691deccbd77da412080a27cdd7244ed8273bc1c0
[WebKit-https.git] / JSTests / ChangeLog
1 2017-03-09  Caio Lima  <ticaiolima@gmail.com>
2
3         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
4         https://bugs.webkit.org/show_bug.cgi?id=167962
5
6         Reviewed by Keith Miller.
7
8         * stress/object-rest-deconstruct.js: Added.
9         (let.assert):
10         (let.assertPropDescriptor):
11         (catch):
12         (get 3):
13         (foo):
14         (let.src.get y):
15         (let.src.set y):
16         (let.gen):
17
18 2017-03-09  Saam Barati  <sbarati@apple.com>
19
20         WebAssembly: Make the Unity AngryBots demo run
21         https://bugs.webkit.org/show_bug.cgi?id=169268
22
23         Reviewed by Keith Miller.
24
25         * wasm/function-tests/many-arguments-to-function.js: Added.
26         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.I32Const.0.I32Const.1.I32Const.2.I32Const.3.I32Const.4.I32Const.5.I32Const.6.I32Const.7.I32Const.8.I32Const.9.I32Const.10.I32Const.11.I32Const.12.I32Const.13.I32Const.14.I32Const.15.I32Const.16.I32Const.17.Call.0.Return.End.End.foo):
27         (i.instance.exports.f0.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.F32Const.Call.Return.End.End.foo):
28         (i.instance.exports.f0):
29         (instance.exports.f0.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.GetLocal.Call.Return.End.End.foo):
30         (instance.exports.f0):
31
32 2017-03-08  Yusuke Suzuki  <utatane.tea@gmail.com>
33
34         [GTK] JSC test stress/arity-check-ftl-throw.js.ftl-no-cjit-validate-sampling-profiler crashing on GTK bot
35         https://bugs.webkit.org/show_bug.cgi?id=160124
36
37         Reviewed by Mark Lam.
38
39         * stress/spread-forward-call-varargs-stack-overflow.js:
40
41 2017-03-06  Saam Barati  <sbarati@apple.com>
42
43         WebAssembly: Implement the WebAssembly.instantiate API
44         https://bugs.webkit.org/show_bug.cgi?id=165982
45         <rdar://problem/29760110>
46
47         Reviewed by Keith Miller.
48
49         * wasm/js-api/web-assembly-instantiate.js: Added.
50         (assert.eq.async.test):
51         (assert.eq):
52         (assert.truthy.async.test):
53         (assert.truthy):
54
55 2017-03-06  Saam Barati  <sbarati@apple.com>
56
57         Unreviewed. Fix test expected error message.
58
59         * wasm/js-api/element.js:
60         (assert.throws):
61
62 2017-03-06  Caio Lima  <ticaiolima@gmail.com>
63
64         op_get_by_id_with_this should use inline caching
65         https://bugs.webkit.org/show_bug.cgi?id=162124
66
67         Reviewed by Saam Barati.
68
69         * microbenchmarks/super-getter.js: Added.
70         (A.prototype.get f):
71         (A):
72         (B.prototype.get f):
73         (B):
74         * stress/super-force-ic-fail.js: Added.
75         (let.assert):
76         (let.aObj.get foo):
77         (let.obj.jaz):
78         (let.bObj.get foo):
79         (let.obj2.foo):
80         * stress/super-get-by-id.js: Added.
81         (assert):
82         (Base):
83         (Base.prototype.get name):
84         (Base.prototype.set name):
85         (Subclass.prototype.get name):
86         (Subclass):
87         (getterName):
88         (getterValue):
89         (PolymorphicSubclass.prototype.get value):
90         (PolymorphicSubclass):
91         (i.let.BaseCode):
92         (i.get value):
93         (MegamorphicSubclass.prototype.get value):
94         (MegamorphicSubclass):
95         (let.subObj.get value):
96         (i.catch):
97         (subObj.get value):
98         (BaseException):
99         (BaseException.prototype.get name):
100         (SubclassException.prototype.get name):
101         (SubclassException):
102         (prototype.foo):
103         (prototype.get name):
104         (SubclassExceptionComplex.prototype.get name):
105         (SubclassExceptionComplex):
106         * stress/super-getter-reset-ic.js: Added.
107         (let.assert):
108         (let.B.f):
109
110 2017-03-06  Saam Barati  <sbarati@apple.com>
111
112         WebAssembly: implement init_expr for Element
113         https://bugs.webkit.org/show_bug.cgi?id=165888
114         <rdar://problem/29760199>
115
116         Reviewed by Keith Miller.
117
118         * wasm/Builder_WebAssemblyBinary.js:
119         (const.emitters.Element):
120         * wasm/assert.js:
121         * wasm/js-api/element.js:
122         (assert.throws):
123         (badInstantiation.makeModule):
124         (badInstantiation.test):
125         (badInstantiation):
126         * wasm/js-api/global-error.js:
127
128 2017-03-06  Carlos Alberto Lopez Perez  <clopez@igalia.com>
129
130         [JSC] [Linux] Test stress/spread-forward-call-varargs-stack-overflow.js fails
131         https://bugs.webkit.org/show_bug.cgi?id=169206
132
133         Unreviewed test gardening.
134
135         * stress/spread-forward-call-varargs-stack-overflow.js: Skip on Linux platforms.
136
137 2017-03-06  Yusuke Suzuki  <utatane.tea@gmail.com>
138
139         [JSC] Allow indexed module namespace object fields
140         https://bugs.webkit.org/show_bug.cgi?id=168870
141
142         Reviewed by Saam Barati.
143
144         * wasm/spec-tests/names.wast.js:
145
146 2017-03-06  Yusuke Suzuki  <utatane.tea@gmail.com>
147
148         Null pointer crash when loading module with unresolved import also as a script file
149         https://bugs.webkit.org/show_bug.cgi?id=168971
150
151         Reviewed by Saam Barati.
152
153         * stress/re-execute-error-module.js: Added.
154         (shouldBe):
155         (async):
156         * stress/resources/error-module.js: Added.
157
158 2017-03-02  Keith Miller  <keith_miller@apple.com>
159
160         WebAssemblyFunction should have Function.prototype as its prototype
161         https://bugs.webkit.org/show_bug.cgi?id=169101
162
163         Reviewed by Filip Pizlo.
164
165         * wasm/js-api/web-assembly-function.js: Added.
166
167 2017-02-28  Oleksandr Skachkov  <gskachkov@gmail.com>
168
169         Use of arguments in arrow function is slow
170         https://bugs.webkit.org/show_bug.cgi?id=168829
171
172         Reviewed by Saam Barati.
173
174         * microbenchmarks/arrowfunciton-direct-arguments.js: Added.
175         (fn):
176         * microbenchmarks/arrowfunciton-reference-arguments.js: Added.
177         (fn):
178
179 2017-02-27  Commit Queue  <commit-queue@webkit.org>
180
181         Unreviewed, rolling out r213019.
182         https://bugs.webkit.org/show_bug.cgi?id=168925
183
184         "It broke 32-bit jsc tests in debug builds" (Requested by
185         saamyjoon on #webkit).
186
187         Reverted changeset:
188
189         "op_get_by_id_with_this should use inline caching"
190         https://bugs.webkit.org/show_bug.cgi?id=162124
191         http://trac.webkit.org/changeset/213019
192
193 2017-02-27  JF Bastien  <jfbastien@apple.com>
194
195         WebAssembly: miscellaneous spec fixes part deux
196         https://bugs.webkit.org/show_bug.cgi?id=168861
197
198         Reviewed by Keith Miller.
199
200         * wasm.yaml: more passing tests
201         * wasm/Builder.js: use a Map instead of an Object for the function
202         index space, because Number entries such as 0 were colliding with
203         string entries such as "0". This in turn requires some hashing of
204         objects which are inserted, because Map uses Object's insertion
205         order when comparing.
206         (export.default.Builder):
207         (export.default.Builder.prototype._functionIndexSpaceKeyHash):
208         (export.default.Builder.prototype._registerFunctionToIndexSpace):
209         (export.default.Builder.prototype._getFunctionFromIndexSpace):
210         * wasm/js-api/test_Instance.js: add a FIXME test
211         * wasm/spec-tests/memory.wast.js:
212         (assert_unlinkable):
213         * wasm/spec-tests/names.wast.js:
214
215 2017-02-26  Caio Lima  <ticaiolima@gmail.com>
216
217         op_get_by_id_with_this should use inline caching
218         https://bugs.webkit.org/show_bug.cgi?id=162124
219
220         Reviewed by Saam Barati.
221
222         * microbenchmarks/super-getter.js: Added.
223         (A.prototype.get f):
224         (A):
225         (B.prototype.get f):
226         (B):
227         * stress/super-force-ic-fail.js: Added.
228         (let.assert):
229         (let.aObj.get foo):
230         (let.obj.jaz):
231         (let.bObj.get foo):
232         (let.obj2.foo):
233         * stress/super-get-by-id.js: Added.
234         (assert):
235         (Base):
236         (Base.prototype.get name):
237         (Base.prototype.set name):
238         (Subclass.prototype.get name):
239         (Subclass):
240         (getterName):
241         (getterValue):
242         (PolymorphicSubclass.prototype.get value):
243         (PolymorphicSubclass):
244         (i.let.BaseCode):
245         (i.get value):
246         (MegamorphicSubclass.prototype.get value):
247         (MegamorphicSubclass):
248         (let.subObj.get value):
249         (i.catch):
250         (subObj.get value):
251         (BaseException):
252         (BaseException.prototype.get name):
253         (SubclassException.prototype.get name):
254         (SubclassException):
255         (prototype.foo):
256         (prototype.get name):
257         (SubclassExceptionComplex.prototype.get name):
258         (SubclassExceptionComplex):
259         * stress/super-getter-reset-ic.js: Added.
260         (let.assert):
261         (let.B.f):
262
263 2017-02-24  JF Bastien  <jfbastien@apple.com>
264
265         WebAssembly: miscellaneous spec fixes
266         https://bugs.webkit.org/show_bug.cgi?id=168822
267
268         Reviewed by Saam Barati.
269
270         * wasm.yaml: mark some skip tests as normal, now that they pass
271         * wasm/Builder.js: error message was wrong, causing extra error if hit
272         * wasm/js-api/global-error.js: new tests
273         (assert.throws):
274         * wasm/spec-tests/call.wast.js: comment out stack check tests
275         * wasm/spec-tests/call_indirect.wast.js: comment out stack check tests
276         * wasm/spec-tests/fac.wast.js: comment out stack check tests
277         * wasm/spec-tests/float_exprs.wast.js: wabt is wrong, bug reported, we should update
278         * wasm/spec-tests/imports.wast.js: bug in old wabt, fixed in recent wabt
279         (assert_unlinkable):
280
281 2017-02-23  Saam Barati  <sbarati@apple.com>
282
283         Intrinsicify parseInt
284         https://bugs.webkit.org/show_bug.cgi?id=168627
285
286         Reviewed by Filip Pizlo.
287
288         * stress/parse-int-intrinsic.js: Added.
289         (assert):
290         (testIntrinsic.let.s):
291         (testIntrinsic):
292         (testIntrinsic2.baz):
293         (testIntrinsic2):
294         (testIntrinsic3.foo):
295         (testIntrinsic3):
296         (testIntrinsic4.foo):
297         (testIntrinsic4):
298         (testIntrinsic5.foo):
299         (testIntrinsic5):
300         (testIntrinsic6.foo):
301         (testIntrinsic6):
302         (testIntrinsic7.foo):
303         (testIntrinsic7):
304
305 2017-02-23  JF Bastien  <jfbastien@apple.com>
306
307         WebAssembly: support 0x1 version
308         https://bugs.webkit.org/show_bug.cgi?id=168672
309
310         Reviewed by Keith Miller.
311
312         Update the version number for all the tests. Note that the spec
313         tests are only updated with a new version number because spec+wabt
314         aren't ready for 0x1 yet. This is tracked by bug #168784.
315
316         * wasm/import-spec-tests.rb: use the new spec repository layout
317         * wasm/js-api/test_basic_api.js:
318         * wasm/self-test/test_BuilderWebAssembly.js:
319         (EmptyModule):
320         (CustomSection):
321         * wasm/spec-tests/address.wast.js:
322         * wasm/spec-tests/binary.wast.js:
323         * wasm/spec-tests/block.wast.js:
324         * wasm/spec-tests/br.wast.js:
325         * wasm/spec-tests/br_if.wast.js:
326         * wasm/spec-tests/br_table.wast.js:
327         * wasm/spec-tests/break-drop.wast.js:
328         * wasm/spec-tests/call.wast.js:
329         * wasm/spec-tests/call_indirect.wast.js:
330         * wasm/spec-tests/comments.wast.js:
331         * wasm/spec-tests/conversions.wast.js:
332         * wasm/spec-tests/custom_section.wast.js:
333         * wasm/spec-tests/endianness.wast.js:
334         * wasm/spec-tests/exports.wast.js:
335         * wasm/spec-tests/f32.wast.js:
336         * wasm/spec-tests/f32_cmp.wast.js:
337         * wasm/spec-tests/f64.wast.js:
338         * wasm/spec-tests/f64_cmp.wast.js:
339         * wasm/spec-tests/fac.wast.js:
340         * wasm/spec-tests/float_exprs.wast.js:
341         * wasm/spec-tests/float_literals.wast.js:
342         * wasm/spec-tests/float_memory.wast.js:
343         * wasm/spec-tests/float_misc.wast.js:
344         * wasm/spec-tests/forward.wast.js:
345         * wasm/spec-tests/func.wast.js:
346         * wasm/spec-tests/func_ptrs.wast.js:
347         * wasm/spec-tests/get_local.wast.js:
348         * wasm/spec-tests/globals.wast.js:
349         * wasm/spec-tests/i32.wast.js:
350         * wasm/spec-tests/i64.wast.js:
351         * wasm/spec-tests/imports.wast.js:
352         * wasm/spec-tests/int_exprs.wast.js:
353         * wasm/spec-tests/int_literals.wast.js:
354         * wasm/spec-tests/left-to-right.wast.js:
355         * wasm/spec-tests/linking.wast.js:
356         * wasm/spec-tests/loop.wast.js:
357         * wasm/spec-tests/memory.wast.js:
358         * wasm/spec-tests/memory_redundancy.wast.js:
359         * wasm/spec-tests/memory_trap.wast.js:
360         * wasm/spec-tests/names.wast.js:
361         * wasm/spec-tests/nop.wast.js:
362         * wasm/spec-tests/resizing.wast.js:
363         * wasm/spec-tests/return.wast.js:
364         * wasm/spec-tests/select.wast.js:
365         * wasm/spec-tests/set_local.wast.js:
366         * wasm/spec-tests/skip-stack-guard-page.wast.js:
367         * wasm/spec-tests/stack.wast.js:
368         * wasm/spec-tests/start.wast.js:
369         * wasm/spec-tests/store_retval.wast.js:
370         * wasm/spec-tests/switch.wast.js:
371         * wasm/spec-tests/tee_local.wast.js:
372         * wasm/spec-tests/traps.wast.js:
373         * wasm/spec-tests/typecheck.wast.js:
374         * wasm/spec-tests/unreachable.wast.js:
375         * wasm/spec-tests/unwind.wast.js:
376         * wasm/wasm.json:
377
378 2017-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>
379
380         JSModuleNamespace object should have IC
381         https://bugs.webkit.org/show_bug.cgi?id=160590
382
383         Reviewed by Saam Barati.
384
385         * modules/module-assert-access-binding.js: Added.
386         * modules/module-assert-access-namespace.js: Added.
387         * modules/namespace-empty.js: Added.
388         (from.string_appeared_here.access):
389         (i.shouldThrow):
390         * stress/module-namespace-access-change.js: Added.
391         (shouldBe):
392         (access):
393         (import.string_appeared_here.then):
394         * stress/module-namespace-access-non-constant.js: Added.
395         (shouldBe):
396         (import.string_appeared_here.then):
397         * stress/module-namespace-access-poly.js: Added.
398         (shouldBe):
399         (access):
400         (import.string_appeared_here.then):
401         * stress/module-namespace-access-transitive-exports.js: Added.
402         (shouldBe):
403         (import.string_appeared_here.then):
404         * stress/module-namespace-access.js: Added.
405         (shouldBe):
406         (import.string_appeared_here.then):
407         * stress/resources/module-namespace-access-transitive-exports-2.js: Added.
408         (export.cocoa):
409         (export.change):
410         * stress/resources/module-namespace-access-transitive-exports.js: Added.
411         * stress/resources/module-namespace-access.js: Added.
412         (export.cocoa):
413         (export.change):
414
415 2017-02-20  Filip Pizlo  <fpizlo@apple.com>
416
417         The collector thread should only start when the mutator doesn't have heap access
418         https://bugs.webkit.org/show_bug.cgi?id=167737
419
420         Reviewed by Keith Miller.
421         
422         Add versions of splay that flash heap access, to simulate what might happen if a third-party app
423         was running concurrent GC. In this case, we might actually start the collector thread.
424
425         * stress/splay-flash-access-1ms.js: Added.
426         (performance.now):
427         (this.Setup.setup.setup):
428         (this.TearDown.tearDown.tearDown):
429         (Benchmark):
430         (BenchmarkResult):
431         (BenchmarkResult.prototype.valueOf):
432         (BenchmarkSuite):
433         (alert):
434         (Math.random):
435         (BenchmarkSuite.ResetRNG):
436         (RunStep):
437         (BenchmarkSuite.RunSuites):
438         (BenchmarkSuite.CountBenchmarks):
439         (BenchmarkSuite.GeometricMean):
440         (BenchmarkSuite.GeometricMeanTime):
441         (BenchmarkSuite.AverageAbovePercentile):
442         (BenchmarkSuite.GeometricMeanLatency):
443         (BenchmarkSuite.FormatScore):
444         (BenchmarkSuite.prototype.NotifyStep):
445         (BenchmarkSuite.prototype.NotifyResult):
446         (BenchmarkSuite.prototype.NotifyError):
447         (BenchmarkSuite.prototype.RunSingleBenchmark):
448         (RunNextSetup):
449         (RunNextBenchmark):
450         (RunNextTearDown):
451         (BenchmarkSuite.prototype.RunStep):
452         (GeneratePayloadTree):
453         (GenerateKey):
454         (SplayUpdateStats):
455         (InsertNewNode):
456         (SplaySetup):
457         (SplayTearDown):
458         (SplayRun):
459         (SplayTree):
460         (SplayTree.prototype.isEmpty):
461         (SplayTree.prototype.insert):
462         (SplayTree.prototype.remove):
463         (SplayTree.prototype.find):
464         (SplayTree.prototype.findMax):
465         (SplayTree.prototype.findGreatestLessThan):
466         (SplayTree.prototype.exportKeys):
467         (SplayTree.prototype.splay_):
468         (SplayTree.Node):
469         (SplayTree.Node.prototype.traverse_):
470         (jscSetUp):
471         (jscTearDown):
472         (jscRun):
473         (averageAbovePercentile):
474         (printPercentile):
475         * stress/splay-flash-access.js: Added.
476         (performance.now):
477         (this.Setup.setup.setup):
478         (this.TearDown.tearDown.tearDown):
479         (Benchmark):
480         (BenchmarkResult):
481         (BenchmarkResult.prototype.valueOf):
482         (BenchmarkSuite):
483         (alert):
484         (Math.random):
485         (BenchmarkSuite.ResetRNG):
486         (RunStep):
487         (BenchmarkSuite.RunSuites):
488         (BenchmarkSuite.CountBenchmarks):
489         (BenchmarkSuite.GeometricMean):
490         (BenchmarkSuite.GeometricMeanTime):
491         (BenchmarkSuite.AverageAbovePercentile):
492         (BenchmarkSuite.GeometricMeanLatency):
493         (BenchmarkSuite.FormatScore):
494         (BenchmarkSuite.prototype.NotifyStep):
495         (BenchmarkSuite.prototype.NotifyResult):
496         (BenchmarkSuite.prototype.NotifyError):
497         (BenchmarkSuite.prototype.RunSingleBenchmark):
498         (RunNextSetup):
499         (RunNextBenchmark):
500         (RunNextTearDown):
501         (BenchmarkSuite.prototype.RunStep):
502         (GeneratePayloadTree):
503         (GenerateKey):
504         (SplayUpdateStats):
505         (InsertNewNode):
506         (SplaySetup):
507         (SplayTearDown):
508         (SplayRun):
509         (SplayTree):
510         (SplayTree.prototype.isEmpty):
511         (SplayTree.prototype.insert):
512         (SplayTree.prototype.remove):
513         (SplayTree.prototype.find):
514         (SplayTree.prototype.findMax):
515         (SplayTree.prototype.findGreatestLessThan):
516         (SplayTree.prototype.exportKeys):
517         (SplayTree.prototype.splay_):
518         (SplayTree.Node):
519         (SplayTree.Node.prototype.traverse_):
520         (jscSetUp):
521         (jscTearDown):
522         (jscRun):
523         (averageAbovePercentile):
524         (printPercentile):
525
526 2017-02-21  Ryan Haddad  <ryanhaddad@apple.com>
527
528         Unreviewed, rolling out r212712.
529
530         This change broke the CLoop build.
531
532         Reverted changeset:
533
534         "JSModuleNamespace object should have IC"
535         https://bugs.webkit.org/show_bug.cgi?id=160590
536         http://trac.webkit.org/changeset/212712
537
538 2017-02-21  Yusuke Suzuki  <utatane.tea@gmail.com>
539
540         JSModuleNamespace object should have IC
541         https://bugs.webkit.org/show_bug.cgi?id=160590
542
543         Reviewed by Saam Barati.
544
545         * modules/module-assert-access-binding.js: Added.
546         * modules/module-assert-access-namespace.js: Added.
547         * modules/namespace-empty.js: Added.
548         (from.string_appeared_here.access):
549         (i.shouldThrow):
550         * stress/module-namespace-access-change.js: Added.
551         (shouldBe):
552         (access):
553         (import.string_appeared_here.then):
554         * stress/module-namespace-access-non-constant.js: Added.
555         (shouldBe):
556         (import.string_appeared_here.then):
557         * stress/module-namespace-access-poly.js: Added.
558         (shouldBe):
559         (access):
560         (import.string_appeared_here.then):
561         * stress/module-namespace-access-transitive-exports.js: Added.
562         (shouldBe):
563         (import.string_appeared_here.then):
564         * stress/module-namespace-access.js: Added.
565         (shouldBe):
566         (import.string_appeared_here.then):
567         * stress/resources/module-namespace-access-transitive-exports-2.js: Added.
568         (export.cocoa):
569         (export.change):
570         * stress/resources/module-namespace-access-transitive-exports.js: Added.
571         * stress/resources/module-namespace-access.js: Added.
572         (export.cocoa):
573         (export.change):
574
575 2017-02-21  Yusuke Suzuki  <utatane.tea@gmail.com>
576
577         ASSERTION FAILED: "!scope.exception()" with Object.isSealed/isFrozen and uninitialized module bindings
578         https://bugs.webkit.org/show_bug.cgi?id=168605
579
580         Reviewed by Saam Barati.
581
582         * modules/module-namespace-is-frozen.js: Added.
583         (from.string_appeared_here.shouldThrow):
584         (export.b):
585         * modules/module-namespace-is-sealed.js: Added.
586         (from.string_appeared_here.shouldThrow):
587         (export.b):
588
589 2017-02-19  Commit Queue  <commit-queue@webkit.org>
590
591         Unreviewed, rolling out r212466.
592         https://bugs.webkit.org/show_bug.cgi?id=168577
593
594         causes crashes on AArch64 on linux, maybe it's causing crashes
595         on iOS too (Requested by pizlo on #webkit).
596
597         Reverted changeset:
598
599         "The collector thread should only start when the mutator
600         doesn't have heap access"
601         https://bugs.webkit.org/show_bug.cgi?id=167737
602         http://trac.webkit.org/changeset/212466
603
604 2017-02-10  Filip Pizlo  <fpizlo@apple.com>
605
606         The collector thread should only start when the mutator doesn't have heap access
607         https://bugs.webkit.org/show_bug.cgi?id=167737
608
609         Reviewed by Keith Miller.
610         
611         Add versions of splay that flash heap access, to simulate what might happen if a third-party app
612         was running concurrent GC. In this case, we might actually start the collector thread.
613
614         * stress/splay-flash-access-1ms.js: Added.
615         (performance.now):
616         (this.Setup.setup.setup):
617         (this.TearDown.tearDown.tearDown):
618         (Benchmark):
619         (BenchmarkResult):
620         (BenchmarkResult.prototype.valueOf):
621         (BenchmarkSuite):
622         (alert):
623         (Math.random):
624         (BenchmarkSuite.ResetRNG):
625         (RunStep):
626         (BenchmarkSuite.RunSuites):
627         (BenchmarkSuite.CountBenchmarks):
628         (BenchmarkSuite.GeometricMean):
629         (BenchmarkSuite.GeometricMeanTime):
630         (BenchmarkSuite.AverageAbovePercentile):
631         (BenchmarkSuite.GeometricMeanLatency):
632         (BenchmarkSuite.FormatScore):
633         (BenchmarkSuite.prototype.NotifyStep):
634         (BenchmarkSuite.prototype.NotifyResult):
635         (BenchmarkSuite.prototype.NotifyError):
636         (BenchmarkSuite.prototype.RunSingleBenchmark):
637         (RunNextSetup):
638         (RunNextBenchmark):
639         (RunNextTearDown):
640         (BenchmarkSuite.prototype.RunStep):
641         (GeneratePayloadTree):
642         (GenerateKey):
643         (SplayUpdateStats):
644         (InsertNewNode):
645         (SplaySetup):
646         (SplayTearDown):
647         (SplayRun):
648         (SplayTree):
649         (SplayTree.prototype.isEmpty):
650         (SplayTree.prototype.insert):
651         (SplayTree.prototype.remove):
652         (SplayTree.prototype.find):
653         (SplayTree.prototype.findMax):
654         (SplayTree.prototype.findGreatestLessThan):
655         (SplayTree.prototype.exportKeys):
656         (SplayTree.prototype.splay_):
657         (SplayTree.Node):
658         (SplayTree.Node.prototype.traverse_):
659         (jscSetUp):
660         (jscTearDown):
661         (jscRun):
662         (averageAbovePercentile):
663         (printPercentile):
664         * stress/splay-flash-access.js: Added.
665         (performance.now):
666         (this.Setup.setup.setup):
667         (this.TearDown.tearDown.tearDown):
668         (Benchmark):
669         (BenchmarkResult):
670         (BenchmarkResult.prototype.valueOf):
671         (BenchmarkSuite):
672         (alert):
673         (Math.random):
674         (BenchmarkSuite.ResetRNG):
675         (RunStep):
676         (BenchmarkSuite.RunSuites):
677         (BenchmarkSuite.CountBenchmarks):
678         (BenchmarkSuite.GeometricMean):
679         (BenchmarkSuite.GeometricMeanTime):
680         (BenchmarkSuite.AverageAbovePercentile):
681         (BenchmarkSuite.GeometricMeanLatency):
682         (BenchmarkSuite.FormatScore):
683         (BenchmarkSuite.prototype.NotifyStep):
684         (BenchmarkSuite.prototype.NotifyResult):
685         (BenchmarkSuite.prototype.NotifyError):
686         (BenchmarkSuite.prototype.RunSingleBenchmark):
687         (RunNextSetup):
688         (RunNextBenchmark):
689         (RunNextTearDown):
690         (BenchmarkSuite.prototype.RunStep):
691         (GeneratePayloadTree):
692         (GenerateKey):
693         (SplayUpdateStats):
694         (InsertNewNode):
695         (SplaySetup):
696         (SplayTearDown):
697         (SplayRun):
698         (SplayTree):
699         (SplayTree.prototype.isEmpty):
700         (SplayTree.prototype.insert):
701         (SplayTree.prototype.remove):
702         (SplayTree.prototype.find):
703         (SplayTree.prototype.findMax):
704         (SplayTree.prototype.findGreatestLessThan):
705         (SplayTree.prototype.exportKeys):
706         (SplayTree.prototype.splay_):
707         (SplayTree.Node):
708         (SplayTree.Node.prototype.traverse_):
709         (jscSetUp):
710         (jscTearDown):
711         (jscRun):
712         (averageAbovePercentile):
713         (printPercentile):
714
715 2017-02-16  Yusuke Suzuki  <utatane.tea@gmail.com>
716
717         [JSC] Update module namespace object according to the latest ECMA262
718         https://bugs.webkit.org/show_bug.cgi?id=168280
719
720         Reviewed by Saam Barati.
721
722         * modules/namespace-object-symbol-iterator-name.js:
723         * modules/namespace-object-typed-array-fast-path.js:
724         * modules/namespace.js:
725         (shouldBe.JSON.stringify.Reflect.getOwnPropertyDescriptor):
726         (shouldThrow):
727
728 2017-02-11  Yusuke Suzuki  <utatane.tea@gmail.com>
729
730         [JSC] Implement (Shared)ArrayBuffer.prototype.byteLength
731         https://bugs.webkit.org/show_bug.cgi?id=166476
732
733         Reviewed by Saam Barati.
734
735         * ChakraCore/test/typedarray/arraybufferType.baseline-jsc:
736         * stress/array-buffer-byte-length.js: Added.
737         (shouldBe):
738         (shouldThrow):
739         (Symbol):
740         * stress/reflect-set.js:
741
742 2017-02-10  Saam Barati  <sbarati@apple.com>
743
744         Object allocation sinking phase doesn't properly handle control flow when emitting a PutHint of a materialized object into a PromotedHeapLocation of a still sunken object
745         https://bugs.webkit.org/show_bug.cgi?id=168140
746         <rdar://problem/30205880>
747
748         Reviewed by Filip Pizlo.
749
750         * stress/allocation-sinking-puthint-control-flow.js: Added.
751         (e):
752         (bar):
753         (let.y):
754         (else.let.y):
755         (baz):
756         (foo):
757         (catch):
758
759 2017-02-09  Mark Lam  <mark.lam@apple.com>
760
761         B3::Procedure::deleteOrphans() should neutralize upsilons with dead phis.
762         https://bugs.webkit.org/show_bug.cgi?id=167437
763         <rdar://problem/30198083>
764
765         Reviewed by Filip Pizlo.
766
767         * stress/b3-delete-orphans-should-neutralize-upsilons-with-dead-phis.js: Added.
768
769 2017-02-09  Saam Barati  <sbarati@apple.com>
770
771         Sloppy mode: We don't properly hoist functions names "arguments" when we have a non-simple parameter list
772         https://bugs.webkit.org/show_bug.cgi?id=167319
773         <rdar://problem/30149432>
774
775         Reviewed by Mark Lam.
776
777         * stress/sloppy-mode-hoist-arguments-function-non-simple-parameter-list.js: Added.
778         (assert):
779         (assert.arguments):
780         (assert.b):
781         (x.arguments):
782         (x.b):
783         (x):
784
785 2017-02-09  Mark Lam  <mark.lam@apple.com>
786
787         Fix max length check in ArrayPrototype.js' concatSlowPath().
788         https://bugs.webkit.org/show_bug.cgi?id=167270
789         <rdar://problem/30128133>
790
791         Reviewed by Filip Pizlo.
792
793         * stress/array-prototype-concat-of-long-spliced-arrays.js: Added.
794         * stress/array-prototype-concat-of-long-spliced-arrays2.js: Added.
795
796 2017-02-09  Keith Miller  <keith_miller@apple.com>
797
798         We should not allow Function.caller to be used on native functions
799         https://bugs.webkit.org/show_bug.cgi?id=165628
800
801         Reviewed by Mark Lam.
802
803         * stress/caller-native-code.js: Added.
804         (f):
805
806 2017-02-04  Yusuke Suzuki  <utatane.tea@gmail.com>
807
808         [JSC] Add operationToInt32SensibleSlow to optimize kraken pbkdf2 and sha256
809         https://bugs.webkit.org/show_bug.cgi?id=167736
810
811         Reviewed by Saam Barati.
812
813         * stress/to-int32-sensible.js: Added.
814         (shouldBe):
815         (toInt32):
816         (test):
817
818 2017-02-01  Yusuke Suzuki  <utatane.tea@gmail.com>
819
820         Unreviewed, remove loop
821         https://bugs.webkit.org/show_bug.cgi?id=167694
822
823         It causes timeout.
824         Original bug can be tested even without this loop.
825
826         * stress/arity-fixup-should-not-touch-stack-area-below-sp.js:
827
828 2017-02-01  Yusuke Suzuki  <utatane.tea@gmail.com>
829
830         ArityFixup should adjust SP first
831         https://bugs.webkit.org/show_bug.cgi?id=167239
832
833         Reviewed by Michael Saboff.
834
835         Significantly large arity fixup reliably causes this crash.
836
837         * stress/arity-fixup-should-not-touch-stack-area-below-sp.js: Added.
838
839 2017-01-31  Filip Pizlo  <fpizlo@apple.com>
840
841         Move slow-running microbenchmarks out of JSTests/microbenchmarks
842         https://bugs.webkit.org/show_bug.cgi?id=167676
843
844         Reviewed by Saam Barati.
845         
846         The microbenchmarks directory is profitable when it's cheap to run. This change moves very slow
847         tests (>=200ms running time on my machine) and puts them in JSTests/slowMicrobenchmarks instead.
848         That directory is run only through `slow!; defaultQuickRun` and is not run by run-jsc-benchmarks.
849         This is a big progression in test running time. But because it frontloads more slow tests, the
850         tests will seem to run more slowly when you first start the test runner.
851
852         * microbenchmarks/default-derived-constructor.js: Removed.
853         * microbenchmarks/dense-set.js: Removed.
854         * microbenchmarks/ftl-polymorphic-div.js: Removed.
855         * microbenchmarks/ftl-polymorphic-mul.js: Removed.
856         * microbenchmarks/function-bind-inlining.js: Removed.
857         * microbenchmarks/function-bind-no-inlining.js: Removed.
858         * microbenchmarks/large-map-iteration-with-additions.js: Removed.
859         * microbenchmarks/large-map-iteration-with-mutation.js: Removed.
860         * microbenchmarks/map-get-get-cse.js: Removed.
861         * microbenchmarks/misc-bugs-847389-jpeg2000.js: Removed.
862         * microbenchmarks/spread-small-array.js: Removed.
863         * microbenchmarks/v8-raytrace-with-try-catch-high-frequency-throws.js: Removed.
864         * slowMicrobenchmarks: Added.
865         * slowMicrobenchmarks.yaml: Added.
866         * slowMicrobenchmarks/README: Added.
867         * slowMicrobenchmarks/default-derived-constructor.js: Copied from JSTests/microbenchmarks/default-derived-constructor.js.
868         * slowMicrobenchmarks/dense-set.js: Copied from JSTests/microbenchmarks/dense-set.js.
869         * slowMicrobenchmarks/ftl-polymorphic-div.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-div.js.
870         * slowMicrobenchmarks/ftl-polymorphic-mul.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-mul.js.
871         * slowMicrobenchmarks/function-bind-inlining.js: Copied from JSTests/microbenchmarks/function-bind-inlining.js.
872         * slowMicrobenchmarks/function-bind-no-inlining.js: Copied from JSTests/microbenchmarks/function-bind-no-inlining.js.
873         * slowMicrobenchmarks/large-map-iteration-with-additions.js: Copied from JSTests/microbenchmarks/large-map-iteration-with-additions.js.
874         * slowMicrobenchmarks/large-map-iteration-with-mutation.js: Copied from JSTests/microbenchmarks/large-map-iteration-with-mutation.js.
875         * slowMicrobenchmarks/map-get-get-cse.js: Copied from JSTests/microbenchmarks/map-get-get-cse.js.
876         * slowMicrobenchmarks/misc-bugs-847389-jpeg2000.js: Copied from JSTests/microbenchmarks/misc-bugs-847389-jpeg2000.js.
877         * slowMicrobenchmarks/spread-small-array.js: Copied from JSTests/microbenchmarks/spread-small-array.js.
878         * slowMicrobenchmarks/v8-raytrace-with-try-catch-high-frequency-throws.js: Copied from JSTests/microbenchmarks/v8-raytrace-with-try-catch-high-frequency-throws.js.
879
880 2017-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
881
882         [JSC] Do not reject WebAssembly.compile() with Exception
883         https://bugs.webkit.org/show_bug.cgi?id=167585
884
885         Reviewed by Mark Lam.
886
887         * wasm/js-api/Module-compile.js:
888         (async.testPromiseAPI):
889
890 2017-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>
891
892         Lift template escape sequence restrictions in tagged templates
893         https://bugs.webkit.org/show_bug.cgi?id=166871
894
895         Reviewed by Saam Barati.
896
897         Update the error messages and add new tests.
898
899         * ChakraCore/test/es6/unicode_6_identifier_Blue524737.baseline-jsc:
900         * stress/lift-template-literal.js: Added.
901         (dump):
902         (testTag.return.tag):
903         (testTag):
904         * stress/template-literal-syntax.js:
905
906 2017-01-26  Mark Lam  <mark.lam@apple.com>
907
908         Fix missing exception check in genericTypedArrayViewProtoFuncSet().
909         https://bugs.webkit.org/show_bug.cgi?id=166812
910         <rdar://problem/29916672>
911
912         Reviewed by Saam Barati.
913
914         * stress/regress-166812.js: Added.
915
916 2017-01-26  Commit Queue  <commit-queue@webkit.org>
917
918         Unreviewed, rolling out r211224.
919         https://bugs.webkit.org/show_bug.cgi?id=167479
920
921         "It was a Kraken performance regression" (Requested by
922         saamyjoon on #webkit).
923
924         Reverted changeset:
925
926         "OSR entry: delay outer-loop compilation when at inner-loop"
927         https://bugs.webkit.org/show_bug.cgi?id=167149
928         http://trac.webkit.org/changeset/211224
929
930 2017-01-26  JF Bastien  <jfbastien@apple.com>
931
932         OSR entry: delay outer-loop compilation when at inner-loop
933         https://bugs.webkit.org/show_bug.cgi?id=167149
934
935         Reviewed by Filip Pizlo.
936
937         Try to be mean to OSR entry by using nested loops, and having
938         non-int32 types or truly varying types.
939
940         Mandelbrot currently never tiers up to FTL because it exits too
941         many times before this. That shouldn't happen because it's just
942         numbers and int32s. I'll file a bug to fix this.
943
944         * microbenchmarks/mandelbrot.js: Added.
945         (mandelbrot):
946         (printable):
947         * microbenchmarks/nonude.js: Added.
948         (Array.prototype.remove):
949         (const.u):
950         (const.load):
951         (const.scan):
952         (const.main):
953
954 2017-01-25  Saam Barati  <sbarati@apple.com>
955
956         WebAssembly JS API: coerce return values from imports
957         https://bugs.webkit.org/show_bug.cgi?id=165480
958         <rdar://problem/29760318>
959
960         Reviewed by Yusuke Suzuki.
961
962         * wasm/function-tests/function-import-return-value.js: Added.
963         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.tests.x.assert.eq):
964         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.tests.Math.fround):
965         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.type.of.Reflect.ownKeys):
966         (test.1):
967         (assert.truthy):
968         (assert.throws):
969
970 2017-01-25  Filip Pizlo  <fpizlo@apple.com>
971
972         jsc.cpp should have the $.agent stuff for testing SAB
973         https://bugs.webkit.org/show_bug.cgi?id=167431
974
975         Reviewed by Saam Barati.
976         
977         Add a very basic test of Atomics using $.agent. This is based on
978         LayoutTests/workers/sab/simple.html.
979
980         * stress/lars-sab-workers.js: Added.
981         (startWorker):
982         (resources):
983         (wake):
984         (else):
985
986 2017-01-24  Filip Pizlo  <fpizlo@apple.com>
987
988         Atomics.store should return the int-converted value according to toInteger
989         https://bugs.webkit.org/show_bug.cgi?id=167399
990
991         Reviewed by Saam Barati.
992
993         * stress/atomics-add-uint32.js: Added.
994         * stress/atomics-store-return.js: Fix the test to match what the spec wants.
995
996 2017-01-24  Yusuke Suzuki  <utatane.tea@gmail.com>
997
998         [JSC] Optimize Number#toString with Int52
999         https://bugs.webkit.org/show_bug.cgi?id=167303
1000
1001         Reviewed by Sam Weinig.
1002
1003         * stress/to-string-with-int52.js: Added.
1004         (shouldBe):
1005
1006 2017-01-24  Filip Pizlo  <fpizlo@apple.com>
1007
1008         Atomics.store should return the int-converted value, not the value that it stored
1009         https://bugs.webkit.org/show_bug.cgi?id=167395
1010
1011         Reviewed by Saam Barati.
1012
1013         * stress/atomics-store-return.js: Added.
1014
1015 2017-01-24  Filip Pizlo  <fpizlo@apple.com>
1016
1017         -0 is a valid array index and AtomicsObject should know this
1018         https://bugs.webkit.org/show_bug.cgi?id=167386
1019
1020         Reviewed by Mark Lam.
1021
1022         * stress/atomics-neg-zero.js: Added.
1023
1024 2017-01-23  Saam Barati  <sbarati@apple.com>
1025
1026         https://bugs.webkit.org/show_bug.cgi?id=167247
1027         JSC: operationSpreadGeneric uses the wrong global object for the builtin function and slow_path_spread consults the wrong global object to prove if the iterator protocol is unobservable
1028         <rdar://problem/30121809>
1029
1030         Reviewed by Filip Pizlo.
1031
1032         * stress/spread-consults-correct-global-object.js: Added.
1033         (assert):
1034         (spread):
1035         * stress/spread-correct-global-object-on-exception.js: Added.
1036         (assert):
1037         (spread):
1038         (const.objectText.let.o.Symbol.iterator):
1039         (catch):
1040
1041 2017-01-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1042
1043         dynamic import is ambiguous with import declaration at module code
1044         https://bugs.webkit.org/show_bug.cgi?id=167098
1045
1046         Reviewed by Darin Adler.
1047
1048         * modules/import-call.js: Added.
1049         (from.string_appeared_here.import.string_appeared_here.then):
1050         * modules/import-call/main.js: Added.
1051         * stress/import-syntax.js:
1052         (async):
1053
1054 2017-01-19  Skachkov Oleksandr  <gskachkov@gmail.com>
1055
1056         "this" missing after await in async arrow function
1057         https://bugs.webkit.org/show_bug.cgi?id=166919
1058
1059         Reviewed by Saam Barati.
1060
1061         * stress/async-arrow-functions-lexical-binding-in-class.js:
1062         (ChildClass.prototype.asyncThisPropWithAwaitBody):
1063         (ChildClass.prototype.asyncThisPropInEvalWithAwaitBody):
1064         (ChildClass.prototype.asyncThisValueBodyWithAwait):
1065         (ChildClass.prototype.asyncThisValueInEvalWithAwaitBody):
1066         (ChildClass):
1067         (ChildClass3):
1068         (ChildClass3.prototype.classValue):
1069         (ChildClass3.prototype.get classProperty):
1070         * stress/async-arrow-functions-lexical-new.target-binding.js:
1071         (C2WithAwait):
1072
1073 2017-01-16  Filip Pizlo  <fpizlo@apple.com>
1074
1075         Make opaque root scanning truly constraint-based
1076         https://bugs.webkit.org/show_bug.cgi?id=165760
1077
1078         Reviewed by Geoffrey Garen.
1079         
1080         Added this test, which demonstrates the benefit of having a dedicated string subspace.
1081
1082         * microbenchmarks/stringalloc.js: Added.
1083
1084 2017-01-17  Michael Saboff  <msaboff@apple.com>
1085
1086         Nested parenthesized regular expressions with non-zero minimum counts appear to hang and use lots of memory
1087         https://bugs.webkit.org/show_bug.cgi?id=167125
1088
1089         Reviewed by Filip Pizlo.
1090
1091         * microbenchmarks/regexp-nested-nonzero-min-counted-parens.js: Added.
1092         New test with limits that run slow and take a reasonable amount of memory
1093         before the change and run fast, using little memory with the change.
1094
1095 2017-01-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1096
1097         Annotate large string tests with largeHeap
1098         https://bugs.webkit.org/show_bug.cgi?id=167054
1099
1100         Reviewed by Filip Pizlo.
1101
1102         * microbenchmarks/dense-set.js:
1103         * microbenchmarks/lots-of-fields.js:
1104         * stress/joined-strings-should-not-exceed-max-string-length.js:
1105         * stress/make-large-string-jit-strcat.js:
1106         * stress/make-large-string-jit.js:
1107         * stress/make-large-string-strcat.js:
1108         * stress/make-large-string.js:
1109         * stress/string-joining-long-strings-should-not-crash.js:
1110         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1111
1112 2017-01-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1113
1114         Reserve capacity for StringBuilder in unescape
1115         https://bugs.webkit.org/show_bug.cgi?id=167008
1116
1117         Reviewed by Sam Weinig.
1118
1119         * stress/unescape.js: Added.
1120         (shouldBe):
1121
1122 2017-01-12  Saam Barati  <sbarati@apple.com>
1123
1124         Add a slice intrinsic to the DFG/FTL
1125         https://bugs.webkit.org/show_bug.cgi?id=166707
1126         <rdar://problem/29913445>
1127
1128         Reviewed by Filip Pizlo.
1129
1130         * stress/array-slice-intrinsic.js: Added.
1131         (assert):
1132         (shallowEq):
1133         (runTest1):
1134         (runTest2):
1135         * stress/array-slice-jettison-on-constructor-change.js: Added.
1136         (assert):
1137         (runTest1):
1138         (runTest2):
1139         (addRandomProperties):
1140         (runTests):
1141         * stress/array-slice-osr-exit-2.js: Added.
1142         (assert):
1143         (Foo):
1144         (shallowEq):
1145         (runTest1):
1146         (runTest2):
1147         (addRandomProperties):
1148         (runTests):
1149         * stress/array-slice-osr-exit.js: Added.
1150         (assert):
1151         (Foo):
1152         (shallowEq):
1153         (runTest1):
1154         (runTest2):
1155         (addRandomProperties):
1156         (runTests):
1157
1158 2017-01-11  Ryan Haddad  <ryanhaddad@apple.com>
1159
1160         Mark es6/typed_arrays_correct_prototype_chains.js as failing after r210570.
1161         https://bugs.webkit.org/show_bug.cgi?id=166931i
1162
1163         Unreviewed test gardening.
1164
1165         * es6.yaml:
1166
1167 2017-01-10  Commit Queue  <commit-queue@webkit.org>
1168
1169         Unreviewed, rolling out r210052.
1170         https://bugs.webkit.org/show_bug.cgi?id=166915
1171
1172         "breaks web compatability" (Requested by keith_miller on
1173         #webkit).
1174
1175         Reverted changeset:
1176
1177         "Add support for global"
1178         https://bugs.webkit.org/show_bug.cgi?id=165171
1179         http://trac.webkit.org/changeset/210052
1180
1181 2017-01-10  Mark Lam  <mark.lam@apple.com>
1182
1183         Property setters should not be called for bound arguments list entries.
1184         https://bugs.webkit.org/show_bug.cgi?id=165631
1185
1186         Reviewed by Filip Pizlo.
1187
1188         * stress/property-setters-should-not-be-called-for-bound-arguments-list-entries.js: Added.
1189
1190 2017-01-10  Skachkov Oleksandr  <gskachkov@gmail.com>
1191
1192         Calling async arrow function which is in a class's member function will cause error
1193         https://bugs.webkit.org/show_bug.cgi?id=166879
1194
1195         Reviewed by Saam Barati.
1196
1197         * stress/async-arrow-functions-lexical-binding-in-class.js: Added.
1198         (shouldBe):
1199         (shouldBeAsync):
1200         (BaseClass.prototype.baseClassValue):
1201         (BaseClass.prototype.get property):
1202         (BaseClass):
1203         (runSomething):
1204         (ChildClass.prototype.classValue):
1205         (ChildClass.prototype.get classProperty):
1206         (ChildClass.prototype.asyncValueExp):
1207         (ChildClass.prototype.asyncValueBody):
1208         (ChildClass.prototype.asyncThisPropExp):
1209         (ChildClass.prototype.asyncThisPropBody):
1210         (ChildClass.prototype.asyncThisPropInEvalExp):
1211         (ChildClass.prototype.asyncThisPropInEvalBody):
1212         (ChildClass.prototype.asyncThisValueExp):
1213         (ChildClass.prototype.asyncThisValueBody):
1214         (ChildClass.prototype.asyncThisValueInEvalExp):
1215         (ChildClass.prototype.asyncThisValueInEvalBody):
1216         (ChildClass):
1217         (ChildClass2):
1218         (ChildClass2.prototype.classValue):
1219         (ChildClass2.prototype.get classProperty):
1220         * stress/async-arrow-functions-lexical-super-binding.js:
1221
1222 2017-01-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1223
1224         [JSC] Prototype dynamic-import
1225         https://bugs.webkit.org/show_bug.cgi?id=165724
1226
1227         Reviewed by Saam Barati.
1228
1229         * stress/import-basic.js: Added.
1230         (async.async.load):
1231         (async):
1232         (catch):
1233         * stress/import-from-eval.js: Added.
1234         (async):
1235         (catch):
1236         * stress/import-syntax.js: Added.
1237         (testSyntaxError):
1238         * stress/import-tests/cocoa.js: Added.
1239         (export.Cocoa):
1240         (export.hello):
1241         * stress/import-tests/multiple.js: Added.
1242         (export.result):
1243         * stress/import-tests/multiple2.js: Added.
1244         (export.ok):
1245         * stress/import-tests/should.js: Added.
1246         (export.shouldBe):
1247         (export.shouldThrow):
1248         * stress/modules-syntax-error.js:
1249
1250 2017-01-09  Commit Queue  <commit-queue@webkit.org>
1251
1252         Unreviewed, rolling out r210476.
1253         https://bugs.webkit.org/show_bug.cgi?id=166859
1254
1255         "4% JSBench regression" (Requested by keith_mi_ on #webkit).
1256
1257         Reverted changeset:
1258
1259         "Add a slice intrinsic to the DFG/FTL"
1260         https://bugs.webkit.org/show_bug.cgi?id=166707
1261         http://trac.webkit.org/changeset/210476
1262
1263 2017-01-06  Saam Barati  <sbarati@apple.com>
1264
1265         Add a slice intrinsic to the DFG/FTL
1266         https://bugs.webkit.org/show_bug.cgi?id=166707
1267
1268         Reviewed by Filip Pizlo.
1269
1270         * stress/array-slice-intrinsic.js: Added.
1271         (assert):
1272         (shallowEq):
1273         (runTest1):
1274         (runTest2):
1275         * stress/array-slice-jettison-on-constructor-change.js: Added.
1276         (assert):
1277         (runTest1):
1278         (runTest2):
1279         (addRandomProperties):
1280         (runTests):
1281         * stress/array-slice-osr-exit-2.js: Added.
1282         (assert):
1283         (Foo):
1284         (shallowEq):
1285         (runTest1):
1286         (runTest2):
1287         (addRandomProperties):
1288         (runTests):
1289         * stress/array-slice-osr-exit.js: Added.
1290         (assert):
1291         (Foo):
1292         (shallowEq):
1293         (runTest1):
1294         (runTest2):
1295         (addRandomProperties):
1296         (runTests):
1297
1298 2017-01-06  Michael Saboff  <msaboff@apple.com>
1299
1300         @putByValDirect in Array.of and Array.from overwrites non-writable/configurable properties
1301         https://bugs.webkit.org/show_bug.cgi?id=153486
1302
1303         Reviewed by Saam Barati.
1304
1305         New regression test.
1306
1307         * stress/regress-153486.js: Added.
1308         (shouldEqual):
1309         (makeUnwriteableUnconfigurableObject):
1310         (testArrayOf):
1311         (testArrayFrom):
1312         (runTest):
1313
1314 2016-12-30  Filip Pizlo  <fpizlo@apple.com>
1315
1316         DeferGC::~DeferGC should be super cheap
1317         https://bugs.webkit.org/show_bug.cgi?id=166626
1318
1319         Reviewed by Saam Barati.
1320
1321         * stress/slow-path-generator-updating-current-node-dfg.js:
1322         * stress/unshift-array-storage.js:
1323
1324 2017-01-04  JF Bastien  <jfbastien@apple.com>
1325
1326         WebAssembly: sections with the same name are allowed
1327         https://bugs.webkit.org/show_bug.cgi?id=166708
1328
1329         Reviewed by Saam Barati.
1330
1331         * wasm/self-test/test_BuilderJSON.js:
1332         (SectionsWithSameCustomName):
1333
1334 2017-01-04  Saam Barati  <sbarati@apple.com>
1335
1336         stress/spread-calling.js timing out on the bots
1337         https://bugs.webkit.org/show_bug.cgi?id=166689
1338         <rdar://problem/29779182>
1339
1340         Reviewed by Mark Lam.
1341
1342         * stress/spread-calling.js:
1343
1344 2017-01-04  JF Bastien  <jfbastien@apple.com>
1345
1346         WebAssembly JS API: add Module.sections
1347         https://bugs.webkit.org/show_bug.cgi?id=165159
1348         <rdar://problem/29760326>
1349
1350         Reviewed by Mark Lam.
1351
1352         As described here: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodulecustomsections
1353
1354         * wasm/Builder.js: allow custom sections to be duplicated
1355         * wasm/js-api/Module.customSection.js: Added.
1356         (assert.throws.WebAssembly.Module.prototype.customSections):
1357         (assert.eq):
1358
1359 2017-01-04  Saam Barati  <sbarati@apple.com>
1360
1361         We don't properly handle exceptions inside the nativeCallTrampoline macro in the LLInt
1362         https://bugs.webkit.org/show_bug.cgi?id=163720
1363
1364         Reviewed by Mark Lam.
1365
1366         * stress/bound-function-tail-call-with-exception.js: Added.
1367         (bar):
1368         (foo):
1369         (catch):
1370
1371 2017-01-03  JF Bastien  <jfbastien@apple.com>
1372
1373         WebAssembly JS API: check and test in-call / out-call values
1374         https://bugs.webkit.org/show_bug.cgi?id=164876
1375         <rdar://problem/29844107>
1376
1377         Reviewed by Saam Barati.
1378
1379         * wasm.yaml:
1380         * wasm/assert.js: add an assert for NaN comparison
1381         * wasm/fuzz/export-function.js: Added. Generate random wasm export
1382         signatures, and call them with random parameters.
1383         (const.paramExporter):
1384         (const.setBuffer):
1385         (const.types.generate):
1386         (generate):
1387         * wasm/js-api/export-arity.js: Added.
1388         (const.paramExporter): Test that mismatched arities when JS calls
1389         wasm follow the defined semantics: i32 is 0, f32 / f64 are NaN.
1390         https://github.com/WebAssembly/design/blob/master/JS.md#exported-function-exotic-objects
1391         * wasm/js-api/export-void-is-undef.js: Added. Test that "void"
1392         wasm functions return "undefined" in JS.
1393
1394 2017-01-02  JF Bastien  <jfbastien@apple.com>
1395
1396         WebAssembly: handle and optimize wasm export → wasm import calls
1397         https://bugs.webkit.org/show_bug.cgi?id=165282
1398
1399         Reviewed by Saam Barati.
1400
1401         * wasm/Builder.js: Add a Proxy to Builder.js, which intercepts
1402         unknown property lookups. This creates way better error messages
1403         on typos than 'undefined is not a function', which happens
1404         semi-frequently as I typo opcode names (and which one is a typo is
1405         hard to find because we chain builders).
1406         (const._isValidValue):
1407         (get target):
1408         (const._importFunctionContinuation):
1409         (const._importMemoryContinuation):
1410         (const._importTableContinuation):
1411         (const._exportFunctionContinuation):
1412         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
1413         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
1414         * wasm/LowLevelBinary.js: Add limited support for var{u}int64 (only the 32-bit values)
1415         (export.default.LowLevelBinary.prototype.varint32):
1416         (export.default.LowLevelBinary.prototype.varuint64):
1417         (export.default.LowLevelBinary.prototype.varint64):
1418         * wasm/function-tests/exceptions.js: update error message
1419         * wasm/function-tests/trap-load.js: update error message
1420         * wasm/function-tests/trap-store.js: update error message
1421         * wasm/js-api/wasm-to-wasm-bad-signature.js: Added. Test a bunch of bad wasm->wasm import signatures
1422         (const.makeImportee.signature.switch):
1423         (BadSignatureDropStartParams):
1424         * wasm/js-api/wasm-to-wasm.js: Added. Test 64-bit wasm->wasm import calls
1425         (const.callerModule):
1426         (const.calleeModule):
1427         (WasmToWasm):
1428
1429 2017-01-02  Saam Barati  <sbarati@apple.com>
1430
1431         WebAssembly: Some loads don't take into account the offset
1432         https://bugs.webkit.org/show_bug.cgi?id=166616
1433         <rdar://problem/29841541>
1434
1435         Reviewed by Keith Miller.
1436
1437         * wasm/function-tests/load-offset.js: Added.
1438
1439 2016-12-29  Saam Barati  <sbarati@apple.com>
1440
1441         WebAssembly: Rebase spec-tests now that wabt has been updated to produce certain kinds of invalid modules
1442         https://bugs.webkit.org/show_bug.cgi?id=166491
1443         <rdar://problem/29814999>
1444
1445         Reviewed by Yusuke Suzuki.
1446
1447         Based off these revisions:
1448         - spec: b055d01ea1dfdd7a5231ae779095435f836de97f
1449         - wabt: d0d44702c753f851b094615298a2f4d4e3c21035
1450
1451         The reason for the rebase is that wabt was updated to stop
1452         silently rejecting invalid modules. This was needed because
1453         some of the spec tests check to make sure that the module
1454         is invalid, but wabt was silently ignoring the errors and
1455         generating valid modules:
1456         https://github.com/WebAssembly/wabt/issues/256
1457
1458         * wasm.yaml:
1459         * wasm/spec-tests/address.wast.js:
1460         * wasm/spec-tests/binary.wast.js:
1461         * wasm/spec-tests/block.wast.js:
1462         * wasm/spec-tests/br.wast.js:
1463         * wasm/spec-tests/br_if.wast.js:
1464         * wasm/spec-tests/br_table.wast.js:
1465         * wasm/spec-tests/break-drop.wast.js:
1466         * wasm/spec-tests/call.wast.js:
1467         * wasm/spec-tests/call_indirect.wast.js:
1468         * wasm/spec-tests/comments.wast.js:
1469         * wasm/spec-tests/conversions.wast.js:
1470         * wasm/spec-tests/custom_section.wast.js:
1471         * wasm/spec-tests/endianness.wast.js:
1472         * wasm/spec-tests/exports.wast.js:
1473         * wasm/spec-tests/f32.wast.js:
1474         * wasm/spec-tests/f32_cmp.wast.js:
1475         * wasm/spec-tests/f64.wast.js:
1476         * wasm/spec-tests/f64_cmp.wast.js:
1477         * wasm/spec-tests/fac.wast.js:
1478         * wasm/spec-tests/float_exprs.wast.js:
1479         * wasm/spec-tests/float_literals.wast.js:
1480         * wasm/spec-tests/float_memory.wast.js:
1481         * wasm/spec-tests/float_misc.wast.js:
1482         * wasm/spec-tests/forward.wast.js:
1483         * wasm/spec-tests/func.wast.js:
1484         * wasm/spec-tests/func_ptrs.wast.js:
1485         * wasm/spec-tests/get_local.wast.js:
1486         * wasm/spec-tests/globals.wast.js:
1487         * wasm/spec-tests/i32.wast.js:
1488         * wasm/spec-tests/i64.wast.js:
1489         * wasm/spec-tests/imports.wast.js:
1490         * wasm/spec-tests/int_exprs.wast.js:
1491         * wasm/spec-tests/int_literals.wast.js:
1492         * wasm/spec-tests/left-to-right.wast.js:
1493         * wasm/spec-tests/linking.wast.js:
1494         * wasm/spec-tests/loop.wast.js:
1495         * wasm/spec-tests/memory.wast.js:
1496         * wasm/spec-tests/memory_redundancy.wast.js:
1497         * wasm/spec-tests/memory_trap.wast.js:
1498         * wasm/spec-tests/names.wast.js:
1499         * wasm/spec-tests/nop.wast.js:
1500         * wasm/spec-tests/resizing.wast.js:
1501         * wasm/spec-tests/return.wast.js:
1502         * wasm/spec-tests/select.wast.js:
1503         * wasm/spec-tests/set_local.wast.js:
1504         * wasm/spec-tests/skip-stack-guard-page.wast.js:
1505         * wasm/spec-tests/stack.wast.js:
1506         * wasm/spec-tests/start.wast.js:
1507         * wasm/spec-tests/store_retval.wast.js:
1508         * wasm/spec-tests/switch.wast.js:
1509         * wasm/spec-tests/tee_local.wast.js:
1510         * wasm/spec-tests/traps.wast.js:
1511         * wasm/spec-tests/typecheck.wast.js:
1512         * wasm/spec-tests/unreachable.wast.js:
1513         * wasm/spec-tests/unwind.wast.js:
1514
1515 2016-12-28  Saam Barati  <sbarati@apple.com>
1516
1517         WebAssembly: Don't allow duplicate export names
1518         https://bugs.webkit.org/show_bug.cgi?id=166490
1519         <rdar://problem/29815000>
1520
1521         Reviewed by Keith Miller.
1522
1523         * wasm.yaml:
1524         * wasm/function-tests/invalid-duplicate-export.js: Added.
1525
1526 2016-12-28  Saam Barati  <sbarati@apple.com>
1527
1528         WebAssembly: Implement grow_memory and current_memory
1529         https://bugs.webkit.org/show_bug.cgi?id=166448
1530         <rdar://problem/29803676>
1531
1532         Reviewed by Keith Miller.
1533
1534         I rewrote some of the testWasmModuleFunctions that used Memory to use
1535         the JS API since the jsc.cpp version can no longer use memory.
1536
1537         * wasm.yaml:
1538         * wasm/function-tests/add-12.js:
1539         (testWasmModuleFunctions):
1540         * wasm/function-tests/br-if-loop-less-than.js:
1541         (testWasmModuleFunctions):
1542         * wasm/function-tests/brTableAsIf.js:
1543         (testWasmModuleFunctions):
1544         * wasm/function-tests/brTableManyValues.js:
1545         (testWasmModuleFunctions):
1546         * wasm/function-tests/brTableWithLoop.js:
1547         (testWasmModuleFunctions):
1548         * wasm/function-tests/dumb-eq-if-then-else.js:
1549         * wasm/function-tests/eqz.js:
1550         * wasm/function-tests/grow-memory-2.js: Added.
1551         (const.func):
1552         (assert.eq.instance.exports.foo):
1553         * wasm/function-tests/grow-memory-3.js: Added.
1554         * wasm/function-tests/grow-memory-4.js: Added.
1555         (const.func):
1556         * wasm/function-tests/grow-memory.js: Added.
1557         (binaryShouldNotParse):
1558         (assert.truthy):
1559         (assert.eq):
1560         (memory.grow):
1561         * wasm/function-tests/i32-load.js:
1562         (testWasmModuleFunctions):
1563         * wasm/function-tests/i32-load8-s.js:
1564         * wasm/function-tests/max.js:
1565         * wasm/function-tests/min.js:
1566         * wasm/js-api/memory-grow.js: Added.
1567         (i.i):
1568         (assertEq):
1569         * wasm/js-api/test_memory.js:
1570         * wasm/wasm.json:
1571
1572 2016-12-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1573
1574         Propagate the source origin as much as possible
1575         https://bugs.webkit.org/show_bug.cgi?id=166348
1576
1577         Reviewed by Darin Adler.
1578
1579         * stress/source-origin.js: Added.
1580         (shouldBe):
1581
1582 2016-12-24  Caio Lima  <ticaiolima@gmail.com>
1583
1584         [test262] Fixing mapped arguments object property test case
1585         https://bugs.webkit.org/show_bug.cgi?id=159398
1586
1587         Reviewed by Saam Barati.
1588
1589         * stress/arguments-bizarre-behaviour-disable-enumerability.js:
1590         * stress/arguments-define-property.js: Added.
1591         (assert):
1592         (testProperties):
1593         * stress/arguments-non-configurable.js: Added.
1594         (assert):
1595         (tryChangeNonConfigurableDescriptor):
1596         (set tryChangeNonConfigurableDescriptor):
1597         (tryChangeWritableOfNonConfigurableDescriptor):
1598         * test262.yaml:
1599
1600 016-12-20  Caio Lima  <ticaiolima@gmail.com>
1601
1602         [test262] Fixing mapped arguments object property test case
1603         https://bugs.webkit.org/show_bug.cgi?id=159398
1604
1605         Reviewed by .
1606
1607         * stress/arguments-bizarre-behaviour-disable-enumerability.js:
1608         * stress/arguments-define-property.js: Added.
1609         (assert):
1610         (testProperties):
1611         * stress/arguments-non-configurable.js: Added.
1612         (assert):
1613         (tryChangeNonConfigurableDescriptor):
1614         (set tryChangeNonConfigurableDescriptor):
1615         (tryChangeWritableOfNonConfigurableDescriptor):
1616         * test262.yaml:
1617
1618 2016-12-23  Keith Miller  <keith_miller@apple.com>
1619
1620         WebAssembly: trap on bad division.
1621         https://bugs.webkit.org/show_bug.cgi?id=164786
1622
1623         Reviewed by Mark Lam.
1624
1625         Also, mark conversions as passing.
1626
1627         * wasm.yaml:
1628         * wasm/wasm.json:
1629
1630 2016-12-22  Keith Miller  <keith_miller@apple.com>
1631
1632         WebAssembly: Make spec-tests/f32.wast.js and spec-tests/f64.wast.js pass
1633         https://bugs.webkit.org/show_bug.cgi?id=166447
1634
1635         Reviewed by Saam Barati.
1636
1637         * wasm.yaml:
1638         * wasm/wasm.json:
1639
1640 2016-12-22  Saam Barati  <sbarati@apple.com>
1641
1642         WebAssembly: Make calling Wasm functions that returns or takes an i64 as a parameter an early exception
1643         https://bugs.webkit.org/show_bug.cgi?id=166437
1644         <rdar://problem/29793949>
1645
1646         Reviewed by Keith Miller.
1647
1648         * wasm.yaml:
1649         * wasm/function-tests/i64-from-js-exceptions.js: Added.
1650         (const.imp.import.sideEffects):
1651         (assert.throws.instance.exports.foo.valueOf):
1652
1653 2016-12-22  Mark Lam  <mark.lam@apple.com>
1654
1655         De-duplicate finally blocks.
1656         https://bugs.webkit.org/show_bug.cgi?id=160168
1657
1658         Reviewed by Saam Barati.
1659
1660         Re-landing r209952 with a few new tests added in test-finally.js.
1661
1662         * stress/deeply-nested-finallys.js: Copied from JSTests/stress/deeply-nested-finallys.js.
1663         - Tests many levels of finally nesting.  This causes the old code to hang (and
1664           crashes eventually) while trying to generate bytecode for the exponentially
1665           duplicated finally blocks.  The new code completes this test almost instantly.
1666
1667         * stress/test-finally.js: Copied from JSTests/stress/test-finally.js.
1668         - Tests control flow through various permutations of finally blocks.
1669
1670 2016-12-22  Saam Barati  <sbarati@apple.com>
1671
1672         WebAssembly: Make the spec-tests/address.wast.js test pass
1673         https://bugs.webkit.org/show_bug.cgi?id=166429
1674         <rdar://problem/29793220>
1675
1676         Reviewed by Keith Miller.
1677
1678         * wasm.yaml:
1679
1680 2016-12-22  Keith Miller  <keith_miller@apple.com>
1681
1682         WebAssembly: The validator should not allow unused stack entries at the end of a block
1683         https://bugs.webkit.org/show_bug.cgi?id=166411
1684
1685         Reviewed by Saam Barati.
1686
1687         Test cleanup and enable new passing tests.
1688
1689         * wasm.yaml:
1690         * wasm/function-tests/br-if-as-return.js:
1691
1692 2016-12-22  Saam Barati  <sbarati@apple.com>
1693
1694         WebAssembly: Make the spec-tests/start.wast.js test pass
1695         https://bugs.webkit.org/show_bug.cgi?id=166416
1696         <rdar://problem/29784532>
1697
1698         Reviewed by Yusuke Suzuki.
1699
1700         * wasm.yaml:
1701
1702 2016-12-21  Keith Miller  <keith_miller@apple.com>
1703
1704         WebAssembly: Fix decode floating point constants in unreachable code
1705         https://bugs.webkit.org/show_bug.cgi?id=166400
1706
1707         Reviewed by Saam Barati.
1708
1709         * wasm.yaml:
1710
1711 2016-12-21  Keith Miller  <keith_miller@apple.com>
1712
1713         WebAssembly: Allow br, br_if, and br_table to act as a return
1714         https://bugs.webkit.org/show_bug.cgi?id=166393
1715
1716         Reviewed by Saam Barati.
1717
1718         Add tests for breaks acting as returns and fix tests that
1719         validate error messages.
1720
1721         * wasm/function-tests/br-as-return.js: Added.
1722         * wasm/function-tests/br-if-as-return.js: Added.
1723         * wasm/function-tests/br-table-as-return.js: Added.
1724         * wasm/function-tests/if-no-else-non-void.js:
1725         * wasm/function-tests/struct.js: Added.
1726         * wasm/js-api/global-error.js:
1727         (assert.throws):
1728         * wasm/js-api/table.js:
1729         (assert.throws):
1730
1731 2016-12-21  Saam Barati  <sbarati@apple.com>
1732
1733         WebAssembly: Import spec tests
1734         https://bugs.webkit.org/show_bug.cgi?id=166395
1735
1736         Rubber stamped by Keith Miller.
1737
1738         This patch implements the Wasm spec's tests found here:
1739         https://github.com/WebAssembly/spec/tree/master/interpreter/test
1740         
1741         These tests are in .wast s-epxression format. To convert
1742         them to JS, I use a script from the wabt library, found here:
1743         https://github.com/WebAssembly/wabt/blob/master/test/run-gen-spec-js.py
1744         
1745         I also added a script that automatically imports the tests as
1746         JS files. The inputs to the script is the path to the Wasm spec
1747         git repo and the path to the wabt git repo. This will make importing
1748         new tests easy in the future.
1749
1750         The wasm spec imported is at commit: b055d01ea1dfdd7a5231ae779095435f836de97f
1751         The wabt used to do the import is at commit: 622b42dced6d793e9d49e9b1fd1d1524defd1387
1752
1753         * wasm.yaml:
1754         * wasm/import-spec-tests.rb: Added.
1755         * wasm/spec-tests: Added.
1756         * wasm/spec-tests/address.wast.js: Added.
1757         (register):
1758         (module):
1759         (instance):
1760         (assert_malformed):
1761         (assert_invalid):
1762         (assert_soft_invalid):
1763         (assert_unlinkable):
1764         (assert_uninstantiable):
1765         (assert_trap):
1766         (assert_return):
1767         (assert_return_nan):
1768         * wasm/spec-tests/binary.wast.js: Added.
1769         (register):
1770         (module):
1771         (instance):
1772         (assert_malformed):
1773         (assert_invalid):
1774         (assert_soft_invalid):
1775         (assert_unlinkable):
1776         (assert_uninstantiable):
1777         (assert_trap):
1778         (assert_return):
1779         (assert_return_nan):
1780         * wasm/spec-tests/block.wast.js: Added.
1781         (register):
1782         (module):
1783         (instance):
1784         (assert_malformed):
1785         (assert_invalid):
1786         (assert_soft_invalid):
1787         (assert_unlinkable):
1788         (assert_uninstantiable):
1789         (assert_trap):
1790         (assert_return):
1791         (assert_return_nan):
1792         * wasm/spec-tests/br.wast.js: Added.
1793         (register):
1794         (module):
1795         (instance):
1796         (assert_malformed):
1797         (assert_invalid):
1798         (assert_soft_invalid):
1799         (assert_unlinkable):
1800         (assert_uninstantiable):
1801         (assert_trap):
1802         (assert_return):
1803         (assert_return_nan):
1804         * wasm/spec-tests/br_if.wast.js: Added.
1805         (register):
1806         (module):
1807         (instance):
1808         (assert_malformed):
1809         (assert_invalid):
1810         (assert_soft_invalid):
1811         (assert_unlinkable):
1812         (assert_uninstantiable):
1813         (assert_trap):
1814         (assert_return):
1815         (assert_return_nan):
1816         * wasm/spec-tests/br_table.wast.js: Added.
1817         (register):
1818         (module):
1819         (instance):
1820         (assert_malformed):
1821         (assert_invalid):
1822         (assert_soft_invalid):
1823         (assert_unlinkable):
1824         (assert_uninstantiable):
1825         (assert_trap):
1826         (assert_return):
1827         (assert_return_nan):
1828         * wasm/spec-tests/break-drop.wast.js: Added.
1829         (register):
1830         (module):
1831         (instance):
1832         (assert_malformed):
1833         (assert_invalid):
1834         (assert_soft_invalid):
1835         (assert_unlinkable):
1836         (assert_uninstantiable):
1837         (assert_trap):
1838         (assert_return):
1839         (assert_return_nan):
1840         * wasm/spec-tests/call.wast.js: Added.
1841         (register):
1842         (module):
1843         (instance):
1844         (assert_malformed):
1845         (assert_invalid):
1846         (assert_soft_invalid):
1847         (assert_unlinkable):
1848         (assert_uninstantiable):
1849         (assert_trap):
1850         (assert_return):
1851         (assert_return_nan):
1852         * wasm/spec-tests/call_indirect.wast.js: Added.
1853         (register):
1854         (module):
1855         (instance):
1856         (assert_malformed):
1857         (assert_invalid):
1858         (assert_soft_invalid):
1859         (assert_unlinkable):
1860         (assert_uninstantiable):
1861         (assert_trap):
1862         (assert_return):
1863         (assert_return_nan):
1864         * wasm/spec-tests/comments.wast.js: Added.
1865         (register):
1866         (module):
1867         (instance):
1868         (assert_malformed):
1869         (assert_invalid):
1870         (assert_soft_invalid):
1871         (assert_unlinkable):
1872         (assert_uninstantiable):
1873         (assert_trap):
1874         (assert_return):
1875         (assert_return_nan):
1876         * wasm/spec-tests/conversions.wast.js: Added.
1877         (register):
1878         (module):
1879         (instance):
1880         (assert_malformed):
1881         (assert_invalid):
1882         (assert_soft_invalid):
1883         (assert_unlinkable):
1884         (assert_uninstantiable):
1885         (assert_trap):
1886         (assert_return):
1887         (assert_return_nan):
1888         * wasm/spec-tests/custom_section.wast.js: Added.
1889         (register):
1890         (module):
1891         (instance):
1892         (assert_malformed):
1893         (assert_invalid):
1894         (assert_soft_invalid):
1895         (assert_unlinkable):
1896         (assert_uninstantiable):
1897         (assert_trap):
1898         (assert_return):
1899         (assert_return_nan):
1900         * wasm/spec-tests/endianness.wast.js: Added.
1901         (register):
1902         (module):
1903         (instance):
1904         (assert_malformed):
1905         (assert_invalid):
1906         (assert_soft_invalid):
1907         (assert_unlinkable):
1908         (assert_uninstantiable):
1909         (assert_trap):
1910         (assert_return):
1911         (assert_return_nan):
1912         * wasm/spec-tests/exports.wast.js: Added.
1913         (register):
1914         (module):
1915         (instance):
1916         (assert_malformed):
1917         (assert_invalid):
1918         (assert_soft_invalid):
1919         (assert_unlinkable):
1920         (assert_uninstantiable):
1921         (assert_trap):
1922         (assert_return):
1923         (assert_return_nan):
1924         * wasm/spec-tests/f32.wast.js: Added.
1925         (register):
1926         (module):
1927         (instance):
1928         (assert_malformed):
1929         (assert_invalid):
1930         (assert_soft_invalid):
1931         (assert_unlinkable):
1932         (assert_uninstantiable):
1933         (assert_trap):
1934         (assert_return):
1935         (assert_return_nan):
1936         * wasm/spec-tests/f32_cmp.wast.js: Added.
1937         (register):
1938         (module):
1939         (instance):
1940         (assert_malformed):
1941         (assert_invalid):
1942         (assert_soft_invalid):
1943         (assert_unlinkable):
1944         (assert_uninstantiable):
1945         (assert_trap):
1946         (assert_return):
1947         (assert_return_nan):
1948         * wasm/spec-tests/f64.wast.js: Added.
1949         (register):
1950         (module):
1951         (instance):
1952         (assert_malformed):
1953         (assert_invalid):
1954         (assert_soft_invalid):
1955         (assert_unlinkable):
1956         (assert_uninstantiable):
1957         (assert_trap):
1958         (assert_return):
1959         (assert_return_nan):
1960         * wasm/spec-tests/f64_cmp.wast.js: Added.
1961         (register):
1962         (module):
1963         (instance):
1964         (assert_malformed):
1965         (assert_invalid):
1966         (assert_soft_invalid):
1967         (assert_unlinkable):
1968         (assert_uninstantiable):
1969         (assert_trap):
1970         (assert_return):
1971         (assert_return_nan):
1972         * wasm/spec-tests/fac.wast.js: Added.
1973         (register):
1974         (module):
1975         (instance):
1976         (assert_malformed):
1977         (assert_invalid):
1978         (assert_soft_invalid):
1979         (assert_unlinkable):
1980         (assert_uninstantiable):
1981         (assert_trap):
1982         (assert_return):
1983         (assert_return_nan):
1984         * wasm/spec-tests/float_exprs.wast.js: Added.
1985         (register):
1986         (module):
1987         (instance):
1988         (assert_malformed):
1989         (assert_invalid):
1990         (assert_soft_invalid):
1991         (assert_unlinkable):
1992         (assert_uninstantiable):
1993         (assert_trap):
1994         (assert_return):
1995         (assert_return_nan):
1996         * wasm/spec-tests/float_literals.wast.js: Added.
1997         (register):
1998         (module):
1999         (instance):
2000         (assert_malformed):
2001         (assert_invalid):
2002         (assert_soft_invalid):
2003         (assert_unlinkable):
2004         (assert_uninstantiable):
2005         (assert_trap):
2006         (assert_return):
2007         (assert_return_nan):
2008         * wasm/spec-tests/float_memory.wast.js: Added.
2009         (register):
2010         (module):
2011         (instance):
2012         (assert_malformed):
2013         (assert_invalid):
2014         (assert_soft_invalid):
2015         (assert_unlinkable):
2016         (assert_uninstantiable):
2017         (assert_trap):
2018         (assert_return):
2019         (assert_return_nan):
2020         * wasm/spec-tests/float_misc.wast.js: Added.
2021         (register):
2022         (module):
2023         (instance):
2024         (assert_malformed):
2025         (assert_invalid):
2026         (assert_soft_invalid):
2027         (assert_unlinkable):
2028         (assert_uninstantiable):
2029         (assert_trap):
2030         (assert_return):
2031         (assert_return_nan):
2032         * wasm/spec-tests/forward.wast.js: Added.
2033         (register):
2034         (module):
2035         (instance):
2036         (assert_malformed):
2037         (assert_invalid):
2038         (assert_soft_invalid):
2039         (assert_unlinkable):
2040         (assert_uninstantiable):
2041         (assert_trap):
2042         (assert_return):
2043         (assert_return_nan):
2044         * wasm/spec-tests/func.wast.js: Added.
2045         (register):
2046         (module):
2047         (instance):
2048         (assert_malformed):
2049         (assert_invalid):
2050         (assert_soft_invalid):
2051         (assert_unlinkable):
2052         (assert_uninstantiable):
2053         (assert_trap):
2054         (assert_return):
2055         (assert_return_nan):
2056         * wasm/spec-tests/func_ptrs.wast.js: Added.
2057         (register):
2058         (module):
2059         (instance):
2060         (assert_malformed):
2061         (assert_invalid):
2062         (assert_soft_invalid):
2063         (assert_unlinkable):
2064         (assert_uninstantiable):
2065         (assert_trap):
2066         (assert_return):
2067         (assert_return_nan):
2068         * wasm/spec-tests/get_local.wast.js: Added.
2069         (register):
2070         (module):
2071         (instance):
2072         (assert_malformed):
2073         (assert_invalid):
2074         (assert_soft_invalid):
2075         (assert_unlinkable):
2076         (assert_uninstantiable):
2077         (assert_trap):
2078         (assert_return):
2079         (assert_return_nan):
2080         * wasm/spec-tests/globals.wast.js: Added.
2081         (register):
2082         (module):
2083         (instance):
2084         (assert_malformed):
2085         (assert_invalid):
2086         (assert_soft_invalid):
2087         (assert_unlinkable):
2088         (assert_uninstantiable):
2089         (assert_trap):
2090         (assert_return):
2091         (assert_return_nan):
2092         * wasm/spec-tests/i32.wast.js: Added.
2093         (register):
2094         (module):
2095         (instance):
2096         (assert_malformed):
2097         (assert_invalid):
2098         (assert_soft_invalid):
2099         (assert_unlinkable):
2100         (assert_uninstantiable):
2101         (assert_trap):
2102         (assert_return):
2103         (assert_return_nan):
2104         * wasm/spec-tests/i64.wast.js: Added.
2105         (register):
2106         (module):
2107         (instance):
2108         (assert_malformed):
2109         (assert_invalid):
2110         (assert_soft_invalid):
2111         (assert_unlinkable):
2112         (assert_uninstantiable):
2113         (assert_trap):
2114         (assert_return):
2115         (assert_return_nan):
2116         * wasm/spec-tests/imports.wast.js: Added.
2117         (register):
2118         (module):
2119         (instance):
2120         (assert_malformed):
2121         (assert_invalid):
2122         (assert_soft_invalid):
2123         (assert_unlinkable):
2124         (assert_uninstantiable):
2125         (assert_trap):
2126         (assert_return):
2127         (assert_return_nan):
2128         * wasm/spec-tests/int_exprs.wast.js: Added.
2129         (register):
2130         (module):
2131         (instance):
2132         (assert_malformed):
2133         (assert_invalid):
2134         (assert_soft_invalid):
2135         (assert_unlinkable):
2136         (assert_uninstantiable):
2137         (assert_trap):
2138         (assert_return):
2139         (assert_return_nan):
2140         * wasm/spec-tests/int_literals.wast.js: Added.
2141         (register):
2142         (module):
2143         (instance):
2144         (assert_malformed):
2145         (assert_invalid):
2146         (assert_soft_invalid):
2147         (assert_unlinkable):
2148         (assert_uninstantiable):
2149         (assert_trap):
2150         (assert_return):
2151         (assert_return_nan):
2152         * wasm/spec-tests/left-to-right.wast.js: Added.
2153         (register):
2154         (module):
2155         (instance):
2156         (assert_malformed):
2157         (assert_invalid):
2158         (assert_soft_invalid):
2159         (assert_unlinkable):
2160         (assert_uninstantiable):
2161         (assert_trap):
2162         (assert_return):
2163         (assert_return_nan):
2164         * wasm/spec-tests/linking.wast.js: Added.
2165         (register):
2166         (module):
2167         (instance):
2168         (assert_malformed):
2169         (assert_invalid):
2170         (assert_soft_invalid):
2171         (assert_unlinkable):
2172         (assert_uninstantiable):
2173         (assert_trap):
2174         (assert_return):
2175         (assert_return_nan):
2176         * wasm/spec-tests/loop.wast.js: Added.
2177         (register):
2178         (module):
2179         (instance):
2180         (assert_malformed):
2181         (assert_invalid):
2182         (assert_soft_invalid):
2183         (assert_unlinkable):
2184         (assert_uninstantiable):
2185         (assert_trap):
2186         (assert_return):
2187         (assert_return_nan):
2188         * wasm/spec-tests/memory.wast.js: Added.
2189         (register):
2190         (module):
2191         (instance):
2192         (assert_malformed):
2193         (assert_invalid):
2194         (assert_soft_invalid):
2195         (assert_unlinkable):
2196         (assert_uninstantiable):
2197         (assert_trap):
2198         (assert_return):
2199         (assert_return_nan):
2200         * wasm/spec-tests/memory_redundancy.wast.js: Added.
2201         (register):
2202         (module):
2203         (instance):
2204         (assert_malformed):
2205         (assert_invalid):
2206         (assert_soft_invalid):
2207         (assert_unlinkable):
2208         (assert_uninstantiable):
2209         (assert_trap):
2210         (assert_return):
2211         (assert_return_nan):
2212         * wasm/spec-tests/memory_trap.wast.js: Added.
2213         (register):
2214         (module):
2215         (instance):
2216         (assert_malformed):
2217         (assert_invalid):
2218         (assert_soft_invalid):
2219         (assert_unlinkable):
2220         (assert_uninstantiable):
2221         (assert_trap):
2222         (assert_return):
2223         (assert_return_nan):
2224         * wasm/spec-tests/names.wast.js: Added.
2225         (register):
2226         (module):
2227         (instance):
2228         (assert_malformed):
2229         (assert_invalid):
2230         (assert_soft_invalid):
2231         (assert_unlinkable):
2232         (assert_uninstantiable):
2233         (assert_trap):
2234         (assert_return):
2235         (assert_return_nan):
2236         * wasm/spec-tests/nop.wast.js: Added.
2237         (register):
2238         (module):
2239         (instance):
2240         (assert_malformed):
2241         (assert_invalid):
2242         (assert_soft_invalid):
2243         (assert_unlinkable):
2244         (assert_uninstantiable):
2245         (assert_trap):
2246         (assert_return):
2247         (assert_return_nan):
2248         * wasm/spec-tests/resizing.wast.js: Added.
2249         (register):
2250         (module):
2251         (instance):
2252         (assert_malformed):
2253         (assert_invalid):
2254         (assert_soft_invalid):
2255         (assert_unlinkable):
2256         (assert_uninstantiable):
2257         (assert_trap):
2258         (assert_return):
2259         (assert_return_nan):
2260         * wasm/spec-tests/return.wast.js: Added.
2261         (register):
2262         (module):
2263         (instance):
2264         (assert_malformed):
2265         (assert_invalid):
2266         (assert_soft_invalid):
2267         (assert_unlinkable):
2268         (assert_uninstantiable):
2269         (assert_trap):
2270         (assert_return):
2271         (assert_return_nan):
2272         * wasm/spec-tests/select.wast.js: Added.
2273         (register):
2274         (module):
2275         (instance):
2276         (assert_malformed):
2277         (assert_invalid):
2278         (assert_soft_invalid):
2279         (assert_unlinkable):
2280         (assert_uninstantiable):
2281         (assert_trap):
2282         (assert_return):
2283         (assert_return_nan):
2284         * wasm/spec-tests/set_local.wast.js: Added.
2285         (register):
2286         (module):
2287         (instance):
2288         (assert_malformed):
2289         (assert_invalid):
2290         (assert_soft_invalid):
2291         (assert_unlinkable):
2292         (assert_uninstantiable):
2293         (assert_trap):
2294         (assert_return):
2295         (assert_return_nan):
2296         * wasm/spec-tests/skip-stack-guard-page.wast.js: Added.
2297         (register):
2298         (module):
2299         (instance):
2300         (assert_malformed):
2301         (assert_invalid):
2302         (assert_soft_invalid):
2303         (assert_unlinkable):
2304         (assert_uninstantiable):
2305         (assert_trap):
2306         (assert_return):
2307         (assert_return_nan):
2308         * wasm/spec-tests/stack.wast.js: Added.
2309         (register):
2310         (module):
2311         (instance):
2312         (assert_malformed):
2313         (assert_invalid):
2314         (assert_soft_invalid):
2315         (assert_unlinkable):
2316         (assert_uninstantiable):
2317         (assert_trap):
2318         (assert_return):
2319         (assert_return_nan):
2320         * wasm/spec-tests/start.wast.js: Added.
2321         (register):
2322         (module):
2323         (instance):
2324         (assert_malformed):
2325         (assert_invalid):
2326         (assert_soft_invalid):
2327         (assert_unlinkable):
2328         (assert_uninstantiable):
2329         (assert_trap):
2330         (assert_return):
2331         (assert_return_nan):
2332         * wasm/spec-tests/store_retval.wast.js: Added.
2333         (register):
2334         (module):
2335         (instance):
2336         (assert_malformed):
2337         (assert_invalid):
2338         (assert_soft_invalid):
2339         (assert_unlinkable):
2340         (assert_uninstantiable):
2341         (assert_trap):
2342         (assert_return):
2343         (assert_return_nan):
2344         * wasm/spec-tests/switch.wast.js: Added.
2345         (register):
2346         (module):
2347         (instance):
2348         (assert_malformed):
2349         (assert_invalid):
2350         (assert_soft_invalid):
2351         (assert_unlinkable):
2352         (assert_uninstantiable):
2353         (assert_trap):
2354         (assert_return):
2355         (assert_return_nan):
2356         * wasm/spec-tests/tee_local.wast.js: Added.
2357         (register):
2358         (module):
2359         (instance):
2360         (assert_malformed):
2361         (assert_invalid):
2362         (assert_soft_invalid):
2363         (assert_unlinkable):
2364         (assert_uninstantiable):
2365         (assert_trap):
2366         (assert_return):
2367         (assert_return_nan):
2368         * wasm/spec-tests/traps.wast.js: Added.
2369         (register):
2370         (module):
2371         (instance):
2372         (assert_malformed):
2373         (assert_invalid):
2374         (assert_soft_invalid):
2375         (assert_unlinkable):
2376         (assert_uninstantiable):
2377         (assert_trap):
2378         (assert_return):
2379         (assert_return_nan):
2380         * wasm/spec-tests/typecheck.wast.js: Added.
2381         (register):
2382         (module):
2383         (instance):
2384         (assert_malformed):
2385         (assert_invalid):
2386         (assert_soft_invalid):
2387         (assert_unlinkable):
2388         (assert_uninstantiable):
2389         (assert_trap):
2390         (assert_return):
2391         (assert_return_nan):
2392         * wasm/spec-tests/unreachable.wast.js: Added.
2393         (register):
2394         (module):
2395         (instance):
2396         (assert_malformed):
2397         (assert_invalid):
2398         (assert_soft_invalid):
2399         (assert_unlinkable):
2400         (assert_uninstantiable):
2401         (assert_trap):
2402         (assert_return):
2403         (assert_return_nan):
2404         * wasm/spec-tests/unwind.wast.js: Added.
2405         (register):
2406         (module):
2407         (instance):
2408         (assert_malformed):
2409         (assert_invalid):
2410         (assert_soft_invalid):
2411         (assert_unlinkable):
2412         (assert_uninstantiable):
2413         (assert_trap):
2414         (assert_return):
2415         (assert_return_nan):
2416
2417 2016-12-20  Keith Miller  <keith_miller@apple.com>
2418
2419         Add support for global
2420         https://bugs.webkit.org/show_bug.cgi?id=165171
2421
2422         Reviewed by Filip Pizlo.
2423
2424         * stress/global.js: Added.
2425
2426 2016-12-20  JF Bastien  <jfbastien@apple.com>
2427
2428         WebAssembly API: implement WebAssembly.LinkError
2429         https://bugs.webkit.org/show_bug.cgi?id=165805
2430         <rdar://problem/29747874>
2431
2432         Reviewed by Mark lam.
2433
2434         Update all exception sites which now throw WebAssembly.LinkError.
2435
2436         * wasm/js-api/element-data.js:
2437         * wasm/js-api/element.js:
2438         (assert.throws):
2439         * wasm/js-api/global-error.js:
2440         (new.Number):
2441         * wasm/js-api/table.js:
2442         (assert.throws):
2443         (new.WebAssembly.Table):
2444         * wasm/js-api/test_Data.js:
2445         * wasm/js-api/test_basic_api.js:
2446         (const.c.in.constructorProperties.switch):
2447         * wasm/js-api/test_memory.js:
2448         (test):
2449         (test.testMemImportError): Deleted.
2450
2451 2016-12-20  JF Bastien  <jfbastien@apple.com>
2452
2453         WebAssembly: unique function signatures
2454         https://bugs.webkit.org/show_bug.cgi?id=165957
2455         <rdar://problem/29735737>
2456
2457         Reviewed by Saam Barati.
2458
2459         * wasm/function-tests/table-basic.js: FIXME is now addressed,
2460         though instance to instance calls still need work which bug
2461         #165282 will address
2462         (i.assert.eq.foo):
2463         * wasm/js-api/unique-signature.js: Added.
2464         (CallIndirectWithDuplicateSignatures):
2465
2466 2016-12-19  Mark Lam  <mark.lam@apple.com>
2467
2468         Rolling out r209974 and r209952. They break some websites in mysterious ways. Step 2: Rollout r209952.
2469         https://bugs.webkit.org/show_bug.cgi?id=166049
2470
2471         Not reviewed.
2472
2473         * stress/deeply-nested-finallys.js: Removed.
2474         * stress/test-finally.js: Removed.
2475
2476 2016-12-19  Saam Barati  <sbarati@apple.com>
2477
2478         WebAssembly: Make running Wasm tests take less time by reducing some tests' iteration count and by splitting some tests into different files
2479         https://bugs.webkit.org/show_bug.cgi?id=166017
2480
2481         Reviewed by Yusuke Suzuki.
2482
2483         * wasm/function-tests/trap-load-2.js: Added.
2484         (assert):
2485         (wasmFrameCountFromError):
2486         (continuation):
2487         (i.catch):
2488         * wasm/function-tests/trap-load.js:
2489         (assert.continuation): Deleted.
2490         * wasm/function-tests/trap-store-2.js: Added.
2491         (import.Builder.from.string_appeared_here.assert):
2492         (continuation):
2493         (i.catch):
2494         * wasm/function-tests/trap-store.js:
2495         (assert.continuation): Deleted.
2496         (assert): Deleted.
2497         * wasm/js-api/test_memory.js:
2498         (test):
2499
2500 2016-12-18  Saam Barati  <sbarati@apple.com>
2501
2502         WebAssembly: Implement the WebAssembly.compile and WebAssembly.validate
2503         https://bugs.webkit.org/show_bug.cgi?id=165936
2504
2505         Reviewed by Mark Lam.
2506
2507         * wasm/js-api/Module-compile.js: Added.
2508         (async.testPromiseAPI):
2509         * wasm/js-api/test_basic_api.js:
2510         (const.c.in.constructorProperties.switch):
2511         * wasm/js-api/validate.js: Added.
2512         (assert.truthy.WebAssembly.validate.builder.WebAssembly):
2513
2514 2016-12-16  Mark Lam  <mark.lam@apple.com>
2515
2516         De-duplicate finally blocks.
2517         https://bugs.webkit.org/show_bug.cgi?id=160168
2518
2519         Reviewed by Keith Miller.
2520
2521         * stress/deeply-nested-finallys.js: Added.
2522         - Tests many levels of finally nesting.  This causes the old code to hang (and
2523           crashes eventually) while trying to generate bytecode for the exponentially
2524           duplicated finally blocks.  The new code completes this test almost instantly.
2525
2526         * stress/test-finally.js: Added.
2527         - Tests control flow through various permutations of finally blocks.
2528
2529 2016-12-16  Saam Barati  <sbarati@apple.com>
2530
2531         WebAssembly: WasmB3IRGenerator should throw exceptions instead of crash
2532         https://bugs.webkit.org/show_bug.cgi?id=165834
2533
2534         Reviewed by Keith Miller.
2535
2536         * wasm/function-tests/exceptions.js: Added.
2537         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2538         * wasm/function-tests/table-basic.js:
2539         (i.i.42.throw.new.Error):
2540
2541 2016-12-16  Keith Miller  <keith_miller@apple.com>
2542
2543         i64.eqz should use an Int64 zero
2544         https://bugs.webkit.org/show_bug.cgi?id=165942
2545
2546         Reviewed by Mark Lam.
2547
2548         * wasm/wasm.json:
2549
2550 2016-12-15  Keith Miller  <keith_miller@apple.com>
2551
2552         Fix validation of non-void if blocks with no else
2553         https://bugs.webkit.org/show_bug.cgi?id=165938
2554
2555         Reviewed by Saam Barati.
2556
2557         Add a new failing test and a fix an existing one.
2558
2559         * wasm/function-tests/dead-call.js:
2560         * wasm/function-tests/if-no-else-non-void.js: Added.
2561
2562 2016-12-15  Keith Miller  <keith_miller@apple.com>
2563
2564         Wasm should not create empty unlinked callsites
2565         https://bugs.webkit.org/show_bug.cgi?id=165933
2566
2567         Reviewed by Mark Lam.
2568
2569         * wasm/function-tests/dead-call.js: Added.
2570
2571 2016-12-15  JF Bastien  <jfbastien@apple.com>
2572
2573         WebAssembly: improve compilation error messages
2574         https://bugs.webkit.org/show_bug.cgi?id=163919
2575
2576         Reviewed by Saam Barati.
2577
2578         Update error messages in these tests.
2579         Use the assert.throws facility in many of them which weren't already.
2580
2581         * wasm/js-api/element.js:
2582         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2583         (assert.throws):
2584         * wasm/js-api/global-error.js:
2585         (assert.throws.new.WebAssembly.Module.bin):
2586         (assert.throws):
2587         (new.Number):
2588         * wasm/js-api/table.js:
2589         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2590         (assert.throws):
2591         (assertBadTableImport):
2592         * wasm/js-api/test_Data.js:
2593         (DataSectionWithoutMemory):
2594         * wasm/js-api/test_Start.js:
2595         (InvalidStartFunctionIndex):
2596         * wasm/js-api/test_basic_api.js:
2597         (const.c.in.constructorProperties.switch):
2598
2599 2016-12-15  JF Bastien  <jfbastien@apple.com>
2600
2601         WebAssembly API: improve data section errors
2602         https://bugs.webkit.org/show_bug.cgi?id=165733
2603
2604         Reviewed by Keith Miller.
2605
2606         * wasm/js-api/element-data.js: Added.
2607         (ElementBeforeData.set const):
2608         (ElementBeforeData): check the order of initialization, which is observable on failure
2609         * wasm/js-api/test_Data.js:
2610         (DataSectionWithoutMemory):
2611         (DataSectionOffTheEnd): Deleted.
2612         (DataSectionPartlyOffTheEnd): Deleted.
2613         (DataSectionEmptyOffTheEnd): Deleted.
2614         (DataSectionSeenByStart): Deleted.
2615
2616 2016-12-15  Keith Miller  <keith_miller@apple.com>
2617
2618         Fix 64-bit shift family Wasm opcodes
2619         https://bugs.webkit.org/show_bug.cgi?id=165902
2620
2621         Reviewed by Geoffrey Garen.
2622
2623         Add tests for shift family of instructions. Since
2624         we can't generate i64 values to pass to wasm we only compile
2625         the code for those functions. Attempting to generate any i64
2626         code using these instructions would have been enough to cause
2627         the B3 Validation error anyway.
2628
2629         * wasm/assert.js:
2630         * wasm/function-tests/rotl.js: Added.
2631         * wasm/function-tests/rotr.js: Added.
2632         * wasm/function-tests/shl.js: Added.
2633         * wasm/function-tests/shr-s.js: Added.
2634         * wasm/function-tests/shr-u.js: Added.
2635         * wasm/wasm.json:
2636
2637 2016-12-14  Keith Miller  <keith_miller@apple.com>
2638
2639         WebAssembly: test_BuilderJSON.js is broken
2640         https://bugs.webkit.org/show_bug.cgi?id=165893
2641
2642         Reviewed by Michael Saboff.
2643
2644         * wasm/Builder.js:
2645         (const._isValidValue):
2646         * wasm/self-test/test_BuilderJSON.js:
2647
2648 2016-12-14  Keith Miller  <keith_miller@apple.com>
2649
2650         Unreviewed, fix test.
2651
2652         * wasm/function-tests/i32-const.js:
2653
2654 2016-12-14  Keith Miller  <keith_miller@apple.com>
2655
2656         Wasm should decode constants correctly
2657         https://bugs.webkit.org/show_bug.cgi?id=165886
2658
2659         Reviewed by Saam Barati.
2660
2661         * wasm/Builder.js:
2662         (const._isValidValue):
2663         * wasm/Builder_WebAssemblyBinary.js:
2664         (const.putOp):
2665         * wasm/LowLevelBinary.js:
2666         (export.default.LowLevelBinary.prototype.float):
2667         (export.default.LowLevelBinary.prototype.double):
2668         * wasm/function-tests/f32-const.js: Added.
2669         * wasm/function-tests/f64-const.js: Added.
2670         * wasm/function-tests/i32-const.js: Added.
2671         * wasm/wasm.json:
2672
2673 2016-12-14  Saam Barati  <sbarati@apple.com>
2674
2675         WebAssembly: Add various low hanging fruit that will allow us to run the LLVM torture tests in Wasm
2676         https://bugs.webkit.org/show_bug.cgi?id=165883
2677
2678         Reviewed by Keith Miller.
2679
2680         * wasm/Builder.js:
2681         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2682         * wasm/Builder_WebAssemblyBinary.js:
2683         (const.emitters.Export):
2684         * wasm/js-api/table.js:
2685         (assertBadBinary):
2686         (assertBadTable):
2687         (assert.truthy):
2688         * wasm/js-api/test_memory.js:
2689         (binaryShouldNotParse):
2690         (test):
2691         (test.testMemImportError):
2692         (assert.truthy):
2693         (assert): Deleted.
2694
2695 2016-12-14  Filip Pizlo  <fpizlo@apple.com>
2696
2697         DirectTailCall implementation needs to tell the shuffler what to put into the ArgumentCount explicitly
2698         https://bugs.webkit.org/show_bug.cgi?id=165882
2699
2700         Reviewed by Mark Lam.
2701
2702         * stress/direct-tail-call-arity-mismatch-count-args.js: Added.
2703         (foo):
2704         (bar):
2705
2706 2016-12-14  Keith Miller  <keith_miller@apple.com>
2707
2708         WebAssembly JS API: implement Global
2709         https://bugs.webkit.org/show_bug.cgi?id=164133
2710
2711         Reviewed by Saam Barati.
2712
2713         * wasm/Builder.js:
2714         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2715         * wasm/Builder_WebAssemblyBinary.js:
2716         (const.valueType.WASM.description.type.i32.type.const.putGlobalType):
2717         (const.putOp):
2718         (const.putInitExpr):
2719         (const.emitters.Import):
2720         (const.emitters.Global):
2721         (const.emitters.Export):
2722         (const.emitters.Code):
2723         * wasm/LowLevelBinary.js:
2724         (export.default.LowLevelBinary.prototype.varuint32):
2725         (export.default.LowLevelBinary.prototype.varint32):
2726         * wasm/js-api/global-error.js: Added.
2727         (catch):
2728         (assert.truthy):
2729         * wasm/js-api/global-external-init-from-import.js: Added.
2730         * wasm/js-api/global-internal-init-from-import.js: Added.
2731         * wasm/js-api/global-mutate.js: Added.
2732         (createInternalGlobalModule):
2733         * wasm/js-api/globals-export.js: Added.
2734         * wasm/js-api/globals-import.js: Added.
2735         * wasm/wasm.json:
2736
2737 2016-12-13  Saam Barati  <sbarati@apple.com>
2738
2739         WebAssembly: implement the elements section
2740         https://bugs.webkit.org/show_bug.cgi?id=165715
2741
2742         Reviewed by Keith Miller.
2743
2744         * wasm/Builder.js:
2745         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2746         (export.default.Builder.prototype._registerSectionBuilders.switch):
2747         * wasm/Builder_WebAssemblyBinary.js:
2748         (const.emitters.Element):
2749         * wasm/function-tests/basic-element.js: Added.
2750         * wasm/js-api/element.js: Added.
2751         (assertBadBinary):
2752         (assertBadBinary.badInstantiation):
2753
2754 2016-12-13  Saam Barati  <sbarati@apple.com>
2755
2756         WebAssembly: implement the table section and table import
2757         https://bugs.webkit.org/show_bug.cgi?id=165716
2758
2759         Reviewed by Keith Miller.
2760
2761         * wasm/Builder.js:
2762         (const._importMemoryContinuation):
2763         (const._importTableContinuation):
2764         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2765         (const._importMemoryContinuation.section): Deleted.
2766         (const): Deleted.
2767         (const._importMemoryContinuation.assert): Deleted.
2768         * wasm/Builder_WebAssemblyBinary.js:
2769         (const.putResizableLimits):
2770         (const.putTable):
2771         (const.emitters.Import):
2772         (const.emitters.Table):
2773         * wasm/function-tests/call-indirect-params.js:
2774         * wasm/function-tests/call-indirect.js:
2775         * wasm/function-tests/table-basic-2.js: Added.
2776         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2777         (func):
2778         * wasm/function-tests/table-basic.js: Added.
2779         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2780         * wasm/js-api/call-indirect-results.js:
2781         (const.wasmModuleWhichImportJS): Deleted.
2782         (MonomorphicImport): Deleted.
2783         * wasm/js-api/call-indirect.js:
2784         (const.wasmModuleWhichImportJS):
2785         (const.makeTable):
2786         (Polyphic2Import):
2787         (VirtualImport):
2788         (MonomorphicImport): Deleted.
2789         * wasm/js-api/table.js: Added.
2790         (assertBadBinary):
2791         (assert.truthy):
2792         (assertBadTable):
2793         (assertBadTableImport):
2794         (assertBadBinary.assertBadTableInstance):
2795         (assertBadTableInstance):
2796         (new.WebAssembly.Table):
2797         * wasm/js-api/test_basic_api.js:
2798         (const.c.in.constructorProperties.switch):
2799
2800 2016-12-13  Commit Queue  <commit-queue@webkit.org>
2801
2802         Unreviewed, rolling out r209725.
2803         https://bugs.webkit.org/show_bug.cgi?id=165811
2804
2805         "Broke ARMv7 builds" (Requested by msaboff on #webkit).
2806
2807         Reverted changeset:
2808
2809         "REGRESSION(r209653): speedometer crashes making virtual slow
2810         path tailcalls"
2811         https://bugs.webkit.org/show_bug.cgi?id=165748
2812         http://trac.webkit.org/changeset/209725
2813
2814 2016-12-12  Michael Saboff  <msaboff@apple.com>
2815
2816         REGRESSION(r209653): speedometer crashes making virtual slow path tailcalls
2817         https://bugs.webkit.org/show_bug.cgi?id=165748
2818
2819         Reviewed by Filip Pizlo.
2820
2821         New regression test.
2822
2823         * stress/regress-165748.js: Added.
2824         (sum1):
2825         (sum2):
2826         (sum3):
2827         (sum4):
2828         (sum5):
2829         (sum6):
2830         (tailCaller):
2831         (test):
2832
2833 2016-12-12  Mark Lam  <mark.lam@apple.com>
2834
2835         Debug JSC test timeout: stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js.ftl-no-cjit.
2836         https://bugs.webkit.org/show_bug.cgi?id=164630
2837
2838         Reviewed by Keith Miller.
2839
2840         Speculative fix for timeout issue.  It looks like this test just runs a bit
2841         slower on debug builds.  So, we'll give it a little more time to run.
2842
2843         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
2844
2845 2016-12-11  Saam Barati  <sbarati@apple.com>
2846
2847         We should be able to throw exceptions from Wasm code and when Wasm frames are on the stack
2848         https://bugs.webkit.org/show_bug.cgi?id=165429
2849
2850         Reviewed by Keith Miller.
2851
2852         * wasm/function-tests/trap-load.js: Added.
2853         (assert):
2854         (wasmFrameCountFromError):
2855         (i.catch):
2856         (assert.continuation):
2857         * wasm/function-tests/trap-store.js: Added.
2858         (import.Builder.from.string_appeared_here.assert):
2859         (i.catch):
2860         (assert.continuation):
2861         (assert):
2862         * wasm/js-api/test_memory_constructor.js:
2863         (assert):
2864
2865 2016-12-10  Commit Queue  <commit-queue@webkit.org>
2866
2867         Unreviewed, rolling out r209653, r209654, r209663, and
2868         r209673.
2869         https://bugs.webkit.org/show_bug.cgi?id=165739
2870
2871         speedometer crashes (Requested by pizlo on #webkit).
2872
2873         Reverted changesets:
2874
2875         "JSVALUE64: Pass arguments in platform argument registers when
2876         making JavaScript calls"
2877         https://bugs.webkit.org/show_bug.cgi?id=160355
2878         http://trac.webkit.org/changeset/209653
2879
2880         "Unreviewed build fix for 32 bit builds."
2881         http://trac.webkit.org/changeset/209654
2882
2883         "Unreviewed build fix for the CLOOP after r209653"
2884         http://trac.webkit.org/changeset/209663
2885
2886         "REGRESSION(r209653) Crash in CallFrameShuffler::snapshot()"
2887         https://bugs.webkit.org/show_bug.cgi?id=165728
2888         http://trac.webkit.org/changeset/209673
2889
2890 2016-12-10  Michael Saboff  <msaboff@apple.com>
2891
2892         REGRESSION(r209653) Crash in CallFrameShuffler::snapshot()
2893         https://bugs.webkit.org/show_bug.cgi?id=165728
2894
2895         Reviewed by Filip Pizlo.
2896
2897         New regression test.
2898
2899         * stress/regress-165728.js: Added.
2900         (sum1):
2901         (sum2):
2902         (tailCaller):
2903         (test):
2904
2905 2016-12-10  Keith Miller  <keith_miller@apple.com>
2906
2907         Fix indirect_call if the result type is used.
2908         https://bugs.webkit.org/show_bug.cgi?id=165727
2909
2910         Reviewed by Michael Saboff.
2911
2912         * wasm/js-api/call-indirect-results.js: Added.
2913         (const.wasmModuleWhichImportJS):
2914         (MonomorphicImport):
2915
2916 2016-12-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2917
2918         [JSC] Module namespace object behaves like immutable prototype exotic object
2919         https://bugs.webkit.org/show_bug.cgi?id=165598
2920
2921         Reviewed by Mark Lam.
2922
2923         * modules/namespace-prototype-assignment.js: Added.
2924         (else):
2925         (reportError):
2926         (shouldEqual):
2927         (shouldThrow):
2928         (stringify):
2929         (makeTestID):
2930         (doInternalSetPrototypeOf):
2931         (ordinarySetPrototypeOf):
2932         (setImmutablePrototype):
2933         (windowProxySetPrototypeOf):
2934         (initSetterExpectation):
2935         (throwIfNoExceptionPending):
2936         (objectSetPrototypeOf):
2937         (setUnderscoreProto):
2938         (reflectSetPrototypeOf):
2939         (setPrototypeOf):
2940         (newObjectProto.toString):
2941         (Symbol):
2942         (test):
2943         (runTests):
2944         * modules/namespace-set-prototype-of.js: Added.
2945         (shouldThrow):
2946         (TypeError.Cannot.set prototype):
2947
2948 2016-12-09  Michael Saboff  <msaboff@apple.com>
2949
2950         JSVALUE64: Pass arguments in platform argument registers when making JavaScript calls
2951         https://bugs.webkit.org/show_bug.cgi?id=160355
2952
2953         Reviewed by Filip Pizlo.
2954
2955         New microbenchmarks to measure call type performance.
2956
2957         * microbenchmarks/calling-computed-args.js: Added.
2958         * microbenchmarks/calling-many-callees.js: Added.
2959         * microbenchmarks/calling-one-callee-fixed.js: Added.
2960         * microbenchmarks/calling-one-callee.js: Added.
2961         * microbenchmarks/calling-poly-callees.js: Added.
2962         * microbenchmarks/calling-poly-extra-arity-callees.js: Added.
2963         * microbenchmarks/calling-tailcall.js: Added.
2964         * microbenchmarks/calling-virtual-arity-fixup-callees.js: Added.
2965         * microbenchmarks/calling-virtual-arity-fixup-stackargs.js: Added.
2966         * microbenchmarks/calling-virtual-callees.js: Added.
2967         * microbenchmarks/calling-virtual-extra-arity-callees.js: Added.
2968
2969 2016-12-09  Keith Miller  <keith_miller@apple.com>
2970
2971         Wasm should support call_indirect
2972         https://bugs.webkit.org/show_bug.cgi?id=165718
2973
2974         Reviewed by Filip Pizlo.
2975
2976         * wasm/Builder.js:
2977         * wasm/function-tests/call-indirect-params.js: Added.
2978         * wasm/function-tests/call-indirect.js: Added.
2979         * wasm/js-api/call-indirect.js: Added.
2980         (const.wasmModuleWhichImportJS):
2981         (MonomorphicImport):
2982         (Polyphic2Import):
2983         (VirtualImport):
2984         * wasm/wasm.json:
2985
2986 2016-12-09  JF Bastien  <jfbastien@apple.com>
2987
2988         WebAssembly: implement data section
2989         https://bugs.webkit.org/show_bug.cgi?id=165696
2990
2991         Reviewed by Keith Miller.
2992
2993         As specified in https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md#data-section
2994         Note that some of the interesting corner cases are ill-defined by the spec: https://github.com/WebAssembly/design/issues/897
2995
2996         * wasm/Builder.js: create a data section from JavaScript
2997         * wasm/Builder_WebAssemblyBinary.js: assemble the data section into the proper binary encoding
2998         (const.emitters.Data):
2999         * wasm/js-api/test_Data.js: Added.
3000         (DataSection):
3001         (DataSectionOffTheEnd):
3002         (DataSectionPartlyOffTheEnd):
3003         (DataSectionEmptyOffTheEnd):
3004         (DataSectionSeenByStart):
3005         * wasm/self-test/test_BuilderJSON.js: make sure the JSON structure is fine (this sanity checks before going to binary)
3006
3007 2016-12-09  JF Bastien  <jfbastien@apple.com>
3008
3009         WebAssembly JS API: implement start function
3010         https://bugs.webkit.org/show_bug.cgi?id=165150
3011
3012         Reviewed by Saam Barati.
3013
3014         * wasm/Builder.js: allow building a .Start()
3015         * wasm/Builder_WebAssemblyBinary.js:
3016         * wasm/js-api/test_Start.js: Added.
3017         (const.emitters.Start): serialize a start section
3018         * wasm/self-test/test_BuilderJSON.js: validate the start section's content
3019
3020 2016-12-09  Saam Barati  <sbarati@apple.com>
3021
3022         WebAssembly JS API: implement importing and defining Memory
3023         https://bugs.webkit.org/show_bug.cgi?id=164134
3024
3025         Reviewed by Keith Miller.
3026
3027         * wasm/Builder.js:
3028         (const._importMemoryContinuation.section):
3029         (const._importMemoryContinuation.assert):
3030         (const._importMemoryContinuation):
3031         (const._exportFunctionContinuation.const): Deleted.
3032         (const._exportFunctionContinuation): Deleted.
3033         * wasm/Builder_WebAssemblyBinary.js:
3034         (const.emitters.Import):
3035         * wasm/js-api/test_basic_api.js:
3036         (const.c.in.constructorProperties.switch):
3037         * wasm/js-api/test_memory.js: Added.
3038         (assert):
3039         (binaryShouldNotParse):
3040         (test):
3041         (test.testMemImportError):
3042         * wasm/js-api/test_memory_constructor.js: Added.
3043         (assert):
3044         (throw.new.Error):
3045         (testInvalidSize):
3046         (assert.testInvalidInitial):
3047         (testInvalidInitial.testInvalidMaximum):
3048         (testInvalidInitial):
3049         (testInvalidMaximum):
3050         * wasm/self-test/test_BuilderJSON.js:
3051
3052 2016-12-08  JF Bastien  <jfbastien@apple.com>
3053
3054         WebAssembly: JSC::link* shouldn't need a CodeBlock
3055         https://bugs.webkit.org/show_bug.cgi?id=165591
3056
3057         Reviewed by Keith Miller.
3058
3059         test that wasm -> JS works, including the IC
3060
3061         * wasm/js-api/test_Instance.js:
3062         (const.wasmModuleWhichImportJS):
3063         (MonomorphicImport):
3064         (Polyphic2Import):
3065         (Polyphic3Import):
3066         (VirtualImport):
3067
3068 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
3069
3070         Green the cloop bot by raising this threshold.
3071
3072         * mozilla/js1_5/Array/regress-101964.js:
3073
3074 2016-12-08  JF Bastien  <jfbastien@apple.com>
3075
3076         WebAssembly JS API: wire up Instance imports
3077         https://bugs.webkit.org/show_bug.cgi?id=165118
3078
3079         Reviewed by Saam Barati.
3080
3081         * wasm/js-api/test_Instance.js: add the test, disabled for now
3082
3083 2016-12-07  Keith Miller  <keith_miller@apple.com>
3084
3085         Add more missing trivial wasm ops.
3086         https://bugs.webkit.org/show_bug.cgi?id=165564
3087
3088         Add tests for drop and tee_local.
3089
3090         Reviewed by Geoffrey Garen.
3091
3092         * wasm/function-tests/drop.js: Added.
3093         * wasm/function-tests/nop.js: Added.
3094         * wasm/function-tests/tee-local.js: Added.
3095
3096 2016-12-06  Keith Miller  <keith_miller@apple.com>
3097
3098         Add support for truncation operators
3099         https://bugs.webkit.org/show_bug.cgi?id=165519
3100
3101         Reviewed by Geoffrey Garen.
3102
3103         * wasm/function-tests/i32-trunc-s-f32.js: Added.
3104         * wasm/function-tests/i32-trunc-s-f64.js: Added.
3105         * wasm/function-tests/i32-trunc-u-f32.js: Added.
3106         * wasm/function-tests/i32-trunc-u-f64.js: Added.
3107         * wasm/function-tests/i64-trunc-s-f32.js: Added.
3108         * wasm/function-tests/i64-trunc-s-f64.js: Added.
3109         * wasm/function-tests/i64-trunc-u-f32.js: Added.
3110         * wasm/function-tests/i64-trunc-u-f64.js: Added.
3111
3112 2016-12-06  Mark Lam  <mark.lam@apple.com>
3113
3114         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
3115         https://bugs.webkit.org/show_bug.cgi?id=165227
3116         <rdar://problem/29442665>
3117
3118         Reviewed by Saam Barati.
3119
3120         * stress/get-from-scope-dynamic-onto-proxy.js:
3121         - Updated error message.
3122
3123         * stress/proxy-dont-infinite-loop.js: Removed.
3124         * stress/proxy-json-path.js: Removed.
3125         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.
3126         - Removed these tests because the issue they are testing relies on being able to
3127           set Object.prototype.__proto__ to something else (which is now not possible).
3128
3129 2016-12-05  Caitlin Potter  <caitp@igalia.com>
3130
3131         [JSC] report unexpected token when "async" is followed by identifier 
3132         https://bugs.webkit.org/show_bug.cgi?id=165091
3133
3134         Reviewed by Mark Lam.
3135
3136         * stress/bug-165091.js:
3137
3138 2016-12-05  Keith Miller  <keith_miller@apple.com>
3139
3140         Add Wasm i64 to i32 conversion.
3141         https://bugs.webkit.org/show_bug.cgi?id=165378
3142
3143         Reviewed by Filip Pizlo.
3144
3145         It turns out the wrap operation is just B3's Trunc.
3146
3147         * wasm/wasm.json:
3148
3149 2016-12-04  Keith Miller  <keith_miller@apple.com>
3150
3151         Add support for Wasm ctz and popcnt
3152         https://bugs.webkit.org/show_bug.cgi?id=165369
3153
3154         Reviewed by Saam Barati.
3155
3156         * wasm/function-tests/ctz.js: Added.
3157         * wasm/function-tests/popcnt.js: Added.
3158
3159 2016-12-03  JF Bastien  <jfbastien@apple.com>
3160
3161         WebAssembly: update binary format to 0xD version
3162         https://bugs.webkit.org/show_bug.cgi?id=165345
3163
3164         Reviewed by Keith Miller.
3165
3166         As described in the following PR: https://github.com/WebAssembly/design/pull/836
3167         Originally committed in r209175, reverted in r209242, and fixed in r209284.
3168
3169         * wasm/Builder.js:
3170         (const._normalizeFunctionSignature):
3171         * wasm/Builder_WebAssemblyBinary.js:
3172         (const.emitters.Type):
3173         (const.emitters.Code):
3174         * wasm/LowLevelBinary.js:
3175         (export.default.LowLevelBinary.prototype.block_type):
3176         (export.default.LowLevelBinary.prototype.inline_signature_type): Deleted.
3177         * wasm/WASM.js:
3178         * wasm/js-api/test_basic_api.js:
3179         * wasm/self-test/test_BuilderWebAssembly.js:
3180         (EmptyModule):
3181         (CustomSection):
3182         * wasm/self-test/test_WASM.js:
3183         * wasm/wasm.json:
3184
3185 2016-12-02  Keith Miller  <keith_miller@apple.com>
3186
3187         Add Wasm copysign
3188         https://bugs.webkit.org/show_bug.cgi?id=165355
3189
3190         Reviewed by Filip Pizlo.
3191
3192         * wasm/function-tests/copysign.js: Added.
3193
3194 2016-12-03  Commit Queue  <commit-queue@webkit.org>
3195
3196         Unreviewed, rolling out r209298.
3197         https://bugs.webkit.org/show_bug.cgi?id=165359
3198
3199         broke the build (Requested by smfr on #webkit).
3200
3201         Reverted changeset:
3202
3203         "Add Wasm copysign"
3204         https://bugs.webkit.org/show_bug.cgi?id=165355
3205         http://trac.webkit.org/changeset/209298
3206
3207 2016-12-02  Keith Miller  <keith_miller@apple.com>
3208
3209         Add Wasm copysign
3210         https://bugs.webkit.org/show_bug.cgi?id=165355
3211
3212         Reviewed by Filip Pizlo.
3213
3214         * wasm/function-tests/copysign.js: Added.
3215
3216 2016-12-02  Keith Miller  <keith_miller@apple.com>
3217
3218         Unreviewed, fix git having a breakdown over trying to reland a rollout.
3219
3220 2016-12-02  Keith Miller  <keith_miller@apple.com>
3221
3222         Add Wasm floating point nearest and trunc
3223         https://bugs.webkit.org/show_bug.cgi?id=165339
3224
3225         Reviewed by Saam Barati.
3226
3227         * wasm/function-tests/nearest.js: Added.
3228         * wasm/function-tests/trunc.js: Added.
3229
3230 2016-12-02  Caitlin Potter  <caitp@igalia.com>
3231
3232 [JSC] add additional bit to JSTokenType bitfield
3233         https://bugs.webkit.org/show_bug.cgi?id=165091
3234
3235         Reviewed by Geoffrey Garen.
3236
3237         * stress/bug-165091.js: Added.
3238         (shouldThrowSyntaxError):
3239
3240 2016-12-02  Commit Queue  <commit-queue@webkit.org>
3241
3242         Unreviewed, rolling out r209275 and r209276.
3243         https://bugs.webkit.org/show_bug.cgi?id=165348
3244
3245         "broke the arm build" (Requested by keith_miller on #webkit).
3246
3247         Reverted changesets:
3248
3249         "Add Wasm floating point nearest and trunc"
3250         https://bugs.webkit.org/show_bug.cgi?id=165339
3251         http://trac.webkit.org/changeset/209275
3252
3253         "Unreviewed, forgot to change instruction after renaming."
3254         http://trac.webkit.org/changeset/209276
3255
3256 2016-12-02  Keith Miller  <keith_miller@apple.com>
3257
3258         Add Wasm floating point nearest and trunc
3259         https://bugs.webkit.org/show_bug.cgi?id=165339
3260
3261         Reviewed by Filip Pizlo.
3262
3263         * wasm/function-tests/nearest.js: Added.
3264         * wasm/function-tests/trunc.js: Added.
3265
3266 2016-12-02  JF Bastien  <jfbastien@apple.com>
3267
3268         WebAssembly: revert patch causing odd breakage
3269         https://bugs.webkit.org/show_bug.cgi?id=165308
3270
3271         Unreviewed.
3272
3273         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
3274         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
3275
3276         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
3277
3278         * wasm/Builder.js:
3279         (const._normalizeFunctionSignature):
3280         * wasm/Builder_WebAssemblyBinary.js:
3281         (const.emitters.Type):
3282         (const.emitters.Code):
3283         * wasm/LowLevelBinary.js:
3284         (export.default.LowLevelBinary.prototype.inline_signature_type):
3285         (export.default.LowLevelBinary.prototype.block_type): Deleted.
3286         * wasm/WASM.js:
3287         * wasm/js-api/test_basic_api.js:
3288         * wasm/self-test/test_BuilderWebAssembly.js:
3289         (EmptyModule):
3290         (CustomSection):
3291         * wasm/self-test/test_WASM.js:
3292         * wasm/wasm.json:
3293
3294 2016-12-01  Ryan Haddad  <ryanhaddad@apple.com>
3295
3296         Skip flaky test ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js
3297         https://bugs.webkit.org/show_bug.cgi?id=162567
3298
3299         Reviewed by Saam Barati.
3300
3301         * ChakraCore.yaml:
3302
3303 2016-12-01  Keith Miller  <keith_miller@apple.com>
3304
3305         Add wasm int to floating point opcodes
3306         https://bugs.webkit.org/show_bug.cgi?id=165252
3307
3308         Reviewed by Geoffrey Garen.
3309
3310         Add tests for Wasm integral to floating point conversion opcodes.
3311
3312         * wasm/function-tests/int-to-floating-point.js: Added.
3313         * wasm/wasm.json:
3314
3315 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
3316
3317         Land a test case for <rdar://problem/27889416>
3318         https://bugs.webkit.org/show_bug.cgi?id=165272
3319
3320         Reviewed by Saam Barati.
3321
3322         * stress/marked-argument-buffer.js: Added.
3323         (allocate):
3324         (test.o.toString):
3325         (test):
3326
3327 2016-11-29  Per Arne Vollan  <pvollan@apple.com>
3328
3329         [Win] Skip failing JSC tests.
3330         https://bugs.webkit.org/show_bug.cgi?id=165140
3331
3332         Reviewed by Mark Lam.
3333
3334         * ChakraCore.yaml:
3335         * microbenchmarks/tan.js:
3336
3337 2016-11-30  JF Bastien  <jfbastien@apple.com>
3338
3339         WebAssembly builder: don't throw when checker not implemented
3340         https://bugs.webkit.org/show_bug.cgi?id=165219
3341
3342         Reviewed by Mark Lam.
3343
3344         We should perform whichever checks we've implemented, and assume the rest are OK until bug #163421 is fixed.
3345
3346         * wasm/Builder.js:
3347         * wasm/README.md:
3348         * wasm/function-tests/add-12.js:
3349         * wasm/function-tests/br-if-loop-less-than.js:
3350         * wasm/function-tests/brTableAsIf.js:
3351         * wasm/function-tests/brTableManyValues.js:
3352         * wasm/function-tests/brTableWithLoop.js:
3353         * wasm/function-tests/dumb-eq-if-then-else.js:
3354         * wasm/function-tests/dumb-less-than-fallthrough.js:
3355         * wasm/function-tests/dumb-less-than-ite.js:
3356         * wasm/function-tests/eqz.js:
3357         * wasm/function-tests/factorial.js:
3358         * wasm/function-tests/float-sub.js:
3359         * wasm/function-tests/i32-load.js:
3360         * wasm/function-tests/i32-load8-s.js:
3361         * wasm/function-tests/if-then-else-fallthrough.js:
3362         * wasm/function-tests/if-then-fallthrough.js:
3363         * wasm/function-tests/loop-mult.js:
3364         * wasm/function-tests/loop-sum.js:
3365         * wasm/function-tests/max.js:
3366         * wasm/function-tests/min.js:
3367         * wasm/function-tests/ret5.js:
3368         * wasm/function-tests/select.js:
3369         * wasm/self-test/test_BuilderJSON.js:
3370
3371 2016-11-29  JF Bastien  <jfbastien@apple.com>
3372
3373         WebAssembly JS API: improve Instance
3374         https://bugs.webkit.org/show_bug.cgi?id=164757
3375
3376         Reviewed by Keith Miller.
3377
3378         An Instance's `exports` property wasn't populated with exports.
3379
3380         A follow-up patch will do imports.
3381
3382         A few things of note:
3383
3384          - LowLevelBinary: support 3-byte integers.
3385          - LowLevelBinary: support proper UTF-8 2003 code points (instead of UTF-16).
3386
3387         * wasm/Builder.js:
3388         * wasm/Builder_WebAssemblyBinary.js: wire up exports, stub other things out some more
3389         (const.emitters.Export):
3390         * wasm/LowLevelBinary.js:
3391         (export.default.LowLevelBinary.prototype.uint24): add, used for UTF-8
3392         (export.default.LowLevelBinary.prototype.string): support UTF-8
3393         (export.default.LowLevelBinary.prototype.getUint24): add, used for UTF-8
3394         (export.default.LowLevelBinary.prototype.getVaruint1): was missing
3395         (export.default.LowLevelBinary.prototype.getString): support UTF-8
3396         (export.default.LowLevelBinary):
3397         * wasm/js-api/test_Instance.js: instance.exports.answer() // <-- this is where the magic of this entire patch is
3398         (ExportedAnswerI32):
3399         * wasm/js-api/test_basic_api.js: punt test to later
3400         (const.c.in.constructorProperties.switch):
3401         * wasm/self-test/test_BuilderWebAssembly.js: UTF-8
3402         (CustomSection):
3403         * wasm/self-test/test_LowLevelBinary_string.js: UTF-8 now works
3404         * wasm/self-test/test_LowLevelBinary_uint16.js: was missing one value
3405         * wasm/self-test/test_LowLevelBinary_uint24.js: Copied from JSTests/wasm/self-test/test_LowLevelBinary_uint8.js.
3406         * wasm/self-test/test_LowLevelBinary_uint8.js: was missing one value
3407         * wasm/self-test/test_LowLevelBinary_varuint1.js: Added.
3408         * wasm/utilities.js: this `dump` thing was useful
3409         (const._dump):
3410
3411 2016-11-29  Saam Barati  <sbarati@apple.com>
3412
3413         We should be able optimize the pattern where we spread a function's rest parameter to another call
3414         https://bugs.webkit.org/show_bug.cgi?id=163865
3415
3416         Reviewed by Filip Pizlo.
3417
3418         * microbenchmarks/default-derived-constructor.js: Added.
3419         (createClassHierarchy.let.currentClass):
3420         (createClassHierarchy):
3421         * stress/call-varargs-spread.js: Added.
3422         (assert):
3423         (bar):
3424         (foo):
3425         * stress/load-varargs-on-new-array-with-spread-convert-to-static-loads.js: Added.
3426         (assert):
3427         (baz):
3428         (bar):
3429         (foo):
3430         * stress/new-array-with-spread-with-normal-spread-and-phantom-spread.js: Added.
3431         (assert):
3432         (foo):
3433         (escape):
3434         (bar):
3435         * stress/phantom-new-array-with-spread-osr-exit.js: Added.
3436         (assert):
3437         (baz):
3438         (bar):
3439         (effects):
3440         (foo):
3441         * stress/phantom-spread-forward-varargs.js: Added.
3442         (assert):
3443         (test1.bar):
3444         (test1.foo):
3445         (test1):
3446         (test2.bar):
3447         (test2.foo):
3448         (test3.baz):
3449         (test3.bar):
3450         (test3.foo):
3451         (test4.baz):
3452         (test4.bar):
3453         (test4.foo):
3454         (test5.baz):
3455         (test5.bar):
3456         (test5.foo):
3457         * stress/phantom-spread-osr-exit.js: Added.
3458         (assert):
3459         (baz):
3460         (bar):
3461         (effects):
3462         (foo):
3463         * stress/spread-call-convert-to-static-call.js: Added.
3464         (assert):
3465         (baz):
3466         (bar):
3467         (foo):
3468         * stress/spread-forward-call-varargs-stack-overflow.js: Added.
3469         (assert):
3470         (identity):
3471         (bar):
3472         (foo):
3473         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol-2.js: Added.
3474         (assert):
3475         (baz.Array.prototype.Symbol.iterator):
3476         (baz):
3477         (bar):
3478         (foo):
3479         (test):
3480         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol.js: Added.
3481         (assert):
3482         (baz.Array.prototype.Symbol.iterator):
3483         (baz):
3484         (bar):
3485         (foo):
3486         * stress/spread-forward-varargs-stack-overflow.js: Added.
3487         (assert):
3488         (bar):
3489         (foo):
3490
3491 2016-11-29  Caitlin Potter  <caitp@igalia.com>
3492
3493         [JSC] always wrap AwaitExpression operand in a new Promise
3494         https://bugs.webkit.org/show_bug.cgi?id=165181
3495
3496         Reviewed by Yusuke Suzuki.
3497
3498         * stress/async-await-basic.js:
3499         (async.awaitedPromisesAreWrapped):
3500
3501 2016-11-29  Keith Miller  <keith_miller@apple.com>
3502
3503         Add simple way to implement Wasm ops that require more than one B3 opcode
3504         https://bugs.webkit.org/show_bug.cgi?id=165129
3505
3506         Reviewed by Geoffrey Garen.
3507
3508         * wasm/function-tests/eqz.js: Added.
3509         * wasm/function-tests/max.js: Added.
3510         * wasm/function-tests/min.js: Added.
3511         * wasm/wasm.json:
3512
3513 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3514
3515         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
3516         https://bugs.webkit.org/show_bug.cgi?id=164898
3517
3518         Reviewed by Darin Adler.
3519
3520         * stress/tagged-template-registry-key-collect.js: Added.
3521         (shouldBe):
3522         (tag):
3523         (i.eval):
3524         * stress/tagged-template-registry-key.js: Added.
3525         (shouldBe):
3526         (tag):
3527         (a):
3528         (b):
3529
3530 2016-11-20  Caitlin Potter  <caitp@igalia.com>
3531
3532         [JSC] speed up parsing of async functions
3533         https://bugs.webkit.org/show_bug.cgi?id=164808
3534
3535         Reviewed by Yusuke Suzuki.
3536
3537         Add tests for line terminator following "async" keyword in async
3538         function syntax.
3539
3540         * stress/async-await-syntax.js:
3541         (shouldBe):
3542
3543 2016-11-19  Mark Lam  <mark.lam@apple.com>
3544
3545         op_mod-* JSC tests needs a longer timeout too.
3546         https://bugs.webkit.org/show_bug.cgi?id=164994
3547
3548         Reviewed by Yusuke Suzuki.
3549
3550         * stress/op_mod-ConstVar.js:
3551         * stress/op_mod-VarConst.js:
3552         * stress/op_mod-VarVar.js:
3553
3554 2016-11-19  Mark Lam  <mark.lam@apple.com>
3555
3556         Add --timeoutMultiplier option to allow some tests more time to run.
3557         https://bugs.webkit.org/show_bug.cgi?id=164951
3558
3559         Reviewed by Yusuke Suzuki.
3560
3561         Extended the timeout for these tests by 50% more because they run quite slow on
3562         low-end machines.
3563
3564         * stress/op_div-ConstVar.js:
3565         * stress/op_div-VarConst.js:
3566         * stress/op_div-VarVar.js:
3567
3568 2016-11-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3569
3570         REGRESSION(r208867): JSC test failure: ChakraCore.yaml/ChakraCore/test/strict/05.arguments_sm.js.default
3571         https://bugs.webkit.org/show_bug.cgi?id=164929
3572
3573         Reviewed by Mark Lam.
3574
3575         ES2017 drops arguments.caller and JavaScriptCore is updated to meet the spec.
3576         This patch rebaselines the result of ChakraCore test for JSC.
3577
3578         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
3579
3580 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
3581
3582         Web Inspector: Generator functions should have a displayable name when shown in stack traces
3583         https://bugs.webkit.org/show_bug.cgi?id=164844
3584         <rdar://problem/29300697>
3585
3586         Reviewed by Yusuke Suzuki.
3587
3588         * stress/generator-function-name.js:
3589         Add another test now that we name the inner generator function
3590         that we do not break the lexical resolution of names.
3591
3592 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
3593
3594         [JSC] Drop arguments.caller
3595         https://bugs.webkit.org/show_bug.cgi?id=164859
3596
3597         Reviewed by Saam Barati.
3598
3599         * stress/strict-mode-arguments-caller.js: Added.
3600         (strictArguments):
3601         (shouldBe):
3602
3603 2016-11-17  Keith Miller  <keith_miller@apple.com>
3604
3605         Add rotate to Wasm
3606         https://bugs.webkit.org/show_bug.cgi?id=164871
3607
3608         Reviewed by Filip Pizlo.
3609
3610         * wasm/wasm.json:
3611
3612 2016-11-17  Keith Miller  <keith_miller@apple.com>
3613
3614         Add sqrt to Wasm
3615         https://bugs.webkit.org/show_bug.cgi?id=164877
3616
3617         Reviewed by Mark Lam.
3618
3619         B3 already has a Sqrt opcode we just need to map Wasm to it.
3620
3621         * wasm/wasm.json:
3622
3623 2016-11-17  Saam Barati  <sbarati@apple.com>
3624
3625         Remove async/await compile time flag and enable tests
3626         https://bugs.webkit.org/show_bug.cgi?id=164828
3627         <rdar://problem/28639334>
3628
3629         Reviewed by Yusuke Suzuki.
3630
3631         * stress/async-arrow-functions-lexical-arguments-binding.js:
3632         * stress/async-arrow-functions-lexical-new.target-binding.js:
3633         * stress/async-arrow-functions-lexical-super-binding.js:
3634         * stress/async-arrow-functions-lexical-this-binding.js:
3635         * stress/async-await-basic.js:
3636         * stress/async-await-long-loop.js:
3637         * stress/async-await-module-reserved-word.js:
3638         * stress/async-await-mozilla.js:
3639         (mozSyntaxErrors):
3640         * stress/async-await-reserved-word.js:
3641         * stress/async-await-syntax.js:
3642         * stress/async-await-throw-loop.js:
3643         * stress/async-function-create-nobaseline.js:
3644         * stress/async-function-create-optimized.js:
3645         * stress/async-function-declaration-sinking-no-double-allocate.js:
3646         * stress/async-function-declaration-sinking-osrexit.js:
3647         * stress/async-function-declaration-sinking-put.js:
3648         * stress/async-function-expression-sinking-no-double-allocate.js:
3649         * stress/async-function-expression-sinking-osrexit.js:
3650         * stress/async-function-expression-sinking-put.js:
3651         * test262.yaml:
3652
3653 2016-11-15  Mark Lam  <mark.lam@apple.com>
3654
3655         Make JSC test functions more robust.
3656         https://bugs.webkit.org/show_bug.cgi?id=164807
3657
3658         Reviewed by Keith Miller.
3659
3660         * stress/jsc-test-functions-should-be-more-robust.js: Added.
3661
3662 2016-11-15  Keith Miller  <keith_miller@apple.com>
3663
3664         B3 should support UDiv/UMod
3665         https://bugs.webkit.org/show_bug.cgi?id=164811
3666
3667         Reviewed by Filip Pizlo.
3668
3669         Link new instructions to wasm.
3670
3671         * wasm/wasm.json:
3672
3673 2016-11-15  Saam Barati  <sbarati@apple.com>
3674
3675         Debug JSC test timeout: stress/has-own-property-name-cache-symbols-and-strings.js.ftl-no-cjit-small-pool
3676         https://bugs.webkit.org/show_bug.cgi?id=163012
3677
3678         Unreviewed. This patch makes a test run for less time because it's timing out on the bots.
3679
3680         * stress/has-own-property-name-cache-symbols-and-strings.js:
3681
3682 2016-11-15  Mark Lam  <mark.lam@apple.com>
3683
3684         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
3685         https://bugs.webkit.org/show_bug.cgi?id=164781
3686         <rdar://problem/28418590>
3687
3688         Reviewed by Geoffrey Garen and Michael Saboff.
3689
3690         * stress/jsc-setImpureGetterDelegate-on-bad-type.js: Added.
3691
3692 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3693
3694         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
3695         https://bugs.webkit.org/show_bug.cgi?id=164727
3696
3697         Reviewed by Filip Pizlo.
3698
3699         * stress/check-dom-with-signature.js: Added.
3700         (shouldBe):
3701         (calling):
3702         (i.array.forEach):
3703
3704 2016-11-14  Caitlin Potter  <caitp@igalia.com>
3705
3706         [JSC] do not reference AwaitExpression Promises in async function Promise chain
3707         https://bugs.webkit.org/show_bug.cgi?id=164753
3708
3709         Reviewed by Yusuke Suzuki.
3710
3711         * asyncFunctionTests.yaml:
3712         * stress/async-await-long-loop.js: Added.
3713         (shouldBe):
3714         (async.longLoop):
3715         * stress/async-await-throw-loop.js: Added.
3716         (shouldBe):
3717         (async.thrower):
3718         (async.throwLoop):
3719
3720 2016-11-14  Keith Miller  <keith_miller@apple.com>
3721
3722         Add Wasm select
3723         https://bugs.webkit.org/show_bug.cgi?id=164743
3724
3725         Reviewed by Saam Barati.
3726
3727         * wasm/function-tests/select.js: Added.
3728
3729 2016-11-14  Caitlin Potter  <caitp@igalia.com>
3730
3731         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
3732         https://bugs.webkit.org/show_bug.cgi?id=164037
3733
3734         Reviewed by Yusuke Suzuki.
3735
3736         Add tests based on tests from https://trac.webkit.org/changeset/194216.
3737
3738         * asyncFunctionTests.yaml:
3739         * stress/async-function-create-nobaseline.js: Added.
3740         * stress/async-function-create-optimized.js: Added.
3741         * stress/async-function-declaration-sinking-no-double-allocate.js: Added.
3742         * stress/async-function-declaration-sinking-osrexit.js: Added.
3743         * stress/async-function-declaration-sinking-put.js: Added.
3744         * stress/async-function-expression-sinking-no-double-allocate.js: Added.
3745         * stress/async-function-expression-sinking-osrexit.js: Added.
3746         * stress/async-function-expression-sinking-put.js: Added.
3747
3748 2016-11-14  Mark Lam  <mark.lam@apple.com>
3749
3750         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
3751         https://bugs.webkit.org/show_bug.cgi?id=164701
3752         <rdar://problem/27462104>
3753
3754         Reviewed by Darin Adler.
3755
3756         * stress/string-prototype-charCodeAt-on-too-long-rope.js: Added.
3757
3758 2016-11-14  Mark Lam  <mark.lam@apple.com>
3759
3760         RegExpObject::exec/match should handle errors gracefully.
3761         https://bugs.webkit.org/show_bug.cgi?id=155145
3762         <rdar://problem/27435934>
3763
3764         Reviewed by Keith Miller.
3765
3766         * stress/regexp-prototype-exec-on-too-long-rope.js: Added.
3767         * stress/regexp-prototype-match-on-too-long-rope.js: Added.
3768         * stress/regexp-prototype-test-on-too-long-rope.js: Added.
3769
3770 2016-11-14  Mark Lam  <mark.lam@apple.com>
3771
3772         Enhance run-jsc-stress-test script to allow optional test specific options to be added for all test run configurations.
3773         https://bugs.webkit.org/show_bug.cgi?id=164695
3774
3775         Reviewed by Keith Miller.
3776
3777         Replace use of runMisc* test run configurations with equivalents.
3778
3779         * stress/licm-no-pre-header-nested.js:
3780         * stress/licm-no-pre-header.js:
3781         * stress/licm-pre-header-cannot-exit-nested.js:
3782         * stress/licm-pre-header-cannot-exit.js:
3783         * stress/make-dictionary-repatch.js:
3784         * stress/retry-cache-later.js:
3785         * stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js:
3786         * stress/slow-path-generator-updating-current-node-dfg.js:
3787         * stress/unshift-array-storage.js:
3788
3789 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
3790
3791         test262: DataView with explicit undefined byteLength should be the same as it not being present
3792         https://bugs.webkit.org/show_bug.cgi?id=164453
3793
3794         Reviewed by Darin Adler.
3795
3796         * stress/dataview-construct.js: Added.
3797         (assert):
3798         (shouldThrow):
3799         * test262.yaml:
3800
3801 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
3802
3803         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
3804         https://bugs.webkit.org/show_bug.cgi?id=164451
3805
3806         Reviewed by Darin Adler.
3807
3808         * test262.yaml:
3809
3810 2016-11-11  Saam Barati  <sbarati@apple.com>
3811
3812         We should have a more concise way of determining when we're varargs calling a function using rest parameters
3813         https://bugs.webkit.org/show_bug.cgi?id=164258
3814
3815         Reviewed by Yusuke Suzuki.
3816
3817         * microbenchmarks/call-using-spread.js: Added.
3818         (bar):
3819         (foo):
3820         * microbenchmarks/spread-large-array.js: Added.
3821         (foo):
3822         (arrays.push):
3823         * microbenchmarks/spread-small-array.js: Added.
3824         (foo):
3825         * stress/spread-array-iterator-watchpoint-2.js: Added.
3826         (foo):
3827         (arrayIterator.next):
3828         * stress/spread-array-iterator-watchpoint.js: Added.
3829         (foo):
3830         (Array.prototype.Symbol.iterator):
3831         * stress/spread-non-array.js: Added.
3832         (assert):
3833         (foo):
3834         (let.customIterator.Symbol.iterator):
3835         (bar):
3836
3837 2016-11-11  Keith Miller  <keith_miller@apple.com>
3838
3839         Relocate wasm tests and actually add them to the test runner
3840         https://bugs.webkit.org/show_bug.cgi?id=164668
3841
3842         Reviewed by Yusuke Suzuki.
3843
3844         This moves the Wasm tests from their current location down a level.
3845         Without relocating, the tests cannot properly be run by the wasm test runner.
3846
3847         * wasm.yaml:
3848         * wasm/Builder.js: Fix typos, yay lazy synatx checking!
3849         * wasm/LowLevelBinary.js: Fix typos, yay lazy synatx checking!
3850         (export.default.LowLevelBinary.prototype.get return):
3851         * wasm/function-tests/add-12.js: Renamed from JSTests/wasm/js-api/function-tests/add-12.js.
3852         * wasm/function-tests/br-if-loop-less-than.js: Renamed from JSTests/wasm/js-api/function-tests/br-if-loop-less-than.js.
3853         * wasm/function-tests/brTableAsIf.js: Renamed from JSTests/wasm/js-api/function-tests/brTableAsIf.js.
3854         * wasm/function-tests/brTableManyValues.js: Renamed from JSTests/wasm/js-api/function-tests/brTableManyValues.js.
3855         * wasm/function-tests/brTableWithLoop.js: Renamed from JSTests/wasm/js-api/function-tests/brTableWithLoop.js.
3856         * wasm/function-tests/dumb-eq-if-then-else.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-eq-if-then-else.js.
3857         * wasm/function-tests/dumb-less-than-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-fallthrough.js.
3858         * wasm/function-tests/dumb-less-than-ite.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-ite.js.
3859         * wasm/function-tests/factorial.js: Renamed from JSTests/wasm/js-api/function-tests/factorial.js.
3860         * wasm/function-tests/float-sub.js: Renamed from JSTests/wasm/js-api/function-tests/float-sub.js.
3861         * wasm/function-tests/i32-load.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load.js.
3862         * wasm/function-tests/i32-load8-s.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load8-s.js.
3863         * wasm/function-tests/if-then-else-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-else-fallthrough.js.
3864         * wasm/function-tests/if-then-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-fallthrough.js.
3865         * wasm/function-tests/loop-mult.js: Renamed from JSTests/wasm/js-api/function-tests/loop-mult.js.
3866         * wasm/function-tests/loop-sum.js: Renamed from JSTests/wasm/js-api/function-tests/loop-sum.js.
3867         * wasm/function-tests/ret5.js: Renamed from JSTests/wasm/js-api/function-tests/ret5.js.
3868         * wasm/self-test/test_BuilderJSON.js: Rebasline
3869
3870 2016-11-11  Keith Miller  <keith_miller@apple.com>
3871
3872         Move Wasm tests to JS
3873         https://bugs.webkit.org/show_bug.cgi?id=164611
3874
3875         Reviewed by Geoffrey Garen.
3876
3877         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
3878         ommited tests were earliest tests, which tested trivial things, like adding two
3879         constants. Some tests are ommited for other reasons, however. These are:
3880
3881         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
3882         Tests that would validate the memory of the module once wasm was done with it since that's
3883         not really possible in JS.
3884
3885         In order to make such a translation easier this patch also adds some features to the JS
3886         testing api:
3887
3888         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
3889         opcode. For example one can do:
3890             ...
3891             .Block("i32", b => b.I32Const(1) )
3892
3893         and the nested lambda will automatically have an end attached.
3894
3895         2) The JS testing api can now handle inline signature types.
3896
3897         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
3898
3899         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
3900         wasm.json without being remapped.
3901
3902         5) Add support for Memory and Function sections to the Builder.
3903
3904         6) Add support for local variables.
3905
3906         On the JSC side, we needed to expose a new function to validate the compiled wasm code
3907         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
3908         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
3909         number of functions in the blob and tests for each of those functions.
3910
3911         * wasm/Builder.js:
3912         (const._maybeRegisterType):
3913         (const): Deleted.
3914         (switch.typeof): Deleted.
3915         * wasm/Builder_WebAssemblyBinary.js:
3916         (const.emitters.Type):
3917         (const.emitters.Import):
3918         (const.emitters.Function):
3919         (const.emitters.Memory):
3920         (const.emitters.Code):
3921         (export.const.Binary):
3922         * wasm/LowLevelBinary.js:
3923         (export.default.LowLevelBinary.prototype.get return):
3924         (export.default.LowLevelBinary.prototype.varuint32):
3925         (export.default.LowLevelBinary.prototype.varint32):
3926         (export.default.LowLevelBinary.prototype.varuint1):
3927         (export.default.LowLevelBinary.prototype.varint7):
3928         (export.default.LowLevelBinary.prototype.varuint7):
3929         (export.default.LowLevelBinary.prototype.inline_signature_type):
3930         (export.default.LowLevelBinary.prototype.string):
3931         (export.default.LowLevelBinary.prototype.getVaruint32):
3932         (export.default.LowLevelBinary.prototype.getVarint32):
3933         (export.default.LowLevelBinary.prototype.getVaruint7):
3934         (export.default.LowLevelBinary.prototype.getString):
3935         (export.default.LowLevelBinary):
3936         (export.default.LowLevelBinary.prototype.varuint): Deleted.
3937         (export.default.LowLevelBinary.prototype.varint): Deleted.
3938         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
3939         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
3940         * wasm/js-api/test_old_tests.js: Added.
3941         (ret5):
3942         (brTableWithLoop):
3943         (brTableManyValues):
3944         (run.brTableManyValues.brTableAsIf):
3945         (ifThenFallthrough):
3946         (ifThenElseFallthrough):
3947         (dumbLessThanFallthrough):
3948         (run.dumbLessThanFallthrough.floatSub):
3949         (run.floatSub.add12):
3950         (run.add12.factorial):
3951         (i32load):
3952         (run.i32load.i32load8s):
3953         (run.i32load8s.dumbEqIfThenElse):
3954         (run.dumbEqIfThenElse.dumbEqIfThenElse):
3955         (run.dumbEqIfThenElse.dumbLessThanIfThenElse):
3956         (run.dumbLessThanIfThenElse.loopSum):
3957         (run.loopSum.loopMult):
3958         (brIfLoopLessThan):
3959         (run.brIfLoopLessThan.run):
3960         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
3961         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
3962
3963         * wasm/Builder.js:
3964         (const._maybeRegisterType):
3965         (const): Deleted.
3966         (switch.typeof): Deleted.
3967         * wasm/Builder_WebAssemblyBinary.js:
3968         (const.emitters.Type):
3969         (const.emitters.Import):
3970         (const.emitters.Function):
3971         (const.emitters.Memory):
3972         (const.emitters.Code):
3973         (export.const.Binary):
3974         * wasm/LowLevelBinary.js:
3975         (export.default.LowLevelBinary.prototype.get return):
3976         (export.default.LowLevelBinary.prototype.varuint32):
3977         (export.default.LowLevelBinary.prototype.varint32):
3978         (export.default.LowLevelBinary.prototype.varuint1):
3979         (export.default.LowLevelBinary.prototype.varint7):
3980         (export.default.LowLevelBinary.prototype.varuint7):
3981         (export.default.LowLevelBinary.prototype.inline_signature_type):
3982         (export.default.LowLevelBinary.prototype.string):
3983         (export.default.LowLevelBinary.prototype.getVaruint32):
3984         (export.default.LowLevelBinary.prototype.getVarint32):
3985         (export.default.LowLevelBinary.prototype.getVaruint7):
3986         (export.default.LowLevelBinary.prototype.getString):
3987         (export.default.LowLevelBinary):
3988         (export.default.LowLevelBinary.prototype.varuint): Deleted.
3989         (export.default.LowLevelBinary.prototype.varint): Deleted.
3990         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
3991         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
3992         * wasm/js-api/function-tests/add-12.js: Added.
3993         * wasm/js-api/function-tests/br-if-loop-less-than.js: Added.
3994         * wasm/js-api/function-tests/brTableAsIf.js: Added.
3995         * wasm/js-api/function-tests/brTableManyValues.js: Added.
3996         * wasm/js-api/function-tests/brTableWithLoop.js: Added.
3997         * wasm/js-api/function-tests/dumb-eq-if-then-else.js: Added.
3998         * wasm/js-api/function-tests/dumb-less-than-fallthrough.js: Added.
3999         * wasm/js-api/function-tests/dumb-less-than-ite.js: Added.
4000         * wasm/js-api/function-tests/factorial.js: Added.
4001         * wasm/js-api/function-tests/float-sub.js: Added.
4002         * wasm/js-api/function-tests/i32-load.js: Added.
4003         * wasm/js-api/function-tests/i32-load8-s.js: Added.
4004         * wasm/js-api/function-tests/if-then-else-fallthrough.js: Added.
4005         * wasm/js-api/function-tests/if-then-fallthrough.js: Added.
4006         * wasm/js-api/function-tests/loop-mult.js: Added.
4007         * wasm/js-api/function-tests/loop-sum.js: Added.
4008         * wasm/js-api/function-tests/ret5.js: Added.
4009         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
4010         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
4011
4012 2016-11-11  Saam Barati  <sbarati@apple.com>
4013
4014         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
4015         https://bugs.webkit.org/show_bug.cgi?id=164650
4016
4017         Reviewed by Geoffrey Garen.
4018
4019         * stress/dont-dead-lock-put-by-val-as-put-by-id.js: Added.
4020         (ident):
4021         (let.o.set foo):
4022         (foo):
4023
4024 2016-11-11  Chris Dumez  <cdumez@apple.com>
4025
4026         Unreviewed, rolling out r208584.
4027
4028         Seems to have regressed Speedometer by 1% on Mac
4029
4030         Reverted changeset:
4031
4032         "We should have a more concise way of determining when we're
4033         varargs calling a function using rest parameters"
4034         https://bugs.webkit.org/show_bug.cgi?id=164258
4035         http://trac.webkit.org/changeset/208584
4036
4037 2016-11-11  Chris Dumez  <cdumez@apple.com>
4038
4039         Unreviewed, rolling out r208117 and r208160.
4040
4041         Regressed Speedometer by >1.5%
4042
4043         Reverted changesets:
4044
4045         "We should have a way of profiling when a get_by_id is pure
4046         and to emit a PureGetById in the DFG/FTL"
4047         https://bugs.webkit.org/show_bug.cgi?id=163305
4048         http://trac.webkit.org/changeset/208117
4049
4050         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
4051         out"
4052         https://bugs.webkit.org/show_bug.cgi?id=164227
4053         http://trac.webkit.org/changeset/208160
4054
4055 2016-11-11  Saam Barati  <sbarati@apple.com>
4056
4057         We should have a more concise way of determining when we're varargs calling a function using rest parameters
4058         https://bugs.webkit.org/show_bug.cgi?id=164258
4059
4060         Reviewed by Yusuke Suzuki.
4061
4062         * microbenchmarks/call-using-spread.js: Added.
4063         (bar):
4064         (foo):
4065         * microbenchmarks/spread-large-array.js: Added.
4066         (foo):
4067         (arrays.push):
4068         * microbenchmarks/spread-small-array.js: Added.
4069         (foo):
4070         * stress/spread-array-iterator-watchpoint-2.js: Added.
4071         (foo):
4072         (arrayIterator.next):
4073         * stress/spread-array-iterator-watchpoint.js: Added.
4074         (foo):
4075         (Array.prototype.Symbol.iterator):
4076         * stress/spread-non-array.js: Added.
4077         (assert):
4078         (foo):
4079         (let.customIterator.Symbol.iterator):
4080         (bar):
4081
4082 2016-11-10  Mark Lam  <mark.lam@apple.com>
4083
4084         Fix broken have-a-bad-time-with-arguments.js test.
4085         https://bugs.webkit.org/show_bug.cgi?id=164626
4086
4087         Reviewed by Filip Pizlo.
4088
4089         But also saved a copy of the broken one as broken-have-a-bad-time-with-arguments-for-gc-testing.js
4090         because coincidentally, it stresses the GC in ways that help reveal bugs.
4091
4092         * stress/broken-have-a-bad-time-with-arguments-for-gc-testing.js: Added.
4093         (testFunction):
4094         (warmupFunction):
4095         (let.argsDeclIndex.in.argumentsDecls.let.indexToReturnIndex.in.indicesToReturn.let.insertElementActionIndex.in.insertElementActions.let.tierWarmupCountIndex.in.tierWarmupCounts.let.testArgsIndex.in.testArgsList.catch):
4096         * stress/have-a-bad-time-with-arguments.js:
4097
4098 2016-11-10  JF Bastien  <jfbastien@apple.com>
4099
4100         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
4101         https://bugs.webkit.org/show_bug.cgi?id=164597
4102
4103         Reviewed by Keith Miller.
4104
4105         Trim the array buffer before returning it: it's optimistically
4106         over-allocated to avoid growing all the time, but when parsed it
4107         can't have extra content.
4108
4109         * wasm/Builder_WebAssemblyBinary.js:
4110         (export.const.Binary):
4111         * wasm/LowLevelBinary.js:
4112         (export.default.LowLevelBinary.prototype.get return):
4113
4114 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
4115
4116         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
4117         https://bugs.webkit.org/show_bug.cgi?id=164450
4118
4119         Reviewed by Darin Adler.
4120
4121         * stress/dataview-typedarray-toindex.js: Added.
4122         Tests for all cases where ToIndex should be used.
4123
4124         * test262.yaml:
4125         New passing tests.
4126
4127 2016-11-10  Mark Lam  <mark.lam@apple.com>
4128
4129         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
4130         https://bugs.webkit.org/show_bug.cgi?id=164600
4131         <rdar://problem/28828676>
4132
4133         Reviewed by Filip Pizlo.
4134
4135         * stress/osr-exit-on-op-negate-should-no-fail-assertions.js: Added.
4136
4137 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
4138
4139         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
4140         https://bugs.webkit.org/show_bug.cgi?id=164502
4141
4142         Reviewed by Saam Barati.
4143
4144         * stress/argument-intrinsic-basic.js: Added.
4145         (shouldBe):
4146         (builtin.createBuiltin):
4147         * stress/argument-intrinsic-inlining-with-result-escape.js: Added.
4148         (shouldBe):
4149         (builtin.createBuiltin):
4150         (escape):
4151         * stress/argument-intrinsic-nested-inlining.js: Added.
4152         (shouldBe):
4153         (builtin.createBuiltin):
4154         (builtinCaller1):
4155         (builtinCaller2):
4156         (escape):
4157         * stress/argument-intrinsic-not-convert-to-get-argument.js: Added.
4158         (shouldBe):
4159         (builtin.createBuiltin):
4160         * stress/argument-intrinsic-with-stack-write.js: Added.
4161         (shouldBe):
4162         (builtin.createBuiltin):
4163
4164 2016-11-09  Saam Barati  <sbarati@apple.com>
4165
4166         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
4167         https://bugs.webkit.org/show_bug.cgi?id=164464
4168         <rdar://problem/29131452>
4169
4170         Reviewed by Darin Adler.
4171
4172         * stress/math-max-min-no-arguments.js: Added.
4173         (assert):
4174         (min):
4175         (max):
4176         (test):
4177
4178 2016-11-09  Saam Barati  <sbarati@apple.com>
4179
4180         TypeProfiler and running GC collection on another thread don't play nicely with each other
4181         https://bugs.webkit.org/show_bug.cgi?id=164441
4182         <rdar://problem/29132174>
4183
4184         Reviewed by Geoffrey Garen.
4185
4186         * typeProfiler/type-profiler-gc.js: Added.
4187         (bar):
4188         (foo):
4189
4190 2016-11-04  Mark Lam  <mark.lam@apple.com>
4191
4192         Error description code should be able to handle Symbol values.
4193         https://bugs.webkit.org/show_bug.cgi?id=164436
4194         <rdar://problem/29115583>
4195
4196         Reviewed by Filip Pizlo and Saam Barati.
4197
4198         * stress/error-description-on-symbols-should-not-crash.js: Added.
4199
4200 2016-11-03  Geoffrey Garen  <ggaren@apple.com>
4201
4202         EvalCodeCache should not give up in strict mode and other cases
4203         https://bugs.webkit.org/show_bug.cgi?id=164357
4204
4205         Reviewed by Michael Saboff.
4206
4207         * microbenchmarks/eval-cached.js: Added. 45x faster now.
4208         * stress/eval-cached.js: Added. Try running the same eval text in a bunch
4209         of different scopes and verify that we access the right scope.
4210
4211 2016-11-04  JF Bastien  <jfbastien@apple.com>
4212
4213         WebAssembly JS API: implement more sections
4214         https://bugs.webkit.org/show_bug.cgi?id=164023
4215
4216         Reviewed by Keith Miller.
4217
4218         On the JSC side:
4219
4220          - Put in parser stubs for all WebAssembly sections.
4221          - Parse Import, Export sections.
4222          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
4223          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
4224          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
4225          - parseCode: avoid overflow through function size.
4226          - Remove all remainders of polyfill-prototype-1, and update license.
4227          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
4228
4229         On the Builder.js testing side:
4230
4231          - Implement Type, Import (function only), Export (function only) sections.
4232          - Check section order and uniqueness.
4233          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
4234          - Allow re-exporting an import.
4235
4236         * wasm/Builder.js: build type, import, and export sections
4237         (const._normalizeFunctionSignature):
4238         * wasm/Builder_WebAssemblyBinary.js: Added. Forked from Builder.js
4239         (const.emitters.Type):
4240         (const.emitters.Import):
4241         (const.emitters.Function):
4242         (const.emitters.Table):
4243         (const.emitters.Memory):
4244         (const.emitters.Global):
4245         (const.emitters.Export):
4246         (const.emitters.Start):
4247         (const.emitters.Element):
4248         (const.emitters.Code):
4249         (const.emitters.Data):
4250         (export.const.Binary):
4251         * wasm/LowLevelBinary.js: Add a few useful outputs
4252         (export.default.LowLevelBinary.prototype.varuint1):
4253         (export.default.LowLevelBinary.prototype.varint7):
4254         * wasm/WASM.js: value type and external kind helpers
4255         * wasm/assert.js: array element-wise equality comparison
4256         (const._eq):
4257         * wasm/js-api/test_Module.js:
4258         (ModuleWithImports):
4259         * wasm/self-test/test_BuilderJSON.js: many more tests for all the new Builder APIs, and update to some older tests which now require a Type section or rejiggered Function signature
4260         (const.assertOpThrows):
4261         (SectionsWithSameCustomName):
4262         (TwoTypeSections):
4263         (EmptyImportSection):
4264         (ImportBeforeTypeSections):
4265         * wasm/self-test/test_BuilderWebAssembly.js: remove a test which wasn't helpful and is now obsolete
4266         (CustomSection):
4267
4268 2016-11-03  Mark Lam  <mark.lam@apple.com>
4269
4270         ClonedArguments need to also support haveABadTime mode.
4271         https://bugs.webkit.org/show_bug.cgi?id=164200
4272         <rdar://problem/27211336>
4273
4274         Reviewed by Geoffrey Garen.
4275
4276         * stress/have-a-bad-time-with-arguments.js: Added.
4277
4278 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
4279
4280         DFG plays fast and loose with the shadow values of a Phi
4281         https://bugs.webkit.org/show_bug.cgi?id=164309
4282
4283         Reviewed by Saam Barati.
4284         
4285         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
4286
4287         * stress/dfg-ssa-swap.js: Added.
4288         (foo):
4289
4290 2016-11-03  Commit Queue  <commit-queue@webkit.org>
4291
4292         Unreviewed, rolling out r208364.
4293         https://bugs.webkit.org/show_bug.cgi?id=164402
4294
4295         broke the build (Requested by smfr on #webkit).
4296
4297         Reverted changeset:
4298
4299         "DFG plays fast and loose with the shadow values of a Phi"
4300         https://bugs.webkit.org/show_bug.cgi?id=164309
4301         http://trac.webkit.org/changeset/208364
4302
4303 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
4304
4305         DFG plays fast and loose with the shadow values of a Phi
4306         https://bugs.webkit.org/show_bug.cgi?id=164309
4307
4308         Reviewed by Saam Barati.
4309         
4310         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
4311
4312         * stress/dfg-ssa-swap.js: Added.
4313         (foo):
4314
4315 2016-11-03  Saam Barati  <sbarati@apple.com>
4316
4317         Asking for a value profile prediction should be defensive against not finding a value profile
4318         https://bugs.webkit.org/show_bug.cgi?id=164306
4319
4320         Reviewed by Mark Lam.
4321
4322         * stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js: Added.
4323         (let.o.set foo):
4324         (bar):
4325
4326 2016-11-02  Saam Barati  <sbarati@apple.com>
4327
4328         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
4329         https://bugs.webkit.org/show_bug.cgi?id=164301
4330
4331         Reviewed by Geoffrey Garen.
4332
4333         * stress/rest-parameter-allocation-elimination-watchpoints-2.js: Added.
4334         (assert):
4335         (foo):
4336         * stress/rest-parameter-allocation-elimination-watchpoints-3.js: Added.
4337         (assert):
4338         (foo):
4339         * stress/rest-parameter-allocation-elimination-watchpoints-4.js: Added.
4340         (assert):
4341         (foo):
4342         * stress/rest-parameter-allocation-elimination-watchpoints-5.js: Added.
4343         (assert):
4344         (foo):
4345         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Added.
4346         (assert):
4347         (foo):
4348         * stress/rest-parameter-allocation-elimination-watchpoints.js: Added.
4349         (assert):
4350         (foo):
4351
4352 2016-11-01  Saam Barati  <sbarati@apple.com>
4353
4354         We should be able to eliminate rest parameter allocations
4355         https://bugs.webkit.org/show_bug.cgi?id=163925
4356
4357         Reviewed by Filip Pizlo.
4358
4359         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
4360         (assert):
4361         (test1.bar):
4362         (test1):
4363         (test2.jaz):
4364         (test2.jaz2.kaz):
4365         (test2.jaz2):
4366         (test2):
4367         (test3.foo):
4368         (test3.baz):
4369         (test3.jaz):
4370         (test3):
4371         (test4.baz):
4372         (test4.jaz):
4373         (test4):
4374         (test5.baz):
4375         (test5.jaz):
4376         (test5):
4377         (test6.baz):
4378         (test6.jaz):
4379         (test6):
4380         (test7.baz):
4381         (test7.jaz):
4382         (test7.check):
4383         (test7):
4384         (test8.baz):
4385         (test8.jaz):
4386         (test8.check):
4387         (test8):
4388         (test9.baz):
4389         (test9.jaz):
4390         (test9.check):
4391         (test9):
4392         (test10.baz):
4393         (test10.jaz):
4394         (test10):
4395         (test11.bar):
4396         (test11.foo):
4397         (test11.makeArguments):
4398         (test11.):
4399         (test12):
4400         (test12.bar):
4401         (test12.foo):
4402         (test12.makeArguments):
4403         (test12.):
4404         (test13.bar):
4405         (test13.top):
4406         (test13.foo):
4407         (test13.makeArguments):
4408         (test13.):
4409         (test13):
4410         (test14.bar):
4411         (test14.top):
4412         (test14.foo):