6402b6a1cec96fa45204a0d7873cd36d90eb69e5
[WebKit-https.git] / JSTests / ChangeLog
1 2017-09-22  Keith Miller  <keith_miller@apple.com>
2
3         Speculatively change iteration protocall to use the same next function
4         https://bugs.webkit.org/show_bug.cgi?id=175653
5
6         Reviewed by Saam Barati.
7
8         Change test to match the new iteration behavior.
9
10         * stress/spread-optimized-properly.js:
11
12 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
13
14         [DFG][FTL] Profile array vector length for array allocation
15         https://bugs.webkit.org/show_bug.cgi?id=177051
16
17         Reviewed by Saam Barati.
18
19         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
20         (target):
21
22 2017-09-22  Commit Queue  <commit-queue@webkit.org>
23
24         Unreviewed, rolling out r222380.
25         https://bugs.webkit.org/show_bug.cgi?id=177352
26
27         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
28         #webkit).
29
30         Reverted changeset:
31
32         "[DFG][FTL] Profile array vector length for array allocation"
33         https://bugs.webkit.org/show_bug.cgi?id=177051
34         http://trac.webkit.org/changeset/222380
35
36 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
37
38         [DFG][FTL] Profile array vector length for array allocation
39         https://bugs.webkit.org/show_bug.cgi?id=177051
40
41         Reviewed by Saam Barati.
42
43         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
44         (target):
45
46 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
47
48         Skip new hanging test262 tests.
49         https://bugs.webkit.org/show_bug.cgi?id=177326
50
51         Unreviewed test gardening.
52
53         * test262.yaml:
54
55 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
56
57         Mark 6 test262 tests as passing.
58         https://bugs.webkit.org/show_bug.cgi?id=177307
59
60         Unreviewed test gardening.
61
62         * test262.yaml:
63
64 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
65
66         Unreviewed follow-up to r222311.
67
68         * test262/harness/sta.js:
69         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
70         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
71         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
72         * test262/test/built-ins/Array/from/elements-added-after.js:
73         * test262/test/built-ins/Array/from/elements-deleted-after.js:
74         * test262/test/built-ins/Array/from/elements-updated-after.js:
75         * test262/test/built-ins/Array/from/from-array.js:
76         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
77         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
78         * test262/test/built-ins/Array/from/source-array-boundary.js:
79         * test262/test/built-ins/Array/from/source-object-constructor.js:
80         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
81         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
82         * test262/test/built-ins/Array/from/source-object-length.js:
83         * test262/test/built-ins/Array/from/source-object-missing.js:
84         * test262/test/built-ins/Array/from/source-object-without.js:
85         * test262/test/built-ins/Array/from/this-null.js:
86         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
87         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
88         * test262/test/language/literals/numeric/7.8.3-1gs.js:
89         * test262/test/language/literals/numeric/7.8.3-2gs.js:
90         * test262/test/language/literals/numeric/7.8.3-3gs.js:
91         * test262/test/language/literals/regexp/7.8.5-1gs.js:
92         * test262/test/language/literals/string/7.8.4-1gs.js:
93         Fix some files that I failed to update when I applied my patch.
94
95 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
96
97         Update test262 tests
98         https://bugs.webkit.org/show_bug.cgi?id=177220
99
100         Reviewed by Saam Barati and Yusuke Suzuki.
101
102         * test262.yaml:
103         * test262/test262-Revision.txt:
104         New rebaselined expectations for all tests.
105
106         * test262/*:
107         Updated.
108
109 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
110
111         [DFG] Remove ToThis more aggressively
112         https://bugs.webkit.org/show_bug.cgi?id=177056
113
114         Reviewed by Saam Barati.
115
116         * stress/generator-with-this-strict.js: Added.
117         (shouldBe):
118         (generator):
119         (target):
120         * stress/generator-with-this.js: Added.
121         (shouldBe):
122         (generator):
123         (target):
124
125 2017-09-17  Michael Saboff  <msaboff@apple.com>
126
127         https://bugs.webkit.org/show_bug.cgi?id=177038
128         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
129
130         Reviewed by JF Bastien.
131
132         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
133         as it dies using too much memory.
134
135 2017-09-15  Saam Barati  <sbarati@apple.com>
136
137         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
138         https://bugs.webkit.org/show_bug.cgi?id=176981
139
140         Reviewed by Yusuke Suzuki.
141
142         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
143         (assert):
144         (verify):
145         (func):
146         (const.bar.createBuiltin):
147
148 2017-09-14  Saam Barati  <sbarati@apple.com>
149
150         It should be valid to exit before each set when doing arity fixup when inlining
151         https://bugs.webkit.org/show_bug.cgi?id=176948
152
153         Reviewed by Keith Miller.
154
155         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
156         (baz):
157         (bar):
158         (foo):
159
160 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
161
162         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
163         https://bugs.webkit.org/show_bug.cgi?id=176867
164
165         Reviewed by Sam Weinig.
166
167         * microbenchmarks/object-get-own-property-symbols.js: Added.
168         (test):
169
170 2017-09-13  Mark Lam  <mark.lam@apple.com>
171
172         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
173         https://bugs.webkit.org/show_bug.cgi?id=176888
174         <rdar://problem/34381832>
175
176         Not reviewed.
177
178         * stress/op_mod-ConstVar.js:
179         * stress/op_mod-VarConst.js:
180         * stress/op_mod-VarVar.js:
181
182 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
183
184         Skip 3 op_mod tests on Debug JSC bots.
185         https://bugs.webkit.org/show_bug.cgi?id=176630
186
187         Unreviewed test gardening.
188
189         * stress/op_mod-ConstVar.js:
190         * stress/op_mod-VarConst.js:
191         * stress/op_mod-VarVar.js:
192
193 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
194
195         [JSC] Fix Array allocation in Object.keys
196         https://bugs.webkit.org/show_bug.cgi?id=176826
197
198         Reviewed by Saam Barati.
199
200         * stress/object-own-property-keys.js: Added.
201         (shouldBe):
202
203 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
204
205         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
206         https://bugs.webkit.org/show_bug.cgi?id=176010
207
208         Reviewed by Filip Pizlo.
209
210         * microbenchmarks/weak-map-key.js: Added.
211         (assert):
212         (objectKey):
213         (let.start.Date.now):
214
215 2017-09-12  Mark Lam  <mark.lam@apple.com>
216
217         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
218         https://bugs.webkit.org/show_bug.cgi?id=176630
219
220         Reviewed by JF Bastien.
221
222         Debug builds are just slow, and these tests do a lot.  They pass when I run them
223         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
224         a speculative fix for the bots that are seeing these fail.
225
226         I also undid the skipping of the op_mod tests for debug builds.
227
228         * stress/op_div-ConstVar.js:
229         * stress/op_div-VarConst.js:
230         * stress/op_div-VarVar.js:
231         * stress/op_mod-ConstVar.js:
232         * stress/op_mod-VarConst.js:
233         * stress/op_mod-VarVar.js:
234
235 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
236
237         Skip stress/value-to-boolean.js on Debug bots.
238         https://bugs.webkit.org/show_bug.cgi?id=176787
239
240         Unreviewed test gardening.
241
242         * stress/value-to-boolean.js:
243
244 2017-09-11  Mark Lam  <mark.lam@apple.com>
245
246         Change test expectation for test262/test/language/statements/try/tco-catch.js
247         https://bugs.webkit.org/show_bug.cgi?id=176749
248
249         Rubber stamped by Keith Miller.
250
251         It's been failing since at least r221821.  I'm changing the test expectation to
252         fail to green the bots while I investigate some more.
253
254         * test262.yaml:
255
256 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
257
258         Unreviewed, rolling out r221854.
259
260         The test added with this change fails on 32-bit JSC bots.
261
262         Reverted changeset:
263
264         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
265         https://bugs.webkit.org/show_bug.cgi?id=176010
266         http://trac.webkit.org/changeset/221854
267
268 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
269
270         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
271         https://bugs.webkit.org/show_bug.cgi?id=176010
272
273         Reviewed by Filip Pizlo.
274
275         * microbenchmarks/weak-map-key.js: Added.
276         (assert):
277         (objectKey):
278         (let.start.Date.now):
279
280 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
281
282         [JSC] Optimize Object.keys by using careful array allocation
283         https://bugs.webkit.org/show_bug.cgi?id=176654
284
285         Reviewed by Darin Adler.
286
287         * microbenchmarks/object-keys.js: Added.
288         (test):
289
290 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
291
292         Error should compute .stack and friends lazily
293         https://bugs.webkit.org/show_bug.cgi?id=176645
294
295         Reviewed by Saam Barati.
296
297         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
298         * microbenchmarks/new-error.js: Added.
299         * microbenchmarks/throw.js: Added.
300
301 2017-09-09  Mark Lam  <mark.lam@apple.com>
302
303         [Re-landing] Use JIT probes for DFG OSR exit.
304         https://bugs.webkit.org/show_bug.cgi?id=175144
305         <rdar://problem/33437050>
306
307         Not reviewed.  Original patch reviewed by Saam Barati.
308
309         Disable these tests for debug builds because they run too slow with the new OSR exit.
310
311         * stress/op_mod-ConstVar.js:
312         * stress/op_mod-VarConst.js:
313         * stress/op_mod-VarVar.js:
314
315 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
316
317         [DFG] NewArrayWithSize(size)'s size does not care negative zero
318         https://bugs.webkit.org/show_bug.cgi?id=176300
319
320         Reviewed by Saam Barati.
321
322         * stress/new-array-with-size-div.js: Added.
323         (shouldBe):
324         (test):
325         (i.i):
326
327 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
328
329         [DFG] PutByVal with Array::Generic is too generic
330         https://bugs.webkit.org/show_bug.cgi?id=176345
331
332         Reviewed by Filip Pizlo.
333
334         * stress/object-assign-symbols.js: Added.
335         (shouldBe):
336         (test):
337         * stress/object-assign.js: Added.
338         (shouldBe):
339         (test):
340         (i.shouldBe.JSON.stringify.test):
341
342 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
343
344         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
345         https://bugs.webkit.org/show_bug.cgi?id=176590
346
347         Reviewed by Saam Barati.
348
349         * microbenchmarks/object-iterate-symbols.js: Added.
350         (test):
351         * microbenchmarks/object-iterate.js: Added.
352         (test):
353         * stress/object-iterate-symbols.js: Added.
354         (shouldBe):
355         (test):
356         * stress/object-iterate.js: Added.
357         (shouldBe):
358         (test):
359
360 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
361
362         [Win32] 10 JSC stress tests are failing.
363         https://bugs.webkit.org/show_bug.cgi?id=176538
364
365         Reviewed by Mark Lam.
366
367         Skip tests on Windows to make the bots green.
368
369         * ChakraCore.yaml:
370         * stress/date-relaxed.js:
371
372 2017-09-06  Mark Lam  <mark.lam@apple.com>
373
374         constructGenericTypedArrayViewWithArguments() is missing an exception check.
375         https://bugs.webkit.org/show_bug.cgi?id=176485
376         <rdar://problem/33898874>
377
378         Reviewed by Keith Miller.
379
380         * stress/regress-176485.js: Added.
381
382 2017-09-05  Saam Barati  <sbarati@apple.com>
383
384         isNotCellSpeculation is wrong with respect to SpecEmpty
385         https://bugs.webkit.org/show_bug.cgi?id=176429
386
387         Reviewed by Michael Saboff.
388
389         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
390         (Foo):
391
392 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
393
394         test262: Completion values for control flow do not match the spec
395         https://bugs.webkit.org/show_bug.cgi?id=171265
396
397         Reviewed by Saam Barati.
398
399         * stress/completion-value.js:
400         Condensed test for completion values in top level statements.
401
402         * stress/super-get-by-id.js:
403         ClassDeclaration when evaled no longer produce values. Convert
404         these to ClassExpressions so they produce the class value.
405         
406         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
407         This is a progression for currect spec behavior.
408
409         * mozilla/mozilla-tests.yaml:
410         This test is now outdated, so mark it as failing for that reason.
411
412         * test262.yaml:
413         Passing all "cptn" completion value tests.
414
415 2017-09-04  Saam Barati  <sbarati@apple.com>
416
417         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
418         https://bugs.webkit.org/show_bug.cgi?id=176317
419
420         Reviewed by Keith Miller.
421
422         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
423         (Foo):
424
425 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
426
427         [DFG][FTL] Efficiently execute number#toString()
428         https://bugs.webkit.org/show_bug.cgi?id=170007
429
430         Reviewed by Keith Miller.
431
432         * microbenchmarks/number-to-string-strength-reduction.js: Added.
433         (test):
434         * microbenchmarks/number-to-string-with-radix-10.js: Added.
435         (test):
436         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
437         (test):
438         * microbenchmarks/number-to-string-with-radix.js: Added.
439         (test):
440         * stress/number-to-string-strength-reduction.js: Added.
441         (shouldBe):
442         (test):
443         * stress/number-to-string-with-radix-10.js: Added.
444         (shouldBe):
445         (test):
446         * stress/number-to-string-with-radix-cse.js: Added.
447         (shouldBe):
448         (test):
449         * stress/number-to-string-with-radix-invalid.js: Added.
450         (shouldThrow):
451         * stress/number-to-string-with-radix-watchpoint.js: Added.
452         (shouldBe):
453         (test):
454         (i.i.1e3.Number.prototype.toString):
455         * stress/number-to-string-with-radix.js: Added.
456         (shouldBe):
457         (test):
458
459 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
460
461         [DFG] Relax arity requirement
462         https://bugs.webkit.org/show_bug.cgi?id=175523
463
464         Reviewed by Saam Barati.
465
466         * stress/arity-mismatch-arguments-length.js: Added.
467         (shouldBe):
468         (test1):
469         (test):
470         * stress/arity-mismatch-get-argument.js: Added.
471         (shouldBe):
472         (builtin.createBuiltin):
473         (test):
474         * stress/arity-mismatch-inlining-extra-slots.js: Added.
475         (shouldBe):
476         (inlineTarget):
477         (test):
478         * stress/arity-mismatch-inlining.js: Added.
479         (shouldBe):
480         (inlineTarget):
481         (test):
482         * stress/arity-mismatch-rest.js: Added.
483         (shouldBe):
484         (test2):
485         (test1):
486         (test):
487
488 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
489
490         [JSC] Fix "name" and "length" of Proxy revoke function
491         https://bugs.webkit.org/show_bug.cgi?id=176155
492
493         Reviewed by Mark Lam.
494
495         * test262.yaml:
496
497 2017-08-31  Saam Barati  <sbarati@apple.com>
498
499         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
500         https://bugs.webkit.org/show_bug.cgi?id=176206
501
502         Reviewed by Keith Miller.
503
504         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
505         (a):
506         (b):
507         (foo):
508
509 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
510
511         Skip two slow JSC tests after r221422.
512
513         Unreviewed test gardening.
514
515         * stress/regexp-prototype-match-on-too-long-rope.js:
516         * stress/regexp-prototype-test-on-too-long-rope.js:
517
518 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
519
520         Unreviewed, skipping slow tests.
521         
522         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
523         work differently now.
524
525         * stress/regexp-prototype-exec-on-too-long-rope.js:
526         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
527
528 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
529
530         [JSC] Use reifying system for "name" property of builtin JSFunction
531         https://bugs.webkit.org/show_bug.cgi?id=175260
532
533         Reviewed by Saam Barati.
534
535         * stress/accessors-get-set-prefix.js:
536         * stress/builtin-function-name.js: Added.
537         (shouldBe):
538         (shouldThrow):
539         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
540         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
541         * stress/private-name-as-anonymous-builtin.js: Added.
542         (shouldBe):
543         (NotPromise):
544
545 2017-08-30  Saam Barati  <sbarati@apple.com>
546
547         Unreviewed. Make test stop printing.
548
549         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
550
551 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
552
553         Unreviewed, rolling out r221327.
554
555         This change caused test262 failures.
556
557         Reverted changeset:
558
559         "[JSC] Use reifying system for "name" property of builtin
560         JSFunction"
561         https://bugs.webkit.org/show_bug.cgi?id=175260
562         http://trac.webkit.org/changeset/221327
563
564 2017-08-30  Saam Barati  <sbarati@apple.com>
565
566         semicolon is being interpreted as an = in the LiteralParser
567         https://bugs.webkit.org/show_bug.cgi?id=176114
568
569         Reviewed by Oliver Hunt.
570
571         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
572         * stress/resources/literal-parser-test-case.js: Added.
573
574 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
575
576         [ESNext] Async iteration - Implement async iteration statement: for-await-of
577         https://bugs.webkit.org/show_bug.cgi?id=166698
578
579         Reviewed by Yusuke Suzuki.
580
581         * stress/async-iteration-for-await-of-syntax.js: Added.
582         (assert):
583         (checkSyntax):
584         (checkSyntaxError):
585         (checkSimpleAsyncGeneratorSloppyMode):
586         (checkSimpleAsyncGeneratorStrictMode):
587         (checkNestedAsyncGenerators):
588         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
589         * stress/async-iteration-for-await-of.js: Added.
590         (assert):
591         (async.foo):
592         (async.boo):
593         (const.boo.async):
594
595 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
596
597         [JSC] Use reifying system for "name" property of builtin JSFunction
598         https://bugs.webkit.org/show_bug.cgi?id=175260
599
600         Reviewed by Saam Barati.
601
602         * stress/accessors-get-set-prefix.js:
603         * stress/builtin-function-name.js: Added.
604         (shouldBe):
605         (shouldThrow):
606         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
607         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
608
609 2017-08-25  Saam Barati  <sbarati@apple.com>
610
611         Support compiling catch in the DFG
612         https://bugs.webkit.org/show_bug.cgi?id=174590
613         <rdar://problem/34047845>
614
615         Reviewed by Filip Pizlo.
616
617         * microbenchmarks/delta-blue-try-catch.js: Added.
618         (exception):
619         (value):
620         (OrderedCollection):
621         (OrderedCollection.prototype.add):
622         (OrderedCollection.prototype.at):
623         (OrderedCollection.prototype.size):
624         (OrderedCollection.prototype.removeFirst):
625         (OrderedCollection.prototype.remove):
626         (Strength):
627         (Strength.stronger):
628         (Strength.weaker):
629         (Strength.weakestOf):
630         (Strength.strongest):
631         (Strength.prototype.nextWeaker):
632         (Constraint):
633         (Constraint.prototype.addConstraint):
634         (Constraint.prototype.satisfy):
635         (Constraint.prototype.destroyConstraint):
636         (Constraint.prototype.isInput):
637         (UnaryConstraint):
638         (UnaryConstraint.prototype.addToGraph):
639         (UnaryConstraint.prototype.chooseMethod):
640         (UnaryConstraint.prototype.isSatisfied):
641         (UnaryConstraint.prototype.markInputs):
642         (UnaryConstraint.prototype.output):
643         (UnaryConstraint.prototype.recalculate):
644         (UnaryConstraint.prototype.markUnsatisfied):
645         (UnaryConstraint.prototype.inputsKnown):
646         (UnaryConstraint.prototype.removeFromGraph):
647         (StayConstraint):
648         (StayConstraint.prototype.execute):
649         (EditConstraint.prototype.isInput):
650         (EditConstraint.prototype.execute):
651         (BinaryConstraint):
652         (BinaryConstraint.prototype.chooseMethod):
653         (BinaryConstraint.prototype.addToGraph):
654         (BinaryConstraint.prototype.isSatisfied):
655         (BinaryConstraint.prototype.markInputs):
656         (BinaryConstraint.prototype.input):
657         (BinaryConstraint.prototype.output):
658         (BinaryConstraint.prototype.recalculate):
659         (BinaryConstraint.prototype.markUnsatisfied):
660         (BinaryConstraint.prototype.inputsKnown):
661         (BinaryConstraint.prototype.removeFromGraph):
662         (ScaleConstraint):
663         (ScaleConstraint.prototype.addToGraph):
664         (ScaleConstraint.prototype.removeFromGraph):
665         (ScaleConstraint.prototype.markInputs):
666         (ScaleConstraint.prototype.execute):
667         (ScaleConstraint.prototype.recalculate):
668         (EqualityConstraint):
669         (EqualityConstraint.prototype.execute):
670         (Variable):
671         (Variable.prototype.addConstraint):
672         (Variable.prototype.removeConstraint):
673         (Planner):
674         (Planner.prototype.incrementalAdd):
675         (Planner.prototype.incrementalRemove):
676         (Planner.prototype.newMark):
677         (Planner.prototype.makePlan):
678         (Planner.prototype.extractPlanFromConstraints):
679         (Planner.prototype.addPropagate):
680         (Planner.prototype.removePropagateFrom):
681         (Planner.prototype.addConstraintsConsumingTo):
682         (Plan):
683         (Plan.prototype.addConstraint):
684         (Plan.prototype.size):
685         (Plan.prototype.constraintAt):
686         (Plan.prototype.execute):
687         (chainTest):
688         (projectionTest):
689         (change):
690         (deltaBlue):
691         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
692         (assert):
693         (Numbers):
694         (Numbers.prototype.next):
695         (return.Transpose):
696         (return.Transpose.prototype.next):
697         (transpose):
698         (verifyEven):
699         (verifyString):
700         (foo):
701         (runIterators):
702         * microbenchmarks/try-catch-word-count.js: Added.
703         (let.assert):
704         (EOF):
705         (let.texts):
706         (let.o.apply):
707         (foo):
708         (bar):
709         (f):
710         (run):
711         (test1):
712         (test2):
713         (test3):
714         (fn):
715         (A):
716         (B):
717         (A.prototype.getValue):
718         (B.prototype.getParentValue):
719         (strlen):
720         (sum.0):
721         (test):
722         (result.test.o):
723         (set add.set add):
724         (set forEach):
725         (stringHash):
726         (set if):
727         (testFunction):
728         (set delete.set has.set add):
729         * stress/catch-set-argument-speculation-failure.js: Added.
730         (o):
731         (e):
732         (e2):
733         (escape):
734         (baz):
735         (noInline.run):
736         (noInline):
737         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
738         (foo):
739         (e):
740         (baz):
741         (bar):
742
743 2017-08-24  Commit Queue  <commit-queue@webkit.org>
744
745         Unreviewed, rolling out r221119, r221124, and r221143.
746         https://bugs.webkit.org/show_bug.cgi?id=175973
747
748         "I think it regressed JSBench by 20%" (Requested by saamyjoon
749         on #webkit).
750
751         Reverted changesets:
752
753         "Support compiling catch in the DFG"
754         https://bugs.webkit.org/show_bug.cgi?id=174590
755         http://trac.webkit.org/changeset/221119
756
757         "Unreviewed, build fix in GTK port"
758         https://bugs.webkit.org/show_bug.cgi?id=174590
759         http://trac.webkit.org/changeset/221124
760
761         "DFG::JITCode::osrEntry should get sorted since we perform a
762         binary search on it"
763         https://bugs.webkit.org/show_bug.cgi?id=175893
764         http://trac.webkit.org/changeset/221143
765
766 2017-08-24  Michael Saboff  <msaboff@apple.com>
767
768         Add support for RegExp "dotAll" flag
769         https://bugs.webkit.org/show_bug.cgi?id=175924
770
771         Reviewed by Keith Miller.
772
773         Updated tests for new dotAll ('s' flag) changes.
774
775         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
776         * stress/static-getter-in-names.js:
777
778 2017-08-24  Mark Lam  <mark.lam@apple.com>
779
780         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
781         https://bugs.webkit.org/show_bug.cgi?id=175940
782         <rdar://problem/29003921>
783
784         Reviewed by Saam Barati.
785
786         * stress/regress-164081.js: Added.
787         (shouldEqual):
788         (testcase):
789
790 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
791
792         Skip flaky JSC test stress/test-finally.js.
793         https://bugs.webkit.org/show_bug.cgi?id=160283
794
795         Unreviewed test gardening.
796
797         * stress/test-finally.js:
798
799 2017-08-23  Saam Barati  <sbarati@apple.com>
800
801         Support compiling catch in the DFG
802         https://bugs.webkit.org/show_bug.cgi?id=174590
803
804         Reviewed by Filip Pizlo.
805
806         * microbenchmarks/delta-blue-try-catch.js: Added.
807         (exception):
808         (value):
809         (OrderedCollection):
810         (OrderedCollection.prototype.add):
811         (OrderedCollection.prototype.at):
812         (OrderedCollection.prototype.size):
813         (OrderedCollection.prototype.removeFirst):
814         (OrderedCollection.prototype.remove):
815         (Strength):
816         (Strength.stronger):
817         (Strength.weaker):
818         (Strength.weakestOf):
819         (Strength.strongest):
820         (Strength.prototype.nextWeaker):
821         (Constraint):
822         (Constraint.prototype.addConstraint):
823         (Constraint.prototype.satisfy):
824         (Constraint.prototype.destroyConstraint):
825         (Constraint.prototype.isInput):
826         (UnaryConstraint):
827         (UnaryConstraint.prototype.addToGraph):
828         (UnaryConstraint.prototype.chooseMethod):
829         (UnaryConstraint.prototype.isSatisfied):
830         (UnaryConstraint.prototype.markInputs):
831         (UnaryConstraint.prototype.output):
832         (UnaryConstraint.prototype.recalculate):
833         (UnaryConstraint.prototype.markUnsatisfied):
834         (UnaryConstraint.prototype.inputsKnown):
835         (UnaryConstraint.prototype.removeFromGraph):
836         (StayConstraint):
837         (StayConstraint.prototype.execute):
838         (EditConstraint.prototype.isInput):
839         (EditConstraint.prototype.execute):
840         (BinaryConstraint):
841         (BinaryConstraint.prototype.chooseMethod):
842         (BinaryConstraint.prototype.addToGraph):
843         (BinaryConstraint.prototype.isSatisfied):
844         (BinaryConstraint.prototype.markInputs):
845         (BinaryConstraint.prototype.input):
846         (BinaryConstraint.prototype.output):
847         (BinaryConstraint.prototype.recalculate):
848         (BinaryConstraint.prototype.markUnsatisfied):
849         (BinaryConstraint.prototype.inputsKnown):
850         (BinaryConstraint.prototype.removeFromGraph):
851         (ScaleConstraint):
852         (ScaleConstraint.prototype.addToGraph):
853         (ScaleConstraint.prototype.removeFromGraph):
854         (ScaleConstraint.prototype.markInputs):
855         (ScaleConstraint.prototype.execute):
856         (ScaleConstraint.prototype.recalculate):
857         (EqualityConstraint):
858         (EqualityConstraint.prototype.execute):
859         (Variable):
860         (Variable.prototype.addConstraint):
861         (Variable.prototype.removeConstraint):
862         (Planner):
863         (Planner.prototype.incrementalAdd):
864         (Planner.prototype.incrementalRemove):
865         (Planner.prototype.newMark):
866         (Planner.prototype.makePlan):
867         (Planner.prototype.extractPlanFromConstraints):
868         (Planner.prototype.addPropagate):
869         (Planner.prototype.removePropagateFrom):
870         (Planner.prototype.addConstraintsConsumingTo):
871         (Plan):
872         (Plan.prototype.addConstraint):
873         (Plan.prototype.size):
874         (Plan.prototype.constraintAt):
875         (Plan.prototype.execute):
876         (chainTest):
877         (projectionTest):
878         (change):
879         (deltaBlue):
880         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
881         (assert):
882         (Numbers):
883         (Numbers.prototype.next):
884         (return.Transpose):
885         (return.Transpose.prototype.next):
886         (transpose):
887         (verifyEven):
888         (verifyString):
889         (foo):
890         (runIterators):
891         * microbenchmarks/try-catch-word-count.js: Added.
892         (let.assert):
893         (EOF):
894         (let.texts):
895         (let.o.apply):
896         (foo):
897         (bar):
898         (f):
899         (run):
900         (test1):
901         (test2):
902         (test3):
903         (fn):
904         (A):
905         (B):
906         (A.prototype.getValue):
907         (B.prototype.getParentValue):
908         (strlen):
909         (sum.0):
910         (test):
911         (result.test.o):
912         (set add.set add):
913         (set forEach):
914         (stringHash):
915         (set if):
916         (testFunction):
917         (set delete.set has.set add):
918         * stress/catch-set-argument-speculation-failure.js: Added.
919         (o):
920         (e):
921         (e2):
922         (escape):
923         (baz):
924         (noInline.run):
925         (noInline):
926         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
927         (foo):
928         (e):
929         (baz):
930         (bar):
931
932 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
933
934         [JSC] Optimize Map iteration with intrinsic
935         https://bugs.webkit.org/show_bug.cgi?id=174355
936
937         Reviewed by Saam Barati.
938
939         * stress/map-iterator-result-should-have-expected-shape.js: Added.
940         (shouldBe):
941         (throw.new.Error):
942         * stress/set-iterator-result-should-have-expected-shape.js: Added.
943         (shouldBe):
944         (throw.new.Error.let.iterator.set Symbol):
945         (throw.new.Error.set add):
946         (let.iterator.set Symbol):
947
948 2017-08-23  Robin Morisset  <rmorisset@apple.com>
949
950         Add a micro-benchmark for checking that accessing a variable within a 'with'
951         block does not automatically prevent type prediction.
952         https://bugs.webkit.org/show_bug.cgi?id=175738
953
954         Reviewed by Saam Barati.
955
956         * stress/with_and_arith.js: Added.
957         (with):
958
959 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
960
961         [ESNext] Async iteration - Implement Async Generator - runtime
962         https://bugs.webkit.org/show_bug.cgi?id=175240
963
964         Reviewed by Yusuke Suzuki.
965
966         * stress/async-iteration-async-from-sync.js: Added.
967         (assert):
968         (const.Logger):
969         (this.fullfilled):
970         (this.fullfilledDone):
971         (this.rejected):
972         (this.catched):
973         (this.isFinal):
974         (_assertLogger):
975         (const.assertLogger):
976         (const.getPromise.promiseHolder.return.new.Promise):
977         (foo):
978         (async.boo):
979         (bar):
980         (async.baz):
981         (async.goo):
982         * stress/async-iteration-basic.js: Added.
983         (assert):
984         (const.Logger):
985         (this.fullfilled):
986         (this.fullfilledDone):
987         (this.rejected):
988         (this.catched):
989         (this.isFinal):
990         (_assertLogger):
991         (const.assertLogger):
992         (const.getPromise.promiseHolder.return.new.Promise):
993         (async.generator):
994         (iterator.next.then):
995         (async.baz):
996         (async.boo):
997         (async.foo):
998         (async.goo):
999         (A.prototype.async.foo):
1000         (A.prototype.async.boo):
1001         (A):
1002         (asyncGenExp.async):
1003         (async.joo):
1004         (j.next.then):
1005         (then):
1006         (async.koo):
1007         (async.loo):
1008         (async.moo):
1009         (async.noo):
1010         (async.ooo):
1011         (async.roo):
1012         (async.poo):
1013         (async.soo):
1014         (async.too):
1015         * stress/async-iteration-evaluation.js: Added.
1016         (assert):
1017         (async.foo):
1018         (catch):
1019         * stress/async-iteration-syntax.js:
1020         * stress/async-iteration-yield-promise.js: Added.
1021         (assert):
1022         (const.Logger):
1023         (this.fullfilled):
1024         (this.fullfilledDone):
1025         (this.rejected):
1026         (this.catched):
1027         (this.isFinal):
1028         (_assertLogger):
1029         (const.assertLogger):
1030         (const.getPromise.promiseHolder.return.new.Promise):
1031         (async.foo):
1032         (async.boo):
1033         (async.bar):
1034         * stress/async-iteration-yield-star-interface.js: Added.
1035         (assert):
1036         (const.getPromise.promiseHolder.return.new.Promise):
1037         (const.Logger):
1038         (this.fullfilled):
1039         (this.fullfilledDone):
1040         (this.rejected):
1041         (this.catched):
1042         (this.custom):
1043         (this.isFinal):
1044         (_assertLogger):
1045         (const.assertLogger):
1046         (let.asyncIter.Symbol.asyncIterator):
1047         (let.asyncIter.next):
1048         (let.asyncIter.throw):
1049         (let.asyncIter.return):
1050         (async.foo):
1051         (asyncIter.Symbol.asyncIterator):
1052         (asyncIter.next):
1053         (async.boo):
1054         (asyncIter.return):
1055         (async.bar):
1056         (async.baz):
1057         (async.foobar):
1058         * stress/async-iteration-yield-star.js: Added.
1059         (assert):
1060         (const.Logger):
1061         (this.fullfilled):
1062         (this.fullfilledDone):
1063         (this.rejected):
1064         (this.catched):
1065         (this.custom):
1066         (this.isFinal):
1067         (_assertLogger):
1068         (const.assertLogger):
1069         (const.getPromise.promiseHolder.return.new.Promise):
1070         (async.foo):
1071         (async.boo):
1072         (async.bar):
1073         (async.baz):
1074         (async.joo):
1075         (async.goo):
1076         (async.koo):
1077         (async.loo):
1078         (let.asyncIter.Symbol.asyncIterator):
1079         (let.asyncIter.next):
1080         (let.asyncIter.throw):
1081         (let.asyncIter.return):
1082         (async.moo):
1083         (async.noo):
1084         * test262.yaml:
1085
1086 2017-08-23  JF Bastien  <jfbastien@apple.com>
1087
1088         Fix printing in test
1089
1090         Unreviewed: fixing verbosity, shouldn't have been there.
1091
1092         * wasm/regress/175693.js:
1093         (else.else):
1094         (catch):
1095
1096 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
1097
1098         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
1099         https://bugs.webkit.org/show_bug.cgi?id=172543
1100
1101         Unreviewed test gardening.
1102
1103         * microbenchmarks/generator-with-several-types.js:
1104
1105 2017-08-17  JF Bastien  <jfbastien@apple.com>
1106
1107         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
1108         https://bugs.webkit.org/show_bug.cgi?id=175693
1109         <rdar://problem/33952443>
1110
1111         Reviewed by Saam Barati.
1112
1113         Add a regression directory for WebAssembly tests.
1114
1115         * wasm.yaml:
1116         * wasm/regress/175693.js: Added.
1117         (else.else):
1118         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
1119         (catch):
1120         * wasm/regress/175693.wasm: Added.
1121
1122 2017-08-15  Robin Morisset  <rmorisset@apple.com>
1123
1124         Support the 'with' keyword in FTL.
1125         https://bugs.webkit.org/show_bug.cgi?id=175585
1126
1127         Reviewed by Saam Barati.
1128
1129         Also improve the JSTest/stress/with.js file to test
1130         what happens when non-objects are passed to with.
1131
1132         * stress/with.js:
1133         (foo):
1134         (i.catch):
1135         (i.with): Deleted.
1136
1137 2017-08-14  Keith Miller  <keith_miller@apple.com>
1138
1139         Add testing tool to lie to the DFG about profiles
1140         https://bugs.webkit.org/show_bug.cgi?id=175487
1141
1142         Reviewed by Saam Barati.
1143
1144         * stress/compare-eq-incomplete-profile.js: Added.
1145         (const.test.createBuiltin):
1146
1147 2017-08-14  Robin Morisset  <rmorisset@apple.com>
1148
1149         Support the with keyword in DFG
1150         https://bugs.webkit.org/show_bug.cgi?id=175470
1151
1152         Reviewed by Saam Barati.
1153
1154         Added a new stress-test for the 'with' keyword, that caught a bug in a
1155         previous version of this code.
1156
1157         * stress/with.js: Added.
1158         (i.with):
1159
1160 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
1161
1162         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
1163         https://bugs.webkit.org/show_bug.cgi?id=175544
1164
1165         Unreviewed test gardening.
1166
1167         * ChakraCore.yaml:
1168
1169 2017-08-09  Caitlin Potter  <caitp@igalia.com>
1170
1171         Early error on ANY operator before new.target
1172         https://bugs.webkit.org/show_bug.cgi?id=157970
1173
1174         Reviewed by Saam Barati.
1175
1176         Instead of throwing if any unary operator precedes new.target, only
1177         throw if the unary operator updates the reference.
1178
1179         The following become legal in JSC:
1180
1181         ```
1182         !new.target
1183         ~new.target
1184         typeof new.target
1185         delete new.target
1186         void new.target
1187         ```
1188
1189         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
1190
1191         * stress/new-target-syntax-errors.js:
1192         * stress/new-target.js:
1193
1194 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
1195
1196         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
1197         https://bugs.webkit.org/show_bug.cgi?id=175255
1198
1199         Unreviewed test gardening.
1200
1201         * stress/regress-169783.js:
1202         * wasm/stress/oom.js:
1203
1204 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1205
1206         REGRESSION: 2 test262/test/language/statements/async-function failures
1207         https://bugs.webkit.org/show_bug.cgi?id=175334
1208
1209         Reviewed by Yusuke Suzuki.
1210
1211         Add @skip parameters to tests, and remove test for async iterator from 
1212         async await syntax test because it is already covered by async-iterator-syntax.js
1213
1214         * stress/async-await-syntax.js:
1215         * stress/async-iteration-syntax.js:
1216
1217 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1218
1219         Unreviewed, gardening test262 for Promise resolve / reject function length
1220         https://bugs.webkit.org/show_bug.cgi?id=175333
1221
1222         * test262.yaml:
1223
1224 2017-08-07  Robin Morisset  <rmorisset@apple.com>
1225
1226         GetOwnProperty of TypedArray indexed fields is wrongly configurable
1227         https://bugs.webkit.org/show_bug.cgi?id=175307
1228
1229         Reviewed by Saam Barati.
1230
1231         * stress/typedarray-getownproperty-not-configurable.js: Added.
1232         (assert):
1233         (foo):
1234
1235 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1236
1237         Promise resolve and reject function should have length = 1
1238         https://bugs.webkit.org/show_bug.cgi?id=175242
1239
1240         Reviewed by Saam Barati.
1241
1242         * stress/builtin-function-length.js: Added.
1243         (shouldBe):
1244         (shouldThrow):
1245         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1246         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1247
1248 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
1249
1250         [ESNext] Async iteration - Implement Async Generator - parser
1251         https://bugs.webkit.org/show_bug.cgi?id=175210
1252
1253         Reviewed by Yusuke Suzuki.
1254
1255         * stress/async-await-syntax.js:
1256         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1257         * stress/async-iteration-syntax.js: Added.
1258         (assert):
1259         (checkSyntax):
1260         (checkSyntaxError):
1261         (checkSimpleAsyncGeneratorSloppyMode):
1262         (checkSimpleAsyncGeneratorStrictMode):
1263         (checkNestedAsyncGenerators):
1264         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
1265         * stress/generator-class-methods-syntax.js:
1266
1267 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1268
1269         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
1270         https://bugs.webkit.org/show_bug.cgi?id=175150
1271
1272         Unreviewed test gardening.
1273
1274         * wasm/js-api/test_memory_constructor.js:
1275
1276 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1277
1278         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
1279         https://bugs.webkit.org/show_bug.cgi?id=175100
1280
1281         Reviewed by Mark Lam.
1282
1283         The JSC test JSTests/wasm/stress/oom.js tries to use all the
1284         available memory until an out of memory exception happens.
1285
1286         The Linux kernel is more tuned for server workloads than for GUI
1287         responsiveness. When a process tries to use a lot of memory, Linux
1288         will do its best to serve the request. This usually translates to
1289         free physical RAM by writing to disk dirty pages and/or moving out
1290         less recently used pages to swap (disk storage).
1291         Meanwhile it does this, the system will become unresponsive and this
1292         leads to freezes that can last even some minutes on the worst cases.
1293
1294         Therefore, let's skip this test on Linux as it will cause more harm
1295         than good on the Linux bots or on the machines of Linux developers.
1296
1297         * wasm/stress/oom.js:
1298
1299 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1300
1301         [JSC] Remove unnecessary print from stress\promise-finally.js test
1302         https://bugs.webkit.org/show_bug.cgi?id=175015
1303
1304         Reviewed by Yusuke Suzuki.
1305
1306         * stress/promise-finally.js:
1307         (p.finally):
1308         (then):
1309
1310 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1311
1312         Unreviewed, update test262 results for optional catch binding
1313
1314         * test262.yaml:
1315
1316 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1317
1318         [JSC] Support optional catch binding
1319         https://bugs.webkit.org/show_bug.cgi?id=174981
1320
1321         Reviewed by Saam Barati.
1322
1323         * stress/optional-catch-binding-syntax.js: Added.
1324         (testSyntax):
1325         (testSyntaxError):
1326         (catch.catch):
1327         * stress/optional-catch-binding.js: Added.
1328         (shouldBe):
1329         (throwException):
1330
1331 2017-07-28  Mark Lam  <mark.lam@apple.com>
1332
1333         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
1334         https://bugs.webkit.org/show_bug.cgi?id=174948
1335         <rdar://problem/33495680>
1336
1337         Reviewed by Filip Pizlo.
1338
1339         * stress/regress-174948.js: Added.
1340
1341 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
1342
1343         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
1344         https://bugs.webkit.org/show_bug.cgi?id=174900
1345
1346         Reviewed by Saam Barati.
1347
1348         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
1349         (sideEffect):
1350         (args):
1351         (test):
1352
1353 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1354
1355         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
1356         https://bugs.webkit.org/show_bug.cgi?id=171637
1357
1358         Reviewed by Darin Adler.
1359
1360         * stress/domjit-getter-complex-with-incorrect-object.js:
1361         (i.shouldThrow):
1362         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
1363         (shouldBe):
1364         (i.shouldThrow):
1365
1366 2017-07-26  JF Bastien  <jfbastien@apple.com>
1367
1368         WebAssembly: test throwing out of the start function
1369         https://bugs.webkit.org/show_bug.cgi?id=165714
1370         <rdar://problem/29760251>
1371
1372         Reviewed by Keith Miller.
1373
1374         * wasm/assert.js:
1375         * wasm/function-tests/trap-from-start.js: Added.
1376         (StartTraps):
1377         * wasm/function-tests/trap-from-start-async.js: Added.
1378         (async.StartTrapsAsync):
1379
1380 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1381
1382         [FTL] Arguments elimination is suppressed by unreachable blocks
1383         https://bugs.webkit.org/show_bug.cgi?id=174352
1384
1385         Reviewed by Filip Pizlo.
1386
1387         * stress/arguments-elimination-force-exit.js: Added.
1388         (shouldBe):
1389         (strict):
1390         (sloppy):
1391         * stress/arguments-elimination-throw.js: Added.
1392         (shouldBe):
1393         (shouldThrow):
1394         (sloppy):
1395         (isArguments):
1396
1397 2017-07-13  Mark Lam  <mark.lam@apple.com>
1398
1399         Add some additional test cases for bug 170896.
1400         https://bugs.webkit.org/show_bug.cgi?id=174491
1401
1402         Reviewed by Filip Pizlo.
1403
1404         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
1405         * stress/regress-170896-with-double-shape-profile.js: Added.
1406         (test):
1407         * stress/regress-170896-with-int32-shape-profile.js: Added.
1408         (test):
1409         * stress/regress-170896.js: Removed.
1410
1411 2017-07-13  Saam Barati  <sbarati@apple.com>
1412
1413         Missing exception check in JSObject::hasInstance
1414         https://bugs.webkit.org/show_bug.cgi?id=174455
1415         <rdar://problem/31384608>
1416
1417         Reviewed by Mark Lam.
1418
1419         * stress/has-instance-exception-check.js: Added.
1420         (assert):
1421         (let.getter.Object.getOwnPropertyDescriptor.get foo):
1422
1423 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
1424
1425         [ESnext] Implement Object Spread
1426         https://bugs.webkit.org/show_bug.cgi?id=167963
1427
1428         Reviewed by Saam Barati.
1429
1430         * stress/obj-rest-destructuring-order.js: Added.
1431         (assert):
1432         (o.get z):
1433         (o.get a):
1434         * stress/obj-spread-order.js: Added.
1435         (assert):
1436         (o.get z):
1437         (o.get a):
1438         * stress/object-spread.js: Added.
1439         (let.assert):
1440         (assert.sameValue):
1441         (let.o.get a):
1442         (let.obj.get c):
1443         (cthulhu.get x):
1444         (let.obj.set c):
1445         (calls.o.get z):
1446         (calls.o.get a):
1447         (try.let.obj.get foo):
1448         (get calls):
1449
1450 2017-07-12  Saam Barati  <sbarati@apple.com>
1451
1452         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
1453         https://bugs.webkit.org/show_bug.cgi?id=174411
1454         <rdar://problem/31696186>
1455
1456         Reviewed by Mark Lam.
1457
1458         * stress/generic-arguments-correct-delete-behavior.js: Added.
1459         (assert):
1460         (makeTest):
1461
1462 2017-07-07  Mark Lam  <mark.lam@apple.com>
1463
1464         \n\r is not the same as \r\n.
1465         https://bugs.webkit.org/show_bug.cgi?id=173053
1466
1467         Reviewed by Keith Miller.
1468
1469         * stress/regress-173053.js: Added.
1470         * stress/template-literal-line-terminators.js:
1471
1472 2017-07-06  Saam Barati  <sbarati@apple.com>
1473
1474         We are missing places where we invalidate the for-in context
1475         https://bugs.webkit.org/show_bug.cgi?id=174184
1476
1477         Reviewed by Geoffrey Garen.
1478
1479         * stress/for-in-invalidate-context-weird-assignments.js: Added.
1480         (assert):
1481         (test):
1482
1483 2017-07-05  Saam Barati  <sbarati@apple.com>
1484
1485         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
1486         https://bugs.webkit.org/show_bug.cgi?id=174188
1487         <rdar://problem/30581423>
1488
1489         Reviewed by Mark Lam.
1490
1491         * stress/new-array-having-a-bad-time-double.js: Added.
1492         (assert):
1493         (foo):
1494
1495 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1496
1497         WTF::StringImpl::copyChars segfaults when built with GCC 7
1498         https://bugs.webkit.org/show_bug.cgi?id=173407
1499
1500         Reviewed by Andreas Kling.
1501
1502         * stress/string-repeat-copy-chars-crash.js: Added.
1503         (shouldBe):
1504
1505 2017-07-03  Saam Barati  <sbarati@apple.com>
1506
1507         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
1508
1509         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1510
1511 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1512
1513         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
1514
1515         It requires too much memory.
1516
1517         * stress/dont-reserve-huge-capacity-lexer.js:
1518
1519 2017-06-30  Michael Saboff  <msaboff@apple.com>
1520
1521         Skip a test on ARM64 platform since we run out of address space.
1522
1523         Rubber stamped by Saam Barati.
1524
1525         * stress/dont-reserve-huge-capacity-lexer.js:
1526
1527 2017-06-30  Michael Saboff  <msaboff@apple.com>
1528
1529         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
1530         https://bugs.webkit.org/show_bug.cgi?id=174044
1531
1532         Reviewed by Oliver Hunt.
1533
1534         New regression test.
1535
1536         * stress/regress-174044.js: Added.
1537         (test1):
1538         (test2):
1539
1540 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
1541
1542         RegExpCachedResult::setInput should reify left and right contexts
1543         https://bugs.webkit.org/show_bug.cgi?id=173818
1544
1545         Reviewed by Keith Miller.
1546
1547         * stress/right-left-context-invalidated-by-input.js: Added.
1548         (test.validateContexts):
1549         (test):
1550
1551 2017-06-29  Saam Barati  <sbarati@apple.com>
1552
1553         Calculating postCapacity in unshiftCountSlowCase is wrong
1554         https://bugs.webkit.org/show_bug.cgi?id=173992
1555         <rdar://problem/32283199>
1556
1557         Reviewed by Keith Miller.
1558
1559         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
1560         (temp):
1561
1562 2017-06-29  Commit Queue  <commit-queue@webkit.org>
1563
1564         Unreviewed, rolling out r218512.
1565         https://bugs.webkit.org/show_bug.cgi?id=173981
1566
1567         "It changes the behavior of the JS API's JSEvaluateScript
1568         which breaks TurboTax" (Requested by saamyjoon on #webkit).
1569
1570         Reverted changeset:
1571
1572         "test262: Completion values for control flow do not match the
1573         spec"
1574         https://bugs.webkit.org/show_bug.cgi?id=171265
1575         http://trac.webkit.org/changeset/218512
1576
1577 2017-06-27  JF Bastien  <jfbastien@apple.com>
1578
1579         WebAssembly: running out of executable memory should throw OoM
1580         https://bugs.webkit.org/show_bug.cgi?id=171537
1581         <rdar://problem/32963338>
1582
1583         Reviewed by Saam Barati.
1584
1585         * wasm.yaml:
1586         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
1587         (const.invoke):
1588         (failCount.0.catch):
1589         (failCount.0.module.undefined.catch):
1590         * wasm/lowExecutableMemory/exports-oom.js: Added.
1591         (const.type):
1592         (const.params):
1593         (const.randomProgram):
1594         (failCount.0.catch):
1595         (failCount.0.module.undefined.catch):
1596         * wasm/lowExecutableMemory/imports-oom.js: Added.
1597         (const.type):
1598         (const.params):
1599         (const.randomProgram):
1600         (f.imports.push):
1601         (failCount.0.catch):
1602         (failCount.0.module.undefined.catch):
1603
1604 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
1605
1606         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
1607         https://bugs.webkit.org/show_bug.cgi?id=167962
1608
1609         Reviewed by Saam Barati.
1610
1611         * stress/object-rest-deconstruct.js: Added.
1612         (let.assert):
1613         (let.assertPropDescriptor):
1614         (catch):
1615         (get 3):
1616         (foo):
1617         (let.src.get y):
1618         (let.src.set y):
1619         (let.gen):
1620
1621 2017-06-27  Saam Barati  <sbarati@apple.com>
1622
1623         Function constructor needs to follow the spec and validate parameters and body independently
1624         https://bugs.webkit.org/show_bug.cgi?id=173303
1625         <rdar://problem/32732526>
1626
1627         Reviewed by Keith Miller.
1628
1629         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1630         * stress/function-constructor-semantics.js: Added.
1631         (assert):
1632         (hasSyntaxError):
1633         (foo):
1634         (async.foo):
1635         (testError):
1636         (testOK.toString):
1637         (toString):
1638
1639 2017-06-26  Saam Barati  <sbarati@apple.com>
1640
1641         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
1642         https://bugs.webkit.org/show_bug.cgi?id=173740
1643
1644         Reviewed by Mark Lam.
1645
1646         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
1647         (Array.prototype.Symbol.iterator):
1648
1649 2017-06-26  Saam Barati  <sbarati@apple.com>
1650
1651         Skip a test on 32-bit platforms since we run out of address space.
1652
1653         Rubber stamped by Mark Lam.
1654
1655         * stress/dont-reserve-huge-capacity-lexer.js:
1656
1657 2017-06-26  Saam Barati  <sbarati@apple.com>
1658
1659         Crash in JSC::Lexer<unsigned char>::setCode
1660         https://bugs.webkit.org/show_bug.cgi?id=172754
1661
1662         Reviewed by Mark Lam.
1663
1664         * stress/dont-reserve-huge-capacity-lexer.js: Added.
1665         (catch):
1666
1667 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1668
1669         [JSC] Clean up Object.entries implementation
1670         https://bugs.webkit.org/show_bug.cgi?id=173759
1671
1672         Reviewed by Sam Weinig.
1673
1674         * microbenchmarks/object-entries.js: Added.
1675         (test):
1676
1677 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
1678
1679         Remove Reflect.enumerate
1680         https://bugs.webkit.org/show_bug.cgi?id=173806
1681
1682         Reviewed by Yusuke Suzuki.
1683
1684         * ChakraCore.yaml:
1685         * es6.yaml:
1686         These tests now fail because they use Reflect.enumerate.
1687
1688         * test262.yaml:
1689         This test now passes, it checked that Reflect.enumerate is undefined!
1690
1691         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
1692         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
1693
1694         * stress/reflect-enumerate.js: Removed.
1695         Remove a test solely for Reflect.enumerate.
1696
1697 2017-06-22  Saam Barati  <sbarati@apple.com>
1698
1699         ValueRep(DoubleRep(@v)) can not simply convert to @v
1700         https://bugs.webkit.org/show_bug.cgi?id=173687
1701         <rdar://problem/32855563>
1702
1703         Reviewed by Mark Lam.
1704
1705         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
1706         (i.catch):
1707
1708 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1709
1710         [JSC] Object.values should be implemented in C++
1711         https://bugs.webkit.org/show_bug.cgi?id=173703
1712
1713         Reviewed by Sam Weinig.
1714
1715         * microbenchmarks/object-keys-map-values.js: Added.
1716         (test):
1717         * microbenchmarks/object-values.js: Added.
1718         (test):
1719         * stress/object-values-changing-properties.js: Added.
1720         (shouldBe):
1721         (throw.new.Error.let.source.get x):
1722         (throw.new.Error):
1723         (shouldBe.let.handler.get order):
1724         (get let):
1725         (shouldBe.let.handler.get return):
1726         (let.handler.get order):
1727
1728 2017-06-21  Saam Barati  <sbarati@apple.com>
1729
1730         eval virtual call is incorrect in the baseline JIT
1731         https://bugs.webkit.org/show_bug.cgi?id=173587
1732         <rdar://problem/32867897>
1733
1734         Reviewed by Michael Saboff.
1735
1736         * stress/do-eval-virtual-call-correctly.js: Added.
1737         (assert):
1738         (f):
1739         (i.test):
1740         (catch):
1741
1742 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
1743
1744         Update test262 test expectations after r218581.
1745
1746         Unreviewed test gardening.
1747
1748         * test262.yaml:
1749
1750 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
1751
1752         Revert changes in bug#160417 about extending `null` not being a derived class
1753         https://bugs.webkit.org/show_bug.cgi?id=169293
1754
1755         Reviewed by Saam Barati.
1756
1757         * stress/class-derived-from-null.js:
1758         (assertThrow):
1759         (test1):
1760         (test2):
1761         (test3):
1762         (test4):
1763         (test5):
1764         (test6):
1765
1766 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1767
1768         [DFG] More ArrayIndexOf fixups for various types
1769         https://bugs.webkit.org/show_bug.cgi?id=173176
1770
1771         Reviewed by Saam Barati.
1772
1773         * stress/array-indexof-arraystorage.js: Added.
1774         (shouldBe):
1775         (indexOfInt32Other):
1776         (indexOfInt32Cell):
1777         (indexOfInt32Boolean):
1778         (indexOfDoubleOther):
1779         (indexOfDoubleCell):
1780         (indexOfDoubleBoolean):
1781         (indexOfInt32):
1782         (indexOfDouble):
1783         * stress/array-indexof-constant-folding.js: Added.
1784         (shouldBe):
1785         (indexOfInt32Other):
1786         (indexOfInt32Cell):
1787         (indexOfInt32Boolean):
1788         (indexOfDoubleOther):
1789         (indexOfDoubleCell):
1790         (indexOfDoubleBoolean):
1791         * stress/array-indexof-hole-and-other.js: Added.
1792         (shouldBe):
1793         (indexOf):
1794         * stress/array-indexof-other.js: Added.
1795         (shouldBe):
1796         (indexOfInt32):
1797         (indexOfDouble):
1798         (indexOfString):
1799         (indexOfObject):
1800         * stress/array-indexof-symbol.js: Added.
1801         (shouldBe):
1802         (indexOfInt32):
1803         (indexOfDouble):
1804         (indexOfString):
1805         (indexOfObject):
1806
1807 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
1808
1809         test262: Completion values for control flow do not match the spec
1810         https://bugs.webkit.org/show_bug.cgi?id=171265
1811
1812         Reviewed by Saam Barati.
1813
1814         * stress/completion-value.js:
1815         Condensed test for completion values in top level statements.
1816
1817         * stress/super-get-by-id.js:
1818         ClassDeclaration when evaled no longer produce values. Convert
1819         these to ClassExpressions so they produce the class value.
1820         
1821         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1822         This is a progression for currect spec behavior.
1823
1824         * mozilla/mozilla-tests.yaml:
1825         This test is now outdated, so mark it as failing for that reason.
1826
1827         * test262.yaml:
1828         Passing all "cptn" completion value tests.
1829
1830 2017-06-17  Keith Miller  <keith_miller@apple.com>
1831
1832         ArrayBuffer constructor needs to create subclass structures before its buffer
1833         https://bugs.webkit.org/show_bug.cgi?id=173510
1834
1835         Reviewed by Yusuke Suzuki.
1836
1837         * test262.yaml:
1838
1839 2017-06-17  Keith Miller  <keith_miller@apple.com>
1840
1841         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
1842         https://bugs.webkit.org/show_bug.cgi?id=173506
1843
1844         Reviewed by Ryosuke Niwa.
1845
1846         Re-baseline tests.
1847
1848         * ChakraCore/test/Function/apply3.baseline-jsc:
1849         * test262.yaml:
1850
1851 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1852
1853         [JSC] Add fast path for Object.assign
1854         https://bugs.webkit.org/show_bug.cgi?id=173416
1855
1856         Reviewed by Mark Lam.
1857
1858         * stress/object-assign-changing-properties.js: Added.
1859         (shouldBe):
1860         (throw.new.Error.let.source.get x):
1861         (throw.new.Error):
1862         (shouldBe.let.source.get x):
1863         (shouldBe.let.target.set x):
1864         (shouldBe.let.target.get x):
1865         * stress/object-assign-proxy.js: Added.
1866         (shouldBe):
1867         (throw.new.Error.let.handler.get order):
1868
1869 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1870
1871         [JSC] Implement Object.assign in C++
1872         https://bugs.webkit.org/show_bug.cgi?id=173414
1873
1874         Reviewed by Saam Barati.
1875
1876         * stress/object-assign-string-first.js: Added.
1877         (shouldBe):
1878         (source.get Symbol):
1879         (source.get 1):
1880         (source.get cocoa):
1881
1882 2017-06-14  JF Bastien  <jfbastien@apple.com>
1883
1884         WebAssembly: remove empty test files
1885         https://bugs.webkit.org/show_bug.cgi?id=173382
1886
1887         Reviewed by Saam Barati.
1888
1889         The following files:
1890                 JSTests/wasm/function-tests/call-indirect-params.js
1891                 JSTests/wasm/function-tests/call-indirect.js
1892                 JSTests/wasm/js-api/call-indirect-results.js
1893         Were changed to empty files in https://trac.webkit.org/changeset/209771
1894
1895         They were testing call_indirect with the wrong semantics, before
1896         we implemented tables. That change implemented tables and
1897         therefore removed the erroneous tests.
1898
1899         We have a few tests for call_indirect which already do the right thing:
1900                 JSTests/wasm/function-tests/context-switch.js
1901                 JSTests/wasm/function-tests/exceptions.js
1902                 JSTests/wasm/function-tests/grow-memory-2.js
1903                 JSTests/wasm/function-tests/stack-overflow.js
1904                 JSTests/wasm/function-tests/table-basic-2.js
1905                 JSTests/wasm/function-tests/table-basic.js
1906                 JSTests/wasm/js-api/call-indirect.js
1907                 JSTests/wasm/js-api/table.js
1908                 JSTests/wasm/js-api/unique-signature.js
1909                 JSTests/wasm/js-api/wrapper-function.js
1910
1911         I also just imported the updated spec tests which, among other
1912         things, test call_indirect:
1913                 core/br.wast
1914                 core/br_table.wast
1915                 core/call_indirect.wast
1916                 core/func.wast
1917                 core/func_ptrs.wast
1918                 core/imports.wast
1919                 core/left-to-right.wast
1920                 core/linking.wast
1921                 core/nop.wast
1922                 core/return.wast
1923                 core/typecheck.wast
1924                 core/unreachable.wast
1925
1926         So I think it's OK to just delete the tests which should just have
1927         been deleted back when tables were added.
1928
1929         * wasm/function-tests/call-indirect-params.js: Removed.
1930         * wasm/function-tests/call-indirect.js: Removed.
1931         * wasm/js-api/call-indirect-results.js: Removed.
1932
1933 2017-06-13  JF Bastien  <jfbastien@apple.com>
1934
1935         WebAssembly: import updated spec tests
1936         https://bugs.webkit.org/show_bug.cgi?id=173287
1937         <rdar://problem/32725975>
1938
1939         Reviewed by Saam Barati.
1940
1941         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
1942         with a few modifications so things work.
1943
1944         Fix a bunch of bugs found through this process, and punt a few tests (which I
1945         marked as blocked by this bug).
1946
1947         Fixes:
1948
1949         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
1950         instead of byte alignment. It was also missing memory-alignment.js despite it
1951         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
1952         pass.
1953
1954         Tables can be imported or in a section. There can be only one, but sections can
1955         be empty. An Elements section can exist if there's no Table, as long as it is
1956         also empty.
1957
1958         Memories can be imported or in a section. There can be only one, but sections
1959         can be empty. A Data section can exist if there's no Memory, as long as it is
1960         also empty.
1961
1962         Prototypes: stringify without .prototype. in the string.
1963
1964         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
1965         not a final size, and throws a RangeError on failure, not a TypeError.
1966
1967         Fix compile / instantiate so the reject the promise if given an argument of the
1968         wrong type (instead of failing instantly).
1969
1970         Fix async on neuter test.
1971
1972         Element section shouldn't affect any Table if any of the elements are out of
1973         bounds. We need to process it in two passes.
1974
1975         Segment section shouldn't affect any Data if any of the segments are out of
1976         bounds. We need to process it in two passes.
1977
1978         Empty data segments are valid, but only when there is no memory. Their index
1979         still gets validated, and has to be zero.
1980
1981         Punts:
1982
1983         Error messages with context, the test seems overly restrictive but this is
1984         minor.
1985
1986         compile/instantiate/validate property descriptors.
1987
1988         UTF-8 bugs.
1989
1990         Temporarily disable NaN tests. We need to go back and implement the following
1991         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
1992         much as getting all the other tests passing.
1993
1994         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
1995         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
1996         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
1997         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
1998         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
1999         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
2000         why they're not allowed.
2001
2002         * wasm.yaml:
2003         * wasm/function-tests/i32-load8-s.js:
2004         * wasm/function-tests/memory-access-past-4gib.js:
2005         (const.op.of.WASM.opcodes):
2006         * wasm/function-tests/memory-alignment.js: Added.
2007         (const.op.of.WASM.opcodes):
2008         * wasm/function-tests/memory-section-and-import.js:
2009         * wasm/js-api/Module-compile.js:
2010         (async.testPromiseAPI):
2011         * wasm/js-api/dont-mmap-zero-byte-memory.js:
2012         (testMems):
2013         * wasm/js-api/element.js:
2014         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2015         * wasm/js-api/neutered-inputs.js:
2016         (const.testFunction): Deleted.
2017         (const.testConstructor): Deleted.
2018         * wasm/js-api/table.js:
2019         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2020         (new.WebAssembly.Module):
2021         (assert.throws):
2022         (assertBadTableImport):
2023         (assert.throws.WebAssembly.Table.prototype.grow):
2024         (assertBadTableInstance): Deleted.
2025         * wasm/js-api/test_Data.js:
2026         (DataSectionWithoutMemory):
2027         * wasm/spec-harness/index.js:
2028         (module):
2029         (uniqueTest): Deleted.
2030         (assert_invalid): Deleted.
2031         (assert_soft_invalid): Deleted.
2032         (register): Deleted.
2033         (call): Deleted.
2034         (get instance): Deleted.
2035         (exports): Deleted.
2036         (run): Deleted.
2037         (assert_unlinkable): Deleted.
2038         (assert_uninstantiable): Deleted.
2039         (assert_trap): Deleted.
2040         (try.f): Deleted.
2041         (catch): Deleted.
2042         (assert_exhaustion): Deleted.
2043         (assert_return): Deleted.
2044         (assert_return_nan): Deleted.
2045         * wasm/spec-harness/testharness.css: Removed.
2046         * wasm/spec-harness/testharness.js: Removed.
2047         * wasm/spec-harness/testharnessreport.js: Removed.
2048         * wasm/spec-harness/wasm-constants.js:
2049         (assertTraps):
2050         (assertWasmThrows):
2051         * wasm/spec-harness/wasm-module-builder.js:
2052         (Binary.prototype.emit_section):
2053         (Binary):
2054         (WasmFunctionBuilder.prototype.addBody):
2055         (WasmFunctionBuilder.prototype.end):
2056         (WasmFunctionBuilder):
2057         (WasmModuleBuilder.prototype.stringToBytes):
2058         (WasmModuleBuilder.prototype.addCustomSection):
2059         (WasmModuleBuilder.prototype.addFunctionTableInit):
2060         (WasmModuleBuilder.prototype.appendToTable):
2061         (WasmModuleBuilder.prototype.toArray):
2062         (WasmModuleBuilder.prototype.toBuffer):
2063         (WasmModuleBuilder.prototype.instantiate):
2064         (WasmModuleBuilder):
2065         * wasm/spec-tests/address.wast.js:
2066         * wasm/spec-tests/align.wast.js: Added.
2067         * wasm/spec-tests/binary.wast.js:
2068         * wasm/spec-tests/block.wast.js:
2069         * wasm/spec-tests/br.wast.js:
2070         * wasm/spec-tests/br_if.wast.js:
2071         * wasm/spec-tests/br_table.wast.js:
2072         * wasm/spec-tests/call.wast.js:
2073         * wasm/spec-tests/call_indirect.wast.js:
2074         * wasm/spec-tests/comments.wast.js:
2075         * wasm/spec-tests/const.wast.js: Added.
2076         * wasm/spec-tests/conversions.wast.js: Added.
2077         * wasm/spec-tests/custom_section.wast.js:
2078         * wasm/spec-tests/exports.wast.js:
2079         * wasm/spec-tests/f32.wast.js: Added.
2080         * wasm/spec-tests/f64.wast.js: Added.
2081         * wasm/spec-tests/fac.wast.js:
2082         * wasm/spec-tests/float_exprs.wast.js: Added.
2083         * wasm/spec-tests/float_misc.wast.js: Added.
2084         * wasm/spec-tests/func.wast.js:
2085         * wasm/spec-tests/globals.wast.js:
2086         * wasm/spec-tests/if.wast.js:
2087         * wasm/spec-tests/imports.wast.js:
2088         * wasm/spec-tests/inline-module.wast.js: Added.
2089         * wasm/spec-tests/jsapi.js:
2090         (testJSAPI.test):
2091         (testJSAPI):
2092         * wasm/spec-tests/labels.wast.js:
2093         * wasm/spec-tests/loop.wast.js:
2094         * wasm/spec-tests/memory.wast.js:
2095         * wasm/spec-tests/memory_trap.wast.js: Added.
2096         * wasm/spec-tests/names.wast.js:
2097         * wasm/spec-tests/nop.wast.js:
2098         * wasm/spec-tests/return.wast.js:
2099         * wasm/spec-tests/stack.wast.js:
2100         * wasm/spec-tests/token.wast.js: Added.
2101         * wasm/spec-tests/type.wast.js: Added.
2102         * wasm/spec-tests/typecheck.wast.js:
2103         * wasm/spec-tests/unreachable.wast.js:
2104         * wasm/spec-tests/unreached-invalid.wast.js:
2105         * wasm/spec-tests/unwind.wast.js:
2106         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
2107         * wasm/spec-tests/utf8-import-field.wast.js: Added.
2108         * wasm/spec-tests/utf8-import-module.wast.js: Added.
2109
2110 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
2111
2112         Unreviewed JSC test gardening.
2113
2114         * stress/check-string-ident.js:
2115         * stress/new-largeish-contiguous-array-with-size.js:
2116
2117 2017-06-13  Michael Saboff  <msaboff@apple.com>
2118
2119         DFG doesn't properly handle a property that is change to read only in a prototype
2120         https://bugs.webkit.org/show_bug.cgi?id=173321
2121
2122         Reviewed by Filip Pizlo.
2123
2124         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
2125         * stress/regress-173321.js: Added new regression test.
2126         (shouldBe):
2127         (SimpleObject):
2128         (test):
2129
2130 2017-06-12  Saam Barati  <sbarati@apple.com>
2131
2132         Update test262 test expectation since r218082 makes new tests pass.
2133
2134         * test262.yaml:
2135
2136 2017-06-12  Saam Barati  <sbarati@apple.com>
2137
2138         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
2139         https://bugs.webkit.org/show_bug.cgi?id=172957
2140         <rdar://problem/32602704>
2141
2142         Reviewed by Filip Pizlo.
2143
2144         * stress/spec-empty-flows-through-cell-checks.js: Added.
2145         (A):
2146         (B):
2147         (i.catch):
2148
2149 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
2150
2151         We incorrectly allow escaped characters in keyword tokens
2152         https://bugs.webkit.org/show_bug.cgi?id=171310
2153
2154         Reviewed by Yusuke Suzuki.
2155
2156         * stress/destructuring-assignment-syntax.js:
2157         * stress/error-messages-for-in-operator-should-not-crash.js:
2158         (catch):
2159         * stress/reserved-word-with-escape.js:
2160         (testSyntaxError.String.raw.v):
2161         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
2162         (testSyntaxError.String.raw.a):
2163         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
2164
2165 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2166
2167         [DFG] Add ArrayIndexOf intrinsic
2168         https://bugs.webkit.org/show_bug.cgi?id=172421
2169
2170         Reviewed by Saam Barati.
2171
2172         * stress/array-indexof-array-prototype-change.js: Added.
2173         (shouldBe):
2174         (indexOfInt32):
2175         * stress/array-indexof-have-a-bad-time-getter.js: Added.
2176         (shouldBe):
2177         (indexOfInt32):
2178         * stress/array-indexof-have-a-bad-time.js: Added.
2179         (shouldBe):
2180         (indexOfInt32):
2181         * stress/array-indexof-hole-with-prototype.js: Added.
2182         (shouldBe):
2183         (indexOf):
2184         * stress/array-indexof-hole.js: Added.
2185         (shouldBe):
2186         (indexOf):
2187         * stress/array-indexof-index.js: Added.
2188         (shouldBe):
2189         (indexOfInt32):
2190         (indexOfDouble):
2191         (indexOfString):
2192         (indexOfObject):
2193         (indexOfValue):
2194         * stress/array-indexof-negative-index.js: Added.
2195         (shouldBe):
2196         (indexOfInt32):
2197         (indexOfDouble):
2198         (indexOfString):
2199         (indexOfObject):
2200         (indexOfValue):
2201         * stress/array-indexof-non-int32-start-index.js: Added.
2202         (shouldBe):
2203         (indexOf):
2204         (object.valueOf):
2205         * stress/array-indexof-object-prototype-change.js: Added.
2206         (shouldBe):
2207         (indexOfInt32):
2208         * stress/array-indexof-object.js: Added.
2209         (shouldBe):
2210         (indexOf):
2211         * stress/array-indexof-original-array.js: Added.
2212         (shouldBe):
2213         (indexOfInt32):
2214         * stress/array-indexof-string.js: Added.
2215         (shouldBe):
2216         (indexOf):
2217         * stress/array-indexof-structure-change-convert.js: Added.
2218         (shouldBe):
2219         (indexOf):
2220         * stress/array-indexof-structure-change.js: Added.
2221         (shouldBe):
2222         (indexOf):
2223         * stress/array-indexof.js: Added.
2224         (shouldBe):
2225         (indexOf):
2226
2227 2017-06-11  Keith Miller  <keith_miller@apple.com>
2228
2229         TypedArray constructor with string shouldn't throw
2230         https://bugs.webkit.org/show_bug.cgi?id=173181
2231
2232         Reviewed by JF Bastien.
2233
2234         We should be coercing primitive arguments to numbers in the various
2235         TypedArray constructors.
2236
2237         * stress/typedarray-constructor.js:
2238
2239 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
2240
2241         Unreviewed, update test results part 3
2242         https://bugs.webkit.org/show_bug.cgi?id=173227
2243
2244         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
2245
2246 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2247
2248         Unreviewed, update test results part 2
2249         https://bugs.webkit.org/show_bug.cgi?id=173227
2250
2251         * test262.yaml:
2252
2253 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2254
2255         Unreviewed, update test results
2256         https://bugs.webkit.org/show_bug.cgi?id=173227
2257
2258         * microbenchmarks/string-prototype-search-observable-side-effects.js:
2259         * test262.yaml:
2260
2261 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2262
2263         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
2264         https://bugs.webkit.org/show_bug.cgi?id=173227
2265
2266         Reviewed by Mark Lam.
2267
2268         Update the test.
2269
2270         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
2271
2272 2017-06-08  Keith Miller  <keith_miller@apple.com>
2273
2274         WebAssembly: We should only create wrappers for functions that can be exported
2275         https://bugs.webkit.org/show_bug.cgi?id=173088
2276
2277         Reviewed by Saam Barati.
2278
2279         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
2280         on the old testWasmModuleFunctions api, which has been removed.
2281
2282         * wasm/function-tests/copysign.js: Removed.
2283         * wasm/function-tests/ctz.js: Removed.
2284         * wasm/function-tests/drop.js: Removed.
2285         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
2286         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
2287         * wasm/function-tests/dumb-less-than-ite.js: Removed.
2288         * wasm/function-tests/eqz.js: Removed.
2289         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
2290         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
2291         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
2292         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
2293         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
2294         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
2295         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
2296         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
2297         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
2298         * wasm/function-tests/if-then-fallthrough.js: Removed.
2299         * wasm/function-tests/int-to-floating-point.js: Removed.
2300         * wasm/function-tests/loop-mult.js:
2301         * wasm/function-tests/loop-sum.js:
2302         * wasm/function-tests/max.js: Removed.
2303         * wasm/function-tests/min.js: Removed.
2304         * wasm/function-tests/nearest.js: Removed.
2305         * wasm/function-tests/nop.js: Removed.
2306         * wasm/function-tests/popcnt.js: Removed.
2307         * wasm/function-tests/ret5.js:
2308         * wasm/function-tests/select.js: Removed.
2309         * wasm/function-tests/tee-local.js: Removed.
2310         * wasm/function-tests/trunc.js: Removed.
2311
2312 2017-06-07  JF Bastien  <jfbastien@apple.com>
2313
2314         WebAssembly: test imports and exports with 16-bit characters
2315         https://bugs.webkit.org/show_bug.cgi?id=165977
2316         <rdar://problem/29760130>
2317
2318         Reviewed by Saam Barati.
2319
2320         The output for import failure was improved, so many tests need to
2321         be updated here. Only one has new tests as noted below.
2322
2323         * wasm/function-tests/memory-import-and-grow.js:
2324         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
2325         (idxModule):
2326         * wasm/js-api/global-error.js:
2327         (new.Number):
2328         (assert.throws):
2329         * wasm/js-api/table.js:
2330         (assert.throws):
2331         (new.WebAssembly.Table):
2332         * wasm/js-api/test_memory.js:
2333         (test):
2334         * wasm/js-api/wasm-to-wasm-bad-signature.js:
2335         (BadSignatureDropStartParams.):
2336         (BadSignatureDropStartParams):
2337         (BadSignatureDropEndParams.):
2338         (BadSignatureSwapParam.):
2339         (BadSignatureRet.):
2340         * wasm/js-api/web-assembly-instantiate.js:
2341         (assert.asyncTest.async.test):
2342         (assert.asyncTest):
2343         * wasm/js-api/wrapper-function.js:
2344         (return.new.WebAssembly.Module):
2345
2346 2017-06-07  Mark Lam  <mark.lam@apple.com>
2347
2348         Restrict the regress-173035.js test to only run on Darwin x86-64.
2349         https://bugs.webkit.org/show_bug.cgi?id=173075
2350
2351         Reviewed by Saam Barati.
2352
2353         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
2354         this test will require to succeed.  Here's an example of this failure:
2355         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
2356
2357         Since the issue is due to allocation of a very large amount of memory, the test
2358         will probably fail on iOS and other platforms as well.  Hence, we should just
2359         skip this test for any platforms that is not Darwin x86-64.
2360
2361         * stress/regress-173035.js:
2362
2363 2017-06-07  Mark Lam  <mark.lam@apple.com>
2364
2365         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
2366         https://bugs.webkit.org/show_bug.cgi?id=168587
2367
2368         Not reviewed.
2369
2370         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
2371
2372         * stress/test-finally.js:
2373
2374 2017-06-06  Mark Lam  <mark.lam@apple.com>
2375
2376         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
2377         https://bugs.webkit.org/show_bug.cgi?id=173035
2378         <rdar://problem/32554593>
2379
2380         Reviewed by Geoffrey Garen and Filip Pizlo.
2381
2382         * stress/regress-173035.js: Added.
2383
2384 2017-06-06  Saam Barati  <sbarati@apple.com>
2385
2386         Make sure we restore SP when doing calls that could be to JS
2387         https://bugs.webkit.org/show_bug.cgi?id=172946
2388         <rdar://problem/32579026>
2389
2390         Reviewed by JF Bastien.
2391
2392         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
2393         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
2394         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
2395         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
2396         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
2397
2398 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
2399
2400         Unreviewed rollout r217807. Caused a test to crash.
2401
2402         * heapProfiler/class-names.js: Removed.
2403         * heapProfiler/driver/driver.js:
2404         (CheapHeapSnapshotNode):
2405         (CheapHeapSnapshot):
2406         (createCheapHeapSnapshot):
2407         (HeapSnapshot):
2408         (createHeapSnapshot):
2409         * typeProfiler/inheritance.js:
2410         (wrapper.A):
2411         (wrapper.B):
2412         (wrapper.C):
2413         (wrapper):
2414
2415 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
2416
2417         index out of bound in bytecodebasicblock
2418         https://bugs.webkit.org/show_bug.cgi?id=172963
2419
2420         Reviewed by Saam Barati and Mark Lam.
2421
2422         * stress/dfg-call-class-constructor.js: Added.
2423         (Foo):
2424         (i.catch):
2425
2426 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
2427
2428         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
2429         https://bugs.webkit.org/show_bug.cgi?id=172848
2430         <rdar://problem/25709212>
2431
2432         Reviewed by Saam Barati.
2433
2434         * typeProfiler/inheritance.js:
2435         Rewrite the test slightly for clarity. The hoisting was confusing.
2436
2437         * heapProfiler/class-names.js: Added.
2438         (MyES5Class):
2439         (MyES6Class):
2440         (MyES6Subclass):
2441         Test object types and improved class names.
2442
2443         * heapProfiler/driver/driver.js:
2444         (CheapHeapSnapshotNode):
2445         (CheapHeapSnapshot):
2446         (createCheapHeapSnapshot):
2447         (HeapSnapshot):
2448         (createHeapSnapshot):
2449         Update snapshot parsing from version 1 to version 2.
2450
2451 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2452
2453         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
2454         https://bugs.webkit.org/show_bug.cgi?id=168844
2455
2456         Reviewed by Saam Barati.
2457
2458         * modules/async-function-export.js: Added.
2459         (f):
2460         (export.async.f):
2461
2462 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2463
2464         ES2015 modules - Export default function hoisting
2465         https://bugs.webkit.org/show_bug.cgi?id=170174
2466
2467         Reviewed by Saam Barati.
2468
2469         This issue itself is solved by fixing function declaration hoisting rules.
2470         This patch just adds the specific test to modules tests to ensure the bug
2471         is fixed.
2472
2473         * modules/export-default-function-hoisting.js: Added.
2474         * modules/export-default-function-hoisting/cappuccino.js: Added.
2475         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
2476         * modules/export-default-function-hoisting/cocoa.js: Added.
2477         (export.default.drinkCocoa):
2478
2479 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2480
2481         Class Proxy can't be extended
2482         https://bugs.webkit.org/show_bug.cgi?id=169040
2483
2484         Reviewed by Saam Barati.
2485
2486         Adding tests that check correctness of Proxy to ES6 `class`
2487         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
2488
2489         * stress/proxy-class.js: Added.
2490         (assert):
2491         (throw.new.Error.SuperClass):
2492         (throw.new.Error.A):
2493         (throw.new.Error):
2494
2495 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2496
2497         [JSC] Implement String.prototype.concat in JS builtins
2498         https://bugs.webkit.org/show_bug.cgi?id=172798
2499
2500         Reviewed by Sam Weinig.
2501
2502         * microbenchmarks/string-concat-convert.js: Added.
2503         (test):
2504         * microbenchmarks/string-concat-long-convert.js: Added.
2505         (test):
2506         * microbenchmarks/string-concat-long.js: Added.
2507         (test):
2508         * microbenchmarks/string-concat.js: Added.
2509         (test):
2510
2511 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
2512
2513         Rolling out: Prevent async methods named 'function'
2514         https://bugs.webkit.org/show_bug.cgi?id=172776
2515
2516         Reviewed by Mark Lam.
2517
2518         * stress/async-await-syntax.js:
2519         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2520         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2521         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2522         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2523         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2524
2525 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
2526
2527         Skip flaky JSC test stress/test-finally.js
2528         https://bugs.webkit.org/show_bug.cgi?id=168587
2529
2530         Unreviewed test gardening.
2531
2532         * stress/test-finally.js:
2533
2534 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2535
2536         Prevent async methods named 'function' in Object literal
2537         https://bugs.webkit.org/show_bug.cgi?id=172660
2538
2539         Reviewed by Saam Barati.
2540
2541         * stress/async-await-syntax.js:
2542         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2543
2544 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2545
2546         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
2547         https://bugs.webkit.org/show_bug.cgi?id=171274
2548
2549         Reviewed by Saam Barati.
2550
2551         * stress/async-arrow-functions-lexical-binding-in-class.js:
2552         (shouldBeAsync):
2553         (shouldBeAsyncAndStoreBind):
2554         (promise.new.Promise):
2555         (ChildClass4):
2556         (ChildClass4.prototype.classValue):
2557         (ChildClass4.prototype.get classProperty):
2558         * stress/async-arrow-functions-lexical-super-binding.js:
2559         (A):
2560         (const.childA1.new.prototype.var.f.async):
2561         (const.childA1.new.var):
2562         (const.childA1.new):
2563         (const.childA2.new.prototype.var.f.async):
2564         (const.childA2.new.var):
2565         (const.childA2.new):
2566         (const.childA3.new.prototype.var.f.async):
2567         (const.childA3.new.var):
2568         (const.childA3.new):
2569         (try.childA4.new.prototype.var.f.async):
2570         (try.childA4.new.var):
2571         (try.childA4.new):
2572         (catch):
2573         (const.childA5.new.prototype.var.f.async):
2574         (const.childA5.new.var):
2575         (const.childA5.new):
2576         (checkClass):
2577         (checkClass.new.prototype.var.f.async):
2578         (checkClass.new.var):
2579         (checkClass.new):
2580         (checkClass.new.prototype.method):
2581         (checkClass.new.prototype.prop):
2582
2583 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2584
2585         [JSC] Map and Set constructors should have fast path for cloning
2586         https://bugs.webkit.org/show_bug.cgi?id=172413
2587
2588         Reviewed by Saam Barati.
2589
2590         * stress/map-clone-instance-iterator-change.js: Added.
2591         (shouldBe):
2592         (map.Symbol.iterator):
2593         * stress/map-clone-iterator-change.js: Added.
2594         (shouldBe):
2595         (Map.prototype.Symbol.iterator):
2596         * stress/map-clone-next-change.js: Added.
2597         (shouldBe):
2598         (map.Symbol.iterator.__proto__.next):
2599         * stress/map-clone.js: Added.
2600         (shouldBe):
2601         (Map.prototype):
2602         * stress/map-inherit-set.js: Added.
2603         (shouldBe):
2604         (DerivedMap):
2605         (set for):
2606         * stress/set-clone-instance-iterator-change.js: Added.
2607         (shouldBe):
2608         (set Symbol.iterator):
2609         * stress/set-clone-iterator-change.js: Added.
2610         (shouldBe):
2611         (set Set.prototype.Symbol.iterator):
2612         * stress/set-clone-next-change.js: Added.
2613         (shouldBe):
2614         (set Symbol.iterator.__proto__.next):
2615         * stress/set-clone.js: Added.
2616         (shouldBe):
2617         (set Set.prototype.add):
2618         * stress/set-inherit-add.js: Added.
2619         (shouldBe):
2620         (DerivedSet.set add):
2621
2622 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
2623
2624         Unreviewed, rolling out r217458.
2625
2626         This change caused 55 JSC test failures.
2627
2628         Reverted changeset:
2629
2630         "Date should use historical data if it's available."
2631         https://bugs.webkit.org/show_bug.cgi?id=172592
2632         http://trac.webkit.org/changeset/217458
2633
2634 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2635
2636         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
2637         https://bugs.webkit.org/show_bug.cgi?id=167805
2638
2639         Reviewed by Saam Barati.
2640
2641         * modules/module-jit-reachability.js: Added.
2642
2643 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
2644
2645         Prevent async methods named 'function'
2646         https://bugs.webkit.org/show_bug.cgi?id=172598
2647
2648         Reviewed by Mark Lam.
2649
2650         * stress/async-await-syntax.js:
2651         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2652         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2653         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2654         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2655         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2656
2657 2017-05-25  Keith Miller  <keith_miller@apple.com>
2658
2659         Date should use historical data if it's available.
2660         https://bugs.webkit.org/show_bug.cgi?id=172592
2661
2662         Reviewed by Mark Lam.
2663
2664         Remove parts of the date tests that rely on the absence of
2665         historical data in Date.
2666
2667         * mozilla/ecma/Date/15.9.5.31-1.js:
2668         (getTestCases):
2669         * mozilla/ecma/Date/15.9.5.35-1.js:
2670         (getTestCases):
2671
2672 2017-05-25  Saam Barati  <sbarati@apple.com>
2673
2674         Our for-in optimization in the bytecode generator does its static analysis incorrectly
2675         https://bugs.webkit.org/show_bug.cgi?id=172532
2676         <rdar://problem/32369452>
2677
2678         Reviewed by Mark Lam.
2679
2680         * stress/for-in-invalidation-for-any-write.js: Added.
2681         (assert):
2682         (test):
2683         (test.i):
2684
2685 2017-05-25  Mark Lam  <mark.lam@apple.com>
2686
2687         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
2688         https://bugs.webkit.org/show_bug.cgi?id=172548
2689         <rdar://problem/31458393>
2690
2691         Reviewed by Filip Pizlo.
2692
2693         * stress/regress-172548.patch: Added.
2694
2695 2017-05-23  Saam Barati  <sbarati@apple.com>
2696
2697         We should not mmap zero bytes for a memory in Wasm
2698         https://bugs.webkit.org/show_bug.cgi?id=172528
2699         <rdar://problem/32257076>
2700
2701         Reviewed by Mark Lam.
2702
2703         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
2704         (testMems):
2705
2706 2017-05-23  Saam Barati  <sbarati@apple.com>
2707
2708         CFGSimplificationPhase should not merge a block with itself
2709         https://bugs.webkit.org/show_bug.cgi?id=172508
2710         <rdar://problem/28424006>
2711
2712         Reviewed by Keith Miller.
2713
2714         * stress/dont-crash-in-cfg-simplification.js: Added.
2715         (bar):
2716         (baz):
2717         (foo):
2718
2719 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2720
2721         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
2722         https://bugs.webkit.org/show_bug.cgi?id=172216
2723
2724         Reviewed by Saam Barati.
2725
2726         * stress/array-storage-get-by-val.js: Added.
2727         (shouldBe):
2728         (testOutOfBound):
2729         (testInBound):
2730         (testSlowPutOutOfBound):
2731         (testSlowPutInBound):
2732
2733 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2734
2735         Unreviewed, fix commented out tests
2736         https://bugs.webkit.org/show_bug.cgi?id=172225
2737
2738         * stress/get-by-val-string.js:
2739         (object.43):
2740         (Hello):
2741         (Hello.prototype.get 42):
2742         (Hello.prototype.43):
2743         (Derived):
2744         (shouldBe):
2745         (throw.new.Error): Deleted.
2746
2747 2017-05-21  Saam Barati  <sbarati@apple.com>
2748
2749         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
2750         https://bugs.webkit.org/show_bug.cgi?id=171041
2751         <rdar://problem/32082516>
2752
2753         Reviewed by Yusuke Suzuki.
2754
2755         * stress/lexical-scoping-for-loop.js: Added.
2756         (assert):
2757         (test1):
2758         (test2):
2759         (test3):
2760         (test4):
2761         (test5):
2762         (test6):
2763         (let.test7):
2764         (let.test8):
2765         (let.test9):
2766         (let.test10):
2767         (let.test11):
2768         (let.test12):
2769
2770 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2771
2772         [JSC] Make get_by_val & string "499" to number 499
2773         https://bugs.webkit.org/show_bug.cgi?id=172225
2774
2775         Reviewed by Saam Barati.
2776
2777         * stress/get-by-val-string.js: Added.
2778         (shouldBe):
2779         (shouldThrow):
2780         (object.43):
2781         (Hello):
2782         (Hello.prototype.get 42):
2783         (Hello.prototype.43):
2784         (Derived):
2785
2786 2017-05-19  Mark Lam  <mark.lam@apple.com>
2787
2788         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2789         https://bugs.webkit.org/show_bug.cgi?id=172383
2790         <rdar://problem/31418651>
2791
2792         Reviewed by Filip Pizlo.
2793
2794         * stress/regress-172383.js: Added.
2795
2796 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
2797
2798         Unreviewed, rolling out r217156.
2799
2800         This change broke the iOS build.
2801
2802         Reverted changeset:
2803
2804         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
2805         result registers."
2806         https://bugs.webkit.org/show_bug.cgi?id=172383
2807         http://trac.webkit.org/changeset/217156
2808
2809 2017-05-19  Mark Lam  <mark.lam@apple.com>
2810
2811         Add missing exception check.
2812         https://bugs.webkit.org/show_bug.cgi?id=172346
2813         <rdar://problem/32289640>
2814
2815         Reviewed by Geoffrey Garen.
2816
2817         * stress/regress-172346.js: Added.
2818
2819 2017-05-19  Mark Lam  <mark.lam@apple.com>
2820
2821         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2822         https://bugs.webkit.org/show_bug.cgi?id=172383
2823         <rdar://problem/31418651>
2824
2825         Reviewed by Filip Pizlo.
2826
2827         * stress/regress-172383.js: Added.
2828
2829 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
2830
2831         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
2832         https://bugs.webkit.org/show_bug.cgi?id=172369
2833
2834         Reviewed by Mark Lam.
2835
2836         * stress/undecided-concat.js: Added.
2837
2838 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2839
2840         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2841         https://bugs.webkit.org/show_bug.cgi?id=172098
2842
2843         Reviewed by Saam Barati.
2844
2845         * stress/check-sub-class.js: Added.
2846         (shouldBe):
2847         (shouldThrow):
2848         (calling):
2849         (array.forEach):
2850         (i.array.forEach):
2851
2852 2017-05-18  JF Bastien  <jfbastien@apple.com>
2853
2854         WebAssembly: exports is a getter
2855         https://bugs.webkit.org/show_bug.cgi?id=172129
2856
2857         Reviewed by Saam Barati.
2858
2859         Update test to reflect new semantics.
2860
2861         * wasm/js-api/test_basic_api.js:
2862         (const.c.in.constructorProperties.switch):
2863
2864 2017-05-18  Saam Barati  <sbarati@apple.com>
2865
2866         Proxy's [[Get]] passes incorrect receiver
2867         https://bugs.webkit.org/show_bug.cgi?id=164849
2868         <rdar://problem/31767058>
2869
2870         Reviewed by Yusuke Suzuki.
2871
2872         * stress/proxy-get-set-correct-receiver.js: Added.
2873         (assert):
2874         (test):
2875         (test.let.target.set prop):
2876         (test.let.target.get prop):
2877         (test.get let):
2878         * stress/proxy-set.js:
2879         (let.target.get x):
2880         * stress/reflect-set-proxy-set.js:
2881         (let.target.get x):
2882         * stress/reflect-set-receiver-proxy-set.js:
2883         (let.target.get x):
2884
2885 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2886
2887         Constructor calls set this too early
2888         https://bugs.webkit.org/show_bug.cgi?id=172302
2889
2890         Reviewed by Saam Barati.
2891         
2892         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
2893         wrong.
2894
2895         * stress/construct-overwritten-variable.js: Added.
2896         (new.x.x):
2897         * stress/construct-spread-overwritten-variable-2.js: Added.
2898         (new.x.x):
2899         * stress/construct-spread-overwritten-variable.js: Added.
2900         (new.x.x):
2901
2902 2017-05-18  Saam Barati  <sbarati@apple.com>
2903
2904         WebAssembly: perform stack checks
2905         https://bugs.webkit.org/show_bug.cgi?id=165546
2906         <rdar://problem/29760307>
2907
2908         Reviewed by Filip Pizlo.
2909
2910         * wasm.yaml:
2911         * wasm/function-tests/factorial.js:
2912         * wasm/function-tests/float-sub.js:
2913         * wasm/function-tests/stack-overflow.js: Added.
2914         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2915         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2916         (assertOverflows.makeInstance):
2917         (assertOverflows.makeInstance2):
2918         (assertOverflows.assertThrows):
2919         (assertOverflows):
2920         (assertThrows.test.makeSignature):
2921         (assertThrows.test.makeInstance):
2922         (assertThrows.test):
2923         (assertThrows):
2924
2925 2017-05-18  Keith Miller  <keith_miller@apple.com>
2926
2927         WebAssembly API: test with neutered inputs
2928         https://bugs.webkit.org/show_bug.cgi?id=163899
2929
2930         Reviewed by JF Bastien.
2931
2932         * wasm/js-api/neutered-inputs.js: Added.
2933         (const.testFunction):
2934         (const.testConstructor):
2935         * wasm/js-api/test_basic_api.js:
2936         (const.c.in.constructorProperties.switch):
2937
2938 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2939
2940         DFG inlining should be hardened for the no-result case
2941         https://bugs.webkit.org/show_bug.cgi?id=172290
2942
2943         Reviewed by Saam Barati.
2944
2945         * stress/array-constructor-no-result.js: Added.
2946         (foo):
2947         * stress/pow-no-result.js: Added.
2948         (foo):
2949
2950 2017-05-18  Commit Queue  <commit-queue@webkit.org>
2951
2952         Unreviewed, rolling out r217031, r217032, and r217037.
2953         https://bugs.webkit.org/show_bug.cgi?id=172293
2954
2955         cause linking errors in Windows (Requested by yusukesuzuki on
2956         #webkit).
2957
2958         Reverted changesets:
2959
2960         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
2961         https://bugs.webkit.org/show_bug.cgi?id=172098
2962         http://trac.webkit.org/changeset/217031
2963
2964         "Unreviewed, rebaseline for newly added ClassInfo"
2965         https://bugs.webkit.org/show_bug.cgi?id=172098
2966         http://trac.webkit.org/changeset/217032
2967
2968         "Unreviewed, fix debug and non-JIT build"
2969         https://bugs.webkit.org/show_bug.cgi?id=172098
2970         http://trac.webkit.org/changeset/217037
2971
2972 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2973
2974         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2975         https://bugs.webkit.org/show_bug.cgi?id=172098
2976
2977         Reviewed by Saam Barati.
2978
2979         * stress/check-sub-class.js: Added.
2980         (shouldBe):
2981         (shouldThrow):
2982         (calling):
2983         (array.forEach):
2984         (i.array.forEach):
2985
2986 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2987
2988         Unreviewed, address mlam's review feedback.
2989
2990         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
2991
2992 2017-05-17  Saam Barati  <sbarati@apple.com>
2993
2994         We don't do context switches for Wasm->Wasm call indirect
2995         https://bugs.webkit.org/show_bug.cgi?id=172188
2996         <rdar://problem/32231828>
2997
2998         Reviewed by Keith Miller.
2999
3000         * wasm/function-tests/context-switch.js: Added.
3001         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3002         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
3003         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
3004         (makeInstance):
3005         (makeInstance2):
3006         (assert.eq.makeInstance):
3007         (assert.eq.makeInstance2):
3008         (assert.eq):
3009
3010 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
3011
3012         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
3013         https://bugs.webkit.org/show_bug.cgi?id=172208
3014
3015         Reviewed by Saam Barati.
3016
3017         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
3018         (foo):
3019         (bar):
3020         (baz):
3021
3022 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3023
3024         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
3025         https://bugs.webkit.org/show_bug.cgi?id=172115
3026
3027         Reviewed by Saam Barati.
3028
3029         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
3030         (shouldBe):
3031         (unknown):
3032         (readWord1):
3033         (readWord2):
3034         (readWord3):
3035         (readWord4):
3036
3037 2017-05-16  JF Bastien  <jfbastien@apple.com>
3038
3039         WebAssembly: add memory fuzzer
3040         https://bugs.webkit.org/show_bug.cgi?id=169976
3041         <rdar://problem/31965328>
3042
3043         Reviewed by Keith Miller.
3044
3045         * wasm/fuzz/memory.js: Added.
3046         (const.insert):
3047         (const.action.string_appeared_here):
3048         (const.performAction):
3049         (catch):
3050
3051 2017-05-16  JF Bastien  <jfbastien@apple.com>
3052
3053         WebAssembly: validate load / store alignment
3054         https://bugs.webkit.org/show_bug.cgi?id=168836
3055         <rdar://problem/31965349>
3056
3057         Reviewed by Keith Miller.
3058
3059         * wasm/WASM.js: fix regular expression greed
3060         * wasm/function-tests/memory-alignment.js: Added.
3061         (const.op.of.WASM.opcodes):
3062         * wasm/wasm.json: fix formatting
3063
3064 2017-05-15  Mark Lam  <mark.lam@apple.com>
3065
3066         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
3067         https://bugs.webkit.org/show_bug.cgi?id=172147
3068
3069         Rubber-stamped by Saam Barati.
3070
3071         * stress/object-rest-deconstruct.js: Removed.
3072         * stress/object-spread.js: Removed.
3073
3074 2017-05-11  JF Bastien  <jfbastien@apple.com>
3075
3076         WebAssembly: stop supporting 0xD
3077         https://bugs.webkit.org/show_bug.cgi?id=168788
3078         <rdar://problem/31880922>
3079
3080         Reviewed by Saam Barati.
3081
3082         Test that only version 1 is supported.
3083
3084         * wasm/js-api/version.js: Added.
3085
3086 2017-05-10  JF Bastien  <jfbastien@apple.com>
3087
3088         WebAssemby: builder doesn't do Memory section maximum correctly
3089         https://bugs.webkit.org/show_bug.cgi?id=171931
3090
3091         Reviewed by Keith Miller.
3092
3093         * wasm/Builder.js:
3094         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3095         * wasm/Builder_WebAssemblyBinary.js:
3096         (const.emitters.Memory):
3097         * wasm/function-tests/memory-grow-invalid.js: Added.
3098
3099 2017-05-10  JF Bastien  <jfbastien@apple.com>
3100
3101         WebAssembly: support name section
3102         https://bugs.webkit.org/show_bug.cgi?id=171263
3103
3104         Reviewed by Keith Miller.
3105
3106         * wasm/function-tests/nameSection.js: Added.
3107         (const.compile):
3108         * wasm/function-tests/nameSection.wasm: Added.
3109         * wasm/function-tests/stack-trace.js: Update format
3110
3111 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
3112
3113         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
3114         https://bugs.webkit.org/show_bug.cgi?id=171801
3115
3116         Reviewed by Michael Saboff.
3117         
3118         These tests used to crash. The prefix and postfix tests cover different paths, except
3119         postfix-ignored goes down the same path as prefix due to an optimization.
3120
3121         * stress/for-in-postfix-ignored-index.js: Added.
3122         (foo):
3123         * stress/for-in-postfix-index.js: Added.
3124         (foo):
3125         * stress/for-in-prefix-index.js: Added.
3126         (foo):
3127
3128 2017-05-08  Mark Lam  <mark.lam@apple.com>
3129
3130         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
3131         https://bugs.webkit.org/show_bug.cgi?id=171786
3132         <rdar://problem/32051023>
3133
3134         Reviewed by Saam Barati.
3135
3136         * stress/bug-171786.js: Added.
3137
3138 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3139
3140         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
3141         https://bugs.webkit.org/show_bug.cgi?id=171543
3142
3143         Reviewed by Saam Barati.
3144
3145         * stress/arrowfunction-lexical-bind-supercall-4.js:
3146         (J):
3147         (K):
3148
3149 2017-05-05  Saam Barati  <sbarati@apple.com>
3150
3151         putDirectIndex does not properly do defineOwnProperty
3152         https://bugs.webkit.org/show_bug.cgi?id=171591
3153         <rdar://problem/31735695>
3154
3155         Reviewed by Geoffrey Garen.
3156
3157         * stress/array-prototype-splice-making-typed-array.js:
3158         (test):
3159         * stress/array-species-config-array-constructor.js:
3160         (shouldThrow):
3161         (test):
3162         * stress/put-direct-index-broken-2.js: Added.
3163         (assert):
3164         (test):
3165         (makeLengthWritable):
3166         (set get restoreOldDesc):
3167         * stress/put-direct-index-broken.js: Added.
3168         (whatToTest):
3169         (tryRunning):
3170         (tryItOut):
3171         * stress/put-indexed-getter-setter.js: Added.
3172         (foo.X.prototype.set 7):
3173         (foo.X.prototype.get 7):
3174         (foo.X):
3175         (foo):
3176
3177 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
3178
3179         [JSC] Math unary functions should be handled by DFG
3180         https://bugs.webkit.org/show_bug.cgi?id=171269
3181
3182         Reviewed by Saam Barati.
3183
3184         * stress/arith-acos-on-various-types.js: Added.
3185         (let.validInputTypedTestCases.validInputTestCases.map):
3186         (isIdentical):
3187         (opaqueACosNoArgument):
3188         (testNoArgument):
3189         (opaqueAllTypesACos):
3190         (testAllTypesCall):
3191         (testSingleTypeCall):
3192         (testConstant):
3193         (opaqueACosForSideEffects):
3194         (testSideEffect.let.testObject.valueOf):
3195         (testSideEffect):
3196         (opaqueACosForCSE):
3197         (testCSE.let.testObject.valueOf):
3198         (testCSE):
3199         (opaqueACosForDCE):
3200         (testDCE.let.testObject.valueOf):
3201         (testDCE):
3202         (testException.opaqueACosWithException):
3203         (testException):
3204         * stress/arith-acosh-on-various-types.js: Added.
3205         (let.validInputTypedTestCases.validInputTestCases.map):
3206         (isIdentical):
3207         (opaqueACoshNoArgument):
3208         (testNoArgument):
3209         (opaqueAllTypesACosh):
3210         (testAllTypesCall):
3211         (testSingleTypeCall):
3212         (testConstant):
3213         (opaqueACoshForSideEffects):
3214         (testSideEffect.let.testObject.valueOf):
3215         (testSideEffect):
3216         (opaqueACoshForCSE):
3217         (testCSE.let.testObject.valueOf):
3218         (testCSE):
3219         (opaqueACoshForDCE):
3220         (testDCE.let.testObject.valueOf):
3221         (testDCE):
3222         (testException.opaqueACoshWithException):
3223         (testException):
3224         * stress/arith-asin-on-various-types.js: Added.
3225         (let.validInputTypedTestCases.validInputTestCases.map):
3226         (isIdentical):
3227         (opaqueASinNoArgument):
3228         (testNoArgument):
3229         (opaqueAllTypesASin):
3230         (testAllTypesCall):
3231         (testSingleTypeCall):
3232         (testConstant):
3233         (opaqueASinForSideEffects):
3234         (testSideEffect.let.testObject.valueOf):
3235         (testSideEffect):
3236         (opaqueASinForCSE):
3237         (testCSE.let.testObject.valueOf):
3238         (testCSE):
3239         (opaqueASinForDCE):
3240         (testDCE.let.testObject.valueOf):
3241         (testDCE):
3242         (testException.opaqueASinWithException):
3243         (testException):
3244         * stress/arith-asinh-on-various-types.js: Added.
3245         (let.validInputTypedTestCases.validInputTestCases.map):
3246         (isIdentical):
3247         (opaqueASinhNoArgument):
3248         (testNoArgument):
3249         (opaqueAllTypesASinh):
3250         (testAllTypesCall):
3251         (testSingleTypeCall):
3252         (testConstant):
3253         (opaqueASinhForSideEffects):
3254         (testSideEffect.let.testObject.valueOf):
3255         (testSideEffect):
3256         (opaqueASinhForCSE):
3257         (testCSE.let.testObject.valueOf):
3258         (testCSE):
3259         (opaqueASinhForDCE):
3260         (testDCE.let.testObject.valueOf):
3261         (testDCE):
3262         (testException.opaqueASinhWithException):
3263         (testException):
3264         * stress/arith-atan-on-various-types.js: Added.
3265         (let.validInputTypedTestCases.validInputTestCases.map):
3266         (isIdentical):
3267         (opaqueATanNoArgument):
3268         (testNoArgument):
3269         (opaqueAllTypesATan):
3270         (testAllTypesCall):
3271         (testSingleTypeCall):
3272         (testConstant):
3273         (opaqueATanForSideEffects):
3274         (testSideEffect.let.testObject.valueOf):
3275         (testSideEffect):
3276         (opaqueATanForCSE):
3277         (testCSE.let.testObject.valueOf):
3278         (testCSE):
3279         (opaqueATanForDCE):
3280         (testDCE.let.testObject.valueOf):
3281         (testDCE):
3282         (testException.opaqueATanWithException):
3283         (testException):
3284         * stress/arith-atanh-on-various-types.js: Added.
3285         (let.validInputTypedTestCases.validInputTestCases.map):
3286         (isIdentical):
3287         (opaqueATanhNoArgument):
3288         (testNoArgument):
3289         (opaqueAllTypesATanh):
3290         (testAllTypesCall):
3291         (testSingleTypeCall):
3292         (testConstant):
3293         (opaqueATanhForSideEffects):
3294         (testSideEffect.let.testObject.valueOf):
3295         (testSideEffect):
3296         (opaqueATanhForCSE):
3297         (testCSE.let.testObject.valueOf):
3298         (testCSE):
3299         (opaqueATanhForDCE):
3300         (testDCE.let.testObject.valueOf):
3301         (testDCE):
3302         (testException.opaqueATanhWithException):
3303         (testException):
3304         * stress/arith-cbrt-on-various-types.js: Added.
3305         (let.validInputTypedTestCases.validInputTestCases.map):
3306         (isIdentical):
3307         (opaqueCbrtNoArgument):
3308         (testNoArgument):
3309         (opaqueAllTypesCbrt):
3310         (testAllTypesCall):
3311         (testSingleTypeCall):
3312         (testConstant):
3313         (opaqueCbrtForSideEffects):
3314         (testSideEffect.let.testObject.valueOf):
3315         (testSideEffect):
3316         (opaqueCbrtForCSE):
3317         (testCSE.let.testObject.valueOf):
3318         (testCSE):
3319         (opaqueCbrtForDCE):
3320         (testDCE.let.testObject.valueOf):
3321         (testDCE):
3322         (testException.opaqueCbrtWithException):
3323         (testException):
3324         * stress/arith-cosh-on-various-types.js: Added.
3325         (let.validInputTypedTestCases.validInputTestCases.map):
3326         (isIdentical):
3327         (opaqueCoshNoArgument):
3328         (testNoArgument):
3329         (opaqueAllTypesCosh):
3330         (testAllTypesCall):
3331         (testSingleTypeCall):
3332         (testConstant):
3333         (opaqueCoshForSideEffects):
3334         (testSideEffect.let.testObject.valueOf):
3335         (testSideEffect):
3336         (opaqueCoshForCSE):
3337         (testCSE.let.testObject.valueOf):
3338         (testCSE):
3339         (opaqueCoshForDCE):
3340         (testDCE.let.testObject.valueOf):
3341         (testDCE):
3342         (testException.opaqueCoshWithException):
3343         (testException):
3344         * stress/arith-expm1-on-various-types.js: Added.
3345         (let.validInputTypedTestCases.validInputTestCases.map):
3346         (isIdentical):
3347         (opaqueExpm1NoArgument):
3348         (testNoArgument):
3349         (opaqueAllTypesExpm1):
3350         (testAllTypesCall):
3351         (testSingleTypeCall):
3352         (testConstant):
3353         (opaqueExpm1ForSideEffects):
3354         (testSideEffect.let.testObject.valueOf):
3355         (testSideEffect):
3356         (opaqueExpm1ForCSE):
3357         (testCSE.let.testObject.valueOf):
3358         (testCSE):
3359         (opaqueExpm1ForDCE):
3360         (testDCE.let.testObject.valueOf):
3361         (testDCE):
3362         (testException.opaqueExpm1WithException):
3363         (testException):
3364         * stress/arith-log10-on-various-types.js: Added.
3365         (let.validInputTypedTestCases.validInputTestCases.map):
3366         (isIdentical):
3367         (opaqueLog10NoArgument):
3368         (testNoArgument):
3369         (opaqueAllTypesLog10):
3370         (testAllTypesCall):
3371         (testSingleTypeCall):
3372         (testConstant):
3373         (opaqueLog10ForSideEffects):
3374         (testSideEffect.let.testObject.valueOf):
3375         (testSideEffect):
3376         (opaqueLog10ForCSE):
3377         (testCSE.let.testObject.valueOf):
3378         (testCSE):
3379         (opaqueLog10ForDCE):
3380         (testDCE.let.testObject.valueOf):
3381         (testDCE):
3382         (testException.opaqueLog10WithException):
3383         (testException):
3384         * stress/arith-log2-on-various-types.js: Added.
3385         (let.validInputTypedTestCases.validInputTestCases.map):
3386         (isIdentical):
3387         (opaqueLog2NoArgument):
3388         (testNoArgument):
3389         (opaqueAllTypesLog2):
3390         (testAllTypesCall):
3391         (testSingleTypeCall):
3392         (testConstant):
3393         (opaqueLog2ForSideEffects):
3394         (testSideEffect.let.testObject.valueOf):
3395         (testSideEffect):
3396         (opaqueLog2ForCSE):
3397         (testCSE.let.testObject.valueOf):
3398         (testCSE):
3399         (opaqueLog2ForDCE):
3400         (testDCE.let.testObject.valueOf):
3401         (testDCE):
3402         (testException.opaqueLog2WithException):
3403         (testException):
3404         * stress/arith-sinh-on-various-types.js: Added.
3405         (let.validInputTypedTestCases.validInputTestCases.map):
3406         (isIdentical):
3407         (opaqueSinhNoArgument):
3408         (testNoArgument):
3409         (opaqueAllTypesSinh):
3410         (testAllTypesCall):
3411         (testSingleTypeCall):
3412         (testConstant):
3413         (opaqueSinhForSideEffects):
3414         (testSideEffect.let.testObject.valueOf):
3415         (testSideEffect):
3416         (opaqueSinhForCSE):
3417         (testCSE.let.testObject.valueOf):
3418         (testCSE):
3419         (opaqueSinhForDCE):
3420         (testDCE.let.testObject.valueOf):
3421         (testDCE):
3422         (testException.opaqueSinhWithException):
3423         (testException):
3424         * stress/arith-tan-on-various-types.js:
3425         (isIdentical):
3426         * stress/arith-tanh-on-various-types.js: Added.
3427         (let.validInputTypedTestCases.validInputTestCases.map):
3428         (isIdentical):
3429         (opaqueTanhNoArgument):
3430         (testNoArgument):
3431         (opaqueAllTypesTanh):
3432         (testAllTypesCall):
3433         (testSingleTypeCall):
3434         (testConstant):
3435         (opaqueTanhForSideEffects):
3436         (testSideEffect.let.testObject.valueOf):
3437         (testSideEffect):
3438         (opaqueTanhForCSE):
3439         (testCSE.let.testObject.valueOf):
3440         (testCSE):
3441         (opaqueTanhForDCE):
3442         (testDCE.let.testObject.valueOf):
3443         (testDCE):
3444         (testException.opaqueTanhWithException):
3445         (testException):
3446
3447 2017-05-03  Keith Miller  <keith_miller@apple.com>
3448
3449         Array.prototype.sort should also allow a null comparator
3450         https://bugs.webkit.org/show_bug.cgi?id=171621
3451
3452         Reviewed by Michael Saboff.
3453
3454         Add test to make it less likely we revert to the incompatable behavior.
3455         Also, fix now incorrect tests.
3456
3457         * ChakraCore/test/Array/array_sort.baseline-jsc:
3458         * stress/array-sort-bad-comparator.js:
3459         (test):
3460         * stress/sort-null-comparator.js: Added.
3461         (assertEq):
3462
3463 2017-05-03  Caitlin Potter  <caitp@igalia.com>
3464
3465         [JSC] remove unneeded asyncFunctionTests.yaml
3466         https://bugs.webkit.org/show_bug.cgi?id=171611
3467
3468         Reviewed by Yusuke Suzuki.
3469
3470         Async functions have shipped, and those tests are run as part of
3471         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
3472
3473         * asyncFunctionTests.yaml: Removed.
3474         * stress/async-await-long-loop.js:
3475         * stress/async-await-throw-loop.js:
3476
3477 2017-05-03  Keith Miller  <keith_miller@apple.com>
3478
3479         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
3480         https://bugs.webkit.org/show_bug.cgi?id=47825
3481
3482         Reviewed by Saam Barati.
3483
3484         * stress/sorting-boolean-result-comparator.js: Added.
3485         (checkArray):
3486
3487 2017-05-02  David Kilzer  <ddkilzer@apple.com>
3488
3489         check-webkit-style should keep JavaScript test functions in sync
3490         <https://webkit.org/b/171424>
3491
3492         Reviewed by Joseph Pecoraro.
3493
3494         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
3495         and shouldThrow() in sync with other copies of these methods.
3496
3497         * stress/resources/standalone-pre.js:
3498         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
3499         variables with underscore.
3500         (shouldThrow): Fix whitespace.
3501
3502 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3503
3504         We initialize functions too early in an eval
3505         https://bugs.webkit.org/show_bug.cgi?id=161099
3506
3507         Reviewed by Saam Barati.
3508
3509         * stress/eval-func-decl-with-let-const-class.js: Added.
3510
3511 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3512
3513         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3514         https://bugs.webkit.org/show_bug.cgi?id=163208
3515
3516         Reviewed by Saam Barati.
3517
3518         * stress/eval-func-decl-block-scoping-reassign.js: Added.
3519         (assert):
3520         (throw.new.Error.f):
3521         (throw.new.Error):
3522         * stress/eval-func-decl-block-with-remove.js: Added.
3523         (assert):
3524         (foo.boo):
3525         (foo):
3526         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3527         (assert):
3528         (assertThrow):
3529         (foo):
3530         (boo):
3531         (joo):
3532         (koo):
3533         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3534         (assert):
3535         (assertThrow):
3536         (foo):
3537         (boo):
3538         (hoo):
3539         (joo):
3540         (koo):
3541         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3542         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3543         (assert):
3544         (assertThrow):
3545         (foo):
3546         (boo):
3547         (goo):
3548         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3549         (assert):
3550         (assertThrow):
3551         (foo):
3552         (boo):
3553         (boo.let.val2):
3554         (boo.let.val3):
3555         * stress/eval-func-decl-in-frozen-global.js: Added.
3556         (assert):
3557         (assertThrow):
3558         (throw.new.Error):
3559         (Object.freeze):
3560         * stress/eval-func-decl-in-global-of-eval.js: Added.
3561         (assert):
3562         (assertThrow):
3563         (bar):
3564         (baz):
3565         (foobar):
3566         * stress/eval-func-decl-in-global.js: Added.
3567         (assert):
3568         (assertThrow):
3569         * stress/eval-func-decl-in-if.js: Added.
3570         (assert):
3571         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3572         (assert):
3573         (assertThrow):
3574         (foo):
3575         (boo):
3576         (foobar):
3577         (hoo):
3578         (joo):
3579         (koo):
3580         (loo):
3581         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3582         (assert):
3583         (assertThrow):
3584         (foo):
3585         (boo):
3586         (goo):
3587         * stress/variable-under-tdz-eval-tricky.js:
3588         (assert):
3589         * test262.yaml:
3590
3591 2017-04-27  Mark Lam  <mark.lam@apple.com>
3592
3593         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
3594         https://bugs.webkit.org/show_bug.cgi?id=171404
3595         <rdar://problem/31876178>
3596
3597         Reviewed by Saam Barati.
3598
3599         * stress/js-fixed-array-out-of-memory.js: Added.
3600
3601 2017-04-27  David Kilzer  <ddkilzer@apple.com>
3602
3603         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
3604         <https://webkit.org/b/171362>
3605         <rdar://problem/31867686>
3606
3607         Reviewed by Joseph Pecoraro.
3608
3609         * stress/resources/standalone-pre.js:
3610         (shouldBe):
3611         (shouldNotThrow):
3612         (shouldThrow):
3613         - Update shouldBe() to accept anonymous function arguments.
3614           (The shouldNotBe() function was never copied over.)
3615         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
3616           function arguments (which were missed in r202609 for Bug
3617           159232).
3618
3619 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3620
3621         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
3622         https://bugs.webkit.org/show_bug.cgi?id=171262
3623
3624         Reviewed by Saam Barati.
3625
3626         * stress/spread-outer-create-rest.js: Added.
3627         (assert):
3628         (foo):
3629         (bar):
3630         (baz):
3631
3632 2017-04-26  Saam Barati  <sbarati@apple.com>
3633
3634         Print Wasm function index in stack trace
3635         https://bugs.webkit.org/show_bug.cgi?id=171349
3636
3637         Reviewed by JF Bastien.
3638
3639         * wasm/function-tests/stack-trace.js: Added.
3640         (import.Builder.from.string_appeared_here.assert):
3641         (let.imp):
3642         * wasm/function-tests/trap-after-cross-instance-call.js:
3643         (wasmFrameCountFromError):
3644         * wasm/function-tests/trap-load-2.js:
3645         (wasmFrameCountFromError):
3646         * wasm/function-tests/trap-load.js:
3647         (wasmFrameCountFromError):
3648
3649 2017-04-26  Saam Barati  <sbarati@apple.com>
3650
3651         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
3652         https://bugs.webkit.org/show_bug.cgi?id=170924
3653         <rdar://problem/31721052>
3654
3655         Reviewed by Mark Lam.
3656
3657         * stress/error-message-for-function-base-not-found.js: Added.
3658         (assert):
3659         (throw.new.Error):
3660         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
3661         (catch):
3662
3663 2017-04-26  Keith Miller  <keith_miller@apple.com>
3664
3665         WebAssembly: Implement tier up
3666         https://bugs.webkit.org/show_bug.cgi?id=170134
3667
3668         Reviewed by Filip Pizlo.
3669
3670         * wasm/function-tests/trap-after-cross-instance-call.js:
3671         * wasm/tier-up/js-to-wasm.js: Added.
3672         (async.test):
3673         * wasm/tier-up/wasm-to-wasm.js: Added.
3674         (async.test):
3675
3676 2017-04-26  Caitlin Potter  <caitp@igalia.com>
3677
3678         [JSC] Object.keys() must discard property names with no PropertyDescriptor
3679         https://bugs.webkit.org/show_bug.cgi?id=171291
3680
3681         Reviewed by Yusuke Suzuki.
3682
3683         * es6/Proxy_ownKeys_duplicates.js:
3684         * stress/proxy-own-keys.js:
3685         (let.handler.getOwnPropertyDescriptor):
3686         (let.handler.ownKeys):
3687
3688 2017-04-25  Commit Queue  <commit-queue@webkit.org>
3689
3690         Unreviewed, rolling out r215476.
3691         https://bugs.webkit.org/show_bug.cgi?id=171304
3692
3693         "It broke JSBench" (Requested by saamyjoon on #webkit).
3694
3695         Reverted changeset:
3696
3697         "[ES6]. Implement Annex B.3.3 function hoisting rules for
3698         eval"
3699         https://bugs.webkit.org/show_bug.cgi?id=163208
3700         http://trac.webkit.org/changeset/215476
3701
3702 2017-04-25  Saam Barati  <sbarati@apple.com>
3703
3704         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
3705         https://bugs.webkit.org/show_bug.cgi?id=171150
3706         <rdar://problem/31771880>
3707
3708         Reviewed by Sam Weinig.
3709
3710         * stress/spread-optimized-properly.js: Added.
3711         (assert):
3712         (test):
3713         (shallowEq):
3714         (makeArrayIterator):
3715         (test.bar):
3716         (test.callback):
3717         (test.arr.__proto__.Symbol.iterator):
3718         (test.arr.Symbol.iterator):
3719         (test.get bar):
3720         (test.hackedNext):
3721         (test.test):
3722         (test.):
3723
3724 2017-04-25  Mark Lam  <mark.lam@apple.com>
3725
3726         [Follow up] Array.prototype.slice() should ensure that end >= begin.
3727         https://bugs.webkit.org/show_bug.cgi?id=170989
3728         <rdar://problem/31705652>
3729
3730         Not reviewed.
3731
3732         Follow up to rename a test file that was accidentally named wrongly.
3733
3734         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
3735         * stress/regress-170989.patch: Removed.
3736
3737 2017-04-25  Mark Lam  <mark.lam@apple.com>
3738
3739         Array.prototype.slice() should ensure that end >= begin.
3740         https://bugs.webkit.org/show_bug.cgi?id=170989
3741         <rdar://problem/31705652>
3742
3743         Reviewed by Saam Barati.
3744
3745         * stress/regress-170989.patch: Added.
3746
3747 2017-04-25  Mark Lam  <mark.lam@apple.com>
3748
3749         Local CSE wrongly CSEs array accesses with different result types.
3750         https://bugs.webkit.org/show_bug.cgi?id=170990
3751         <rdar://problem/31705945>
3752
3753         Reviewed by Saam Barati.
3754
3755         * stress/regress-170990.js: Added.
3756
3757 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3758
3759         WebAssembly: exporting a property with a name that's a number doesn't work
3760         https://bugs.webkit.org/show_bug.cgi?id=168857
3761
3762         Reviewed by JF Bastien.
3763
3764         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
3765
3766         * wasm/js-api/test_Instance.js:
3767         (ExportedNumber):
3768
3769 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3770
3771         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
3772         https://bugs.webkit.org/show_bug.cgi?id=171190
3773
3774         Reviewed by Saam Barati.
3775
3776         * stress/async-await-syntax.js:
3777         * test262.yaml:
3778
3779 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3780
3781         [JSC] Use JSFixedArray directly when using call_varargs
3782         https://bugs.webkit.org/show_bug.cgi?id=171057
3783
3784         Reviewed by Saam Barati.
3785
3786         * stress/spread-capture-rest.js: Added.
3787         (shouldBe):
3788         (capture):
3789         (a):
3790         (b):
3791         * stress/spread-multi-layers.js: Added.
3792         (shouldBe):
3793         (a):
3794         (b):
3795         (c):
3796         (d):
3797         * stress/spread-non-varargs.js: Added.
3798         (shouldBe):
3799         (a):
3800         (b):
3801
3802 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3803
3804         test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
3805         https://bugs.webkit.org/show_bug.cgi?id=170897
3806
3807         Reviewed by Saam Barati.
3808
3809         * test262.yaml:
3810
3811 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3812
3813         Address some FIXMEs in JavaScript tests for bugs that have been fixed
3814         https://bugs.webkit.org/show_bug.cgi?id=171191
3815
3816         Reviewed by JF Bastien.
3817
3818         * stress/proxy-is-extensible.js:
3819
3820 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3821
3822         test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
3823         https://bugs.webkit.org/show_bug.cgi?id=171160
3824
3825         Reviewed by JF Bastien.
3826
3827         * stress/inferred-names.js:
3828         * test262.yaml:
3829
3830 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3831
3832         test262: test262/test/language/expressions/generators/yield-as-label.js
3833         https://bugs.webkit.org/show_bug.cgi?id=170979
3834
3835         Reviewed by Saam Barati.
3836
3837         * stress/async-await-module-reserved-word.js:
3838         * stress/async-await-reserved-word.js:
3839         Converge on "Cannot" instead of "Can't".
3840
3841         * catch-parameter-syntax.js:
3842         * yield-named-variable-generator.js:
3843         * yield-named-variable.js:
3844         * stress/yield-label-generator.js:
3845         * stress/yield-label.js:
3846         * stress/yield-reserved-word.js: Added.
3847         More complete list of when 'yield' is allowed.
3848
3849         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3850         * test262.yaml:
3851
3852 2017-04-23  Commit Queue  <commit-queue@webkit.org>
3853
3854         Unreviewed, rolling out r215674.
3855         https://bugs.webkit.org/show_bug.cgi?id=171212
3856
3857         Possible unintended commit. This patch was on the wrong bug.
3858         (Requested by JoePeck on #webkit).
3859
3860         Reverted changeset:
3861
3862         "test262: test262/test/language/expressions/generators/yield-
3863         as-label.js"
3864         https://bugs.webkit.org/show_bug.cgi?id=170979
3865         http://trac.webkit.org/changeset/215674
3866
3867 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3868
3869         test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
3870         https://bugs.webkit.org/show_bug.cgi?id=171197
3871
3872         Reviewed by Saam Barati.
3873
3874         * test262.yaml:
3875
3876 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3877
3878         test262: test262/test/language/expressions/generators/yield-as-label.js
3879         https://bugs.webkit.org/show_bug.cgi?id=170979
3880
3881         Reviewed by Saam Barati.
3882
3883         * stress/async-await-module-reserved-word.js:
3884         * stress/async-await-reserved-word.js:
3885         Converge on "Cannot" instead of "Can't".
3886
3887         * catch-parameter-syntax.js:
3888         * yield-named-variable-generator.js:
3889         * yield-named-variable.js:
3890         * stress/yield-label-generator.js:
3891         * stress/yield-label.js:
3892         * stress/yield-reserved-word.js: Added.
3893         More complete list of when 'yield' is allowed.
3894
3895         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3896         * test262.yaml:
3897
3898 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3899
3900         test262: test262/test/built-ins/Number/parseFloat.js
3901         https://bugs.webkit.org/show_bug.cgi?id=171193
3902
3903         Reviewed by Yusuke Suzuki.
3904
3905         * test262.yaml:
3906
3907 2017-04-22  JF Bastien  <jfbastien@apple.com>
3908
3909         WebAssembly: Module.exports, Module.imports, Module.customSections are wrong
3910         https://bugs.webkit.org/show_bug.cgi?id=171078
3911
3912         Reviewed by Saam Barati.
3913
3914         They're static properties of Module, not instance properties of a module.
3915         https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymoduleexports
3916
3917         * wasm/js-api/Module.customSection.js:
3918         (assert.throws.WebAssembly.Module.customSections):
3919         (assert.eq):
3920         (assert.throws.WebAssembly.Module.prototype.customSections): Deleted.
3921         * wasm/js-api/Module.exports.js:
3922         (assert.throws.WebAssembly.Module.exports):
3923         (assert.truthy):
3924         (assert.throws.WebAssembly.Module.prototype.exports): Deleted.
3925         * wasm/js-api/Module.imports.js:
3926         (assert.throws.WebAssembly.Module.imports):
3927         (assert.truthy):
3928         (assert.throws.WebAssembly.Module.prototype.imports): Deleted.
3929
3930 2017-04-21  JF Bastien  <jfbastien@apple.com>
3931
3932         Silence noisy test
3933
3934         Unreviewed, Fil / Michael and I talked about it in the corridor. I
3935         just forgot to set verbose to false before commit.
3936
3937         * wasm/stress/oom.js:
3938
3939 2017-04-20  Yusuke Suzuki  <utatane.tea@gmail.com>
3940
3941         [JSC][FTL] FTL should support Arrayify
3942         https://bugs.webkit.org/show_bug.cgi?id=169596
3943
3944         Reviewed by Saam Barati.
3945
3946         * stress/arrayify.js: Added.
3947         (arrayifyInt32):
3948         (arrayifyDouble):
3949         (arrayifyContiguous):
3950
3951 2017-04-20  Mark Lam  <mark.lam@apple.com>
3952
3953         virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
3954         https://bugs.webkit.org/show_bug.cgi?id=171079
3955         <rdar://problem/31684756>
3956
3957         Reviewed by Saam Barati.
3958
3959         * stress/regress-171079.js: Added.
3960
3961 2017-04-15  Filip Pizlo  <fpizlo@apple.com>
3962
3963         Optimize SharedArrayBuffer in the DFG+FTL
3964         https://bugs.webkit.org/show_bug.cgi?id=164108
3965
3966         Reviewed by Saam Barati.
3967         
3968         Added a fairly comprehensive test of the intrinsics. This creates a function for each possible
3969         combination of type and operation, and then first uses it nicely and then tries a bunch of
3970         erroneous conditions like OOB.
3971
3972         * stress/SharedArrayBuffer-opt.js: Added.
3973         (string_appeared_here.switch):
3974         (string_appeared_here.str):
3975         (runAtomic):
3976         (shouldFail):
3977         (Symbol):
3978         (string_appeared_here.a.of.arrays.m.of.atomics):
3979         * stress/SharedArrayBuffer.js:
3980
3981 2017-04-19  Mark Lam  <mark.lam@apple.com>
3982
3983         B3StackmapSpecial should handle when stackmap values are not recoverable from a Def'ed arg.
3984         https://bugs.webkit.org/show_bug.cgi?id=170973
3985         <rdar://problem/30318657>
3986
3987         Reviewed by Filip Pizlo.
3988
3989         * stress/regress-170973.js: Added.
3990
3991 2017-04-19  JF Bastien  <jfbastien@apple.com>
3992
3993         WebAssembly: limit slow memories
3994         https://bugs.webkit.org/show_bug.cgi?id=170825
3995
3996         Reviewed by Saam Barati.
3997
3998         * wasm.yaml:
3999         * wasm/stress/oom.js: Added.
4000         (try.true.WebAssemblyMemoryMode):
4001         (catch):
4002
4003 2017-04-19  JF Bastien  <jfbastien@apple.com>
4004
4005         WebAssembly: don't expose any WebAssembly JS object if JIT is off
4006         https://bugs.webkit.org/show_bug.cgi?id=170782
4007
4008         Reviewed by Saam Barati.
4009
4010         * wasm.yaml:
4011         * wasm/noJIT/noJIT.js: Added.
4012
4013 2017-04-18  Mark Lam  <mark.lam@apple.com>
4014
4015         r211670 broke double to int conversion.
4016         https://bugs.webkit.org/show_bug.cgi?id=170961
4017         <rdar://problem/31687696>
4018
4019         Reviewed by Yusuke Suzuki.
4020
4021         * microbenchmarks/double-to-int32.js: Added.
4022         * stress/to-int32-sensible2.js: Added.
4023
4024 2017-04-18  Oleksandr Skachkov  <gskachkov@gmail.com>
4025
4026         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
4027         https://bugs.webkit.org/show_bug.cgi?id=163208
4028
4029         Reviewed by Saam Barati.
4030
4031         * stress/eval-func-decl-block-scoping-reassign.js: Added.
4032         (assert):
4033         (throw.new.Error.f):
4034         (throw.new.Error):
4035         * stress/eval-func-decl-block-with-remove.js: Added.
4036         (assert):
4037         (foo.boo):
4038         (foo):
4039         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
4040         (assert):
4041         (assertThrow):
4042         (foo):
4043         (boo):
4044         (joo):
4045         (koo):
4046         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
4047         (assert):
4048         (assertThrow):
4049         (foo):
4050         (boo):
4051         (hoo):
4052         (joo):
4053         (koo):
4054         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
4055         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
4056         (assert):
4057         (assertThrow):
4058         (foo):
4059         (boo):
4060         (goo):
4061         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
4062         (assert):
4063         (assertThrow):
4064         (foo):
4065         (boo):
4066         (boo.let.val2):
4067         (boo.let.val3):
4068         * stress/eval-func-decl-in-frozen-global.js: Added.
4069         (assert):
4070         (assertThrow):
4071         (throw.new.Error):
4072         (Object.freeze):
4073         * stress/eval-func-decl-in-global-of-eval.js: Added.
4074         (assert):
4075         (assertThrow):
4076         (bar):
4077         (baz):
4078         (foobar):
4079         * stress/eval-func-decl-in-global.js: Added.
4080         (assert):
4081         (assertThrow):
4082         * stress/eval-func-decl-in-if.js: Added.
4083         (assert):
4084         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
4085         (assert):
4086         (assertThrow):
4087         (foo):
4088         (boo):
4089         (foobar):
4090         (hoo):
4091         (joo):
4092         (koo):
4093         (loo):
4094         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
4095         (assert):
4096         (assertThrow):
4097         (foo):
4098         (boo):
4099         (goo):
4100         * stress/variable-under-tdz-eval-tricky.js:
4101         (assert):
4102         * test262.yaml:
4103
4104 2017-04-18  Filip Pizlo  <fpizlo@apple.com>
4105
4106         wasm/function-tests/memory-multiagent times out sometimes
4107         https://bugs.webkit.org/show_bug.cgi?id=170958
4108
4109         Reviewed by Keith Miller.
4110         
4111         Add the ability to skip tests easily. Skip the test.
4112
4113         * wasm.yaml:
4114         * wasm/function-tests/memory-multiagent.js:
4115
4116 2017-04-18  Saam Barati  <sbarati@apple.com>
4117
4118         Follow up to debug build stack overflow in test after r215453
4119
4120         Rubber stamped by Mark Lam.
4121
4122         * stress/call-apply-exponential-bytecode-size.js: Decrease the call
4123         size to prevent stack overflow errors on debug builds.
4124
4125 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
4126
4127         [DFG] Convert ValueAdd(Int32, String) => MakeRope(ToString(Int32), String)
4128         https://bugs.webkit.org/show_bug.cgi?id=170943
4129
4130         Reviewed by Geoffrey Garen.
4131
4132         * microbenchmarks/number-to-string-with-add-empty.js: Added.
4133         (toStringLeft):
4134         (toStringRight):
4135         * microbenchmarks/number-to-string-with-add-in-loop.js: Added.
4136         (toStringLeft):
4137         (toStringRight):
4138         * microbenchmarks/number-to-string-with-add.js: Added.
4139         (toStringLeft):
4140         (toStringRight):
4141         * stress/number-to-string-with-add.js: Added.
4142         (shouldBe):
4143         (toStringRight):
4144         (toStringLeftEmpty):
4145         (toStringRightEmpty):
4146
4147 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
4148
4149         [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
4150         https://bugs.webkit.org/show_bug.cgi?id=170940
4151
4152         Reviewed by Filip Pizlo.
4153
4154         * microbenchmarks/for-of-array.js: Added.
4155         (fn):
4156
4157 2017-04-17  Saam Barati  <sbarati@apple.com>
4158
4159         BytecodeGenerator ".call" and ".apply" is exponential in nesting depth
4160         https://bugs.webkit.org/show_bug.cgi?id=139847
4161         <rdar://problem/19321122>
4162
4163         Reviewed by Oliver Hunt.
4164
4165         * stress/call-apply-exponential-bytecode-size.js: Added.
4166         (assert):
4167         (const.inc):
4168         (const.inc2):
4169         (bar):
4170         (randomApplyOrCall):
4171         (baz):
4172         (jaz):
4173         (haz):
4174         (foo):
4175
4176 2017-04-17  Mark Lam  <mark.lam@apple.com>
4177
4178         JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
4179         https://bugs.webkit.org/show_bug.cgi?id=170896
4180         <rdar://problem/31651319>
4181
4182         Reviewed by JF Bastien and Keith Miller.
4183
4184         * stress/regress-170896.js: Added.
4185
4186 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4187
4188         test262: test262/test/built-ins/Object/prototype/toLocaleString/primitive_this_value.js
4189         https://bugs.webkit.org/show_bug.cgi?id=170882
4190
4191         Reviewed by Saam Barati.
4192
4193         * test262.yaml:
4194
4195 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4196
4197         test262: test262/test/built-ins/isNaN/toprimitive-not-callable-throws.js
4198         https://bugs.webkit.org/show_bug.cgi?id=170888
4199
4200         Reviewed by Saam Barati.
4201
4202         * stress/computed-accessor.js:
4203         * stress/eval-in-arrow-function.js:
4204         * stress/rest-elements.js:
4205         * stress/string-object-define-own-property.js:
4206         Remove unused shouldThrow.
4207
4208         * stress/symbol-toprimitive-errors.js: Added.
4209         Check for ToPrimitive TypeErrors.
4210
4211         * test262.yaml:
4212
4213 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4214
4215         test262: test262/test/language/expressions/tagged-template/template-object.js
4216         https://bugs.webkit.org/show_bug.cgi?id=170878
4217
4218         Reviewed by Saam Barati.
4219
4220         * stress/array-length-not-writable.js: Added.
4221         (assert):
4222         * test262.yaml:
4223
4224 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4225
4226         test262: test262/test/built-ins/Object/getOwnPropertyNames/15.2.3.4-4-44.js
4227         https://bugs.webkit.org/show_bug.cgi?id=170879
4228
4229         Reviewed by Saam Barati.
4230
4231         * ChakraCore/test/es5/enumerable.baseline-jsc:
4232         * test262.yaml:
4233
4234 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
4235
4236         test262: test262/test/built-ins/Date/prototype/Symbol.toPrimitive/name.js
4237         https://bugs.webkit.org/show_bug.cgi?id=170884
4238
4239         Reviewed by Yusuke Suzuki.
4240
4241         * test262.yaml:
4242
4243 2017-04-15  Joseph Pecoraro  <pecoraro@apple.com>
4244
4245         test262: test262/test/language/global-code/new.target-arrow.js
4246         https://bugs.webkit.org/show_bug.cgi?id=170872
4247
4248         Reviewed by Saam Barati.
4249
4250         * stress/async-arrow-functions-lexical-new.target-binding.js:
4251         (shouldThrowAsync): Deleted.
4252         (shouldThrowAsync.async): Deleted.
4253         This code should have thrown a SyntaxError. Instead it was throwing
4254         a ReferenceError for the internal @newTargetLocal variable.
4255
4256         * stress/new-target-syntax-errors.js:
4257         Cover the arrow function in global code cases.
4258
4259         * ChakraCore.yaml:
4260         * ChakraCore/test/es6/globalLambdaNewTargetSyntaxError.baseline-jsc:
4261         We now pass with an expected SyntaxError. Our error message is different.
4262
4263         * test262.yaml:
4264
4265 2017-04-14  Saam Barati  <sbarati@apple.com>
4266
4267         ParseInt intrinsic in DFG backend doesn't properly flush its operands
4268         https://bugs.webkit.org/show_bug.cgi?id=170865
4269
4270         Reviewed by Mark Lam and Geoffrey Garen.
4271
4272         * stress/parse-int-intrinsic-dfg-backend-flush.js: Added.
4273         (assert):
4274         (foo):
4275
4276 2017-04-14  Caitlin Potter  <caitp@igalia.com>
4277
4278         [JSC] use ExpressionErrorClassifier for AwaitExpression operand
4279         https://bugs.webkit.org/show_bug.cgi?id=170844
4280
4281         Reviewed by Saam Barati.
4282
4283         * stress/regress-170732.js: Added.
4284
4285 2017-04-14  Oleksandr Skachkov  <gskachkov@gmail.com>
4286
4287         Safari 10.1 JSON.parse returns incorrect object for numeric keys with decimal values
4288         https://bugs.webkit.org/show_bug.cgi?id=170442
4289
4290         Reviewed by Yusuke Suzuki.
4291
4292         * stress/object-number-properties.js:
4293
4294 2017-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
4295
4296         [JSC] Date.parse should accept wider range of representation
4297         https://bugs.webkit.org/show_bug.cgi?id=170720
4298
4299         Reviewed by Darin Adler.
4300
4301         * stress/date-relaxed.js: Added.
4302         (shouldBe):
4303         (throw.new.Error):
4304
4305 2017-04-13  Mark Lam  <mark.lam@apple.com>
4306
4307         Should use flushDirect() when flushing the scopeRegister due to needsScopeRegister().
4308         https://bugs.webkit.org/show_bug.cgi?id=170661
4309         <rdar://problem/31579046>
4310
4311         Reviewed by Filip Pizlo.
4312
4313         * stress/regress-170661.js: Added.
4314
4315 2017-04-13  JF Bastien  <jfbastien@apple.com>
4316
4317         WebAssembly: manage memory better
4318         https://bugs.webkit.org/show_bug.cgi?id=170628
4319
4320         Reviewed by Keith Miller, Michael Saboff.
4321
4322         * wasm/Builder.js: move a helper out so tests can use it
4323         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
4324         * wasm/WASM.js: add utilities to classify opcodes
4325         (export.opcodes):
4326         (export.const.memoryAccessInfo.op.const.sign):
4327         * wasm/function-tests/memory-access-past-4gib.js: Added. This test
4328         fails before this patch.
4329         (const.op.of.WASM.opcodes):
4330         * wasm/function-tests/memory-many.js: Added. This simple tests
4331         just shouldn't crash. In verbose mode it's useful at determining
4332         if the GC falls behind or not.
4333         * wasm/function-tests/memory-multiagent.js: Added. Emulate postMessage.
4334         (const.startAgents.numAgentsToStart.a.agent.receiveBroadcast):
4335         (const.startAgents.numAgentsToStart.a.write.const.idx.Math.random):
4336         (const.broadcastToAgents):
4337         * wasm/js-api/extension-MemoryMode.js: verbose logging.
4338         (testMemoryNoMax):
4339         (testMemory):
4340         (testInstanceNoMemory):
4341         (testInstanceNoMax):
4342         (testInstance):
4343         * wasm/utilities.js: move a utility here.
4344
4345 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
4346
4347         test262: test262/test/built-ins/NativeErrors/EvalError/proto.js
4348         https://bugs.webkit.org/show_bug.cgi?id=170668
4349
4350         Reviewed by Keith Miller.
4351
4352         * ChakraCore.yaml:
4353         * ChakraCore/test/Lib/error.baseline-jsc: Added.
4354         This test does not match the spec.
4355
4356         * test262.yaml:
4357
4358 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
4359
4360         test262: test262/test/language/literals/regexp/u-dec-esc.js
4361         https://bugs.webkit.org/show_bug.cgi?id=170687
4362
4363         Reviewed by Michael Saboff.
4364
4365         * test262.yaml:
4366
4367 2017-04-11  Michael Saboff  <msaboff@apple.com>
4368
4369         Implement Object.isFrozen() and Object.isSealed() per ECMA spec
4370         https://bugs.webkit.org/show_bug.cgi?id=170753
4371
4372         Reviewed by Mark Lam.
4373
4374         Added JSC baseline and enabled defineIndexProperty test.
4375
4376         Note that JSC differs from Chakra in that a JSC doesn't use indexed
4377         properties placed on the Array prototype when sorting the indexed 
4378         properties of an Object.  This is behavior is considered undefined
4379         in the standard.
4380
4381         * ChakraCore.yaml:
4382         * ChakraCore/test/es5/defineIndexProperty.baseline-jsc: Added.
4383
4384 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
4385
4386         test262: test262/test/annexB/language/comments/multi-line-html-close.js
4387         https://bugs.webkit.org/show_bug.cgi?id=170648
4388
4389         Reviewed by Keith Miller.
4390
4391         * test262.yaml:
4392
4393 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
4394
4395         test262: test262/test/built-ins/Array/S15.4.3_A2.2.js
4396         https://bugs.webkit.org/show_bug.cgi?id=170652
4397
4398         Reviewed by Michael Saboff.
4399
4400         * stress/native-constructors-length.js: Added.
4401         (assertLengthDescriptorAttributes):
4402         Add a quick test for the length properties of all native constructors.
4403
4404         * ChakraCore/test/es5/enumerable.baseline-jsc:
4405         Rebaseline expectations for this test.
4406
4407         * test262.yaml:
4408
4409 2017-04-10  Keith Miller  <keith_miller@apple.com>
4410
4411         WebAssembly: Update spec tests
4412         https://bugs.webkit.org/show_bug.cgi?id=170683
4413
4414         Rubber-stamped by JF Bastien.
4415
4416         * wasm.yaml:
4417         * wasm/spec-tests/br_table.wast.js:
4418         * wasm/spec-tests/conversions.wast.js: Removed.
4419         * wasm/spec-tests/f32_bitwise.wast.js: Added.
4420         * wasm/spec-tests/f32_cmp.wast.js:
4421         * wasm/spec-tests/f64_bitwise.wast.js: Added.
4422         * wasm/spec-tests/f64_cmp.wast.js:
4423         * wasm/spec-tests/i32.wast.js:
4424         * wasm/spec-tests/i64.wast.js:
4425         * wasm/spec-tests/int_exprs.wast.js:
4426         * wasm/spec-tests/memory.wast.js:
4427
4428 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
4429
4430         test262: test262/test/annexB/language/expressions/object/__proto__-fn-name.js
4431         https://bugs.webkit.org/show_bug.cgi?id=170650
4432
4433         Reviewed by Saam Barati.
4434
4435         * stress/inferred-names.js:
4436         * test262.yaml:
4437
4438 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
4439
4440         test262: test262/test/annexB/language/literals/regexp/identity-escape.js
4441         https://bugs.webkit.org/show_bug.cgi?id=170651
4442
4443         Reviewed by Saam Barati.
4444
4445         * test262.yaml:
4446
4447 2017-04-07  Michael Saboff  <msaboff@apple.com>
4448
4449         Fix and enable ChakraCore/test/es6/ES6Function_bugs.js after r215072
4450         https://bugs.webkit.org/show_bug.cgi?id=170580
4451
4452         Reviewed by JF Bastien.
4453
4454         Commented out subtest that expects defineProperty("length") to a getter on a
4455         sealed function shouldn't throw.
4456
4457         * ChakraCore.yaml:
4458         * ChakraCore/test/es6/ES6Function_bugs.js:
4459
4460 2017-04-06  Michael Saboff  <msaboff@apple.com>
4461
4462         Cannot Object.seal() or Object.freeze() global "this"
4463         https://bugs.webkit.org/show_bug.cgi?id=170549
4464
4465         Reviewed by Mark Lam.
4466
4467         Enabled failing tests fixed by the corresponding code change:
4468             ChakraCore/test/LetConst/delete.js
4469             ChakraCore/test/LetConst/dop.js
4470             ChakraCore/test/LetConst/dop1.js
4471
4472         * ChakraCore.yaml:
4473         * ChakraCore/test/LetConst/dop.baseline-jsc: Added JSC specific expected output.
4474         * ChakraCore/test/LetConst/dop1.baseline-jsc: Added JSC specific expected output.
4475
4476 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
4477
4478         test262: ES2017 test progressions need updated expectations (arguments.caller removed)
4479         https://bugs.webkit.org/show_bug.cgi?id=170536
4480
4481         Reviewed by Mark Lam.
4482
4483         * test262.yaml:
4484         After r208867 the tests are out of date and are now expected to fail.
4485
4486 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
4487
4488         test262: Final rebaseline of existing tests, a few tests have started failing
4489         https://bugs.webkit.org/show_bug.cgi?id=170538
4490
4491         Reviewed by Mark Lam.
4492
4493         * test262.yaml:</