670cc5c266202241a19e5a5e0396875afa15a72c
[WebKit-https.git] / JSTests / ChangeLog
1 2019-10-25  Ross Kirsling  <ross.kirsling@sony.com>
2
3         test262-runner should be able to pass JSC a feature flag
4         https://bugs.webkit.org/show_bug.cgi?id=203301
5
6         Reviewed by Keith Miller.
7
8         * test262/config.yaml:
9         Add feature flag mapping.
10         Also skip a few forgotten features as well as BigInt TypedArray tests.
11
12         * test262/expectations.yaml:
13         Regenerate expectations.
14
15 2019-10-23  Keith Miller  <keith_miller@apple.com>
16
17         Undo incidental change from BytecodeIndex class patch
18         https://bugs.webkit.org/show_bug.cgi?id=203339
19
20         Reviewed by Mark Lam.
21
22         * stress/error-source-location-assertion.js: Added.
23
24 2019-10-23  Ross Kirsling  <ross.kirsling@sony.com>
25
26         String.prototype.matchAll should throw on non-global regex
27         https://bugs.webkit.org/show_bug.cgi?id=202838
28
29         Reviewed by Keith Miller.
30
31         * stress/string-matchall.js: Added.
32
33         * test262/expectations.yaml:
34         Mark four test cases as passing.
35
36 2019-10-23  Ross Kirsling  <ross.kirsling@sony.com>
37
38         Update test262 (2019.10.11)
39         https://bugs.webkit.org/show_bug.cgi?id=202861
40
41         Reviewed by Keith Miller.
42
43         * test262/config.yaml:
44         * test262/expectations.yaml:
45         * test262/harness/:
46         * test262/latest-changes-summary.txt:
47         * test262/test/:
48         * test262/test262-Revision.txt:
49
50 2019-10-22  Zhifei Fang  <zhifei_fang@apple.com>
51
52         [JSC tests] Skip slow tests on Watch S3 and Watch S4
53         https://bugs.webkit.org/show_bug.cgi?id=203268
54
55         Reviewed by Saam Barati.
56
57         * microbenchmarks/ArrayBuffer-DataView-alloc-large-long-lived.js:
58         * microbenchmarks/ArrayBuffer-DataView-alloc-long-lived.js:
59         * microbenchmarks/ArrayBuffer-Int32Array-byteOffset.js:
60         * microbenchmarks/ArrayBuffer-Int8Array-alloc-large-long-lived.js:
61         * microbenchmarks/ArrayBuffer-Int8Array-alloc-long-lived-buffer.js:
62         * microbenchmarks/ArrayBuffer-Int8Array-alloc-long-lived.js:
63         * microbenchmarks/ArrayBuffer-Int8Array-alloc.js:
64         * microbenchmarks/DataView-custom-properties.js:
65         * microbenchmarks/Float32Array-matrix-mult.js:
66         * microbenchmarks/Float32Array-to-Float64Array-set.js:
67         * microbenchmarks/Float64Array-alloc-long-lived.js:
68         * microbenchmarks/Float64Array-to-Int16Array-set.js:
69         * microbenchmarks/HashMap-put-get-iterate-keys.js:
70         * microbenchmarks/HashMap-put-get-iterate.js:
71         * microbenchmarks/HashMap-string-put-get-iterate.js:
72         * microbenchmarks/Int16Array-alloc-long-lived.js:
73         * microbenchmarks/Int16Array-bubble-sort-with-byteLength.js:
74         * microbenchmarks/Int16Array-bubble-sort.js:
75         * microbenchmarks/Int16Array-load-int-mul.js:
76         * microbenchmarks/Int16Array-to-Int32Array-set.js:
77         * microbenchmarks/Int32Array-Int8Array-view-alloc.js:
78         * microbenchmarks/Int32Array-alloc-large.js:
79         * microbenchmarks/Int32Array-alloc-long-lived.js:
80         * microbenchmarks/Int32Array-alloc.js:
81         * microbenchmarks/Int8Array-alloc-long-lived.js:
82         * microbenchmarks/Int8Array-load-with-byteLength.js:
83         * microbenchmarks/Int8Array-load.js:
84         * microbenchmarks/JSONP-negative-0.js:
85         * microbenchmarks/Number-isNaN.js:
86         * microbenchmarks/abc-forward-loop-equal.js:
87         * microbenchmarks/abc-postfix-backward-loop.js:
88         * microbenchmarks/abc-simple-backward-loop.js:
89         * microbenchmarks/abc-simple-forward-loop.js:
90         * microbenchmarks/abc-skippy-loop.js:
91         * microbenchmarks/abs-boolean.js:
92         * microbenchmarks/adapt-to-double-divide.js:
93         * microbenchmarks/add-tree.js:
94         * microbenchmarks/aliased-arguments-getbyval.js:
95         * microbenchmarks/allocate-big-object.js:
96         * microbenchmarks/apply-not-apply.js:
97         * microbenchmarks/arguments-named-and-reflective.js:
98         * microbenchmarks/arguments-out-of-bounds.js:
99         * microbenchmarks/arguments-strict-mode.js:
100         * microbenchmarks/arguments.js:
101         * microbenchmarks/arity-mismatch-inlining.js:
102         * microbenchmarks/array-access-polymorphic-structure.js:
103         * microbenchmarks/array-nonarray-polymorhpic-access.js:
104         * microbenchmarks/array-prototype-every.js:
105         * microbenchmarks/array-prototype-forEach.js:
106         * microbenchmarks/array-prototype-join-uninitialized.js:
107         * microbenchmarks/array-prototype-map.js:
108         * microbenchmarks/array-prototype-reduce.js:
109         * microbenchmarks/array-prototype-reduceRight.js:
110         * microbenchmarks/array-prototype-some.js:
111         * microbenchmarks/array-push-0.js:
112         * microbenchmarks/array-push-1.js:
113         * microbenchmarks/array-push-2.js:
114         * microbenchmarks/array-splice-contiguous.js:
115         * microbenchmarks/array-with-double-add.js:
116         * microbenchmarks/array-with-double-increment.js:
117         * microbenchmarks/array-with-double-mul-add.js:
118         * microbenchmarks/array-with-double-sum.js:
119         * microbenchmarks/array-with-int32-add-sub.js:
120         * microbenchmarks/array-with-int32-or-double-sum.js:
121         * microbenchmarks/arrowfunciton-direct-arguments.js:
122         * microbenchmarks/arrowfunciton-reference-arguments.js:
123         * microbenchmarks/arrowfunction-call-in-class-constructor.js:
124         * microbenchmarks/arrowfunction-call-in-class-method.js:
125         * microbenchmarks/arrowfunction-call-in-function.js:
126         * microbenchmarks/arrowfunction-call.js:
127         * microbenchmarks/asmjs_bool_bug.js:
128         * microbenchmarks/assign-custom-setter-polymorphic.js:
129         * microbenchmarks/assign-custom-setter.js:
130         * microbenchmarks/basic-set.js:
131         * microbenchmarks/big-int-mul.js:
132         * microbenchmarks/bigswitch-indirect-symbol.js:
133         * microbenchmarks/bigswitch-indirect.js:
134         * microbenchmarks/bigswitch.js:
135         * microbenchmarks/bit-or-tree.js:
136         * microbenchmarks/bit-test-constant.js:
137         * microbenchmarks/bit-test-load.js:
138         * microbenchmarks/bit-test-nonconstant.js:
139         * microbenchmarks/bit-xor-tree.js:
140         * microbenchmarks/boolean-test.js:
141         * microbenchmarks/bound-function-call.js:
142         * microbenchmarks/bound-function-construction-performance.js:
143         * microbenchmarks/branch-fold.js:
144         * microbenchmarks/branch-on-string-as-boolean.js:
145         * microbenchmarks/bug-153431.js:
146         * microbenchmarks/build-large-object.js:
147         * microbenchmarks/by-val-generic.js:
148         * microbenchmarks/cache-get-variables-under-tdz-in-bytecode-generator.js:
149         * microbenchmarks/call-or-not-call.js:
150         * microbenchmarks/call-spread-apply.js:
151         * microbenchmarks/call-spread-call.js:
152         * microbenchmarks/call-using-spread.js:
153         * microbenchmarks/captured-assignments.js:
154         * microbenchmarks/cast-int-to-double.js:
155         * microbenchmarks/cell-argument.js:
156         * microbenchmarks/cfg-simplify.js:
157         * microbenchmarks/chain-getter-access.js:
158         * microbenchmarks/check-mul-constant.js:
159         * microbenchmarks/check-mul-no-constant.js:
160         * microbenchmarks/check-mul-power-of-two.js:
161         * microbenchmarks/cmpeq-obj-to-obj-other.js:
162         * microbenchmarks/concat-append-one.js:
163         * microbenchmarks/constant-fold-check-type-info-flags.js:
164         * microbenchmarks/constant-test.js:
165         * microbenchmarks/construct-poly-proto-object.js:
166         * microbenchmarks/contiguous-array-to-string.js:
167         * microbenchmarks/create-lots-of-functions.js:
168         * microbenchmarks/create-many-weak-map.js:
169         * microbenchmarks/cse-new-array-buffer.js:
170         * microbenchmarks/cse-new-array.js:
171         * microbenchmarks/custom-accessor-materialized.js:
172         * microbenchmarks/custom-accessor-thin-air.js:
173         * microbenchmarks/custom-accessor.js:
174         * microbenchmarks/custom-setter-getter-as-put-get-by-id.js:
175         * microbenchmarks/custom-value-2.js:
176         * microbenchmarks/custom-value.js:
177         * microbenchmarks/data-view-accesses-2.js:
178         * microbenchmarks/data-view-accesses.js:
179         * microbenchmarks/dataview-cse.js:
180         * microbenchmarks/delay-tear-off-arguments-strictmode.js:
181         * microbenchmarks/delta-blue-try-catch.js:
182         * microbenchmarks/deltablue-for-of.js:
183         * microbenchmarks/deltablue-varargs.js:
184         * microbenchmarks/destructuring-arguments.js:
185         * microbenchmarks/destructuring-parameters-overridden-by-function.js:
186         * microbenchmarks/destructuring-swap.js:
187         * microbenchmarks/dfg-internal-function-call.js:
188         * microbenchmarks/dfg-internal-function-construct.js:
189         * microbenchmarks/dfg-internal-function-not-handled-call.js:
190         * microbenchmarks/dfg-internal-function-not-handled-construct.js:
191         * microbenchmarks/direct-arguments-getbyval.js:
192         * microbenchmarks/direct-arguments-length.js:
193         * microbenchmarks/direct-arguments-overridden-length.js:
194         * microbenchmarks/direct-arguments-possibly-overridden-length.js:
195         * microbenchmarks/direct-call-arity-mismatch.js:
196         * microbenchmarks/direct-call.js:
197         * microbenchmarks/direct-construct-arity-mismatch.js:
198         * microbenchmarks/direct-construct.js:
199         * microbenchmarks/direct-tail-call-arity-mismatch.js:
200         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js:
201         * microbenchmarks/direct-tail-call-inlined-caller.js:
202         * microbenchmarks/direct-tail-call.js:
203         * microbenchmarks/div-boolean-double.js:
204         * microbenchmarks/div-boolean.js:
205         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js:
206         * microbenchmarks/double-array-to-string.js:
207         * microbenchmarks/double-get-by-val-out-of-bounds.js:
208         * microbenchmarks/double-pollution-getbyval.js:
209         * microbenchmarks/double-pollution-putbyoffset.js:
210         * microbenchmarks/double-real-use.js:
211         * microbenchmarks/double-to-int32-typed-array-no-inline.js:
212         * microbenchmarks/double-to-int32-typed-array.js:
213         * microbenchmarks/double-to-uint32-typed-array-no-inline.js:
214         * microbenchmarks/double-to-uint32-typed-array.js:
215         * microbenchmarks/elidable-new-object-dag.js:
216         * microbenchmarks/elidable-new-object-roflcopter.js:
217         * microbenchmarks/elidable-new-object-then-call.js:
218         * microbenchmarks/elidable-new-object-tree.js:
219         * microbenchmarks/empty-string-plus-int.js:
220         * microbenchmarks/emscripten-cube2hash.js:
221         * microbenchmarks/eval-cached.js:
222         * microbenchmarks/eval-code-ftl-reentry.js:
223         * microbenchmarks/eval-code-ftl.js:
224         * microbenchmarks/eval-compute.js:
225         * microbenchmarks/eval-not-eval-compute-args.js:
226         * microbenchmarks/eval-not-eval-compute.js:
227         * microbenchmarks/exit-length-on-plain-object.js:
228         * microbenchmarks/external-arguments-getbyval.js:
229         * microbenchmarks/external-arguments-putbyval.js:
230         * microbenchmarks/fixed-typed-array-storage-var-index.js:
231         * microbenchmarks/fixed-typed-array-storage.js:
232         * microbenchmarks/fold-double-to-int.js:
233         * microbenchmarks/fold-get-by-id-to-multi-get-by-offset-rare-int.js:
234         * microbenchmarks/fold-get-by-id-to-multi-get-by-offset.js:
235         * microbenchmarks/fold-multi-get-by-offset-to-get-by-offset.js:
236         * microbenchmarks/fold-multi-get-by-offset-to-poly-get-by-offset.js:
237         * microbenchmarks/fold-multi-put-by-offset-to-poly-put-by-offset.js:
238         * microbenchmarks/fold-multi-put-by-offset-to-put-by-offset.js:
239         * microbenchmarks/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js:
240         * microbenchmarks/fold-put-by-id-to-multi-put-by-offset.js:
241         * microbenchmarks/fold-put-by-val-with-string-to-multi-put-by-offset.js:
242         * microbenchmarks/fold-put-by-val-with-symbol-to-multi-put-by-offset.js:
243         * microbenchmarks/fold-put-structure.js:
244         * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js:
245         * microbenchmarks/for-of-array.js:
246         * microbenchmarks/for-of-iterate-array-entries.js:
247         * microbenchmarks/for-of-iterate-array-keys.js:
248         * microbenchmarks/for-of-iterate-array-values.js:
249         * microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js:
250         * microbenchmarks/freeze-and-do-work.js:
251         * microbenchmarks/fround.js:
252         * microbenchmarks/ftl-library-inlining-dataview.js:
253         * microbenchmarks/ftl-library-inlining.js:
254         * microbenchmarks/ftl-polymorphic-StringFromCharCode.js:
255         * microbenchmarks/function-call.js:
256         * microbenchmarks/function-dot-apply.js:
257         * microbenchmarks/function-test.js:
258         * microbenchmarks/function-with-eval.js:
259         * microbenchmarks/gcse-poly-get-less-obvious.js:
260         * microbenchmarks/gcse-poly-get.js:
261         * microbenchmarks/gcse.js:
262         * microbenchmarks/generate-multiple-llint-entrypoints.js:
263         * microbenchmarks/generator-create.js:
264         * microbenchmarks/generator-fib.js:
265         * microbenchmarks/generator-function-create.js:
266         * microbenchmarks/generator-sunspider-access-nsieve.js:
267         * microbenchmarks/generator-with-several-types.js:
268         * microbenchmarks/get-by-id-bimorphic-check-structure-elimination-simple.js:
269         * microbenchmarks/get-by-id-bimorphic-check-structure-elimination.js:
270         * microbenchmarks/get-by-id-chain-from-try-block.js:
271         * microbenchmarks/get-by-id-check-structure-elimination.js:
272         * microbenchmarks/get-by-id-proto-or-self.js:
273         * microbenchmarks/get-by-id-quadmorphic-check-structure-elimination-simple.js:
274         * microbenchmarks/get-by-id-self-or-proto.js:
275         * microbenchmarks/get-by-val-negative-array-index.js:
276         * microbenchmarks/get-by-val-out-of-bounds.js:
277         * microbenchmarks/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js:
278         * microbenchmarks/get-by-val-with-string-bimorphic-check-structure-elimination.js:
279         * microbenchmarks/get-by-val-with-string-chain-from-try-block.js:
280         * microbenchmarks/get-by-val-with-string-check-structure-elimination.js:
281         * microbenchmarks/get-by-val-with-string-proto-or-self.js:
282         * microbenchmarks/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js:
283         * microbenchmarks/get-by-val-with-string-self-or-proto.js:
284         * microbenchmarks/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js:
285         * microbenchmarks/get-by-val-with-symbol-bimorphic-check-structure-elimination.js:
286         * microbenchmarks/get-by-val-with-symbol-chain-from-try-block.js:
287         * microbenchmarks/get-by-val-with-symbol-check-structure-elimination.js:
288         * microbenchmarks/get-by-val-with-symbol-proto-or-self.js:
289         * microbenchmarks/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js:
290         * microbenchmarks/get-by-val-with-symbol-self-or-proto.js:
291         * microbenchmarks/get-custom-getter.js:
292         * microbenchmarks/get_by_val-Int32Array.js:
293         * microbenchmarks/get_callee_monomorphic.js:
294         * microbenchmarks/get_callee_polymorphic.js:
295         * microbenchmarks/getter-no-activation.js:
296         * microbenchmarks/getter-prototype.js:
297         * microbenchmarks/getter-richards-try-catch.js:
298         * microbenchmarks/getter-richards.js:
299         * microbenchmarks/getter.js:
300         * microbenchmarks/global-code-ftl.js:
301         * microbenchmarks/global-isNaN.js:
302         * microbenchmarks/global-object-access-with-mutating-structure.js:
303         * microbenchmarks/global-var-const-infer-fire-from-opt.js:
304         * microbenchmarks/global-var-const-infer.js:
305         * microbenchmarks/hard-overflow-check-equal.js:
306         * microbenchmarks/hard-overflow-check.js:
307         * microbenchmarks/has-own-property-name-cache.js:
308         * microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js:
309         * microbenchmarks/hoist-make-rope.js:
310         * microbenchmarks/hoist-poly-check-structure-effectful-loop.js:
311         * microbenchmarks/hoist-poly-check-structure.js:
312         * microbenchmarks/implicit-bigswitch-indirect-symbol.js:
313         * microbenchmarks/imul-double-only.js:
314         * microbenchmarks/imul-int-only.js:
315         * microbenchmarks/imul-mixed.js:
316         * microbenchmarks/in-by-id-match.js:
317         * microbenchmarks/in-by-id-removed.js:
318         * microbenchmarks/in-four-cases.js:
319         * microbenchmarks/in-one-case-false.js:
320         * microbenchmarks/in-one-case-true.js:
321         * microbenchmarks/in-two-cases.js:
322         * microbenchmarks/indexed-properties-in-objects.js:
323         * microbenchmarks/infer-closure-const-then-mov-no-inline.js:
324         * microbenchmarks/infer-closure-const-then-mov.js:
325         * microbenchmarks/infer-closure-const-then-put-to-scope-no-inline.js:
326         * microbenchmarks/infer-closure-const-then-put-to-scope.js:
327         * microbenchmarks/infer-closure-const-then-reenter-no-inline.js:
328         * microbenchmarks/infer-closure-const-then-reenter.js:
329         * microbenchmarks/infer-constant-global-property.js:
330         * microbenchmarks/infer-constant-property.js:
331         * microbenchmarks/infer-one-time-closure-ten-vars.js:
332         * microbenchmarks/infer-one-time-closure-two-vars.js:
333         * microbenchmarks/infer-one-time-closure.js:
334         * microbenchmarks/infer-one-time-deep-closure.js:
335         * microbenchmarks/inline-arguments-access.js:
336         * microbenchmarks/inline-arguments-aliased-access.js:
337         * microbenchmarks/inline-arguments-local-escape.js:
338         * microbenchmarks/inline-get-scoped-var.js:
339         * microbenchmarks/inlined-put-by-id-transition.js:
340         * microbenchmarks/inlined-put-by-val-with-string-transition.js:
341         * microbenchmarks/inlined-put-by-val-with-symbol-transition.js:
342         * microbenchmarks/instanceof-always-hit-one.js:
343         * microbenchmarks/instanceof-always-hit-two.js:
344         * microbenchmarks/instanceof-bound.js:
345         * microbenchmarks/instanceof-dynamic.js:
346         * microbenchmarks/instanceof-sometimes-hit.js:
347         * microbenchmarks/instanceof-tricky-dynamic.js:
348         * microbenchmarks/int-or-other-abs-then-get-by-val.js:
349         * microbenchmarks/int-or-other-abs-zero-then-get-by-val.js:
350         * microbenchmarks/int-or-other-add-then-get-by-val.js:
351         * microbenchmarks/int-or-other-add.js:
352         * microbenchmarks/int-or-other-div-then-get-by-val.js:
353         * microbenchmarks/int-or-other-max-then-get-by-val.js:
354         * microbenchmarks/int-or-other-min-then-get-by-val.js:
355         * microbenchmarks/int-or-other-mod-then-get-by-val.js:
356         * microbenchmarks/int-or-other-mul-then-get-by-val.js:
357         * microbenchmarks/int-or-other-neg-then-get-by-val.js:
358         * microbenchmarks/int-or-other-neg-zero-then-get-by-val.js:
359         * microbenchmarks/int-or-other-sub-then-get-by-val.js:
360         * microbenchmarks/int-or-other-sub.js:
361         * microbenchmarks/int-overflow-local.js:
362         * microbenchmarks/int32-array-to-string.js:
363         * microbenchmarks/int52-back-and-forth.js:
364         * microbenchmarks/int52-rand-function.js:
365         * microbenchmarks/int52-spill.js:
366         * microbenchmarks/int8-out-of-bounds.js:
367         * microbenchmarks/integer-divide.js:
368         * microbenchmarks/integer-modulo.js:
369         * microbenchmarks/is-array-for-array.js:
370         * microbenchmarks/is-array-for-mixed-case.js:
371         * microbenchmarks/is-array-for-non-array-object.js:
372         * microbenchmarks/is-array-for-proxy.js:
373         * microbenchmarks/is-boolean-fold-tricky.js:
374         * microbenchmarks/is-boolean-fold.js:
375         * microbenchmarks/is-function-fold-tricky-internal-function.js:
376         * microbenchmarks/is-function-fold-tricky.js:
377         * microbenchmarks/is-function-fold.js:
378         * microbenchmarks/is-not-cell-speculation-for-empty-value.js:
379         * microbenchmarks/is-number-fold-tricky.js:
380         * microbenchmarks/is-number-fold.js:
381         * microbenchmarks/is-object-or-null-fold-functions.js:
382         * microbenchmarks/is-object-or-null-fold-less-tricky.js:
383         * microbenchmarks/is-object-or-null-fold-tricky.js:
384         * microbenchmarks/is-object-or-null-fold.js:
385         * microbenchmarks/is-object-or-null-trickier-function.js:
386         * microbenchmarks/is-object-or-null-trickier-internal-function.js:
387         * microbenchmarks/is-object-or-null-tricky-function.js:
388         * microbenchmarks/is-object-or-null-tricky-internal-function.js:
389         * microbenchmarks/is-string-fold-tricky.js:
390         * microbenchmarks/is-string-fold.js:
391         * microbenchmarks/is-symbol-mixed.js:
392         * microbenchmarks/is-symbol.js:
393         * microbenchmarks/is-undefined-fold-tricky.js:
394         * microbenchmarks/is-undefined-fold.js:
395         * microbenchmarks/json-parse-array-reviver-same-value.js:
396         * microbenchmarks/json-parse-array-reviver.js:
397         * microbenchmarks/json-parse-object-reviver-same-value.js:
398         * microbenchmarks/json-parse-object-reviver.js:
399         * microbenchmarks/large-empty-array-join-resolve-rope.js:
400         * microbenchmarks/large-empty-array-join.js:
401         * microbenchmarks/large-int-captured.js:
402         * microbenchmarks/large-int-neg.js:
403         * microbenchmarks/large-int.js:
404         * microbenchmarks/large-map-iteration.js:
405         * microbenchmarks/lazy-array-species-watchpoints.js:
406         * microbenchmarks/let-for-in.js:
407         * microbenchmarks/licm-dragons-out-of-bounds.js:
408         * microbenchmarks/licm-dragons-overflow.js:
409         * microbenchmarks/licm-dragons-two-structures.js:
410         * microbenchmarks/licm-dragons.js:
411         * microbenchmarks/load-varargs-elimination.js:
412         * microbenchmarks/locale-compare.js:
413         * microbenchmarks/logical-not-weird-types.js:
414         * microbenchmarks/logical-not.js:
415         * microbenchmarks/loop-osr-with-arity-mismatch.js:
416         * microbenchmarks/lots-of-fields.js:
417         * microbenchmarks/make-indexed-storage.js:
418         * microbenchmarks/make-rope-cse.js:
419         * microbenchmarks/make-rope.js:
420         * microbenchmarks/many-foreach-calls.js:
421         * microbenchmarks/many-repeat-stores.js:
422         * microbenchmarks/map-for-each.js:
423         * microbenchmarks/map-for-of.js:
424         * microbenchmarks/map-has-and-set.js:
425         * microbenchmarks/map-has-get-cse-opportunity.js:
426         * microbenchmarks/map-key-well-typed.js:
427         * microbenchmarks/map-rehash.js:
428         * microbenchmarks/marsaglia-larger-ints.js:
429         * microbenchmarks/marsaglia-osr-entry.js:
430         * microbenchmarks/math-random.js:
431         * microbenchmarks/math-trunc.js:
432         * microbenchmarks/math-with-out-of-bounds-array-values.js:
433         * microbenchmarks/max-boolean.js:
434         * microbenchmarks/megamorphic-load.js:
435         * microbenchmarks/memcpy-loop.js:
436         * microbenchmarks/memcpy-typed-loop-large.js:
437         * microbenchmarks/memcpy-typed-loop-small.js:
438         * microbenchmarks/memcpy-typed-loop-speculative.js:
439         * microbenchmarks/memcpy-typed-loop.js:
440         * microbenchmarks/memcpy-wasm-large.js:
441         * microbenchmarks/memcpy-wasm-medium.js:
442         * microbenchmarks/memcpy-wasm-small.js:
443         * microbenchmarks/memcpy-wasm.js:
444         * microbenchmarks/method-on-number.js:
445         * microbenchmarks/min-boolean.js:
446         * microbenchmarks/minus-boolean-double.js:
447         * microbenchmarks/minus-boolean.js:
448         * microbenchmarks/misc-strict-eq.js:
449         * microbenchmarks/mod-boolean-double.js:
450         * microbenchmarks/mod-boolean.js:
451         * microbenchmarks/mod-untyped.js:
452         * microbenchmarks/mul-boolean-double.js:
453         * microbenchmarks/mul-boolean.js:
454         * microbenchmarks/mul-immediate-sub.js:
455         * microbenchmarks/neg-boolean.js:
456         * microbenchmarks/negative-zero-divide.js:
457         * microbenchmarks/negative-zero-modulo.js:
458         * microbenchmarks/negative-zero-negate.js:
459         * microbenchmarks/new-array-buffer-dead.js:
460         * microbenchmarks/new-array-buffer-push.js:
461         * microbenchmarks/new-array-buffer-vector-profile.js:
462         * microbenchmarks/new-array-dead.js:
463         * microbenchmarks/new-array-push.js:
464         * microbenchmarks/new-error.js:
465         * microbenchmarks/no-inline-constructor.js:
466         * microbenchmarks/number-test.js:
467         * microbenchmarks/number-to-string-strength-reduction.js:
468         * microbenchmarks/number-to-string-with-add-empty.js:
469         * microbenchmarks/number-to-string-with-add-in-loop.js:
470         * microbenchmarks/number-to-string-with-add.js:
471         * microbenchmarks/number-to-string-with-radix-10.js:
472         * microbenchmarks/number-to-string-with-radix-cse.js:
473         * microbenchmarks/number-to-string-with-radix.js:
474         * microbenchmarks/object-and.js:
475         * microbenchmarks/object-closure-call.js:
476         * microbenchmarks/object-create-constant-prototype.js:
477         * microbenchmarks/object-create-null.js:
478         * microbenchmarks/object-create-unknown-object-prototype.js:
479         * microbenchmarks/object-create-untyped-prototype.js:
480         * microbenchmarks/object-entries.js:
481         * microbenchmarks/object-get-own-property-symbols-on-large-array.js:
482         * microbenchmarks/object-get-own-property-symbols.js:
483         * microbenchmarks/object-int-add-array.js:
484         * microbenchmarks/object-int-add.js:
485         * microbenchmarks/object-int-and-array.js:
486         * microbenchmarks/object-int-mul-array.js:
487         * microbenchmarks/object-int-sub-array.js:
488         * microbenchmarks/object-int-sub.js:
489         * microbenchmarks/object-is.js:
490         * microbenchmarks/object-iterate-symbols.js:
491         * microbenchmarks/object-iterate.js:
492         * microbenchmarks/object-keys-map-values.js:
493         * microbenchmarks/object-keys.js:
494         * microbenchmarks/object-lshift.js:
495         * microbenchmarks/object-or.js:
496         * microbenchmarks/object-rshift.js:
497         * microbenchmarks/object-test.js:
498         * microbenchmarks/object-urshift.js:
499         * microbenchmarks/object-values.js:
500         * microbenchmarks/object-xor.js:
501         * microbenchmarks/obvious-sink-pathology-taken.js:
502         * microbenchmarks/obvious-sink-pathology.js:
503         * microbenchmarks/obviously-elidable-new-object.js:
504         * microbenchmarks/plus-boolean-arith.js:
505         * microbenchmarks/plus-boolean-double.js:
506         * microbenchmarks/plus-boolean.js:
507         * microbenchmarks/poly-chain-access-different-prototypes-simple.js:
508         * microbenchmarks/poly-chain-access-different-prototypes.js:
509         * microbenchmarks/poly-chain-access-simpler.js:
510         * microbenchmarks/poly-chain-access.js:
511         * microbenchmarks/poly-proto-access.js:
512         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js:
513         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js:
514         * microbenchmarks/poly-proto-put-transition-speed.js:
515         * microbenchmarks/poly-proto-setter-speed.js:
516         * microbenchmarks/poly-stricteq.js:
517         * microbenchmarks/polymorphic-array-call.js:
518         * microbenchmarks/polymorphic-get-by-id.js:
519         * microbenchmarks/polymorphic-put-by-id.js:
520         * microbenchmarks/polymorphic-put-by-val-with-string.js:
521         * microbenchmarks/polymorphic-put-by-val-with-symbol.js:
522         * microbenchmarks/polymorphic-structure.js:
523         * microbenchmarks/polyvariant-get-by-id-shorter-tower.js:
524         * microbenchmarks/polyvariant-get-by-id-tower.js:
525         * microbenchmarks/polyvariant-monomorphic-get-by-id.js:
526         * microbenchmarks/prevent-extensions-and-do-work.js:
527         * microbenchmarks/promise-creation-many.js:
528         * microbenchmarks/proto-getter-access.js:
529         * microbenchmarks/prototype-access-with-mutating-prototype.js:
530         * microbenchmarks/put-by-id-replace-and-transition.js:
531         * microbenchmarks/put-by-id-slightly-polymorphic.js:
532         * microbenchmarks/put-by-id-transition-with-indexing-header.js:
533         * microbenchmarks/put-by-id.js:
534         * microbenchmarks/put-by-val-direct-large-index.js:
535         * microbenchmarks/put-by-val-direct.js:
536         * microbenchmarks/put-by-val-large-index-blank-indexing-type.js:
537         * microbenchmarks/put-by-val-machine-int.js:
538         * microbenchmarks/put-by-val-negative-array-index.js:
539         * microbenchmarks/put-by-val-with-string-replace-and-transition.js:
540         * microbenchmarks/put-by-val-with-string-slightly-polymorphic.js:
541         * microbenchmarks/put-by-val-with-string.js:
542         * microbenchmarks/put-by-val-with-symbol-replace-and-transition.js:
543         * microbenchmarks/put-by-val-with-symbol-slightly-polymorphic.js:
544         * microbenchmarks/put-by-val-with-symbol.js:
545         * microbenchmarks/rare-osr-exit-on-local.js:
546         * microbenchmarks/raytrace-with-empty-try-catch.js:
547         * microbenchmarks/raytrace-with-try-catch.js:
548         * microbenchmarks/regexp-exec.js:
549         * microbenchmarks/regexp-last-index.js:
550         * microbenchmarks/regexp-nested-nonzero-min-counted-parens.js:
551         * microbenchmarks/regexp-prototype-is-not-instance.js:
552         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
553         * microbenchmarks/regexp-prototype-search-observable-side-effects2.js:
554         * microbenchmarks/regexp-prototype-split-observable-side-effects.js:
555         * microbenchmarks/regexp-prototype-split-observable-side-effects2.js:
556         * microbenchmarks/regexp-prototype-split-observable-side-effects3-flags.js:
557         * microbenchmarks/regexp-prototype-split-observable-side-effects3-global.js:
558         * microbenchmarks/regexp-prototype-split-observable-side-effects3-ignoreCase.js:
559         * microbenchmarks/regexp-prototype-split-observable-side-effects3-multiline.js:
560         * microbenchmarks/regexp-prototype-split-observable-side-effects3-sticky.js:
561         * microbenchmarks/regexp-prototype-split-observable-side-effects3-unicode.js:
562         * microbenchmarks/regexp-prototype-split-observable-side-effects4.js:
563         * microbenchmarks/regexp-prototype-test-observable-side-effects.js:
564         * microbenchmarks/regexp-prototype-test-observable-side-effects2.js:
565         * microbenchmarks/regexp-set-last-index.js:
566         * microbenchmarks/regexp-u-global-es5.js:
567         * microbenchmarks/regexp-u-global-es6.js:
568         * microbenchmarks/register-pressure-from-osr.js:
569         * microbenchmarks/repeat-multi-get-by-offset.js:
570         * microbenchmarks/rest-parameter-construction-performance.js:
571         * microbenchmarks/richards-empty-try-catch.js:
572         * microbenchmarks/richards-try-catch.js:
573         * microbenchmarks/scoped-arguments-length.js:
574         * microbenchmarks/scoped-arguments-overridden-length.js:
575         * microbenchmarks/scoped-arguments-possibly-overridden-length.js:
576         * microbenchmarks/seal-and-do-work.js:
577         * microbenchmarks/set-for-each.js:
578         * microbenchmarks/set-for-of.js:
579         * microbenchmarks/setter-prototype.js:
580         * microbenchmarks/setter.js:
581         * microbenchmarks/simple-activation-demo.js:
582         * microbenchmarks/simple-getter-access.js:
583         * microbenchmarks/simple-poly-call-nested.js:
584         * microbenchmarks/simple-poly-call.js:
585         * microbenchmarks/simple-regexp-exec-folding-fail.js:
586         * microbenchmarks/simple-regexp-exec-folding.js:
587         * microbenchmarks/simple-regexp-test-folding-fail-with-hoisted-regexp.js:
588         * microbenchmarks/simple-regexp-test-folding-fail.js:
589         * microbenchmarks/simple-regexp-test-folding-with-hoisted-regexp.js:
590         * microbenchmarks/simple-regexp-test-folding.js:
591         * microbenchmarks/sin-boolean.js:
592         * microbenchmarks/singleton-scope.js:
593         * microbenchmarks/sink-function.js:
594         * microbenchmarks/sink-huge-activation.js:
595         * microbenchmarks/sinkable-new-object-dag.js:
596         * microbenchmarks/sinkable-new-object-taken.js:
597         * microbenchmarks/sinkable-new-object-with-builtin-constructor.js:
598         * microbenchmarks/sinkable-new-object.js:
599         * microbenchmarks/slow-array-profile-convergence.js:
600         * microbenchmarks/slow-convergence.js:
601         * microbenchmarks/slow-ternaries.js:
602         * microbenchmarks/sorting-benchmark.js:
603         * microbenchmarks/sparse-conditional.js:
604         * microbenchmarks/sparse-set.js:
605         * microbenchmarks/splice-to-remove.js:
606         * microbenchmarks/strcat-const.js:
607         * microbenchmarks/strcat-length-const.js:
608         * microbenchmarks/strict-osr-entry.js:
609         * microbenchmarks/string-char-code-at.js:
610         * microbenchmarks/string-concat-convert.js:
611         * microbenchmarks/string-concat-long-convert.js:
612         * microbenchmarks/string-concat-long.js:
613         * microbenchmarks/string-concat-object.js:
614         * microbenchmarks/string-concat-pair-object.js:
615         * microbenchmarks/string-concat-pair-simple.js:
616         * microbenchmarks/string-concat-simple.js:
617         * microbenchmarks/string-concat.js:
618         * microbenchmarks/string-cons-repeat.js:
619         * microbenchmarks/string-cons-tower.js:
620         * microbenchmarks/string-equality.js:
621         * microbenchmarks/string-from-char-code.js:
622         * microbenchmarks/string-get-by-val-big-char.js:
623         * microbenchmarks/string-get-by-val-out-of-bounds-insane.js:
624         * microbenchmarks/string-get-by-val-out-of-bounds.js:
625         * microbenchmarks/string-get-by-val.js:
626         * microbenchmarks/string-hash.js:
627         * microbenchmarks/string-long-ident-equality.js:
628         * microbenchmarks/string-object-to-string.js:
629         * microbenchmarks/string-object-value-of.js:
630         * microbenchmarks/string-out-of-bounds.js:
631         * microbenchmarks/string-prototype-search-observable-side-effects.js:
632         * microbenchmarks/string-prototype-search-observable-side-effects2.js:
633         * microbenchmarks/string-prototype-search-observable-side-effects3.js:
634         * microbenchmarks/string-prototype-search-observable-side-effects4.js:
635         * microbenchmarks/string-prototype-split-observable-side-effects.js:
636         * microbenchmarks/string-prototype-split-observable-side-effects2.js:
637         * microbenchmarks/string-prototype-split-observable-side-effects3-flags.js:
638         * microbenchmarks/string-prototype-split-observable-side-effects3-global.js:
639         * microbenchmarks/string-prototype-split-observable-side-effects3-ignoreCase.js:
640         * microbenchmarks/string-prototype-split-observable-side-effects3-multiline.js:
641         * microbenchmarks/string-prototype-split-observable-side-effects3-sticky.js:
642         * microbenchmarks/string-prototype-split-observable-side-effects3-unicode.js:
643         * microbenchmarks/string-prototype-split-observable-side-effects4.js:
644         * microbenchmarks/string-repeat-arith.js:
645         * microbenchmarks/string-repeat-not-resolving-fixed.js:
646         * microbenchmarks/string-repeat-not-resolving-no-inline.js:
647         * microbenchmarks/string-repeat-not-resolving.js:
648         * microbenchmarks/string-repeat-resolving-fixed.js:
649         * microbenchmarks/string-repeat-resolving-no-inline.js:
650         * microbenchmarks/string-repeat-resolving.js:
651         * microbenchmarks/string-repeat-single-not-resolving.js:
652         * microbenchmarks/string-repeat-single-resolving.js:
653         * microbenchmarks/string-repeat-small-not-resolving.js:
654         * microbenchmarks/string-repeat-small-resolving.js:
655         * microbenchmarks/string-replace-empty.js:
656         * microbenchmarks/string-replace-generic.js:
657         * microbenchmarks/string-replace.js:
658         * microbenchmarks/string-rope-with-object.js:
659         * microbenchmarks/string-slice-empty.js:
660         * microbenchmarks/string-slice-one-char.js:
661         * microbenchmarks/string-slice.js:
662         * microbenchmarks/string-sub.js:
663         * microbenchmarks/string-test.js:
664         * microbenchmarks/string-transcoding.js:
665         * microbenchmarks/string-var-equality.js:
666         * microbenchmarks/stringalloc.js:
667         * microbenchmarks/structure-hoist-over-transitions.js:
668         * microbenchmarks/substring-concat-weird.js:
669         * microbenchmarks/substring-concat.js:
670         * microbenchmarks/substring.js:
671         * microbenchmarks/super-get-by-id-with-this-monomorphic.js:
672         * microbenchmarks/super-get-by-id-with-this-polymorphic.js:
673         * microbenchmarks/super-get-by-val-with-this-monomorphic.js:
674         * microbenchmarks/super-get-by-val-with-this-polymorphic.js:
675         * microbenchmarks/super-getter.js:
676         * microbenchmarks/switch-char-constant.js:
677         * microbenchmarks/switch-char.js:
678         * microbenchmarks/switch-constant.js:
679         * microbenchmarks/switch-string-basic-big-var.js:
680         * microbenchmarks/switch-string-basic-big.js:
681         * microbenchmarks/switch-string-basic-var.js:
682         * microbenchmarks/switch-string-basic.js:
683         * microbenchmarks/switch-string-big-length-tower-var.js:
684         * microbenchmarks/switch-string-length-tower-var.js:
685         * microbenchmarks/switch-string-length-tower.js:
686         * microbenchmarks/switch-string-short.js:
687         * microbenchmarks/switch.js:
688         * microbenchmarks/switching-size-classes.js:
689         * microbenchmarks/symbol-creation.js:
690         * microbenchmarks/symbol-tostringtag.js:
691         * microbenchmarks/tan.js:
692         * microbenchmarks/tear-off-arguments-simple.js:
693         * microbenchmarks/tear-off-arguments.js:
694         * microbenchmarks/template-string-array.js:
695         * microbenchmarks/temporal-structure.js:
696         * microbenchmarks/throw.js:
697         * microbenchmarks/to-int32-boolean.js:
698         * microbenchmarks/to-number-boolean.js:
699         * microbenchmarks/to-number-constructor-number-string-number-string.js:
700         * microbenchmarks/to-number-constructor-only-number.js:
701         * microbenchmarks/to-number-constructor-only-string.js:
702         * microbenchmarks/to-number-constructor-string-number-string-number.js:
703         * microbenchmarks/to-number-number-string-number-string.js:
704         * microbenchmarks/to-number-only-number.js:
705         * microbenchmarks/to-number-only-string.js:
706         * microbenchmarks/to-number-string-number-string-number.js:
707         * microbenchmarks/to-string-on-cow-array.js:
708         * microbenchmarks/try-catch-get-by-val-cloned-arguments.js:
709         * microbenchmarks/try-catch-get-by-val-direct-arguments.js:
710         * microbenchmarks/try-catch-get-by-val-scoped-arguments.js:
711         * microbenchmarks/try-catch-word-count.js:
712         * microbenchmarks/try-get-by-id-basic.js:
713         * microbenchmarks/try-get-by-id-polymorphic.js:
714         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
715         * microbenchmarks/typed-array-subarray.js:
716         * microbenchmarks/typed-array-sum.js:
717         * microbenchmarks/undefined-test.js:
718         * microbenchmarks/unprofiled-licm.js:
719         * microbenchmarks/untyped-string-from-char-code.js:
720         * microbenchmarks/v8-raytrace-with-empty-try-catch.js:
721         * microbenchmarks/v8-raytrace-with-try-catch.js:
722         * microbenchmarks/v8-regexp-search.js:
723         * microbenchmarks/varargs-call.js:
724         * microbenchmarks/varargs-construct-inline.js:
725         * microbenchmarks/varargs-construct.js:
726         * microbenchmarks/varargs-inline.js:
727         * microbenchmarks/varargs-strict-mode.js:
728         * microbenchmarks/varargs.js:
729         * microbenchmarks/vector-length-hint-array-constructor.js:
730         * microbenchmarks/vector-length-hint-new-array.js:
731         * microbenchmarks/weak-map-key.js:
732         * microbenchmarks/weak-set-key.js:
733         * microbenchmarks/weird-inlining-const-prop.js:
734
735 2019-10-22  Mark Lam  <mark.lam@apple.com>
736
737         Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky().
738         https://bugs.webkit.org/show_bug.cgi?id=203230
739         <rdar://problem/56460749>
740
741         Reviewed by Robin Morisset.
742
743         * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Added.
744
745 2019-10-21  Mark Lam  <mark.lam@apple.com>
746
747         Rolling out r251411: Fix is incorrect.
748         https://bugs.webkit.org/show_bug.cgi?id=203230
749
750         Not reviewed.
751
752         * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Removed.
753
754 2019-10-21  Mark Lam  <mark.lam@apple.com>
755
756         Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky().
757         https://bugs.webkit.org/show_bug.cgi?id=203230
758         <rdar://problem/56460749>
759
760         Reviewed by Robin Morisset.
761
762         * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Added.
763
764 2019-10-21  Saam Barati  <sbarati@apple.com>
765
766         ValuePow's constant folding rule differs from what the runtime does
767         https://bugs.webkit.org/show_bug.cgi?id=203220
768         <rdar://problem/56181441>
769
770         Reviewed by Yusuke Suzuki.
771
772         * value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js: Added.
773         (foo):
774
775 2019-10-21  Mark Lam  <mark.lam@apple.com>
776
777         Fix missing exception check in JSON Stringifier.
778         https://bugs.webkit.org/show_bug.cgi?id=203227
779         <rdar://problem/56459854>
780
781         Reviewed by Keith Miller.
782
783         * stress/missing-exception-check-in-josn-stringifier.js: Added.
784
785 2019-10-21  Saam Barati  <sbarati@apple.com>
786
787         JSON.parse has bad is array assert
788         https://bugs.webkit.org/show_bug.cgi?id=203207
789         <rdar://problem/56366913>
790
791         Reviewed by Yusuke Suzuki.
792
793         * stress/json-parse-array-prototype-is-array-assert.js: Added.
794         (assert):
795
796 2019-10-21  Robin Morisset  <rmorisset@apple.com>
797
798         Throw the right exception upon memory exhaustion in Array::slice
799         https://bugs.webkit.org/show_bug.cgi?id=202650
800
801         Reviewed by Saam Barati.
802
803         * stress/array-slice-memory-exhaustion.js: Added.
804         (foo):
805
806 2019-10-21  Robin Morisset  <rmorisset@apple.com>
807
808         Post increment/decrement should only call ToNumber once
809         https://bugs.webkit.org/show_bug.cgi?id=202711
810
811         Reviewed by Saam Barati.
812
813         * stress/postinc-custom-valueOf.js: Added.
814         (postInc):
815         (postDec):
816
817 2019-10-18  Yusuke Suzuki  <ysuzuki@apple.com>
818
819         [JSC] DFG::CommonData modification by DFG reallyAdd should be guarded by CodeBlock's lock
820         https://bugs.webkit.org/show_bug.cgi?id=203177
821
822         Reviewed by Mark Lam.
823
824         * stress/dfg-really-add-locking.js: Added.
825
826 2019-10-17  Mark Lam  <mark.lam@apple.com>
827
828         Add missing checks after calls to the sameValue() JSValue comparator.
829         https://bugs.webkit.org/show_bug.cgi?id=203126
830         <rdar://problem/56366561>
831
832         Reviewed by Saam Barati.
833
834         * stress/validate-exception-check-in-proxy-object-put.js: Added.
835
836 2019-10-17  Saam Barati  <sbarati@apple.com>
837
838         GetByVal and PutByVal on ArrayStorage need to use the same AbstractHeap
839         https://bugs.webkit.org/show_bug.cgi?id=203124
840         <rdar://problem/55988183>
841
842         Reviewed by Yusuke Suzuki.
843
844         * stress/licm-array-storage-get-and-put-by-val.js: Added.
845         (assert):
846         (foo):
847
848 2019-10-16  Keith Miller  <keith_miller@apple.com>
849
850         Move assert in Wasm::Plan::fail.
851         https://bugs.webkit.org/show_bug.cgi?id=203052
852
853         Reviewed by Mark Lam.
854
855         * wasm/regress/wasm-plan-fail-bad-error-message-assert.js: Added.
856         (Binary):
857         (Binary.prototype.trunc_buffer):
858         (Binary.prototype.emit_leb_u):
859         (Binary.prototype.emit_u32v):
860         (Binary.prototype.emit_bytes):
861         (Binary.prototype.emit_header):
862         (__f_576):
863         (__f_587):
864
865 2019-10-15  Mark Lam  <mark.lam@apple.com>
866
867         operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string.
868         https://bugs.webkit.org/show_bug.cgi?id=202312
869         <rdar://problem/55782280>
870
871         Reviewed by Yusuke Suzuki.
872
873         * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js: Added.
874         * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js: Added.
875         * stress/switch-on-char-llint-rope.js:
876         - Changed this test to make a new rope string for each iterations.  Otherwise,
877           the rope will get resolved, and subsequent tiers will not be testing with a rope.
878
879 2019-10-14  Yusuke Suzuki  <ysuzuki@apple.com>
880
881         [JSC] GetterSetter should be JSCell, not JSObject
882         https://bugs.webkit.org/show_bug.cgi?id=202656
883
884         Reviewed by Tadeu Zagallo and Saam Barati.
885
886         * stress/getter-setter-should-be-cell.js: Added.
887         (foo.with.):
888         (foo.with.get for):
889         (foo.with.bar):
890         (foo):
891
892 2019-10-14  Saam Barati  <sbarati@apple.com>
893
894         Canonicalize how we prepare the prototype chain for inline caching
895         https://bugs.webkit.org/show_bug.cgi?id=202827
896         <rdar://problem/56193919>
897
898         Reviewed by Yusuke Suzuki.
899
900         * stress/cache-correct-offset-after-flattening.js: Added.
901         (assert):
902
903 2019-10-14  Paulo Matos  <pmatos@igalia.com>
904
905         Skip memcpy-typed-loop timing out on ARMv7 pending investigation
906         https://bugs.webkit.org/show_bug.cgi?id=202923
907
908         Reviewed by Adrian Perez de Castro.
909
910         * microbenchmarks/memcpy-typed-loop.js:
911
912 2019-10-11  Keith Miller  <keith_miller@apple.com>
913
914         Wasm B3IRGenerator should use arguments for control data.
915         https://bugs.webkit.org/show_bug.cgi?id=202855
916
917         Reviewed by Yusuke Suzuki.
918
919         * wasm/stress/loop-more-args-than-results.js: Added.
920
921 2019-10-10  Mark Lam  <mark.lam@apple.com>
922
923         Modify JSTests/stress/string-overflow-createError-*.js tests to allow an OOME result.
924         https://bugs.webkit.org/show_bug.cgi?id=202828
925
926         Reviewed by Yusuke Suzuki.
927
928         The tests intentionally allocate a very large string.  Hence, for some memory
929         limited configurations, it is perfectly reasonable for the test to throw an Out
930         Of Memory error.
931
932         * stress/string-overflow-createError-builder.js:
933         * stress/string-overflow-createError-fit.js:
934
935 2019-10-09  Yusuke Suzuki  <ysuzuki@apple.com>
936
937         Unreviewed, roll out r250878
938         https://bugs.webkit.org/show_bug.cgi?id=202656
939
940         Breaking vimeo page.
941
942         * stress/getter-setter-should-be-cell.js: Removed.
943
944 2019-10-08  Yusuke Suzuki  <ysuzuki@apple.com>
945
946         [JSC] GetterSetter should be JSCell, not JSObject
947         https://bugs.webkit.org/show_bug.cgi?id=202656
948
949         Reviewed by Tadeu Zagallo and Saam Barati.
950
951         * stress/getter-setter-should-be-cell.js: Added.
952         (foo.with.):
953         (foo.with.get for):
954         (foo.with.bar):
955         (foo):
956
957 2019-10-08  Alexey Shvayka  <shvaikalesh@gmail.com>
958
959         JSON.parse incorrectly handles array proxies
960         https://bugs.webkit.org/show_bug.cgi?id=199292
961
962         Reviewed by Saam Barati.
963
964         * microbenchmarks/json-parse-array-reviver-same-value.js: Added.
965         * microbenchmarks/json-parse-array-reviver.js: Added.
966         * microbenchmarks/json-parse-object-reviver-same-value.js: Added.
967         * microbenchmarks/json-parse-object-reviver.js: Added.
968         * stress/json-parse-reviver-array-proxy.js: Added.
969         * stress/json-parse-reviver-revoked-proxy.js: Added.
970         * test262/expectations.yaml: Mark 6 test cases as passing.
971
972 2019-10-08  Ross Kirsling  <ross.kirsling@sony.com>
973
974         Update test262 (2019.10.08).
975
976         Rubber-stamped by Keith Miller.
977
978         * test262/config.yaml:
979         * test262/expectations.yaml:
980         * test262/latest-changes-summary.txt:
981         * test262/test/:
982         * test262/test262-Revision.txt:
983
984 2019-10-07  Saam Barati  <sbarati@apple.com>
985
986         Allow OSR exit to the LLInt
987         https://bugs.webkit.org/show_bug.cgi?id=197993
988
989         Reviewed by Tadeu Zagallo.
990
991         * stress/exit-from-getter-by-val.js: Added.
992         * stress/exit-from-setter-by-val.js: Added.
993
994 2019-10-07  Matt Lewis  <jlewis3@apple.com>
995
996         Unreviewed, rolling out r250750.
997
998         Reverting change as this broke interal test over the weekend.
999
1000         Reverted changeset:
1001
1002         "Allow OSR exit to the LLInt"
1003         https://bugs.webkit.org/show_bug.cgi?id=197993
1004         https://trac.webkit.org/changeset/250750
1005
1006 2019-10-04  Saam Barati  <sbarati@apple.com>
1007
1008         Allow OSR exit to the LLInt
1009         https://bugs.webkit.org/show_bug.cgi?id=197993
1010
1011         Reviewed by Tadeu Zagallo.
1012
1013         * stress/exit-from-getter-by-val.js: Added.
1014         * stress/exit-from-setter-by-val.js: Added.
1015
1016 2019-10-04  Paulo Matos  <pmatos@igalia.com>
1017
1018         Revert regexp test skip on armv7l and mips
1019         https://bugs.webkit.org/show_bug.cgi?id=202310
1020
1021         Reviewed by Žan Doberšek.
1022
1023         Test was skipped in bug 202113 on armv7l and mips due to bug 202041.
1024         Bug 202041 is fixed and change of bug 202113 can be reverted.
1025
1026         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
1027
1028 2019-10-02  Mark Lam  <mark.lam@apple.com>
1029
1030         DoubleToStringConverter::ToExponential() should null terminate its string.
1031         https://bugs.webkit.org/show_bug.cgi?id=202492
1032         <rdar://problem/55907708>
1033
1034         Reviewed by Filip Pizlo.
1035
1036         * stress/dtoa-AddSubstring-should-uses-strnlen-in-assertion.js: Added.
1037
1038 2019-10-02  Yusuke Suzuki  <ysuzuki@apple.com>
1039
1040         [JSC] AsyncGenerator should have internal fields
1041         https://bugs.webkit.org/show_bug.cgi?id=201498
1042
1043         Reviewed by Saam Barati.
1044
1045         * stress/async-generator-construct-failure.js: Added.
1046         (shouldThrow):
1047         (async.gen):
1048         (TypeError):
1049         * stress/async-generator-prototype-change.js: Added.
1050         (shouldBe):
1051         (async.gen):
1052         * stress/async-generator-prototype-closure.js: Added.
1053         (shouldBe):
1054         (test.async.gen):
1055         (test):
1056         * stress/create-async-generator.js: Added.
1057         (shouldBe):
1058         (test.async.generator):
1059         (test):
1060
1061 2019-10-01  Saam Barati  <sbarati@apple.com>
1062
1063         ObjectAllocationSinkingPhase shouldn't insert hints for allocations which are no longer valid
1064         https://bugs.webkit.org/show_bug.cgi?id=199361
1065         <rdar://problem/52454940>
1066
1067         Reviewed by Yusuke Suzuki.
1068
1069         * stress/allocation-sinking-hints-are-valid-ssa-2.js: Added.
1070         (main.fn):
1071         (main.executor):
1072         (main):
1073         * stress/allocation-sinking-hints-are-valid-ssa.js: Added.
1074         (main.fn):
1075         (main.executor):
1076         (main):
1077
1078 2019-10-01  Keith Miller  <keith_miller@apple.com>
1079
1080         skip test until we figure out why it's timing out
1081         https://bugs.webkit.org/show_bug.cgi?id=202423
1082
1083         Reviewed by Mark Lam.
1084
1085         new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js consistently times out on the bots.
1086         Let's skip it until we figure out what's going on.
1087
1088         * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js:
1089
1090 2019-10-01  Keith Miller  <keith_miller@apple.com>
1091
1092         Mark toctou test as skipped on debug builds
1093         https://bugs.webkit.org/show_bug.cgi?id=202420
1094
1095         Reviewed by Saam Barati.
1096
1097         Keeps timing out... Let's just skip it.
1098
1099         * stress/toctou-having-a-bad-time-new-array.js:
1100
1101 2019-10-01  Keith Miller  <keith_miller@apple.com>
1102
1103         Test262 update
1104
1105         Rubber-stamped by Michael Saboff.
1106
1107         Note, this was too big to effectivetly put on bugzilla as it's a 10MB patch...
1108
1109         * test262/*:
1110
1111 2019-10-01  Michael Saboff  <msaboff@apple.com> and Paulo Matos  <pmatos@igalia.com>
1112
1113         [YARR] Properly handle surrogates when matching back references
1114         https://bugs.webkit.org/show_bug.cgi?id=202041
1115
1116         Reviewed by Keith Miller.
1117
1118         Unchanged from the workin progress patch posted by Paulo Matos <pmatos@igalia.com>.
1119
1120         Updated test.
1121
1122         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
1123         (testRegExpNotMatch):
1124
1125 2019-10-01  Keith Miller  <keith_miller@apple.com>
1126
1127         Add support for the Wasm multi-value proposal
1128         https://bugs.webkit.org/show_bug.cgi?id=202250
1129
1130         Reviewed by Saam Barati.
1131
1132         This patch adds a new way to run stress tests via the .wat text
1133         format. By attaching an asm.js compiled version of the wabt tool
1134         we can easily create wat files programatically and convert them
1135         into a wasm blob to compile. To make this easy there is a
1136         wabt-wrapper.js module file that exports two useful functions that
1137         correspond to WebAssembly.compile and WebAssembly.instantiate.
1138
1139         * wasm.yaml:
1140         * wasm/function-tests/if-no-else-non-void.js:
1141         * wasm/js-api/web-assembly-instantiate.js:
1142         (assert.asyncTest.async.test):
1143         (assert.asyncTest):
1144         * wasm/libwabt.js: Added.
1145         (WabtModule):
1146         (set get if):
1147         * wasm/references/func_ref.js:
1148         * wasm/references/validation.js:
1149         (assert.throws):
1150         * wasm/spec-harness/index.js:
1151         * wasm/spec-tests/block.wast.js:
1152         * wasm/spec-tests/br.wast.js:
1153         * wasm/spec-tests/br_if.wast.js:
1154         * wasm/spec-tests/call.wast.js:
1155         * wasm/spec-tests/call_indirect.wast.js:
1156         * wasm/spec-tests/func.wast.js:
1157         * wasm/spec-tests/if.wast.js:
1158         * wasm/spec-tests/loop.wast.js:
1159         * wasm/spec-tests/type.wast.js:
1160         * wasm/stress/js-wasm-call-many-return-types-on-stack-no-args.js: Added.
1161         (buildWat):
1162         * wasm/stress/js-wasm-js-varying-arities.js: Added.
1163         (paramForwarder):
1164         * wasm/stress/wasm-js-call-many-return-types-on-stack-no-args.js: Added.
1165         (buildWat):
1166         * wasm/stress/wasm-js-multi-value-exception-in-iterator.js: Added.
1167         (buildWat.throwError):
1168         (buildWat.throwErrorInIterator):
1169         (buildWat.tooManyValues):
1170         (buildWat.tooFewValues):
1171         (buildWat):
1172         * wasm/stress/wasm-wasm-call-indirect-many-return-types-on-stack.js: Added.
1173         (buildWat):
1174         * wasm/stress/wasm-wasm-call-many-return-types-on-stack-no-args.js: Added.
1175         (buildWat):
1176         * wasm/wabt-wrapper.js: Added.
1177         (export.compile):
1178         * wasm/wast-tests/br-if-at-end-of-block.wasm: Added.
1179         * wasm/wast-tests/br-if-at-end-of-block.wast: Added.
1180         * wasm/wast-tests/harness.js:
1181         (async.runWasmFile):
1182         * wasm/wast-tests/single-param-loop-signature.wasm: Added.
1183         * wasm/wast-tests/single-param-loop-signature.wast: Added.
1184
1185 2019-09-30  Tadeu Zagallo  <tzagallo@apple.com>
1186
1187         Make assertion in JSObject::putOwnDataProperty more precise
1188         https://bugs.webkit.org/show_bug.cgi?id=202379
1189         <rdar://problem/49515980>
1190
1191         Reviewed by Yusuke Suzuki.
1192
1193         * stress/object-assign-target-proto-setter.js: Added.
1194         (get Object):
1195
1196 2019-09-30  Yusuke Suzuki  <ysuzuki@apple.com>
1197
1198         [JSC] HeapSnapshotBuilder m_rootData should be protected with a lock too
1199         https://bugs.webkit.org/show_bug.cgi?id=202389
1200         <rdar://problem/50717564>
1201
1202         Reviewed by Mark Lam.
1203
1204         * stress/heap-analyzer-taking-lock.js: Added.
1205
1206 2019-09-30  Saam Barati  <sbarati@apple.com>
1207
1208         Inline caching is wrong for custom accessors and custom values
1209         https://bugs.webkit.org/show_bug.cgi?id=201994
1210         <rdar://problem/50850326>
1211
1212         Reviewed by Yusuke Suzuki.
1213
1214         * microbenchmarks/custom-accessor-materialized.js: Added.
1215         (assert):
1216         (test4.get const):
1217         * microbenchmarks/custom-accessor-thin-air.js: Added.
1218         (assert):
1219         (test5.get const):
1220         (test5.get proto):
1221         * microbenchmarks/custom-accessor.js: Added.
1222         (assert):
1223         (test3.get const):
1224         * microbenchmarks/custom-value-2.js: Added.
1225         (assert):
1226         (test1.getMultiline):
1227         (test1):
1228         * microbenchmarks/custom-value.js: Added.
1229         (assert):
1230         (test1.getMultiline):
1231         (test1):
1232         * stress/custom-accessor-delete-1.js: Added.
1233         (assert):
1234         (test3.get const):
1235         * stress/custom-accessor-delete-2.js: Added.
1236         (assert):
1237         (test4.get const):
1238         * stress/custom-accessor-delete-3.js: Added.
1239         (assert):
1240         (test5.get const):
1241         (test5.get proto):
1242         * stress/custom-value-delete-property-1.js: Added.
1243         (assert):
1244         (test1.getMultiline):
1245         (test1):
1246         * stress/custom-value-delete-property-2.js: Added.
1247         (test2.foo):
1248         (test2):
1249         * stress/custom-value-delete-property-3.js: Added.
1250         (test6.foo):
1251         (test6):
1252
1253 2019-09-30  Yusuke Suzuki  <ysuzuki@apple.com>
1254
1255         [JSC] AI folds CompareEq wrongly when it sees proven Boolean and Number
1256         https://bugs.webkit.org/show_bug.cgi?id=202382
1257         <rdar://problem/52669112>
1258
1259         Reviewed by Saam Barati.
1260
1261         * stress/compare-eq-bool-number-folding.js: Added.
1262         (test):
1263
1264 2019-09-27  Yusuke Suzuki  <ysuzuki@apple.com>
1265
1266         [JSC] Keep JSString::value(ExecState*)'s result as String instead of `const String&`
1267         https://bugs.webkit.org/show_bug.cgi?id=202330
1268
1269         Reviewed by Saam Barati.
1270
1271         * stress/to-lower-case-gc-stress.js: Added.
1272
1273 2019-09-27  Alexey Shvayka  <shvaikalesh@gmail.com>
1274
1275         Non-standard Error properties should not be enumerable
1276         https://bugs.webkit.org/show_bug.cgi?id=198975
1277
1278         Reviewed by Ross Kirsling.
1279
1280         * ChakraCore/test/Error/NativeErrors_v4.baseline-jsc: Adjust expectations.
1281         * microbenchmarks/let-for-in.js: Adjust test.
1282         * test262/expectations.yaml: Mark 6 test cases as passing.
1283
1284 2019-09-26  Yusuke Suzuki  <ysuzuki@apple.com>
1285
1286         [JSC] DFG recursive-tail-call optimization should not emit jump to call-frame with varargs
1287         https://bugs.webkit.org/show_bug.cgi?id=202299
1288         <rdar://problem/52669116>
1289
1290         Reviewed by Saam Barati.
1291
1292         * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs-simple.js: Added.
1293         (foo):
1294         (test):
1295         * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs.js: Added.
1296         (foo):
1297         (C1.prototype.baz):
1298         (C1):
1299         (bar):
1300         (noInline.bar.goo):
1301         (C2.prototype.baz):
1302         (C2):
1303         (test):
1304
1305 2019-09-26  Alexey Shvayka  <shvaikalesh@gmail.com>
1306
1307         toExponential, toFixed, and toPrecision should allow arguments up to 100
1308         https://bugs.webkit.org/show_bug.cgi?id=199163
1309
1310         Reviewed by Ross Kirsling.
1311
1312         * ChakraCore/test/Number/toString_3.baseline-jsc:
1313         * ChakraCore/test/es5/exceptions3.baseline-jsc:
1314         * test262/expectations.yaml: Mark 6 test cases as passing.
1315
1316 2019-09-24  Alexey Shvayka  <shvaikalesh@gmail.com>
1317
1318         [ES6] Come up with a test for Proxy.[[GetOwnProperty]] that tests the isExtensible error when the  result of the trap is undefined
1319         https://bugs.webkit.org/show_bug.cgi?id=154376
1320
1321         Reviewed by Ross Kirsling.
1322
1323         Adds 2 test cases:
1324         1. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is non-extensible, TypeError is thrown.
1325         2. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is another Proxy, its "isExtensible" trap is called.
1326
1327         * stress/proxy-get-own-property.js:
1328
1329 2019-09-24  Caio Lima  <ticaiolima@gmail.com>
1330
1331         [BigInt] Add ValueBitRShift into DFG
1332         https://bugs.webkit.org/show_bug.cgi?id=192663
1333
1334         Reviewed by Robin Morisset.
1335
1336         * stress/big-int-right-shift-jit-osr.js: Added.
1337         * stress/big-int-right-shift-jit-untyped.js: Added.
1338         * stress/big-int-right-shift-jit.js: Added.
1339         * stress/value-rshift-ai-rule.js: Added.
1340
1341 2019-09-23  Ross Kirsling  <ross.kirsling@sony.com>
1342
1343         Array methods should throw TypeError upon attempting to modify a string
1344         https://bugs.webkit.org/show_bug.cgi?id=201910
1345
1346         Reviewed by Keith Miller.
1347
1348         * stress/array-methods-should-not-modify-string.js: Added.
1349
1350         * mozilla/js1_6/Array/regress-304828.js:
1351         Fix test. Original copy was changed similarly seven years ago:
1352         https://searchfox.org/mozilla-central/source/js/src/tests/non262/Array/regress-304828.js
1353
1354         * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js:
1355         Fix test. `Object.__proto__ = []; Object.shift();` shouldn't be valid JS.
1356
1357 2019-09-23  Mark Lam  <mark.lam@apple.com>
1358
1359         Lazy JSGlobalObject property materialization should not use putDirectWithoutTransition.
1360         https://bugs.webkit.org/show_bug.cgi?id=202122
1361         <rdar://problem/55535249>
1362
1363         Reviewed by Yusuke Suzuki.
1364
1365         * stress/lazy-global-object-property-materialization-should-not-putDirectWithoutTransition.js: Added.
1366
1367 2019-09-23  Caio Lima  <ticaiolima@gmail.com>
1368
1369         Skip stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js into ARMv7 and MIPS
1370         https://bugs.webkit.org/show_bug.cgi?id=202113
1371
1372         Unreviewed test gardening, skipped test in ARMv7 and MIPS.
1373
1374         It is going to be fixed in
1375         https://bugs.webkit.org/show_bug.cgi?id=202041
1376
1377         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
1378
1379 2019-09-22  Yusuke Suzuki  <ysuzuki@apple.com>
1380
1381         [JSC] Int52Rep(DoubleRepAnyIntUse) should not call operation function
1382         https://bugs.webkit.org/show_bug.cgi?id=202072
1383
1384         Reviewed by Mark Lam.
1385
1386         * stress/int52rep-with-double-checks-int52-range.js: Added.
1387         (shouldBe):
1388         (test):
1389
1390 2019-09-21  Caio Lima  <ticaiolima@gmail.com>
1391
1392         stress/test-out-of-memory.js is not throwing OOM into ARMv7 and MIPS
1393         https://bugs.webkit.org/show_bug.cgi?id=202011
1394
1395         Reviewed by Mark Lam.
1396
1397         We are skipping this test into MIPS and ARMv7 because some of its assumptions
1398         are not valid for them. The current behavior of the test in those architectures
1399         is that it does not throw during `new ArrayBuffer(1000)` allocation site,
1400         because eden collection keeps happening between iterations. The collection
1401         is triggered on those architectures because the amount of stress 
1402         `new Promise` generates into GC limits is not enough to avoid them
1403         while loop is executing.
1404
1405         Changing the size of `UInt8Array` from `80000000` to `160000000` can
1406         be an alternative fix to avoid collection happening during `ArrayBuffer`
1407         allocation loop, but we can't guarantee this test is always going to execute
1408         without error when Gigacage is disabled, given we can reach an OOM state in
1409         some allocations that need to succeed, making this test flaky for those
1410         architectures.
1411
1412         * stress/test-out-of-memory.js:
1413
1414 2019-09-21  Tadeu Zagallo  <tzagallo@apple.com>
1415
1416         AccessCase should strongly visit its dependencies while on stack
1417         https://bugs.webkit.org/show_bug.cgi?id=201986
1418         <rdar://problem/55521953>
1419
1420         Reviewed by Saam Barati and Yusuke Suzuki.
1421
1422         * stress/ftl-put-by-id-setter-exception-interesting-live-state-2.js: Added.
1423         (foo):
1424         (warmup):
1425
1426 2019-09-20  Saam Barati  <sbarati@apple.com>
1427
1428         Unreviewed. Make toctou-having-a-bad-time-new-array.js run for less time because it's timing out on the debug bots.
1429
1430         * stress/toctou-having-a-bad-time-new-array.js:
1431
1432 2019-09-19  Yusuke Suzuki  <ysuzuki@apple.com>
1433
1434         [JSC] DFG op_call_varargs should not assume that one-previous-local of freeReg is usable
1435         https://bugs.webkit.org/show_bug.cgi?id=202014
1436
1437         Reviewed by Saam Barati.
1438
1439         * stress/call-varargs-inlining-should-not-clobber-previous-to-free-register.js: Added.
1440         (__v0):
1441
1442 2019-09-19  Tadeu Zagallo  <tzagallo@apple.com>
1443
1444         Syntax checker should report duplicate __proto__ properties
1445         https://bugs.webkit.org/show_bug.cgi?id=201897
1446         <rdar://problem/53201788>
1447
1448         Reviewed by Mark Lam.
1449
1450         * stress/syntax-checker-duplicate-underscore-proto.js: Added.
1451         (catch):
1452
1453 2019-09-18  Saam Barati  <sbarati@apple.com>
1454
1455         TOCTOU bug in havingABadTime related assertion in DFGSpeculativeJIT
1456         https://bugs.webkit.org/show_bug.cgi?id=201953
1457         <rdar://problem/53803524>
1458
1459         Reviewed by Yusuke Suzuki.
1460
1461         * stress/toctou-having-a-bad-time-new-array.js: Added.
1462         (let.code):
1463
1464 2019-09-18  Saam Barati  <sbarati@apple.com>
1465
1466         Phantom insertion phase may disagree with arguments forwarding about live ranges
1467         https://bugs.webkit.org/show_bug.cgi?id=200715
1468         <rdar://problem/54301717>
1469
1470         Reviewed by Yusuke Suzuki.
1471
1472         * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js: Added.
1473         (main.v23):
1474         (main.try.v43):
1475         (main.):
1476         (main):
1477
1478 2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>
1479
1480         [JSC] Generator should have internal fields
1481         https://bugs.webkit.org/show_bug.cgi?id=201159
1482
1483         Reviewed by Keith Miller.
1484
1485         * stress/create-generator.js: Added.
1486         (shouldBe):
1487         (test.generator):
1488         (test):
1489         * stress/generator-construct-failure.js: Added.
1490         (shouldThrow):
1491         (TypeError):
1492         * stress/generator-prototype-change.js: Added.
1493         (shouldBe):
1494         (gen):
1495         * stress/generator-prototype-closure.js: Added.
1496         (shouldBe):
1497         (test.gen):
1498         (test):
1499         * stress/object-assign-fast-path.js:
1500
1501 2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>
1502
1503         Follow-up after String.codePointAt optimization
1504         https://bugs.webkit.org/show_bug.cgi?id=201889
1505
1506         Reviewed by Saam Barati.
1507
1508         * stress/string-char-at-bad-type.js: Added.
1509         (shouldBe):
1510         (object.toString):
1511         (test):
1512         * stress/string-char-code-at-bad-type.js: Added.
1513         (shouldBe):
1514         (object.toString):
1515         (test):
1516         * stress/string-code-point-at-bad-type.js: Added.
1517         (shouldBe):
1518         (object.toString):
1519         (test):
1520
1521 2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>
1522
1523         [JSC] CheckArray+NonArray is not filtering out Array in AI
1524         https://bugs.webkit.org/show_bug.cgi?id=201857
1525         <rdar://problem/54194820>
1526
1527         Reviewed by Keith Miller.
1528
1529         * stress/check-array-with-non-array-does-not-filter-arrays.js: Added.
1530         (foo):
1531
1532 2019-09-17  Saam Barati  <sbarati@apple.com>
1533
1534         CheckArray on DirectArguments/ScopedArguments does not filter out slow put array storage
1535         https://bugs.webkit.org/show_bug.cgi?id=201853
1536         <rdar://problem/53805461>
1537
1538         Reviewed by Yusuke Suzuki.
1539
1540         * stress/direct-arguments-check-array-filter-type.js: Added.
1541         (foo):
1542
1543 2019-09-16  Tadeu Zagallo  <tzagallo@apple.com>
1544
1545         Wasm StreamingParser should validate that number of functions matches number of declarations
1546         https://bugs.webkit.org/show_bug.cgi?id=201850
1547         <rdar://problem/55290186>
1548
1549         Reviewed by Yusuke Suzuki.
1550
1551         * wasm/regress/validate-number-of-functions-match-declarations.js: Added.
1552         (catch):
1553
1554 2019-09-16  Michael Saboff  <msaboff@apple.com>
1555
1556         [JSC] Perform check again when we found non-BMP characters
1557         https://bugs.webkit.org/show_bug.cgi?id=201647
1558
1559         Reviewed by Yusuke Suzuki.
1560
1561         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js: Added.
1562         * stress/regexp-unicode-within-string.js: Updated test to eliminate the bogus print().
1563         (testRegExpInbounds):
1564
1565 2019-09-16  Ross Kirsling  <ross.kirsling@sony.com>
1566
1567         [JSC] Add missing syntax errors for await in function parameter default expressions
1568         https://bugs.webkit.org/show_bug.cgi?id=201615
1569
1570         Reviewed by Darin Adler.
1571
1572         * stress/async-await-reserved-word.js:
1573         * stress/async-await-syntax.js:
1574         Add test cases.
1575
1576         * test262/expectations.yaml:
1577         Mark newly-passing test cases.
1578
1579 2019-09-16  Saam Barati  <sbarati@apple.com>
1580
1581         JSObject::putInlineSlow should not ignore "__proto__" for Proxy
1582         https://bugs.webkit.org/show_bug.cgi?id=200386
1583         <rdar://problem/53854946>
1584
1585         Reviewed by Yusuke Suzuki.
1586
1587         * stress/proxy-__proto__-in-prototype-chain.js: Added.
1588         * stress/proxy-property-replace-structure-transition.js: Added.
1589
1590 2019-09-13  Alexey Shvayka  <shvaikalesh@gmail.com>
1591
1592         Date.prototype.toJSON does not execute steps 1-2
1593         https://bugs.webkit.org/show_bug.cgi?id=105282
1594
1595         Reviewed by Ross Kirsling.
1596
1597         * test262/expectations.yaml: Mark 2 test cases as passing.
1598
1599 2019-09-12  Mark Lam  <mark.lam@apple.com>
1600
1601         Harden JSC against the abuse of runtime options.
1602         https://bugs.webkit.org/show_bug.cgi?id=201597
1603         <rdar://problem/55167068>
1604
1605         Reviewed by Filip Pizlo.
1606
1607         Remove the call to forceGCSlowPaths().  This utility function will be removed.
1608         The modern way to set the required option is to use //@ requireOptions.
1609
1610         * stress/ftl-try-catch-oom-error-lazy-slow-path.js:
1611
1612 2019-09-11  Yusuke Suzuki  <ysuzuki@apple.com>
1613
1614         [JSC] Add StringCodePointAt intrinsic
1615         https://bugs.webkit.org/show_bug.cgi?id=201673
1616
1617         Reviewed by Michael Saboff.
1618
1619         * stress/string-char-at-constant-index-out-of-range.js: Added.
1620         (shouldBe):
1621         (test):
1622         * stress/string-char-code-at-constant-index-out-of-range.js: Added.
1623         (shouldBe):
1624         (test):
1625         * stress/string-code-point-at--out-of-range.js: Added.
1626         (shouldBe):
1627         (test):
1628         * stress/string-code-point-at-basic.js: Added.
1629         (test):
1630         * stress/string-code-point-at-constant-index-out-of-range.js: Added.
1631         (shouldBe):
1632         (test):
1633         * stress/string-code-point-at-constant-int32-max-index-out-of-range.js: Added.
1634         (shouldBe):
1635         (test):
1636         * stress/string-code-point-at-constant-surrogate-pair.js: Added.
1637         (shouldBe):
1638         (test):
1639         (breaking):
1640         * stress/string-code-point-at-surrogate-pair.js: Added.
1641         (shouldBe):
1642         * stress/string-code-point-at.js: Added.
1643         (shouldBe):
1644
1645 2019-09-10  Michael Saboff  <msaboff@apple.com>
1646
1647         JSC crashes due to stack overflow while building RegExp
1648         https://bugs.webkit.org/show_bug.cgi?id=201649
1649
1650         Reviewed by Yusuke Suzuki.
1651
1652         New regression test.
1653
1654         * stress/regexp-bol-optimize-out-of-stack.js: Added.
1655         (test):
1656         (catch):
1657
1658 2019-09-10  Yusuke Suzuki  <ysuzuki@apple.com>
1659
1660         [WebAssembly] Use StreamingParser in existing Wasm::BBQPlan
1661         https://bugs.webkit.org/show_bug.cgi?id=189043
1662
1663         Reviewed by Keith Miller.
1664
1665         The offset performing the validation becomes a bit different.
1666         The offset 0 is nice since it is the starting offset of the Module header signature compared to the offset 8.
1667
1668         * wasm/js-api/version.js:
1669
1670 2019-09-07  Keith Miller  <keith_miller@apple.com>
1671
1672         OSR entry into wasm misses some contexts
1673         https://bugs.webkit.org/show_bug.cgi?id=201569
1674
1675         Reviewed by Yusuke Suzuki.
1676
1677         Add a new harness and wast and the generated wasm file for
1678         testing. The idea long term is to make it easy to test by creating
1679         a C file and converting it to a wast then modify that to produce a
1680         test.
1681
1682         * wasm.yaml:
1683         * wasm/wast-tests/harness.js: Added.
1684         (async.runWasmFile):
1685         * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wasm: Added.
1686         * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wast: Added.
1687         * wasm/wast-tests/osr-entry-inner-loop-branch-above.wasm: Added.
1688         * wasm/wast-tests/osr-entry-inner-loop-branch-above.wast: Added.
1689         * wasm/wast-tests/osr-entry-inner-loop.wasm: Added.
1690         * wasm/wast-tests/osr-entry-inner-loop.wast: Added.
1691         * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wasm: Added.
1692         * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wast: Added.
1693
1694 2019-09-09  Yusuke Suzuki  <ysuzuki@apple.com>
1695
1696         [JSC] Promise resolve/reject functions should be created more efficiently
1697         https://bugs.webkit.org/show_bug.cgi?id=201488
1698
1699         Reviewed by Mark Lam.
1700
1701         * microbenchmarks/promise-creation-many.js: Added.
1702         (executor):
1703
1704 2019-09-09  Zan Dobersek  <zdobersek@igalia.com>
1705
1706         Unreviewed JSC test gardening.
1707
1708         * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js:
1709         This test allocates a 2GB string before it goes out and tests
1710         out-of-memory exception when appending other strings to it. As such,
1711         skip the test on memory-limited platforms.
1712
1713 2019-09-07  Mark Lam  <mark.lam@apple.com>
1714
1715         The jsc shell should allow disabling of the Gigacage for testing purposes.
1716         https://bugs.webkit.org/show_bug.cgi?id=201579
1717
1718         Reviewed by Michael Saboff.
1719
1720         Unskip the tests now.
1721
1722         * stress/disable-gigacage-arrays.js:
1723         * stress/disable-gigacage-strings.js:
1724         * stress/disable-gigacage-typed-arrays.js:
1725
1726 2019-09-07  Mark Lam  <mark.lam@apple.com>
1727
1728         Gardening: temporarily skipping these tests until the fix can be reviewed and landed.
1729
1730         Not reviewed.
1731
1732         See https://bugs.webkit.org/show_bug.cgi?id=201579 for the fix.
1733
1734         * stress/disable-gigacage-arrays.js:
1735         * stress/disable-gigacage-strings.js:
1736         * stress/disable-gigacage-typed-arrays.js:
1737
1738 2019-09-07  Mark Lam  <mark.lam@apple.com>
1739
1740         Gardening: speculative test fix to green bots [attempt #2].
1741         https://bugs.webkit.org/show_bug.cgi?id=201529
1742         <rdar://problem/53935772>
1743
1744         Not reviewed.
1745
1746         * stress/test-out-of-memory.js:
1747
1748 2019-09-06  Mark Lam  <mark.lam@apple.com>
1749
1750         Gardening: speculative test fix to green bots.
1751         https://bugs.webkit.org/show_bug.cgi?id=201529
1752         <rdar://problem/53935772>
1753
1754         Not reviewed.
1755
1756         * stress/test-out-of-memory.js:
1757
1758 2019-09-06  Ross Kirsling  <ross.kirsling@sony.com>
1759
1760         Math.round() produces wrong result for value prior to 0.5
1761         https://bugs.webkit.org/show_bug.cgi?id=185115
1762
1763         Reviewed by Saam Barati.
1764
1765         * stress/math-round-basics.js:
1766         Add positive/negative test cases.
1767
1768         * test262/expectations.yaml:
1769         Mark test passing.
1770
1771 2019-09-06  Mark Lam  <mark.lam@apple.com>
1772
1773         Move web-assembly-constructors-should-not-override-global-object-property.js below JSTests/wasm/stress.
1774         https://bugs.webkit.org/show_bug.cgi?id=201551
1775
1776         Reviewed by Tadeu Zagallo.
1777
1778         Ports that don't support WASM will always fail this test if it stays in JSTests/stress.
1779
1780         * stress/web-assembly-constructors-should-not-override-global-object-property.js: Removed.
1781         * wasm/stress/web-assembly-constructors-should-not-override-global-object-property.js: Copied from JSTests/stress/web-assembly-constructors-should-not-override-global-object-property.js.
1782
1783 2019-09-06  Mark Lam  <mark.lam@apple.com>
1784
1785         Fix bmalloc::Allocator:tryAllocate() to return null on failure to allocate.
1786         https://bugs.webkit.org/show_bug.cgi?id=201529
1787         <rdar://problem/53935772>
1788
1789         Reviewed by Yusuke Suzuki.
1790
1791         * stress/test-out-of-memory.js: Added.
1792
1793 2019-09-05  Tadeu Zagallo  <tzagallo@apple.com>
1794
1795         LazyClassStructure::setConstructor should not store the constructor to the global object
1796         https://bugs.webkit.org/show_bug.cgi?id=201484
1797         <rdar://problem/50400451>
1798
1799         Reviewed by Yusuke Suzuki.
1800
1801         * stress/web-assembly-constructors-should-not-override-global-object-property.js: Added.
1802
1803 2019-09-05  Yusuke Suzuki  <ysuzuki@apple.com>
1804
1805         [JSC] Do not use FTLOutput::weakPointer directly
1806         https://bugs.webkit.org/show_bug.cgi?id=201495
1807
1808         Reviewed by Filip Pizlo.
1809
1810         * stress/create-promise-weak-pointer.js: Added.
1811         (foo):
1812
1813 2019-09-04  Yusuke Suzuki  <ysuzuki@apple.com>
1814
1815         [JSC] Make Promise implementation faster
1816         https://bugs.webkit.org/show_bug.cgi?id=200898
1817
1818         Reviewed by Saam Barati.
1819
1820         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
1821         (assert.assert.return.throws):
1822         * modules/breaking-builtin-promise-then-does-not-break-internal-promise.js: Added.
1823         * modules/breaking-builtin-promise-then-does-not-break-internal-promise/test.js: Added.
1824         * stress/constructor-kind-naked-should-not-be-applied-to-inner-functions.js: Added.
1825         (shouldThrow):
1826         (new.Promise):
1827         (shouldThrow.Promise):
1828         * stress/create-promise-should-respect-promise-realm.js: Added.
1829         (shouldBe):
1830         (other.new.OtherPromise):
1831         (DerivedOtherPromise):
1832         (i.promise.new.DerivedOtherPromise):
1833         (createPromise):
1834         * stress/derived-promise-constructor-class-syntax-prototype-replace-attempt.js: Added.
1835         (shouldBe):
1836         (DerivedPromise):
1837         (i.array.push.new.DerivedPromise):
1838         (promise.new.DerivedPromise):
1839         * stress/derived-promise-constructor-inlined.js: Added.
1840         (shouldBe):
1841         (DerivedPromise):
1842         (i.array.push.new.DerivedPromise):
1843         (DerivedPromise.all.array.then):
1844         * stress/derived-promise-prototype-replaced.js: Added.
1845         (shouldBe):
1846         (DerivedPromise):
1847         (i.array.push.new.DerivedPromise):
1848         (promise.new.DerivedPromise):
1849         * stress/internal-promise-constructor-not-confusing.js: Added.
1850         (shouldBe):
1851         (InternalPromise.vm.createBuiltin):
1852         (DerivedPromise):
1853         * stress/internal-promise-is-not-exposed.js: Added.
1854         (shouldBe):
1855         * stress/new-promise-should-respect-promise-realm.js: Added.
1856         (shouldBe):
1857         (other.new.OtherPromise):
1858         (createPromise):
1859         * stress/promise-cannot-be-called.js:
1860         (shouldThrow):
1861         * stress/promise-capability-fast-path.js: Added.
1862         (shouldBe):
1863         (i.array.push.new.Promise):
1864         (i.array.i.then):
1865         * stress/promise-capability-slow-path.js: Added.
1866         (shouldBe):
1867         (Promise.prototype.then):
1868         (i.array.push.new.Promise):
1869         (i.array.i.then):
1870         * stress/promise-capability-then-slow-path.js: Added.
1871         (shouldBe):
1872         (DerivedPromise):
1873         (DerivedPromise.prototype.then):
1874         (i.array.push.new.DerivedPromise):
1875         (i.array.i.then):
1876         * stress/promise-constructor-inlined.js: Added.
1877         (shouldBe):
1878         (i.array.push.new.Promise):
1879         (Promise.all.array.then):
1880         * stress/promise-constructor-transition-from-new-promise-to-create-promise.js: Added.
1881         (shouldBe):
1882         (DerivedPromise):
1883         (DerivedPromise2):
1884         (i.array.push.new.DerivedPromise):
1885         (i.array2.push.new.DerivedPromise2):
1886         * stress/without-promise-functions.js: Added.
1887         (shouldBe):
1888         (async):
1889
1890 2019-09-03  Mark Lam  <mark.lam@apple.com>
1891
1892         Assertions in JSArrayBufferView::byteOffset() are only valid for the mutator thread.
1893         https://bugs.webkit.org/show_bug.cgi?id=201309
1894         <rdar://problem/54832121>
1895
1896         Reviewed by Yusuke Suzuki.
1897
1898         * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js: Added.
1899
1900 2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>
1901
1902         [JSC] Generate new.target register only when it is used
1903         https://bugs.webkit.org/show_bug.cgi?id=201335
1904
1905         Reviewed by Mark Lam.
1906
1907         * stress/ensure-new-register-allocated.js: Added.
1908         (shouldBe):
1909         (basic):
1910         (arrow):
1911         (Base):
1912         (Derived):
1913         (evaluate):
1914
1915 2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>
1916
1917         [JSC] DFG ByteCodeParser should not copy JIT-related part of SimpleJumpTable
1918         https://bugs.webkit.org/show_bug.cgi?id=201331
1919
1920         Reviewed by Mark Lam.
1921
1922         * stress/simple-jump-table-copy.js: Added.
1923         (let.code):
1924         (g2):
1925
1926 2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>
1927
1928         [JSC] DFG inlining CheckBadCell slow path does not assume result VirtualRegister can be invalid
1929         https://bugs.webkit.org/show_bug.cgi?id=201332
1930
1931         Reviewed by Mark Lam.
1932
1933         This test is very flaky, it is hard to reproduce.
1934
1935         * stress/setter-inlining-resulting-bad-cell-result-virtual-register-should-be-invalid.js: Added.
1936         (code):
1937
1938 2019-08-29  Yusuke Suzuki  <ysuzuki@apple.com>
1939
1940         [JSC] Repatch should construct CallCases and CasesValue at the same time
1941         https://bugs.webkit.org/show_bug.cgi?id=201325
1942
1943         Reviewed by Saam Barati.
1944
1945         * stress/repatch-switch.js: Added.
1946         (main.f2.f0):
1947         (main.f2.f3):
1948         (main.f2.f1):
1949         (main.f2):
1950         (main):
1951
1952 2019-08-29  Yusuke Suzuki  <ysuzuki@apple.com>
1953
1954         [JSC] ObjectAllocationSinkingPhase wrongly deals with always-taken branches during interpretation
1955         https://bugs.webkit.org/show_bug.cgi?id=198650
1956
1957         Reviewed by Saam Barati.
1958
1959         * stress/object-allocation-sinking-interpretation-can-interpret-edges-that-can-be-proven-unreachable-in-ai.js:
1960         (main.v0):
1961         (main):
1962
1963 2019-08-28  Mark Lam  <mark.lam@apple.com>
1964
1965         DFG/FTL: We should prefetch structures and do a loadLoadFence before doing PrototypeChainIsSane checks.
1966         https://bugs.webkit.org/show_bug.cgi?id=201281
1967         <rdar://problem/54028228>
1968
1969         Reviewed by Yusuke Suzuki and Saam Barati.
1970
1971         * stress/structure-storedPrototype-should-only-assert-on-the-mutator-thread.js: Added.
1972
1973 2019-08-28  Mark Lam  <mark.lam@apple.com>
1974
1975         Placate exception check validation in DFG's operationHasGenericProperty().
1976         https://bugs.webkit.org/show_bug.cgi?id=201245
1977         <rdar://problem/54777512>
1978
1979         Reviewed by Robin Morisset.
1980
1981         * stress/missing-exception-check-in-operationHasGenericProperty.js: Added.
1982
1983 2019-08-27  Mark Lam  <mark.lam@apple.com>
1984
1985         constructFunctionSkippingEvalEnabledCheck() should use tryMakeString() and check for OOM.
1986         https://bugs.webkit.org/show_bug.cgi?id=201196
1987         <rdar://problem/54703775>
1988
1989         Reviewed by Yusuke Suzuki.
1990
1991         * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: Added.
1992
1993 2019-08-26  Ross Kirsling  <ross.kirsling@sony.com>
1994
1995         [JSC] Ensure x?.y ?? z is fast
1996         https://bugs.webkit.org/show_bug.cgi?id=200875
1997
1998         Reviewed by Yusuke Suzuki.
1999
2000         * stress/nullish-coalescing.js:
2001
2002 2019-08-23  Tadeu Zagallo  <tzagallo@apple.com>
2003
2004         Remove MaximalFlushInsertionPhase
2005         https://bugs.webkit.org/show_bug.cgi?id=201036
2006
2007         Reviewed by Saam Barati.
2008
2009         Remove all the references to maximal flush
2010
2011         * stress/arith-ceil-on-various-types.js:
2012         (checkCompileCountForUselessNegativeZero):
2013         * stress/arith-floor-on-various-types.js:
2014         (checkCompileCountForUselessNegativeZero):
2015         * stress/arith-negate-on-various-types.js:
2016         (checkCompileCountForUselessNegativeZero):
2017         * stress/arith-round-on-various-types.js:
2018         (checkCompileCountForUselessNegativeZero):
2019         * stress/arith-trunc-on-various-types.js:
2020         (checkCompileCountForUselessNegativeZero):
2021         * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js:
2022         * stress/has-indexed-property-should-accept-non-int32.js:
2023         * stress/has-indexed-property-with-worsening-array-mode.js:
2024         * stress/known-int32-cant-be-used-across-bytecode-boundary.js:
2025         * stress/read-dead-bytecode-locals-in-must-handle-values1.js:
2026         * stress/read-dead-bytecode-locals-in-must-handle-values2.js:
2027         * stress/rest-parameter-many-arguments.js:
2028         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js:
2029         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js:
2030         * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js:
2031
2032 2019-08-23  Justin Michaud  <justin_michaud@apple.com>
2033
2034         [WASM-References] Do not overwrite argument registers in jsCallEntrypoint
2035         https://bugs.webkit.org/show_bug.cgi?id=200952
2036
2037         Reviewed by Saam Barati.
2038
2039         * wasm/references/func_ref.js:
2040         (assert.throws):
2041
2042 2019-08-22  Justin Michaud  <justin_michaud@apple.com>
2043
2044         Add missing exception check in canonicalizeLocaleList
2045         https://bugs.webkit.org/show_bug.cgi?id=201021
2046
2047         Reviewed by Mark Lam.
2048
2049         * stress/missing-exception-check-in-canonicalizeLocaleList.js: Added.
2050         (catch):
2051
2052 2019-08-21  Mark Lam  <mark.lam@apple.com>
2053
2054         Wasm::FunctionParser is failing to enforce maxFunctionLocals.
2055         https://bugs.webkit.org/show_bug.cgi?id=201016
2056         <rdar://problem/54579911>
2057
2058         Reviewed by Yusuke Suzuki.
2059
2060         * wasm/stress/too-many-locals.js: Added.
2061         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.catch):
2062
2063 2019-08-21  Ross Kirsling  <ross.kirsling@sony.com>
2064
2065         JSTests/stress/optional-chaining should not call shouldThrowTypeError in a loop
2066         https://bugs.webkit.org/show_bug.cgi?id=200965
2067
2068         Reviewed by Saam Barati.
2069
2070         This has nothing to do with ?. in particular, but throwing >1M type errors takes 100s in Debug on my machine.
2071         The main idea here was to JITify the simple success cases, so let's not run the simple failures so many times.
2072
2073         * stress/optional-chaining.js:
2074
2075 2019-08-21  Michael Saboff  <msaboff@apple.com>
2076
2077         [JSC] incorrent JIT lead to StackOverflow
2078         https://bugs.webkit.org/show_bug.cgi?id=197823
2079
2080         Reviewed by Tadeu Zagallo.
2081
2082         New test.
2083
2084         * stress/bound-function-stack-overflow.js: Added.
2085         (foo):
2086         (catch):
2087
2088 2019-08-20  Justin Michaud  <justin_michaud@apple.com>
2089
2090         Identify memcpy loops in b3
2091         https://bugs.webkit.org/show_bug.cgi?id=200181
2092
2093         Reviewed by Saam Barati.
2094
2095         * microbenchmarks/memcpy-loop.js: Added.
2096         (doTest):
2097         (let.arr1):
2098         * microbenchmarks/memcpy-typed-loop-large.js: Added.
2099         (doTest):
2100         (let.arr1.new.Int32Array.1000000.let.arr2.new.Int32Array.1000000):
2101         (arr2):
2102         * microbenchmarks/memcpy-typed-loop-small.js: Added.
2103         (doTest):
2104         (16.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
2105         (16.arr2):
2106         * microbenchmarks/memcpy-typed-loop-speculative.js: Added.
2107         (doTest):
2108         (let.arr1.new.Int32Array.10.let.arr2.new.Int32Array.10):
2109         (arr2):
2110         * microbenchmarks/memcpy-wasm-large.js: Added.
2111         (typeof.WebAssembly.string_appeared_here.eq):
2112         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
2113         * microbenchmarks/memcpy-wasm-medium.js: Added.
2114         (typeof.WebAssembly.string_appeared_here.eq):
2115         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
2116         * microbenchmarks/memcpy-wasm-small.js: Added.
2117         (typeof.WebAssembly.string_appeared_here.eq):
2118         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
2119         * microbenchmarks/memcpy-wasm.js: Added.
2120         (typeof.WebAssembly.string_appeared_here.eq):
2121         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
2122         * stress/memcpy-typed-loops.js: Added.
2123         (noLoop):
2124         (invalidStart):
2125         (const.size.10.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
2126         (arr2):
2127         * wasm/function-tests/memcpy-wasm-loop.js: Added.
2128         (0.GetLocal.3.I32Const.1.I32Add.SetLocal.3.Br.1.End.End.End.WebAssembly):
2129         (string_appeared_here):
2130
2131 2019-08-20  Yusuke Suzuki  <ysuzuki@apple.com>
2132
2133         [JSC] Array.prototype.toString should not get "join" function each time
2134         https://bugs.webkit.org/show_bug.cgi?id=200905
2135
2136         Reviewed by Mark Lam.
2137
2138         * stress/array-prototype-join-change.js: Added.
2139         (shouldBe):
2140         (array2.join):
2141         (DerivedArray):
2142         (DerivedArray.prototype.join):
2143         (array3.__proto__.join):
2144         (Array.prototype.join):
2145
2146 2019-08-20  Justin Michaud  <justin_michaud@apple.com>
2147
2148         Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
2149         https://bugs.webkit.org/show_bug.cgi?id=200782
2150
2151         Reviewed by Saam Barati.
2152
2153         Skip long memcpy test on debug, and try to fix flakiness for recompilation count tests by disabling cjit.
2154
2155         * microbenchmarks/memcpy-typed-loop.js:
2156         * stress/int8-repeat-in-then-out-of-bounds.js:
2157
2158 2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>
2159
2160         Proxy constructor should throw if handler is revoked Proxy
2161         https://bugs.webkit.org/show_bug.cgi?id=198755
2162
2163         Reviewed by Saam Barati.
2164
2165         * stress/proxy-revoke.js: Adjust error message.
2166         * test262/expectations.yaml: Mark 2 test cases as passing.
2167
2168 2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>
2169
2170         [JSC] OSR entry to Wasm OMG
2171         https://bugs.webkit.org/show_bug.cgi?id=200362
2172
2173         Reviewed by Michael Saboff.
2174
2175         * wasm/stress/osr-entry-basic.js: Added.
2176         (instance.exports.loop):
2177         * wasm/stress/osr-entry-many-locals-f32.js: Added.
2178         * wasm/stress/osr-entry-many-locals-f64.js: Added.
2179         * wasm/stress/osr-entry-many-locals-i32.js: Added.
2180         * wasm/stress/osr-entry-many-locals-i64.js: Added.
2181         * wasm/stress/osr-entry-many-stacks-f32.js: Added.
2182         * wasm/stress/osr-entry-many-stacks-f64.js: Added.
2183         * wasm/stress/osr-entry-many-stacks-i32.js: Added.
2184         * wasm/stress/osr-entry-many-stacks-i64.js: Added.
2185
2186 2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>
2187
2188         Date.prototype.toJSON throws if toISOString returns an object
2189         https://bugs.webkit.org/show_bug.cgi?id=198495
2190
2191         Reviewed by Ross Kirsling.
2192
2193         * test262/expectations.yaml: Mark 6 test cases as passing.
2194
2195 2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>
2196
2197         [JSC] DFG DataView get/set optimization should take care of the case little-endian flag is JSEmpty
2198         https://bugs.webkit.org/show_bug.cgi?id=200899
2199         <rdar://problem/54073341>
2200
2201         Reviewed by Mark Lam.
2202
2203         * stress/data-view-get-dfg-should-handle-empty-constant.js: Added.
2204         (i.new.Promise):
2205         * stress/data-view-set-dfg-should-handle-empty-constant.js: Added.
2206         (i.new.Promise):
2207
2208 2019-08-19  Michael Saboff  <msaboff@apple.com>
2209
2210         Webkit jsc Crash in RegExp::matchInline (this=<optimized out>
2211         https://bugs.webkit.org/show_bug.cgi?id=197090
2212
2213         Reviewed by Yusuke Suzuki.
2214
2215         New test.
2216
2217         * stress/regexp-nonconsuming-counted-parens.js: Added.
2218
2219 2019-08-18  Ross Kirsling  <ross.kirsling@sony.com>
2220
2221         [JSC] Correct a->an in error messages and API docblocks
2222         https://bugs.webkit.org/show_bug.cgi?id=200833
2223
2224         Reviewed by Don Olmstead.
2225
2226         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
2227         (assert.assert.return.throws):
2228         * stress/promise-finally-should-accept-non-promise-objects.js:
2229         * wasm/js-api/table.js:
2230         (assert.throws):
2231
2232 2019-08-17  Ross Kirsling  <ross.kirsling@sony.com>
2233
2234         [ESNext] Implement optional chaining
2235         https://bugs.webkit.org/show_bug.cgi?id=200199
2236
2237         Reviewed by Yusuke Suzuki.
2238
2239         * stress/nullish-coalescing.js:
2240         * stress/optional-chaining.js: Added.
2241         * stress/tail-call-recognize.js:
2242
2243 2019-08-17  Ross Kirsling  <ross.kirsling@sony.com>
2244
2245         [ESNext] Support hashbang.
2246         https://bugs.webkit.org/show_bug.cgi?id=200865
2247
2248         Reviewed by Mark Lam.
2249
2250         * stress/hashbang.js: Added.
2251         * test262/expectations.yaml: Mark 6 cases as passing.
2252
2253 2019-08-17  Yusuke Suzuki  <ysuzuki@apple.com>
2254
2255         [JSC] DFG ToNumber should support Boolean in fixup
2256         https://bugs.webkit.org/show_bug.cgi?id=200864
2257
2258         Reviewed by Mark Lam.
2259
2260         * microbenchmarks/to-number-boolean.js: Added.
2261         (test):
2262         * stress/to-number-boolean-int32.js: Added.
2263         (shouldBe):
2264         (test):
2265         (check):
2266         * stress/to-number-boolean.js: Added.
2267         (shouldBe):
2268         (test):
2269         (check):
2270         * stress/to-number-int32.js: Added.
2271         (shouldBe):
2272         (test):
2273         (check):
2274
2275 2019-08-16  Mark Lam  <mark.lam@apple.com>
2276
2277         More missing exception checks in string comparison operators.
2278         https://bugs.webkit.org/show_bug.cgi?id=200844
2279         <rdar://problem/54378684>
2280
2281         Reviewed by Saam Barati.
2282
2283         * stress/missing-exception-check-in-string-greater-than-compare.js: Added.
2284         * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: Added.
2285         * stress/missing-exception-check-in-string-less-than-compare.js: Added.
2286         * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: Added.
2287
2288 2019-08-16  Mark Lam  <mark.lam@apple.com>
2289
2290         CodeBlock destructor should clear all of its watchpoints.
2291         https://bugs.webkit.org/show_bug.cgi?id=200792
2292         <rdar://problem/53947800>
2293
2294         Reviewed by Yusuke Suzuki.
2295
2296         * stress/codeblock-should-clear-watchpoints-on-destruction.js: Added.
2297
2298 2019-08-16  Justin Michaud  <justin_michaud@apple.com>
2299
2300         Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
2301         https://bugs.webkit.org/show_bug.cgi?id=200782
2302
2303         Reviewed by Saam Barati.
2304
2305         * microbenchmarks/int8-out-of-bounds.js: Added.
2306         (foo):
2307         * microbenchmarks/memcpy-typed-loop.js: Added.
2308         (doTest):
2309         (let.arr1.new.Int32Array.1000.let.arr2.new.Int32Array.1000):
2310         (arr2):
2311         * stress/int8-repeat-in-then-out-of-bounds.js: Added.
2312         (foo):
2313
2314 2019-08-16  Mark Lam  <mark.lam@apple.com>
2315
2316         [Re-land] ProxyObject should not be allow to access its target's private properties.
2317         https://bugs.webkit.org/show_bug.cgi?id=200739
2318         <rdar://problem/53972768>
2319
2320         Reviewed by Yusuke Suzuki.
2321
2322         * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Copied from JSTests/stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js.
2323         * stress/proxy-with-private-symbols.js:
2324
2325 2019-08-16  Yusuke Suzuki  <ysuzuki@apple.com>
2326
2327         [JSC] Promise.prototype.finally should accept non-promise objects
2328         https://bugs.webkit.org/show_bug.cgi?id=200829
2329
2330         Reviewed by Mark Lam.
2331
2332         * stress/promise-finally-should-accept-non-promise-objects.js: Added.
2333         (shouldBe):
2334         (Thenable):
2335         (Thenable.prototype.then):
2336
2337 2019-08-16  Alexey Shvayka  <shvaikalesh@gmail.com>
2338
2339         Promise constructor should check argument before [[Construct]]
2340         https://bugs.webkit.org/show_bug.cgi?id=198976
2341
2342         Reviewed by Ross Kirsling.
2343
2344         * stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js: Fix test.
2345         * stress/create-subclass-structure-might-throw.js: Fix test.
2346         * test262/expectations.yaml: Mark 2 test cases as passing.
2347
2348 2019-08-16  Ryan Haddad  <ryanhaddad@apple.com>
2349
2350         Unreviewed, rolling out r248709.
2351
2352         Caused test/built-ins/Promise/prototype/finally/this-value-
2353         non-promise.js to fail on test262 bot
2354
2355         Reverted changeset:
2356
2357         "ProxyObject should not be allow to access its target's
2358         private properties."
2359         https://bugs.webkit.org/show_bug.cgi?id=200739
2360         https://trac.webkit.org/changeset/248709
2361
2362 2019-08-15  Alexey Shvayka  <shvaikalesh@gmail.com>
2363
2364         DateConversion::formatDateTime incorrectly formats negative years
2365         https://bugs.webkit.org/show_bug.cgi?id=199964
2366
2367         Reviewed by Ross Kirsling.
2368
2369         * test262/expectations.yaml: Mark 6 test cases as passing.
2370
2371 2019-08-15  Mark Lam  <mark.lam@apple.com>
2372
2373         More missing exception checks in String.prototype.
2374         https://bugs.webkit.org/show_bug.cgi?id=200762
2375         <rdar://problem/54333896>
2376
2377         Reviewed by Michael Saboff.
2378
2379         * stress/missing-exception-check-in-string-lastIndexOf.js: Added.
2380         * stress/missing-exception-check-in-string-toLower.js: Added.
2381         * stress/missing-exception-check-in-string-toUpper.js: Added.
2382
2383 2019-08-14  Mark Lam  <mark.lam@apple.com>
2384
2385         ProxyObject should not be allow to access its target's private properties.
2386         https://bugs.webkit.org/show_bug.cgi?id=200739
2387         <rdar://problem/53972768>
2388
2389         Reviewed by Yusuke Suzuki.
2390
2391         * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Added.
2392         * stress/proxy-with-private-symbols.js: Rebased.
2393
2394 2019-08-14  Mark Lam  <mark.lam@apple.com>
2395
2396         Missing exception check in string compare.
2397         https://bugs.webkit.org/show_bug.cgi?id=200743
2398         <rdar://problem/53975356>
2399
2400         Reviewed by Michael Saboff.
2401
2402         * stress/missing-exception-check-in-string-compare.js: Added.
2403
2404 2019-08-08  Ross Kirsling  <ross.kirsling@sony.com>
2405
2406         [JSC] Add "jump if (not) undefined or null" bytecode ops
2407         https://bugs.webkit.org/show_bug.cgi?id=200480
2408
2409         Reviewed by Saam Barati.
2410
2411         * stress/destructuring-assignment-require-object-coercible.js:
2412         * stress/nullish-coalescing.js:
2413
2414 2019-08-05  Michael Saboff  <msaboff@apple.com>
2415
2416         JSC: assertion failure in SpeculativeJIT::compileGetByValOnIntTypedArray
2417         https://bugs.webkit.org/show_bug.cgi?id=199997
2418
2419         Reviewed by Saam Barati.
2420
2421         New test.
2422
2423         * stress/typedarray-no-alreadyChecked-assert.js: Added.
2424         (checkIntArray):
2425         (checkFloatArray):
2426
2427 2019-08-02  Yusuke Suzuki  <ysuzuki@apple.com>
2428
2429         [JSC] Support WebAssembly in SamplingProfiler
2430         https://bugs.webkit.org/show_bug.cgi?id=200329
2431
2432         Reviewed by Saam Barati.
2433
2434         * stress/sampling-profiler-wasm-name-section.js: Added.
2435         (const.compile):
2436         (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
2437         (platformSupportsSamplingProfiler.vm.isWasmSupported):
2438         * stress/sampling-profiler-wasm.js: Added.
2439         (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
2440         (platformSupportsSamplingProfiler.vm.isWasmSupported):
2441         * stress/sampling-profiler/loop.wasm: Added.
2442         * stress/sampling-profiler/loop.wast: Added.
2443         * stress/sampling-profiler/nameSection.wasm: Added.
2444
2445 2019-08-02  Yusuke Suzuki  <ysuzuki@apple.com>
2446
2447         [JSC] LazyJSValue should be robust for empty JSValue
2448         https://bugs.webkit.org/show_bug.cgi?id=200388
2449
2450         Reviewed by Saam Barati.
2451
2452         * stress/switch-constant-child-becomes-empty.js: Added.
2453         (foo):
2454
2455 2019-08-01  Yusuke Suzuki  <ysuzuki@apple.com>
2456
2457         GetterSetter type confusion during DFG compilation
2458         https://bugs.webkit.org/show_bug.cgi?id=199903
2459
2460         Reviewed by Mark Lam.
2461
2462         * stress/cse-propagated-constant-may-not-follow-structure-restrictions.js: Added.
2463
2464 2019-08-01  Ross Kirsling  <ross.kirsling@sony.com>
2465
2466         Update Test262 (2019.08.01)
2467         https://bugs.webkit.org/show_bug.cgi?id=200351
2468
2469         Reviewed by Keith Miller.
2470
2471         * test262/expectations.yaml:
2472         * test262/harness/testIntl.js:
2473         * test262/latest-changes-summary.txt:
2474         * test262/test/:
2475         * test262/test262-Revision.txt:
2476
2477 2019-07-30  Yusuke Suzuki  <ysuzuki@apple.com>
2478
2479         [JSC] Make StructureChain less-tricky by using Auxiliary Buffer
2480         https://bugs.webkit.org/show_bug.cgi?id=200192
2481
2482         Reviewed by Saam Barati.
2483
2484         * stress/structure-chain-stress.js: Added.
2485         (keys):
2486
2487 2019-07-29  Yusuke Suzuki  <ysuzuki@apple.com>
2488
2489         [JSC] Increment bytecode age only when SlotVisitor is first-visit
2490         https://bugs.webkit.org/show_bug.cgi?id=200196
2491
2492         Reviewed by Robin Morisset.
2493
2494         * stress/reparsing-unlinked-codeblock.js:
2495
2496 2019-07-29  Justin Michaud  <justin_michaud@apple.com>
2497
2498         [X86] Emit BT instruction for shift + mask in B3
2499         https://bugs.webkit.org/show_bug.cgi?id=199891
2500
2501         Reviewed by Robin Morisset.
2502
2503         Lower the number of iterations to fix debug timeouts.
2504
2505         * microbenchmarks/bit-test-load.js:
2506         (i):
2507
2508 2019-07-27  Justin Michaud  <justin_michaud@apple.com>
2509
2510         [X86] Emit BT instruction for shift + mask in B3
2511         https://bugs.webkit.org/show_bug.cgi?id=199891
2512
2513         Reviewed by Keith Miller.
2514
2515         * microbenchmarks/bit-test-constant.js: Added.
2516         (let.glob.0.doTest):
2517         * microbenchmarks/bit-test-load.js: Added.
2518         (let.glob.0.let.arr.new.Int32Array.8.doTest):
2519         (i):
2520         * microbenchmarks/bit-test-nonconstant.js: Added.
2521         (let.glob.0.doTest):
2522
2523 2019-07-26  Yusuke Suzuki  <ysuzuki@apple.com>
2524
2525         [JSC] Potential GC fix for JSPropertyNameEnumerator
2526         https://bugs.webkit.org/show_bug.cgi?id=200151
2527
2528         Reviewed by Mark Lam.
2529
2530         * stress/for-in-stress.js: Added.
2531         (keys):
2532
2533 2019-07-25  Ross Kirsling  <ross.kirsling@sony.com>
2534
2535         Legacy numeric literals should not permit separators or BigInt
2536         https://bugs.webkit.org/show_bug.cgi?id=199984
2537
2538         Reviewed by Keith Miller.
2539
2540         * stress/big-int-literals.js:
2541         * stress/numeric-literal-separators.js:
2542
2543 2019-07-25  Ross Kirsling  <ross.kirsling@sony.com>
2544
2545         [ESNext] Implement nullish coalescing
2546         https://bugs.webkit.org/show_bug.cgi?id=200072
2547
2548         Reviewed by Darin Adler.
2549
2550         * stress/nullish-coalescing.js: Added.
2551
2552 2019-07-24  Alexey Shvayka  <shvaikalesh@gmail.com>
2553
2554         Three checks are missing in Proxy internal methods
2555         https://bugs.webkit.org/show_bug.cgi?id=198630
2556
2557         Reviewed by Darin Adler.
2558
2559         * stress/proxy-delete.js: Assert isExtensible is called in correct order.
2560         * test262/expectations.yaml: Mark 6 test cases as passing.
2561
2562 2019-07-23  Justin Michaud  <justin_michaud@apple.com>
2563
2564         Sometimes we miss removable CheckInBounds
2565         https://bugs.webkit.org/show_bug.cgi?id=200018
2566
2567         Reviewed by Saam Barati.
2568
2569         * microbenchmarks/typed-array-sum.js: Added.
2570         (doTest):
2571
2572 2019-07-16  Mark Lam  <mark.lam@apple.com>
2573
2574         ArgumentsEliminationPhase should insert KillStack nodes before PutStack nodes that it adds.
2575         https://bugs.webkit.org/show_bug.cgi?id=199821
2576         <rdar://problem/52452328>
2577
2578         Reviewed by Filip Pizlo.
2579
2580         * stress/arguments-elimination-should-insert-KillStacks-before-added-PutStacks.js: Added.
2581
2582 2019-07-16  Keith Miller  <keith_miller@apple.com>
2583
2584         Unreviewed, test262 gardening.
2585
2586         * test262/expectations.yaml:
2587
2588 2019-07-15  Keith Miller  <keith_miller@apple.com>
2589
2590         A Possible Issue of Object.create method
2591         https://bugs.webkit.org/show_bug.cgi?id=199744
2592
2593         Reviewed by Yusuke Suzuki.
2594
2595         * stress/object-create-non-object-properties-parameter.js: Added.
2596         (catch):
2597
2598 2019-07-15  Keith Miller  <keith_miller@apple.com>
2599
2600         Update test262
2601         https://bugs.webkit.org/show_bug.cgi?id=199801
2602
2603         Rubber-stamped by Yusuke Suzuki.
2604
2605         * test262/expectations.yaml:
2606         * test262/latest-changes-summary.txt:
2607         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/Symbol.toStringTag.js: Added.
2608         (fg.new.FinalizationGroup):
2609         (callback):
2610         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-job-not-active-throws.js: Added.
2611         (fg.new.FinalizationGroup):
2612         (callback):
2613         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-length.js: Added.
2614         (fg.new.FinalizationGroup):
2615         (callback):
2616         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-missing-internal-throws.js: Added.
2617         (fg.new.FinalizationGroup):
2618         (callback):
2619         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-name.js: Added.
2620         (fg.new.FinalizationGroup):
2621         (callback):
2622         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-not-object-throws.js: Added.
2623         (fg.new.FinalizationGroup):
2624         (callback):
2625         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-prop-desc.js: Added.
2626         (fg.new.FinalizationGroup):
2627         (callback):
2628         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/proto.js: Added.
2629         (callback):
2630         (fg.new.FinalizationGroup):
2631         * test262/test/built-ins/FinalizationGroup/constructor.js: Added.
2632         * test262/test/built-ins/FinalizationGroup/gc-has-one-chance-to-call-cleanupCallback.js: Added.
2633         (cb):
2634         (fg.new.FinalizationGroup):
2635         (emptyCells):
2636         (async.fn):
2637         (fn.then.async):
2638         * test262/test/built-ins/FinalizationGroup/instance-extensible.js: Added.
2639         (fg.new.FinalizationGroup):
2640         * test262/test/built-ins/FinalizationGroup/length.js: Added.
2641         * test262/test/built-ins/FinalizationGroup/name.js: Added.
2642         * test262/test/built-ins/FinalizationGroup/newtarget-prototype-is-not-object.js: Added.
2643         (newTarget):
2644         (fn):
2645         * test262/test/built-ins/FinalizationGroup/prop-desc.js: Added.
2646         * test262/test/built-ins/FinalizationGroup/proto-from-ctor-realm.js: Added.
2647         (fn):
2648         * test262/test/built-ins/FinalizationGroup/proto.js: Added.
2649         * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-abrupt.js: Added.
2650         (newTarget):
2651         * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-custom.js: Added.
2652         (newTarget):
2653         * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget.js: Added.
2654         (fg.new.FinalizationGroup):
2655         * test262/test/built-ins/FinalizationGroup/prototype/Symbol.toStringTag.js: Added.
2656         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-iterator-proto.js: Added.
2657         (callback):
2658         (fg.new.FinalizationGroup):
2659         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-not-callable-throws.js: Added.
2660         (fg.new.FinalizationGroup):
2661         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-reference.js: Added.
2662         (cb):
2663         (fg.new.FinalizationGroup):
2664         (emptyCells):
2665         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-unregister.js: Added.
2666         (fg.new.FinalizationGroup):
2667         (fg.cleanupSome.cb):
2668         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanupcallback-iterator-proto.js: Added.
2669         (callback):
2670         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/custom-this.js: Added.
2671         (fn):
2672         (cb):
2673         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/gc-cleanup-not-prevented-with-wr-deref.js: Added.
2674         (cb):
2675         (fg.new.FinalizationGroup):
2676         (emptyCells):
2677         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-dynamic.js: Added.
2678         (fg.new.FinalizationGroup):
2679         (callback):
2680         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-holdings-multiple-values.js: Added.
2681         (fg.new.FinalizationGroup):
2682         (callback):
2683         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/length.js: Added.
2684         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/name.js: Added.
2685         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-callback-throws.js: Added.
2686         (poisoned):
2687         (fg.new.FinalizationGroup):
2688         (emptyCells):
2689         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-cleanup-callback-throws.js: Added.
2690         (poisoned):
2691         (emptyCells):
2692         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/prop-desc.js: Added.
2693         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined-with-gc.js: Added.
2694         (fn):
2695         (cb):
2696         (emptyCells):
2697         (prototype.assert.sameValue.fg.cleanupSome):
2698         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined.js: Added.
2699         (fn):
2700         (cb):
2701         (poisoned):
2702         (assert.sameValue.fg.cleanupSome):
2703         (prototype.assert.sameValue.fg.cleanupSome):
2704         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-does-not-have-internal-cells-throws.js: Added.
2705         (cb):
2706         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-not-object-throws.js: Added.
2707         (cb):
2708         * test262/test/built-ins/FinalizationGroup/prototype/constructor.js: Added.
2709         * test262/test/built-ins/FinalizationGroup/prototype/prop-desc.js: Added.
2710         * test262/test/built-ins/FinalizationGroup/prototype/proto.js: Added.
2711         * test262/test/built-ins/FinalizationGroup/prototype/register/custom-this.js: Added.
2712         (fn):
2713         * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-any-value-type.js: Added.
2714         (fn):
2715         * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-same-as-target.js: Added.
2716         (fg.new.FinalizationGroup):
2717         * test262/test/built-ins/FinalizationGroup/prototype/register/length.js: Added.
2718         * test262/test/built-ins/FinalizationGroup/prototype/register/name.js: Added.
2719         * test262/test/built-ins/FinalizationGroup/prototype/register/prop-desc.js: Added.
2720         * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself.js: Added.
2721         (fn):
2722         * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined.js: Added.
2723         (fn):
2724         * test262/test/built-ins/FinalizationGroup/prototype/register/target-not-object-throws.js: Added.
2725         (fg.new.FinalizationGroup):
2726         * test262/test/built-ins/FinalizationGroup/prototype/register/this-does-not-have-internal-target-throws.js: Added.
2727         * test262/test/built-ins/FinalizationGroup/prototype/register/this-not-object-throws.js: Added.
2728         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-not-object-or-undefined-throws.js: Added.
2729         (fg.new.FinalizationGroup):
2730         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target.js: Added.
2731         (fg.new.FinalizationGroup):
2732         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings.js: Added.
2733         (fg.new.FinalizationGroup):
2734         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-target.js: Added.
2735         (fg.new.FinalizationGroup):
2736         * test262/test/built-ins/FinalizationGroup/prototype/unregister/custom-this.js: Added.
2737         (fn):
2738         * test262/test/built-ins/FinalizationGroup/prototype/unregister/length.js: Added.
2739         * test262/test/built-ins/FinalizationGroup/prototype/unregister/name.js: Added.
2740         * test262/test/built-ins/FinalizationGroup/prototype/unregister/prop-desc.js: Added.
2741         * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-does-not-have-internal-cells-throws.js: Added.
2742         * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-not-object-throws.js: Added.
2743         * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregister.js: Added.
2744         (fn):
2745         * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregisterToken-not-object-throws.js: Added.
2746         (fg.new.FinalizationGroup):
2747         * test262/test/built-ins/FinalizationGroup/returns-new-object-from-constructor.js: Added.
2748         (cleanupCallback):
2749         (let.key.of.Object.getOwnPropertyNames):
2750         (set for):
2751         * test262/test/built-ins/FinalizationGroup/target-not-callable-throws.js: Added.
2752         * test262/test/built-ins/FinalizationGroup/undefined-newtarget-throws.js: Added.
2753         (FinalizationGroup):
2754         * test262/test/built-ins/FinalizationGroup/unnaffected-by-poisoned-cleanupCallback.js: Added.
2755         (cleanupCallback):
2756         (let.key.of.Object.getOwnPropertyNames):
2757         (set for):
2758         * test262/test/built-ins/Function/StrictFunction_restricted-properties.js:
2759         * test262/test/built-ins/Function/prototype/bind/BoundFunction_restricted-properties.js:
2760         * test262/test/built-ins/Function/prototype/restricted-property-arguments.js:
2761         * test262/test/built-ins/Function/prototype/restricted-property-caller.js:
2762         * test262/test/built-ins/Object/prototype/toString/proxy-function-async.js: Added.
2763         (asyncProxy.new.Proxy.async):
2764         * test262/test/built-ins/Object/prototype/toString/proxy-function.js:
2765         (asyncProxy.new.Proxy.async):
2766         * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-builtin.js: Added.
2767         (setIter.set Symbol):
2768         (set defaultTag):
2769         (gen):
2770         (get return):
2771         (set new):
2772         * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-proxy-function.js: Added.
2773         (generatorProxy.new.Proxy):
2774         (asyncProxy.new.Proxy.async):
2775         * test262/test/built-ins/Object/subclass-object-arg.js:
2776         * test262/test/built-ins/Promise/all/invoke-resolve-get-error-close.js:
2777         * test262/test/built-ins/Promise/all/resolve-element-function-name.js:
2778         * test262/test/built-ins/Promise/allSettled/invoke-resolve-get-error-close.js:
2779         * test262/test/built-ins/Promise/allSettled/reject-element-function-name.js:
2780         * test262/test/built-ins/Promise/allSettled/resolve-element-function-name.js:
2781         * test262/test/built-ins/Promise/executor-function-name.js:
2782         * test262/test/built-ins/Promise/race/invoke-resolve-get-error-close.js:
2783         * test262/test/built-ins/Promise/reject-function-name.js:
2784         * test262/test/built-ins/Promise/resolve-function-name.js:
2785         * test262/test/built-ins/Set/prototype/values/does-not-have-setdata-internal-slot-weakset.js:
2786         * test262/test/built-ins/WeakRef/constructor.js: Added.
2787         * test262/test/built-ins/WeakRef/instance-extensible.js: Added.
2788         * test262/test/built-ins/WeakRef/length.js: Added.
2789         * test262/test/built-ins/WeakRef/name.js: Added.
2790         * test262/test/built-ins/WeakRef/newtarget-prototype-is-not-object.js: Added.
2791         (newTarget):
2792         * test262/test/built-ins/WeakRef/prop-desc.js: Added.
2793         * test262/test/built-ins/WeakRef/proto-from-ctor-realm.js: Added.
2794         * test262/test/built-ins/WeakRef/proto.js: Added.
2795         * test262/test/built-ins/WeakRef/prototype-from-newtarget-abrupt.js: Added.
2796         (newTarget):
2797         * test262/test/built-ins/WeakRef/prototype-from-newtarget-custom.js: Added.
2798         (newTarget):
2799         * test262/test/built-ins/WeakRef/prototype-from-newtarget.js: Added.
2800         * test262/test/built-ins/WeakRef/prototype/Symbol.toStringTag.js: Added.
2801         * test262/test/built-ins/WeakRef/prototype/constructor.js: Added.
2802         * test262/test/built-ins/WeakRef/prototype/deref/custom-this.js: Added.
2803         * test262/test/built-ins/WeakRef/prototype/deref/gc-cleanup-not-prevented-with-wr-deref.js: Added.
2804         (emptyCells):
2805         * test262/test/built-ins/WeakRef/prototype/deref/length.js: Added.
2806         * test262/test/built-ins/WeakRef/prototype/deref/name.js: Added.
2807         * test262/test/built-ins/WeakRef/prototype/deref/prop-desc.js: Added.
2808         * test262/test/built-ins/WeakRef/prototype/deref/return-target.js: Added.
2809         * test262/test/built-ins/WeakRef/prototype/deref/this-does-not-have-internal-target-throws.js: Added.
2810         (fg.new.FinalizationGroup):
2811         * test262/test/built-ins/WeakRef/prototype/deref/this-not-object-throws.js: Added.
2812         * test262/test/built-ins/WeakRef/prototype/prop-desc.js: Added.
2813         * test262/test/built-ins/WeakRef/prototype/proto.js: Added.
2814         * test262/test/built-ins/WeakRef/returns-new-object-from-constructor.js: Added.
2815         (let.key.of.Object.getOwnPropertyNames):
2816         (set for):
2817         * test262/test/built-ins/WeakRef/target-not-object-throws.js: Added.
2818         * test262/test/built-ins/WeakRef/undefined-newtarget-throws.js: Added.
2819         * test262/test/intl402/BigInt/prototype/toLocaleString/builtin.js:
2820         * test262/test/intl402/BigInt/prototype/toLocaleString/default-options-object-prototype.js:
2821         * test262/test/intl402/BigInt/prototype/toLocaleString/length.js:
2822         * test262/test/intl402/BigInt/prototype/toLocaleString/returns-same-results-as-NumberFormat.js:
2823         * test262/test/intl402/BigInt/prototype/toLocaleString/taint-Intl-NumberFormat.js:
2824         * test262/test/intl402/BigInt/prototype/toLocaleString/this-value-invalid.js:
2825         * test262/test/intl402/BigInt/prototype/toLocaleString/throws-same-exceptions-as-NumberFormat.js:
2826         * test262/test/intl402/DateTimeFormat/constructor-options-order-quarter.js: Removed.
2827         * test262/test/intl402/DateTimeFormat/constructor-options-quarter-invalid.js: Removed.
2828         * test262/test/intl402/DateTimeFormat/constructor-options-quarter-valid.js: Removed.
2829         * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-long-en.js: Added.
2830         * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-narrow-en.js: Added.
2831         * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-short-en.js: Added.
2832         * test262/test/intl402/DateTimeFormat/prototype/format/fractionalSecondDigits.js: Added.
2833         * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-date-string.js:
2834         * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-near-time-boundaries.js:
2835         * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-to-integer.js:
2836         * test262/test/intl402/DateTimeFormat/prototype/formatRange/builtin.js:
2837         * test262/test/intl402/DateTimeFormat/prototype/formatRange/prop-desc.js:
2838         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-date-string.js:
2839         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-near-time-boundaries.js:
2840         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-to-integer.js:
2841         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/builtin.js:
2842         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/prop-desc.js:
2843         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-long-en.js: Added.
2844         (assertParts):
2845         (assertPartsNumeric):
2846         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-narrow-en.js: Added.
2847         (assertParts):
2848         (assertPartsNumeric):
2849         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-short-en.js: Added.
2850         (assertParts):
2851         (assertPartsNumeric):
2852         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/fractionalSecondDigits.js: Added.
2853         (assertParts):
2854         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-quarter.js: Removed.
2855         * test262/test/intl402/DateTimeFormat/taint-Object-prototype-quarter.js: Removed.
2856         * test262/test/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js:
2857         * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/en-us-numeric-auto.js:
2858         * test262/test/language/expressions/arrow-function/ArrowFunction_restricted-properties.js:
2859         * test262/test/language/expressions/class/elements/private-field-access-on-inner-arrow-function.js: Added.
2860         (C.prototype.method):
2861         * test262/test/language/expressions/class/elements/private-field-access-on-inner-function.js: Added.
2862         (C.prototype.method.innerFunction):
2863         (C.prototype.method):
2864         * test262/test/language/expressions/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
2865         (C):
2866         (C.method):
2867         * test262/test/language/expressions/class/elements/private-getter-access-on-inner-function.js: Added.
2868         (C):
2869         (C.method.innerFunction):
2870         (C.method):
2871         * test262/test/language/expressions/class/elements/private-getter-is-not-a-own-property.js: Added.
2872         (C):
2873         (C.checkPrivateGetter):
2874         * test262/test/language/expressions/class/elements/private-method-access-on-inner-arrow-function.js: Added.
2875         (C):
2876         (C.method):
2877         * test262/test/language/expressions/class/elements/private-method-access-on-inner-function.js: Added.
2878         (C):
2879         (C.method.innerFunction):
2880         (C.method):
2881         * test262/test/language/expressions/class/elements/private-method-is-not-a-own-property.js: Added.
2882         (C):
2883         (C.checkPrivateMethod):
2884         * test262/test/language/expressions/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
2885         (C):
2886         (C.method):
2887         * test262/test/language/expressions/class/elements/private-setter-access-on-inner-function.js: Added.
2888         (C):
2889         (C.method.innerFunction):
2890         (C.method):
2891         * test262/test/language/expressions/class/elements/private-setter-is-not-a-own-property.js: Added.
2892         (C):
2893         (C.checkPrivateSetter):
2894         * test262/test/language/expressions/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
2895         * test262/test/language/expressions/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
2896         * test262/test/language/expressions/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
2897         * test262/test/language/expressions/class/poisoned-underscore-proto.js: Added.
2898         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2899         (let.classStringExpression):
2900         (let.classStringExpression.access):
2901         (let.createAndInstantiateClass):
2902         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2903         (let.classStringExpression):
2904         (let.classStringExpression.access):
2905         (let.createAndInstantiateClass):
2906         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2907         (const.C):
2908         (let.createAndInstantiateClass):
2909         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2910         (let.classStringExpression.return.prototype.m):
2911         (let.classStringExpression.return.prototype.access):
2912         (let.createAndInstantiateClass):
2913         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2914         (let.classStringExpression.return.prototype.m):
2915         (let.classStringExpression.return.prototype.access):
2916         (let.createAndInstantiateClass):
2917         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2918         (let.classStringExpression):
2919         (let.classStringExpression.access):
2920         (let.createAndInstantiateClass):
2921         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2922         (let.classStringExpression.prototype.m):
2923         (let.classStringExpression.prototype.access):
2924         (let.classStringExpression):
2925         (let.createAndInstantiateClass):
2926         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2927         (let.classStringExpression.prototype.m):
2928         (let.classStringExpression.prototype.access):
2929         (let.classStringExpression):
2930         (let.createAndInstantiateClass):
2931         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2932         (const.C):
2933         (let.createAndInstantiateClass):
2934         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2935         (let.classStringExpression.return.C.prototype.m):
2936         (let.classStringExpression.return.C.prototype.access):
2937         (let.classStringExpression.return.C):
2938         (let.createAndInstantiateClass):
2939         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2940         (let.classStringExpression.return.C.prototype.m):
2941         (let.classStringExpression.return.C.prototype.access):
2942         (let.classStringExpression.return.C):
2943         (let.createAndInstantiateClass):
2944         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2945         (let.classStringExpression):
2946         (let.classStringExpression.access):
2947         (let.createAndInstantiateClass):
2948         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2949         (let.classStringExpression):
2950         (let.classStringExpression.access):
2951         (let.createAndInstantiateClass):
2952         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2953         (let.classStringExpression):
2954         (let.classStringExpression.access):
2955         (let.createAndInstantiateClass):
2956         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2957         (const.C):
2958         (let.createAndInstantiateClass):
2959         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2960         (let.classStringExpression.return.prototype.m):
2961         (let.classStringExpression.return.prototype.access):
2962         (let.createAndInstantiateClass):
2963         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2964         (let.classStringExpression.return.prototype.m):
2965         (let.classStringExpression.return.prototype.access):
2966         (let.createAndInstantiateClass):
2967         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
2968         (let.classStringExpression):
2969         (let.classStringExpression.access):
2970         (let.createAndInstantiateClass):
2971         * test262/test/language/expressions/new.target/unary-expr.js: Added.
2972         (new):
2973         (async):
2974         * test262/test/language/expressions/super/call-poisoned-underscore-proto.js: Added.
2975         (A):
2976         * test262/test/language/expressions/super/prop-poisoned-underscore-proto.js: Added.
2977         * test262/test/language/identifiers/vals-cjk-escaped.js: Added.
2978         * test262/test/language/identifiers/vals-cjk.js: Added.
2979         * test262/test/language/statements/class/elements/private-class-field-on-frozen-objects.js:
2980         * test262/test/language/statements/class/elements/private-field-access-on-inner-arrow-function.js: Added.
2981         (C.prototype.method):
2982         (C):
2983         * test262/test/language/statements/class/elements/private-field-access-on-inner-function.js: Added.
2984         (C.prototype.method.innerFunction):
2985         (C.prototype.method):
2986         (C):
2987         * test262/test/language/statements/class/elements/private-field-is-not-clobbered-by-computed-property.js: Added.
2988         (C.prototype.checkPrivateField):
2989         (C):
2990         * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval-on-initializer.js: Added.
2991         (C):
2992         * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval.js: Added.
2993         (C.prototype.getWithEval):
2994         (C):
2995         (D):
2996         * test262/test/language/statements/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
2997         (C.prototype.get m):
2998         (C.prototype.method):
2999         (C):
3000         * test262/test/language/statements/class/elements/private-getter-access-on-inner-function.js: Added.
3001         (C.prototype.get m):
3002         (C.prototype.method.innerFunction):
3003         (C.prototype.method):
3004         (C):
3005         * test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js:
3006         (let.createAndInstantiateClass):
3007         * test262/test/language/statements/class/elements/private-getter-is-not-a-own-property.js: Added.
3008         (C.prototype.get m):
3009         (C.prototype.checkPrivateGetter):
3010         (C):
3011         * test262/test/language/statements/class/elements/private-getter-is-not-clobbered-by-computed-property.js: Added.
3012         (C.prototype.get m):
3013         (C.prototype.checkPrivateGetter):
3014         (C):
3015         * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval-on-initializer.js: Added.
3016         (C.prototype.get m):
3017         (C):
3018         * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval.js: Added.
3019         (C.prototype.get m):
3020         (C.prototype.getWithEval):
3021         (C):
3022         (D.prototype.get m):
3023         (D):
3024         * test262/test/language/statements/class/elements/private-method-access-on-inner-arrow-function.js: Added.
3025         (C.prototype.m):
3026         (C.prototype.method):
3027         (C):
3028         * test262/test/language/statements/class/elements/private-method-access-on-inner-function.js: Added.
3029         (C.prototype.m):
3030         (C.prototype.method.innerFunction):
3031         (C.prototype.method):
3032         (C):
3033         * test262/test/language/statements/class/elements/private-method-is-not-a-own-property.js: Added.
3034         (C.prototype.m):
3035         (C.prototype.checkPrivateMethod):
3036         (C):
3037         * test262/test/language/statements/class/elements/private-method-is-not-clobbered-by-computed-property.js: Added.
3038         (C.prototype.m):
3039         (C.prototype.checkPrivateMethod):
3040         (C):
3041         * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval-on-initializer.js: Added.
3042         (C.prototype.m):
3043         (C):
3044         * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval.js: Added.
3045         (C.prototype.m):
3046         (C.prototype.getWithEval):
3047         (C):
3048         (D.prototype.m):
3049         (D):
3050         * test262/test/language/statements/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
3051         (C.prototype.set m):
3052         (C.prototype.method):
3053         (C):
3054         * test262/test/language/statements/class/elements/private-setter-access-on-inner-function.js: Added.
3055         (C.prototype.set m):
3056         (C.prototype.method.innerFunction):
3057         (C.prototype.method):
3058         (C):
3059         * test262/test/language/statements/class/elements/private-setter-is-not-a-own-property.js: Added.
3060         (C.prototype.set m):
3061         (C.prototype.checkPrivateSetter):
3062         (C):
3063         * test262/test/language/statements/class/elements/private-setter-is-not-clobbered-by-computed-property.js: Added.
3064         (C.prototype.set m):
3065         (C.prototype.checkPrivateSetter):
3066         (C):
3067         * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval-on-initializer.js: Added.
3068         (C.prototype.set m):
3069         (C):
3070         * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval.js: Added.
3071         (C.prototype.set m):
3072         (C.prototype.setWithEval):
3073         (C):
3074         (D.prototype.set m):
3075         (D):
3076         * test262/test/language/statements/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
3077         * test262/test/language/statements/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
3078         * test262/test/language/statements/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
3079         * test262/test/language/statements/class/elements/super-access-inside-a-private-getter.js: Added.
3080         (A.prototype.method):
3081         (A):
3082         (C.prototype.get m):
3083         (C.prototype.access):
3084         (C):
3085         * test262/test/language/statements/class/elements/super-access-inside-a-private-method.js: Added.
3086         (A.prototype.method):
3087         (A):
3088         (C.prototype.m):
3089         (C.prototype.access):
3090         (C):
3091         * test262/test/language/statements/class/elements/super-access-inside-a-private-setter.js: Added.
3092         (A.prototype.method):
3093         (A):
3094         (C.prototype.set m):
3095         (C.prototype.access):
3096         (C):
3097         * test262/test/language/statements/class/poisoned-underscore-proto.js: Added.
3098         (A):
3099         * test262/test/language/statements/function/13.2-30-s.js:
3100         * test262/test262-Revision.txt:
3101
3102 2019-07-15  Yusuke Suzuki  <ysuzuki@apple.com>
3103
3104         [JSC] Improve wasm wpt test results by fixing miscellaneous issues
3105         https://bugs.webkit.org/show_bug.cgi?id=199783
3106
3107         Reviewed by Mark Lam.
3108
3109         Fix our spec tests.
3110
3111         * wasm/js-api/Module-compile.js:
3112         * wasm/js-api/test_basic_api.js:
3113         (const.c.in.constructorProperties.switch):
3114         * wasm/js-api/validate.js:
3115         * wasm/js-api/web-assembly-instantiate.js:
3116         * wasm/spec-tests/jsapi.js:
3117         (testJSAPI.get test):
3118         (testJSAPI.set test):
3119
3120 2019-07-15  Michael Catanzaro  <mcatanzaro@igalia.com>
3121
3122         Unreviewed, rolling out r247440.
3123
3124         Broke builds
3125
3126         Reverted changeset:
3127
3128         "[JSC] Improve wasm wpt test results by fixing miscellaneous
3129         issues"
3130         https://bugs.webkit.org/show_bug.cgi?id=199783
3131         https://trac.webkit.org/changeset/247440
3132
3133 2019-07-15  Yusuke Suzuki  <ysuzuki@apple.com>
3134
3135         [JSC] Improve wasm wpt test results by fixing miscellaneous issues
3136         https://bugs.webkit.org/show_bug.cgi?id=199783
3137
3138         Reviewed by Mark Lam.
3139
3140         Fix our spec tests.
3141
3142         * wasm/js-api/Module-compile.js:
3143         * wasm/js-api/test_basic_api.js:
3144         (const.c.in.constructorProperties.switch):
3145         * wasm/js-api/validate.js:
3146         * wasm/js-api/web-assembly-instantiate.js:
3147         * wasm/spec-tests/jsapi.js:
3148         (testJSAPI.get test):
3149         (testJSAPI.set test):
3150
3151 2019-07-12  Justin Michaud  <justin_michaud@apple.com>
3152
3153         B3 should reduce (integer) Sub(Neg(x), y) to Neg(Add(x, y))
3154         https://bugs.webkit.org/show_bug.cgi?id=196371
3155
3156         Reviewed by Keith Miller.
3157
3158         * microbenchmarks/mul-immediate-sub.js: Added.
3159         (doTest):
3160
3161 2019-07-12  Caio Lima  <ticaiolima@gmail.com>
3162
3163         [BigInt] Add ValueBitLShift into DFG
3164         https://bugs.webkit.org/show_bug.cgi?id=192664
3165
3166         Reviewed by Saam Barati.
3167
3168         We are adding tests to cover ValueBitwise operations AI changes.
3169
3170         * stress/big-int-left-shift-untyped.js: Added.
3171         * stress/bit-op-with-object-returning-int32.js:
3172         * stress/value-bit-and-ai-rule.js: Added.
3173         * stress/value-bit-lshift-ai-rule.js: Added.
3174         * stress/value-bit-or-ai-rule.js: Added.
3175         * stress/value-bit-xor-ai-rule.js: Added.
3176
3177 2019-07-11  Justin Michaud  <justin_michaud@apple.com>
3178
3179         Add b3 macro lowering for CheckMul on arm64
3180         https://bugs.webkit.org/show_bug.cgi?id=199251
3181
3182         Reviewed by Robin Morisset.
3183
3184         * microbenchmarks/check-mul-constant.js: Added.
3185         (doTest):
3186         * microbenchmarks/check-mul-no-constant.js: Added.
3187         (doTest):
3188         * microbenchmarks/check-mul-power-of-two.js: Added.
3189         (doTest):
3190
3191 2019-07-10  Tadeu Zagallo  <tzagallo@apple.com>
3192
3193         Optimize join of large empty arrays
3194         https://bugs.webkit.org/show_bug.cgi?id=199636
3195
3196         Reviewed by Mark Lam.
3197
3198         * microbenchmarks/large-empty-array-join.js: Added.
3199         * microbenchmarks/large-empty-array-join-resolve-rope.js: Added.
3200
3201 2019-07-06  Michael Saboff  <msaboff@apple.com>
3202
3203         switch(String) needs to check for exceptions when resolving the string
3204         https://bugs.webkit.org/show_bug.cgi?id=199541
3205
3206         Reviewed by Mark Lam.
3207
3208         New tests.
3209
3210         * stress/switch-string-oom.js: Added.
3211         (test):
3212         (testLowerTiers):
3213         (testFTL):
3214
3215 2019-07-05  Mark Lam  <mark.lam@apple.com>
3216
3217         ArgumentsEliminationPhase::eliminateCandidatesThatInterfere() should not decrement nodeIndex pass zero.
3218         https://bugs.webkit.org/show_bug.cgi?id=199533
3219         <rdar://problem/52669111>
3220
3221         Reviewed by Filip Pizlo.
3222
3223         * stress/ArgumentsEliminationPhase-eliminateCandidatesThatEscape-should-not-decrement-nodeIndex-pass-zero.js: Added.
3224
3225 2019-07-05  Alexey Shvayka  <shvaikalesh@gmail.com>
3226
3227         [JSC] Clean up ArraySpeciesCreate
3228         https://bugs.webkit.org/show_bug.cgi?id=182434
3229
3230         Reviewed by Yusuke Suzuki.
3231
3232         Adjusts error message expectations in stress tests.
3233
3234         * stress/array-flatmap.js:
3235         * stress/array-flatten.js:
3236         * stress/array-species-create-should-handle-masquerader.js:
3237         * test262/expectations.yaml: Mark 4 test cases as passing.
3238
3239 2019-07-02  Michael Saboff  <msaboff@apple.com>
3240
3241         Exception from For..of loop assignment eliminates TDZ checks in subsequent code
3242         https://bugs.webkit.org/show_bug.cgi?id=199395
3243
3244         Reviewed by Filip Pizlo.
3245
3246         New regession test.
3247
3248         * stress/for-of-tdz-with-try-catch.js: Added.
3249         (test):
3250         (i.catch):
3251
3252 2019-07-02  Keith Miller  <keith_miller@apple.com>
3253
3254         Frozen Arrays length assignment should throw in strict mode
3255         https://bugs.webkit.org/show_bug.cgi?id=199365
3256
3257         Reviewed by Yusuke Suzuki.
3258
3259         * stress/frozen-array-length-should-throw-strict.js: Added.
3260         (test):
3261
3262 2019-07-01  Justin Michaud  <justin_michaud@apple.com>
3263
3264         [Wasm-References] Disable references by default
3265         https://bugs.webkit.org/show_bug.cgi?id=199390
3266
3267         Reviewed by Saam Barati.
3268
3269         * wasm/references-spec-tests/ref_is_null.js:
3270         * wasm/references-spec-tests/ref_null.js:
3271         * wasm/references/anyref_globals.js:
3272         * wasm/references/anyref_modules.js:
3273         * wasm/references/anyref_table.js:
3274         * wasm/references/anyref_table_import.js:
3275         * wasm/references/element_parsing.js:
3276         * wasm/references/func_ref.js:
3277         * wasm/references/is_null.js:
3278         * wasm/references/multitable.js:
3279         * wasm/references/table_misc.js:
3280         * wasm/references/validation.js:
3281
3282 2019-07-01  Ryan Haddad  <ryanhaddad@apple.com>
3283
3284         Unreviewed, rolling out r246946.
3285
3286         Caused JSC test crashes on arm64
3287
3288         Reverted changeset:
3289
3290         "Add b3 macro lowering for CheckMul on arm64"
3291         https://bugs.webkit.org/show_bug.cgi?id=199251
3292         https://trac.webkit.org/changeset/246946
3293
3294 2019-06-28  Justin Michaud  <justin_michaud@apple.com>
3295
3296         Add b3 macro lowering for CheckMul on arm64
3297         https://bugs.webkit.org/show_bug.cgi?id=199251
3298
3299         Reviewed by Robin Morisset.
3300
3301         * microbenchmarks/check-mul-constant.js: Added.
3302         (doTest):
3303         * microbenchmarks/check-mul-no-constant.js: Added.
3304         (doTest):
3305         * microbenchmarks/check-mul-power-of-two.js: Added.
3306         (doTest):
3307
3308 2019-06-26  Keith Miller  <keith_miller@apple.com>
3309
3310         speciesConstruct needs to throw if the result is a DataView
3311         https://bugs.webkit.org/show_bug.cgi?id=199231
3312
3313         Reviewed by Mark Lam.
3314
3315         * stress/typedarray-filter.js:
3316         (subclasses.forEach):
3317         * stress/typedarray-map.js:
3318         (subclasses.forEach):
3319         * stress/typedarray-slice.js:
3320         (typedArrays.forEach):
3321         * stress/typedarray-subarray.js:
3322         (subclasses.forEach):
3323
3324 2019-06-24  Commit Queue  <commit-queue@webkit.org>
3325
3326         Unreviewed, rolling out r246714.
3327         https://bugs.webkit.org/show_bug.cgi?id=199179
3328
3329         revert to do patch in a different way. (Requested by keith_mi_
3330         on #webkit).
3331
3332         Reverted changeset:
3333
3334         "All prototypes should call didBecomePrototype()"
3335         https://bugs.webkit.org/show_bug.cgi?id=196315
3336         https://trac.webkit.org/changeset/246714
3337
3338 2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
3339
3340         Add Array.prototype.{flat,flatMap} to unscopables
3341         https://bugs.webkit.org/show_bug.cgi?id=194322
3342
3343         Reviewed by Keith Miller.
3344
3345         * stress/unscopables.js: Fix test.
3346         * test262/expectations.yaml: Mark 2 test cases as passing.
3347
3348 2019-06-21  Mark Lam  <mark.lam@apple.com>
3349
3350         ArraySlice needs to keep the source array alive.
3351         https://bugs.webkit.org/show_bug.cgi?id=197374
3352         <rdar://problem/50304429>
3353
3354         Reviewed by Michael Saboff and Filip Pizlo.
3355
3356         * stress/array-slice-must-keep-source-array-alive.js: Added.
3357
3358 2019-06-22  Robin Morisset  <rmorisset@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
3359
3360         All prototypes should call didBecomePrototype()
3361         https://bugs.webkit.org/show_bug.cgi?id=196315
3362
3363         Reviewed by Saam Barati.
3364
3365         * stress/function-prototype-indexed-accessor.js: Added.
3366
3367 2019-06-22  Yusuke Suzuki  <ysuzuki@apple.com>
3368
3369         [JSC] Strict, Sloppy and Arrow functions should have different classInfo
3370         https://bugs.webkit.org/show_bug.cgi?id=197631
3371
3372         Reviewed by Saam Barati.
3373
3374         * stress/has-own-property-arguments.js: Added.
3375         (shouldBe):
3376         (A):
3377
3378 2019-06-22  Yusuke Suzuki  <ysuzuki@apple.com>
3379
3380         [JSC] ClassExpr should not store result in the middle of evaluation
3381         https://bugs.webkit.org/show_bug.cgi?id=199106
3382
3383         Reviewed by Tadeu Zagallo.
3384
3385         * stress/class-expression-should-store-result-at-last.js: Added.
3386         (shouldThrow):
3387         (shouldThrow.let.a):
3388
3389 2019-06-20  Justin Michaud  <justin_michaud@apple.com>
3390
3391         [WASM-References] Add extra tests for Wasm references + fix element parsing and subtyping bugs
3392         https://bugs.webkit.org/show_bug.cgi?id=199044
3393
3394         Reviewed by Saam Barati.
3395
3396         Add wasm references spec tests as well as a worker test.
3397
3398         * wasm.yaml:
3399         * wasm/Builder_WebAssemblyBinary.js:
3400         (const.emitters.Element):
3401         * wasm/js-api/element.js:
3402         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3403         * wasm/references-spec-tests/ref_is_null.js: Added.
3404         (hostref):
3405         (is_hostref):
3406         (is_funcref):
3407         (eq_ref):
3408         (let.handler.get target):
3409         (register):
3410         (module):
3411         (instance):
3412         (call):
3413         (get instance):
3414         (exports):
3415         (run):
3416         (assert_malformed):
3417         (assert_invalid):
3418         (assert_unlinkable):
3419         (assert_uninstantiable):
3420         (assert_trap):
3421         (try.f):
3422         (catch):
3423         (assert_exhaustion):
3424         (assert_return):
3425         (assert_return_canonical_nan):
3426         (assert_return_arithmetic_nan):
3427         (assert_return_ref):
3428         (assert_return_func):
3429         * wasm/references-spec-tests/ref_null.js: Added.
3430         (hostref):
3431         (is_hostref):
3432         (is_funcref):
3433         (eq_ref):
3434         (let.handler.get target):
3435         (register):
3436         (module):
3437         (instance):
3438         (call):
3439         (get instance):
3440         (exports):
3441         (run):
3442         (assert_malformed):
3443         (assert_invalid):
3444         (assert_unlinkable):
3445         (assert_uninstantiable):
3446         (assert_trap):
3447         (try.f):
3448         (catch):
3449         (assert_exhaustion):
3450         (assert_return):
3451         (assert_return_canonical_nan):
3452         (assert_return_arithmetic_nan):
3453         (assert_return_ref):
3454         (assert_return_func):
3455         * wasm/references/element_parsing.js: Added.
3456         (module):
3457         * wasm/references/func_ref.js:
3458         * wasm/references/multitable.js:
3459         * wasm/references/table_misc.js:
3460         (TableSize.0.End.End.WebAssembly):
3461         * wasm/references/validation.js:
3462         (assert.throws):
3463
3464 2019-06-19  Alexey Shvayka  <shvaikalesh@gmail.com>
3465
3466         Optimize `resolve` method lookup in Promise static methods
3467         https://bugs.webkit.org/show_bug.cgi?id=198864
3468
3469         Reviewed by Yusuke Suzuki.
3470
3471         * test262/expectations.yaml: Mark 18 test cases as passing.
3472
3473 2019-06-19  Justin Michaud  <justin_michaud@apple.com>
3474
3475         [WASM-References] Rename anyfunc to funcref
3476         https://bugs.webkit.org/show_bug.cgi?id=198983
3477
3478         Reviewed by Yusuke Suzuki.
3479
3480         * wasm/function-tests/basic-element.js:
3481         * wasm/function-tests/context-switch.js:
3482         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3483         (makeInstance):
3484         (assert.eq.makeInstance):
3485         * wasm/function-tests/exceptions.js:
3486         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3487         * wasm/function-tests/grow-memory-2.js:
3488         (assert.eq.instance.exports.foo):
3489         * wasm/function-tests/nameSection.js:
3490         (const.compile):
3491         * wasm/function-tests/stack-overflow.js:
3492         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3493         (assertOverflows.makeInstance):
3494         * wasm/function-tests/table-basic-2.js:
3495         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3496         * wasm/function-tests/table-basic.js:
3497         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3498         * wasm/function-tests/trap-from-start-async.js:
3499         * wasm/function-tests/trap-from-start.js:
3500         * wasm/js-api/Module.exports.js:
3501         (assert.truthy):
3502         * wasm/js-api/Module.imports.js:
3503         (assert.truthy):
3504         * wasm/js-api/call-indirect.js:
3505         (const.oneTable):
3506         (const.multiTable):
3507         (multiTable.const.makeTable):
3508         (multiTable):
3509         (multiTable.Polyphic2Import):
3510         (multiTable.VirtualImport):
3511         * wasm/js-api/element-data.js:
3512         * wasm/js-api/element.js:
3513         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3514         (assert.throws):
3515         (badInstantiation.makeModule):
3516         (badInstantiation.test):
3517         (badInstantiation):
3518         * wasm/js-api/extension-MemoryMode.js:
3519         * wasm/js-api/table.js:
3520         (new.WebAssembly.Module):
3521         (assert.throws):
3522         (assertBadTableImport):
3523         (assert.throws.WebAssembly.Table.prototype.grow):
3524         (new.WebAssembly.Table):
3525         (assertBadTable):
3526         (assert.truthy):
3527         * wasm/js-api/test_basic_api.js:
3528         (const.c.in.constructorProperties.switch):
3529         * wasm/js-api/unique-signature.js:
3530         (CallIndirectWithDuplicateSignatures):
3531         * wasm/js-api/wrapper-function.js:
3532         * wasm/modules/table.wat:
3533         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
3534         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
3535         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
3536         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
3537         * wasm/references/anyref_table.js:
3538         * wasm/references/anyref_table_import.js:
3539         (doSet):
3540         (assert.throws):
3541         * wasm/references/func_ref.js:
3542         (makeFuncrefIdent):
3543         (assert.eq.instance.exports.fix):
3544         (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly.assert.throws):
3545         (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly):
3546         (let.importedFun.of):
3547         (makeAnyfuncIdent): Deleted.
3548         (makeAnyfuncIdent.fun): Deleted.
3549         * wasm/references/multitable.js:
3550         (assert.eq):
3551         (assert.throws):
3552         * wasm/references/table_misc.js:
3553         (GetLocal.0.TableFill.0.End.End.WebAssembly):
3554         * wasm/references/validation.js:
3555         (assert.throws.new.WebAssembly.Module.bin):
3556         (assert.throws):
3557         * wasm/spec-harness/index.js:
3558         * wasm/spec-harness/wasm-constants.js:
3559         * wasm/spec-harness/wasm-module-builder.js:
3560         (WasmModuleBuilder.prototype.toArray):
3561         * wasm/spec-harness/wast.js:
3562         (elem_type):
3563         (string_of_elem_type):
3564         (string_of_table_type):
3565         * wasm/spec-tests/jsapi.js:
3566         * wasm/stress/wasm-table-grow-initialize.js:
3567         * wasm/wasm.json:
3568
3569 2019-06-18  Justin Michaud  <justin_michaud@apple.com>
3570
3571         [WASM-References] Add support for Table.size, grow and fill instructions
3572         https://bugs.webkit.org/show_bug.cgi?id=198761
3573
3574         Reviewed by Yusuke Suzuki.
3575
3576         * wasm/Builder_WebAssemblyBinary.js:
3577         (const.putOp):
3578         * wasm/references/table_misc.js: Added.
3579         (TableSize.End.End.WebAssembly):
3580         (GetLocal.0.GetLocal.1.TableGrow.End.End.WebAssembly):
3581         * wasm/wasm.json:
3582
3583 2019-06-18  Justin Michaud  <justin_michaud@apple.com>
3584
3585         [WASM-References] Add support for multiple tables
3586         https://bugs.webkit.org/show_bug.cgi?id=198760
3587
3588         Reviewed by Saam Barati.
3589
3590         * wasm/Builder.js:
3591         * wasm/js-api/call-indirect.js:
3592         (const.oneTable):
3593         (const.multiTable):
3594         (multiTable):
3595         (multiTable.Polyphic2Import):
3596         (multiTable.VirtualImport):
3597         (const.wasmModuleWhichImportJS): Deleted.
3598         (const.makeTable): Deleted.
3599         (): Deleted.
3600         (Polyphic2Import): Deleted.
3601         (VirtualImport): Deleted.
3602         * wasm/js-api/table.js:
3603         (new.WebAssembly.Module):
3604         (assert.throws):
3605         (assertBadTableImport):
3606         (assert.truthy):
3607         (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
3608         * wasm/references/anyref_table.js:
3609         * wasm/references/anyref_table_import.js:
3610         (makeImport):
3611         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
3612         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
3613         * wasm/references/multitable.js: Added.
3614         (assert.throws.1.exports.set_tbl0):
3615         (assert.throws):
3616         (assert.eq):
3617         * wasm/references/validation.js:
3618         (assert.throws.new.WebAssembly.Module.bin):
3619         (assert.throws):
3620         * wasm/spec-tests/imports.wast.js:
3621         * wasm/wasm.json:
3622
3623         * wasm/Builder.js:
3624         * wasm/js-api/call-indirect.js:
3625         (const.oneTable):
3626         (const.multiTable):
3627         (multiTable):
3628         (multiTable.Polyphic2Import):
3629         (multiTable.VirtualImport):
3630         (const.wasmModuleWhichImportJS): Deleted.
3631         (const.makeTable): Deleted.
3632         (): Deleted.
3633         (Polyphic2Import): Deleted.
3634         (VirtualImport): Deleted.
3635         * wasm/js-api/table.js:
3636         (new.WebAssembly.Module):
3637         (assert.throws):
3638         (assertBadTableImport):
3639         (assert.truthy):
3640         (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
3641         * wasm/references/anyref_table.js:
3642         * wasm/references/anyref_table_import.js:
3643         (makeImport):
3644         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
3645         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
3646         * wasm/references/func_ref.js:
3647         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun): Deleted.
3648         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws): Deleted.
3649         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly): Deleted.
3650         * wasm/references/multitable.js: Added.
3651         (assert.throws.1.exports.set_tbl0):
3652         (assert.throws):
3653         (assert.eq):
3654         (string_appeared_here.tableInsanity):
3655         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly.):
3656         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly):
3657         * wasm/references/validation.js:
3658         (assert.throws.new.WebAssembly.Module.bin):
3659         (assert.throws):
3660         * wasm/spec-tests/imports.wast.js:
3661         * wasm/wasm.json:
3662
3663 2019-06-18  Alexey Shvayka  <shvaikalesh@gmail.com>
3664
3665         [ESNExt] String.prototype.matchAll
3666         https://bugs.webkit.org/show_bug.cgi?id=186694
3667
3668         Reviewed by Yusuke Suzuki.
3669
3670         Implement String.prototype.matchAll.
3671         (https://tc39.es/ecma262/#sec-string.prototype.matchall)
3672
3673         * test262/config.yaml:
3674
3675 2019-06-18  Tadeu Zagallo  <tzagallo@apple.com>
3676
3677         DFG code should not reify the names of builtin functions with private names
3678         https://bugs.webkit.org/show_bug.cgi?id=198849
3679         <rdar://problem/51733890>
3680
3681         Reviewed by Filip Pizlo.
3682
3683         * stress/builtin-private-function-name.js: Added.
3684         (then):
3685         (PromiseLike):
3686
3687 2019-06-18  Keith Miller  <keith_miller@apple.com>
3688
3689         MaybeParseAsGeneratorForScope sometimes loses track of its scope ref
3690         https://bugs.webkit.org/show_bug.cgi?id=198969
3691         <rdar://problem/51620714>
3692
3693         Reviewed by Tadeu Zagallo.
3694
3695         * stress/nested-yield-in-arrow-function-should-be-a-syntax-error.js: Added.
3696         (catch):
3697
3698 2019-06-17  Justin Michaud  <justin_michaud@apple.com>
3699
3700         Validate that table element type is funcref if using an element section
3701         https://bugs.webkit.org/show_bug.cgi?id=198910
3702
3703         Reviewed by Yusuke Suzuki.
3704
3705         * wasm/references/anyref_table.js:
3706
3707 2019-06-17  Yusuke Suzuki  <ysuzuki@apple.com>
3708
3709         [JSC] Introduce DisposableCallSiteIndex to enforce type-safety
3710         https://bugs.webkit.org/show_bug.cgi?id=197378
3711
3712         Reviewed by Saam Barati.
3713
3714         * stress/disposable-call-site-index-with-call-and-this.js: Added.
3715         (foo):
3716         (bar):
3717         * stress/disposable-call-site-index.js: Added.
3718         (foo):
3719         (bar):
3720
3721 2019-06-17  Justin Michaud  <justin_michaud@apple.com>
3722
3723         [WASM-References] Add support for Funcref in parameters and return types
3724         https://bugs.webkit.org/show_bug.cgi?id=198157
3725
3726         Reviewed by Yusuke Suzuki.
3727
3728         * wasm/Builder.js:
3729         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3730         * wasm/references/anyref_globals.js:
3731         * wasm/references/func_ref.js: Added.
3732         (fullGC.gc.makeExportedFunction):
3733         (makeExportedIdent):
3734         (makeAnyfuncIdent):
3735         (fun):
3736         (assert.eq.instance.exports.fix.fun):
3737         (assert.eq.instance.exports.fix):
3738         (string_appeared_here.End.End.Function.End.Code.End.WebAssembly.imp.ref):
3739         (string_appeared_here.End.End.Function.End.Code.End.WebAssembly):
3740         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun):
3741         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws):
3742         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly):
3743         (assert.throws):
3744         (assert.throws.doTest):
3745         (let.importedFun.of):
3746         (makeAnyfuncIdent.fun):
3747         * wasm/references/validation.js:
3748         (assert.throws):
3749         * wasm/wasm.json:
3750
3751 2019-06-17  Ross Kirsling  <ross.kirsling@sony.com>
3752
3753         Update test262 tests (2019.06.13)
3754         https://bugs.webkit.org/show_bug.cgi?id=198821
3755
3756         Reviewed by Konstantin Tokarev.
3757
3758         * test262/expectations.yaml:
3759         * test262/harness/:
3760         * test262/latest-changes-summary.txt:
3761         * test262/test/:
3762         * test262/test262-Revision.txt:
3763
3764 2019-06-16  Yusuke Suzuki  <ysuzuki@apple.com>
3765
3766         [JSC] Grown region of WasmTable should be initialized with null
3767         https://bugs.webkit.org/show_bug.cgi?id=198903
3768
3769         Reviewed by Saam Barati.
3770
3771         * wasm/stress/wasm-table-grow-initialize.js: Added.
3772         (shouldBe):
3773
3774 2019-06-13  Yusuke Suzuki  <ysuzuki@apple.com>
3775
3776         Yarr bytecode compilation failure should be gracefully handled
3777         https://bugs.webkit.org/show_bug.cgi?id=198700
3778
3779         Reviewed by Michael Saboff.
3780
3781         * stress/regexp-bytecode-compilation-fail.js: Added.
3782         (shouldThrow):
3783
3784 2019-06-12  Yusuke Suzuki  <ysuzuki@apple.com>
3785
3786         [JSC] Polymorphic call stub's slow path should restore callee saves before performing tail call
3787         https://bugs.webkit.org/show_bug.cgi?id=198770
3788
3789         Reviewed by Saam Barati.
3790
3791         * stress/poly-call-stub-slow-path-should-restore-callee-saves-when-doing-tail-call.js: Added.
3792         (test):
3793
3794 2019-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>
3795
3796         JSC should throw if proxy set returns falsish in strict mode context
3797         https://bugs.webkit.org/show_bug.cgi?id=177398
3798
3799         Reviewed by Yusuke Suzuki.
3800
3801         1. Add coverage for Proxy `set` trap returning falsy value in strict mode.
3802         2. RegExp methods throw unless [[Set]] succeeds. Return `true` from Proxy `set` traps to fix the tests.
3803
3804         * stress/proxy-set.js: Add 2 test cases.
3805         * stress/regexp-match-proxy.js: Fix test.
3806         * stress/regexp-replace-proxy.js: Fix test.
3807
3808 2019-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>
3809
3810         Error message for non-callable Proxy `construct` trap is misleading
3811         https://bugs.webkit.org/show_bug.cgi?id=198637
3812
3813         Reviewed by Saam Barati.
3814
3815         * stress/proxy-construct.js:
3816
3817 2019-06-10  Tadeu Zagallo  <tzagallo@apple.com>
3818
3819         AI BitURShift's result should not be unsigned
3820         https://bugs.webkit.org/show_bug.cgi?id=198689
3821         <rdar://problem/51550063>
3822
3823         Reviewed by Saam Barati.
3824
3825         * stress/urshift-int32-overflow.js: Added.
3826         (foo.):
3827         (foo):
3828
3829 2019-06-11  Guillaume Emont  <guijemont@igalia.com>
3830
3831         Skip stress/ftl-gettypedarrayoffset-wasteful.js on Arm/Linux
3832
3833         Unreviewed gardening.
3834
3835         * stress/ftl-gettypedarrayoffset-wasteful.js:
3836         Skipped on arm/linux as it always times out on the bot since a change
3837         between r246270 and r246278 inclusive.
3838
3839 2019-06-10  Yusuke Suzuki  <ysuzuki@apple.com>
3840
3841         [JSC] UnlinkedCodeBlock should be eventually jettisoned in VM mini mode
3842         https://bugs.webkit.org/show_bug.cgi?id=198023
3843
3844         Reviewed by Saam Barati.
3845
3846         * stress/reparsing-unlinked-codeblock.js: Added.
3847         (shouldBe):
3848         (hello):
3849
3850 2019-06-09  Yusuke Suzuki  <ysuzuki@apple.com>
3851
3852         [JSC] Use mergePrediction in ValuePow prediction propagation
3853         https://bugs.webkit.org/show_bug.cgi?id=198648
3854
3855         Reviewed by Saam Barati.
3856
3857         * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.
3858
3859 2019-06-07  Tadeu Zagallo  <tzagallo@apple.com>
3860
3861         AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset
3862         https://bugs.webkit.org/show_bug.cgi?id=198581
3863         <rdar://problem/51099753>
3864
3865         Reviewed by Saam Barati.
3866
3867         * stress/global-object-proto-getter.js: Added.
3868         (f):
3869         (test):
3870
3871 2019-06-05  Justin Michaud  <justin_michaud@apple.com>
3872
3873         [WASM-References] Add support for Anyref tables, Table.get and Table.set (for Anyref only).
3874         https://bugs.webkit.org/show_bug.cgi?id=198398
3875
3876         Reviewed by Saam Barati.
3877
3878         * wasm/references/anyref_table.js: Added.
3879         (string_appeared_here.doGCSet):
3880         (doGCTest):
3881         (doGCSet.doGCTest.let.count.0.doBarrierSet):
3882         * wasm/references/anyref_table_import.js: Added.
3883         (makeImport):
3884         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
3885         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
3886         * wasm/references/is_null_error.js: Removed.
3887         * wasm/references/validation.js: Added.
3888         (assert.throws.new.WebAssembly.Module.bin):
3889         (assert.throws):
3890         * wasm/wasm.json:
3891
3892 2019-06-05  Justin Michaud  <justin_michaud@apple.com>
3893
3894         WebAssembly: pow functions returns 0 when exponent 1.0 or -1.0
3895         https://bugs.webkit.org/show_bug.cgi?id=198106
3896
3897         Reviewed by Saam Barati.
3898
3899         * wasm/regress/selectf64.js: Added.
3900         * wasm/regress/selectf64.wasm: Added.
3901         * wasm/regress/selectf64.wat: Added.
3902
3903 2019-06-04  Tadeu Zagallo  <tzagallo@apple.com>
3904
3905         Argument elimination should check transitive dependents for interference
3906         https://bugs.webkit.org/show_bug.cgi?id=198520
3907         <rdar://problem/50863343>
3908
3909         Reviewed by Filip Pizlo.
3910
3911         * stress/argument-elimination-inline-rest-past-kill.js: Added.
3912         (f2):
3913         (f3):
3914
3915 2019-06-04  Tadeu Zagallo  <tzagallo@apple.com>
3916
3917         Argument elimination should check for negative indices in GetByVal
3918         https://bugs.webkit.org/show_bug.cgi?id=198302
3919         <rdar://problem/51188095>
3920
3921         Reviewed by Filip Pizlo.
3922
3923         * stress/eliminate-arguments-negative-rest-access.js: Added.
3924         (inlinee):
3925         (opt):
3926
3927 2019-06-03  Caio Lima  <ticaiolima@gmail.com>
3928
3929         [ESNext][BigInt] Implement support for "**"
3930         https://bugs.webkit.org/show_bug.cgi?id=190799
3931
3932         Reviewed by Saam Barati.
3933
3934         * stress/big-int-exp-basic.js: Added.
3935         * stress/big-int-exp-jit-osr.js: Added.
3936         * stress/big-int-exp-jit-untyped.js: Added.
3937         * stress/big-int-exp-jit.js: Added.
3938         * stress/big-int-exp-negative-exponent.js: Added.
3939         * stress/big-int-exp-to-primitive.js: Added.
3940         * stress/big-int-exp-type-error.js: Added.
3941         * stress/big-int-exp-wrapped-value.js: Added.
3942         * stress/value-pow-ai-rule.js: Added.
3943
3944 2019-05-30  Tadeu Zagallo  <tzagallo@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
3945
3946         [JSC] Implement op_wide16 / op_wide32 and introduce 16bit version bytecode
3947         https://bugs.webkit.org/show_bug.cgi?id=197979
3948
3949         Reviewed by Filip Pizlo.
3950
3951         * stress/16bit-code.js: Added.
3952         (shouldBe):
3953         * stress/32bit-code.js: Added.
3954         (shouldBe):
3955
3956 2019-05-30  Justin Michaud  <justin_michaud@apple.com>
3957
3958         oss-fuzz: jsc: Issue 15016: jsc: Abrt in JSC::Wasm::AirIRGenerator::addLocal (15016)
3959         https://bugs.webkit.org/show_bug.cgi?id=198355
3960
3961         Reviewed by Saam Barati.
3962
3963         * wasm/references/is_null.js:
3964
3965 2019-05-30  Stephan Szabo  <stephan.szabo@sony.com>
3966
3967         [PlayStation] Skip additional tests on PlayStation
3968         https://bugs.webkit.org/show_bug.cgi?id=198352
3969
3970         Reviewed by Don Olmstead.
3971
3972         Skip pow test on PlayStation due to behavior difference in standard library.
3973         Skip incremental marking test due to OOM on PlayStation systems.
3974
3975         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
3976         * stress/math-pow-with-constants.js:
3977         * stress/pow-with-constants.js:
3978
3979 2019-05-28  Dean Jackson  <dino@apple.com>
3980
3981         Implement Promise.allSettled
3982         https://bugs.webkit.org/show_bug.cgi?id=197600
3983         <rdar://problem/50483885>
3984
3985         Reviewed by Keith Miller.
3986
3987         Start testing Promise.allSettled. We pass most of the tests.
3988         The ones that fail are similar to the Promise.all tests we already fail.
3989
3990         * test262/config.yaml: Remove Promise.allSettled from skipped tests.
3991         * test262/expectations.yaml: Add new expectations for allSettled tests.
3992
3993 2019-05-28  Michael Saboff  <msaboff@apple.com>
3994
3995         [YARR] Properly handle RegExp's that require large ParenContext space
3996         https://bugs.webkit.org/show_bug.cgi?id=198065
3997
3998         Reviewed by Keith Miller.
3999
4000         New test.
4001
4002         * stress/regexp-large-paren-context.js: Added.
4003         (testLargeRegExp):
4004
4005 2019-05-28  Tadeu Zagallo  <tzagallo@apple.com>
4006
4007         JITOperations putByVal should mark negative array indices as out-of-bounds
4008         https://bugs.webkit.org/show_bug.cgi?id=198271
4009
4010         Reviewed by Saam Barati.
4011
4012         * microbenchmarks/get-by-val-negative-array-index.js:
4013         (foo):
4014         Update the getByVal microbenchmark added in r245769. This now shows that r245769
4015         is 4.2x faster than the previous commit.
4016
4017         * microbenchmarks/put-by-val-negative-array-index.js: Added.
4018         (foo):
4019
4020 2019-05-25  Tadeu Zagallo  <tzagallo@apple.com>
4021
4022         JITOperations getByVal should mark negative array indices as out-of-bounds
4023         https://bugs.webkit.org/show_bug.cgi?id=198229
4024
4025         Reviewed by Saam Barati.
4026
4027         * microbenchmarks/get-by-val-negative-array-index.js: Added.
4028         (foo):
4029
4030 2019-05-24  Justin Michaud  <justin_michaud@apple.com>
4031
4032         [WASM-References] Support Anyref in globals
4033         https://bugs.webkit.org/show_bug.cgi?id=198102
4034
4035         Reviewed by Saam Barati.
4036
4037         Add test for anyrefs in globals, as well as adding a new RefNull initExpr for Builder.
4038
4039         * wasm/Builder.js:
4040         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
4041         * wasm/Builder_WebAssemblyBinary.js:
4042         (const.putInitExpr):
4043         * wasm/references/anyref_globals.js: Added.
4044         (GetGlobal.0.End.End.WebAssembly):
4045         (5.doGCSet):
4046         (doGCTest):
4047         (doGCSet.doGCTest.let.count.0.doBarrierSet):
4048
4049 2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
4050
4051         DFG::OSREntry should not perform arity check
4052         https://bugs.webkit.org/show_bug.cgi?id=198189
4053
4054         Reviewed by Saam Barati.
4055
4056         * microbenchmarks/loop-osr-with-arity-mismatch.js: Added.
4057         (foo):
4058
4059 2019-05-23  Stephan Szabo  <stephan.szabo@sony.com>
4060
4061         [PlayStation] Skip additional tests on PlayStation
4062         https://bugs.webkit.org/show_bug.cgi?id=198145
4063
4064         Reviewed by Ross Kirsling.
4065
4066         * exceptionFuzz.yaml:
4067         Add skip on hostOS playstation
4068         * executableAllocationFuzz.yaml:
4069         Add skip on hostOS playstation
4070
4071 2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
4072
4073         createListFromArrayLike should throw if value is not an object
4074         https://bugs.webkit.org/show_bug.cgi?id=198138
4075
4076         Reviewed by Yusuke Suzuki.
4077
4078         * stress/create-list-from-array-like-not-object.js: Added.
4079         (testValid):
4080         (testInvalid):
4081         * stress/proxy-get-own-property-names-should-not-clear-previous-results.js:
4082         (opt):
4083         * stress/proxy-proto-enumerator.js: Added.
4084         (main):
4085         * stress/proxy-proto-own-keys.js: Added.
4086         (assert):
4087         (ownKeys):
4088
4089 2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
4090
4091         [JSC] ArrayAllocationProfile should not access to butterfly in concurrent compiler
4092         https://bugs.webkit.org/show_bug.cgi?id=197809
4093
4094         Reviewed by Michael Saboff.
4095
4096         * stress/array-allocation-profile-should-not-update-itself-in-concurrent-compiler.js: Added.
4097         (foo):
4098
4099 2019-05-22  Ross Kirsling  <ross.kirsling@sony.com>
4100
4101         [ESNext] Implement support for Numeric Separators
4102         https://bugs.webkit.org/show_bug.cgi?id=196351
4103
4104         Reviewed by Keith Miller.
4105
4106         * stress/numeric-literal-separators.js: Added.
4107         Add tests for feature.
4108
4109         * test262/expectations.yaml:
4110         Mark 60 test cases as passing.
4111
4112 2019-05-22  Tadeu Zagallo  <tzagallo@apple.com>
4113
4114         llint_slow_path_get_by_id needs to hold the CodeBlock's to update the metadata's mode
4115         https://bugs.webkit.org/show_bug.cgi?id=198120
4116         <rdar://problem/49668795>
4117
4118         Reviewed by Michael Saboff.
4119
4120         * stress/get-array-length-concurrently-change-mode.js: Added.
4121         (main):
4122
4123 2019-05-22  Commit Queue  <commit-queue@webkit.org>
4124
4125         Unreviewed, rolling out r245634.
4126         https://bugs.webkit.org/show_bug.cgi?id=198140
4127
4128         'This patch makes JSC crash on launch in debug builds'
4129         (Requested by tadeuzagallo on #webkit).
4130
4131         Reverted changeset:
4132
4133         "[ESNext] Implement support for Numeric Separators"
4134         https://bugs.webkit.org/show_bug.cgi?id=196351
4135         https://trac.webkit.org/changeset/245634
4136
4137 2019-05-22  Tadeu Zagallo  <tzagallo@apple.com>
4138
4139         Stack-buffer-overflow in decodeURIComponent
4140         https://bugs.webkit.org/show_bug.cgi?id=198109
4141         <rdar://problem/50397550>
4142
4143         Reviewed by Michael Saboff.
4144
4145         * stress/decode-uri-icu-count-trail-bytes.js: Added.
4146         (i.j.try.i.toString):
4147         (i.j.catch):
4148
4149 2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
4150
4151         Don't clear PropertyNameArray in Proxy code
4152         https://bugs.webkit.org/show_bug.cgi?id=197691
4153
4154         Reviewed by Saam Barati.
4155
4156         * stress/proxy-get-own-property-names-should-not-clear-previous-results.js: Added.
4157         (shouldBe):
4158         (opt):
4159
4160 2019-05-22  Ross Kirsling  <ross.kirsling@sony.com>
4161
4162         [ESNext] Implement support for Numeric Separators
4163         https://bugs.webkit.org/show_bug.cgi?id=196351
4164
4165         Reviewed by Keith Miller.
4166
4167         * stress/numeric-literal-separators.js: Added.
4168         Add tests for feature.
4169
4170         * test262/expectations.yaml:
4171         Mark 60 test cases as passing.
4172
4173 2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
4174
4175         [JSC] ArrayBufferContents::tryAllocate signs the pointer with allocation size and authenticates it with sizeInBytes
4176         https://bugs.webkit.org/show_bug.cgi?id=198101
4177
4178         Reviewed by Michael Saboff.
4179
4180         * stress/zero-sized-array-buffer-pointer-should-be-signed-with-zero.js: Added.
4181         (shouldBe):
4182
4183 2019-05-20  Keith Miller  <keith_miller@apple.com>
4184
4185         Cleanup Yarr regexp code around paren contexts.
4186         https://bugs.webkit.org/show_bug.cgi?id=198063
4187
4188         Reviewed by Yusuke Suzuki.
4189
4190         * stress/regexp-many-named-sequential-capture-groups.js: Added.
4191         (i.s):
4192         * stress/regexp-many-unnamed-sequential-capture-groups.js: Added.
4193
4194 2019-05-17  Justin Michaud  <justin_michaud@apple.com>
4195
4196         [WASM-References] Add support for Anyref in parameters and return types, Ref.null and Ref.is_null for Anyref values.
4197         https://bugs.webkit.org/show_bug.cgi?id=197969
4198
4199         Reviewed by Keith Miller.
4200
4201         Support the anyref type in Builder.js, plus add some extra error logging.
4202         Add new folder for wasm references tests.
4203
4204         * wasm.yaml:
4205         * wasm/Builder.js:
4206         (const._isValidValue):
4207         * wasm/references/anyref_modules.js: Added.
4208         (Call.3.RefIsNull.End.End.WebAssembly.js.ident):
4209         (Call.3.RefIsNull.End.End.WebAssembly.js.make_null):
4210         (Call.3.RefIsNull.End.End.WebAssembly):
4211         (undefined):
4212         * wasm/references/is_null.js: Added.
4213         * wasm/references/is_null_error.js: Added.
4214         * wasm/spec-harness/index.js:
4215         * wasm/wasm.json:
4216
4217 2019-05-16  Ross Kirsling  <ross.kirsling@sony.com>
4218
4219         [JSC] Invalid AssignmentTargetType should be an early error.
4220         https://bugs.webkit.org/show_bug.cgi?id=197603
4221
4222         Reviewed by Keith Miller.
4223
4224         * test262/expectations.yaml:
4225         Update expectations to reflect new SyntaxErrors.
4226         (Ideally, these should all be viewed as passing in the near future.)
4227
4228         * stress/async-await-basic.js:
4229         * stress/big-int-literals.js:
4230         Update tests to reflect new SyntaxErrors.
4231
4232         * ChakraCore.yaml:
4233         * ChakraCore/test/EH/try6.baseline-jsc:
4234         * ChakraCore/test/Error/variousErrors3.baseline-jsc: Added.
4235         Update baselines to reflect new SyntaxErrors.
4236
4237 2019-05-15  Saam Barati  <sbarati@apple.com>
4238
4239         Bound liveness of SetArgumentMaybe nodes when maximal flush insertion phase is enabled
4240         https://bugs.webkit.org/show_bug.cgi?id=197855
4241         <rdar://problem/50236506>
4242
4243         Reviewed by Michael Saboff.
4244
4245         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js: Added.
4246         (f0):
4247         (bar):
4248         (foo):
4249         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js: Added.
4250         (f1):
4251         (f2):
4252         (foo):
4253
4254 2019-05-14  Keith Miller  <keith_miller@apple.com>
4255
4256         Fix issue with byteOffset on ARM64E
4257         https://bugs.webkit.org/show_bug.cgi?id=197884
4258
4259         Reviewed by Saam Barati.
4260
4261         We didn't have any tests that run with non-byte/non-zero offset
4262         typed arrays.
4263
4264         * stress/ftl-gettypedarrayoffset-wasteful.js:
4265
4266 2019-05-14  Yusuke Suzuki  <ysuzuki@apple.com>
4267
4268         [JSC] Shrink sizeof(UnlinkedFunctionExecutable) more
4269         https://bugs.webkit.org/show_bug.cgi?id=197833
4270
4271         Reviewed by Darin Adler.
4272
4273         * stress/generator-name.js: Added.
4274         (shouldBe):
4275         (gen):
4276         (catch):
4277
4278 2019-05-13  Tadeu Zagallo  <tzagallo@apple.com>
4279
4280         JSObject::getOwnPropertyDescriptor is missing an exception check
4281         https://bugs.webkit.org/show_bug.cgi?id=197693
4282         <rdar://problem/50441784>
4283
4284         Reviewed by Saam Barati.
4285
4286         * stress/proxy-spread.js: Added.
4287         (foo):
4288
4289 2019-05-10  Saam barati  <sbarati@apple.com>
4290
4291         Call to JSToWasmICCallee::createStructure passes in wrong prototype value
4292         https://bugs.webkit.org/show_bug.cgi?id=197807
4293         <rdar://problem/50530400>
4294
4295         Reviewed by Yusuke Suzuki.
4296
4297         * stress/js-to-wasm-callee-has-correct-prototype.js: Added.
4298         (test.getInstance):
4299         (test):
4300
4301 2019-05-10  Ross Kirsling  <ross.kirsling@sony.com>
4302
4303         [Test262] Unreviewed expectations update following r245188.
4304
4305         * test262/config.yaml:
4306         * test262/expectations.yaml:
4307
4308         * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-infinity-throws.js:
4309         * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-is-nan-throws.js:
4310         * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-undefined-throws.js:
4311         * test262/test/intl402/DateTimeFormat/prototype/formatRange/date-x-greater-than-y-throws.js:
4312         * test262/test/intl402/DateTimeFormat/prototype/formatRange/this-is-not-object-throws.js:
4313         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-infinity-throws.js:
4314         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/date-is-nan-throws.js:
<