JSTests:
[WebKit-https.git] / JSTests / ChangeLog
1 2017-08-15  Robin Morisset  <rmorisset@apple.com>
2
3         Support the 'with' keyword in FTL.
4         https://bugs.webkit.org/show_bug.cgi?id=175585
5
6         Reviewed by Saam Barati.
7
8         Also improve the JSTest/stress/with.js file to test
9         what happens when non-objects are passed to with.
10
11         * stress/with.js:
12         (foo):
13         (i.catch):
14         (i.with): Deleted.
15
16 2017-08-14  Keith Miller  <keith_miller@apple.com>
17
18         Add testing tool to lie to the DFG about profiles
19         https://bugs.webkit.org/show_bug.cgi?id=175487
20
21         Reviewed by Saam Barati.
22
23         * stress/compare-eq-incomplete-profile.js: Added.
24         (const.test.createBuiltin):
25
26 2017-08-14  Robin Morisset  <rmorisset@apple.com>
27
28         Support the with keyword in DFG
29         https://bugs.webkit.org/show_bug.cgi?id=175470
30
31         Reviewed by Saam Barati.
32
33         Added a new stress-test for the 'with' keyword, that caught a bug in a
34         previous version of this code.
35
36         * stress/with.js: Added.
37         (i.with):
38
39 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
40
41         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
42         https://bugs.webkit.org/show_bug.cgi?id=175544
43
44         Unreviewed test gardening.
45
46         * ChakraCore.yaml:
47
48 2017-08-09  Caitlin Potter  <caitp@igalia.com>
49
50         Early error on ANY operator before new.target
51         https://bugs.webkit.org/show_bug.cgi?id=157970
52
53         Reviewed by Saam Barati.
54
55         Instead of throwing if any unary operator precedes new.target, only
56         throw if the unary operator updates the reference.
57
58         The following become legal in JSC:
59
60         ```
61         !new.target
62         ~new.target
63         typeof new.target
64         delete new.target
65         void new.target
66         ```
67
68         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
69
70         * stress/new-target-syntax-errors.js:
71         * stress/new-target.js:
72
73 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
74
75         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
76         https://bugs.webkit.org/show_bug.cgi?id=175255
77
78         Unreviewed test gardening.
79
80         * stress/regress-169783.js:
81         * wasm/stress/oom.js:
82
83 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
84
85         REGRESSION: 2 test262/test/language/statements/async-function failures
86         https://bugs.webkit.org/show_bug.cgi?id=175334
87
88         Reviewed by Yusuke Suzuki.
89
90         Add @skip parameters to tests, and remove test for async iterator from 
91         async await syntax test because it is already covered by async-iterator-syntax.js
92
93         * stress/async-await-syntax.js:
94         * stress/async-iteration-syntax.js:
95
96 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
97
98         Unreviewed, gardening test262 for Promise resolve / reject function length
99         https://bugs.webkit.org/show_bug.cgi?id=175333
100
101         * test262.yaml:
102
103 2017-08-07  Robin Morisset  <rmorisset@apple.com>
104
105         GetOwnProperty of TypedArray indexed fields is wrongly configurable
106         https://bugs.webkit.org/show_bug.cgi?id=175307
107
108         Reviewed by Saam Barati.
109
110         * stress/typedarray-getownproperty-not-configurable.js: Added.
111         (assert):
112         (foo):
113
114 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
115
116         Promise resolve and reject function should have length = 1
117         https://bugs.webkit.org/show_bug.cgi?id=175242
118
119         Reviewed by Saam Barati.
120
121         * stress/builtin-function-length.js: Added.
122         (shouldBe):
123         (shouldThrow):
124         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
125         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
126
127 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
128
129         [ESNext] Async iteration - Implement Async Generator - parser
130         https://bugs.webkit.org/show_bug.cgi?id=175210
131
132         Reviewed by Yusuke Suzuki.
133
134         * stress/async-await-syntax.js:
135         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
136         * stress/async-iteration-syntax.js: Added.
137         (assert):
138         (checkSyntax):
139         (checkSyntaxError):
140         (checkSimpleAsyncGeneratorSloppyMode):
141         (checkSimpleAsyncGeneratorStrictMode):
142         (checkNestedAsyncGenerators):
143         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
144         * stress/generator-class-methods-syntax.js:
145
146 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
147
148         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
149         https://bugs.webkit.org/show_bug.cgi?id=175150
150
151         Unreviewed test gardening.
152
153         * wasm/js-api/test_memory_constructor.js:
154
155 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
156
157         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
158         https://bugs.webkit.org/show_bug.cgi?id=175100
159
160         Reviewed by Mark Lam.
161
162         The JSC test JSTests/wasm/stress/oom.js tries to use all the
163         available memory until an out of memory exception happens.
164
165         The Linux kernel is more tuned for server workloads than for GUI
166         responsiveness. When a process tries to use a lot of memory, Linux
167         will do its best to serve the request. This usually translates to
168         free physical RAM by writing to disk dirty pages and/or moving out
169         less recently used pages to swap (disk storage).
170         Meanwhile it does this, the system will become unresponsive and this
171         leads to freezes that can last even some minutes on the worst cases.
172
173         Therefore, let's skip this test on Linux as it will cause more harm
174         than good on the Linux bots or on the machines of Linux developers.
175
176         * wasm/stress/oom.js:
177
178 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
179
180         [JSC] Remove unnecessary print from stress\promise-finally.js test
181         https://bugs.webkit.org/show_bug.cgi?id=175015
182
183         Reviewed by Yusuke Suzuki.
184
185         * stress/promise-finally.js:
186         (p.finally):
187         (then):
188
189 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
190
191         Unreviewed, update test262 results for optional catch binding
192
193         * test262.yaml:
194
195 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
196
197         [JSC] Support optional catch binding
198         https://bugs.webkit.org/show_bug.cgi?id=174981
199
200         Reviewed by Saam Barati.
201
202         * stress/optional-catch-binding-syntax.js: Added.
203         (testSyntax):
204         (testSyntaxError):
205         (catch.catch):
206         * stress/optional-catch-binding.js: Added.
207         (shouldBe):
208         (throwException):
209
210 2017-07-28  Mark Lam  <mark.lam@apple.com>
211
212         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
213         https://bugs.webkit.org/show_bug.cgi?id=174948
214         <rdar://problem/33495680>
215
216         Reviewed by Filip Pizlo.
217
218         * stress/regress-174948.js: Added.
219
220 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
221
222         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
223         https://bugs.webkit.org/show_bug.cgi?id=174900
224
225         Reviewed by Saam Barati.
226
227         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
228         (sideEffect):
229         (args):
230         (test):
231
232 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
233
234         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
235         https://bugs.webkit.org/show_bug.cgi?id=171637
236
237         Reviewed by Darin Adler.
238
239         * stress/domjit-getter-complex-with-incorrect-object.js:
240         (i.shouldThrow):
241         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
242         (shouldBe):
243         (i.shouldThrow):
244
245 2017-07-26  JF Bastien  <jfbastien@apple.com>
246
247         WebAssembly: test throwing out of the start function
248         https://bugs.webkit.org/show_bug.cgi?id=165714
249         <rdar://problem/29760251>
250
251         Reviewed by Keith Miller.
252
253         * wasm/assert.js:
254         * wasm/function-tests/trap-from-start.js: Added.
255         (StartTraps):
256         * wasm/function-tests/trap-from-start-async.js: Added.
257         (async.StartTrapsAsync):
258
259 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
260
261         [FTL] Arguments elimination is suppressed by unreachable blocks
262         https://bugs.webkit.org/show_bug.cgi?id=174352
263
264         Reviewed by Filip Pizlo.
265
266         * stress/arguments-elimination-force-exit.js: Added.
267         (shouldBe):
268         (strict):
269         (sloppy):
270         * stress/arguments-elimination-throw.js: Added.
271         (shouldBe):
272         (shouldThrow):
273         (sloppy):
274         (isArguments):
275
276 2017-07-13  Mark Lam  <mark.lam@apple.com>
277
278         Add some additional test cases for bug 170896.
279         https://bugs.webkit.org/show_bug.cgi?id=174491
280
281         Reviewed by Filip Pizlo.
282
283         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
284         * stress/regress-170896-with-double-shape-profile.js: Added.
285         (test):
286         * stress/regress-170896-with-int32-shape-profile.js: Added.
287         (test):
288         * stress/regress-170896.js: Removed.
289
290 2017-07-13  Saam Barati  <sbarati@apple.com>
291
292         Missing exception check in JSObject::hasInstance
293         https://bugs.webkit.org/show_bug.cgi?id=174455
294         <rdar://problem/31384608>
295
296         Reviewed by Mark Lam.
297
298         * stress/has-instance-exception-check.js: Added.
299         (assert):
300         (let.getter.Object.getOwnPropertyDescriptor.get foo):
301
302 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
303
304         [ESnext] Implement Object Spread
305         https://bugs.webkit.org/show_bug.cgi?id=167963
306
307         Reviewed by Saam Barati.
308
309         * stress/obj-rest-destructuring-order.js: Added.
310         (assert):
311         (o.get z):
312         (o.get a):
313         * stress/obj-spread-order.js: Added.
314         (assert):
315         (o.get z):
316         (o.get a):
317         * stress/object-spread.js: Added.
318         (let.assert):
319         (assert.sameValue):
320         (let.o.get a):
321         (let.obj.get c):
322         (cthulhu.get x):
323         (let.obj.set c):
324         (calls.o.get z):
325         (calls.o.get a):
326         (try.let.obj.get foo):
327         (get calls):
328
329 2017-07-12  Saam Barati  <sbarati@apple.com>
330
331         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
332         https://bugs.webkit.org/show_bug.cgi?id=174411
333         <rdar://problem/31696186>
334
335         Reviewed by Mark Lam.
336
337         * stress/generic-arguments-correct-delete-behavior.js: Added.
338         (assert):
339         (makeTest):
340
341 2017-07-07  Mark Lam  <mark.lam@apple.com>
342
343         \n\r is not the same as \r\n.
344         https://bugs.webkit.org/show_bug.cgi?id=173053
345
346         Reviewed by Keith Miller.
347
348         * stress/regress-173053.js: Added.
349         * stress/template-literal-line-terminators.js:
350
351 2017-07-06  Saam Barati  <sbarati@apple.com>
352
353         We are missing places where we invalidate the for-in context
354         https://bugs.webkit.org/show_bug.cgi?id=174184
355
356         Reviewed by Geoffrey Garen.
357
358         * stress/for-in-invalidate-context-weird-assignments.js: Added.
359         (assert):
360         (test):
361
362 2017-07-05  Saam Barati  <sbarati@apple.com>
363
364         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
365         https://bugs.webkit.org/show_bug.cgi?id=174188
366         <rdar://problem/30581423>
367
368         Reviewed by Mark Lam.
369
370         * stress/new-array-having-a-bad-time-double.js: Added.
371         (assert):
372         (foo):
373
374 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
375
376         WTF::StringImpl::copyChars segfaults when built with GCC 7
377         https://bugs.webkit.org/show_bug.cgi?id=173407
378
379         Reviewed by Andreas Kling.
380
381         * stress/string-repeat-copy-chars-crash.js: Added.
382         (shouldBe):
383
384 2017-07-03  Saam Barati  <sbarati@apple.com>
385
386         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
387
388         * stress/unshiftCountSlowCase-correct-postCapacity.js:
389
390 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
391
392         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
393
394         It requires too much memory.
395
396         * stress/dont-reserve-huge-capacity-lexer.js:
397
398 2017-06-30  Michael Saboff  <msaboff@apple.com>
399
400         Skip a test on ARM64 platform since we run out of address space.
401
402         Rubber stamped by Saam Barati.
403
404         * stress/dont-reserve-huge-capacity-lexer.js:
405
406 2017-06-30  Michael Saboff  <msaboff@apple.com>
407
408         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
409         https://bugs.webkit.org/show_bug.cgi?id=174044
410
411         Reviewed by Oliver Hunt.
412
413         New regression test.
414
415         * stress/regress-174044.js: Added.
416         (test1):
417         (test2):
418
419 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
420
421         RegExpCachedResult::setInput should reify left and right contexts
422         https://bugs.webkit.org/show_bug.cgi?id=173818
423
424         Reviewed by Keith Miller.
425
426         * stress/right-left-context-invalidated-by-input.js: Added.
427         (test.validateContexts):
428         (test):
429
430 2017-06-29  Saam Barati  <sbarati@apple.com>
431
432         Calculating postCapacity in unshiftCountSlowCase is wrong
433         https://bugs.webkit.org/show_bug.cgi?id=173992
434         <rdar://problem/32283199>
435
436         Reviewed by Keith Miller.
437
438         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
439         (temp):
440
441 2017-06-29  Commit Queue  <commit-queue@webkit.org>
442
443         Unreviewed, rolling out r218512.
444         https://bugs.webkit.org/show_bug.cgi?id=173981
445
446         "It changes the behavior of the JS API's JSEvaluateScript
447         which breaks TurboTax" (Requested by saamyjoon on #webkit).
448
449         Reverted changeset:
450
451         "test262: Completion values for control flow do not match the
452         spec"
453         https://bugs.webkit.org/show_bug.cgi?id=171265
454         http://trac.webkit.org/changeset/218512
455
456 2017-06-27  JF Bastien  <jfbastien@apple.com>
457
458         WebAssembly: running out of executable memory should throw OoM
459         https://bugs.webkit.org/show_bug.cgi?id=171537
460         <rdar://problem/32963338>
461
462         Reviewed by Saam Barati.
463
464         * wasm.yaml:
465         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
466         (const.invoke):
467         (failCount.0.catch):
468         (failCount.0.module.undefined.catch):
469         * wasm/lowExecutableMemory/exports-oom.js: Added.
470         (const.type):
471         (const.params):
472         (const.randomProgram):
473         (failCount.0.catch):
474         (failCount.0.module.undefined.catch):
475         * wasm/lowExecutableMemory/imports-oom.js: Added.
476         (const.type):
477         (const.params):
478         (const.randomProgram):
479         (f.imports.push):
480         (failCount.0.catch):
481         (failCount.0.module.undefined.catch):
482
483 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
484
485         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
486         https://bugs.webkit.org/show_bug.cgi?id=167962
487
488         Reviewed by Saam Barati.
489
490         * stress/object-rest-deconstruct.js: Added.
491         (let.assert):
492         (let.assertPropDescriptor):
493         (catch):
494         (get 3):
495         (foo):
496         (let.src.get y):
497         (let.src.set y):
498         (let.gen):
499
500 2017-06-27  Saam Barati  <sbarati@apple.com>
501
502         Function constructor needs to follow the spec and validate parameters and body independently
503         https://bugs.webkit.org/show_bug.cgi?id=173303
504         <rdar://problem/32732526>
505
506         Reviewed by Keith Miller.
507
508         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
509         * stress/function-constructor-semantics.js: Added.
510         (assert):
511         (hasSyntaxError):
512         (foo):
513         (async.foo):
514         (testError):
515         (testOK.toString):
516         (toString):
517
518 2017-06-26  Saam Barati  <sbarati@apple.com>
519
520         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
521         https://bugs.webkit.org/show_bug.cgi?id=173740
522
523         Reviewed by Mark Lam.
524
525         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
526         (Array.prototype.Symbol.iterator):
527
528 2017-06-26  Saam Barati  <sbarati@apple.com>
529
530         Skip a test on 32-bit platforms since we run out of address space.
531
532         Rubber stamped by Mark Lam.
533
534         * stress/dont-reserve-huge-capacity-lexer.js:
535
536 2017-06-26  Saam Barati  <sbarati@apple.com>
537
538         Crash in JSC::Lexer<unsigned char>::setCode
539         https://bugs.webkit.org/show_bug.cgi?id=172754
540
541         Reviewed by Mark Lam.
542
543         * stress/dont-reserve-huge-capacity-lexer.js: Added.
544         (catch):
545
546 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
547
548         [JSC] Clean up Object.entries implementation
549         https://bugs.webkit.org/show_bug.cgi?id=173759
550
551         Reviewed by Sam Weinig.
552
553         * microbenchmarks/object-entries.js: Added.
554         (test):
555
556 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
557
558         Remove Reflect.enumerate
559         https://bugs.webkit.org/show_bug.cgi?id=173806
560
561         Reviewed by Yusuke Suzuki.
562
563         * ChakraCore.yaml:
564         * es6.yaml:
565         These tests now fail because they use Reflect.enumerate.
566
567         * test262.yaml:
568         This test now passes, it checked that Reflect.enumerate is undefined!
569
570         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
571         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
572
573         * stress/reflect-enumerate.js: Removed.
574         Remove a test solely for Reflect.enumerate.
575
576 2017-06-22  Saam Barati  <sbarati@apple.com>
577
578         ValueRep(DoubleRep(@v)) can not simply convert to @v
579         https://bugs.webkit.org/show_bug.cgi?id=173687
580         <rdar://problem/32855563>
581
582         Reviewed by Mark Lam.
583
584         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
585         (i.catch):
586
587 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
588
589         [JSC] Object.values should be implemented in C++
590         https://bugs.webkit.org/show_bug.cgi?id=173703
591
592         Reviewed by Sam Weinig.
593
594         * microbenchmarks/object-keys-map-values.js: Added.
595         (test):
596         * microbenchmarks/object-values.js: Added.
597         (test):
598         * stress/object-values-changing-properties.js: Added.
599         (shouldBe):
600         (throw.new.Error.let.source.get x):
601         (throw.new.Error):
602         (shouldBe.let.handler.get order):
603         (get let):
604         (shouldBe.let.handler.get return):
605         (let.handler.get order):
606
607 2017-06-21  Saam Barati  <sbarati@apple.com>
608
609         eval virtual call is incorrect in the baseline JIT
610         https://bugs.webkit.org/show_bug.cgi?id=173587
611         <rdar://problem/32867897>
612
613         Reviewed by Michael Saboff.
614
615         * stress/do-eval-virtual-call-correctly.js: Added.
616         (assert):
617         (f):
618         (i.test):
619         (catch):
620
621 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
622
623         Update test262 test expectations after r218581.
624
625         Unreviewed test gardening.
626
627         * test262.yaml:
628
629 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
630
631         Revert changes in bug#160417 about extending `null` not being a derived class
632         https://bugs.webkit.org/show_bug.cgi?id=169293
633
634         Reviewed by Saam Barati.
635
636         * stress/class-derived-from-null.js:
637         (assertThrow):
638         (test1):
639         (test2):
640         (test3):
641         (test4):
642         (test5):
643         (test6):
644
645 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
646
647         [DFG] More ArrayIndexOf fixups for various types
648         https://bugs.webkit.org/show_bug.cgi?id=173176
649
650         Reviewed by Saam Barati.
651
652         * stress/array-indexof-arraystorage.js: Added.
653         (shouldBe):
654         (indexOfInt32Other):
655         (indexOfInt32Cell):
656         (indexOfInt32Boolean):
657         (indexOfDoubleOther):
658         (indexOfDoubleCell):
659         (indexOfDoubleBoolean):
660         (indexOfInt32):
661         (indexOfDouble):
662         * stress/array-indexof-constant-folding.js: Added.
663         (shouldBe):
664         (indexOfInt32Other):
665         (indexOfInt32Cell):
666         (indexOfInt32Boolean):
667         (indexOfDoubleOther):
668         (indexOfDoubleCell):
669         (indexOfDoubleBoolean):
670         * stress/array-indexof-hole-and-other.js: Added.
671         (shouldBe):
672         (indexOf):
673         * stress/array-indexof-other.js: Added.
674         (shouldBe):
675         (indexOfInt32):
676         (indexOfDouble):
677         (indexOfString):
678         (indexOfObject):
679         * stress/array-indexof-symbol.js: Added.
680         (shouldBe):
681         (indexOfInt32):
682         (indexOfDouble):
683         (indexOfString):
684         (indexOfObject):
685
686 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
687
688         test262: Completion values for control flow do not match the spec
689         https://bugs.webkit.org/show_bug.cgi?id=171265
690
691         Reviewed by Saam Barati.
692
693         * stress/completion-value.js:
694         Condensed test for completion values in top level statements.
695
696         * stress/super-get-by-id.js:
697         ClassDeclaration when evaled no longer produce values. Convert
698         these to ClassExpressions so they produce the class value.
699         
700         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
701         This is a progression for currect spec behavior.
702
703         * mozilla/mozilla-tests.yaml:
704         This test is now outdated, so mark it as failing for that reason.
705
706         * test262.yaml:
707         Passing all "cptn" completion value tests.
708
709 2017-06-17  Keith Miller  <keith_miller@apple.com>
710
711         ArrayBuffer constructor needs to create subclass structures before its buffer
712         https://bugs.webkit.org/show_bug.cgi?id=173510
713
714         Reviewed by Yusuke Suzuki.
715
716         * test262.yaml:
717
718 2017-06-17  Keith Miller  <keith_miller@apple.com>
719
720         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
721         https://bugs.webkit.org/show_bug.cgi?id=173506
722
723         Reviewed by Ryosuke Niwa.
724
725         Re-baseline tests.
726
727         * ChakraCore/test/Function/apply3.baseline-jsc:
728         * test262.yaml:
729
730 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
731
732         [JSC] Add fast path for Object.assign
733         https://bugs.webkit.org/show_bug.cgi?id=173416
734
735         Reviewed by Mark Lam.
736
737         * stress/object-assign-changing-properties.js: Added.
738         (shouldBe):
739         (throw.new.Error.let.source.get x):
740         (throw.new.Error):
741         (shouldBe.let.source.get x):
742         (shouldBe.let.target.set x):
743         (shouldBe.let.target.get x):
744         * stress/object-assign-proxy.js: Added.
745         (shouldBe):
746         (throw.new.Error.let.handler.get order):
747
748 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
749
750         [JSC] Implement Object.assign in C++
751         https://bugs.webkit.org/show_bug.cgi?id=173414
752
753         Reviewed by Saam Barati.
754
755         * stress/object-assign-string-first.js: Added.
756         (shouldBe):
757         (source.get Symbol):
758         (source.get 1):
759         (source.get cocoa):
760
761 2017-06-14  JF Bastien  <jfbastien@apple.com>
762
763         WebAssembly: remove empty test files
764         https://bugs.webkit.org/show_bug.cgi?id=173382
765
766         Reviewed by Saam Barati.
767
768         The following files:
769                 JSTests/wasm/function-tests/call-indirect-params.js
770                 JSTests/wasm/function-tests/call-indirect.js
771                 JSTests/wasm/js-api/call-indirect-results.js
772         Were changed to empty files in https://trac.webkit.org/changeset/209771
773
774         They were testing call_indirect with the wrong semantics, before
775         we implemented tables. That change implemented tables and
776         therefore removed the erroneous tests.
777
778         We have a few tests for call_indirect which already do the right thing:
779                 JSTests/wasm/function-tests/context-switch.js
780                 JSTests/wasm/function-tests/exceptions.js
781                 JSTests/wasm/function-tests/grow-memory-2.js
782                 JSTests/wasm/function-tests/stack-overflow.js
783                 JSTests/wasm/function-tests/table-basic-2.js
784                 JSTests/wasm/function-tests/table-basic.js
785                 JSTests/wasm/js-api/call-indirect.js
786                 JSTests/wasm/js-api/table.js
787                 JSTests/wasm/js-api/unique-signature.js
788                 JSTests/wasm/js-api/wrapper-function.js
789
790         I also just imported the updated spec tests which, among other
791         things, test call_indirect:
792                 core/br.wast
793                 core/br_table.wast
794                 core/call_indirect.wast
795                 core/func.wast
796                 core/func_ptrs.wast
797                 core/imports.wast
798                 core/left-to-right.wast
799                 core/linking.wast
800                 core/nop.wast
801                 core/return.wast
802                 core/typecheck.wast
803                 core/unreachable.wast
804
805         So I think it's OK to just delete the tests which should just have
806         been deleted back when tables were added.
807
808         * wasm/function-tests/call-indirect-params.js: Removed.
809         * wasm/function-tests/call-indirect.js: Removed.
810         * wasm/js-api/call-indirect-results.js: Removed.
811
812 2017-06-13  JF Bastien  <jfbastien@apple.com>
813
814         WebAssembly: import updated spec tests
815         https://bugs.webkit.org/show_bug.cgi?id=173287
816         <rdar://problem/32725975>
817
818         Reviewed by Saam Barati.
819
820         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
821         with a few modifications so things work.
822
823         Fix a bunch of bugs found through this process, and punt a few tests (which I
824         marked as blocked by this bug).
825
826         Fixes:
827
828         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
829         instead of byte alignment. It was also missing memory-alignment.js despite it
830         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
831         pass.
832
833         Tables can be imported or in a section. There can be only one, but sections can
834         be empty. An Elements section can exist if there's no Table, as long as it is
835         also empty.
836
837         Memories can be imported or in a section. There can be only one, but sections
838         can be empty. A Data section can exist if there's no Memory, as long as it is
839         also empty.
840
841         Prototypes: stringify without .prototype. in the string.
842
843         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
844         not a final size, and throws a RangeError on failure, not a TypeError.
845
846         Fix compile / instantiate so the reject the promise if given an argument of the
847         wrong type (instead of failing instantly).
848
849         Fix async on neuter test.
850
851         Element section shouldn't affect any Table if any of the elements are out of
852         bounds. We need to process it in two passes.
853
854         Segment section shouldn't affect any Data if any of the segments are out of
855         bounds. We need to process it in two passes.
856
857         Empty data segments are valid, but only when there is no memory. Their index
858         still gets validated, and has to be zero.
859
860         Punts:
861
862         Error messages with context, the test seems overly restrictive but this is
863         minor.
864
865         compile/instantiate/validate property descriptors.
866
867         UTF-8 bugs.
868
869         Temporarily disable NaN tests. We need to go back and implement the following
870         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
871         much as getting all the other tests passing.
872
873         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
874         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
875         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
876         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
877         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
878         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
879         why they're not allowed.
880
881         * wasm.yaml:
882         * wasm/function-tests/i32-load8-s.js:
883         * wasm/function-tests/memory-access-past-4gib.js:
884         (const.op.of.WASM.opcodes):
885         * wasm/function-tests/memory-alignment.js: Added.
886         (const.op.of.WASM.opcodes):
887         * wasm/function-tests/memory-section-and-import.js:
888         * wasm/js-api/Module-compile.js:
889         (async.testPromiseAPI):
890         * wasm/js-api/dont-mmap-zero-byte-memory.js:
891         (testMems):
892         * wasm/js-api/element.js:
893         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
894         * wasm/js-api/neutered-inputs.js:
895         (const.testFunction): Deleted.
896         (const.testConstructor): Deleted.
897         * wasm/js-api/table.js:
898         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
899         (new.WebAssembly.Module):
900         (assert.throws):
901         (assertBadTableImport):
902         (assert.throws.WebAssembly.Table.prototype.grow):
903         (assertBadTableInstance): Deleted.
904         * wasm/js-api/test_Data.js:
905         (DataSectionWithoutMemory):
906         * wasm/spec-harness/index.js:
907         (module):
908         (uniqueTest): Deleted.
909         (assert_invalid): Deleted.
910         (assert_soft_invalid): Deleted.
911         (register): Deleted.
912         (call): Deleted.
913         (get instance): Deleted.
914         (exports): Deleted.
915         (run): Deleted.
916         (assert_unlinkable): Deleted.
917         (assert_uninstantiable): Deleted.
918         (assert_trap): Deleted.
919         (try.f): Deleted.
920         (catch): Deleted.
921         (assert_exhaustion): Deleted.
922         (assert_return): Deleted.
923         (assert_return_nan): Deleted.
924         * wasm/spec-harness/testharness.css: Removed.
925         * wasm/spec-harness/testharness.js: Removed.
926         * wasm/spec-harness/testharnessreport.js: Removed.
927         * wasm/spec-harness/wasm-constants.js:
928         (assertTraps):
929         (assertWasmThrows):
930         * wasm/spec-harness/wasm-module-builder.js:
931         (Binary.prototype.emit_section):
932         (Binary):
933         (WasmFunctionBuilder.prototype.addBody):
934         (WasmFunctionBuilder.prototype.end):
935         (WasmFunctionBuilder):
936         (WasmModuleBuilder.prototype.stringToBytes):
937         (WasmModuleBuilder.prototype.addCustomSection):
938         (WasmModuleBuilder.prototype.addFunctionTableInit):
939         (WasmModuleBuilder.prototype.appendToTable):
940         (WasmModuleBuilder.prototype.toArray):
941         (WasmModuleBuilder.prototype.toBuffer):
942         (WasmModuleBuilder.prototype.instantiate):
943         (WasmModuleBuilder):
944         * wasm/spec-tests/address.wast.js:
945         * wasm/spec-tests/align.wast.js: Added.
946         * wasm/spec-tests/binary.wast.js:
947         * wasm/spec-tests/block.wast.js:
948         * wasm/spec-tests/br.wast.js:
949         * wasm/spec-tests/br_if.wast.js:
950         * wasm/spec-tests/br_table.wast.js:
951         * wasm/spec-tests/call.wast.js:
952         * wasm/spec-tests/call_indirect.wast.js:
953         * wasm/spec-tests/comments.wast.js:
954         * wasm/spec-tests/const.wast.js: Added.
955         * wasm/spec-tests/conversions.wast.js: Added.
956         * wasm/spec-tests/custom_section.wast.js:
957         * wasm/spec-tests/exports.wast.js:
958         * wasm/spec-tests/f32.wast.js: Added.
959         * wasm/spec-tests/f64.wast.js: Added.
960         * wasm/spec-tests/fac.wast.js:
961         * wasm/spec-tests/float_exprs.wast.js: Added.
962         * wasm/spec-tests/float_misc.wast.js: Added.
963         * wasm/spec-tests/func.wast.js:
964         * wasm/spec-tests/globals.wast.js:
965         * wasm/spec-tests/if.wast.js:
966         * wasm/spec-tests/imports.wast.js:
967         * wasm/spec-tests/inline-module.wast.js: Added.
968         * wasm/spec-tests/jsapi.js:
969         (testJSAPI.test):
970         (testJSAPI):
971         * wasm/spec-tests/labels.wast.js:
972         * wasm/spec-tests/loop.wast.js:
973         * wasm/spec-tests/memory.wast.js:
974         * wasm/spec-tests/memory_trap.wast.js: Added.
975         * wasm/spec-tests/names.wast.js:
976         * wasm/spec-tests/nop.wast.js:
977         * wasm/spec-tests/return.wast.js:
978         * wasm/spec-tests/stack.wast.js:
979         * wasm/spec-tests/token.wast.js: Added.
980         * wasm/spec-tests/type.wast.js: Added.
981         * wasm/spec-tests/typecheck.wast.js:
982         * wasm/spec-tests/unreachable.wast.js:
983         * wasm/spec-tests/unreached-invalid.wast.js:
984         * wasm/spec-tests/unwind.wast.js:
985         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
986         * wasm/spec-tests/utf8-import-field.wast.js: Added.
987         * wasm/spec-tests/utf8-import-module.wast.js: Added.
988
989 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
990
991         Unreviewed JSC test gardening.
992
993         * stress/check-string-ident.js:
994         * stress/new-largeish-contiguous-array-with-size.js:
995
996 2017-06-13  Michael Saboff  <msaboff@apple.com>
997
998         DFG doesn't properly handle a property that is change to read only in a prototype
999         https://bugs.webkit.org/show_bug.cgi?id=173321
1000
1001         Reviewed by Filip Pizlo.
1002
1003         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
1004         * stress/regress-173321.js: Added new regression test.
1005         (shouldBe):
1006         (SimpleObject):
1007         (test):
1008
1009 2017-06-12  Saam Barati  <sbarati@apple.com>
1010
1011         Update test262 test expectation since r218082 makes new tests pass.
1012
1013         * test262.yaml:
1014
1015 2017-06-12  Saam Barati  <sbarati@apple.com>
1016
1017         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
1018         https://bugs.webkit.org/show_bug.cgi?id=172957
1019         <rdar://problem/32602704>
1020
1021         Reviewed by Filip Pizlo.
1022
1023         * stress/spec-empty-flows-through-cell-checks.js: Added.
1024         (A):
1025         (B):
1026         (i.catch):
1027
1028 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
1029
1030         We incorrectly allow escaped characters in keyword tokens
1031         https://bugs.webkit.org/show_bug.cgi?id=171310
1032
1033         Reviewed by Yusuke Suzuki.
1034
1035         * stress/destructuring-assignment-syntax.js:
1036         * stress/error-messages-for-in-operator-should-not-crash.js:
1037         (catch):
1038         * stress/reserved-word-with-escape.js:
1039         (testSyntaxError.String.raw.v):
1040         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
1041         (testSyntaxError.String.raw.a):
1042         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
1043
1044 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1045
1046         [DFG] Add ArrayIndexOf intrinsic
1047         https://bugs.webkit.org/show_bug.cgi?id=172421
1048
1049         Reviewed by Saam Barati.
1050
1051         * stress/array-indexof-array-prototype-change.js: Added.
1052         (shouldBe):
1053         (indexOfInt32):
1054         * stress/array-indexof-have-a-bad-time-getter.js: Added.
1055         (shouldBe):
1056         (indexOfInt32):
1057         * stress/array-indexof-have-a-bad-time.js: Added.
1058         (shouldBe):
1059         (indexOfInt32):
1060         * stress/array-indexof-hole-with-prototype.js: Added.
1061         (shouldBe):
1062         (indexOf):
1063         * stress/array-indexof-hole.js: Added.
1064         (shouldBe):
1065         (indexOf):
1066         * stress/array-indexof-index.js: Added.
1067         (shouldBe):
1068         (indexOfInt32):
1069         (indexOfDouble):
1070         (indexOfString):
1071         (indexOfObject):
1072         (indexOfValue):
1073         * stress/array-indexof-negative-index.js: Added.
1074         (shouldBe):
1075         (indexOfInt32):
1076         (indexOfDouble):
1077         (indexOfString):
1078         (indexOfObject):
1079         (indexOfValue):
1080         * stress/array-indexof-non-int32-start-index.js: Added.
1081         (shouldBe):
1082         (indexOf):
1083         (object.valueOf):
1084         * stress/array-indexof-object-prototype-change.js: Added.
1085         (shouldBe):
1086         (indexOfInt32):
1087         * stress/array-indexof-object.js: Added.
1088         (shouldBe):
1089         (indexOf):
1090         * stress/array-indexof-original-array.js: Added.
1091         (shouldBe):
1092         (indexOfInt32):
1093         * stress/array-indexof-string.js: Added.
1094         (shouldBe):
1095         (indexOf):
1096         * stress/array-indexof-structure-change-convert.js: Added.
1097         (shouldBe):
1098         (indexOf):
1099         * stress/array-indexof-structure-change.js: Added.
1100         (shouldBe):
1101         (indexOf):
1102         * stress/array-indexof.js: Added.
1103         (shouldBe):
1104         (indexOf):
1105
1106 2017-06-11  Keith Miller  <keith_miller@apple.com>
1107
1108         TypedArray constructor with string shouldn't throw
1109         https://bugs.webkit.org/show_bug.cgi?id=173181
1110
1111         Reviewed by JF Bastien.
1112
1113         We should be coercing primitive arguments to numbers in the various
1114         TypedArray constructors.
1115
1116         * stress/typedarray-constructor.js:
1117
1118 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1119
1120         Unreviewed, update test results part 3
1121         https://bugs.webkit.org/show_bug.cgi?id=173227
1122
1123         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
1124
1125 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1126
1127         Unreviewed, update test results part 2
1128         https://bugs.webkit.org/show_bug.cgi?id=173227
1129
1130         * test262.yaml:
1131
1132 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1133
1134         Unreviewed, update test results
1135         https://bugs.webkit.org/show_bug.cgi?id=173227
1136
1137         * microbenchmarks/string-prototype-search-observable-side-effects.js:
1138         * test262.yaml:
1139
1140 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1141
1142         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
1143         https://bugs.webkit.org/show_bug.cgi?id=173227
1144
1145         Reviewed by Mark Lam.
1146
1147         Update the test.
1148
1149         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
1150
1151 2017-06-08  Keith Miller  <keith_miller@apple.com>
1152
1153         WebAssembly: We should only create wrappers for functions that can be exported
1154         https://bugs.webkit.org/show_bug.cgi?id=173088
1155
1156         Reviewed by Saam Barati.
1157
1158         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
1159         on the old testWasmModuleFunctions api, which has been removed.
1160
1161         * wasm/function-tests/copysign.js: Removed.
1162         * wasm/function-tests/ctz.js: Removed.
1163         * wasm/function-tests/drop.js: Removed.
1164         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
1165         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
1166         * wasm/function-tests/dumb-less-than-ite.js: Removed.
1167         * wasm/function-tests/eqz.js: Removed.
1168         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
1169         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
1170         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
1171         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
1172         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
1173         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
1174         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
1175         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
1176         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
1177         * wasm/function-tests/if-then-fallthrough.js: Removed.
1178         * wasm/function-tests/int-to-floating-point.js: Removed.
1179         * wasm/function-tests/loop-mult.js:
1180         * wasm/function-tests/loop-sum.js:
1181         * wasm/function-tests/max.js: Removed.
1182         * wasm/function-tests/min.js: Removed.
1183         * wasm/function-tests/nearest.js: Removed.
1184         * wasm/function-tests/nop.js: Removed.
1185         * wasm/function-tests/popcnt.js: Removed.
1186         * wasm/function-tests/ret5.js:
1187         * wasm/function-tests/select.js: Removed.
1188         * wasm/function-tests/tee-local.js: Removed.
1189         * wasm/function-tests/trunc.js: Removed.
1190
1191 2017-06-07  JF Bastien  <jfbastien@apple.com>
1192
1193         WebAssembly: test imports and exports with 16-bit characters
1194         https://bugs.webkit.org/show_bug.cgi?id=165977
1195         <rdar://problem/29760130>
1196
1197         Reviewed by Saam Barati.
1198
1199         The output for import failure was improved, so many tests need to
1200         be updated here. Only one has new tests as noted below.
1201
1202         * wasm/function-tests/memory-import-and-grow.js:
1203         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
1204         (idxModule):
1205         * wasm/js-api/global-error.js:
1206         (new.Number):
1207         (assert.throws):
1208         * wasm/js-api/table.js:
1209         (assert.throws):
1210         (new.WebAssembly.Table):
1211         * wasm/js-api/test_memory.js:
1212         (test):
1213         * wasm/js-api/wasm-to-wasm-bad-signature.js:
1214         (BadSignatureDropStartParams.):
1215         (BadSignatureDropStartParams):
1216         (BadSignatureDropEndParams.):
1217         (BadSignatureSwapParam.):
1218         (BadSignatureRet.):
1219         * wasm/js-api/web-assembly-instantiate.js:
1220         (assert.asyncTest.async.test):
1221         (assert.asyncTest):
1222         * wasm/js-api/wrapper-function.js:
1223         (return.new.WebAssembly.Module):
1224
1225 2017-06-07  Mark Lam  <mark.lam@apple.com>
1226
1227         Restrict the regress-173035.js test to only run on Darwin x86-64.
1228         https://bugs.webkit.org/show_bug.cgi?id=173075
1229
1230         Reviewed by Saam Barati.
1231
1232         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
1233         this test will require to succeed.  Here's an example of this failure:
1234         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
1235
1236         Since the issue is due to allocation of a very large amount of memory, the test
1237         will probably fail on iOS and other platforms as well.  Hence, we should just
1238         skip this test for any platforms that is not Darwin x86-64.
1239
1240         * stress/regress-173035.js:
1241
1242 2017-06-07  Mark Lam  <mark.lam@apple.com>
1243
1244         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
1245         https://bugs.webkit.org/show_bug.cgi?id=168587
1246
1247         Not reviewed.
1248
1249         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
1250
1251         * stress/test-finally.js:
1252
1253 2017-06-06  Mark Lam  <mark.lam@apple.com>
1254
1255         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
1256         https://bugs.webkit.org/show_bug.cgi?id=173035
1257         <rdar://problem/32554593>
1258
1259         Reviewed by Geoffrey Garen and Filip Pizlo.
1260
1261         * stress/regress-173035.js: Added.
1262
1263 2017-06-06  Saam Barati  <sbarati@apple.com>
1264
1265         Make sure we restore SP when doing calls that could be to JS
1266         https://bugs.webkit.org/show_bug.cgi?id=172946
1267         <rdar://problem/32579026>
1268
1269         Reviewed by JF Bastien.
1270
1271         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
1272         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
1273         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
1274         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
1275         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
1276
1277 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
1278
1279         Unreviewed rollout r217807. Caused a test to crash.
1280
1281         * heapProfiler/class-names.js: Removed.
1282         * heapProfiler/driver/driver.js:
1283         (CheapHeapSnapshotNode):
1284         (CheapHeapSnapshot):
1285         (createCheapHeapSnapshot):
1286         (HeapSnapshot):
1287         (createHeapSnapshot):
1288         * typeProfiler/inheritance.js:
1289         (wrapper.A):
1290         (wrapper.B):
1291         (wrapper.C):
1292         (wrapper):
1293
1294 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
1295
1296         index out of bound in bytecodebasicblock
1297         https://bugs.webkit.org/show_bug.cgi?id=172963
1298
1299         Reviewed by Saam Barati and Mark Lam.
1300
1301         * stress/dfg-call-class-constructor.js: Added.
1302         (Foo):
1303         (i.catch):
1304
1305 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
1306
1307         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
1308         https://bugs.webkit.org/show_bug.cgi?id=172848
1309         <rdar://problem/25709212>
1310
1311         Reviewed by Saam Barati.
1312
1313         * typeProfiler/inheritance.js:
1314         Rewrite the test slightly for clarity. The hoisting was confusing.
1315
1316         * heapProfiler/class-names.js: Added.
1317         (MyES5Class):
1318         (MyES6Class):
1319         (MyES6Subclass):
1320         Test object types and improved class names.
1321
1322         * heapProfiler/driver/driver.js:
1323         (CheapHeapSnapshotNode):
1324         (CheapHeapSnapshot):
1325         (createCheapHeapSnapshot):
1326         (HeapSnapshot):
1327         (createHeapSnapshot):
1328         Update snapshot parsing from version 1 to version 2.
1329
1330 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1331
1332         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
1333         https://bugs.webkit.org/show_bug.cgi?id=168844
1334
1335         Reviewed by Saam Barati.
1336
1337         * modules/async-function-export.js: Added.
1338         (f):
1339         (export.async.f):
1340
1341 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1342
1343         ES2015 modules - Export default function hoisting
1344         https://bugs.webkit.org/show_bug.cgi?id=170174
1345
1346         Reviewed by Saam Barati.
1347
1348         This issue itself is solved by fixing function declaration hoisting rules.
1349         This patch just adds the specific test to modules tests to ensure the bug
1350         is fixed.
1351
1352         * modules/export-default-function-hoisting.js: Added.
1353         * modules/export-default-function-hoisting/cappuccino.js: Added.
1354         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
1355         * modules/export-default-function-hoisting/cocoa.js: Added.
1356         (export.default.drinkCocoa):
1357
1358 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1359
1360         Class Proxy can't be extended
1361         https://bugs.webkit.org/show_bug.cgi?id=169040
1362
1363         Reviewed by Saam Barati.
1364
1365         Adding tests that check correctness of Proxy to ES6 `class`
1366         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
1367
1368         * stress/proxy-class.js: Added.
1369         (assert):
1370         (throw.new.Error.SuperClass):
1371         (throw.new.Error.A):
1372         (throw.new.Error):
1373
1374 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1375
1376         [JSC] Implement String.prototype.concat in JS builtins
1377         https://bugs.webkit.org/show_bug.cgi?id=172798
1378
1379         Reviewed by Sam Weinig.
1380
1381         * microbenchmarks/string-concat-convert.js: Added.
1382         (test):
1383         * microbenchmarks/string-concat-long-convert.js: Added.
1384         (test):
1385         * microbenchmarks/string-concat-long.js: Added.
1386         (test):
1387         * microbenchmarks/string-concat.js: Added.
1388         (test):
1389
1390 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
1391
1392         Rolling out: Prevent async methods named 'function'
1393         https://bugs.webkit.org/show_bug.cgi?id=172776
1394
1395         Reviewed by Mark Lam.
1396
1397         * stress/async-await-syntax.js:
1398         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1399         (testTopLevelAsyncAwaitSyntaxSloppyMode):
1400         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
1401         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1402         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
1403
1404 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
1405
1406         Skip flaky JSC test stress/test-finally.js
1407         https://bugs.webkit.org/show_bug.cgi?id=168587
1408
1409         Unreviewed test gardening.
1410
1411         * stress/test-finally.js:
1412
1413 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
1414
1415         Prevent async methods named 'function' in Object literal
1416         https://bugs.webkit.org/show_bug.cgi?id=172660
1417
1418         Reviewed by Saam Barati.
1419
1420         * stress/async-await-syntax.js:
1421         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
1422
1423 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
1424
1425         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
1426         https://bugs.webkit.org/show_bug.cgi?id=171274
1427
1428         Reviewed by Saam Barati.
1429
1430         * stress/async-arrow-functions-lexical-binding-in-class.js:
1431         (shouldBeAsync):
1432         (shouldBeAsyncAndStoreBind):
1433         (promise.new.Promise):
1434         (ChildClass4):
1435         (ChildClass4.prototype.classValue):
1436         (ChildClass4.prototype.get classProperty):
1437         * stress/async-arrow-functions-lexical-super-binding.js:
1438         (A):
1439         (const.childA1.new.prototype.var.f.async):
1440         (const.childA1.new.var):
1441         (const.childA1.new):
1442         (const.childA2.new.prototype.var.f.async):
1443         (const.childA2.new.var):
1444         (const.childA2.new):
1445         (const.childA3.new.prototype.var.f.async):
1446         (const.childA3.new.var):
1447         (const.childA3.new):
1448         (try.childA4.new.prototype.var.f.async):
1449         (try.childA4.new.var):
1450         (try.childA4.new):
1451         (catch):
1452         (const.childA5.new.prototype.var.f.async):
1453         (const.childA5.new.var):
1454         (const.childA5.new):
1455         (checkClass):
1456         (checkClass.new.prototype.var.f.async):
1457         (checkClass.new.var):
1458         (checkClass.new):
1459         (checkClass.new.prototype.method):
1460         (checkClass.new.prototype.prop):
1461
1462 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1463
1464         [JSC] Map and Set constructors should have fast path for cloning
1465         https://bugs.webkit.org/show_bug.cgi?id=172413
1466
1467         Reviewed by Saam Barati.
1468
1469         * stress/map-clone-instance-iterator-change.js: Added.
1470         (shouldBe):
1471         (map.Symbol.iterator):
1472         * stress/map-clone-iterator-change.js: Added.
1473         (shouldBe):
1474         (Map.prototype.Symbol.iterator):
1475         * stress/map-clone-next-change.js: Added.
1476         (shouldBe):
1477         (map.Symbol.iterator.__proto__.next):
1478         * stress/map-clone.js: Added.
1479         (shouldBe):
1480         (Map.prototype):
1481         * stress/map-inherit-set.js: Added.
1482         (shouldBe):
1483         (DerivedMap):
1484         (set for):
1485         * stress/set-clone-instance-iterator-change.js: Added.
1486         (shouldBe):
1487         (set Symbol.iterator):
1488         * stress/set-clone-iterator-change.js: Added.
1489         (shouldBe):
1490         (set Set.prototype.Symbol.iterator):
1491         * stress/set-clone-next-change.js: Added.
1492         (shouldBe):
1493         (set Symbol.iterator.__proto__.next):
1494         * stress/set-clone.js: Added.
1495         (shouldBe):
1496         (set Set.prototype.add):
1497         * stress/set-inherit-add.js: Added.
1498         (shouldBe):
1499         (DerivedSet.set add):
1500
1501 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
1502
1503         Unreviewed, rolling out r217458.
1504
1505         This change caused 55 JSC test failures.
1506
1507         Reverted changeset:
1508
1509         "Date should use historical data if it's available."
1510         https://bugs.webkit.org/show_bug.cgi?id=172592
1511         http://trac.webkit.org/changeset/217458
1512
1513 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1514
1515         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
1516         https://bugs.webkit.org/show_bug.cgi?id=167805
1517
1518         Reviewed by Saam Barati.
1519
1520         * modules/module-jit-reachability.js: Added.
1521
1522 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
1523
1524         Prevent async methods named 'function'
1525         https://bugs.webkit.org/show_bug.cgi?id=172598
1526
1527         Reviewed by Mark Lam.
1528
1529         * stress/async-await-syntax.js:
1530         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1531         (testTopLevelAsyncAwaitSyntaxSloppyMode):
1532         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
1533         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1534         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
1535
1536 2017-05-25  Keith Miller  <keith_miller@apple.com>
1537
1538         Date should use historical data if it's available.
1539         https://bugs.webkit.org/show_bug.cgi?id=172592
1540
1541         Reviewed by Mark Lam.
1542
1543         Remove parts of the date tests that rely on the absence of
1544         historical data in Date.
1545
1546         * mozilla/ecma/Date/15.9.5.31-1.js:
1547         (getTestCases):
1548         * mozilla/ecma/Date/15.9.5.35-1.js:
1549         (getTestCases):
1550
1551 2017-05-25  Saam Barati  <sbarati@apple.com>
1552
1553         Our for-in optimization in the bytecode generator does its static analysis incorrectly
1554         https://bugs.webkit.org/show_bug.cgi?id=172532
1555         <rdar://problem/32369452>
1556
1557         Reviewed by Mark Lam.
1558
1559         * stress/for-in-invalidation-for-any-write.js: Added.
1560         (assert):
1561         (test):
1562         (test.i):
1563
1564 2017-05-25  Mark Lam  <mark.lam@apple.com>
1565
1566         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
1567         https://bugs.webkit.org/show_bug.cgi?id=172548
1568         <rdar://problem/31458393>
1569
1570         Reviewed by Filip Pizlo.
1571
1572         * stress/regress-172548.patch: Added.
1573
1574 2017-05-23  Saam Barati  <sbarati@apple.com>
1575
1576         We should not mmap zero bytes for a memory in Wasm
1577         https://bugs.webkit.org/show_bug.cgi?id=172528
1578         <rdar://problem/32257076>
1579
1580         Reviewed by Mark Lam.
1581
1582         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
1583         (testMems):
1584
1585 2017-05-23  Saam Barati  <sbarati@apple.com>
1586
1587         CFGSimplificationPhase should not merge a block with itself
1588         https://bugs.webkit.org/show_bug.cgi?id=172508
1589         <rdar://problem/28424006>
1590
1591         Reviewed by Keith Miller.
1592
1593         * stress/dont-crash-in-cfg-simplification.js: Added.
1594         (bar):
1595         (baz):
1596         (foo):
1597
1598 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1599
1600         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
1601         https://bugs.webkit.org/show_bug.cgi?id=172216
1602
1603         Reviewed by Saam Barati.
1604
1605         * stress/array-storage-get-by-val.js: Added.
1606         (shouldBe):
1607         (testOutOfBound):
1608         (testInBound):
1609         (testSlowPutOutOfBound):
1610         (testSlowPutInBound):
1611
1612 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1613
1614         Unreviewed, fix commented out tests
1615         https://bugs.webkit.org/show_bug.cgi?id=172225
1616
1617         * stress/get-by-val-string.js:
1618         (object.43):
1619         (Hello):
1620         (Hello.prototype.get 42):
1621         (Hello.prototype.43):
1622         (Derived):
1623         (shouldBe):
1624         (throw.new.Error): Deleted.
1625
1626 2017-05-21  Saam Barati  <sbarati@apple.com>
1627
1628         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
1629         https://bugs.webkit.org/show_bug.cgi?id=171041
1630         <rdar://problem/32082516>
1631
1632         Reviewed by Yusuke Suzuki.
1633
1634         * stress/lexical-scoping-for-loop.js: Added.
1635         (assert):
1636         (test1):
1637         (test2):
1638         (test3):
1639         (test4):
1640         (test5):
1641         (test6):
1642         (let.test7):
1643         (let.test8):
1644         (let.test9):
1645         (let.test10):
1646         (let.test11):
1647         (let.test12):
1648
1649 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1650
1651         [JSC] Make get_by_val & string "499" to number 499
1652         https://bugs.webkit.org/show_bug.cgi?id=172225
1653
1654         Reviewed by Saam Barati.
1655
1656         * stress/get-by-val-string.js: Added.
1657         (shouldBe):
1658         (shouldThrow):
1659         (object.43):
1660         (Hello):
1661         (Hello.prototype.get 42):
1662         (Hello.prototype.43):
1663         (Derived):
1664
1665 2017-05-19  Mark Lam  <mark.lam@apple.com>
1666
1667         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
1668         https://bugs.webkit.org/show_bug.cgi?id=172383
1669         <rdar://problem/31418651>
1670
1671         Reviewed by Filip Pizlo.
1672
1673         * stress/regress-172383.js: Added.
1674
1675 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
1676
1677         Unreviewed, rolling out r217156.
1678
1679         This change broke the iOS build.
1680
1681         Reverted changeset:
1682
1683         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
1684         result registers."
1685         https://bugs.webkit.org/show_bug.cgi?id=172383
1686         http://trac.webkit.org/changeset/217156
1687
1688 2017-05-19  Mark Lam  <mark.lam@apple.com>
1689
1690         Add missing exception check.
1691         https://bugs.webkit.org/show_bug.cgi?id=172346
1692         <rdar://problem/32289640>
1693
1694         Reviewed by Geoffrey Garen.
1695
1696         * stress/regress-172346.js: Added.
1697
1698 2017-05-19  Mark Lam  <mark.lam@apple.com>
1699
1700         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
1701         https://bugs.webkit.org/show_bug.cgi?id=172383
1702         <rdar://problem/31418651>
1703
1704         Reviewed by Filip Pizlo.
1705
1706         * stress/regress-172383.js: Added.
1707
1708 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
1709
1710         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
1711         https://bugs.webkit.org/show_bug.cgi?id=172369
1712
1713         Reviewed by Mark Lam.
1714
1715         * stress/undecided-concat.js: Added.
1716
1717 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1718
1719         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
1720         https://bugs.webkit.org/show_bug.cgi?id=172098
1721
1722         Reviewed by Saam Barati.
1723
1724         * stress/check-sub-class.js: Added.
1725         (shouldBe):
1726         (shouldThrow):
1727         (calling):
1728         (array.forEach):
1729         (i.array.forEach):
1730
1731 2017-05-18  JF Bastien  <jfbastien@apple.com>
1732
1733         WebAssembly: exports is a getter
1734         https://bugs.webkit.org/show_bug.cgi?id=172129
1735
1736         Reviewed by Saam Barati.
1737
1738         Update test to reflect new semantics.
1739
1740         * wasm/js-api/test_basic_api.js:
1741         (const.c.in.constructorProperties.switch):
1742
1743 2017-05-18  Saam Barati  <sbarati@apple.com>
1744
1745         Proxy's [[Get]] passes incorrect receiver
1746         https://bugs.webkit.org/show_bug.cgi?id=164849
1747         <rdar://problem/31767058>
1748
1749         Reviewed by Yusuke Suzuki.
1750
1751         * stress/proxy-get-set-correct-receiver.js: Added.
1752         (assert):
1753         (test):
1754         (test.let.target.set prop):
1755         (test.let.target.get prop):
1756         (test.get let):
1757         * stress/proxy-set.js:
1758         (let.target.get x):
1759         * stress/reflect-set-proxy-set.js:
1760         (let.target.get x):
1761         * stress/reflect-set-receiver-proxy-set.js:
1762         (let.target.get x):
1763
1764 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
1765
1766         Constructor calls set this too early
1767         https://bugs.webkit.org/show_bug.cgi?id=172302
1768
1769         Reviewed by Saam Barati.
1770         
1771         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
1772         wrong.
1773
1774         * stress/construct-overwritten-variable.js: Added.
1775         (new.x.x):
1776         * stress/construct-spread-overwritten-variable-2.js: Added.
1777         (new.x.x):
1778         * stress/construct-spread-overwritten-variable.js: Added.
1779         (new.x.x):
1780
1781 2017-05-18  Saam Barati  <sbarati@apple.com>
1782
1783         WebAssembly: perform stack checks
1784         https://bugs.webkit.org/show_bug.cgi?id=165546
1785         <rdar://problem/29760307>
1786
1787         Reviewed by Filip Pizlo.
1788
1789         * wasm.yaml:
1790         * wasm/function-tests/factorial.js:
1791         * wasm/function-tests/float-sub.js:
1792         * wasm/function-tests/stack-overflow.js: Added.
1793         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
1794         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
1795         (assertOverflows.makeInstance):
1796         (assertOverflows.makeInstance2):
1797         (assertOverflows.assertThrows):
1798         (assertOverflows):
1799         (assertThrows.test.makeSignature):
1800         (assertThrows.test.makeInstance):
1801         (assertThrows.test):
1802         (assertThrows):
1803
1804 2017-05-18  Keith Miller  <keith_miller@apple.com>
1805
1806         WebAssembly API: test with neutered inputs
1807         https://bugs.webkit.org/show_bug.cgi?id=163899
1808
1809         Reviewed by JF Bastien.
1810
1811         * wasm/js-api/neutered-inputs.js: Added.
1812         (const.testFunction):
1813         (const.testConstructor):
1814         * wasm/js-api/test_basic_api.js:
1815         (const.c.in.constructorProperties.switch):
1816
1817 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
1818
1819         DFG inlining should be hardened for the no-result case
1820         https://bugs.webkit.org/show_bug.cgi?id=172290
1821
1822         Reviewed by Saam Barati.
1823
1824         * stress/array-constructor-no-result.js: Added.
1825         (foo):
1826         * stress/pow-no-result.js: Added.
1827         (foo):
1828
1829 2017-05-18  Commit Queue  <commit-queue@webkit.org>
1830
1831         Unreviewed, rolling out r217031, r217032, and r217037.
1832         https://bugs.webkit.org/show_bug.cgi?id=172293
1833
1834         cause linking errors in Windows (Requested by yusukesuzuki on
1835         #webkit).
1836
1837         Reverted changesets:
1838
1839         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
1840         https://bugs.webkit.org/show_bug.cgi?id=172098
1841         http://trac.webkit.org/changeset/217031
1842
1843         "Unreviewed, rebaseline for newly added ClassInfo"
1844         https://bugs.webkit.org/show_bug.cgi?id=172098
1845         http://trac.webkit.org/changeset/217032
1846
1847         "Unreviewed, fix debug and non-JIT build"
1848         https://bugs.webkit.org/show_bug.cgi?id=172098
1849         http://trac.webkit.org/changeset/217037
1850
1851 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1852
1853         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
1854         https://bugs.webkit.org/show_bug.cgi?id=172098
1855
1856         Reviewed by Saam Barati.
1857
1858         * stress/check-sub-class.js: Added.
1859         (shouldBe):
1860         (shouldThrow):
1861         (calling):
1862         (array.forEach):
1863         (i.array.forEach):
1864
1865 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
1866
1867         Unreviewed, address mlam's review feedback.
1868
1869         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
1870
1871 2017-05-17  Saam Barati  <sbarati@apple.com>
1872
1873         We don't do context switches for Wasm->Wasm call indirect
1874         https://bugs.webkit.org/show_bug.cgi?id=172188
1875         <rdar://problem/32231828>
1876
1877         Reviewed by Keith Miller.
1878
1879         * wasm/function-tests/context-switch.js: Added.
1880         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
1881         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
1882         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
1883         (makeInstance):
1884         (makeInstance2):
1885         (assert.eq.makeInstance):
1886         (assert.eq.makeInstance2):
1887         (assert.eq):
1888
1889 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
1890
1891         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
1892         https://bugs.webkit.org/show_bug.cgi?id=172208
1893
1894         Reviewed by Saam Barati.
1895
1896         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
1897         (foo):
1898         (bar):
1899         (baz):
1900
1901 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1902
1903         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
1904         https://bugs.webkit.org/show_bug.cgi?id=172115
1905
1906         Reviewed by Saam Barati.
1907
1908         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
1909         (shouldBe):
1910         (unknown):
1911         (readWord1):
1912         (readWord2):
1913         (readWord3):
1914         (readWord4):
1915
1916 2017-05-16  JF Bastien  <jfbastien@apple.com>
1917
1918         WebAssembly: add memory fuzzer
1919         https://bugs.webkit.org/show_bug.cgi?id=169976
1920         <rdar://problem/31965328>
1921
1922         Reviewed by Keith Miller.
1923
1924         * wasm/fuzz/memory.js: Added.
1925         (const.insert):
1926         (const.action.string_appeared_here):
1927         (const.performAction):
1928         (catch):
1929
1930 2017-05-16  JF Bastien  <jfbastien@apple.com>
1931
1932         WebAssembly: validate load / store alignment
1933         https://bugs.webkit.org/show_bug.cgi?id=168836
1934         <rdar://problem/31965349>
1935
1936         Reviewed by Keith Miller.
1937
1938         * wasm/WASM.js: fix regular expression greed
1939         * wasm/function-tests/memory-alignment.js: Added.
1940         (const.op.of.WASM.opcodes):
1941         * wasm/wasm.json: fix formatting
1942
1943 2017-05-15  Mark Lam  <mark.lam@apple.com>
1944
1945         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
1946         https://bugs.webkit.org/show_bug.cgi?id=172147
1947
1948         Rubber-stamped by Saam Barati.
1949
1950         * stress/object-rest-deconstruct.js: Removed.
1951         * stress/object-spread.js: Removed.
1952
1953 2017-05-11  JF Bastien  <jfbastien@apple.com>
1954
1955         WebAssembly: stop supporting 0xD
1956         https://bugs.webkit.org/show_bug.cgi?id=168788
1957         <rdar://problem/31880922>
1958
1959         Reviewed by Saam Barati.
1960
1961         Test that only version 1 is supported.
1962
1963         * wasm/js-api/version.js: Added.
1964
1965 2017-05-10  JF Bastien  <jfbastien@apple.com>
1966
1967         WebAssemby: builder doesn't do Memory section maximum correctly
1968         https://bugs.webkit.org/show_bug.cgi?id=171931
1969
1970         Reviewed by Keith Miller.
1971
1972         * wasm/Builder.js:
1973         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
1974         * wasm/Builder_WebAssemblyBinary.js:
1975         (const.emitters.Memory):
1976         * wasm/function-tests/memory-grow-invalid.js: Added.
1977
1978 2017-05-10  JF Bastien  <jfbastien@apple.com>
1979
1980         WebAssembly: support name section
1981         https://bugs.webkit.org/show_bug.cgi?id=171263
1982
1983         Reviewed by Keith Miller.
1984
1985         * wasm/function-tests/nameSection.js: Added.
1986         (const.compile):
1987         * wasm/function-tests/nameSection.wasm: Added.
1988         * wasm/function-tests/stack-trace.js: Update format
1989
1990 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
1991
1992         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
1993         https://bugs.webkit.org/show_bug.cgi?id=171801
1994
1995         Reviewed by Michael Saboff.
1996         
1997         These tests used to crash. The prefix and postfix tests cover different paths, except
1998         postfix-ignored goes down the same path as prefix due to an optimization.
1999
2000         * stress/for-in-postfix-ignored-index.js: Added.
2001         (foo):
2002         * stress/for-in-postfix-index.js: Added.
2003         (foo):
2004         * stress/for-in-prefix-index.js: Added.
2005         (foo):
2006
2007 2017-05-08  Mark Lam  <mark.lam@apple.com>
2008
2009         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
2010         https://bugs.webkit.org/show_bug.cgi?id=171786
2011         <rdar://problem/32051023>
2012
2013         Reviewed by Saam Barati.
2014
2015         * stress/bug-171786.js: Added.
2016
2017 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2018
2019         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
2020         https://bugs.webkit.org/show_bug.cgi?id=171543
2021
2022         Reviewed by Saam Barati.
2023
2024         * stress/arrowfunction-lexical-bind-supercall-4.js:
2025         (J):
2026         (K):
2027
2028 2017-05-05  Saam Barati  <sbarati@apple.com>
2029
2030         putDirectIndex does not properly do defineOwnProperty
2031         https://bugs.webkit.org/show_bug.cgi?id=171591
2032         <rdar://problem/31735695>
2033
2034         Reviewed by Geoffrey Garen.
2035
2036         * stress/array-prototype-splice-making-typed-array.js:
2037         (test):
2038         * stress/array-species-config-array-constructor.js:
2039         (shouldThrow):
2040         (test):
2041         * stress/put-direct-index-broken-2.js: Added.
2042         (assert):
2043         (test):
2044         (makeLengthWritable):
2045         (set get restoreOldDesc):
2046         * stress/put-direct-index-broken.js: Added.
2047         (whatToTest):
2048         (tryRunning):
2049         (tryItOut):
2050         * stress/put-indexed-getter-setter.js: Added.
2051         (foo.X.prototype.set 7):
2052         (foo.X.prototype.get 7):
2053         (foo.X):
2054         (foo):
2055
2056 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2057
2058         [JSC] Math unary functions should be handled by DFG
2059         https://bugs.webkit.org/show_bug.cgi?id=171269
2060
2061         Reviewed by Saam Barati.
2062
2063         * stress/arith-acos-on-various-types.js: Added.
2064         (let.validInputTypedTestCases.validInputTestCases.map):
2065         (isIdentical):
2066         (opaqueACosNoArgument):
2067         (testNoArgument):
2068         (opaqueAllTypesACos):
2069         (testAllTypesCall):
2070         (testSingleTypeCall):
2071         (testConstant):
2072         (opaqueACosForSideEffects):
2073         (testSideEffect.let.testObject.valueOf):
2074         (testSideEffect):
2075         (opaqueACosForCSE):
2076         (testCSE.let.testObject.valueOf):
2077         (testCSE):
2078         (opaqueACosForDCE):
2079         (testDCE.let.testObject.valueOf):
2080         (testDCE):
2081         (testException.opaqueACosWithException):
2082         (testException):
2083         * stress/arith-acosh-on-various-types.js: Added.
2084         (let.validInputTypedTestCases.validInputTestCases.map):
2085         (isIdentical):
2086         (opaqueACoshNoArgument):
2087         (testNoArgument):
2088         (opaqueAllTypesACosh):
2089         (testAllTypesCall):
2090         (testSingleTypeCall):
2091         (testConstant):
2092         (opaqueACoshForSideEffects):
2093         (testSideEffect.let.testObject.valueOf):
2094         (testSideEffect):
2095         (opaqueACoshForCSE):
2096         (testCSE.let.testObject.valueOf):
2097         (testCSE):
2098         (opaqueACoshForDCE):
2099         (testDCE.let.testObject.valueOf):
2100         (testDCE):
2101         (testException.opaqueACoshWithException):
2102         (testException):
2103         * stress/arith-asin-on-various-types.js: Added.
2104         (let.validInputTypedTestCases.validInputTestCases.map):
2105         (isIdentical):
2106         (opaqueASinNoArgument):
2107         (testNoArgument):
2108         (opaqueAllTypesASin):
2109         (testAllTypesCall):
2110         (testSingleTypeCall):
2111         (testConstant):
2112         (opaqueASinForSideEffects):
2113         (testSideEffect.let.testObject.valueOf):
2114         (testSideEffect):
2115         (opaqueASinForCSE):
2116         (testCSE.let.testObject.valueOf):
2117         (testCSE):
2118         (opaqueASinForDCE):
2119         (testDCE.let.testObject.valueOf):
2120         (testDCE):
2121         (testException.opaqueASinWithException):
2122         (testException):
2123         * stress/arith-asinh-on-various-types.js: Added.
2124         (let.validInputTypedTestCases.validInputTestCases.map):
2125         (isIdentical):
2126         (opaqueASinhNoArgument):
2127         (testNoArgument):
2128         (opaqueAllTypesASinh):
2129         (testAllTypesCall):
2130         (testSingleTypeCall):
2131         (testConstant):
2132         (opaqueASinhForSideEffects):
2133         (testSideEffect.let.testObject.valueOf):
2134         (testSideEffect):
2135         (opaqueASinhForCSE):
2136         (testCSE.let.testObject.valueOf):
2137         (testCSE):
2138         (opaqueASinhForDCE):
2139         (testDCE.let.testObject.valueOf):
2140         (testDCE):
2141         (testException.opaqueASinhWithException):
2142         (testException):
2143         * stress/arith-atan-on-various-types.js: Added.
2144         (let.validInputTypedTestCases.validInputTestCases.map):
2145         (isIdentical):
2146         (opaqueATanNoArgument):
2147         (testNoArgument):
2148         (opaqueAllTypesATan):
2149         (testAllTypesCall):
2150         (testSingleTypeCall):
2151         (testConstant):
2152         (opaqueATanForSideEffects):
2153         (testSideEffect.let.testObject.valueOf):
2154         (testSideEffect):
2155         (opaqueATanForCSE):
2156         (testCSE.let.testObject.valueOf):
2157         (testCSE):
2158         (opaqueATanForDCE):
2159         (testDCE.let.testObject.valueOf):
2160         (testDCE):
2161         (testException.opaqueATanWithException):
2162         (testException):
2163         * stress/arith-atanh-on-various-types.js: Added.
2164         (let.validInputTypedTestCases.validInputTestCases.map):
2165         (isIdentical):
2166         (opaqueATanhNoArgument):
2167         (testNoArgument):
2168         (opaqueAllTypesATanh):
2169         (testAllTypesCall):
2170         (testSingleTypeCall):
2171         (testConstant):
2172         (opaqueATanhForSideEffects):
2173         (testSideEffect.let.testObject.valueOf):
2174         (testSideEffect):
2175         (opaqueATanhForCSE):
2176         (testCSE.let.testObject.valueOf):
2177         (testCSE):
2178         (opaqueATanhForDCE):
2179         (testDCE.let.testObject.valueOf):
2180         (testDCE):
2181         (testException.opaqueATanhWithException):
2182         (testException):
2183         * stress/arith-cbrt-on-various-types.js: Added.
2184         (let.validInputTypedTestCases.validInputTestCases.map):
2185         (isIdentical):
2186         (opaqueCbrtNoArgument):
2187         (testNoArgument):
2188         (opaqueAllTypesCbrt):
2189         (testAllTypesCall):
2190         (testSingleTypeCall):
2191         (testConstant):
2192         (opaqueCbrtForSideEffects):
2193         (testSideEffect.let.testObject.valueOf):
2194         (testSideEffect):
2195         (opaqueCbrtForCSE):
2196         (testCSE.let.testObject.valueOf):
2197         (testCSE):
2198         (opaqueCbrtForDCE):
2199         (testDCE.let.testObject.valueOf):
2200         (testDCE):
2201         (testException.opaqueCbrtWithException):
2202         (testException):
2203         * stress/arith-cosh-on-various-types.js: Added.
2204         (let.validInputTypedTestCases.validInputTestCases.map):
2205         (isIdentical):
2206         (opaqueCoshNoArgument):
2207         (testNoArgument):
2208         (opaqueAllTypesCosh):
2209         (testAllTypesCall):
2210         (testSingleTypeCall):
2211         (testConstant):
2212         (opaqueCoshForSideEffects):
2213         (testSideEffect.let.testObject.valueOf):
2214         (testSideEffect):
2215         (opaqueCoshForCSE):
2216         (testCSE.let.testObject.valueOf):
2217         (testCSE):
2218         (opaqueCoshForDCE):
2219         (testDCE.let.testObject.valueOf):
2220         (testDCE):
2221         (testException.opaqueCoshWithException):
2222         (testException):
2223         * stress/arith-expm1-on-various-types.js: Added.
2224         (let.validInputTypedTestCases.validInputTestCases.map):
2225         (isIdentical):
2226         (opaqueExpm1NoArgument):
2227         (testNoArgument):
2228         (opaqueAllTypesExpm1):
2229         (testAllTypesCall):
2230         (testSingleTypeCall):
2231         (testConstant):
2232         (opaqueExpm1ForSideEffects):
2233         (testSideEffect.let.testObject.valueOf):
2234         (testSideEffect):
2235         (opaqueExpm1ForCSE):
2236         (testCSE.let.testObject.valueOf):
2237         (testCSE):
2238         (opaqueExpm1ForDCE):
2239         (testDCE.let.testObject.valueOf):
2240         (testDCE):
2241         (testException.opaqueExpm1WithException):
2242         (testException):
2243         * stress/arith-log10-on-various-types.js: Added.
2244         (let.validInputTypedTestCases.validInputTestCases.map):
2245         (isIdentical):
2246         (opaqueLog10NoArgument):
2247         (testNoArgument):
2248         (opaqueAllTypesLog10):
2249         (testAllTypesCall):
2250         (testSingleTypeCall):
2251         (testConstant):
2252         (opaqueLog10ForSideEffects):
2253         (testSideEffect.let.testObject.valueOf):
2254         (testSideEffect):
2255         (opaqueLog10ForCSE):
2256         (testCSE.let.testObject.valueOf):
2257         (testCSE):
2258         (opaqueLog10ForDCE):
2259         (testDCE.let.testObject.valueOf):
2260         (testDCE):
2261         (testException.opaqueLog10WithException):
2262         (testException):
2263         * stress/arith-log2-on-various-types.js: Added.
2264         (let.validInputTypedTestCases.validInputTestCases.map):
2265         (isIdentical):
2266         (opaqueLog2NoArgument):
2267         (testNoArgument):
2268         (opaqueAllTypesLog2):
2269         (testAllTypesCall):
2270         (testSingleTypeCall):
2271         (testConstant):
2272         (opaqueLog2ForSideEffects):
2273         (testSideEffect.let.testObject.valueOf):
2274         (testSideEffect):
2275         (opaqueLog2ForCSE):
2276         (testCSE.let.testObject.valueOf):
2277         (testCSE):
2278         (opaqueLog2ForDCE):
2279         (testDCE.let.testObject.valueOf):
2280         (testDCE):
2281         (testException.opaqueLog2WithException):
2282         (testException):
2283         * stress/arith-sinh-on-various-types.js: Added.
2284         (let.validInputTypedTestCases.validInputTestCases.map):
2285         (isIdentical):
2286         (opaqueSinhNoArgument):
2287         (testNoArgument):
2288         (opaqueAllTypesSinh):
2289         (testAllTypesCall):
2290         (testSingleTypeCall):
2291         (testConstant):
2292         (opaqueSinhForSideEffects):
2293         (testSideEffect.let.testObject.valueOf):
2294         (testSideEffect):
2295         (opaqueSinhForCSE):
2296         (testCSE.let.testObject.valueOf):
2297         (testCSE):
2298         (opaqueSinhForDCE):
2299         (testDCE.let.testObject.valueOf):
2300         (testDCE):
2301         (testException.opaqueSinhWithException):
2302         (testException):
2303         * stress/arith-tan-on-various-types.js:
2304         (isIdentical):
2305         * stress/arith-tanh-on-various-types.js: Added.
2306         (let.validInputTypedTestCases.validInputTestCases.map):
2307         (isIdentical):
2308         (opaqueTanhNoArgument):
2309         (testNoArgument):
2310         (opaqueAllTypesTanh):
2311         (testAllTypesCall):
2312         (testSingleTypeCall):
2313         (testConstant):
2314         (opaqueTanhForSideEffects):
2315         (testSideEffect.let.testObject.valueOf):
2316         (testSideEffect):
2317         (opaqueTanhForCSE):
2318         (testCSE.let.testObject.valueOf):
2319         (testCSE):
2320         (opaqueTanhForDCE):
2321         (testDCE.let.testObject.valueOf):
2322         (testDCE):
2323         (testException.opaqueTanhWithException):
2324         (testException):
2325
2326 2017-05-03  Keith Miller  <keith_miller@apple.com>
2327
2328         Array.prototype.sort should also allow a null comparator
2329         https://bugs.webkit.org/show_bug.cgi?id=171621
2330
2331         Reviewed by Michael Saboff.
2332
2333         Add test to make it less likely we revert to the incompatable behavior.
2334         Also, fix now incorrect tests.
2335
2336         * ChakraCore/test/Array/array_sort.baseline-jsc:
2337         * stress/array-sort-bad-comparator.js:
2338         (test):
2339         * stress/sort-null-comparator.js: Added.
2340         (assertEq):
2341
2342 2017-05-03  Caitlin Potter  <caitp@igalia.com>
2343
2344         [JSC] remove unneeded asyncFunctionTests.yaml
2345         https://bugs.webkit.org/show_bug.cgi?id=171611
2346
2347         Reviewed by Yusuke Suzuki.
2348
2349         Async functions have shipped, and those tests are run as part of
2350         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
2351
2352         * asyncFunctionTests.yaml: Removed.
2353         * stress/async-await-long-loop.js:
2354         * stress/async-await-throw-loop.js:
2355
2356 2017-05-03  Keith Miller  <keith_miller@apple.com>
2357
2358         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
2359         https://bugs.webkit.org/show_bug.cgi?id=47825
2360
2361         Reviewed by Saam Barati.
2362
2363         * stress/sorting-boolean-result-comparator.js: Added.
2364         (checkArray):
2365
2366 2017-05-02  David Kilzer  <ddkilzer@apple.com>
2367
2368         check-webkit-style should keep JavaScript test functions in sync
2369         <https://webkit.org/b/171424>
2370
2371         Reviewed by Joseph Pecoraro.
2372
2373         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
2374         and shouldThrow() in sync with other copies of these methods.
2375
2376         * stress/resources/standalone-pre.js:
2377         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
2378         variables with underscore.
2379         (shouldThrow): Fix whitespace.
2380
2381 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2382
2383         We initialize functions too early in an eval
2384         https://bugs.webkit.org/show_bug.cgi?id=161099
2385
2386         Reviewed by Saam Barati.
2387
2388         * stress/eval-func-decl-with-let-const-class.js: Added.
2389
2390 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2391
2392         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
2393         https://bugs.webkit.org/show_bug.cgi?id=163208
2394
2395         Reviewed by Saam Barati.
2396
2397         * stress/eval-func-decl-block-scoping-reassign.js: Added.
2398         (assert):
2399         (throw.new.Error.f):
2400         (throw.new.Error):
2401         * stress/eval-func-decl-block-with-remove.js: Added.
2402         (assert):
2403         (foo.boo):
2404         (foo):
2405         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
2406         (assert):
2407         (assertThrow):
2408         (foo):
2409         (boo):
2410         (joo):
2411         (koo):
2412         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
2413         (assert):
2414         (assertThrow):
2415         (foo):
2416         (boo):
2417         (hoo):
2418         (joo):
2419         (koo):
2420         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
2421         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
2422         (assert):
2423         (assertThrow):
2424         (foo):
2425         (boo):
2426         (goo):
2427         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
2428         (assert):
2429         (assertThrow):
2430         (foo):
2431         (boo):
2432         (boo.let.val2):
2433         (boo.let.val3):
2434         * stress/eval-func-decl-in-frozen-global.js: Added.
2435         (assert):
2436         (assertThrow):
2437         (throw.new.Error):
2438         (Object.freeze):
2439         * stress/eval-func-decl-in-global-of-eval.js: Added.
2440         (assert):
2441         (assertThrow):
2442         (bar):
2443         (baz):
2444         (foobar):
2445         * stress/eval-func-decl-in-global.js: Added.
2446         (assert):
2447         (assertThrow):
2448         * stress/eval-func-decl-in-if.js: Added.
2449         (assert):
2450         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
2451         (assert):
2452         (assertThrow):
2453         (foo):
2454         (boo):
2455         (foobar):
2456         (hoo):
2457         (joo):
2458         (koo):
2459         (loo):
2460         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
2461         (assert):
2462         (assertThrow):
2463         (foo):
2464         (boo):
2465         (goo):
2466         * stress/variable-under-tdz-eval-tricky.js:
2467         (assert):
2468         * test262.yaml:
2469
2470 2017-04-27  Mark Lam  <mark.lam@apple.com>
2471
2472         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
2473         https://bugs.webkit.org/show_bug.cgi?id=171404
2474         <rdar://problem/31876178>
2475
2476         Reviewed by Saam Barati.
2477
2478         * stress/js-fixed-array-out-of-memory.js: Added.
2479
2480 2017-04-27  David Kilzer  <ddkilzer@apple.com>
2481
2482         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
2483         <https://webkit.org/b/171362>
2484         <rdar://problem/31867686>
2485
2486         Reviewed by Joseph Pecoraro.
2487
2488         * stress/resources/standalone-pre.js:
2489         (shouldBe):
2490         (shouldNotThrow):
2491         (shouldThrow):
2492         - Update shouldBe() to accept anonymous function arguments.
2493           (The shouldNotBe() function was never copied over.)
2494         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
2495           function arguments (which were missed in r202609 for Bug
2496           159232).
2497
2498 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2499
2500         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
2501         https://bugs.webkit.org/show_bug.cgi?id=171262
2502
2503         Reviewed by Saam Barati.
2504
2505         * stress/spread-outer-create-rest.js: Added.
2506         (assert):
2507         (foo):
2508         (bar):
2509         (baz):
2510
2511 2017-04-26  Saam Barati  <sbarati@apple.com>
2512
2513         Print Wasm function index in stack trace
2514         https://bugs.webkit.org/show_bug.cgi?id=171349
2515
2516         Reviewed by JF Bastien.
2517
2518         * wasm/function-tests/stack-trace.js: Added.
2519         (import.Builder.from.string_appeared_here.assert):
2520         (let.imp):
2521         * wasm/function-tests/trap-after-cross-instance-call.js:
2522         (wasmFrameCountFromError):
2523         * wasm/function-tests/trap-load-2.js:
2524         (wasmFrameCountFromError):
2525         * wasm/function-tests/trap-load.js:
2526         (wasmFrameCountFromError):
2527
2528 2017-04-26  Saam Barati  <sbarati@apple.com>
2529
2530         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
2531         https://bugs.webkit.org/show_bug.cgi?id=170924
2532         <rdar://problem/31721052>
2533
2534         Reviewed by Mark Lam.
2535
2536         * stress/error-message-for-function-base-not-found.js: Added.
2537         (assert):
2538         (throw.new.Error):
2539         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
2540         (catch):
2541
2542 2017-04-26  Keith Miller  <keith_miller@apple.com>
2543
2544         WebAssembly: Implement tier up
2545         https://bugs.webkit.org/show_bug.cgi?id=170134
2546
2547         Reviewed by Filip Pizlo.
2548
2549         * wasm/function-tests/trap-after-cross-instance-call.js:
2550         * wasm/tier-up/js-to-wasm.js: Added.
2551         (async.test):
2552         * wasm/tier-up/wasm-to-wasm.js: Added.
2553         (async.test):
2554
2555 2017-04-26  Caitlin Potter  <caitp@igalia.com>
2556
2557         [JSC] Object.keys() must discard property names with no PropertyDescriptor
2558         https://bugs.webkit.org/show_bug.cgi?id=171291
2559
2560         Reviewed by Yusuke Suzuki.
2561
2562         * es6/Proxy_ownKeys_duplicates.js:
2563         * stress/proxy-own-keys.js:
2564         (let.handler.getOwnPropertyDescriptor):
2565         (let.handler.ownKeys):
2566
2567 2017-04-25  Commit Queue  <commit-queue@webkit.org>
2568
2569         Unreviewed, rolling out r215476.
2570         https://bugs.webkit.org/show_bug.cgi?id=171304
2571
2572         "It broke JSBench" (Requested by saamyjoon on #webkit).
2573
2574         Reverted changeset:
2575
2576         "[ES6]. Implement Annex B.3.3 function hoisting rules for
2577         eval"
2578         https://bugs.webkit.org/show_bug.cgi?id=163208
2579         http://trac.webkit.org/changeset/215476
2580
2581 2017-04-25  Saam Barati  <sbarati@apple.com>
2582
2583         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
2584         https://bugs.webkit.org/show_bug.cgi?id=171150
2585         <rdar://problem/31771880>
2586
2587         Reviewed by Sam Weinig.
2588
2589         * stress/spread-optimized-properly.js: Added.
2590         (assert):
2591         (test):
2592         (shallowEq):
2593         (makeArrayIterator):
2594         (test.bar):
2595         (test.callback):
2596         (test.arr.__proto__.Symbol.iterator):
2597         (test.arr.Symbol.iterator):
2598         (test.get bar):
2599         (test.hackedNext):
2600         (test.test):
2601         (test.):
2602
2603 2017-04-25  Mark Lam  <mark.lam@apple.com>
2604
2605         [Follow up] Array.prototype.slice() should ensure that end >= begin.
2606         https://bugs.webkit.org/show_bug.cgi?id=170989
2607         <rdar://problem/31705652>
2608
2609         Not reviewed.
2610
2611         Follow up to rename a test file that was accidentally named wrongly.
2612
2613         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
2614         * stress/regress-170989.patch: Removed.
2615
2616 2017-04-25  Mark Lam  <mark.lam@apple.com>
2617
2618         Array.prototype.slice() should ensure that end >= begin.
2619         https://bugs.webkit.org/show_bug.cgi?id=170989
2620         <rdar://problem/31705652>
2621
2622         Reviewed by Saam Barati.
2623
2624         * stress/regress-170989.patch: Added.
2625
2626 2017-04-25  Mark Lam  <mark.lam@apple.com>
2627
2628         Local CSE wrongly CSEs array accesses with different result types.
2629         https://bugs.webkit.org/show_bug.cgi?id=170990
2630         <rdar://problem/31705945>
2631
2632         Reviewed by Saam Barati.
2633
2634         * stress/regress-170990.js: Added.
2635
2636 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2637
2638         WebAssembly: exporting a property with a name that's a number doesn't work
2639         https://bugs.webkit.org/show_bug.cgi?id=168857
2640
2641         Reviewed by JF Bastien.
2642
2643         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
2644
2645         * wasm/js-api/test_Instance.js:
2646         (ExportedNumber):
2647
2648 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2649
2650         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
2651         https://bugs.webkit.org/show_bug.cgi?id=171190
2652
2653         Reviewed by Saam Barati.
2654
2655         * stress/async-await-syntax.js:
2656         * test262.yaml:
2657
2658 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
2659
2660         [JSC] Use JSFixedArray directly when using call_varargs
2661         https://bugs.webkit.org/show_bug.cgi?id=171057
2662
2663         Reviewed by Saam Barati.
2664
2665         * stress/spread-capture-rest.js: Added.
2666         (shouldBe):
2667         (capture):
2668         (a):
2669         (b):
2670         * stress/spread-multi-layers.js: Added.
2671         (shouldBe):
2672         (a):
2673         (b):
2674         (c):
2675         (d):
2676         * stress/spread-non-varargs.js: Added.
2677         (shouldBe):
2678         (a):
2679         (b):
2680
2681 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2682
2683         test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
2684         https://bugs.webkit.org/show_bug.cgi?id=170897
2685
2686         Reviewed by Saam Barati.
2687
2688         * test262.yaml:
2689
2690 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2691
2692         Address some FIXMEs in JavaScript tests for bugs that have been fixed
2693         https://bugs.webkit.org/show_bug.cgi?id=171191
2694
2695         Reviewed by JF Bastien.
2696
2697         * stress/proxy-is-extensible.js:
2698
2699 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2700
2701         test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
2702         https://bugs.webkit.org/show_bug.cgi?id=171160
2703
2704         Reviewed by JF Bastien.
2705
2706         * stress/inferred-names.js:
2707         * test262.yaml:
2708
2709 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2710
2711         test262: test262/test/language/expressions/generators/yield-as-label.js
2712         https://bugs.webkit.org/show_bug.cgi?id=170979
2713
2714         Reviewed by Saam Barati.
2715
2716         * stress/async-await-module-reserved-word.js:
2717         * stress/async-await-reserved-word.js:
2718         Converge on "Cannot" instead of "Can't".
2719
2720         * catch-parameter-syntax.js:
2721         * yield-named-variable-generator.js:
2722         * yield-named-variable.js:
2723         * stress/yield-label-generator.js:
2724         * stress/yield-label.js:
2725         * stress/yield-reserved-word.js: Added.
2726         More complete list of when 'yield' is allowed.
2727
2728         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
2729         * test262.yaml:
2730
2731 2017-04-23  Commit Queue  <commit-queue@webkit.org>
2732
2733         Unreviewed, rolling out r215674.
2734         https://bugs.webkit.org/show_bug.cgi?id=171212
2735
2736         Possible unintended commit. This patch was on the wrong bug.
2737         (Requested by JoePeck on #webkit).
2738
2739         Reverted changeset:
2740
2741         "test262: test262/test/language/expressions/generators/yield-
2742         as-label.js"
2743         https://bugs.webkit.org/show_bug.cgi?id=170979
2744         http://trac.webkit.org/changeset/215674
2745
2746 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
2747
2748         test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
2749         https://bugs.webkit.org/show_bug.cgi?id=171197
2750
2751         Reviewed by Saam Barati.
2752
2753         * test262.yaml:
2754
2755 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
2756
2757         test262: test262/test/language/expressions/generators/yield-as-label.js
2758         https://bugs.webkit.org/show_bug.cgi?id=170979
2759
2760         Reviewed by Saam Barati.
2761
2762         * stress/async-await-module-reserved-word.js:
2763         * stress/async-await-reserved-word.js:
2764         Converge on "Cannot" instead of "Can't".
2765
2766         * catch-parameter-syntax.js:
2767         * yield-named-variable-generator.js:
2768         * yield-named-variable.js:
2769         * stress/yield-label-generator.js:
2770         * stress/yield-label.js:
2771         * stress/yield-reserved-word.js: Added.
2772         More complete list of when 'yield' is allowed.
2773
2774         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
2775         * test262.yaml:
2776
2777 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
2778
2779         test262: test262/test/built-ins/Number/parseFloat.js
2780         https://bugs.webkit.org/show_bug.cgi?id=171193
2781
2782         Reviewed by Yusuke Suzuki.
2783
2784         * test262.yaml:
2785
2786 2017-04-22  JF Bastien  <jfbastien@apple.com>
2787
2788         WebAssembly: Module.exports, Module.imports, Module.customSections are wrong
2789         https://bugs.webkit.org/show_bug.cgi?id=171078
2790
2791         Reviewed by Saam Barati.
2792
2793         They're static properties of Module, not instance properties of a module.
2794         https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymoduleexports
2795
2796         * wasm/js-api/Module.customSection.js:
2797         (assert.throws.WebAssembly.Module.customSections):
2798         (assert.eq):
2799         (assert.throws.WebAssembly.Module.prototype.customSections): Deleted.
2800         * wasm/js-api/Module.exports.js:
2801         (assert.throws.WebAssembly.Module.exports):
2802         (assert.truthy):
2803         (assert.throws.WebAssembly.Module.prototype.exports): Deleted.
2804         * wasm/js-api/Module.imports.js:
2805         (assert.throws.WebAssembly.Module.imports):
2806         (assert.truthy):
2807         (assert.throws.WebAssembly.Module.prototype.imports): Deleted.
2808
2809 2017-04-21  JF Bastien  <jfbastien@apple.com>
2810
2811         Silence noisy test
2812
2813         Unreviewed, Fil / Michael and I talked about it in the corridor. I
2814         just forgot to set verbose to false before commit.
2815
2816         * wasm/stress/oom.js:
2817
2818 2017-04-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2819
2820         [JSC][FTL] FTL should support Arrayify
2821         https://bugs.webkit.org/show_bug.cgi?id=169596
2822
2823         Reviewed by Saam Barati.
2824
2825         * stress/arrayify.js: Added.
2826         (arrayifyInt32):
2827         (arrayifyDouble):
2828         (arrayifyContiguous):
2829
2830 2017-04-20  Mark Lam  <mark.lam@apple.com>
2831
2832         virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
2833         https://bugs.webkit.org/show_bug.cgi?id=171079
2834         <rdar://problem/31684756>
2835
2836         Reviewed by Saam Barati.
2837
2838         * stress/regress-171079.js: Added.
2839
2840 2017-04-15  Filip Pizlo  <fpizlo@apple.com>
2841
2842         Optimize SharedArrayBuffer in the DFG+FTL
2843         https://bugs.webkit.org/show_bug.cgi?id=164108
2844
2845         Reviewed by Saam Barati.
2846         
2847         Added a fairly comprehensive test of the intrinsics. This creates a function for each possible
2848         combination of type and operation, and then first uses it nicely and then tries a bunch of
2849         erroneous conditions like OOB.
2850
2851         * stress/SharedArrayBuffer-opt.js: Added.
2852         (string_appeared_here.switch):
2853         (string_appeared_here.str):
2854         (runAtomic):
2855         (shouldFail):
2856         (Symbol):
2857         (string_appeared_here.a.of.arrays.m.of.atomics):
2858         * stress/SharedArrayBuffer.js:
2859
2860 2017-04-19  Mark Lam  <mark.lam@apple.com>
2861
2862         B3StackmapSpecial should handle when stackmap values are not recoverable from a Def'ed arg.
2863         https://bugs.webkit.org/show_bug.cgi?id=170973
2864         <rdar://problem/30318657>
2865
2866         Reviewed by Filip Pizlo.
2867
2868         * stress/regress-170973.js: Added.
2869
2870 2017-04-19  JF Bastien  <jfbastien@apple.com>
2871
2872         WebAssembly: limit slow memories
2873         https://bugs.webkit.org/show_bug.cgi?id=170825
2874
2875         Reviewed by Saam Barati.
2876
2877         * wasm.yaml:
2878         * wasm/stress/oom.js: Added.
2879         (try.true.WebAssemblyMemoryMode):
2880         (catch):
2881
2882 2017-04-19  JF Bastien  <jfbastien@apple.com>
2883
2884         WebAssembly: don't expose any WebAssembly JS object if JIT is off
2885         https://bugs.webkit.org/show_bug.cgi?id=170782
2886
2887         Reviewed by Saam Barati.
2888
2889         * wasm.yaml:
2890         * wasm/noJIT/noJIT.js: Added.
2891
2892 2017-04-18  Mark Lam  <mark.lam@apple.com>
2893
2894         r211670 broke double to int conversion.
2895         https://bugs.webkit.org/show_bug.cgi?id=170961
2896         <rdar://problem/31687696>
2897
2898         Reviewed by Yusuke Suzuki.
2899
2900         * microbenchmarks/double-to-int32.js: Added.
2901         * stress/to-int32-sensible2.js: Added.
2902
2903 2017-04-18  Oleksandr Skachkov  <gskachkov@gmail.com>
2904
2905         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
2906         https://bugs.webkit.org/show_bug.cgi?id=163208
2907
2908         Reviewed by Saam Barati.
2909
2910         * stress/eval-func-decl-block-scoping-reassign.js: Added.
2911         (assert):
2912         (throw.new.Error.f):
2913         (throw.new.Error):
2914         * stress/eval-func-decl-block-with-remove.js: Added.
2915         (assert):
2916         (foo.boo):
2917         (foo):
2918         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
2919         (assert):
2920         (assertThrow):
2921         (foo):
2922         (boo):
2923         (joo):
2924         (koo):
2925         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
2926         (assert):
2927         (assertThrow):
2928         (foo):
2929         (boo):
2930         (hoo):
2931         (joo):
2932         (koo):
2933         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
2934         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
2935         (assert):
2936         (assertThrow):
2937         (foo):
2938         (boo):
2939         (goo):
2940         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
2941         (assert):
2942         (assertThrow):
2943         (foo):
2944         (boo):
2945         (boo.let.val2):
2946         (boo.let.val3):
2947         * stress/eval-func-decl-in-frozen-global.js: Added.
2948         (assert):
2949         (assertThrow):
2950         (throw.new.Error):
2951         (Object.freeze):
2952         * stress/eval-func-decl-in-global-of-eval.js: Added.
2953         (assert):
2954         (assertThrow):
2955         (bar):
2956         (baz):
2957         (foobar):
2958         * stress/eval-func-decl-in-global.js: Added.
2959         (assert):
2960         (assertThrow):
2961         * stress/eval-func-decl-in-if.js: Added.
2962         (assert):
2963         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
2964         (assert):
2965         (assertThrow):
2966         (foo):
2967         (boo):
2968         (foobar):
2969         (hoo):
2970         (joo):
2971         (koo):
2972         (loo):
2973         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
2974         (assert):
2975         (assertThrow):
2976         (foo):
2977         (boo):
2978         (goo):
2979         * stress/variable-under-tdz-eval-tricky.js:
2980         (assert):
2981         * test262.yaml:
2982
2983 2017-04-18  Filip Pizlo  <fpizlo@apple.com>
2984
2985         wasm/function-tests/memory-multiagent times out sometimes
2986         https://bugs.webkit.org/show_bug.cgi?id=170958
2987
2988         Reviewed by Keith Miller.
2989         
2990         Add the ability to skip tests easily. Skip the test.
2991
2992         * wasm.yaml:
2993         * wasm/function-tests/memory-multiagent.js:
2994
2995 2017-04-18  Saam Barati  <sbarati@apple.com>
2996
2997         Follow up to debug build stack overflow in test after r215453
2998
2999         Rubber stamped by Mark Lam.
3000
3001         * stress/call-apply-exponential-bytecode-size.js: Decrease the call
3002         size to prevent stack overflow errors on debug builds.
3003
3004 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3005
3006         [DFG] Convert ValueAdd(Int32, String) => MakeRope(ToString(Int32), String)
3007         https://bugs.webkit.org/show_bug.cgi?id=170943
3008
3009         Reviewed by Geoffrey Garen.
3010
3011         * microbenchmarks/number-to-string-with-add-empty.js: Added.
3012         (toStringLeft):
3013         (toStringRight):
3014         * microbenchmarks/number-to-string-with-add-in-loop.js: Added.
3015         (toStringLeft):
3016         (toStringRight):
3017         * microbenchmarks/number-to-string-with-add.js: Added.
3018         (toStringLeft):
3019         (toStringRight):
3020         * stress/number-to-string-with-add.js: Added.
3021         (shouldBe):
3022         (toStringRight):
3023         (toStringLeftEmpty):
3024         (toStringRightEmpty):
3025
3026 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3027
3028         [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
3029         https://bugs.webkit.org/show_bug.cgi?id=170940
3030
3031         Reviewed by Filip Pizlo.
3032
3033         * microbenchmarks/for-of-array.js: Added.
3034         (fn):
3035
3036 2017-04-17  Saam Barati  <sbarati@apple.com>
3037
3038         BytecodeGenerator ".call" and ".apply" is exponential in nesting depth
3039         https://bugs.webkit.org/show_bug.cgi?id=139847
3040         <rdar://problem/19321122>
3041
3042         Reviewed by Oliver Hunt.
3043
3044         * stress/call-apply-exponential-bytecode-size.js: Added.
3045         (assert):
3046         (const.inc):
3047         (const.inc2):
3048         (bar):
3049         (randomApplyOrCall):
3050         (baz):
3051         (jaz):
3052         (haz):
3053         (foo):
3054
3055 2017-04-17  Mark Lam  <mark.lam@apple.com>
3056
3057         JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
3058         https://bugs.webkit.org/show_bug.cgi?id=170896
3059         <rdar://problem/31651319>
3060
3061         Reviewed by JF Bastien and Keith Miller.
3062
3063         * stress/regress-170896.js: Added.
3064
3065 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3066
3067         test262: test262/test/built-ins/Object/prototype/toLocaleString/primitive_this_value.js
3068         https://bugs.webkit.org/show_bug.cgi?id=170882
3069
3070         Reviewed by Saam Barati.
3071
3072         * test262.yaml:
3073
3074 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3075
3076         test262: test262/test/built-ins/isNaN/toprimitive-not-callable-throws.js
3077         https://bugs.webkit.org/show_bug.cgi?id=170888
3078
3079         Reviewed by Saam Barati.
3080
3081         * stress/computed-accessor.js:
3082         * stress/eval-in-arrow-function.js:
3083         * stress/rest-elements.js:
3084         * stress/string-object-define-own-property.js:
3085         Remove unused shouldThrow.
3086
3087         * stress/symbol-toprimitive-errors.js: Added.
3088         Check for ToPrimitive TypeErrors.
3089
3090         * test262.yaml:
3091
3092 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3093
3094         test262: test262/test/language/expressions/tagged-template/template-object.js
3095         https://bugs.webkit.org/show_bug.cgi?id=170878
3096
3097         Reviewed by Saam Barati.
3098
3099         * stress/array-length-not-writable.js: Added.
3100         (assert):
3101         * test262.yaml:
3102
3103 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3104
3105         test262: test262/test/built-ins/Object/getOwnPropertyNames/15.2.3.4-4-44.js
3106         https://bugs.webkit.org/show_bug.cgi?id=170879
3107
3108         Reviewed by Saam Barati.
3109
3110         * ChakraCore/test/es5/enumerable.baseline-jsc:
3111         * test262.yaml:
3112
3113 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3114
3115         test262: test262/test/built-ins/Date/prototype/Symbol.toPrimitive/name.js
3116         https://bugs.webkit.org/show_bug.cgi?id=170884
3117
3118         Reviewed by Yusuke Suzuki.
3119
3120         * test262.yaml:
3121
3122 2017-04-15  Joseph Pecoraro  <pecoraro@apple.com>
3123
3124         test262: test262/test/language/global-code/new.target-arrow.js
3125         https://bugs.webkit.org/show_bug.cgi?id=170872
3126
3127         Reviewed by Saam Barati.
3128
3129         * stress/async-arrow-functions-lexical-new.target-binding.js:
3130         (shouldThrowAsync): Deleted.
3131         (shouldThrowAsync.async): Deleted.
3132         This code should have thrown a SyntaxError. Instead it was throwing
3133         a ReferenceError for the internal @newTargetLocal variable.
3134
3135         * stress/new-target-syntax-errors.js:
3136         Cover the arrow function in global code cases.
3137
3138         * ChakraCore.yaml:
3139         * ChakraCore/test/es6/globalLambdaNewTargetSyntaxError.baseline-jsc:
3140         We now pass with an expected SyntaxError. Our error message is different.
3141
3142         * test262.yaml:
3143
3144 2017-04-14  Saam Barati  <sbarati@apple.com>
3145
3146         ParseInt intrinsic in DFG backend doesn't properly flush its operands
3147         https://bugs.webkit.org/show_bug.cgi?id=170865
3148
3149         Reviewed by Mark Lam and Geoffrey Garen.
3150
3151         * stress/parse-int-intrinsic-dfg-backend-flush.js: Added.
3152         (assert):
3153         (foo):
3154
3155 2017-04-14  Caitlin Potter  <caitp@igalia.com>
3156
3157         [JSC] use ExpressionErrorClassifier for AwaitExpression operand
3158         https://bugs.webkit.org/show_bug.cgi?id=170844
3159
3160         Reviewed by Saam Barati.
3161
3162         * stress/regress-170732.js: Added.
3163
3164 2017-04-14  Oleksandr Skachkov  <gskachkov@gmail.com>
3165
3166         Safari 10.1 JSON.parse returns incorrect object for numeric keys with decimal values
3167         https://bugs.webkit.org/show_bug.cgi?id=170442
3168
3169         Reviewed by Yusuke Suzuki.
3170
3171         * stress/object-number-properties.js:
3172
3173 2017-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3174
3175         [JSC] Date.parse should accept wider range of representation
3176         https://bugs.webkit.org/show_bug.cgi?id=170720
3177
3178         Reviewed by Darin Adler.
3179
3180         * stress/date-relaxed.js: Added.
3181         (shouldBe):
3182         (throw.new.Error):
3183
3184 2017-04-13  Mark Lam  <mark.lam@apple.com>
3185
3186         Should use flushDirect() when flushing the scopeRegister due to needsScopeRegister().
3187         https://bugs.webkit.org/show_bug.cgi?id=170661
3188         <rdar://problem/31579046>
3189
3190         Reviewed by Filip Pizlo.
3191
3192         * stress/regress-170661.js: Added.
3193
3194 2017-04-13  JF Bastien  <jfbastien@apple.com>
3195
3196         WebAssembly: manage memory better
3197         https://bugs.webkit.org/show_bug.cgi?id=170628
3198
3199         Reviewed by Keith Miller, Michael Saboff.
3200
3201         * wasm/Builder.js: move a helper out so tests can use it
3202         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3203         * wasm/WASM.js: add utilities to classify opcodes
3204         (export.opcodes):
3205         (export.const.memoryAccessInfo.op.const.sign):
3206         * wasm/function-tests/memory-access-past-4gib.js: Added. This test
3207         fails before this patch.
3208         (const.op.of.WASM.opcodes):
3209         * wasm/function-tests/memory-many.js: Added. This simple tests
3210         just shouldn't crash. In verbose mode it's useful at determining
3211         if the GC falls behind or not.
3212         * wasm/function-tests/memory-multiagent.js: Added. Emulate postMessage.
3213         (const.startAgents.numAgentsToStart.a.agent.receiveBroadcast):
3214         (const.startAgents.numAgentsToStart.a.write.const.idx.Math.random):
3215         (const.broadcastToAgents):
3216         * wasm/js-api/extension-MemoryMode.js: verbose logging.
3217         (testMemoryNoMax):
3218         (testMemory):
3219         (testInstanceNoMemory):
3220         (testInstanceNoMax):
3221         (testInstance):
3222         * wasm/utilities.js: move a utility here.
3223
3224 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
3225
3226         test262: test262/test/built-ins/NativeErrors/EvalError/proto.js
3227         https://bugs.webkit.org/show_bug.cgi?id=170668
3228
3229         Reviewed by Keith Miller.
3230
3231         * ChakraCore.yaml:
3232         * ChakraCore/test/Lib/error.baseline-jsc: Added.
3233         This test does not match the spec.
3234
3235         * test262.yaml:
3236
3237 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
3238
3239         test262: test262/test/language/literals/regexp/u-dec-esc.js
3240         https://bugs.webkit.org/show_bug.cgi?id=170687
3241
3242         Reviewed by Michael Saboff.
3243
3244         * test262.yaml:
3245
3246 2017-04-11  Michael Saboff  <msaboff@apple.com>
3247
3248         Implement Object.isFrozen() and Object.isSealed() per ECMA spec
3249         https://bugs.webkit.org/show_bug.cgi?id=170753
3250
3251         Reviewed by Mark Lam.
3252
3253         Added JSC baseline and enabled defineIndexProperty test.
3254
3255         Note that JSC differs from Chakra in that a JSC doesn't use indexed
3256         properties placed on the Array prototype when sorting the indexed 
3257         properties of an Object.  This is behavior is considered undefined
3258         in the standard.
3259
3260         * ChakraCore.yaml:
3261         * ChakraCore/test/es5/defineIndexProperty.baseline-jsc: Added.
3262
3263 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
3264
3265         test262: test262/test/annexB/language/comments/multi-line-html-close.js
3266         https://bugs.webkit.org/show_bug.cgi?id=170648
3267
3268         Reviewed by Keith Miller.
3269
3270         * test262.yaml:
3271
3272 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
3273
3274         test262: test262/test/built-ins/Array/S15.4.3_A2.2.js
3275         https://bugs.webkit.org/show_bug.cgi?id=170652
3276
3277         Reviewed by Michael Saboff.
3278
3279         * stress/native-constructors-length.js: Added.
3280         (assertLengthDescriptorAttributes):
3281         Add a quick test for the length properties of all native constructors.
3282
3283         * ChakraCore/test/es5/enumerable.baseline-jsc:
3284         Rebaseline expectations for this test.
3285
3286         * test262.yaml:
3287
3288 2017-04-10  Keith Miller  <keith_miller@apple.com>
3289
3290         WebAssembly: Update spec tests
3291         https://bugs.webkit.org/show_bug.cgi?id=170683
3292
3293         Rubber-stamped by JF Bastien.
3294
3295         * wasm.yaml:
3296         * wasm/spec-tests/br_table.wast.js:
3297         * wasm/spec-tests/conversions.wast.js: Removed.
3298         * wasm/spec-tests/f32_bitwise.wast.js: Added.
3299         * wasm/spec-tests/f32_cmp.wast.js:
3300         * wasm/spec-tests/f64_bitwise.wast.js: Added.
3301         * wasm/spec-tests/f64_cmp.wast.js:
3302         * wasm/spec-tests/i32.wast.js:
3303         * wasm/spec-tests/i64.wast.js:
3304         * wasm/spec-tests/int_exprs.wast.js:
3305         * wasm/spec-tests/memory.wast.js:
3306
3307 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
3308
3309         test262: test262/test/annexB/language/expressions/object/__proto__-fn-name.js
3310         https://bugs.webkit.org/show_bug.cgi?id=170650
3311
3312         Reviewed by Saam Barati.
3313
3314         * stress/inferred-names.js:
3315         * test262.yaml:
3316
3317 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
3318
3319         test262: test262/test/annexB/language/literals/regexp/identity-escape.js
3320         https://bugs.webkit.org/show_bug.cgi?id=170651
3321
3322         Reviewed by Saam Barati.
3323
3324         * test262.yaml:
3325
3326 2017-04-07  Michael Saboff  <msaboff@apple.com>
3327
3328         Fix and enable ChakraCore/test/es6/ES6Function_bugs.js after r215072
3329         https://bugs.webkit.org/show_bug.cgi?id=170580
3330
3331         Reviewed by JF Bastien.
3332
3333         Commented out subtest that expects defineProperty("length") to a getter on a
3334         sealed function shouldn't throw.
3335
3336         * ChakraCore.yaml:
3337         * ChakraCore/test/es6/ES6Function_bugs.js:
3338
3339 2017-04-06  Michael Saboff  <msaboff@apple.com>
3340
3341         Cannot Object.seal() or Object.freeze() global "this"
3342         https://bugs.webkit.org/show_bug.cgi?id=170549
3343
3344         Reviewed by Mark Lam.
3345
3346         Enabled failing tests fixed by the corresponding code change:
3347             ChakraCore/test/LetConst/delete.js
3348             ChakraCore/test/LetConst/dop.js
3349             ChakraCore/test/LetConst/dop1.js
3350
3351         * ChakraCore.yaml:
3352         * ChakraCore/test/LetConst/dop.baseline-jsc: Added JSC specific expected output.
3353         * ChakraCore/test/LetConst/dop1.baseline-jsc: Added JSC specific expected output.
3354
3355 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3356
3357         test262: ES2017 test progressions need updated expectations (arguments.caller removed)
3358         https://bugs.webkit.org/show_bug.cgi?id=170536
3359
3360         Reviewed by Mark Lam.
3361
3362         * test262.yaml:
3363         After r208867 the tests are out of date and are now expected to fail.
3364
3365 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3366
3367         test262: Final rebaseline of existing tests, a few tests have started failing
3368         https://bugs.webkit.org/show_bug.cgi?id=170538
3369
3370         Reviewed by Mark Lam.
3371
3372         * test262.yaml:
3373         These tests started failing a while ago. Mark them as legitmate failures.
3374
3375 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3376
3377         test262: Rebaseline expectations for now passing tests
3378         https://bugs.webkit.org/show_bug.cgi?id=170532
3379
3380         Reviewed by Ryosuke Niwa.
3381
3382         * test262.yaml:
3383         Update expectations for tests we are now passing.
3384
3385 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3386
3387         test262: module test progressions need updated expectations (@@iterator changes)
3388         https://bugs.webkit.org/show_bug.cgi?id=170535
3389
3390         Reviewed by Saam Barati.
3391
3392         * test262.yaml:
3393         After r212430 the tests are out of date and are now expected to fail.
3394
3395 2017-04-05  Michael Saboff  <msaboff@apple.com>
3396
3397         Unreviewed rollout of r214642 as the test still intermittently fails.
3398
3399         Disabled ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js.
3400
3401         * ChakraCore.yaml:
3402
3403 2017-04-05  Michael Saboff  <msaboff@apple.com>
3404
3405         REGRESSION (Safari 10.1): Inserting elements into arrays fails when array contains very large numbers
3406         https://bugs.webkit.org/show_bug.cgi?id=170264
3407         <rdar://problem/31375593>
3408
3409         Rubber-stamped by Saam Barati.
3410
3411         The original bug was fixed in: https://trac.webkit.org/changeset/214714
3412         I'm just adding another test for good measure.
3413
3414         * stress/double-array-to-array-storage.js: Added.
3415         (assert):
3416
3417 2017-04-05  Keith Miller  <keith_miller@apple.com>
3418
3419         WebAssembly: We shouldn't need to pin size registers if we have a fast memory.
3420         https://bugs.webkit.org/show_bug.cgi?id=170504
3421
3422         Reviewed by Mark Lam.
3423
3424         * wasm/function-tests/trap-after-cross-instance-call.js: Added.
3425         (b.new.WebAssembly.Memory):
3426         (importObject.foo.bar):
3427         (wasmFrameCountFromError):
3428
3429 2017-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3430
3431         [JSC] Generate TemplateObjects at linking time
3432         https://bugs.webkit.org/show_bug.cgi?id=169743
3433
3434         Reviewed by Keith Miller.
3435
3436         * stress/template-string-tags-eval.js: Added.
3437         (shouldBe):
3438         (tag):
3439
3440 2017-04-04  Mark Lam  <mark.lam@apple.com>
3441
3442         On ARM64, DFG::SpeculativeJIT::compileArithMod() failed to ensure result is of DataFormatInt32.
3443         https://bugs.webkit.org/show_bug.cgi?id=170473
3444         <rdar://problem/29912391>
3445
3446         Reviewed by Saam Barati.
3447
3448         * stress/regress-170473.js: Added.
3449
3450 2017-04-03  Mark Lam  <mark.lam@apple.com>
3451
3452         Fix incorrect capacity delta calculation reported in SparseArrayValueMap::add().
3453         https://bugs.webkit.org/show_bug.cgi?id=170412
3454         <rdar://problem/29697336>
3455
3456         Reviewed by Filip Pizlo.
3457
3458         * stress/regress-170412.js: Added.
3459
3460 2017-04-03  Keith Miller  <keith_miller@apple.com>
3461
3462         WebAssembly: Update spec tests
3463         https://bugs.webkit.org/show_bug.cgi?id=170361
3464
3465         Rubber-stamped by Saam Barati.
3466
3467         Update the spec tests to run tests generated by the newer spec
3468         test builder wasm-spec/test/builder.py. This patch also adds the
3469         necessary harness code in spec-harness.js so we can run the tests.
3470
3471         * wasm.yaml:
3472         * wasm/import-spec-tests.rb:
3473         * wasm/spec-harness.js: Added.
3474         (import.string_appeared_here.then):
3475         (test):
3476         (promise_test):
3477         (let.assert_unreached):
3478         * wasm/spec-harness/index.js: Added.
3479         (let.testNum):
3480         (assertThrows):
3481         (_assert):
3482         (ValueResult):
3483         (ErrorResult):
3484         (Result.prototype.isError):
3485         (binary):
3486         (module):
3487         (uniqueTest):
3488         (assert_invalid):
3489         (assert_soft_invalid):
3490         (register):
3491         (call):
3492         (get instance):
3493         (exports):
3494         (run):
3495         (assert_unlinkable):
3496         (assert_uninstantiable):
3497         (assert_trap):
3498         (try.f):
3499         (catch):
3500         (assert_exhaustion):
3501         (assert_return):
3502         (assert_return_nan):
3503         * wasm/spec-harness/testharness.css: Added.
3504         (html):
3505         (#log .warning,):
3506         (#log .error,):
3507         (section#summary):
3508         (table#results):
3509         (table#results th:first-child,):
3510         (table#results th:last-child,):
3511         (table#results.assertions th:last-child,):
3512         (table#results th):
3513         (table#results td):
3514         (tr.pass > td:first-child):
3515         (tr.fail > td:first-child):
3516         (tr.timeout > td:first-child):
3517         (tr.notrun > td:first-child):
3518         (.pass > td:first-child, .fail > td:first-child, .timeout > td:first-child, .notrun > td:first-child):
3519         (table#results span):
3520         (table#results span.expected):
3521         (table#results span.actual):
3522         (span.ok):
3523         (tr.error):
3524         (span.timeout):
3525         (span.ok, span.timeout, span.error):
3526         * wasm/spec-harness/testharness.js: Added.
3527         (WindowTestEnvironment):
3528         (WindowTestEnvironment.prototype._dispatch):
3529         (WindowTestEnvironment.prototype._forEach_windows):
3530         (WindowTestEnvironment.prototype.on_tests_ready):
3531         (WindowTestEnvironment.prototype.setup_messages):
3532         (WindowTestEnvironment.prototype.next_default_test_name):
3533         (WindowTestEnvironment.prototype.on_new_harness_properties):
3534         (WindowTestEnvironment.prototype.add_on_loaded_callback):
3535         (WindowTestEnvironment.prototype.test_timeout):
3536         (WindowTestEnvironment.prototype.global_scope):
3537         (WorkerTestEnvironment):
3538         (WorkerTestEnvironment.prototype._dispatch):
3539         (WorkerTestEnvironment.prototype._add_message_port):
3540         (WorkerTestEnvironment.prototype.next_default_test_name):
3541         (WorkerTestEnvironment.prototype.on_new_harness_properties):
3542         (WorkerTestEnvironment.prototype.on_tests_ready):
3543         (WorkerTestEnvironment.prototype.add_on_loaded_callback):
3544         (WorkerTestEnvironment.prototype.test_timeout):
3545         (WorkerTestEnvironment.prototype.global_scope):
3546         (DedicatedWorkerTestEnvironment):
3547         (DedicatedWorkerTestEnvironment.prototype.on_tests_ready):
3548         (SharedWorkerTestEnvironment):
3549         (SharedWorkerTestEnvironment.prototype.on_tests_ready):
3550         (ServiceWorkerTestEnvironment):
3551         (ServiceWorkerTestEnvironment.prototype.add_on_loaded_callback):
3552         (create_test_environment):
3553         (is_shared_worker):
3554         (is_service_worker):
3555         (test):
3556         (async_test):
3557         (promise_test):
3558         (this.wait_for):
3559         (EventWatcher):
3560         (setup):
3561         (done):
3562         (generate_tests):
3563         (step_timeout):
3564         (truncate):
3565         (is_node):
3566         (format_value):
3567         * wasm/spec-harness/testharnessreport.js: Added.
3568         * wasm/spec-harness/wasm-constants.js: Added.
3569         (bytes):
3570         (bytesWithHeader):
3571         (makeSig):
3572         (makeSig_v_x):
3573         (makeSig_v_xx):
3574         (makeSig_r_v):
3575         (makeSig_r_x):
3576         (makeSig_r_xx):
3577         (assertTraps):
3578         (assertWasmThrows):
3579         * wasm/spec-harness/wasm-module-builder.js: Added.
3580         (Binary.prototype.emit_u8):
3581         (Binary.prototype.emit_u16):
3582         (Binary.prototype.emit_u32):
3583         (Binary.prototype.emit_u32v):
3584         (Binary.prototype.emit_bytes):
3585         (Binary.prototype.emit_string):
3586         (Binary.prototype.emit_header):
3587         (Binary.prototype.emit_section):
3588         (Binary):
3589         (WasmFunctionBuilder):
3590         (WasmFunctionBuilder.prototype.exportAs):
3591         (WasmFunctionBuilder.prototype.exportFunc):
3592         (WasmFunctionBuilder.prototype.addBody):
3593         (WasmFunctionBuilder.prototype.addLocals):
3594         (WasmFunctionBuilder.prototype.end):
3595         (WasmGlobalBuilder):
3596         (WasmGlobalBuilder.prototype.exportAs):
3597         (WasmModuleBuilder):
3598         (WasmModuleBuilder.prototype.addStart):
3599         (WasmModuleBuilder.prototype.addMemory):
3600         (WasmModuleBuilder.prototype.addExplicitSection):
3601         (WasmModuleBuilder.prototype.addType):
3602         (WasmModuleBuilder.prototype.addGlobal):
3603         (WasmModuleBuilder.prototype.addFunction):
3604         (WasmModuleBuilder.prototype.addImport):
3605         (WasmModuleBuilder.prototype.addImportedGlobal):
3606         (WasmModuleBuilder.prototype.addImportedMemory):
3607         (WasmModuleBuilder.prototype.addImportedTable):
3608         (WasmModuleBuilder.prototype.addExport):
3609         (WasmModuleBuilder.prototype.addExportOfKind):
3610         (WasmModuleBuilder.prototype.addDataSegment):
3611         (WasmModuleBuilder.prototype.exportMemoryAs):
3612         (WasmModuleBuilder.prototype.addFunctionTableInit):
3613         (WasmModuleBuilder.prototype.appendToTable):
3614         (WasmModuleBuilder.prototype.setFunctionTableLength):
3615         (WasmModuleBuilder.prototype.toArray):
3616         (WasmModuleBuilder.prototype.toBuffer):
3617         (WasmModuleBuilder.prototype.instantiate):
3618         * wasm/spec-harness/wast.js: Added.
3619         (normalize):
3620         (require.else._registry.name):
3621         (require):
3622         (add_hex_char):
3623         (add_char):
3624         (string_with):
3625         (list_of_opt):
3626         (break_bytes.f):
3627         (break_bytes):
3628         (f):
3629         (decls):
3630         (func_type):
3631         (limits):
3632         (global_type):
3633         (testop):
3634         (relop):
3635         (unop):
3636         (binop):
3637         (cvtop):
3638         (oper):
3639         (mem_size):
3640         (extension):
3641         (memop):
3642         (storeop):
3643         (var):
3644         (constop):
3645         (instr.else.switch.case.0.f):
3646         (instr.else.switch.case.1.f.1):
3647         (instr.else.switch.case.2.f.2):
3648         (instr):
3649         (func_with_name):
3650         (func):
3651         (start):
3652         (table):
3653         (memory):
3654         (segment):
3655         (elems):
3656         (data):
3657         (typedef):
3658         (import_kind):
3659         (import):
3660         (export_kind):
3661         (export):
3662         (var_opt):
3663         (is_func_import):
3664         (is_table_import):
3665         (is_memory_import):
3666         (is_global_import):
3667         (f.1):
3668         (f.2):
3669         (f.3):
3670         (module_with_var_opt):
3671         (module_):
3672         (literal):
3673         (definition):
3674         (access):
3675         (action):
3676         (script):
3677         (_registry.string_appeared_here):
3678         (init):
3679         (make_matrix):
3680         (copy):
3681         (append):
3682         (sub):
3683         (fill):
3684         (blit):
3685         (iter):
3686         (map):
3687         (iteri):
3688         (mapi):
3689         (to_list):
3690         (list_length):
3691         (of_list):
3692         (fold_left):
3693         (fold_right):
3694         (maxson):
3695         (trickle):
3696         (bubble):
3697         (trickleup):
3698         (sort):
3699         (merge):
3700         (isortto):
3701         (sortto):
3702         (stable_sort):
3703         (import_type):
3704         (export_type):
3705         (dims.n):
3706         (dims.d.i):
3707         (dims):
3708         (map_file):
3709         (create):
3710         (of_array):
3711         (slice_left):
3712         (slice_right):
3713         (slice_left_1):
3714         (slice_right_1):
3715         (slice_left_2):
3716         (slice_right_2):
3717         (array1_of_genarray):
3718         (array2_of_genarray):
3719         (array3_of_genarray):
3720         (reshape_1):
3721         (reshape_2):
3722         (reshape_3):
3723         (reshape):
3724         (__):
3725         (contents):
3726         (to_bytes):
3727         (nth):
3728         (length):
3729         (clear):
3730         (reset):
3731         (resize):
3732         (add_substring):
3733         (add_subbytes):
3734         (add_string):
3735         (add_bytes):
3736         (add_buffer):
3737         (add_channel):
3738         (output_buffer):
3739         (closing):
3740         (advance_to_closing):
3741         (advance_to_non_alpha):
3742         (find_ident):
3743         (add_substitute):
3744         (make):
3745         (to_string):
3746         (of_string):
3747         (sub_string):
3748         (extend):
3749         (blit_string):
3750         (concat):
3751         (cat):
3752         (is_space):
3753         (trim):
3754         (escaped):
3755         (uppercase):
3756         (lowercase):
3757         (apply1):
3758         (capitalize):
3759         (uncapitalize):
3760         (index_rec):
3761         (index):
3762         (index_from):
3763         (rindex_rec):
3764         (rindex):
3765         (rindex_from):
3766         (contains_from):
3767         (contains):
3768         (rcontains_from):
3769         (caml_array_sub):
3770         (len):
3771         (caml_array_concat):