed, rolling out r223022.
1345
1346         This change introduced 18 test262 failures.
1347
1348         Reverted changeset:
1349
1350         "`async` should be able to be used as an imported binding
1351         name"
1352         https://bugs.webkit.org/show_bug.cgi?id=176573
1353         http://trac.webkit.org/changeset/223022
1354
1355 2017-10-09  Saam Barati  <sbarati@apple.com>
1356
1357         3 poly-proto JSC tests timing out on debug after r222827
1358         https://bugs.webkit.org/show_bug.cgi?id=177880
1359         <rdar://problem/34817122>
1360
1361         Unreviewed.
1362
1363         I'm skipping these type profiler tests on debug since they are long running.
1364
1365         * typeProfiler/deltablue-for-of.js:
1366         * typeProfiler/getter-richards.js:
1367
1368 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1369
1370         Safari 10 /11 problem with if (!await get(something)).
1371         https://bugs.webkit.org/show_bug.cgi?id=176685
1372
1373         Reviewed by Saam Barati.
1374
1375         * stress/async-await-basic.js:
1376         (awaitEpression.async):
1377         * stress/async-await-syntax.js:
1378         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1379         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1380
1381 2017-10-08  Saam Barati  <sbarati@apple.com>
1382
1383         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1384
1385         * typeProfiler/deltablue-for-of.js:
1386         * typeProfiler/getter-richards.js:
1387
1388 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1389
1390         `async` should be able to be used as an imported binding name
1391         https://bugs.webkit.org/show_bug.cgi?id=176573
1392
1393         Reviewed by Darin Adler.
1394
1395         * modules/import-default-async.js: Added.
1396         * modules/import-named-async-as.js: Added.
1397         * modules/import-named-async.js: Added.
1398         * modules/import-named-async/target.js: Added.
1399         * modules/import-namespace-async.js: Added.
1400
1401 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1402
1403         Enable gigacage on iOS
1404         https://bugs.webkit.org/show_bug.cgi?id=177586
1405
1406         Reviewed by JF Bastien.
1407         
1408         Add tests for when Gigacage gets runtime disabled.
1409
1410         * stress/disable-gigacage-arrays.js: Added.
1411         (foo):
1412         * stress/disable-gigacage-strings.js: Added.
1413         (foo):
1414         * stress/disable-gigacage-typed-arrays.js: Added.
1415         (foo):
1416
1417 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1418
1419         Unreviewed, rolling out r222791 and r222873.
1420         https://bugs.webkit.org/show_bug.cgi?id=178031
1421
1422         Caused crashes with workers/wasm LayoutTests (Requested by
1423         ryanhaddad on #webkit).
1424
1425         Reverted changesets:
1426
1427         "WebAssembly: no VM / JS version of everything but Instance"
1428         https://bugs.webkit.org/show_bug.cgi?id=177473
1429         http://trac.webkit.org/changeset/222791
1430
1431         "WebAssembly: address no VM / JS follow-ups"
1432         https://bugs.webkit.org/show_bug.cgi?id=177887
1433         http://trac.webkit.org/changeset/222873
1434
1435 2017-10-05  Saam Barati  <sbarati@apple.com>
1436
1437         Make sure all prototypes under poly proto get added into the VM's prototype map
1438         https://bugs.webkit.org/show_bug.cgi?id=177909
1439
1440         Reviewed by Keith Miller.
1441
1442         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1443         (assert):
1444         (foo.C):
1445         (foo):
1446         (set x):
1447
1448 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1449
1450         [JSC] Introduce import.meta
1451         https://bugs.webkit.org/show_bug.cgi?id=177703
1452
1453         Reviewed by Filip Pizlo.
1454
1455         * modules/import-meta-syntax.js: Added.
1456         (shouldThrow):
1457         (shouldNotThrow):
1458         * modules/import-meta.js: Added.
1459         * modules/import-meta/cocoa.js: Added.
1460         * modules/resources/assert.js:
1461         (export.shouldNotThrow):
1462         * stress/import-syntax.js:
1463
1464 2017-10-04  Saam Barati  <sbarati@apple.com>
1465
1466         Make pertinent AccessCases watch the poly proto watchpoint
1467         https://bugs.webkit.org/show_bug.cgi?id=177765
1468
1469         Reviewed by Keith Miller.
1470
1471         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1472         (assert):
1473         (foo.C):
1474         (foo):
1475         (validate):
1476         * stress/poly-proto-clear-stub.js: Added.
1477         (assert):
1478         (foo.C):
1479         (foo):
1480
1481 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1482
1483         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1484
1485         Unreviewed test gardening.
1486
1487         * test262.yaml:
1488
1489 2017-10-04  Saam Barati  <sbarati@apple.com>
1490
1491         3 poly-proto JSC tests timing out on debug after r222827
1492         https://bugs.webkit.org/show_bug.cgi?id=177880
1493
1494         Rubber stamped by Mark Lam.
1495
1496         * microbenchmarks/poly-proto-access.js:
1497         * typeProfiler/deltablue-for-of.js:
1498         * typeProfiler/getter-richards.js:
1499
1500 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1501
1502         Unreviewed, marking tco-catch.js as a failure after test262 update
1503         https://bugs.webkit.org/show_bug.cgi?id=177859
1504
1505         * test262.yaml:
1506
1507 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1508
1509         Unreviewed, marking one async iterator test262 test failed
1510         https://bugs.webkit.org/show_bug.cgi?id=177859
1511
1512         * test262.yaml:
1513
1514 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1515
1516         [Test262] Update Test262 to Oct 4 version
1517         https://bugs.webkit.org/show_bug.cgi?id=177859
1518
1519         Reviewed by Sam Weinig.
1520
1521         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1522         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1523
1524         * test262.yaml:
1525         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1526         (checkSequence):
1527         * test262/harness/typeCoercion.js:
1528         (testCoercibleToIndexZero):
1529         (testCoercibleToIndexOne):
1530         (testCoercibleToIndexFromIndex):
1531         (testNotCoercibleToIndex.testPrimitiveValue):
1532         (testNotCoercibleToInteger):
1533         (testCoercibleToBigIntZero.testPrimitiveValue):
1534         (testCoercibleToBigIntZero):
1535         (testCoercibleToBigIntOne.testPrimitiveValue):
1536         (testCoercibleToBigIntOne):
1537         (testPrimitiveValue):
1538         (testCoercibleToBigIntFromBigInt):
1539         (testNotCoercibleToBigInt.testPrimitiveValue):
1540         (testNotCoercibleToBigInt.testStringValue):
1541         (testNotCoercibleToBigInt):
1542         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1543         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1544         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1545         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1546         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1547         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1548         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1549         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1550         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1551         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1552         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1553         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1554         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1555         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1556         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1557         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1558         (testCoercibleToBigIntZero):
1559         (testCoercibleToBigIntOne):
1560         (testNotCoercibleToBigInt):
1561         (MyError): Deleted.
1562         (valueOf): Deleted.
1563         (toString): Deleted.
1564         (Symbol.toPrimitive): Deleted.
1565         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1566         (testCoercibleToIndexZero):
1567         (testCoercibleToIndexOne):
1568         (testNotCoercibleToIndex):
1569         (MyError): Deleted.
1570         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1571         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1572         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1573         (BigInt.asIntN.valueOf): Deleted.
1574         (BigInt.asIntN.toString): Deleted.
1575         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1576         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1577         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1578         (testCoercibleToBigIntZero):
1579         (testCoercibleToBigIntOne):
1580         (testNotCoercibleToBigInt):
1581         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1582         (testCoercibleToIndexZero):
1583         (testCoercibleToIndexOne):
1584         (testNotCoercibleToIndex):
1585         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1586         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1587         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1588         (bits.valueOf):
1589         (bigint.valueOf):
1590         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1591         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1592         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1593         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1594         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1595         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1596         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1597         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1598         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1599         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1600         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1601         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1602         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1603         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1604         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1605         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1606         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1607         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1608         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1609         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1610         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1611         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1612         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1613         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1614         (replacer):
1615         (BigInt.prototype.toJSON):
1616         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1617         (replacer):
1618         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1619         (BigInt.prototype.toJSON):
1620         * test262/test/built-ins/JSON/stringify/bigint.js:
1621         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1622         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1623         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1624         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1625         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1626         * test262/test/built-ins/Object/proto-from-ctor.js:
1627         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1628         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1629         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1630         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1631         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1632         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1633         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1634         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1635         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1636         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1637         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1638         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1639         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1640         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1641         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1642         * test262/test/built-ins/Proxy/get-fn-realm.js:
1643         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1644         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1645         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1646         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1647         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1648         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1649         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1650         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1651         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1652         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1653         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1654         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1655         (i6.replace):
1656         (i6b.replace):
1657         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1658         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1659         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1660         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1661         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1662         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1663         * test262/test/built-ins/RegExp/u180e.js: Added.
1664         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1665         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1666         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1667         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1668         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1669         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1670         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1671         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1672         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1673         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1674         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1675         * test262/test/built-ins/String/prototype/endsWith/length.js:
1676         * test262/test/built-ins/String/prototype/endsWith/name.js:
1677         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1678         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1679         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1680         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1681         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1682         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1683         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1684         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1685         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1686         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1687         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1688         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1689         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1690         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1691         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1692         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1693         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1694         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1695         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1696         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1697         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1698         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1699         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1700         * test262/test/built-ins/String/prototype/includes/includes.js:
1701         * test262/test/built-ins/String/prototype/includes/length.js:
1702         * test262/test/built-ins/String/prototype/includes/name.js:
1703         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1704         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1705         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1706         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1707         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1708         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1709         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1710         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1711         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1712         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1713         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1714         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1715         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1716         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1717         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1718         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1719         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1720         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1721         * test262/test/built-ins/String/prototype/trim/u180e.js:
1722         * test262/test/built-ins/Symbol/for/cross-realm.js:
1723         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1724         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1725         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1726         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1727         * test262/test/built-ins/Symbol/match/cross-realm.js:
1728         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1729         * test262/test/built-ins/Symbol/search/cross-realm.js:
1730         * test262/test/built-ins/Symbol/species/cross-realm.js:
1731         * test262/test/built-ins/Symbol/split/cross-realm.js:
1732         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1733         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1734         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1735         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1736         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1737         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1738         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1739         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1740         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1741         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1742         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1743         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1744         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1745         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1746         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1747         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1748         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1749         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1750         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1751         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1752         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1753         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1754         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1755         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1756         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1757         * test262/test/language/eval-code/indirect/realm.js:
1758         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1759         (o.get z):
1760         (o.get a):
1761         * test262/test/language/expressions/call/eval-realm-indirect.js:
1762         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1763         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1764         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1765         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1766         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1767         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1768         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1769         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1770         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1771         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1772         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1773         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1774         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1775         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1776         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1777         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1778         * test262/test/language/expressions/less-than/bigint-and-number.js:
1779         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1780         * test262/test/language/expressions/super/realm.js:
1781         * test262/test/language/expressions/tagged-template/cache-realm.js:
1782         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1783         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1784         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1785         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1786         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1787         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1788         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1789         (o.get z):
1790         (o.get a):
1791         * test262/test/language/statements/for-of/iterator-next-reference.js:
1792         (next):
1793         (iterator.next): Deleted.
1794         (x.of.iterable.): Deleted.
1795         (x.of.iterable.get return): Deleted.
1796         (x.of.iterable.iterator.next): Deleted.
1797         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1798         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1799         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1800         * test262/test/language/white-space/mongolian-vowel-separator.js:
1801         * test262/test262-Revision.txt:
1802
1803 2017-10-03  Saam Barati  <sbarati@apple.com>
1804
1805         Implement polymorphic prototypes
1806         https://bugs.webkit.org/show_bug.cgi?id=176391
1807
1808         Reviewed by Filip Pizlo.
1809
1810         * microbenchmarks/poly-proto-access.js: Added.
1811         (assert):
1812         (foo.C):
1813         (foo.C.prototype.get bar):
1814         (foo):
1815         (bar):
1816         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1817         (assert):
1818         (makePolyProtoObject.foo.C):
1819         (makePolyProtoObject.foo):
1820         (makePolyProtoObject):
1821         (performSet):
1822         * microbenchmarks/poly-proto-setter-speed.js: Added.
1823         (assert):
1824         (makePolyProtoObject.foo.C):
1825         (makePolyProtoObject.foo.C.prototype.set p):
1826         (makePolyProtoObject.foo):
1827         (makePolyProtoObject):
1828         (performSet):
1829         * stress/constructor-with-return.js:
1830         (i.tests.forEach.Constructor):
1831         (i.tests.forEach):
1832         (tests.forEach.Constructor): Deleted.
1833         (tests.forEach): Deleted.
1834         * stress/dom-jit-with-poly-proto.js: Added.
1835         (assert):
1836         (makePolyProtoObject.foo.C):
1837         (makePolyProtoObject.foo):
1838         (makePolyProtoObject):
1839         (validate):
1840         * stress/poly-proto-custom-value-and-accessor.js: Added.
1841         (assert):
1842         (makePolyProtoObject.foo.C):
1843         (makePolyProtoObject.foo):
1844         (makePolyProtoObject):
1845         (items.forEach):
1846         (set get for):
1847         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1848         (assert):
1849         (makePolyProtoObject.foo.C):
1850         (makePolyProtoObject.foo):
1851         (makePolyProtoObject):
1852         (foo):
1853         * stress/poly-proto-miss.js: Added.
1854         (makePolyProtoInstanceWithNullPrototype.foo.C):
1855         (makePolyProtoInstanceWithNullPrototype.foo):
1856         (makePolyProtoInstanceWithNullPrototype):
1857         (assert):
1858         (validate):
1859         * stress/poly-proto-op-in-caching.js: Added.
1860         (assert):
1861         (makePolyProtoObject.foo.C):
1862         (makePolyProtoObject.foo):
1863         (makePolyProtoObject):
1864         (validate):
1865         (validate2):
1866         * stress/poly-proto-put-transition.js: Added.
1867         (assert):
1868         (makePolyProtoObject.foo.C):
1869         (makePolyProtoObject.foo):
1870         (makePolyProtoObject):
1871         (performSet):
1872         (i.obj.__proto__.set p):
1873         * stress/poly-proto-set-prototype.js: Added.
1874         (assert):
1875         (let.alternateProto.get x):
1876         (let.alternateProto2.get y):
1877         (let.alternateProto2.get x):
1878         (foo.C):
1879         (foo):
1880         (validate):
1881         * stress/poly-proto-setter.js: Added.
1882         (assert):
1883         (makePolyProtoObject.foo.C):
1884         (makePolyProtoObject.foo.C.prototype.set p):
1885         (makePolyProtoObject.foo.C.prototype.get p):
1886         (makePolyProtoObject.foo):
1887         (makePolyProtoObject):
1888         (performSet):
1889         * stress/poly-proto-using-inheritance.js: Added.
1890         (assert):
1891         (foo.C):
1892         (foo.C.prototype.get baz):
1893         (foo):
1894         (bar.C):
1895         (bar):
1896         (validate):
1897         * stress/primitive-poly-proto.js: Added.
1898         (makePolyProtoInstance.foo.C):
1899         (makePolyProtoInstance.foo):
1900         (makePolyProtoInstance):
1901         (assert):
1902         (validate):
1903         * stress/prototype-is-not-js-object.js: Added.
1904         (foo.bar):
1905         (foo):
1906         (assert):
1907         (validate):
1908         * stress/try-get-by-id-poly-proto.js: Added.
1909         (assert):
1910         (makePolyProtoObject.foo.C):
1911         (makePolyProtoObject.foo):
1912         (makePolyProtoObject):
1913         (tryGetByIdText):
1914         (x.__proto__.get bar):
1915         (validate):
1916         * typeProfiler/overflow.js:
1917
1918 2017-10-03  JF Bastien  <jfbastien@apple.com>
1919
1920         WebAssembly: no VM / JS version of everything but Instance
1921         https://bugs.webkit.org/show_bug.cgi?id=177473
1922
1923         Reviewed by Filip Pizlo.
1924
1925         - Exceeding max on memory growth now returns a range error as per
1926         spec. This is a (very minor) breaking change: it used to throw OOM
1927         error. Update the corresponding test.
1928
1929         * wasm/js-api/memory-grow.js:
1930         (assertEq):
1931         * wasm/js-api/table.js:
1932         (assert.throws):
1933
1934 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1935
1936         Skip JSC test stress/regress-159779-2.js on debug.
1937         https://bugs.webkit.org/show_bug.cgi?id=177204
1938
1939         Unreviewed test gardening.
1940
1941         * stress/regress-159779-2.js:
1942
1943 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1944
1945         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1946         https://bugs.webkit.org/show_bug.cgi?id=175642
1947
1948         Reviewed by Darin Adler.
1949
1950         * ChakraCore/test/Function/apply3.baseline-jsc:
1951
1952 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1953
1954         Unreviewed, rolling out r222564.
1955         https://bugs.webkit.org/show_bug.cgi?id=177720
1956
1957         "It regressed JetStream by 2% on iOS caused by a 50%
1958         regression on the bigfib subtest" (Requested by saamyjoon on
1959         #webkit).
1960
1961         Reverted changeset:
1962
1963         "Add Above/Below comparisons for UInt32 patterns"
1964         https://bugs.webkit.org/show_bug.cgi?id=177281
1965         http://trac.webkit.org/changeset/222564
1966
1967 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1968
1969         [DFG] Support ArrayPush with multiple args
1970         https://bugs.webkit.org/show_bug.cgi?id=175823
1971
1972         Reviewed by Saam Barati.
1973
1974         * microbenchmarks/array-push-0.js: Added.
1975         (arrayPush0):
1976         * microbenchmarks/array-push-1.js: Added.
1977         (arrayPush1):
1978         * microbenchmarks/array-push-2.js: Added.
1979         (arrayPush2):
1980         * microbenchmarks/array-push-3.js: Added.
1981         (arrayPush3):
1982         * stress/array-push-multiple-contiguous.js: Added.
1983         (shouldBe):
1984         (test):
1985         * stress/array-push-multiple-double-nan.js: Added.
1986         (shouldBe):
1987         (test):
1988         * stress/array-push-multiple-double.js: Added.
1989         (shouldBe):
1990         (test):
1991         * stress/array-push-multiple-int32.js: Added.
1992         (shouldBe):
1993         (test):
1994         * stress/array-push-multiple-many-contiguous.js: Added.
1995         (shouldBe):
1996         (test):
1997         * stress/array-push-multiple-many-double.js: Added.
1998         (shouldBe):
1999         (test):
2000         * stress/array-push-multiple-many-int32.js: Added.
2001         (shouldBe):
2002         (test):
2003         * stress/array-push-multiple-many-storage.js: Added.
2004         (shouldBe):
2005         (test):
2006         * stress/array-push-multiple-storage.js: Added.
2007         (shouldBe):
2008         (test):
2009         * stress/array-push-with-force-exit.js: Added.
2010         (target.createBuiltin):
2011
2012 2017-09-29  Saam Barati  <sbarati@apple.com>
2013
2014         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2015         https://bugs.webkit.org/show_bug.cgi?id=177639
2016
2017         Reviewed by Geoffrey Garen.
2018
2019         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2020         (assert):
2021         (Class):
2022         (items.forEach):
2023         (set get for):
2024
2025 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2026
2027         Unreviewed, rolling out r222563, r222565, and r222581.
2028         https://bugs.webkit.org/show_bug.cgi?id=177675
2029
2030         "It causes a crash when playing youtube videos" (Requested by
2031         saamyjoon on #webkit).
2032
2033         Reverted changesets:
2034
2035         "[DFG] Support ArrayPush with multiple args"
2036         https://bugs.webkit.org/show_bug.cgi?id=175823
2037         http://trac.webkit.org/changeset/222563
2038
2039         "Unreviewed, build fix after r222563"
2040         https://bugs.webkit.org/show_bug.cgi?id=175823
2041         http://trac.webkit.org/changeset/222565
2042
2043         "Unreviewed, fix x86 breaking due to exhausted registers"
2044         https://bugs.webkit.org/show_bug.cgi?id=175823
2045         http://trac.webkit.org/changeset/222581
2046
2047 2017-09-28  Mark Lam  <mark.lam@apple.com>
2048
2049         test262: Unexpected passes after r222617 and r222618.
2050         https://bugs.webkit.org/show_bug.cgi?id=177622
2051         <rdar://problem/34725960>
2052
2053         Reviewed by Saam Barati.
2054
2055         Update test262.yaml for tests that are now passing.
2056
2057         * test262.yaml:
2058
2059 2017-09-27  Michael Saboff  <msaboff@apple.com>
2060
2061         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2062         https://bugs.webkit.org/show_bug.cgi?id=177570
2063
2064         Reviewed by Filip Pizlo.
2065
2066         New regression test.
2067
2068         * stress/regress-177570.js: Added.
2069
2070 2017-09-28  Michael Saboff  <msaboff@apple.com>
2071
2072         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2073         https://bugs.webkit.org/show_bug.cgi?id=177423
2074
2075         Reviewed by Mark Lam.
2076
2077         Updated regression test.
2078
2079         * stress/regress-177423.js:
2080         (catch):
2081
2082 2017-09-27  Mark Lam  <mark.lam@apple.com>
2083
2084         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2085         https://bugs.webkit.org/show_bug.cgi?id=177584
2086         <rdar://problem/34463903>
2087
2088         Reviewed by Saam Barati.
2089
2090         * stress/regress-177584.js: Added.
2091         (assertEqual):
2092         (Array.prototype.Symbol.species):
2093
2094 2017-09-27  Saam Barati  <sbarati@apple.com>
2095
2096         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2097         https://bugs.webkit.org/show_bug.cgi?id=177523
2098
2099         Reviewed by Mark Lam.
2100
2101         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2102         (assert):
2103         (Test):
2104         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2105         (addMethods):
2106         (i.Test.prototype.propName):
2107
2108 2017-09-27  Mark Lam  <mark.lam@apple.com>
2109
2110         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2111         https://bugs.webkit.org/show_bug.cgi?id=177423
2112         <rdar://problem/34621320>
2113
2114         Reviewed by Keith Miller.
2115
2116         * stress/regress-177423.js: Added.
2117
2118 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2119
2120         Add Above/Below comparisons for UInt32 patterns
2121         https://bugs.webkit.org/show_bug.cgi?id=177281
2122
2123         Reviewed by Saam Barati.
2124
2125         * stress/uint32-comparison-jump.js: Added.
2126         (shouldBe):
2127         (above):
2128         (aboveOrEqual):
2129         (below):
2130         (belowOrEqual):
2131         (notAbove):
2132         (notAboveOrEqual):
2133         (notBelow):
2134         (notBelowOrEqual):
2135         * stress/uint32-comparison.js: Added.
2136         (shouldBe):
2137         (above):
2138         (aboveOrEqual):
2139         (below):
2140         (belowOrEqual):
2141         (aboveTest):
2142         (aboveOrEqualTest):
2143         (belowTest):
2144         (belowOrEqualTest):
2145
2146 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2147
2148         [DFG] Support ArrayPush with multiple args
2149         https://bugs.webkit.org/show_bug.cgi?id=175823
2150
2151         Reviewed by Saam Barati.
2152
2153         * microbenchmarks/array-push-0.js: Added.
2154         (arrayPush0):
2155         * microbenchmarks/array-push-1.js: Added.
2156         (arrayPush1):
2157         * microbenchmarks/array-push-2.js: Added.
2158         (arrayPush2):
2159         * microbenchmarks/array-push-3.js: Added.
2160         (arrayPush3):
2161         * stress/array-push-multiple-contiguous.js: Added.
2162         (shouldBe):
2163         (test):
2164         * stress/array-push-multiple-double-nan.js: Added.
2165         (shouldBe):
2166         (test):
2167         * stress/array-push-multiple-double.js: Added.
2168         (shouldBe):
2169         (test):
2170         * stress/array-push-multiple-int32.js: Added.
2171         (shouldBe):
2172         (test):
2173         * stress/array-push-multiple-many-contiguous.js: Added.
2174         (shouldBe):
2175         (test):
2176         * stress/array-push-multiple-many-double.js: Added.
2177         (shouldBe):
2178         (test):
2179         * stress/array-push-multiple-many-int32.js: Added.
2180         (shouldBe):
2181         (test):
2182         * stress/array-push-multiple-many-storage.js: Added.
2183         (shouldBe):
2184         (test):
2185         * stress/array-push-multiple-storage.js: Added.
2186         (shouldBe):
2187         (test):
2188
2189 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2190
2191         Unreviewed, rolling out r222518.
2192         https://bugs.webkit.org/show_bug.cgi?id=177507
2193
2194         Break the High Sierra build (Requested by yusukesuzuki on
2195         #webkit).
2196
2197         Reverted changeset:
2198
2199         "Add Above/Below comparisons for UInt32 patterns"
2200         https://bugs.webkit.org/show_bug.cgi?id=177281
2201         http://trac.webkit.org/changeset/222518
2202
2203 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2204
2205         Add Above/Below comparisons for UInt32 patterns
2206         https://bugs.webkit.org/show_bug.cgi?id=177281
2207
2208         Reviewed by Saam Barati.
2209
2210         * stress/uint32-comparison-jump.js: Added.
2211         (shouldBe):
2212         (above):
2213         (aboveOrEqual):
2214         (below):
2215         (belowOrEqual):
2216         (notAbove):
2217         (notAboveOrEqual):
2218         (notBelow):
2219         (notBelowOrEqual):
2220         * stress/uint32-comparison.js: Added.
2221         (shouldBe):
2222         (above):
2223         (aboveOrEqual):
2224         (below):
2225         (belowOrEqual):
2226         (aboveTest):
2227         (aboveOrEqualTest):
2228         (belowTest):
2229         (belowOrEqualTest):
2230
2231 2017-09-23  Keith Miller  <keith_miller@apple.com>
2232
2233         Fix infinite looping test262 test
2234         https://bugs.webkit.org/show_bug.cgi?id=177412
2235
2236         Reviewed by Yusuke Suzuki.
2237
2238         This test was poorly designed since failing it would cause the vm
2239         to inifinite loop. I've fixed it locally and will fix it on github pending
2240         the results of next weeks tc39 meeting.
2241
2242         * test262.yaml:
2243         * test262/test/language/statements/for-of/iterator-next-reference.js:
2244
2245 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2246
2247         test262: $.agent became $262.agent in test262 update
2248         https://bugs.webkit.org/show_bug.cgi?id=177407
2249
2250         Reviewed by Yusuke Suzuki.
2251
2252         * test262.yaml:
2253         ~320 tests pass now that we correctly make $262 available.
2254
2255 2017-09-22  Keith Miller  <keith_miller@apple.com>
2256
2257         Speculatively change iteration protocall to use the same next function
2258         https://bugs.webkit.org/show_bug.cgi?id=175653
2259
2260         Reviewed by Saam Barati.
2261
2262         Change test to match the new iteration behavior.
2263
2264         * stress/spread-optimized-properly.js:
2265
2266 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2267
2268         [DFG][FTL] Profile array vector length for array allocation
2269         https://bugs.webkit.org/show_bug.cgi?id=177051
2270
2271         Reviewed by Saam Barati.
2272
2273         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2274         (target):
2275
2276 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2277
2278         Unreviewed, rolling out r222380.
2279         https://bugs.webkit.org/show_bug.cgi?id=177352
2280
2281         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2282         #webkit).
2283
2284         Reverted changeset:
2285
2286         "[DFG][FTL] Profile array vector length for array allocation"
2287         https://bugs.webkit.org/show_bug.cgi?id=177051
2288         http://trac.webkit.org/changeset/222380
2289
2290 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2291
2292         [DFG][FTL] Profile array vector length for array allocation
2293         https://bugs.webkit.org/show_bug.cgi?id=177051
2294
2295         Reviewed by Saam Barati.
2296
2297         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2298         (target):
2299
2300 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2301
2302         Skip new hanging test262 tests.
2303         https://bugs.webkit.org/show_bug.cgi?id=177326
2304
2305         Unreviewed test gardening.
2306
2307         * test262.yaml:
2308
2309 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2310
2311         Mark 6 test262 tests as passing.
2312         https://bugs.webkit.org/show_bug.cgi?id=177307
2313
2314         Unreviewed test gardening.
2315
2316         * test262.yaml:
2317
2318 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2319
2320         Unreviewed follow-up to r222311.
2321
2322         * test262/harness/sta.js:
2323         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2324         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2325         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2326         * test262/test/built-ins/Array/from/elements-added-after.js:
2327         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2328         * test262/test/built-ins/Array/from/elements-updated-after.js:
2329         * test262/test/built-ins/Array/from/from-array.js:
2330         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2331         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2332         * test262/test/built-ins/Array/from/source-array-boundary.js:
2333         * test262/test/built-ins/Array/from/source-object-constructor.js:
2334         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2335         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2336         * test262/test/built-ins/Array/from/source-object-length.js:
2337         * test262/test/built-ins/Array/from/source-object-missing.js:
2338         * test262/test/built-ins/Array/from/source-object-without.js:
2339         * test262/test/built-ins/Array/from/this-null.js:
2340         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2341         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2342         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2343         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2344         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2345         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2346         * test262/test/language/literals/string/7.8.4-1gs.js:
2347         Fix some files that I failed to update when I applied my patch.
2348
2349 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2350
2351         Update test262 tests
2352         https://bugs.webkit.org/show_bug.cgi?id=177220
2353
2354         Reviewed by Saam Barati and Yusuke Suzuki.
2355
2356         * test262.yaml:
2357         * test262/test262-Revision.txt:
2358         New rebaselined expectations for all tests.
2359
2360         * test262/*:
2361         Updated.
2362
2363 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2364
2365         [DFG] Remove ToThis more aggressively
2366         https://bugs.webkit.org/show_bug.cgi?id=177056
2367
2368         Reviewed by Saam Barati.
2369
2370         * stress/generator-with-this-strict.js: Added.
2371         (shouldBe):
2372         (generator):
2373         (target):
2374         * stress/generator-with-this.js: Added.
2375         (shouldBe):
2376         (generator):
2377         (target):
2378
2379 2017-09-17  Michael Saboff  <msaboff@apple.com>
2380
2381         https://bugs.webkit.org/show_bug.cgi?id=177038
2382         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2383
2384         Reviewed by JF Bastien.
2385
2386         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2387         as it dies using too much memory.
2388
2389 2017-09-15  Saam Barati  <sbarati@apple.com>
2390
2391         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2392         https://bugs.webkit.org/show_bug.cgi?id=176981
2393
2394         Reviewed by Yusuke Suzuki.
2395
2396         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2397         (assert):
2398         (verify):
2399         (func):
2400         (const.bar.createBuiltin):
2401
2402 2017-09-14  Saam Barati  <sbarati@apple.com>
2403
2404         It should be valid to exit before each set when doing arity fixup when inlining
2405         https://bugs.webkit.org/show_bug.cgi?id=176948
2406
2407         Reviewed by Keith Miller.
2408
2409         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2410         (baz):
2411         (bar):
2412         (foo):
2413
2414 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2415
2416         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2417         https://bugs.webkit.org/show_bug.cgi?id=176867
2418
2419         Reviewed by Sam Weinig.
2420
2421         * microbenchmarks/object-get-own-property-symbols.js: Added.
2422         (test):
2423
2424 2017-09-13  Mark Lam  <mark.lam@apple.com>
2425
2426         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2427         https://bugs.webkit.org/show_bug.cgi?id=176888
2428         <rdar://problem/34381832>
2429
2430         Not reviewed.
2431
2432         * stress/op_mod-ConstVar.js:
2433         * stress/op_mod-VarConst.js:
2434         * stress/op_mod-VarVar.js:
2435
2436 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2437
2438         Skip 3 op_mod tests on Debug JSC bots.
2439         https://bugs.webkit.org/show_bug.cgi?id=176630
2440
2441         Unreviewed test gardening.
2442
2443         * stress/op_mod-ConstVar.js:
2444         * stress/op_mod-VarConst.js:
2445         * stress/op_mod-VarVar.js:
2446
2447 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2448
2449         [JSC] Fix Array allocation in Object.keys
2450         https://bugs.webkit.org/show_bug.cgi?id=176826
2451
2452         Reviewed by Saam Barati.
2453
2454         * stress/object-own-property-keys.js: Added.
2455         (shouldBe):
2456
2457 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2458
2459         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2460         https://bugs.webkit.org/show_bug.cgi?id=176010
2461
2462         Reviewed by Filip Pizlo.
2463
2464         * microbenchmarks/weak-map-key.js: Added.
2465         (assert):
2466         (objectKey):
2467         (let.start.Date.now):
2468
2469 2017-09-12  Mark Lam  <mark.lam@apple.com>
2470
2471         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2472         https://bugs.webkit.org/show_bug.cgi?id=176630
2473
2474         Reviewed by JF Bastien.
2475
2476         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2477         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2478         a speculative fix for the bots that are seeing these fail.
2479
2480         I also undid the skipping of the op_mod tests for debug builds.
2481
2482         * stress/op_div-ConstVar.js:
2483         * stress/op_div-VarConst.js:
2484         * stress/op_div-VarVar.js:
2485         * stress/op_mod-ConstVar.js:
2486         * stress/op_mod-VarConst.js:
2487         * stress/op_mod-VarVar.js:
2488
2489 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2490
2491         Skip stress/value-to-boolean.js on Debug bots.
2492         https://bugs.webkit.org/show_bug.cgi?id=176787
2493
2494         Unreviewed test gardening.
2495
2496         * stress/value-to-boolean.js:
2497
2498 2017-09-11  Mark Lam  <mark.lam@apple.com>
2499
2500         Change test expectation for test262/test/language/statements/try/tco-catch.js
2501         https://bugs.webkit.org/show_bug.cgi?id=176749
2502
2503         Rubber stamped by Keith Miller.
2504
2505         It's been failing since at least r221821.  I'm changing the test expectation to
2506         fail to green the bots while I investigate some more.
2507
2508         * test262.yaml:
2509
2510 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2511
2512         Unreviewed, rolling out r221854.
2513
2514         The test added with this change fails on 32-bit JSC bots.
2515
2516         Reverted changeset:
2517
2518         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2519         https://bugs.webkit.org/show_bug.cgi?id=176010
2520         http://trac.webkit.org/changeset/221854
2521
2522 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2523
2524         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2525         https://bugs.webkit.org/show_bug.cgi?id=176010
2526
2527         Reviewed by Filip Pizlo.
2528
2529         * microbenchmarks/weak-map-key.js: Added.
2530         (assert):
2531         (objectKey):
2532         (let.start.Date.now):
2533
2534 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2535
2536         [JSC] Optimize Object.keys by using careful array allocation
2537         https://bugs.webkit.org/show_bug.cgi?id=176654
2538
2539         Reviewed by Darin Adler.
2540
2541         * microbenchmarks/object-keys.js: Added.
2542         (test):
2543
2544 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2545
2546         Error should compute .stack and friends lazily
2547         https://bugs.webkit.org/show_bug.cgi?id=176645
2548
2549         Reviewed by Saam Barati.
2550
2551         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2552         * microbenchmarks/new-error.js: Added.
2553         * microbenchmarks/throw.js: Added.
2554
2555 2017-09-09  Mark Lam  <mark.lam@apple.com>
2556
2557         [Re-landing] Use JIT probes for DFG OSR exit.
2558         https://bugs.webkit.org/show_bug.cgi?id=175144
2559         <rdar://problem/33437050>
2560
2561         Not reviewed.  Original patch reviewed by Saam Barati.
2562
2563         Disable these tests for debug builds because they run too slow with the new OSR exit.
2564
2565         * stress/op_mod-ConstVar.js:
2566         * stress/op_mod-VarConst.js:
2567         * stress/op_mod-VarVar.js:
2568
2569 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2570
2571         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2572         https://bugs.webkit.org/show_bug.cgi?id=176300
2573
2574         Reviewed by Saam Barati.
2575
2576         * stress/new-array-with-size-div.js: Added.
2577         (shouldBe):
2578         (test):
2579         (i.i):
2580
2581 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2582
2583         [DFG] PutByVal with Array::Generic is too generic
2584         https://bugs.webkit.org/show_bug.cgi?id=176345
2585
2586         Reviewed by Filip Pizlo.
2587
2588         * stress/object-assign-symbols.js: Added.
2589         (shouldBe):
2590         (test):
2591         * stress/object-assign.js: Added.
2592         (shouldBe):
2593         (test):
2594         (i.shouldBe.JSON.stringify.test):
2595
2596 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2597
2598         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2599         https://bugs.webkit.org/show_bug.cgi?id=176590
2600
2601         Reviewed by Saam Barati.
2602
2603         * microbenchmarks/object-iterate-symbols.js: Added.
2604         (test):
2605         * microbenchmarks/object-iterate.js: Added.
2606         (test):
2607         * stress/object-iterate-symbols.js: Added.
2608         (shouldBe):
2609         (test):
2610         * stress/object-iterate.js: Added.
2611         (shouldBe):
2612         (test):
2613
2614 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2615
2616         [Win32] 10 JSC stress tests are failing.
2617         https://bugs.webkit.org/show_bug.cgi?id=176538
2618
2619         Reviewed by Mark Lam.
2620
2621         Skip tests on Windows to make the bots green.
2622
2623         * ChakraCore.yaml:
2624         * stress/date-relaxed.js:
2625
2626 2017-09-06  Mark Lam  <mark.lam@apple.com>
2627
2628         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2629         https://bugs.webkit.org/show_bug.cgi?id=176485
2630         <rdar://problem/33898874>
2631
2632         Reviewed by Keith Miller.
2633
2634         * stress/regress-176485.js: Added.
2635
2636 2017-09-05  Saam Barati  <sbarati@apple.com>
2637
2638         isNotCellSpeculation is wrong with respect to SpecEmpty
2639         https://bugs.webkit.org/show_bug.cgi?id=176429
2640
2641         Reviewed by Michael Saboff.
2642
2643         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2644         (Foo):
2645
2646 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2647
2648         test262: Completion values for control flow do not match the spec
2649         https://bugs.webkit.org/show_bug.cgi?id=171265
2650
2651         Reviewed by Saam Barati.
2652
2653         * stress/completion-value.js:
2654         Condensed test for completion values in top level statements.
2655
2656         * stress/super-get-by-id.js:
2657         ClassDeclaration when evaled no longer produce values. Convert
2658         these to ClassExpressions so they produce the class value.
2659         
2660         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2661         This is a progression for currect spec behavior.
2662
2663         * mozilla/mozilla-tests.yaml:
2664         This test is now outdated, so mark it as failing for that reason.
2665
2666         * test262.yaml:
2667         Passing all "cptn" completion value tests.
2668
2669 2017-09-04  Saam Barati  <sbarati@apple.com>
2670
2671         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2672         https://bugs.webkit.org/show_bug.cgi?id=176317
2673
2674         Reviewed by Keith Miller.
2675
2676         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2677         (Foo):
2678
2679 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2680
2681         [DFG][FTL] Efficiently execute number#toString()
2682         https://bugs.webkit.org/show_bug.cgi?id=170007
2683
2684         Reviewed by Keith Miller.
2685
2686         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2687         (test):
2688         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2689         (test):
2690         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2691         (test):
2692         * microbenchmarks/number-to-string-with-radix.js: Added.
2693         (test):
2694         * stress/number-to-string-strength-reduction.js: Added.
2695         (shouldBe):
2696         (test):
2697         * stress/number-to-string-with-radix-10.js: Added.
2698         (shouldBe):
2699         (test):
2700         * stress/number-to-string-with-radix-cse.js: Added.
2701         (shouldBe):
2702         (test):
2703         * stress/number-to-string-with-radix-invalid.js: Added.
2704         (shouldThrow):
2705         * stress/number-to-string-with-radix-watchpoint.js: Added.
2706         (shouldBe):
2707         (test):
2708         (i.i.1e3.Number.prototype.toString):
2709         * stress/number-to-string-with-radix.js: Added.
2710         (shouldBe):
2711         (test):
2712
2713 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2714
2715         [DFG] Relax arity requirement
2716         https://bugs.webkit.org/show_bug.cgi?id=175523
2717
2718         Reviewed by Saam Barati.
2719
2720         * stress/arity-mismatch-arguments-length.js: Added.
2721         (shouldBe):
2722         (test1):
2723         (test):
2724         * stress/arity-mismatch-get-argument.js: Added.
2725         (shouldBe):
2726         (builtin.createBuiltin):
2727         (test):
2728         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2729         (shouldBe):
2730         (inlineTarget):
2731         (test):
2732         * stress/arity-mismatch-inlining.js: Added.
2733         (shouldBe):
2734         (inlineTarget):
2735         (test):
2736         * stress/arity-mismatch-rest.js: Added.
2737         (shouldBe):
2738         (test2):
2739         (test1):
2740         (test):
2741
2742 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2743
2744         [JSC] Fix "name" and "length" of Proxy revoke function
2745         https://bugs.webkit.org/show_bug.cgi?id=176155
2746
2747         Reviewed by Mark Lam.
2748
2749         * test262.yaml:
2750
2751 2017-08-31  Saam Barati  <sbarati@apple.com>
2752
2753         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2754         https://bugs.webkit.org/show_bug.cgi?id=176206
2755
2756         Reviewed by Keith Miller.
2757
2758         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2759         (a):
2760         (b):
2761         (foo):
2762
2763 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2764
2765         Skip two slow JSC tests after r221422.
2766
2767         Unreviewed test gardening.
2768
2769         * stress/regexp-prototype-match-on-too-long-rope.js:
2770         * stress/regexp-prototype-test-on-too-long-rope.js:
2771
2772 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2773
2774         Unreviewed, skipping slow tests.
2775         
2776         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2777         work differently now.
2778
2779         * stress/regexp-prototype-exec-on-too-long-rope.js:
2780         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2781
2782 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2783
2784         [JSC] Use reifying system for "name" property of builtin JSFunction
2785         https://bugs.webkit.org/show_bug.cgi?id=175260
2786
2787         Reviewed by Saam Barati.
2788
2789         * stress/accessors-get-set-prefix.js:
2790         * stress/builtin-function-name.js: Added.
2791         (shouldBe):
2792         (shouldThrow):
2793         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2794         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2795         * stress/private-name-as-anonymous-builtin.js: Added.
2796         (shouldBe):
2797         (NotPromise):
2798
2799 2017-08-30  Saam Barati  <sbarati@apple.com>
2800
2801         Unreviewed. Make test stop printing.
2802
2803         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2804
2805 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2806
2807         Unreviewed, rolling out r221327.
2808
2809         This change caused test262 failures.
2810
2811         Reverted changeset:
2812
2813         "[JSC] Use reifying system for "name" property of builtin
2814         JSFunction"
2815         https://bugs.webkit.org/show_bug.cgi?id=175260
2816         http://trac.webkit.org/changeset/221327
2817
2818 2017-08-30  Saam Barati  <sbarati@apple.com>
2819
2820         semicolon is being interpreted as an = in the LiteralParser
2821         https://bugs.webkit.org/show_bug.cgi?id=176114
2822
2823         Reviewed by Oliver Hunt.
2824
2825         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2826         * stress/resources/literal-parser-test-case.js: Added.
2827
2828 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2829
2830         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2831         https://bugs.webkit.org/show_bug.cgi?id=166698
2832
2833         Reviewed by Yusuke Suzuki.
2834
2835         * stress/async-iteration-for-await-of-syntax.js: Added.
2836         (assert):
2837         (checkSyntax):
2838         (checkSyntaxError):
2839         (checkSimpleAsyncGeneratorSloppyMode):
2840         (checkSimpleAsyncGeneratorStrictMode):
2841         (checkNestedAsyncGenerators):
2842         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2843         * stress/async-iteration-for-await-of.js: Added.
2844         (assert):
2845         (async.foo):
2846         (async.boo):
2847         (const.boo.async):
2848
2849 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2850
2851         [JSC] Use reifying system for "name" property of builtin JSFunction
2852         https://bugs.webkit.org/show_bug.cgi?id=175260
2853
2854         Reviewed by Saam Barati.
2855
2856         * stress/accessors-get-set-prefix.js:
2857         * stress/builtin-function-name.js: Added.
2858         (shouldBe):
2859         (shouldThrow):
2860         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2861         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2862
2863 2017-08-25  Saam Barati  <sbarati@apple.com>
2864
2865         Support compiling catch in the DFG
2866         https://bugs.webkit.org/show_bug.cgi?id=174590
2867         <rdar://problem/34047845>
2868
2869         Reviewed by Filip Pizlo.
2870
2871         * microbenchmarks/delta-blue-try-catch.js: Added.
2872         (exception):
2873         (value):
2874         (OrderedCollection):
2875         (OrderedCollection.prototype.add):
2876         (OrderedCollection.prototype.at):
2877         (OrderedCollection.prototype.size):
2878         (OrderedCollection.prototype.removeFirst):
2879         (OrderedCollection.prototype.remove):
2880         (Strength):
2881         (Strength.stronger):
2882         (Strength.weaker):
2883         (Strength.weakestOf):
2884         (Strength.strongest):
2885         (Strength.prototype.nextWeaker):
2886         (Constraint):
2887         (Constraint.prototype.addConstraint):
2888         (Constraint.prototype.satisfy):
2889         (Constraint.prototype.destroyConstraint):
2890         (Constraint.prototype.isInput):
2891         (UnaryConstraint):
2892         (UnaryConstraint.prototype.addToGraph):
2893         (UnaryConstraint.prototype.chooseMethod):
2894         (UnaryConstraint.prototype.isSatisfied):
2895         (UnaryConstraint.prototype.markInputs):
2896         (UnaryConstraint.prototype.output):
2897         (UnaryConstraint.prototype.recalculate):
2898         (UnaryConstraint.prototype.markUnsatisfied):
2899         (UnaryConstraint.prototype.inputsKnown):
2900         (UnaryConstraint.prototype.removeFromGraph):
2901         (StayConstraint):
2902         (StayConstraint.prototype.execute):
2903         (EditConstraint.prototype.isInput):
2904         (EditConstraint.prototype.execute):
2905         (BinaryConstraint):
2906         (BinaryConstraint.prototype.chooseMethod):
2907         (BinaryConstraint.prototype.addToGraph):
2908         (BinaryConstraint.prototype.isSatisfied):
2909         (BinaryConstraint.prototype.markInputs):
2910         (BinaryConstraint.prototype.input):
2911         (BinaryConstraint.prototype.output):
2912         (BinaryConstraint.prototype.recalculate):
2913         (BinaryConstraint.prototype.markUnsatisfied):
2914         (BinaryConstraint.prototype.inputsKnown):
2915         (BinaryConstraint.prototype.removeFromGraph):
2916         (ScaleConstraint):
2917         (ScaleConstraint.prototype.addToGraph):
2918         (ScaleConstraint.prototype.removeFromGraph):
2919         (ScaleConstraint.prototype.markInputs):
2920         (ScaleConstraint.prototype.execute):
2921         (ScaleConstraint.prototype.recalculate):
2922         (EqualityConstraint):
2923         (EqualityConstraint.prototype.execute):
2924         (Variable):
2925         (Variable.prototype.addConstraint):
2926         (Variable.prototype.removeConstraint):
2927         (Planner):
2928         (Planner.prototype.incrementalAdd):
2929         (Planner.prototype.incrementalRemove):
2930         (Planner.prototype.newMark):
2931         (Planner.prototype.makePlan):
2932         (Planner.prototype.extractPlanFromConstraints):
2933         (Planner.prototype.addPropagate):
2934         (Planner.prototype.removePropagateFrom):
2935         (Planner.prototype.addConstraintsConsumingTo):
2936         (Plan):
2937         (Plan.prototype.addConstraint):
2938         (Plan.prototype.size):
2939         (Plan.prototype.constraintAt):
2940         (Plan.prototype.execute):
2941         (chainTest):
2942         (projectionTest):
2943         (change):
2944         (deltaBlue):
2945         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2946         (assert):
2947         (Numbers):
2948         (Numbers.prototype.next):
2949         (return.Transpose):
2950         (return.Transpose.prototype.next):
2951         (transpose):
2952         (verifyEven):
2953         (verifyString):
2954         (foo):
2955         (runIterators):
2956         * microbenchmarks/try-catch-word-count.js: Added.
2957         (let.assert):
2958         (EOF):
2959         (let.texts):
2960         (let.o.apply):
2961         (foo):
2962         (bar):
2963         (f):
2964         (run):
2965         (test1):
2966         (test2):
2967         (test3):
2968         (fn):
2969         (A):
2970         (B):
2971         (A.prototype.getValue):
2972         (B.prototype.getParentValue):
2973         (strlen):
2974         (sum.0):
2975         (test):
2976         (result.test.o):
2977         (set add.set add):
2978         (set forEach):
2979         (stringHash):
2980         (set if):
2981         (testFunction):
2982         (set delete.set has.set add):
2983         * stress/catch-set-argument-speculation-failure.js: Added.
2984         (o):
2985         (e):
2986         (e2):
2987         (escape):
2988         (baz):
2989         (noInline.run):
2990         (noInline):
2991         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2992         (foo):
2993         (e):
2994         (baz):
2995         (bar):
2996
2997 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2998
2999         Unreviewed, rolling out r221119, r221124, and r221143.
3000         https://bugs.webkit.org/show_bug.cgi?id=175973
3001
3002         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3003         on #webkit).
3004
3005         Reverted changesets:
3006
3007         "Support compiling catch in the DFG"
3008         https://bugs.webkit.org/show_bug.cgi?id=174590
3009         http://trac.webkit.org/changeset/221119
3010
3011         "Unreviewed, build fix in GTK port"
3012         https://bugs.webkit.org/show_bug.cgi?id=174590
3013         http://trac.webkit.org/changeset/221124
3014
3015         "DFG::JITCode::osrEntry should get sorted since we perform a
3016         binary search on it"
3017         https://bugs.webkit.org/show_bug.cgi?id=175893
3018         http://trac.webkit.org/changeset/221143
3019
3020 2017-08-24  Michael Saboff  <msaboff@apple.com>
3021
3022         Add support for RegExp "dotAll" flag
3023         https://bugs.webkit.org/show_bug.cgi?id=175924
3024
3025         Reviewed by Keith Miller.
3026
3027         Updated tests for new dotAll ('s' flag) changes.
3028
3029         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3030         * stress/static-getter-in-names.js:
3031
3032 2017-08-24  Mark Lam  <mark.lam@apple.com>
3033
3034         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3035         https://bugs.webkit.org/show_bug.cgi?id=175940
3036         <rdar://problem/29003921>
3037
3038         Reviewed by Saam Barati.
3039
3040         * stress/regress-164081.js: Added.
3041         (shouldEqual):
3042         (testcase):
3043
3044 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3045
3046         Skip flaky JSC test stress/test-finally.js.
3047         https://bugs.webkit.org/show_bug.cgi?id=160283
3048
3049         Unreviewed test gardening.
3050
3051         * stress/test-finally.js:
3052
3053 2017-08-23  Saam Barati  <sbarati@apple.com>
3054
3055         Support compiling catch in the DFG
3056         https://bugs.webkit.org/show_bug.cgi?id=174590
3057
3058         Reviewed by Filip Pizlo.
3059
3060         * microbenchmarks/delta-blue-try-catch.js: Added.
3061         (exception):
3062         (value):
3063         (OrderedCollection):
3064         (OrderedCollection.prototype.add):
3065         (OrderedCollection.prototype.at):
3066         (OrderedCollection.prototype.size):
3067         (OrderedCollection.prototype.removeFirst):
3068         (OrderedCollection.prototype.remove):
3069         (Strength):
3070         (Strength.stronger):
3071         (Strength.weaker):
3072         (Strength.weakestOf):
3073         (Strength.strongest):
3074         (Strength.prototype.nextWeaker):
3075         (Constraint):
3076         (Constraint.prototype.addConstraint):
3077         (Constraint.prototype.satisfy):
3078         (Constraint.prototype.destroyConstraint):
3079         (Constraint.prototype.isInput):
3080         (UnaryConstraint):
3081         (UnaryConstraint.prototype.addToGraph):
3082         (UnaryConstraint.prototype.chooseMethod):
3083         (UnaryConstraint.prototype.isSatisfied):
3084         (UnaryConstraint.prototype.markInputs):
3085         (UnaryConstraint.prototype.output):
3086         (UnaryConstraint.prototype.recalculate):
3087         (UnaryConstraint.prototype.markUnsatisfied):
3088         (UnaryConstraint.prototype.inputsKnown):
3089         (UnaryConstraint.prototype.removeFromGraph):
3090         (StayConstraint):
3091         (StayConstraint.prototype.execute):
3092         (EditConstraint.prototype.isInput):
3093         (EditConstraint.prototype.execute):
3094         (BinaryConstraint):
3095         (BinaryConstraint.prototype.chooseMethod):
3096         (BinaryConstraint.prototype.addToGraph):
3097         (BinaryConstraint.prototype.isSatisfied):
3098         (BinaryConstraint.prototype.markInputs):
3099         (BinaryConstraint.prototype.input):
3100         (BinaryConstraint.prototype.output):
3101         (BinaryConstraint.prototype.recalculate):
3102         (BinaryConstraint.prototype.markUnsatisfied):
3103         (BinaryConstraint.prototype.inputsKnown):
3104         (BinaryConstraint.prototype.removeFromGraph):
3105         (ScaleConstraint):
3106         (ScaleConstraint.prototype.addToGraph):
3107         (ScaleConstraint.prototype.removeFromGraph):
3108         (ScaleConstraint.prototype.markInputs):
3109         (ScaleConstraint.prototype.execute):
3110         (ScaleConstraint.prototype.recalculate):
3111         (EqualityConstraint):
3112         (EqualityConstraint.prototype.execute):
3113         (Variable):
3114         (Variable.prototype.addConstraint):
3115         (Variable.prototype.removeConstraint):
3116         (Planner):
3117         (Planner.prototype.incrementalAdd):
3118         (Planner.prototype.incrementalRemove):
3119         (Planner.prototype.newMark):
3120         (Planner.prototype.makePlan):
3121         (Planner.prototype.extractPlanFromConstraints):
3122         (Planner.prototype.addPropagate):
3123         (Planner.prototype.removePropagateFrom):
3124         (Planner.prototype.addConstraintsConsumingTo):
3125         (Plan):
3126         (Plan.prototype.addConstraint):
3127         (Plan.prototype.size):
3128         (Plan.prototype.constraintAt):
3129         (Plan.prototype.execute):
3130         (chainTest):
3131         (projectionTest):
3132         (change):
3133         (deltaBlue):
3134         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3135         (assert):
3136         (Numbers):
3137         (Numbers.prototype.next):
3138         (return.Transpose):
3139         (return.Transpose.prototype.next):
3140         (transpose):
3141         (verifyEven):
3142         (verifyString):
3143         (foo):
3144         (runIterators):
3145         * microbenchmarks/try-catch-word-count.js: Added.
3146         (let.assert):
3147         (EOF):
3148         (let.texts):
3149         (let.o.apply):
3150         (foo):
3151         (bar):
3152         (f):
3153         (run):
3154         (test1):
3155         (test2):
3156         (test3):
3157         (fn):
3158         (A):
3159         (B):
3160         (A.prototype.getValue):
3161         (B.prototype.getParentValue):
3162         (strlen):
3163         (sum.0):
3164         (test):
3165         (result.test.o):
3166         (set add.set add):
3167         (set forEach):
3168         (stringHash):
3169         (set if):
3170         (testFunction):
3171         (set delete.set has.set add):
3172         * stress/catch-set-argument-speculation-failure.js: Added.
3173         (o):
3174         (e):
3175         (e2):
3176         (escape):
3177         (baz):
3178         (noInline.run):
3179         (noInline):
3180         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3181         (foo):
3182         (e):
3183         (baz):
3184         (bar):
3185
3186 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3187
3188         [JSC] Optimize Map iteration with intrinsic
3189         https://bugs.webkit.org/show_bug.cgi?id=174355
3190
3191         Reviewed by Saam Barati.
3192
3193         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3194         (shouldBe):
3195         (throw.new.Error):
3196         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3197         (shouldBe):
3198         (throw.new.Error.let.iterator.set Symbol):
3199         (throw.new.Error.set add):
3200         (let.iterator.set Symbol):
3201
3202 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3203
3204         Add a micro-benchmark for checking that accessing a variable within a 'with'
3205         block does not automatically prevent type prediction.
3206         https://bugs.webkit.org/show_bug.cgi?id=175738
3207
3208         Reviewed by Saam Barati.
3209
3210         * stress/with_and_arith.js: Added.
3211         (with):
3212
3213 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3214
3215         [ESNext] Async iteration - Implement Async Generator - runtime
3216         https://bugs.webkit.org/show_bug.cgi?id=175240
3217
3218         Reviewed by Yusuke Suzuki.
3219
3220         * stress/async-iteration-async-from-sync.js: Added.
3221         (assert):
3222         (const.Logger):
3223         (this.fullfilled):
3224         (this.fullfilledDone):
3225         (this.rejected):
3226         (this.catched):
3227         (this.isFinal):
3228         (_assertLogger):
3229         (const.assertLogger):
3230         (const.getPromise.promiseHolder.return.new.Promise):
3231         (foo):
3232         (async.boo):
3233         (bar):
3234         (async.baz):
3235         (async.goo):
3236         * stress/async-iteration-basic.js: Added.
3237         (assert):
3238         (const.Logger):
3239         (this.fullfilled):
3240         (this.fullfilledDone):
3241         (this.rejected):
3242         (this.catched):
3243         (this.isFinal):
3244         (_assertLogger):
3245         (const.assertLogger):
3246         (const.getPromise.promiseHolder.return.new.Promise):
3247         (async.generator):
3248         (iterator.next.then):
3249         (async.baz):
3250         (async.boo):
3251         (async.foo):
3252         (async.goo):
3253         (A.prototype.async.foo):
3254         (A.prototype.async.boo):
3255         (A):
3256         (asyncGenExp.async):
3257         (async.joo):
3258         (j.next.then):
3259         (then):
3260         (async.koo):
3261         (async.loo):
3262         (async.moo):
3263         (async.noo):
3264         (async.ooo):
3265         (async.roo):
3266         (async.poo):
3267         (async.soo):
3268         (async.too):
3269         * stress/async-iteration-evaluation.js: Added.
3270         (assert):
3271         (async.foo):
3272         (catch):
3273         * stress/async-iteration-syntax.js:
3274         * stress/async-iteration-yield-promise.js: Added.
3275         (assert):
3276         (const.Logger):
3277         (this.fullfilled):
3278         (this.fullfilledDone):
3279         (this.rejected):
3280         (this.catched):
3281         (this.isFinal):
3282         (_assertLogger):
3283         (const.assertLogger):
3284         (const.getPromise.promiseHolder.return.new.Promise):
3285         (async.foo):
3286         (async.boo):
3287         (async.bar):
3288         * stress/async-iteration-yield-star-interface.js: Added.
3289         (assert):
3290         (const.getPromise.promiseHolder.return.new.Promise):
3291         (const.Logger):
3292         (this.fullfilled):
3293         (this.fullfilledDone):
3294         (this.rejected):
3295         (this.catched):
3296         (this.custom):
3297         (this.isFinal):
3298         (_assertLogger):
3299         (const.assertLogger):
3300         (let.asyncIter.Symbol.asyncIterator):
3301         (let.asyncIter.next):
3302         (let.asyncIter.throw):
3303         (let.asyncIter.return):
3304         (async.foo):
3305         (asyncIter.Symbol.asyncIterator):
3306         (asyncIter.next):
3307         (async.boo):
3308         (asyncIter.return):
3309         (async.bar):
3310         (async.baz):
3311         (async.foobar):
3312         * stress/async-iteration-yield-star.js: Added.
3313         (assert):
3314         (const.Logger):
3315         (this.fullfilled):
3316         (this.fullfilledDone):
3317         (this.rejected):
3318         (this.catched):
3319         (this.custom):
3320         (this.isFinal):
3321         (_assertLogger):
3322         (const.assertLogger):
3323         (const.getPromise.promiseHolder.return.new.Promise):
3324         (async.foo):
3325         (async.boo):
3326         (async.bar):
3327         (async.baz):
3328         (async.joo):
3329         (async.goo):
3330         (async.koo):
3331         (async.loo):
3332         (let.asyncIter.Symbol.asyncIterator):
3333         (let.asyncIter.next):
3334         (let.asyncIter.throw):
3335         (let.asyncIter.return):
3336         (async.moo):
3337         (async.noo):
3338         * test262.yaml:
3339
3340 2017-08-23  JF Bastien  <jfbastien@apple.com>
3341
3342         Fix printing in test
3343
3344         Unreviewed: fixing verbosity, shouldn't have been there.
3345
3346         * wasm/regress/175693.js:
3347         (else.else):
3348         (catch):
3349
3350 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3351
3352         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3353         https://bugs.webkit.org/show_bug.cgi?id=172543
3354
3355         Unreviewed test gardening.
3356
3357         * microbenchmarks/generator-with-several-types.js:
3358
3359 2017-08-17  JF Bastien  <jfbastien@apple.com>
3360
3361         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3362         https://bugs.webkit.org/show_bug.cgi?id=175693
3363         <rdar://problem/33952443>
3364
3365         Reviewed by Saam Barati.
3366
3367         Add a regression directory for WebAssembly tests.
3368
3369         * wasm.yaml:
3370         * wasm/regress/175693.js: Added.
3371         (else.else):
3372         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3373         (catch):
3374         * wasm/regress/175693.wasm: Added.
3375
3376 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3377
3378         Support the 'with' keyword in FTL.
3379         https://bugs.webkit.org/show_bug.cgi?id=175585
3380
3381         Reviewed by Saam Barati.
3382
3383         Also improve the JSTest/stress/with.js file to test
3384         what happens when non-objects are passed to with.
3385
3386         * stress/with.js:
3387         (foo):
3388         (i.catch):
3389         (i.with): Deleted.
3390
3391 2017-08-14  Keith Miller  <keith_miller@apple.com>
3392
3393         Add testing tool to lie to the DFG about profiles
3394         https://bugs.webkit.org/show_bug.cgi?id=175487
3395
3396         Reviewed by Saam Barati.
3397
3398         * stress/compare-eq-incomplete-profile.js: Added.
3399         (const.test.createBuiltin):
3400
3401 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3402
3403         Support the with keyword in DFG
3404         https://bugs.webkit.org/show_bug.cgi?id=175470
3405
3406         Reviewed by Saam Barati.
3407
3408         Added a new stress-test for the 'with' keyword, that caught a bug in a
3409         previous version of this code.
3410
3411         * stress/with.js: Added.
3412         (i.with):
3413
3414 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3415
3416         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3417         https://bugs.webkit.org/show_bug.cgi?id=175544
3418
3419         Unreviewed test gardening.
3420
3421         * ChakraCore.yaml:
3422
3423 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3424
3425         Early error on ANY operator before new.target
3426         https://bugs.webkit.org/show_bug.cgi?id=157970
3427
3428         Reviewed by Saam Barati.
3429
3430         Instead of throwing if any unary operator precedes new.target, only
3431         throw if the unary operator updates the reference.
3432
3433         The following become legal in JSC:
3434
3435         ```
3436         !new.target
3437         ~new.target
3438         typeof new.target
3439         delete new.target
3440         void new.target
3441         ```
3442
3443         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3444
3445         * stress/new-target-syntax-errors.js:
3446         * stress/new-target.js:
3447
3448 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3449
3450         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3451         https://bugs.webkit.org/show_bug.cgi?id=175255
3452
3453         Unreviewed test gardening.
3454
3455         * stress/regress-169783.js:
3456         * wasm/stress/oom.js:
3457
3458 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3459
3460         REGRESSION: 2 test262/test/language/statements/async-function failures
3461         https://bugs.webkit.org/show_bug.cgi?id=175334
3462
3463         Reviewed by Yusuke Suzuki.
3464
3465         Add @skip parameters to tests, and remove test for async iterator from 
3466         async await syntax test because it is already covered by async-iterator-syntax.js
3467
3468         * stress/async-await-syntax.js:
3469         * stress/async-iteration-syntax.js:
3470
3471 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3472
3473         Unreviewed, gardening test262 for Promise resolve / reject function length
3474         https://bugs.webkit.org/show_bug.cgi?id=175333
3475
3476         * test262.yaml:
3477
3478 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3479
3480         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3481         https://bugs.webkit.org/show_bug.cgi?id=175307
3482
3483         Reviewed by Saam Barati.
3484
3485         * stress/typedarray-getownproperty-not-configurable.js: Added.
3486         (assert):
3487         (foo):
3488
3489 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3490
3491         Promise resolve and reject function should have length = 1
3492         https://bugs.webkit.org/show_bug.cgi?id=175242
3493
3494         Reviewed by Saam Barati.
3495
3496         * stress/builtin-function-length.js: Added.
3497         (shouldBe):
3498         (shouldThrow):
3499         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3500         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3501
3502 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3503
3504         [ESNext] Async iteration - Implement Async Generator - parser
3505         https://bugs.webkit.org/show_bug.cgi?id=175210
3506
3507         Reviewed by Yusuke Suzuki.
3508
3509         * stress/async-await-syntax.js:
3510         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3511         * stress/async-iteration-syntax.js: Added.
3512         (assert):
3513         (checkSyntax):
3514         (checkSyntaxError):
3515         (checkSimpleAsyncGeneratorSloppyMode):
3516         (checkSimpleAsyncGeneratorStrictMode):
3517         (checkNestedAsyncGenerators):
3518         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3519         * stress/generator-class-methods-syntax.js:
3520
3521 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3522
3523         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3524         https://bugs.webkit.org/show_bug.cgi?id=175150
3525
3526         Unreviewed test gardening.
3527
3528         * wasm/js-api/test_memory_constructor.js:
3529
3530 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3531
3532         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3533         https://bugs.webkit.org/show_bug.cgi?id=175100
3534
3535         Reviewed by Mark Lam.
3536
3537         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3538         available memory until an out of memory exception happens.
3539
3540         The Linux kernel is more tuned for server workloads than for GUI
3541         responsiveness. When a process tries to use a lot of memory, Linux
3542         will do its best to serve the request. This usually translates to
3543         free physical RAM by writing to disk dirty pages and/or moving out
3544         less recently used pages to swap (disk storage).
3545         Meanwhile it does this, the system will become unresponsive and this
3546         leads to freezes that can last even some minutes on the worst cases.
3547
3548         Therefore, let's skip this test on Linux as it will cause more harm
3549         than good on the Linux bots or on the machines of Linux developers.
3550
3551         * wasm/stress/oom.js:
3552
3553 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3554
3555         [JSC] Remove unnecessary print from stress\promise-finally.js test
3556         https://bugs.webkit.org/show_bug.cgi?id=175015
3557
3558         Reviewed by Yusuke Suzuki.
3559
3560         * stress/promise-finally.js:
3561         (p.finally):
3562         (then):
3563
3564 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3565
3566         Unreviewed, update test262 results for optional catch binding
3567
3568         * test262.yaml:
3569
3570 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3571
3572         [JSC] Support optional catch binding
3573         https://bugs.webkit.org/show_bug.cgi?id=174981
3574
3575         Reviewed by Saam Barati.
3576
3577         * stress/optional-catch-binding-syntax.js: Added.
3578         (testSyntax):
3579         (testSyntaxError):
3580         (catch.catch):
3581         * stress/optional-catch-binding.js: Added.
3582         (shouldBe):
3583         (throwException):
3584
3585 2017-07-28  Mark Lam  <mark.lam@apple.com>
3586
3587         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3588         https://bugs.webkit.org/show_bug.cgi?id=174948
3589         <rdar://problem/33495680>
3590
3591         Reviewed by Filip Pizlo.
3592
3593         * stress/regress-174948.js: Added.
3594
3595 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3596
3597         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3598         https://bugs.webkit.org/show_bug.cgi?id=174900
3599
3600         Reviewed by Saam Barati.
3601
3602         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3603         (sideEffect):
3604         (args):
3605         (test):
3606
3607 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3608
3609         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3610         https://bugs.webkit.org/show_bug.cgi?id=171637
3611
3612         Reviewed by Darin Adler.
3613
3614         * stress/domjit-getter-complex-with-incorrect-object.js:
3615         (i.shouldThrow):
3616         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3617         (shouldBe):
3618         (i.shouldThrow):
3619
3620 2017-07-26  JF Bastien  <jfbastien@apple.com>
3621
3622         WebAssembly: test throwing out of the start function
3623         https://bugs.webkit.org/show_bug.cgi?id=165714
3624         <rdar://problem/29760251>
3625
3626         Reviewed by Keith Miller.
3627
3628         * wasm/assert.js:
3629         * wasm/function-tests/trap-from-start.js: Added.
3630         (StartTraps):
3631         * wasm/function-tests/trap-from-start-async.js: Added.
3632         (async.StartTrapsAsync):
3633
3634 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3635
3636         [FTL] Arguments elimination is suppressed by unreachable blocks
3637         https://bugs.webkit.org/show_bug.cgi?id=174352
3638
3639         Reviewed by Filip Pizlo.
3640
3641         * stress/arguments-elimination-force-exit.js: Added.
3642         (shouldBe):
3643         (strict):
3644         (sloppy):
3645         * stress/arguments-elimination-throw.js: Added.
3646         (shouldBe):
3647         (shouldThrow):
3648         (sloppy):
3649         (isArguments):
3650
3651 2017-07-13  Mark Lam  <mark.lam@apple.com>
3652
3653         Add some additional test cases for bug 170896.
3654         https://bugs.webkit.org/show_bug.cgi?id=174491
3655
3656         Reviewed by Filip Pizlo.
3657
3658         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3659         * stress/regress-170896-with-double-shape-profile.js: Added.
3660         (test):
3661         * stress/regress-170896-with-int32-shape-profile.js: Added.
3662         (test):
3663         * stress/regress-170896.js: Removed.
3664
3665 2017-07-13  Saam Barati  <sbarati@apple.com>
3666
3667         Missing exception check in JSObject::hasInstance
3668         https://bugs.webkit.org/show_bug.cgi?id=174455
3669         <rdar://problem/31384608>
3670
3671         Reviewed by Mark Lam.
3672
3673         * stress/has-instance-exception-check.js: Added.
3674         (assert):
3675         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3676
3677 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3678
3679         [ESnext] Implement Object Spread
3680         https://bugs.webkit.org/show_bug.cgi?id=167963
3681
3682         Reviewed by Saam Barati.
3683
3684         * stress/obj-rest-destructuring-order.js: Added.
3685         (assert):
3686         (o.get z):
3687         (o.get a):
3688         * stress/obj-spread-order.js: Added.
3689         (assert):
3690         (o.get z):
3691         (o.get a):
3692         * stress/object-spread.js: Added.
3693         (let.assert):
3694         (assert.sameValue):
3695         (let.o.get a):
3696         (let.obj.get c):
3697         (cthulhu.get x):
3698         (let.obj.set c):
3699         (calls.o.get z):
3700         (calls.o.get a):
3701         (try.let.obj.get foo):
3702         (get calls):
3703
3704 2017-07-12  Saam Barati  <sbarati@apple.com>
3705
3706         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3707         https://bugs.webkit.org/show_bug.cgi?id=174411
3708         <rdar://problem/31696186>
3709
3710         Reviewed by Mark Lam.
3711
3712         * stress/generic-arguments-correct-delete-behavior.js: Added.
3713         (assert):
3714         (makeTest):
3715
3716 2017-07-07  Mark Lam  <mark.lam@apple.com>
3717
3718         \n\r is not the same as \r\n.
3719         https://bugs.webkit.org/show_bug.cgi?id=173053
3720
3721         Reviewed by Keith Miller.
3722
3723         * stress/regress-173053.js: Added.
3724         * stress/template-literal-line-terminators.js:
3725
3726 2017-07-06  Saam Barati  <sbarati@apple.com>
3727
3728         We are missing places where we invalidate the for-in context
3729         https://bugs.webkit.org/show_bug.cgi?id=174184
3730
3731         Reviewed by Geoffrey Garen.
3732
3733         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3734         (assert):
3735         (test):
3736
3737 2017-07-05  Saam Barati  <sbarati@apple.com>
3738
3739         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3740         https://bugs.webkit.org/show_bug.cgi?id=174188
3741         <rdar://problem/30581423>
3742
3743         Reviewed by Mark Lam.
3744
3745         * stress/new-array-having-a-bad-time-double.js: Added.
3746         (assert):
3747         (foo):
3748
3749 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3750
3751         WTF::StringImpl::copyChars segfaults when built with GCC 7
3752         https://bugs.webkit.org/show_bug.cgi?id=173407
3753
3754         Reviewed by Andreas Kling.
3755
3756         * stress/string-repeat-copy-chars-crash.js: Added.
3757         (shouldBe):
3758
3759 2017-07-03  Saam Barati  <sbarati@apple.com>
3760
3761         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3762
3763         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3764
3765 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3766
3767         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3768
3769         It requires too much memory.
3770
3771         * stress/dont-reserve-huge-capacity-lexer.js:
3772
3773 2017-06-30  Michael Saboff  <msaboff@apple.com>
3774
3775         Skip a test on ARM64 platform since we run out of address space.
3776
3777         Rubber stamped by Saam Barati.
3778
3779         * stress/dont-reserve-huge-capacity-lexer.js:
3780
3781 2017-06-30  Michael Saboff  <msaboff@apple.com>
3782
3783         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3784         https://bugs.webkit.org/show_bug.cgi?id=174044
3785
3786         Reviewed by Oliver Hunt.
3787
3788         New regression test.
3789
3790         * stress/regress-174044.js: Added.
3791         (test1):
3792         (test2):
3793
3794 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3795
3796         RegExpCachedResult::setInput should reify left and right contexts
3797         https://bugs.webkit.org/show_bug.cgi?id=173818
3798
3799         Reviewed by Keith Miller.
3800
3801         * stress/right-left-context-invalidated-by-input.js: Added.
3802         (test.validateContexts):
3803         (test):
3804
3805 2017-06-29  Saam Barati  <sbarati@apple.com>
3806
3807         Calculating postCapacity in unshiftCountSlowCase is wrong
3808         https://bugs.webkit.org/show_bug.cgi?id=173992
3809         <rdar://problem/32283199>
3810
3811         Reviewed by Keith Miller.
3812
3813         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3814         (temp):
3815
3816 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3817
3818         Unreviewed, rolling out r218512.
3819         https://bugs.webkit.org/show_bug.cgi?id=173981
3820
3821         "It changes the behavior of the JS API's JSEvaluateScript
3822         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3823
3824         Reverted changeset:
3825
3826         "test262: Completion values for control flow do not match the
3827         spec"
3828         https://bugs.webkit.org/show_bug.cgi?id=171265
3829         http://trac.webkit.org/changeset/218512
3830
3831 2017-06-27  JF Bastien  <jfbastien@apple.com>
3832
3833         WebAssembly: running out of executable memory should throw OoM
3834         https://bugs.webkit.org/show_bug.cgi?id=171537
3835         <rdar://problem/32963338>
3836
3837         Reviewed by Saam Barati.
3838
3839         * wasm.yaml:
3840         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3841         (const.invoke):
3842         (failCount.0.catch):
3843         (failCount.0.module.undefined.catch):
3844         * wasm/lowExecutableMemory/exports-oom.js: Added.
3845         (const.type):
3846         (const.params):
3847         (const.randomProgram):
3848         (failCount.0.catch):
3849         (failCount.0.module.undefined.catch):
3850         * wasm/lowExecutableMemory/imports-oom.js: Added.
3851         (const.type):
3852         (const.params):
3853         (const.randomProgram):
3854         (f.imports.push):
3855         (failCount.0.catch):
3856         (failCount.0.module.undefined.catch):
3857
3858 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3859
3860         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3861         https://bugs.webkit.org/show_bug.cgi?id=167962
3862
3863         Reviewed by Saam Barati.
3864
3865         * stress/object-rest-deconstruct.js: Added.
3866         (let.assert):
3867         (let.assertPropDescriptor):
3868         (catch):
3869         (get 3):
3870         (foo):
3871         (let.src.get y):
3872         (let.src.set y):
3873         (let.gen):
3874
3875 2017-06-27  Saam Barati  <sbarati@apple.com>
3876
3877         Function constructor needs to follow the spec and validate parameters and body independently
3878         https://bugs.webkit.org/show_bug.cgi?id=173303
3879         <rdar://problem/32732526>
3880
3881         Reviewed by Keith Miller.
3882
3883         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3884         * stress/function-constructor-semantics.js: Added.
3885         (assert):
3886         (hasSyntaxError):
3887         (foo):
3888         (async.foo):
3889         (testError):
3890         (testOK.toString):
3891         (toString):
3892
3893 2017-06-26  Saam Barati  <sbarati@apple.com>
3894
3895         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3896         https://bugs.webkit.org/show_bug.cgi?id=173740
3897
3898         Reviewed by Mark Lam.
3899
3900         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3901         (Array.prototype.Symbol.iterator):
3902
3903 2017-06-26  Saam Barati  <sbarati@apple.com>
3904
3905         Skip a test on 32-bit platforms since we run out of address space.
3906
3907         Rubber stamped by Mark Lam.
3908
3909         * stress/dont-reserve-huge-capacity-lexer.js:
3910
3911 2017-06-26  Saam Barati  <sbarati@apple.com>
3912
3913         Crash in JSC::Lexer<unsigned char>::setCode
3914         https://bugs.webkit.org/show_bug.cgi?id=172754
3915
3916         Reviewed by Mark Lam.
3917
3918         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3919         (catch):
3920
3921 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3922
3923         [JSC] Clean up Object.entries implementation
3924         https://bugs.webkit.org/show_bug.cgi?id=173759
3925
3926         Reviewed by Sam Weinig.
3927
3928         * microbenchmarks/object-entries.js: Added.
3929         (test):
3930
3931 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3932
3933         Remove Reflect.enumerate
3934         https://bugs.webkit.org/show_bug.cgi?id=173806
3935
3936         Reviewed by Yusuke Suzuki.
3937
3938         * ChakraCore.yaml:
3939         * es6.yaml:
3940         These tests now fail because they use Reflect.enumerate.
3941
3942         * test262.yaml:
3943         This test now passes, it checked that Reflect.enumerate is undefined!
3944
3945         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3946         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3947
3948         * stress/reflect-enumerate.js: Removed.
3949         Remove a test solely for Reflect.enumerate.
3950
3951 2017-06-22  Saam Barati  <sbarati@apple.com>
3952
3953         ValueRep(DoubleRep(@v)) can not simply convert to @v
3954         https://bugs.webkit.org/show_bug.cgi?id=173687
3955         <rdar://problem/32855563>
3956
3957         Reviewed by Mark Lam.
3958
3959         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3960         (i.catch):
3961
3962 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3963
3964         [JSC] Object.values should be implemented in C++
3965         https://bugs.webkit.org/show_bug.cgi?id=173703
3966
3967         Reviewed by Sam Weinig.
3968
3969         * microbenchmarks/object-keys-map-values.js: Added.
3970         (test):
3971         * microbenchmarks/object-values.js: Added.
3972         (test):
3973         * stress/object-values-changing-properties.js: Added.
3974         (shouldBe):
3975         (throw.new.Error.let.source.get x):
3976         (throw.new.Error):
3977         (shouldBe.let.handler.get order):
3978         (get let):
3979         (shouldBe.let.handler.get return):
3980         (let.handler.get order):
3981
3982 2017-06-21  Saam Barati  <sbarati@apple.com>
3983
3984         eval virtual call is incorrect in the baseline JIT
3985         https://bugs.webkit.org/show_bug.cgi?id=173587
3986         <rdar://problem/32867897>
3987
3988         Reviewed by Michael Saboff.
3989
3990         * stress/do-eval-virtual-call-correctly.js: Added.
3991         (assert):
3992         (f):
3993         (i.test):
3994         (catch):
3995
3996 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3997
3998         Update test262 test expectations after r218581.
3999
4000         Unreviewed test gardening.
4001
4002         * test262.yaml:
4003
4004 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
4005
4006         Revert changes in bug#160417 about extending `null` not being a derived class
4007         https://bugs.webkit.org/show_bug.cgi?id=169293
4008
4009         Reviewed by Saam Barati.
4010
4011         * stress/class-derived-from-null.js:
4012         (assertThrow):
4013         (test1):
4014         (test2):
4015         (test3):
4016         (test4):
4017         (test5):
4018         (test6):
4019
4020 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
4021
4022         [DFG] More ArrayIndexOf fixups for various types
4023         https://bugs.webkit.org/show_bug.cgi?id=173176
4024
4025         Reviewed by Saam Barati.
4026
4027         * stress/array-indexof-arraystorage.js: Added.
4028         (shouldBe):
4029         (indexOfInt32Other):
4030         (indexOfInt32Cell):
4031         (indexOfInt32Boolean):
4032         (indexOfDoubleOther):
4033         (indexOfDoubleCell):
4034         (indexOfDoubleBoolean):
4035         (indexOfInt32):
4036         (indexOfDouble):
4037         * stress/array-indexof-constant-folding.js: Added.
4038         (shouldBe):
4039         (indexOfInt32Other):
4040         (indexOfInt32Cell):
4041         (indexOfInt32Boolean):
4042         (indexOfDoubleOther):
4043         (indexOfDoubleCell):
4044         (indexOfDoubleBoolean):
4045         * stress/array-indexof-hole-and-other.js: Added.
4046         (shouldBe):
4047         (indexOf):
4048         * stress/array-indexof-other.js: Added.
4049         (shouldBe):
4050         (indexOfInt32):
4051         (indexOfDouble):
4052         (indexOfString):
4053         (indexOfObject):
4054         * stress/array-indexof-symbol.js: Added.
4055         (shouldBe):
4056         (indexOfInt32):
4057         (indexOfDouble):
4058         (indexOfString):
4059         (indexOfObject):
4060
4061 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
4062
4063         test262: Completion values for control flow do not match the spec
4064         https://bugs.webkit.org/show_bug.cgi?id=171265
4065
4066         Reviewed by Saam Barati.
4067
4068         * stress/completion-value.js:
4069         Condensed test for completion values in top level statements.
4070
4071         * stress/super-get-by-id.js:
4072         ClassDeclaration when evaled no longer produce values. Convert
4073         these to ClassExpressions so they produce the class value.
4074         
4075         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
4076         This is a progression for currect spec behavior.
4077
4078         * mozilla/mozilla-tests.yaml:
4079         This test is now outdated, so mark it as failing for that reason.
4080
4081         * test262.yaml:
4082         Passing all "cptn" completion value tests.
4083
4084 2017-06-17  Keith Miller  <keith_miller@apple.com>
4085
4086         ArrayBuffer constructor needs to create subclass structures before its buffer
4087         https://bugs.webkit.org/show_bug.cgi?id=173510
4088
4089         Reviewed by Yusuke Suzuki.
4090
4091         * test262.yaml:
4092
4093 2017-06-17  Keith Miller  <keith_miller@apple.com>
4094
4095         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
4096         https://bugs.webkit.org/show_bug.cgi?id=173506
4097
4098         Reviewed by Ryosuke Niwa.
4099
4100         Re-baseline tests.
4101
4102         * ChakraCore/test/Function/apply3.baseline-jsc:
4103         * test262.yaml:
4104
4105 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4106
4107         [JSC] Add fast path for Object.assign
4108         https://bugs.webkit.org/show_bug.cgi?id=173416
4109
4110         Reviewed by Mark Lam.
4111
4112         * stress/object-assign-changing-properties.js: Added.
4113         (shouldBe):
4114         (throw.new.Error.let.source.get x):
4115         (throw.new.Error):
4116         (shouldBe.let.source.get x):
4117         (shouldBe.let.target.set x):
4118         (shouldBe.let.target.get x):
4119         * stress/object-assign-proxy.js: Added.
4120         (shouldBe):
4121         (throw.new.Error.let.handler.get order):
4122
4123 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
4124
4125         [JSC] Implement Object.assign in C++
4126         https://bugs.webkit.org/show_bug.cgi?id=173414
4127
4128         Reviewed by Saam Barati.
4129
4130         * stress/object-assign-string-first.js: Added.
4131         (shouldBe):
4132         (source.get Symbol):
4133         (source.get 1):
4134         (source.get cocoa):
4135
4136 2017-06-14  JF Bastien  <jfbastien@apple.com>
4137
4138         WebAssembly: remove empty test files
4139         https://bugs.webkit.org/show_bug.cgi?id=173382
4140
4141         Reviewed by Saam Barati.
4142
4143         The following files:
4144                 JSTests/wasm/function-tests/call-indirect-params.js
4145                 JSTests/wasm/function-tests/call-indirect.js
4146                 JSTests/wasm/js-api/call-indirect-results.js
4147         Were changed to empty files in https://trac.webkit.org/changeset/209771
4148
4149         They were testing call_indirect with the wrong semantics, before
4150         we implemented tables. That change implemented tables and
4151         therefore removed the erroneous tests.
4152
4153         We have a few tests for call_indirect which already do the right thing:
4154                 JSTests/wasm/function-tests/context-switch.js
4155                 JSTests/wasm/function-tests/exceptions.js
4156                 JSTests/wasm/function-tests/grow-memory-2.js
4157                 JSTests/wasm/function-tests/stack-overflow.js
4158                 JSTests/wasm/function-tests/table-basic-2.js
4159                 JSTests/wasm/function-tests/table-basic.js
4160                 JSTests/wasm/js-api/call-indirect.js
4161                 JSTests/wasm/js-api/table.js
4162                 JSTests/wasm/js-api/unique-signature.js
4163                 JSTests/wasm/js-api/wrapper-function.js
4164
4165         I also just imported the updated spec tests which, among other
4166         things, test call_indirect:
4167                 core/br.wast
4168                 core/br_table.wast
4169                 core/call_indirect.wast
4170                 core/func.wast
4171                 core/func_ptrs.wast
4172                 core/imports.wast
4173                 core/left-to-right.wast
4174                 core/linking.wast
4175                 core/nop.wast
4176                 core/return.wast
4177                 core/typecheck.wast
4178                 core/unreachable.wast
4179
4180         So I think it's OK to just delete the tests which should just have
4181         been deleted back when tables were added.
4182
4183         * wasm/function-tests/call-indirect-params.js: Removed.
4184         * wasm/function-tests/call-indirect.js: Removed.
4185         * wasm/js-api/call-indirect-results.js: Removed.
4186
4187 2017-06-13  JF Bastien  <jfbastien@apple.com>
4188
4189         WebAssembly: import updated spec tests
4190         https://bugs.webkit.org/show_bug.cgi?id=173287
4191         <rdar://problem/32725975>
4192
4193         Reviewed by Saam Barati.
4194
4195         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
4196         with a few modifications so things work.
4197
4198         Fix a bunch of bugs found through this process, and punt a few tests (which I
4199         marked as blocked by this bug).
4200
4201         Fixes:
4202
4203         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
4204         instead of byte alignment. It was also missing memory-alignment.js despite it
4205         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
4206         pass.
4207
4208         Tables can be imported or in a section. There can be only one, but sections can
4209         be empty. An Elements section can exist if there's no Table, as long as it is
4210         also empty.
4211
4212         Memories can be imported or in a section. There can be only one, but sections
4213         can be empty. A Data section can exist if there's no Memory, as long as it is
4214         also empty.
4215
4216         Prototypes: stringify without .prototype. in the string.
4217
4218         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
4219         not a final size, and throws a RangeError on failure, not a TypeError.
4220
4221         Fix compile / instantiate so the reject the promise if given an argument of the
4222         wrong type (instead of failing instantly).
4223
4224         Fix async on neuter test.
4225
4226         Element section shouldn't affect any Table if any of the elements are out of
4227         bounds. We need to process it in two passes.
4228
4229         Segment section shouldn't affect any Data if any of the segments are out of
4230         bounds. We need to process it in two passes.
4231
4232         Empty data segments are valid, but only when there is no memory. Their index
4233         still gets validated, and has to be zero.
4234
4235         Punts:
4236
4237         Error messages with context, the test seems overly restrictive but this is
4238         minor.
4239
4240         compile/instantiate/validate property descriptors.
4241
4242         UTF-8 bugs.
4243
4244         Temporarily disable NaN tests. We need to go back and implement the following
4245         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
4246         much as getting all the other tests passing.
4247
4248         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
4249         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
4250         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
4251         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
4252         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
4253         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
4254         why they're not allowed.
4255
4256         * wasm.yaml:
4257         * wasm/function-tests/i32-load8-s.js:
4258         * wasm/function-tests/memory-access-past-4gib.js:
4259         (const.op.of.WASM.opcodes):
4260         * wasm/function-tests/memory-alignment.js: Added.
4261         (const.op.of.WASM.opcodes):
4262         * wasm/function-tests/memory-section-and-import.js:
4263         * wasm/js-api/Module-compile.js:
4264         (async.testPromiseAPI):
4265         * wasm/js-api/dont-mmap-zero-byte-memory.js:
4266         (testMems):
4267         * wasm/js-api/element.js:
4268         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
4269         * wasm/js-api/neutered-inputs.js:
4270         (const.testFunction): Deleted.
4271         (const.testConstructor): Deleted.
4272         * wasm/js-api/table.js:
4273         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
4274         (new.WebAssembly.Module):
4275         (assert.throws):
4276         (assertBadTableImport):
4277         (assert.throws.WebAssembly.Table.prototype.grow):
4278         (assertBadTableInstance): Deleted.
4279         * wasm/js-api/test_Data.js:
4280         (DataSectionWithoutMemory):
4281         * wasm/spec-harness/index.js:
4282         (module):
4283         (uniqueTest): Deleted.
4284         (assert_invalid): Deleted.
4285         (assert_soft_invalid): Deleted.
4286         (register): Deleted.
4287         (call): Deleted.
4288         (get instance): Deleted.
4289         (exports): Deleted.
4290         (run): Deleted.
4291         (assert_unlinkable): Deleted.
4292         (assert_uninstantiable): Deleted.
4293         (assert_trap): Deleted.
4294         (try.f): Deleted.
4295         (catch): Deleted.
4296         (assert_exhaustion): Deleted.
4297         (assert_return): Deleted.
4298         (assert_return_nan): Deleted.
4299         * wasm/spec-harness/testharness.css: Removed.
4300         * wasm/spec-harness/testharness.js: Removed.
4301         * wasm/spec-harness/testharnessreport.js: Removed.
4302         * wasm/spec-harness/wasm-constants.js:
4303         (assertTraps):
4304         (assertWasmThrows):
4305         * wasm/spec-harness/wasm-module-builder.js:
4306         (Binary.prototype.emit_section):
4307         (Binary):
4308         (WasmFunctionBuilder.prototype.addBody):
4309         (WasmFunctionBuilder.prototype.end):
4310         (WasmFunctionBuilder):
4311         (WasmModuleBuilder.prototype.stringToBytes):
4312         (WasmModuleBuilder.prototype.addCustomSection):
4313         (WasmModuleBuilder.prototype.addFunctionTableInit):
4314         (WasmModuleBuilder.prototype.appendToTable):
4315         (WasmModuleBuilder.prototype.toArray):
4316         (WasmModuleBuilder.prototype.toBuffer):
4317         (WasmModuleBuilder.prototype.instantiate):
4318         (WasmModuleBuilder):
4319         * wasm/spec-tests/address.wast.js:
4320         * wasm/spec-tests/align.wast.js: Added.
4321         * wasm/spec-tests/binary.wast.js:
4322         * wasm/spec-tests/block.wast.js:
4323         * wasm/spec-tests/br.wast.js:
4324         * wasm/spec-tests/br_if.wast.js:
4325         * wasm/spec-tests/br_table.wast.js:
4326         * wasm/spec-tests/call.wast.js:
4327         * wasm/spec-tests/call_indirect.wast.js:
4328         * wasm/spec-tests/comments.wast.js:
4329         * wasm/spec-tests/const.wast.js: Added.
4330         * wasm/spec-tests/conversions.wast.js: Added.
4331         * wasm/spec-tests/custom_section.wast.js:
4332         * wasm/spec-tests/exports.wast.js:
4333         * wasm/spec-tests/f32.wast.js: Added.
4334         * wasm/spec-tests/f64.wast.js: Added.
4335         * wasm/spec-tests/fac.wast.js:
4336         * wasm/spec-tests/float_exprs.wast.js: Added.
4337         * wasm/spec-tests/float_misc.wast.js: Added.
4338         * wasm/spec-tests/func.wast.js:
4339         * wasm/spec-tests/globals.wast.js:
4340         * wasm/spec-tests/if.wast.js:
4341         * wasm/spec-tests/imports.wast.js:
4342         * wasm/spec-tests/inline-module.wast.js: Added.
4343         * wasm/spec-tests/jsapi.js:
4344         (testJSAPI.test):
4345         (testJSAPI):
4346         * wasm/spec-tests/labels.wast.js:
4347         * wasm/spec-tests/loop.wast.js:
4348         * wasm/spec-tests/memory.wast.js:
4349         * wasm/spec-tests/memory_trap.wast.js: Added.
4350         * wasm/spec-tests/names.wast.js:
4351         * wasm/spec-tests/nop.wast.js:
4352         * wasm/spec-tests/return.wast.js:
4353         * wasm/spec-tests/stack.wast.js:
4354         * wasm/spec-tests/token.wast.js: Added.
4355         * wasm/spec-tests/type.wast.js: Added.
4356         * wasm/spec-tests/typecheck.wast.js:
4357         * wasm/spec-tests/unreachable.wast.js:
4358         * wasm/spec-tests/unreached-invalid.wast.js:
4359         * wasm/spec-tests/unwind.wast.js:
4360         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
4361         * wasm/spec-tests/utf8-import-field.wast.js: Added.
4362         * wasm/spec-tests/utf8-import-module.wast.js: Added.
4363
4364 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
4365
4366         Unreviewed JSC test gardening.
4367
4368         * stress/check-string-ident.js:
4369         * stress/new-largeish-contiguous-array-with-size.js:
4370
4371 2017-06-13  Michael Saboff  <msaboff@apple.com>
4372
4373         DFG doesn't properly handle a property that is change to read only in a prototype
4374         https://bugs.webkit.org/show_bug.cgi?id=173321
4375
4376         Reviewed by Filip Pizlo.
4377
4378         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
4379         * stress/regress-173321.js: Added new regression test.
4380         (shouldBe):
4381         (SimpleObject):
4382         (test):
4383
4384 2017-06-12  Saam Barati  <sbarati@apple.com>
4385
4386         Update test262 test expectation since r218082 makes new tests pass.
4387
4388         * test262.yaml:
4389
4390 2017-06-12  Saam Barati  <sbarati@apple.com>
4391
4392         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
4393         https://bugs.webkit.org/show_bug.cgi?id=172957
4394         <rdar://problem/32602704>
4395
4396         Reviewed by Filip Pizlo.
4397
4398         * stress/spec-empty-flows-through-cell-checks.js: Added.
4399         (A):
4400         (B):
4401         (i.catch):
4402
4403 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
4404
4405         We incorrectly allow escaped characters in keyword tokens
4406         https://bugs.webkit.org/show_bug.cgi?id=171310
4407
4408         Reviewed by Yusuke Suzuki.
4409
4410         * stress/destructuring-assignment-syntax.js:
4411         * stress/error-messages-for-in-operator-should-not-crash.js:
4412         (catch):
4413         * stress/reserved-word-with-escape.js:
4414         (testSyntaxError.String.raw.v):
4415         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
4416         (testSyntaxError.String.raw.a):
4417         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
4418
4419 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
4420
4421         [DFG] Add ArrayIndexOf intrinsic
4422         https://bugs.webkit.org/show_bug.cgi?id=172421
4423
4424         Reviewed by Saam Barati.
4425
4426         * stre