JSTests/ChangeLog

   1 2018-02-01  Keith Miller  <keith_miller@apple.com>
   2
   3         Fix crashes due to mishandling custom sections.
   4         https://bugs.webkit.org/show_bug.cgi?id=182404
   5         <rdar://problem/36935863>
   6
   7         Reviewed by Saam Barati.
   8
   9         * wasm/Builder.js:
  10         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
  11         * wasm/js-api/validate.js:
  12         (assert.truthy):
  13
  14 2018-01-31  Saam Barati  <sbarati@apple.com>
  15
  16         JSC incorrectly interpreting script, sets Global Property instead of Global Lexical variable (LiteralParser / JSONP path)
  17         https://bugs.webkit.org/show_bug.cgi?id=182074
  18         <rdar://problem/36846261>
  19
  20         Reviewed by Mark Lam.
  21
  22         * stress/jsonp-program-evaluate-path-must-consider-global-lexical-environment.js: Added.
  23         (assert):
  24         (let.func):
  25         (let.o.foo):
  26         (varFunc):
  27
  28 2018-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
  29
  30         Unreviewed, update test262 expects
  31         https://bugs.webkit.org/show_bug.cgi?id=182232
  32
  33         * test262.yaml:
  34
  35 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
  36
  37         [JSC] Implement trimStart and trimEnd
  38         https://bugs.webkit.org/show_bug.cgi?id=182233
  39
  40         Reviewed by Mark Lam.
  41
  42         * stress/trim.js: Added.
  43         (shouldBe):
  44         (startTest):
  45         (endTest):
  46         (trimTest):
  47
  48 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
  49
  50         [JSC] Relax line terminators in String to make JSON subset of JS
  51         https://bugs.webkit.org/show_bug.cgi?id=182232
  52
  53         Reviewed by Keith Miller.
  54
  55         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
  56         * stress/relaxed-line-terminators-in-string.js: Added.
  57         (shouldBe):
  58
  59 2018-01-29  Michael Saboff  <msaboff@apple.com>
  60
  61         REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
  62         https://bugs.webkit.org/show_bug.cgi?id=182249
  63
  64         Reviewed by Keith Miller.
  65
  66         New regression test.
  67
  68         * stress/compare-clobber-untypeduse.js: Added.
  69
  70 2018-01-29  Matt Lewis  <jlewis3@apple.com>
  71
  72         Unreviewed, rolling out r227725.
  73
  74         This caused internal failures.
  75
  76         Reverted changeset:
  77
  78         "JSC Sampling Profiler: Detect tester and testee when sampling
  79         in RegExp JIT"
  80         https://bugs.webkit.org/show_bug.cgi?id=152729
  81         https://trac.webkit.org/changeset/227725
  82
  83 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
  84
  85         JSC Sampling Profiler: Detect tester and testee when sampling in RegExp JIT
  86         https://bugs.webkit.org/show_bug.cgi?id=152729
  87
  88         Reviewed by Saam Barati.
  89
  90         * stress/sampling-profiler-regexp.js: Added.
  91         (platformSupportsSamplingProfiler.test):
  92         (platformSupportsSamplingProfiler.baz):
  93         (platformSupportsSamplingProfiler):
  94
  95 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
  96
  97         [DFG][FTL] WeakMap#set should have DFG node
  98         https://bugs.webkit.org/show_bug.cgi?id=180015
  99
 100         Reviewed by Saam Barati.
 101
 102         * stress/weakmap-set-change-get.js: Added.
 103         (shouldBe):
 104         (test):
 105         * stress/weakmap-set-cse.js: Added.
 106         (shouldBe):
 107         (test):
 108         * stress/weakset-add-change-get.js: Added.
 109         (shouldBe):
 110         * stress/weakset-add-cse.js: Added.
 111         (shouldBe):
 112
 113 2018-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>
 114
 115         DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
 116         https://bugs.webkit.org/show_bug.cgi?id=182213
 117
 118         Reviewed by Mark Lam.
 119
 120         * stress/int32-min-to-string.js: Added.
 121         (shouldBe):
 122         (test2):
 123         (test4):
 124         (test8):
 125         (test16):
 126         (test32):
 127         * stress/zero-to-string.js: Added.
 128         (shouldBe):
 129         (test2):
 130         (test4):
 131         (test8):
 132         (test16):
 133         (test32):
 134
 135 2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 136
 137         Add more module scope related tests with code evaluation by string
 138         https://bugs.webkit.org/show_bug.cgi?id=181983
 139
 140         Reviewed by Sam Weinig.
 141
 142         Add more module scope related tests. When the original tests are landed,
 143         we do not have browser integration. This patch adds more module scope tests
 144         with dynamically created script evaluation. We add tests with Function
 145         constructor, direct eval, indirect eval, setTimeout, setInterval, and event handlers.
 146
 147         * modules/scopes-eval.js: Added.
 148         (shouldBe):
 149         * modules/scopes.js:
 150         (shouldBe):
 151
 152 2018-01-23  Filip Pizlo  <fpizlo@apple.com>
 153
 154         Unreviewed, retire some microbenchmarks that are proportionately very slow. Benchmark running time should be proportional to their value. Microbenchmarks have little value, so they should be very fast.
 155
 156         * microbenchmarks/array-push-3.js: Removed.
 157         * microbenchmarks/bigswitch-indirect-symbol-or-undefined.js: Removed.
 158         * microbenchmarks/double-to-int32.js: Removed.
 159         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Removed.
 160         * microbenchmarks/ftl-polymorphic-bitand.js: Removed.
 161         * microbenchmarks/ftl-polymorphic-bitor.js: Removed.
 162         * microbenchmarks/ftl-polymorphic-bitxor.js: Removed.
 163         * microbenchmarks/ftl-polymorphic-lshift.js: Removed.
 164         * microbenchmarks/ftl-polymorphic-rshift.js: Removed.
 165         * microbenchmarks/ftl-polymorphic-sub.js: Removed.
 166         * microbenchmarks/ftl-polymorphic-urshift.js: Removed.
 167         * microbenchmarks/map-constant-key.js: Removed.
 168         * microbenchmarks/nested-function-parsing.js: Removed.
 169         * microbenchmarks/rest-parameter-allocation-elimination.js: Removed.
 170         * microbenchmarks/spread-large-array.js: Removed.
 171         * microbenchmarks/string-add-constant-folding.js: Removed.
 172         * microbenchmarks/to-lower-case.js: Removed.
 173         * microbenchmarks/undefined-property-access.js: Removed.
 174         * slowMicrobenchmarks/array-push-3.js: Copied from JSTests/microbenchmarks/array-push-3.js.
 175         * slowMicrobenchmarks/bigswitch-indirect-symbol-or-undefined.js: Copied from JSTests/microbenchmarks/bigswitch-indirect-symbol-or-undefined.js.
 176         * slowMicrobenchmarks/double-to-int32.js: Copied from JSTests/microbenchmarks/double-to-int32.js.
 177         * slowMicrobenchmarks/fake-iterators-that-throw-when-finished.js: Copied from JSTests/microbenchmarks/fake-iterators-that-throw-when-finished.js.
 178         * slowMicrobenchmarks/ftl-polymorphic-bitand.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitand.js.
 179         * slowMicrobenchmarks/ftl-polymorphic-bitor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitor.js.
 180         * slowMicrobenchmarks/ftl-polymorphic-bitxor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitxor.js.
 181         * slowMicrobenchmarks/ftl-polymorphic-lshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-lshift.js.
 182         * slowMicrobenchmarks/ftl-polymorphic-rshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-rshift.js.
 183         * slowMicrobenchmarks/ftl-polymorphic-sub.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-sub.js.
 184         * slowMicrobenchmarks/ftl-polymorphic-urshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-urshift.js.
 185         * slowMicrobenchmarks/map-constant-key.js: Copied from JSTests/microbenchmarks/map-constant-key.js.
 186         * slowMicrobenchmarks/nested-function-parsing.js: Copied from JSTests/microbenchmarks/nested-function-parsing.js.
 187         * slowMicrobenchmarks/rest-parameter-allocation-elimination.js: Copied from JSTests/microbenchmarks/rest-parameter-allocation-elimination.js.
 188         * slowMicrobenchmarks/spread-large-array.js: Copied from JSTests/microbenchmarks/spread-large-array.js.
 189         * slowMicrobenchmarks/string-add-constant-folding.js: Copied from JSTests/microbenchmarks/string-add-constant-folding.js.
 190         * slowMicrobenchmarks/to-lower-case.js: Copied from JSTests/microbenchmarks/to-lower-case.js.
 191         * slowMicrobenchmarks/undefined-property-access.js: Copied from JSTests/microbenchmarks/undefined-property-access.js.
 192
 193 2018-01-23  Robin Morisset  <rmorisset@apple.com>
 194
 195         Update the argument count in DFGByteCodeParser::handleRecursiveCall
 196         https://bugs.webkit.org/show_bug.cgi?id=181739
 197         <rdar://problem/36627662>
 198
 199         Reviewed by Saam Barati.
 200
 201         * stress/recursive-tail-call-with-different-argument-count.js: Added.
 202         (foo):
 203         (bar):
 204
 205 2018-01-22  Michael Saboff  <msaboff@apple.com>
 206
 207         DFG abstract interpreter needs to properly model effects of some Math ops
 208         https://bugs.webkit.org/show_bug.cgi?id=181886
 209
 210         Reviewed by Saam Barati.
 211
 212         New regression test.
 213
 214         * stress/arith-nodes-abstract-interpreter-untypeduse.js: Added.
 215         (test):
 216
 217 2018-01-20  Caio Lima  <ticaiolima@gmail.com>
 218
 219         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
 220         https://bugs.webkit.org/show_bug.cgi?id=181182
 221
 222         Reviewed by Darin Adler.
 223
 224         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
 225         * stress/big-int-prototype-to-string-exception.js: Added.
 226         * stress/big-int-prototype-to-string-wrong-values.js: Added.
 227         * stress/number-prototype-to-string-cast-overflow.js: Added.
 228         * stress/number-prototype-to-string-exception.js: Added.
 229         * stress/number-prototype-to-string-wrong-values.js: Added.
 230
 231 2018-01-19  Ryan Haddad  <ryanhaddad@apple.com>
 232
 233         Disable Atomics when SharedArrayBuffer isn’t enabled
 234         https://bugs.webkit.org/show_bug.cgi?id=181572
 235
 236         Unreviewed test gardening.
 237
 238         * test262.yaml: Skip tests that fail after this change.
 239
 240 2018-01-19  Saam Barati  <sbarati@apple.com>
 241
 242         Kill ArithNegate's ArithProfile assert inside BytecodeParser
 243         https://bugs.webkit.org/show_bug.cgi?id=181877
 244         <rdar://problem/36630552>
 245
 246         Reviewed by Mark Lam.
 247
 248         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js: Added.
 249         (runNearStackLimit):
 250         (f1):
 251         (f2):
 252         (f3):
 253         (i.catch):
 254         (i.try.runNearStackLimit):
 255         (catch):
 256
 257 2018-01-19  Saam Barati  <sbarati@apple.com>
 258
 259         Spread's effects are modeled incorrectly both in AI and in Clobberize
 260         https://bugs.webkit.org/show_bug.cgi?id=181867
 261         <rdar://problem/36290415>
 262
 263         Reviewed by Michael Saboff.
 264
 265         * stress/ai-needs-to-model-spreads-effects.js: Added.
 266         (try.p.Symbol.iterator):
 267         (try.go):
 268         (catch):
 269         * stress/clobberize-needs-to-model-spread-effects.js: Added.
 270         (assert):
 271         (foo):
 272         (a.Symbol.iterator):
 273
 274 2018-01-19  Yusuke Suzuki  <utatane.tea@gmail.com>
 275
 276         Unreviewed, reduce count of iteration to fix timing out debug JSC test
 277         https://bugs.webkit.org/show_bug.cgi?id=181535
 278
 279         * stress/inserted-recovery-with-set-last-index.js:
 280
 281 2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>
 282
 283         [DFG][FTL] Introduce PhantomNewRegexp and RegExpExecNonGlobalOrSticky
 284         https://bugs.webkit.org/show_bug.cgi?id=181535
 285
 286         Reviewed by Saam Barati.
 287
 288         * stress/inserted-recovery-with-set-last-index.js: Added.
 289         (shouldBe):
 290         (foo):
 291         * stress/materialize-regexp-at-osr-exit.js: Added.
 292         (shouldBe):
 293         (test):
 294         * stress/materialize-regexp-cyclic-regexp-at-osr-exit.js: Added.
 295         (shouldBe):
 296         (test):
 297         * stress/materialize-regexp-cyclic-regexp.js: Added.
 298         (shouldBe):
 299         (test):
 300         (i.switch):
 301         * stress/materialize-regexp-cyclic.js: Added.
 302         (shouldBe):
 303         (test):
 304         (i.switch):
 305         * stress/materialize-regexp-referenced-from-phantom-regexp-cyclic.js: Added.
 306         (bar):
 307         (foo):
 308         (test):
 309         * stress/materialize-regexp-referenced-from-phantom-regexp.js: Added.
 310         (bar):
 311         (foo):
 312         (test):
 313         * stress/materialize-regexp.js: Added.
 314         (shouldBe):
 315         (test):
 316         * stress/phantom-regexp-regexp-exec.js: Added.
 317         (shouldBe):
 318         (test):
 319         * stress/phantom-regexp-string-match.js: Added.
 320         (shouldBe):
 321         (test):
 322         * stress/regexp-last-index-sinking.js: Added.
 323         (shouldBe):
 324         (test):
 325
 326 2018-01-17  Saam Barati  <sbarati@apple.com>
 327
 328         Disable Atomics when SharedArrayBuffer isn’t enabled
 329         https://bugs.webkit.org/show_bug.cgi?id=181572
 330         <rdar://problem/36553206>
 331
 332         Reviewed by Michael Saboff.
 333
 334         * stress/isLockFree.js:
 335
 336 2018-01-17  Saam Barati  <sbarati@apple.com>
 337
 338         DFG::Node::convertToConstant needs to clear the varargs flags
 339         https://bugs.webkit.org/show_bug.cgi?id=181697
 340         <rdar://problem/36497332>
 341
 342         Reviewed by Yusuke Suzuki.
 343
 344         * stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
 345         (doIndexOf):
 346         (bar):
 347         (i.bar):
 348
 349 2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>
 350
 351         Unreviewed, rolling out r226937.
 352
 353         Tests added with this change are failing due to a missing
 354         exception check.
 355
 356         Reverted changeset:
 357
 358         "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
 359         double to int32_t"
 360         https://bugs.webkit.org/show_bug.cgi?id=181182
 361         https://trac.webkit.org/changeset/226937
 362
 363 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
 364
 365         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
 366         https://bugs.webkit.org/show_bug.cgi?id=181182
 367
 368         Reviewed by Darin Adler.
 369
 370         * bigIntTests.yaml:
 371         * stress/big-int-constructor.js:
 372         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
 373         (assert):
 374         (assertThrowRangeError):
 375         * stress/number-prototype-to-string-cast-overflow.js: Added.
 376         (assert):
 377         (assertThrowRangeError):
 378
 379 2018-01-12  Saam Barati  <sbarati@apple.com>
 380
 381         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
 382         https://bugs.webkit.org/show_bug.cgi?id=181177
 383         <rdar://problem/36205704>
 384
 385         Reviewed by Yusuke Suzuki.
 386
 387         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
 388         (runNearStackLimit.t):
 389         (runNearStackLimit):
 390         (test.f):
 391         (test):
 392
 393 2018-01-12  Saam Barati  <sbarati@apple.com>
 394
 395         Each variant of a polymorphic inlined call should be exitOK at the top of the block
 396         https://bugs.webkit.org/show_bug.cgi?id=181562
 397         <rdar://problem/36445624>
 398
 399         Reviewed by Yusuke Suzuki.
 400
 401         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
 402         (f):
 403         (foo):
 404
 405 2018-01-11  Saam Barati  <sbarati@apple.com>
 406
 407         When inserting Unreachable in byte code parser we need to flush all the right things
 408         https://bugs.webkit.org/show_bug.cgi?id=181509
 409         <rdar://problem/36423110>
 410
 411         Reviewed by Mark Lam.
 412
 413         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
 414
 415 2018-01-11  Saam Barati  <sbarati@apple.com>
 416
 417         JITMathIC code in the FTL is wrong when code gets duplicated
 418         https://bugs.webkit.org/show_bug.cgi?id=181525
 419         <rdar://problem/36351993>
 420
 421         Reviewed by Michael Saboff and Keith Miller.
 422
 423         * stress/allow-math-ic-b3-code-duplication.js: Added.
 424
 425 2018-01-11  Saam Barati  <sbarati@apple.com>
 426
 427         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
 428         https://bugs.webkit.org/show_bug.cgi?id=181508
 429
 430         Reviewed by Yusuke Suzuki.
 431
 432         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
 433         (assert):
 434         (test1.foo):
 435         (test1):
 436         (test2.foo):
 437         (test2):
 438
 439 2018-01-09  Mark Lam  <mark.lam@apple.com>
 440
 441         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
 442         https://bugs.webkit.org/show_bug.cgi?id=181388
 443         <rdar://problem/36349351>
 444
 445         Reviewed by Saam Barati.
 446
 447         * stress/regress-181388.js: Added.
 448
 449 2018-01-08  JF Bastien  <jfbastien@apple.com>
 450
 451         WebAssembly: mask indexed accesses to Table
 452         https://bugs.webkit.org/show_bug.cgi?id=181412
 453         <rdar://problem/36363236>
 454
 455         Reviewed by Saam Barati.
 456
 457         Update error messages.
 458
 459         * wasm/js-api/table.js:
 460         (assert.throws.WebAssembly.Table.prototype.grow):
 461
 462 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
 463
 464         Disable SharedArrayBuffer tests missed in r226386.
 465         https://bugs.webkit.org/show_bug.cgi?id=181266
 466
 467         Unreviewed test gardening.
 468
 469         * test262.yaml:
 470
 471 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
 472
 473         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
 474         https://bugs.webkit.org/show_bug.cgi?id=181321
 475
 476         Reviewed by Saam Barati.
 477
 478         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
 479         (shouldBe):
 480         (testFunction):
 481         * test262.yaml:
 482
 483 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
 484
 485         Unreviewed, attempt to fix test262 after r226386.
 486
 487         * test262.yaml:
 488
 489 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 490
 491         [DFG] Define defs for MapSet/SetAdd to participate in CSE
 492         https://bugs.webkit.org/show_bug.cgi?id=179911
 493
 494         Reviewed by Saam Barati.
 495
 496         In addition to these tests, map-set-cse.js and set-add-cse.js work.
 497
 498         * stress/map-set-change-get.js: Added.
 499         (shouldBe):
 500         (test):
 501         * stress/map-set-create-bucket.js: Added.
 502         (shouldBe):
 503         (test):
 504         * stress/set-add-create-bucket.js: Added.
 505         (shouldBe):
 506
 507 2018-01-03  Michael Saboff  <msaboff@apple.com>
 508
 509         Disable SharedArrayBuffers from Web API
 510         https://bugs.webkit.org/show_bug.cgi?id=181266
 511
 512         Reviewed by Saam Barati.
 513
 514         Disabled SharedArrayBuffer tests.
 515
 516         * stress/SharedArrayBuffer-opt.js:
 517         * stress/SharedArrayBuffer.js:
 518         * stress/array-buffer-byte-length.js:
 519         * stress/atomics-add-uint32.js:
 520         * stress/atomics-known-int-use.js:
 521         * stress/atomics-neg-zero.js:
 522         * stress/atomics-store-return.js:
 523         * stress/lars-sab-workers.js:
 524         * stress/regress-159779-1.js:
 525         * stress/regress-159779-2.js:
 526         * stress/regress-170473.js:
 527         * test262.yaml:
 528
 529 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
 530
 531         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
 532         https://bugs.webkit.org/show_bug.cgi?id=181258
 533
 534         Reviewed by Antonio Gomes.
 535
 536         * stress/big-int-constructor-gc.js:
 537         * stress/big-int-constructor-oom.js:
 538
 539 2018-01-03  Robin Morisset  <rmorisset@apple.com>
 540
 541         Inlining of a function that ends in op_unreachable crashes
 542         https://bugs.webkit.org/show_bug.cgi?id=181027
 543
 544         Reviewed by Filip Pizlo.
 545
 546         * stress/inlining-unreachable.js: Added.
 547         (bar):
 548         (baz):
 549         (i.catch):
 550
 551 2018-01-02  Saam Barati  <sbarati@apple.com>
 552
 553         Incorrect assertion inside AccessCase
 554         https://bugs.webkit.org/show_bug.cgi?id=181200
 555         <rdar://problem/35494754>
 556
 557         Reviewed by Yusuke Suzuki.
 558
 559         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
 560         (ctor):
 561         (theFunc):
 562         (run):
 563
 564 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
 565
 566         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
 567         https://bugs.webkit.org/show_bug.cgi?id=175359
 568
 569         Reviewed by Yusuke Suzuki.
 570
 571         * bigIntTests.yaml:
 572         * stress/big-int-as-key.js: Added.
 573         * stress/big-int-constructor-gc.js: Added.
 574         * stress/big-int-constructor-oom.js: Added.
 575         * stress/big-int-constructor-properties.js: Added.
 576         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
 577         * stress/big-int-constructor-prototype.js: Added.
 578         * stress/big-int-constructor.js: Added.
 579         * stress/big-int-function-apply.js:
 580         * stress/big-int-length.js: Added.
 581         * stress/big-int-prop-descriptor.js: Added.
 582         * stress/big-int-proto-constructor.js: Added.
 583         * stress/big-int-proto-name.js: Added.
 584         * stress/big-int-prototype-properties.js: Added.
 585         * stress/big-int-prototype-proto.js: Added.
 586         * stress/big-int-prototype-value-of.js: Added.
 587         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
 588         * stress/big-int-prototype-to-string-apply.js: Added.
 589         * stress/big-int-to-object.js: Added.
 590         * stress/big-int-to-string.js: Added.
 591
 592 2017-12-28  Saam Barati  <sbarati@apple.com>
 593
 594         Assertion used to determine if something is an async generator is wrong
 595         https://bugs.webkit.org/show_bug.cgi?id=181168
 596         <rdar://problem/35640560>
 597
 598         Reviewed by Yusuke Suzuki.
 599
 600         * stress/async-generator-assertion.js: Added.
 601
 602 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
 603
 604         Skip stress/splay-flash-access tests on memory limited platforms
 605         https://bugs.webkit.org/show_bug.cgi?id=181086
 606
 607         Reviewed by Carlos Alberto Lopez Perez.
 608
 609         These tests use about 185M of memory, and occasionally get OOM-killed
 610         on memory limited platforms.
 611
 612         * stress/splay-flash-access-1ms.js:
 613         * stress/splay-flash-access.js:
 614
 615 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
 616
 617         Skip slow jsc tests on embedded platforms
 618         https://bugs.webkit.org/show_bug.cgi?id=180937
 619
 620         Reviewed by Carlos Alberto Lopez Perez.
 621
 622         The tests typeProfiler/deltablue-for-of.js and
 623         typeProfiler/getter-richards.js take a very long time in the
 624         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
 625         thus always timeout. They should be skipped on these platforms.
 626
 627         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
 628         * typeProfiler/getter-richards.js: Skip on arm*/mips.
 629
 630 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
 631
 632         [JSC] Do not check isValid() in op_new_regexp
 633         https://bugs.webkit.org/show_bug.cgi?id=180970
 634
 635         Reviewed by Saam Barati.
 636
 637         * stress/regexp-syntax-error-invalid-flags.js: Added.
 638         (shouldThrow):
 639
 640 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
 641
 642         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
 643         https://bugs.webkit.org/show_bug.cgi?id=180712
 644
 645         Reviewed by Michael Catanzaro.
 646
 647         stress/call-apply-exponential-bytecode-size.js crashes if the
 648         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
 649         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
 650         should skip the test on other platforms.
 651
 652         * stress/call-apply-exponential-bytecode-size.js:
 653
 654 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
 655
 656         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
 657         https://bugs.webkit.org/show_bug.cgi?id=179762
 658
 659         Reviewed by Saam Barati.
 660
 661         * stress/call-varargs-double-new-array-buffer.js: Added.
 662         (assert):
 663         (bar):
 664         (foo):
 665         * stress/call-varargs-spread-new-array-buffer.js: Added.
 666         (assert):
 667         (bar):
 668         (foo):
 669         * stress/call-varargs-spread-new-array-buffer2.js: Added.
 670         (assert):
 671         (bar):
 672         (foo):
 673         * stress/forward-varargs-double-new-array-buffer.js: Added.
 674         (assert):
 675         (test.baz):
 676         (test.bar):
 677         (test.foo):
 678         (test):
 679         * stress/new-array-buffer-sinking-osrexit.js: Added.
 680         (target):
 681         (test):
 682         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
 683         (shouldBe):
 684         (test):
 685         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
 686         (shouldBe):
 687         (target):
 688         (test):
 689         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
 690         (assert):
 691         (test1.bar):
 692         (test1.foo):
 693         (test1):
 694         (test2.bar):
 695         (test2.foo):
 696         (test3.baz):
 697         (test3.bar):
 698         (test3.foo):
 699         (test4.baz):
 700         (test4.bar):
 701         (test4.foo):
 702         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
 703         (assert):
 704         (test.baz):
 705         (test.bar):
 706         (test.foo):
 707         (test):
 708         * stress/phantom-new-array-buffer-osr-exit.js: Added.
 709         (assert):
 710         (baz):
 711         (bar):
 712         (effects):
 713         (foo):
 714
 715 2017-12-14  Saam Barati  <sbarati@apple.com>
 716
 717         The CleanUp after LICM is erroneously removing a Check
 718         https://bugs.webkit.org/show_bug.cgi?id=180852
 719         <rdar://problem/36063494>
 720
 721         Reviewed by Filip Pizlo.
 722
 723         * stress/dont-run-cleanup-after-licm.js: Added.
 724
 725 2017-12-14  Michael Saboff  <msaboff@apple.com>
 726
 727         REGRESSION (r225695): Repro crash on yahoo login page
 728         https://bugs.webkit.org/show_bug.cgi?id=180761
 729
 730         Reviewed by JF Bastien.
 731
 732         New regression test.
 733
 734         * stress/regress-180761.js: Added.
 735
 736 2017-12-13  Keith Miller  <keith_miller@apple.com>
 737
 738         JSObjects should have a mask for loading indexed properties
 739         https://bugs.webkit.org/show_bug.cgi?id=180768
 740
 741         Reviewed by Mark Lam.
 742
 743         * stress/int16-put-by-val-in-and-out-of-bounds.js:
 744         (test):
 745
 746 2017-12-13  Saam Barati  <sbarati@apple.com>
 747
 748         Arrow functions need their own structure because they have different properties than sloppy functions
 749         https://bugs.webkit.org/show_bug.cgi?id=180779
 750         <rdar://problem/35814591>
 751
 752         Reviewed by Mark Lam.
 753
 754         * stress/arrow-function-needs-its-own-structure.js: Added.
 755         (assert):
 756         (readPrototype):
 757         (noInline.let.f1):
 758         (noInline):
 759
 760 2017-12-13  Saam Barati  <sbarati@apple.com>
 761
 762         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
 763         https://bugs.webkit.org/show_bug.cgi?id=163579
 764         <rdar://problem/35455798>
 765
 766         Reviewed by Mark Lam.
 767
 768         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
 769         (assert):
 770         (test1):
 771         (i.test1):
 772         (i.test1.C):
 773         (i.test1.async.foo):
 774         (i.test1.foo):
 775         (test2):
 776
 777 2017-12-13  Saam Barati  <sbarati@apple.com>
 778
 779         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
 780         https://bugs.webkit.org/show_bug.cgi?id=180734
 781         <rdar://problem/35640547>
 782
 783         Reviewed by Yusuke Suzuki.
 784
 785         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
 786         (__isPropertyOfType):
 787         (__getProperties):
 788         (__getObjects):
 789         (__getRandomObject):
 790         (theClass.):
 791         (theClass):
 792         (childClass):
 793         (counter.catch):
 794
 795 2017-12-12  Saam Barati  <sbarati@apple.com>
 796
 797         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
 798         https://bugs.webkit.org/show_bug.cgi?id=180725
 799         <rdar://problem/35970511>
 800
 801         Reviewed by Michael Saboff.
 802
 803         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
 804         (f1):
 805         (f2):
 806         (let.o2.valueOf):
 807
 808 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
 809
 810         [JSC] Implement optimized WeakMap and WeakSet
 811         https://bugs.webkit.org/show_bug.cgi?id=179929
 812
 813         Reviewed by Saam Barati.
 814
 815         * microbenchmarks/weak-map-key.js:
 816         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
 817         (assert):
 818         (objectKey):
 819         (let.start.Date.now):
 820         * stress/basic-weakmap.js: Added.
 821         (shouldBe):
 822         (test):
 823         * stress/basic-weakset.js: Added.
 824         (shouldBe):
 825         (test.set new):
 826         * stress/weakmap-cse-set-break.js: Added.
 827         (shouldBe):
 828         (test):
 829         * stress/weakmap-cse.js: Added.
 830         (shouldBe):
 831         (test):
 832         * stress/weakmap-gc.js: Added.
 833         (test):
 834         * stress/weakset-cse-add-break.js: Added.
 835         (shouldBe):
 836         (test.set new):
 837         * stress/weakset-cse.js: Added.
 838         (shouldBe):
 839         (test.set new):
 840         * stress/weakset-gc.js: Added.
 841         (test.set add):
 842         (test.set new):
 843         (test):
 844
 845 2017-12-12  Saam Barati  <sbarati@apple.com>
 846
 847         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
 848         https://bugs.webkit.org/show_bug.cgi?id=180723
 849         <rdar://problem/35859726>
 850
 851         Reviewed by JF Bastien.
 852
 853         * stress/get-my-argument-by-val-constant-folding.js: Added.
 854         (test):
 855         (catch):
 856
 857 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
 858
 859         [ESNext][BigInt] Implement BigInt literals and JSBigInt
 860         https://bugs.webkit.org/show_bug.cgi?id=179000
 861
 862         Reviewed by Darin Adler and Yusuke Suzuki.
 863
 864         * bigIntTests.yaml: Added.
 865         * stress/big-int-literal-line-terminator.js: Added.
 866         * stress/big-int-literals.js: Added.
 867         * stress/big-int-operations-error.js: Added.
 868         * stress/big-int-type-of.js: Added.
 869         * stress/big-int-white-space-trailing-leading.js: Added.
 870         * stress/big-int-function-apply.js: Added.
 871
 872 2017-12-11  Saam Barati  <sbarati@apple.com>
 873
 874         We need to disableCaching() in ErrorInstance when we materialize properties
 875         https://bugs.webkit.org/show_bug.cgi?id=180343
 876         <rdar://problem/35833002>
 877
 878         Reviewed by Mark Lam.
 879
 880         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
 881         (assert):
 882         (makeError):
 883         (storeToStack):
 884         (storeToStackAlreadyMaterialized):
 885
 886 2017-12-05  JF Bastien  <jfbastien@apple.com>
 887
 888         WebAssembly: don't eagerly checksum
 889         https://bugs.webkit.org/show_bug.cgi?id=180441
 890         <rdar://problem/35156628>
 891
 892         Reviewed by Saam Barati.
 893
 894         Checksum is now disabled, so tests only have <?> as the module
 895         name.
 896
 897         * wasm/function-tests/nameSection.js:
 898         * wasm/function-tests/stack-overflow.js:
 899         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
 900         (assertOverflows.assertThrows):
 901         (assertOverflows):
 902         * wasm/function-tests/stack-trace.js:
 903
 904 2017-12-04  JF Bastien  <jfbastien@apple.com>
 905
 906         Proxy all functions, except the $ objects
 907         https://bugs.webkit.org/show_bug.cgi?id=180375
 908
 909         Reviewed by Saam Barati.
 910
 911         It looks like this test may have broken some executions because I
 912         call some internal objects. Explicitly ignore objects whose name
 913         starts with "$" because it's a bad idea anyways.
 914
 915         * stress/proxy-all-the-parameters.js:
 916         (generateObjects):
 917         (get throw):
 918
 919 2017-12-04  Saam Barati  <sbarati@apple.com>
 920
 921         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
 922         https://bugs.webkit.org/show_bug.cgi?id=180366
 923         <rdar://problem/35685877>
 924
 925         Reviewed by Michael Saboff.
 926
 927         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
 928         (theParent):
 929         (test1.base.getParentStaticValue):
 930         (test1.base):
 931         (test1.__v_24888.prototype.set prop):
 932         (test1.__v_24888):
 933         (test2.base.getParentStaticValue):
 934         (test2.base):
 935         (test2.__v_24888.prototype.set prop):
 936         (test2.__v_24888):
 937         (test2):
 938
 939 2017-12-01  JF Bastien  <jfbastien@apple.com>
 940
 941         Try proxying all function arguments
 942         https://bugs.webkit.org/show_bug.cgi?id=180306
 943
 944         Reviewed by Saam Barati.
 945
 946         * stress/proxy-all-the-parameters.js: Added.
 947         (isPropertyOfType):
 948         (getProperties):
 949         (generateObjects):
 950         (getObjects):
 951         (getFunctions):
 952         (get throw):
 953         (let.o.of.getObjects.let.f.of.getFunctions.catch):
 954
 955 2017-12-01  JF Bastien  <jfbastien@apple.com>
 956
 957         JavaScriptCore: missing exception checks in Math functions that take more than one argument
 958         https://bugs.webkit.org/show_bug.cgi?id=180297
 959         <rdar://problem/35745556>
 960
 961         Reviewed by Mark Lam.
 962
 963         * stress/math-exceptions.js: Added.
 964         (get try):
 965         (catch):
 966
 967 2017-12-01  JF Bastien  <jfbastien@apple.com>
 968
 969         JavaScriptCore: add test for weird class static getters
 970         https://bugs.webkit.org/show_bug.cgi?id=180281
 971         <rdar://problem/35592139>
 972
 973         Reviewed by Mark Lam.
 974
 975         I fixed a bug for it in r224927 and didn't add a test. Do so.
 976
 977         * stress/class-static-get-weird.js: Added.
 978         (c.prototype.get name):
 979         (c):
 980         (c.prototype.get arguments):
 981         (c.prototype.get caller):
 982         (c.prototype.get length):
 983
 984 2017-12-01  Saam Barati  <sbarati@apple.com>
 985
 986         Having a bad time needs to handle ArrayClass indexing type as well
 987         https://bugs.webkit.org/show_bug.cgi?id=180274
 988         <rdar://problem/35667869>
 989
 990         Reviewed by Keith Miller and Mark Lam.
 991
 992         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
 993         (assert):
 994         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
 995         (assert):
 996
 997 2017-12-01  JF Bastien  <jfbastien@apple.com>
 998
 999         WebAssembly: restore cached stack limit after out-call
1000         https://bugs.webkit.org/show_bug.cgi?id=179106
1001         <rdar://problem/35337525>
1002
1003         Reviewed by Saam Barati.
1004
1005         * wasm/function-tests/double-instance.js: Added.
1006         (const.imp.boom):
1007         (const.imp.get callAnother):
1008
1009 2017-11-30  JF Bastien  <jfbastien@apple.com>
1010
1011         WebAssembly: improve stack trace
1012         https://bugs.webkit.org/show_bug.cgi?id=179343
1013
1014         Reviewed by Saam Barati.
1015
1016         Update the tests to follow the new format. Notably, SHA1 module
1017         hash is now included in traces, and stubs are properly identified.
1018
1019         * wasm/assert.js: Add an assertion which matches regular expressions.
1020         * wasm/function-tests/nameSection.js:
1021         * wasm/function-tests/stack-overflow.js:
1022         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
1023         (assertOverflows.assertThrows.wasm.1):
1024         (assertOverflows.assertThrows.wasm.0):
1025         (assertOverflows.assertThrows):
1026         (assertOverflows):
1027         * wasm/function-tests/stack-trace.js:
1028         (import.Builder.from.string_appeared_here.assert): Deleted.
1029         * wasm/function-tests/trap-after-cross-instance-call.js:
1030         (wasmFrameCountFromError):
1031         * wasm/function-tests/trap-load-2.js:
1032         (wasmFrameCountFromError):
1033         * wasm/function-tests/trap-load.js:
1034         (wasmFrameCountFromError):
1035
1036 2017-11-30  Mark Lam  <mark.lam@apple.com>
1037
1038         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
1039         https://bugs.webkit.org/show_bug.cgi?id=180219
1040         <rdar://problem/35696536>
1041
1042         Reviewed by Filip Pizlo.
1043
1044         * stress/regress-180219.js: Added.
1045
1046 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1047
1048         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
1049         https://bugs.webkit.org/show_bug.cgi?id=180190
1050
1051         Reviewed by Mark Lam.
1052
1053         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
1054         (shouldBe):
1055         (test1):
1056         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
1057         (shouldBe):
1058         (test1):
1059         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
1060         (shouldBe):
1061         (test1):
1062         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
1063         (shouldBe):
1064         (test1):
1065         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
1066         (shouldBe):
1067         (test1):
1068         * stress/operation-in-may-have-negative-int32.js: Added.
1069         (shouldBe):
1070         (test2):
1071         * stress/operation-in-negative-int32-cast.js: Added.
1072         (shouldBe):
1073         (test1):
1074
1075 2017-11-28  JF Bastien  <jfbastien@apple.com>
1076
1077         Strict and sloppy functions shouldn't share structure
1078         https://bugs.webkit.org/show_bug.cgi?id=180103
1079         <rdar://problem/35667847>
1080
1081         Reviewed by Saam Barati.
1082
1083         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
1084         because the IC was wrong.
1085         (foo):
1086         (bar):
1087         (baz):
1088         (catch):
1089         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
1090         in this patch, but may as well test odd strict mode corner cases.
1091         (bar):
1092         (baz):
1093         (catch):
1094         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
1095         (foo):
1096         (bar):
1097         (baz):
1098         (catch):
1099         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
1100         next file, but with invalidation of the FunctionExecutable's
1101         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
1102         slower path.
1103         (foo):
1104         (bar.const.x):
1105         (bar.const.y):
1106         (bar):
1107         (catch):
1108         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
1109         strict nesting works correctly.
1110         (foo):
1111         (bar.baz):
1112         (bar):
1113         * stress/strict-function-structure.js: Added. The test used to
1114         assert in objectProtoFuncHasOwnProperty.
1115         (foo):
1116         (bar):
1117         (baz):
1118         * stress/strict-nested-function-structure.js: Added. Nesting.
1119         (foo):
1120         (bar):
1121         (baz.boo):
1122         (baz):
1123
1124 2017-11-29  Robin Morisset  <rmorisset@apple.com>
1125
1126         The recursive tail call optimisation is wrong on closures
1127         https://bugs.webkit.org/show_bug.cgi?id=179835
1128
1129         Reviewed by Saam Barati.
1130
1131         * stress/closure-recursive-tail-call.js: Added.
1132         (makeClosure):
1133
1134 2017-11-27  JF Bastien  <jfbastien@apple.com>
1135
1136         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
1137         https://bugs.webkit.org/show_bug.cgi?id=180051
1138         <rdar://problem/35614371>
1139
1140         Reviewed by Saam Barati.
1141
1142         * stress/rest-parameter-negative.js: Added.
1143         (__f_5484):
1144         (catch):
1145         (__f_5485):
1146         (__v_22598.catch):
1147
1148 2017-11-27  Saam Barati  <sbarati@apple.com>
1149
1150         Spread can escape when CreateRest does not
1151         https://bugs.webkit.org/show_bug.cgi?id=180057
1152         <rdar://problem/35676119>
1153
1154         Reviewed by JF Bastien.
1155
1156         * stress/spread-escapes-but-create-rest-does-not.js: Added.
1157         (assert):
1158         (getProperties):
1159         (theFunc):
1160         (let.obj.valueOf):
1161
1162 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1163
1164         [DFG] Add NormalizeMapKey DFG IR
1165         https://bugs.webkit.org/show_bug.cgi?id=179912
1166
1167         Reviewed by Saam Barati.
1168
1169         * stress/map-untyped-normalize-cse.js: Added.
1170         (shouldBe):
1171         (test):
1172         * stress/map-untyped-normalize.js: Added.
1173         (shouldBe):
1174         (test):
1175         * stress/set-untyped-normalize-cse.js: Added.
1176         (shouldBe):
1177         (set return.set has.set has):
1178         * stress/set-untyped-normalize.js: Added.
1179         (shouldBe):
1180         (set return.set has):
1181
1182 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1183
1184         [FTL] Support DeleteById and DeleteByVal
1185         https://bugs.webkit.org/show_bug.cgi?id=180022
1186
1187         Reviewed by Saam Barati.
1188
1189         * stress/delete-by-id.js: Added.
1190         (shouldBe):
1191         (test1):
1192         (test2):
1193         * stress/delete-by-val-ftl.js: Added.
1194         (shouldBe):
1195         (test1):
1196         (test2):
1197
1198 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1199
1200         [DFG] Introduce {Set,Map,WeakMap}Fields
1201         https://bugs.webkit.org/show_bug.cgi?id=179925
1202
1203         Reviewed by Saam Barati.
1204
1205         * stress/map-set-clobber-map-get.js: Added.
1206         (shouldBe):
1207         (test):
1208         * stress/map-set-does-not-clobber-set-has.js: Added.
1209         (shouldBe):
1210         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
1211         (shouldBe):
1212         (test):
1213         * stress/set-add-clobber-set-has.js: Added.
1214         (shouldBe):
1215         * stress/set-add-does-not-clobber-map-get.js: Added.
1216         (shouldBe):
1217
1218 2017-11-24  Mark Lam  <mark.lam@apple.com>
1219
1220         Move unsafe jsc shell test functions to the $vm object.
1221         https://bugs.webkit.org/show_bug.cgi?id=179980
1222
1223         Reviewed by Yusuke Suzuki.
1224
1225         * controlFlowProfiler/driver/driver.js:
1226         * controlFlowProfiler/execution-count.js:
1227         * controlFlowProfiler/if-statement.js:
1228         * controlFlowProfiler/loop-statements.js:
1229         * controlFlowProfiler/switch-statements.js:
1230         * controlFlowProfiler/test-jit.js:
1231         * exceptionFuzz/3d-cube.js:
1232         * exceptionFuzz/date-format-xparb.js:
1233         * exceptionFuzz/earley-boyer.js:
1234         * heapProfiler/basic-edges.js:
1235         * heapProfiler/property-edge-types.js:
1236         * microbenchmarks/try-get-by-id-basic.js:
1237         * microbenchmarks/try-get-by-id-polymorphic.js:
1238         * modules/namespace-object-try-get.js:
1239         * stress/argument-count-bytecode.js:
1240         * stress/argument-intrinsic-basic.js:
1241         * stress/argument-intrinsic-inlining-use-caller-arg.js:
1242         * stress/argument-intrinsic-inlining-with-result-escape.js:
1243         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
1244         * stress/argument-intrinsic-inlining-with-vararg.js:
1245         * stress/argument-intrinsic-nested-inlining.js:
1246         * stress/argument-intrinsic-not-convert-to-get-argument.js:
1247         * stress/argument-intrinsic-with-stack-write.js:
1248         * stress/arity-mismatch-get-argument.js:
1249         * stress/array-message-passing.js:
1250         * stress/array-push-with-force-exit.js:
1251         * stress/check-dom-with-signature.js:
1252         * stress/check-sub-class.js:
1253         * stress/compare-eq-incomplete-profile.js:
1254         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
1255         * stress/do-eval-virtual-call-correctly.js:
1256         * stress/dom-jit-with-poly-proto.js:
1257         * stress/domjit-exception-ic.js:
1258         * stress/domjit-exception.js:
1259         * stress/domjit-getter-complex-with-incorrect-object.js:
1260         * stress/domjit-getter-complex.js:
1261         * stress/domjit-getter-poly.js:
1262         * stress/domjit-getter-proto.js:
1263         * stress/domjit-getter-super-poly.js:
1264         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
1265         * stress/domjit-getter-type-check.js:
1266         * stress/domjit-getter.js:
1267         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
1268         * stress/for-in-proxy-target-changed-structure.js:
1269         * stress/for-in-proxy.js:
1270         * stress/generational-opaque-roots.js:
1271         * stress/global-const-redeclaration-setting-2.js:
1272         * stress/global-const-redeclaration-setting-3.js:
1273         * stress/global-const-redeclaration-setting-4.js:
1274         * stress/global-const-redeclaration-setting-5.js:
1275         * stress/global-const-redeclaration-setting.js:
1276         * stress/import-basic.js:
1277         * stress/import-from-eval.js:
1278         * stress/import-reject-with-exception.js:
1279         * stress/import-syntax.js:
1280         * stress/impure-get-own-property-slot-inline-cache.js:
1281         * stress/is-constructor.js:
1282         * stress/istypedarrayview-intrinsic.js:
1283         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
1284         * stress/jsc-test-functions-should-be-more-robust.js:
1285         * stress/object-toString-with-proxy.js:
1286         * stress/poly-proto-custom-value-and-accessor.js:
1287         * stress/proxy-inline-cache.js:
1288         * stress/re-execute-error-module.js:
1289         * stress/regress-150532.js:
1290         * stress/regress-156992.js:
1291         * stress/regress-179619.js:
1292         * stress/resources/shadow-chicken-support.js:
1293         * stress/runtime-array.js:
1294         * stress/sampling-profiler-microtasks.js:
1295         * stress/shadow-chicken-enabled.js:
1296         * stress/spread-correct-global-object-on-exception.js:
1297         * stress/super-get-by-id.js:
1298         * stress/tailCallForwardArguments.js:
1299         * stress/to-object-intrinsic-boolean-edge.js:
1300         * stress/to-object-intrinsic-null-or-undefined-edge.js:
1301         * stress/to-object-intrinsic-number-edge.js:
1302         * stress/to-object-intrinsic-object-edge.js:
1303         * stress/to-object-intrinsic-string-edge.js:
1304         * stress/to-object-intrinsic-symbol-edge.js:
1305         * stress/to-object-intrinsic.js:
1306         * stress/try-catch-custom-getter-as-get-by-id.js:
1307         * stress/try-get-by-id-poly-proto.js:
1308         * stress/try-get-by-id-should-spill-registers-dfg.js:
1309         * stress/try-get-by-id.js:
1310         * typeProfiler/arrow-functions.js:
1311         * typeProfiler/basic.js:
1312         * typeProfiler/captured.js:
1313         * typeProfiler/classes.js:
1314         * typeProfiler/dfg-jit-optimizations.js:
1315         * typeProfiler/dictionary-mode.js:
1316         * typeProfiler/es6-block-scoping.js:
1317         * typeProfiler/es6-classes.js:
1318         * typeProfiler/inheritance.js:
1319         * typeProfiler/int52-dfg.js:
1320         * typeProfiler/loop.js:
1321         * typeProfiler/optional-fields.js:
1322         * typeProfiler/overflow.js:
1323         * typeProfiler/return.js:
1324         * typeProfiler/symbol.js:
1325         * typeProfiler/weird-prototype-chain.js:
1326
1327 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1328
1329         [DFG][FTL] Support MapSet / SetAdd intrinsics
1330         https://bugs.webkit.org/show_bug.cgi?id=179858
1331
1332         Reviewed by Saam Barati.
1333
1334         * microbenchmarks/map-has-and-set.js: Added.
1335         (test):
1336         * stress/map-set-check-failure.js: Added.
1337         (shouldBe):
1338         (shouldThrow):
1339         (target):
1340         * stress/map-set-cse.js: Added.
1341         (shouldBe):
1342         (test):
1343         * stress/set-add-check-failure.js: Added.
1344         (shouldBe):
1345         (shouldThrow):
1346         (set shouldThrow):
1347         * stress/set-add-cse.js: Added.
1348         (shouldBe):
1349
1350 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1351
1352         [JSC] Allow poly proto for intrinsic getters
1353         https://bugs.webkit.org/show_bug.cgi?id=179550
1354
1355         Reviewed by Saam Barati.
1356
1357         This change is also tested by existing tests.
1358
1359             1. stress/intrinsic-getter-with-poly-proto.js
1360             2. stress/poly-proto-intrinsic-getter-correctness.js
1361
1362         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
1363         (shouldBe):
1364         (makePolyProtoObject.foo.C):
1365         (makePolyProtoObject.foo):
1366         (makePolyProtoObject):
1367         (target):
1368         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
1369         (shouldBe):
1370         (makePolyProtoObject.foo.C):
1371         (makePolyProtoObject.foo):
1372         (makePolyProtoObject):
1373         (target):
1374
1375 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
1376
1377         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
1378         https://bugs.webkit.org/show_bug.cgi?id=179744
1379
1380         Reviewed by Michael Catanzaro.
1381
1382         This test uses too much memory for our buildbots on these platforms
1383         and gets OOM-killed.
1384
1385         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1386         Skip if $memoryLimited and linux.
1387
1388 2017-11-17  JF Bastien  <jfbastien@apple.com>
1389
1390         WebAssembly JS API: throw when a promise can't be created
1391         https://bugs.webkit.org/show_bug.cgi?id=179826
1392         <rdar://problem/35455813>
1393
1394         Reviewed by Mark Lam.
1395
1396         Test WebAssembly.{compile,instantiate} where promise creation
1397         fails because of a stack overflow.
1398
1399         * wasm/js-api/promise-stack-overflow.js: Added.
1400         (const.runNearStackLimit.f.const.t):
1401         (async.testCompile):
1402         (async.testInstantiate):
1403
1404 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1405
1406         Unreviewed, mark regress-178385.js as memory exhausting
1407
1408         * stress/regress-178385.js:
1409
1410 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
1411
1412         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
1413
1414         Unreviewed test gardening.
1415
1416         * test262.yaml:
1417
1418 2017-11-16  Robin Morisset  <rmorisset@apple.com>
1419
1420         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
1421         https://bugs.webkit.org/show_bug.cgi?id=179763
1422         <rdar://problem/35550513>
1423
1424         Reviewed by Keith Miller.
1425
1426         Just adding a slightly cleaned-up version of the original fuzzer-found test.
1427
1428         * stress/tdz-this-in-try-catch.js: Added.
1429         (__v_6388):
1430         (__v_6392):
1431
1432 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1433
1434         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
1435         https://bugs.webkit.org/show_bug.cgi?id=179594
1436
1437         Reviewed by Saam Barati.
1438
1439         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
1440         (shouldBe):
1441         (args):
1442         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
1443         (shouldBe):
1444         (args):
1445
1446 2017-11-14  Saam Barati  <sbarati@apple.com>
1447
1448         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
1449         https://bugs.webkit.org/show_bug.cgi?id=179639
1450         <rdar://problem/35513018>
1451
1452         Reviewed by JF Bastien.
1453
1454         * wasm/function-tests/grow-memory-cause-gc.js: Added.
1455         (escape):
1456         (i.func):
1457
1458 2017-11-13  Mark Lam  <mark.lam@apple.com>
1459
1460         Add more overflow check book-keeping for MarkedArgumentBuffer.
1461         https://bugs.webkit.org/show_bug.cgi?id=179634
1462         <rdar://problem/35492517>
1463
1464         Reviewed by Saam Barati.
1465
1466         * stress/regress-179634.js: Added.
1467
1468 2017-11-13  Mark Lam  <mark.lam@apple.com>
1469
1470         Make the jsc shell loadGetterFromGetterSetter() function more robust.
1471         https://bugs.webkit.org/show_bug.cgi?id=179619
1472         <rdar://problem/35492518>
1473
1474         Reviewed by Saam Barati.
1475
1476         * stress/regress-179619.js: Added.
1477
1478 2017-11-12  Mark Lam  <mark.lam@apple.com>
1479
1480         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
1481         https://bugs.webkit.org/show_bug.cgi?id=179562
1482         <rdar://problem/35467022>
1483
1484         Reviewed by Saam Barati.
1485
1486         * regress-179562.js: Added.
1487
1488 2017-11-08  Saam Barati  <sbarati@apple.com>
1489
1490         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
1491         https://bugs.webkit.org/show_bug.cgi?id=177792
1492
1493         Reviewed by Yusuke Suzuki.
1494
1495         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
1496         (assert):
1497         (foo.Foo.prototype.ensureX):
1498         (foo.Foo):
1499         (foo):
1500         (access):
1501
1502 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
1503
1504         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1505         https://bugs.webkit.org/show_bug.cgi?id=178592
1506
1507         Unreviewed test gardening.
1508
1509         * test262.yaml:
1510
1511 2017-11-08  Robin Morisset  <rmorisset@apple.com>
1512
1513         Turn recursive tail calls into loops
1514         https://bugs.webkit.org/show_bug.cgi?id=176601
1515
1516         Reviewed by Saam Barati.
1517
1518         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
1519
1520         Add some simple test that computes factorial in several ways, and other trivial computations.
1521         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1522         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1523         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1524         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1525
1526         * stress/inline-call-to-recursive-tail-call.js: Added.
1527         (factorial.aux):
1528         (factorial):
1529         (factorial2.aux2):
1530         (factorial2.id):
1531         (factorial2):
1532         (factorial3.aux3):
1533         (factorial3):
1534         (aux4):
1535         (factorial4):
1536         (foo):
1537         (auxBar):
1538         (bar):
1539         (test):
1540
1541 2017-11-07  Mark Lam  <mark.lam@apple.com>
1542
1543         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1544         https://bugs.webkit.org/show_bug.cgi?id=179355
1545         <rdar://problem/35263053>
1546
1547         Reviewed by Saam Barati.
1548
1549         * stress/regress-179355.js: Added.
1550
1551 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1552
1553         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1554         https://bugs.webkit.org/show_bug.cgi?id=144458
1555
1556         Reviewed by Saam Barati.
1557
1558         * microbenchmarks/dfg-internal-function-call.js: Added.
1559         (target):
1560         * microbenchmarks/dfg-internal-function-construct.js: Added.
1561         (target):
1562         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1563         (target):
1564         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1565         (target):
1566         * stress/dfg-internal-function-call.js: Added.
1567         (shouldBe):
1568         (target):
1569         * stress/dfg-internal-function-construct.js: Added.
1570         (shouldBe):
1571         (target):
1572         * stress/internal-function-call.js: Added.
1573         (shouldBe):
1574         * stress/internal-function-construct.js: Added.
1575         (shouldBe):
1576
1577 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1578
1579         [Win] Skip stress/regress-178385.js.
1580         https://bugs.webkit.org/show_bug.cgi?id=179298
1581
1582         Unreviewed test gardening.
1583
1584         * stress/regress-178385.js:
1585
1586 2017-11-03  Keith Miller  <keith_miller@apple.com>
1587
1588         Add test for ic with side effects
1589         https://bugs.webkit.org/show_bug.cgi?id=179268
1590
1591         Reviewed by Saam Barati.
1592
1593         * stress/put-inline-cache-side-effects.js: Added.
1594         (let.i.of.objs.keys):
1595         (f):
1596
1597 2017-11-03  Mark Lam  <mark.lam@apple.com>
1598
1599         CachedCall (and its clients) needs overflow checks.
1600         https://bugs.webkit.org/show_bug.cgi?id=179185
1601
1602         Reviewed by JF Bastien.
1603
1604         * stress/regress-179185.js: Added.
1605
1606 2017-11-02  Michael Saboff  <msaboff@apple.com>
1607
1608         DFG needs to handle code motion of code in for..in loop bodies
1609         https://bugs.webkit.org/show_bug.cgi?id=179212
1610
1611         Reviewed by Keith Miller.
1612
1613         New regression test.
1614
1615         * stress/for-in-side-effects.js: Added.
1616         (getPrototypeOf):
1617         (reset):
1618         (testWithoutFTL.f):
1619         (testWithoutFTL):
1620         (testWithFTL.f):
1621         (testWithFTL):
1622
1623 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1624
1625         AI does not correctly model the clobber case of ArithClz32
1626         https://bugs.webkit.org/show_bug.cgi?id=179188
1627
1628         Reviewed by Michael Saboff.
1629
1630         * stress/arith-clz32-effects.js: Added.
1631         (foo):
1632         (valueOf):
1633
1634 2017-11-01  Michael Saboff  <msaboff@apple.com>
1635
1636         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1637         https://bugs.webkit.org/show_bug.cgi?id=179140
1638
1639         Reviewed by Saam Barati.
1640
1641         New regression test.
1642
1643         * stress/regress-179140.js: Added.
1644         (testWithoutFTL):
1645         (testWithFTL):
1646
1647 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1648
1649         [JSC] Introduce @toObject
1650         https://bugs.webkit.org/show_bug.cgi?id=178726
1651
1652         Reviewed by Saam Barati.
1653
1654         * stress/array-copywithin.js:
1655         (shouldThrow):
1656         * stress/object-constructor-boolean-edge.js: Added.
1657         (shouldBe):
1658         (test):
1659         * stress/object-constructor-global.js: Added.
1660         (shouldBe):
1661         * stress/object-constructor-null-edge.js: Added.
1662         (shouldBe):
1663         (test):
1664         * stress/object-constructor-number-edge.js: Added.
1665         (shouldBe):
1666         (test):
1667         * stress/object-constructor-object-edge.js: Added.
1668         (shouldBe):
1669         (test):
1670         (i.arg):
1671         * stress/object-constructor-string-edge.js: Added.
1672         (shouldBe):
1673         (test):
1674         * stress/object-constructor-symbol-edge.js: Added.
1675         (shouldBe):
1676         (test):
1677         * stress/object-constructor-undefined-edge.js: Added.
1678         (shouldBe):
1679         (test):
1680         * stress/symbol-array-from.js: Added.
1681         (shouldBe):
1682         * stress/to-object-intrinsic-boolean-edge.js: Added.
1683         (shouldBe):
1684         (builtin.createBuiltin):
1685         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1686         (shouldThrow):
1687         * stress/to-object-intrinsic-number-edge.js: Added.
1688         (shouldBe):
1689         (builtin.createBuiltin):
1690         * stress/to-object-intrinsic-object-edge.js: Added.
1691         (shouldBe):
1692         (builtin.createBuiltin):
1693         (i.arg):
1694         * stress/to-object-intrinsic-string-edge.js: Added.
1695         (shouldBe):
1696         (builtin.createBuiltin):
1697         * stress/to-object-intrinsic-symbol-edge.js: Added.
1698         (shouldBe):
1699         (builtin.createBuiltin):
1700         * stress/to-object-intrinsic.js: Added.
1701         (shouldBe):
1702         (shouldThrow):
1703         (builtin.createBuiltin):
1704
1705 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1706
1707         [DFG][FTL] Introduce StringSlice
1708         https://bugs.webkit.org/show_bug.cgi?id=178934
1709
1710         Reviewed by Saam Barati.
1711
1712         * microbenchmarks/string-slice-empty.js: Added.
1713         (slice):
1714         * microbenchmarks/string-slice-one-char.js: Added.
1715         (slice):
1716         * microbenchmarks/string-slice.js: Added.
1717         (slice):
1718
1719 2017-10-26  Michael Saboff  <msaboff@apple.com>
1720
1721         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1722         https://bugs.webkit.org/show_bug.cgi?id=178890
1723
1724         Reviewed by Keith Miller.
1725
1726         New regression test.
1727
1728         * stress/regress-178890.js: Added.
1729
1730 2017-10-26  Mark Lam  <mark.lam@apple.com>
1731
1732         JSRopeString::RopeBuilder::append() should check for overflows.
1733         https://bugs.webkit.org/show_bug.cgi?id=178385
1734         <rdar://problem/35027468>
1735
1736         Reviewed by Saam Barati.
1737
1738         * stress/regress-178385.js: Added.
1739
1740 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1741
1742         Unreviewed, rolling out r223961.
1743
1744         The change that required this has been rolled out.
1745
1746         Reverted changeset:
1747
1748         "Mark test262.yaml/test262/test/language/statements/try/tco-
1749         catch.js as passing."
1750         https://bugs.webkit.org/show_bug.cgi?id=178592
1751         https://trac.webkit.org/changeset/223961
1752
1753 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1754
1755         Unreviewed, rolling out r223691 and r223729.
1756         https://bugs.webkit.org/show_bug.cgi?id=178834
1757
1758         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1759         by rniwa on #webkit).
1760
1761         Reverted changesets:
1762
1763         "Turn recursive tail calls into loops"
1764         https://bugs.webkit.org/show_bug.cgi?id=176601
1765         https://trac.webkit.org/changeset/223691
1766
1767         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1768         comparison is always false due to limited range of data type
1769         [-Wtype-limits]"
1770         https://bugs.webkit.org/show_bug.cgi?id=178543
1771         https://trac.webkit.org/changeset/223729
1772
1773 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1774
1775         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1776         https://bugs.webkit.org/show_bug.cgi?id=178592
1777
1778         Unreviewed test gardening.
1779
1780         * test262.yaml:
1781
1782 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1783
1784         [FTL] Support NewStringObject
1785         https://bugs.webkit.org/show_bug.cgi?id=178737
1786
1787         Reviewed by Saam Barati.
1788
1789         * stress/new-string-object.js: Added.
1790         (shouldBe):
1791         (test):
1792
1793 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1794
1795         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1796         https://bugs.webkit.org/show_bug.cgi?id=178308
1797
1798         Reviewed by Mark Lam.
1799
1800         * test262.yaml:
1801
1802 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1803
1804         [JSC] Use fastJoin in Array#toString
1805         https://bugs.webkit.org/show_bug.cgi?id=178062
1806
1807         Reviewed by Darin Adler.
1808
1809         * microbenchmarks/contiguous-array-to-string.js: Added.
1810         (target):
1811         * microbenchmarks/double-array-to-string.js: Added.
1812         (target):
1813         * microbenchmarks/int32-array-to-string.js: Added.
1814         (target):
1815
1816 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1817
1818         stress/check-string-ident.js is improperly skipped
1819         https://bugs.webkit.org/show_bug.cgi?id=178642
1820
1821         Reviewed by Saam Barati.
1822
1823         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1824         since it enforces the run-jsc-stress-tests script to still set up the
1825         test to run, despite the skip directive that's used before.
1826
1827 2017-10-20  Mark Lam  <mark.lam@apple.com>
1828
1829         Add a test case for r214334.
1830         https://bugs.webkit.org/show_bug.cgi?id=169941
1831         <rdar://problem/31221258>
1832
1833         Reviewed by JF Bastien.
1834
1835         * stress/regress-169941.js: Added.
1836
1837 2017-10-19  JF Bastien  <jfbastien@apple.com>
1838
1839         WebAssembly: no VM / JS version of everything but Instance
1840         https://bugs.webkit.org/show_bug.cgi?id=177473
1841
1842         Reviewed by Filip Pizlo, Saam Barati.
1843
1844         - Exceeding max on memory growth now returns a range error as per
1845         spec. This is a (very minor) breaking change: it used to throw OOM
1846         error. Update the corresponding test.
1847
1848         * wasm/js-api/memory-grow.js:
1849         (assertEq):
1850         * wasm/js-api/table.js:
1851         (assert.throws):
1852
1853 2017-10-19  Mark Lam  <mark.lam@apple.com>
1854
1855         Stringifier::appendStringifiedValue() is missing an exception check.
1856         https://bugs.webkit.org/show_bug.cgi?id=178386
1857         <rdar://problem/35027610>
1858
1859         Reviewed by Saam Barati.
1860
1861         * stress/regress-178386.js: Added.
1862
1863 2017-10-19  Michael Saboff  <msaboff@apple.com>
1864
1865         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1866         https://bugs.webkit.org/show_bug.cgi?id=178521
1867
1868         Reviewed by JF Bastien.
1869
1870         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1871         now passes with the current version (5.0) of the Emoji spec.
1872
1873 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1874
1875         Turn recursive tail calls into loops
1876         https://bugs.webkit.org/show_bug.cgi?id=176601
1877
1878         Reviewed by Saam Barati.
1879
1880         Add some simple test that computes factorial in several ways, and other trivial computations.
1881         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1882         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1883         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1884         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1885
1886         * stress/inline-call-to-recursive-tail-call.js: Added.
1887         (factorial.aux):
1888         (factorial):
1889         (factorial2.aux):
1890         (factorial2.id):
1891         (factorial2):
1892         (factorial3.aux):
1893         (factorial3):
1894         (aux):
1895         (factorial4):
1896         (test):
1897
1898 2017-10-18  Mark Lam  <mark.lam@apple.com>
1899
1900         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1901         https://bugs.webkit.org/show_bug.cgi?id=177600
1902         <rdar://problem/34710985>
1903
1904         Reviewed by Saam Barati.
1905
1906         * stress/regress-177600.js: Added.
1907
1908 2017-10-18  Mark Lam  <mark.lam@apple.com>
1909
1910         The compiler should always register a structure when it adds its transitionWatchPointSet.
1911         https://bugs.webkit.org/show_bug.cgi?id=178420
1912         <rdar://problem/34814024>
1913
1914         Reviewed by Saam Barati and Filip Pizlo.
1915
1916         * stress/regress-178420.js: Added.
1917         (new.Array.10000.map):
1918
1919 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1920
1921         [JSC] __proto__ getter should be fast
1922         https://bugs.webkit.org/show_bug.cgi?id=178067
1923
1924         Reviewed by Saam Barati.
1925
1926         * stress/dfg-object-proto-accessor.js: Added.
1927         (shouldBe):
1928         (shouldThrow):
1929         (target):
1930         * stress/dfg-object-proto-getter.js: Added.
1931         (shouldBe):
1932         (shouldThrow):
1933         (target):
1934         * stress/dfg-object-prototype-of.js: Added.
1935         (shouldBe):
1936         (shouldThrow):
1937         (target):
1938         * stress/dfg-reflect-get-prototype-of.js: Added.
1939         (shouldBe):
1940         (shouldThrow):
1941         (target):
1942         * stress/intrinsic-getter-with-poly-proto.js: Added.
1943         (shouldBe):
1944         (makePolyProtoObject.foo.C):
1945         (makePolyProtoObject.foo):
1946         (makePolyProtoObject):
1947         (target):
1948         * stress/object-get-prototype-of-filtered.js: Added.
1949         (shouldBe):
1950         (shouldThrow):
1951         (target):
1952         (i.Cocoa):
1953         * stress/object-get-prototype-of-mono-proto.js: Added.
1954         (shouldBe):
1955         (makePolyProtoObject.foo.C):
1956         (makePolyProtoObject.foo):
1957         (makePolyProtoObject):
1958         (target):
1959         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1960         (shouldBe):
1961         (makePolyProtoObject.foo.C):
1962         (makePolyProtoObject.foo):
1963         (makePolyProtoObject):
1964         (target):
1965         * stress/object-get-prototype-of-poly-proto.js: Added.
1966         (shouldBe):
1967         (makePolyProtoObject.foo.C):
1968         (makePolyProtoObject.foo):
1969         (makePolyProtoObject):
1970         (target):
1971         * stress/object-proto-getter-filtered.js: Added.
1972         (shouldBe):
1973         (shouldThrow):
1974         (target):
1975         (i.Cocoa):
1976         * stress/object-proto-getter-poly-mono-proto.js: Added.
1977         (shouldBe):
1978         (makePolyProtoObject.foo.C):
1979         (makePolyProtoObject.foo):
1980         (makePolyProtoObject):
1981         (target):
1982         * stress/object-proto-getter-poly-proto.js: Added.
1983         (shouldBe):
1984         (makePolyProtoObject.foo.C):
1985         (makePolyProtoObject.foo):
1986         (makePolyProtoObject):
1987         (target):
1988         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1989         * stress/string-proto.js: Added.
1990         (shouldBe):
1991         (target):
1992
1993 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1994
1995         Unreviewed, rolling out r223523.
1996
1997         A test for this change is failing on debug JSC bots.
1998
1999         Reverted changeset:
2000
2001         "[JSC] __proto__ getter should be fast"
2002         https://bugs.webkit.org/show_bug.cgi?id=178067
2003         https://trac.webkit.org/changeset/223523
2004
2005 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2006
2007         [JSC] __proto__ getter should be fast
2008         https://bugs.webkit.org/show_bug.cgi?id=178067
2009
2010         Reviewed by Saam Barati.
2011
2012         * stress/dfg-object-proto-accessor.js: Added.
2013         (shouldBe):
2014         (shouldThrow):
2015         (target):
2016         * stress/dfg-object-proto-getter.js: Added.
2017         (shouldBe):
2018         (shouldThrow):
2019         (target):
2020         * stress/dfg-object-prototype-of.js: Added.
2021         (shouldBe):
2022         (shouldThrow):
2023         (target):
2024         * stress/dfg-reflect-get-prototype-of.js: Added.
2025         (shouldBe):
2026         (shouldThrow):
2027         (target):
2028         * stress/object-get-prototype-of-filtered.js: Added.
2029         (shouldBe):
2030         (shouldThrow):
2031         (target):
2032         (i.Cocoa):
2033         * stress/object-get-prototype-of-mono-proto.js: Added.
2034         (shouldBe):
2035         (makePolyProtoObject.foo.C):
2036         (makePolyProtoObject.foo):
2037         (makePolyProtoObject):
2038         (target):
2039         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
2040         (shouldBe):
2041         (makePolyProtoObject.foo.C):
2042         (makePolyProtoObject.foo):
2043         (makePolyProtoObject):
2044         (target):
2045         * stress/object-get-prototype-of-poly-proto.js: Added.
2046         (shouldBe):
2047         (makePolyProtoObject.foo.C):
2048         (makePolyProtoObject.foo):
2049         (makePolyProtoObject):
2050         (target):
2051         * stress/object-proto-getter-filtered.js: Added.
2052         (shouldBe):
2053         (shouldThrow):
2054         (target):
2055         (i.Cocoa):
2056         * stress/object-proto-getter-poly-mono-proto.js: Added.
2057         (shouldBe):
2058         (makePolyProtoObject.foo.C):
2059         (makePolyProtoObject.foo):
2060         (makePolyProtoObject):
2061         (target):
2062         * stress/object-proto-getter-poly-proto.js: Added.
2063         (shouldBe):
2064         (makePolyProtoObject.foo.C):
2065         (makePolyProtoObject.foo):
2066         (makePolyProtoObject):
2067         (target):
2068         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
2069         * stress/string-proto.js: Added.
2070         (shouldBe):
2071         (target):
2072
2073 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2074
2075         Reland "Add Above/Below comparisons for UInt32 patterns"
2076         https://bugs.webkit.org/show_bug.cgi?id=177281
2077
2078         Reviewed by Saam Barati.
2079
2080         * stress/uint32-comparison-jump.js: Added.
2081         (shouldBe):
2082         (above):
2083         (aboveOrEqual):
2084         (below):
2085         (belowOrEqual):
2086         (notAbove):
2087         (notAboveOrEqual):
2088         (notBelow):
2089         (notBelowOrEqual):
2090         * stress/uint32-comparison.js: Added.
2091         (shouldBe):
2092         (above):
2093         (aboveOrEqual):
2094         (below):
2095         (belowOrEqual):
2096         (aboveTest):
2097         (aboveOrEqualTest):
2098         (belowTest):
2099         (belowOrEqualTest):
2100
2101 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2102
2103         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
2104         https://bugs.webkit.org/show_bug.cgi?id=178210
2105
2106         Reviewed by Saam Barati.
2107
2108         * wasm/function-tests/trap-from-start-async.js:
2109         (async.StartTrapsAsync):
2110         * wasm/function-tests/trap-from-start.js:
2111         (StartTraps):
2112         * wasm/js-api/web-assembly-function.js:
2113         (assert.eq.Object.getPrototypeOf):
2114         * wasm/js-api/wrapper-function.js:
2115         (return.new.WebAssembly.Module):
2116         (assert.throws.makeInstance): Deleted.
2117         (assert.throws.Bar): Deleted.
2118         (assert.throws): Deleted.
2119
2120 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
2121
2122         Enable gigacage on iOS
2123         https://bugs.webkit.org/show_bug.cgi?id=177586
2124
2125         Reviewed by JF Bastien.
2126
2127         Add tests for when Gigacage gets runtime disabled.
2128
2129         * stress/disable-gigacage-arrays.js: Added.
2130         (foo):
2131         * stress/disable-gigacage-strings.js: Added.
2132         (foo):
2133         * stress/disable-gigacage-typed-arrays.js: Added.
2134         (foo):
2135
2136 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
2137
2138         import.meta should not be assignable
2139         https://bugs.webkit.org/show_bug.cgi?id=178202
2140
2141         Reviewed by Saam Barati.
2142
2143         * modules/import-meta-assignment.js: Added.
2144         (shouldThrow):
2145         (SyntaxError.import.meta.can.shouldThrow):
2146
2147 2017-10-11  Saam Barati  <sbarati@apple.com>
2148
2149         Unreviewed. Actually skip certain type profiler tests in debug.
2150
2151         * typeProfiler.yaml:
2152         * typeProfiler/deltablue-for-of.js:
2153         * typeProfiler/getter-richards.js:
2154
2155 2017-10-11  Commit Queue  <commit-queue@webkit.org>
2156
2157         Unreviewed, rolling out r223113 and r223121.
2158         https://bugs.webkit.org/show_bug.cgi?id=178182
2159
2160         Reintroduced 20% regression on Kraken (Requested by rniwa on
2161         #webkit).
2162
2163         Reverted changesets:
2164
2165         "Enable gigacage on iOS"
2166         https://bugs.webkit.org/show_bug.cgi?id=177586
2167         https://trac.webkit.org/changeset/223113
2168
2169         "Use one virtual allocation for all gigacages and their
2170         runways"
2171         https://bugs.webkit.org/show_bug.cgi?id=178050
2172         https://trac.webkit.org/changeset/223121
2173
2174 2017-10-11  Michael Saboff  <msaboff@apple.com>
2175
2176         Disable test262 named capture group tests with direct unicode names and with references before definitions
2177         https://bugs.webkit.org/show_bug.cgi?id=178177
2178
2179         Reviewed by Keith Miller.
2180
2181         Bugs to track fixing these test are:
2182         https://bugs.webkit.org/show_bug.cgi?id=178174 -
2183             "Add support in named capture group identifiers for direct surrogate pairs"
2184         https://bugs.webkit.org/show_bug.cgi?id=178175 -
2185             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
2186
2187         * test262.yaml:
2188
2189 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
2190
2191         Object properties are undefined in super.call() but not in this.call()
2192         https://bugs.webkit.org/show_bug.cgi?id=177230
2193
2194         Reviewed by Saam Barati.
2195
2196         * stress/super-call-function-subclass.js: Added.
2197         (assert):
2198         (A.prototype.t):
2199         (A):
2200         * stress/super-dot-call-and-apply.js: Added.
2201         (assert):
2202         (A):
2203         (A.prototype.call):
2204         (A.prototype.apply):
2205         (B.prototype.testSuper):
2206         (B):
2207         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
2208         (D.prototype.testSuper):
2209         (D):
2210
2211 2017-10-10  Saam Barati  <sbarati@apple.com>
2212
2213         The prototype cache should be aware of the Executable it generates a Structure for
2214         https://bugs.webkit.org/show_bug.cgi?id=177907
2215
2216         Reviewed by Filip Pizlo.
2217
2218         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
2219         (assert):
2220         (foo.C):
2221         (foo):
2222         (bar.C):
2223         (bar):
2224         (access):
2225         (makeLongChain):
2226         (accessY):
2227
2228 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2229
2230         `async` should be able to be used as an imported binding name
2231         https://bugs.webkit.org/show_bug.cgi?id=176573
2232
2233         Reviewed by Saam Barati.
2234
2235         * modules/import-default-async.js: Added.
2236         * modules/import-named-async-as.js: Added.
2237         * modules/import-named-async.js: Added.
2238         * modules/import-named-async/target.js: Added.
2239         * modules/import-namespace-async.js: Added.
2240         * test262.yaml:
2241
2242 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
2243
2244         Enable gigacage on iOS
2245         https://bugs.webkit.org/show_bug.cgi?id=177586
2246
2247         Reviewed by JF Bastien.
2248
2249         Add tests for when Gigacage gets runtime disabled.
2250
2251         * stress/disable-gigacage-arrays.js: Added.
2252         (foo):
2253         * stress/disable-gigacage-strings.js: Added.
2254         (foo):
2255         * stress/disable-gigacage-typed-arrays.js: Added.
2256         (foo):
2257
2258 2017-10-09  Michael Saboff  <msaboff@apple.com>
2259
2260         Implement RegExp Unicode property escapes
2261         https://bugs.webkit.org/show_bug.cgi?id=172069
2262
2263         Reviewed by JF Bastien.
2264
2265         Enabled Unicode Property tests.
2266
2267         * test262.yaml:
2268
2269 2017-10-09  Commit Queue  <commit-queue@webkit.org>
2270
2271         Unreviewed, rolling out r223015 and r223025.
2272         https://bugs.webkit.org/show_bug.cgi?id=178093
2273
2274         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
2275         #webkit).
2276
2277         Reverted changesets:
2278
2279         "Enable gigacage on iOS"
2280         https://bugs.webkit.org/show_bug.cgi?id=177586
2281         http://trac.webkit.org/changeset/223015
2282
2283         "Unreviewed, disable Gigacage on ARM64 Linux"
2284         https://bugs.webkit.org/show_bug.cgi?id=177586
2285         http://trac.webkit.org/changeset/223025
2286
2287 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
2288
2289         Update expectations for test262 tests that pass after r223043.
2290         https://bugs.webkit.org/show_bug.cgi?id=176685
2291
2292         Unreviewed test gardening.
2293
2294         * test262.yaml:
2295
2296 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
2297
2298         Unreviewed, rolling out r223022.
2299
2300         This change introduced 18 test262 failures.
2301
2302         Reverted changeset:
2303
2304         "`async` should be able to be used as an imported binding
2305         name"
2306         https://bugs.webkit.org/show_bug.cgi?id=176573
2307         http://trac.webkit.org/changeset/223022
2308
2309 2017-10-09  Saam Barati  <sbarati@apple.com>
2310
2311         3 poly-proto JSC tests timing out on debug after r222827
2312         https://bugs.webkit.org/show_bug.cgi?id=177880
2313         <rdar://problem/34817122>
2314
2315         Unreviewed.
2316
2317         I'm skipping these type profiler tests on debug since they are long running.
2318
2319         * typeProfiler/deltablue-for-of.js:
2320         * typeProfiler/getter-richards.js:
2321
2322 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2323
2324         Safari 10 /11 problem with if (!await get(something)).
2325         https://bugs.webkit.org/show_bug.cgi?id=176685
2326
2327         Reviewed by Saam Barati.
2328
2329         * stress/async-await-basic.js:
2330         (awaitEpression.async):
2331         * stress/async-await-syntax.js:
2332         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2333         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2334
2335 2017-10-08  Saam Barati  <sbarati@apple.com>
2336
2337         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
2338
2339         * typeProfiler/deltablue-for-of.js:
2340         * typeProfiler/getter-richards.js:
2341
2342 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
2343
2344         `async` should be able to be used as an imported binding name
2345         https://bugs.webkit.org/show_bug.cgi?id=176573
2346
2347         Reviewed by Darin Adler.
2348
2349         * modules/import-default-async.js: Added.
2350         * modules/import-named-async-as.js: Added.
2351         * modules/import-named-async.js: Added.
2352         * modules/import-named-async/target.js: Added.
2353         * modules/import-namespace-async.js: Added.
2354
2355 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
2356
2357         Enable gigacage on iOS
2358         https://bugs.webkit.org/show_bug.cgi?id=177586
2359
2360         Reviewed by JF Bastien.
2361
2362         Add tests for when Gigacage gets runtime disabled.
2363
2364         * stress/disable-gigacage-arrays.js: Added.
2365         (foo):
2366         * stress/disable-gigacage-strings.js: Added.
2367         (foo):
2368         * stress/disable-gigacage-typed-arrays.js: Added.
2369         (foo):
2370
2371 2017-10-06  Commit Queue  <commit-queue@webkit.org>
2372
2373         Unreviewed, rolling out r222791 and r222873.
2374         https://bugs.webkit.org/show_bug.cgi?id=178031
2375
2376         Caused crashes with workers/wasm LayoutTests (Requested by
2377         ryanhaddad on #webkit).
2378
2379         Reverted changesets:
2380
2381         "WebAssembly: no VM / JS version of everything but Instance"
2382         https://bugs.webkit.org/show_bug.cgi?id=177473
2383         http://trac.webkit.org/changeset/222791
2384
2385         "WebAssembly: address no VM / JS follow-ups"
2386         https://bugs.webkit.org/show_bug.cgi?id=177887
2387         http://trac.webkit.org/changeset/222873
2388
2389 2017-10-05  Saam Barati  <sbarati@apple.com>
2390
2391         Make sure all prototypes under poly proto get added into the VM's prototype map
2392         https://bugs.webkit.org/show_bug.cgi?id=177909
2393
2394         Reviewed by Keith Miller.
2395
2396         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
2397         (assert):
2398         (foo.C):
2399         (foo):
2400         (set x):
2401
2402 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2403
2404         [JSC] Introduce import.meta
2405         https://bugs.webkit.org/show_bug.cgi?id=177703
2406
2407         Reviewed by Filip Pizlo.
2408
2409         * modules/import-meta-syntax.js: Added.
2410         (shouldThrow):
2411         (shouldNotThrow):
2412         * modules/import-meta.js: Added.
2413         * modules/import-meta/cocoa.js: Added.
2414         * modules/resources/assert.js:
2415         (export.shouldNotThrow):
2416         * stress/import-syntax.js:
2417
2418 2017-10-04  Saam Barati  <sbarati@apple.com>
2419
2420         Make pertinent AccessCases watch the poly proto watchpoint
2421         https://bugs.webkit.org/show_bug.cgi?id=177765
2422
2423         Reviewed by Keith Miller.
2424
2425         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
2426         (assert):
2427         (foo.C):
2428         (foo):
2429         (validate):
2430         * stress/poly-proto-clear-stub.js: Added.
2431         (assert):
2432         (foo.C):
2433         (foo):
2434
2435 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
2436
2437         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
2438
2439         Unreviewed test gardening.
2440
2441         * test262.yaml:
2442
2443 2017-10-04  Saam Barati  <sbarati@apple.com>
2444
2445         3 poly-proto JSC tests timing out on debug after r222827
2446         https://bugs.webkit.org/show_bug.cgi?id=177880
2447
2448         Rubber stamped by Mark Lam.
2449
2450         * microbenchmarks/poly-proto-access.js:
2451         * typeProfiler/deltablue-for-of.js:
2452         * typeProfiler/getter-richards.js:
2453
2454 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
2455
2456         Unreviewed, marking tco-catch.js as a failure after test262 update
2457         https://bugs.webkit.org/show_bug.cgi?id=177859
2458
2459         * test262.yaml:
2460
2461 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2462
2463         Unreviewed, marking one async iterator test262 test failed
2464         https://bugs.webkit.org/show_bug.cgi?id=177859
2465
2466         * test262.yaml:
2467
2468 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2469
2470         [Test262] Update Test262 to Oct 4 version
2471         https://bugs.webkit.org/show_bug.cgi?id=177859
2472
2473         Reviewed by Sam Weinig.
2474
2475         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
2476         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
2477
2478         * test262.yaml:
2479         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
2480         (checkSequence):
2481         * test262/harness/typeCoercion.js:
2482         (testCoercibleToIndexZero):
2483         (testCoercibleToIndexOne):
2484         (testCoercibleToIndexFromIndex):
2485         (testNotCoercibleToIndex.testPrimitiveValue):
2486         (testNotCoercibleToInteger):
2487         (testCoercibleToBigIntZero.testPrimitiveValue):
2488         (testCoercibleToBigIntZero):
2489         (testCoercibleToBigIntOne.testPrimitiveValue):
2490         (testCoercibleToBigIntOne):
2491         (testPrimitiveValue):
2492         (testCoercibleToBigIntFromBigInt):
2493         (testNotCoercibleToBigInt.testPrimitiveValue):
2494         (testNotCoercibleToBigInt.testStringValue):
2495         (testNotCoercibleToBigInt):
2496         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
2497         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
2498         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
2499         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
2500         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
2501         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
2502         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
2503         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
2504         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
2505         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
2506         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
2507         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
2508         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
2509         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
2510         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
2511         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
2512         (testCoercibleToBigIntZero):
2513         (testCoercibleToBigIntOne):
2514         (testNotCoercibleToBigInt):
2515         (MyError): Deleted.
2516         (valueOf): Deleted.
2517         (toString): Deleted.
2518         (Symbol.toPrimitive): Deleted.
2519         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
2520         (testCoercibleToIndexZero):
2521         (testCoercibleToIndexOne):
2522         (testNotCoercibleToIndex):
2523         (MyError): Deleted.
2524         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
2525         (assert.sameValue.BigInt.asIntN.toString): Deleted.
2526         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
2527         (BigInt.asIntN.valueOf): Deleted.
2528         (BigInt.asIntN.toString): Deleted.
2529         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
2530         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
2531         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
2532         (testCoercibleToBigIntZero):
2533         (testCoercibleToBigIntOne):
2534         (testNotCoercibleToBigInt):
2535         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
2536         (testCoercibleToIndexZero):
2537         (testCoercibleToIndexOne):
2538         (testNotCoercibleToIndex):
2539         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2540         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2541         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2542         (bits.valueOf):
2543         (bigint.valueOf):
2544         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2545         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2546         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2547         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2548         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2549         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2550         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2551         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2552         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2553         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2554         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2555         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2556         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2557         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2558         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2559         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2560         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2561         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2562         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2563         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2564         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2565         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2566         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2567         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2568         (replacer):
2569         (BigInt.prototype.toJSON):
2570         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2571         (replacer):
2572         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2573         (BigInt.prototype.toJSON):
2574         * test262/test/built-ins/JSON/stringify/bigint.js:
2575         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2576         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2577         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2578         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2579         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2580         * test262/test/built-ins/Object/proto-from-ctor.js:
2581         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2582         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2583         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2584         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2585         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2586         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2587         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2588         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2589         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2590         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2591         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2592         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2593         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2594         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2595         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2596         * test262/test/built-ins/Proxy/get-fn-realm.js:
2597         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2598         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2599         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2600         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2601         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2602         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2603         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2604         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2605         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2606         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2607         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2608         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2609         (i6.replace):
2610         (i6b.replace):
2611         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2612         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2613         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2614         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2615         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2616         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2617         * test262/test/built-ins/RegExp/u180e.js: Added.
2618         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2619         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2620         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2621         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2622         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2623         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2624         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2625         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2626         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2627         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2628         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2629         * test262/test/built-ins/String/prototype/endsWith/length.js:
2630         * test262/test/built-ins/String/prototype/endsWith/name.js:
2631         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2632         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2633         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2634         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2635         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2636         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2637         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2638         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2639         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2640         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2641         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2642         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2643         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2644         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2645         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2646         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2647         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2648         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2649         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2650         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2651         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2652         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2653         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2654         * test262/test/built-ins/String/prototype/includes/includes.js:
2655         * test262/test/built-ins/String/prototype/includes/length.js:
2656         * test262/test/built-ins/String/prototype/includes/name.js:
2657         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2658         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2659         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2660         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2661         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2662         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2663         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2664         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2665         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2666         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2667         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2668         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2669         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2670         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2671         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2672         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2673         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2674         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2675         * test262/test/built-ins/String/prototype/trim/u180e.js:
2676         * test262/test/built-ins/Symbol/for/cross-realm.js:
2677         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2678         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2679         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2680         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2681         * test262/test/built-ins/Symbol/match/cross-realm.js:
2682         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2683         * test262/test/built-ins/Symbol/search/cross-realm.js:
2684         * test262/test/built-ins/Symbol/species/cross-realm.js:
2685         * test262/test/built-ins/Symbol/split/cross-realm.js:
2686         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2687         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2688         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2689         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2690         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2691         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2692         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2693         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2694         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2695         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2696         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2697         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2698         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2699         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2700         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2701         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2702         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2703         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2704         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2705         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2706         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2707         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2708         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2709         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2710         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2711         * test262/test/language/eval-code/indirect/realm.js:
2712         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2713         (o.get z):
2714         (o.get a):
2715         * test262/test/language/expressions/call/eval-realm-indirect.js:
2716         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2717         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2718         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2719         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2720         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2721         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2722         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2723         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2724         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2725         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2726         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2727         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2728         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2729         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2730         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2731         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2732         * test262/test/language/expressions/less-than/bigint-and-number.js:
2733         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2734         * test262/test/language/expressions/super/realm.js:
2735         * test262/test/language/expressions/tagged-template/cache-realm.js:
2736         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2737         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2738         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2739         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2740         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2741         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2742         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2743         (o.get z):
2744         (o.get a):
2745         * test262/test/language/statements/for-of/iterator-next-reference.js:
2746         (next):
2747         (iterator.next): Deleted.
2748         (x.of.iterable.): Deleted.
2749         (x.of.iterable.get return): Deleted.
2750         (x.of.iterable.iterator.next): Deleted.
2751         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2752         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2753         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2754         * test262/test/language/white-space/mongolian-vowel-separator.js:
2755         * test262/test262-Revision.txt:
2756
2757 2017-10-03  Saam Barati  <sbarati@apple.com>
2758
2759         Implement polymorphic prototypes
2760         https://bugs.webkit.org/show_bug.cgi?id=176391
2761
2762         Reviewed by Filip Pizlo.
2763
2764         * microbenchmarks/poly-proto-access.js: Added.
2765         (assert):
2766         (foo.C):
2767         (foo.C.prototype.get bar):
2768         (foo):
2769         (bar):
2770         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2771         (assert):
2772         (makePolyProtoObject.foo.C):
2773         (makePolyProtoObject.foo):
2774         (makePolyProtoObject):
2775         (performSet):
2776         * microbenchmarks/poly-proto-setter-speed.js: Added.
2777         (assert):
2778         (makePolyProtoObject.foo.C):
2779         (makePolyProtoObject.foo.C.prototype.set p):
2780         (makePolyProtoObject.foo):
2781         (makePolyProtoObject):
2782         (performSet):
2783         * stress/constructor-with-return.js:
2784         (i.tests.forEach.Constructor):
2785         (i.tests.forEach):
2786         (tests.forEach.Constructor): Deleted.
2787         (tests.forEach): Deleted.
2788         * stress/dom-jit-with-poly-proto.js: Added.
2789         (assert):
2790         (makePolyProtoObject.foo.C):
2791         (makePolyProtoObject.foo):
2792         (makePolyProtoObject):
2793         (validate):
2794         * stress/poly-proto-custom-value-and-accessor.js: Added.
2795         (assert):
2796         (makePolyProtoObject.foo.C):
2797         (makePolyProtoObject.foo):
2798         (makePolyProtoObject):
2799         (items.forEach):
2800         (set get for):
2801         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2802         (assert):
2803         (makePolyProtoObject.foo.C):
2804         (makePolyProtoObject.foo):
2805         (makePolyProtoObject):
2806         (foo):
2807         * stress/poly-proto-miss.js: Added.
2808         (makePolyProtoInstanceWithNullPrototype.foo.C):
2809         (makePolyProtoInstanceWithNullPrototype.foo):
2810         (makePolyProtoInstanceWithNullPrototype):
2811         (assert):
2812         (validate):
2813         * stress/poly-proto-op-in-caching.js: Added.
2814         (assert):
2815         (makePolyProtoObject.foo.C):
2816         (makePolyProtoObject.foo):
2817         (makePolyProtoObject):
2818         (validate):
2819         (validate2):
2820         * stress/poly-proto-put-transition.js: Added.
2821         (assert):
2822         (makePolyProtoObject.foo.C):
2823         (makePolyProtoObject.foo):
2824         (makePolyProtoObject):
2825         (performSet):
2826         (i.obj.__proto__.set p):
2827         * stress/poly-proto-set-prototype.js: Added.
2828         (assert):
2829         (let.alternateProto.get x):
2830         (let.alternateProto2.get y):
2831         (let.alternateProto2.get x):
2832         (foo.C):
2833         (foo):
2834         (validate):
2835         * stress/poly-proto-setter.js: Added.
2836         (assert):
2837         (makePolyProtoObject.foo.C):
2838         (makePolyProtoObject.foo.C.prototype.set p):
2839         (makePolyProtoObject.foo.C.prototype.get p):
2840         (makePolyProtoObject.foo):
2841         (makePolyProtoObject):
2842         (performSet):
2843         * stress/poly-proto-using-inheritance.js: Added.
2844         (assert):
2845         (foo.C):
2846         (foo.C.prototype.get baz):
2847         (foo):
2848         (bar.C):
2849         (bar):
2850         (validate):
2851         * stress/primitive-poly-proto.js: Added.
2852         (makePolyProtoInstance.foo.C):
2853         (makePolyProtoInstance.foo):
2854         (makePolyProtoInstance):
2855         (assert):
2856         (validate):
2857         * stress/prototype-is-not-js-object.js: Added.
2858         (foo.bar):
2859         (foo):
2860         (assert):
2861         (validate):
2862         * stress/try-get-by-id-poly-proto.js: Added.
2863         (assert):
2864         (makePolyProtoObject.foo.C):
2865         (makePolyProtoObject.foo):
2866         (makePolyProtoObject):
2867         (tryGetByIdText):
2868         (x.__proto__.get bar):
2869         (validate):
2870         * typeProfiler/overflow.js:
2871
2872 2017-10-03  JF Bastien  <jfbastien@apple.com>
2873
2874         WebAssembly: no VM / JS version of everything but Instance
2875         https://bugs.webkit.org/show_bug.cgi?id=177473
2876
2877         Reviewed by Filip Pizlo.
2878
2879         - Exceeding max on memory growth now returns a range error as per
2880         spec. This is a (very minor) breaking change: it used to throw OOM
2881         error. Update the corresponding test.
2882
2883         * wasm/js-api/memory-grow.js:
2884         (assertEq):
2885         * wasm/js-api/table.js:
2886         (assert.throws):
2887
2888 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2889
2890         Skip JSC test stress/regress-159779-2.js on debug.
2891         https://bugs.webkit.org/show_bug.cgi?id=177204
2892
2893         Unreviewed test gardening.
2894
2895         * stress/regress-159779-2.js:
2896
2897 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2898
2899         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2900         https://bugs.webkit.org/show_bug.cgi?id=175642
2901
2902         Reviewed by Darin Adler.
2903
2904         * ChakraCore/test/Function/apply3.baseline-jsc:
2905
2906 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2907
2908         Unreviewed, rolling out r222564.
2909         https://bugs.webkit.org/show_bug.cgi?id=177720
2910
2911         "It regressed JetStream by 2% on iOS caused by a 50%
2912         regression on the bigfib subtest" (Requested by saamyjoon on
2913         #webkit).
2914
2915         Reverted changeset:
2916
2917         "Add Above/Below comparisons for UInt32 patterns"
2918         https://bugs.webkit.org/show_bug.cgi?id=177281
2919         http://trac.webkit.org/changeset/222564
2920
2921 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2922
2923         [DFG] Support ArrayPush with multiple args
2924         https://bugs.webkit.org/show_bug.cgi?id=175823
2925
2926         Reviewed by Saam Barati.
2927
2928         * microbenchmarks/array-push-0.js: Added.
2929         (arrayPush0):
2930         * microbenchmarks/array-push-1.js: Added.
2931         (arrayPush1):
2932         * microbenchmarks/array-push-2.js: Added.
2933         (arrayPush2):
2934         * microbenchmarks/array-push-3.js: Added.
2935         (arrayPush3):
2936         * stress/array-push-multiple-contiguous.js: Added.
2937         (shouldBe):
2938         (test):
2939         * stress/array-push-multiple-double-nan.js: Added.
2940         (shouldBe):
2941         (test):
2942         * stress/array-push-multiple-double.js: Added.
2943         (shouldBe):
2944         (test):
2945         * stress/array-push-multiple-int32.js: Added.
2946         (shouldBe):
2947         (test):
2948         * stress/array-push-multiple-many-contiguous.js: Added.
2949         (shouldBe):
2950         (test):
2951         * stress/array-push-multiple-many-double.js: Added.
2952         (shouldBe):
2953         (test):
2954         * stress/array-push-multiple-many-int32.js: Added.
2955         (shouldBe):
2956         (test):
2957         * stress/array-push-multiple-many-storage.js: Added.
2958         (shouldBe):
2959         (test):
2960         * stress/array-push-multiple-storage.js: Added.
2961         (shouldBe):
2962         (test):
2963         * stress/array-push-with-force-exit.js: Added.
2964         (target.createBuiltin):
2965
2966 2017-09-29  Saam Barati  <sbarati@apple.com>
2967
2968         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2969         https://bugs.webkit.org/show_bug.cgi?id=177639
2970
2971         Reviewed by Geoffrey Garen.
2972
2973         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2974         (assert):
2975         (Class):
2976         (items.forEach):
2977         (set get for):
2978
2979 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2980
2981         Unreviewed, rolling out r222563, r222565, and r222581.
2982         https://bugs.webkit.org/show_bug.cgi?id=177675
2983
2984         "It causes a crash when playing youtube videos" (Requested by
2985         saamyjoon on #webkit).
2986
2987         Reverted changesets:
2988
2989         "[DFG] Support ArrayPush with multiple args"
2990         https://bugs.webkit.org/show_bug.cgi?id=175823
2991         http://trac.webkit.org/changeset/222563
2992
2993         "Unreviewed, build fix after r222563"
2994         https://bugs.webkit.org/show_bug.cgi?id=175823
2995         http://trac.webkit.org/changeset/222565
2996
2997         "Unreviewed, fix x86 breaking due to exhausted registers"
2998         https://bugs.webkit.org/show_bug.cgi?id=175823
2999         http://trac.webkit.org/changeset/222581
3000
3001 2017-09-28  Mark Lam  <mark.lam@apple.com>
3002
3003         test262: Unexpected passes after r222617 and r222618.
3004         https://bugs.webkit.org/show_bug.cgi?id=177622
3005         <rdar://problem/34725960>
3006
3007         Reviewed by Saam Barati.
3008
3009         Update test262.yaml for tests that are now passing.
3010
3011         * test262.yaml:
3012
3013 2017-09-27  Michael Saboff  <msaboff@apple.com>
3014
3015         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
3016         https://bugs.webkit.org/show_bug.cgi?id=177570
3017
3018         Reviewed by Filip Pizlo.
3019
3020         New regression test.
3021
3022         * stress/regress-177570.js: Added.
3023
3024 2017-09-28  Michael Saboff  <msaboff@apple.com>
3025
3026         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
3027         https://bugs.webkit.org/show_bug.cgi?id=177423
3028
3029         Reviewed by Mark Lam.
3030
3031         Updated regression test.
3032
3033         * stress/regress-177423.js:
3034         (catch):
3035
3036 2017-09-27  Mark Lam  <mark.lam@apple.com>
3037
3038         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
3039         https://bugs.webkit.org/show_bug.cgi?id=177584
3040         <rdar://problem/34463903>
3041
3042         Reviewed by Saam Barati.
3043
3044         * stress/regress-177584.js: Added.
3045         (assertEqual):
3046         (Array.prototype.Symbol.species):
3047
3048 2017-09-27  Saam Barati  <sbarati@apple.com>
3049
3050         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
3051         https://bugs.webkit.org/show_bug.cgi?id=177523
3052
3053         Reviewed by Mark Lam.
3054
3055         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
3056         (assert):
3057         (Test):
3058         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
3059         (addMethods):
3060         (i.Test.prototype.propName):
3061
3062 2017-09-27  Mark Lam  <mark.lam@apple.com>
3063
3064         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
3065         https://bugs.webkit.org/show_bug.cgi?id=177423
3066         <rdar://problem/34621320>
3067
3068         Reviewed by Keith Miller.
3069
3070         * stress/regress-177423.js: Added.
3071
3072 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3073
3074         Add Above/Below comparisons for UInt32 patterns
3075         https://bugs.webkit.org/show_bug.cgi?id=177281
3076
3077         Reviewed by Saam Barati.
3078
3079         * stress/uint32-comparison-jump.js: Added.
3080         (shouldBe):
3081         (above):
3082         (aboveOrEqual):
3083         (below):
3084         (belowOrEqual):
3085         (notAbove):
3086         (notAboveOrEqual):
3087         (notBelow):
3088         (notBelowOrEqual):
3089         * stress/uint32-comparison.js: Added.
3090         (shouldBe):
3091         (above):
3092         (aboveOrEqual):
3093         (below):
3094         (belowOrEqual):
3095         (aboveTest):
3096         (aboveOrEqualTest):
3097         (belowTest):
3098         (belowOrEqualTest):
3099
3100 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3101
3102         [DFG] Support ArrayPush with multiple args
3103         https://bugs.webkit.org/show_bug.cgi?id=175823
3104
3105         Reviewed by Saam Barati.
3106
3107         * microbenchmarks/array-push-0.js: Added.
3108         (arrayPush0):
3109         * microbenchmarks/array-push-1.js: Added.
3110         (arrayPush1):
3111         * microbenchmarks/array-push-2.js: Added.
3112         (arrayPush2):
3113         * microbenchmarks/array-push-3.js: Added.
3114         (arrayPush3):
3115         * stress/array-push-multiple-contiguous.js: Added.
3116         (shouldBe):
3117         (test):
3118         * stress/array-push-multiple-double-nan.js: Added.
3119         (shouldBe):
3120         (test):
3121         * stress/array-push-multiple-double.js: Added.
3122         (shouldBe):
3123         (test):
3124         * stress/array-push-multiple-int32.js: Added.
3125         (shouldBe):
3126         (test):
3127         * stress/array-push-multiple-many-contiguous.js: Added.
3128         (shouldBe):
3129         (test):
3130         * stress/array-push-multiple-many-double.js: Added.
3131         (shouldBe):
3132         (test):
3133         * stress/array-push-multiple-many-int32.js: Added.
3134         (shouldBe):
3135         (test):
3136         * stress/array-push-multiple-many-storage.js: Added.
3137         (shouldBe):
3138         (test):
3139         * stress/array-push-multiple-storage.js: Added.
3140         (shouldBe):
3141         (test):
3142
3143 2017-09-26  Commit Queue  <commit-queue@webkit.org>
3144
3145         Unreviewed, rolling out r222518.
3146         https://bugs.webkit.org/show_bug.cgi?id=177507
3147
3148         Break the High Sierra build (Requested by yusukesuzuki on
3149         #webkit).
3150
3151         Reverted changeset:
3152
3153         "Add Above/Below comparisons for UInt32 patterns"
3154         https://bugs.webkit.org/show_bug.cgi?id=177281
3155         http://trac.webkit.org/changeset/222518
3156
3157 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3158
3159         Add Above/Below comparisons for UInt32 patterns
3160         https://bugs.webkit.org/show_bug.cgi?id=177281
3161
3162         Reviewed by Saam Barati.
3163
3164         * stress/uint32-comparison-jump.js: Added.
3165         (shouldBe):
3166         (above):
3167         (aboveOrEqual):
3168         (below):
3169         (belowOrEqual):
3170         (notAbove):
3171         (notAboveOrEqual):
3172         (notBelow):
3173         (notBelowOrEqual):
3174         * stress/uint32-comparison.js: Added.
3175         (shouldBe):
3176         (above):
3177         (aboveOrEqual):
3178         (below):
3179         (belowOrEqual):
3180         (aboveTest):
3181         (aboveOrEqualTest):
3182         (belowTest):
3183         (belowOrEqualTest):
3184
3185 2017-09-23  Keith Miller  <keith_miller@apple.com>
3186
3187         Fix infinite looping test262 test
3188         https://bugs.webkit.org/show_bug.cgi?id=177412
3189
3190         Reviewed by Yusuke Suzuki.
3191
3192         This test was poorly designed since failing it would cause the vm
3193         to inifinite loop. I've fixed it locally and will fix it on github pending
3194         the results of next weeks tc39 meeting.
3195
3196         * test262.yaml:
3197         * test262/test/language/statements/for-of/iterator-next-reference.js:
3198
3199 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
3200
3201         test262: $.agent became $262.agent in test262 update
3202         https://bugs.webkit.org/show_bug.cgi?id=177407
3203
3204         Reviewed by Yusuke Suzuki.
3205
3206         * test262.yaml:
3207         ~320 tests pass now that we correctly make $262 available.
3208
3209 2017-09-22  Keith Miller  <keith_miller@apple.com>
3210
3211         Speculatively change iteration protocall to use the same next function
3212         https://bugs.webkit.org/show_bug.cgi?id=175653
3213
3214         Reviewed by Saam Barati.
3215
3216         Change test to match the new iteration behavior.
3217
3218         * stress/spread-optimized-properly.js:
3219
3220 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3221
3222         [DFG][FTL] Profile array vector length for array allocation
3223         https://bugs.webkit.org/show_bug.cgi?id=177051
3224
3225         Reviewed by Saam Barati.
3226
3227         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
3228         (target):
3229
3230 2017-09-22  Commit Queue  <commit-queue@webkit.org>
3231
3232         Unreviewed, rolling out r222380.
3233         https://bugs.webkit.org/show_bug.cgi?id=177352
3234
3235         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
3236         #webkit).
3237
3238         Reverted changeset:
3239
3240         "[DFG][FTL] Profile array vector length for array allocation"
3241         https://bugs.webkit.org/show_bug.cgi?id=177051
3242         http://trac.webkit.org/changeset/222380
3243
3244 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3245
3246         [DFG][FTL] Profile array vector length for array allocation
3247         https://bugs.webkit.org/show_bug.cgi?id=177051
3248
3249         Reviewed by Saam Barati.
3250
3251         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
3252         (target):
3253
3254 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
3255
3256         Skip new hanging test262 tests.
3257         https://bugs.webkit.org/show_bug.cgi?id=177326
3258
3259         Unreviewed test gardening.
3260
3261         * test262.yaml:
3262
3263 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
3264
3265         Mark 6 test262 tests as passing.
3266         https://bugs.webkit.org/show_bug.cgi?id=177307
3267
3268         Unreviewed test gardening.
3269
3270         * test262.yaml:
3271
3272 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
3273
3274         Unreviewed follow-up to r222311.
3275
3276         * test262/harness/sta.js:
3277         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
3278         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
3279         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
3280         * test262/test/built-ins/Array/from/elements-added-after.js:
3281         * test262/test/built-ins/Array/from/elements-deleted-after.js:
3282         * test262/test/built-ins/Array/from/elements-updated-after.js:
3283         * test262/test/built-ins/Array/from/from-array.js:
3284         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
3285         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
3286         * test262/test/built-ins/Array/from/source-array-boundary.js:
3287         * test262/test/built-ins/Array/from/source-object-constructor.js:
3288         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
3289         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
3290         * test262/test/built-ins/Array/from/source-object-length.js:
3291         * test262/test/built-ins/Array/from/source-object-missing.js:
3292         * test262/test/built-ins/Array/from/source-object-without.js:
3293         * test262/test/built-ins/Array/from/this-null.js:
3294         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
3295         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
3296         * test262/test/language/literals/numeric/7.8.3-1gs.js:
3297         * test262/test/language/literals/numeric/7.8.3-2gs.js:
3298         * test262/test/language/literals/numeric/7.8.3-3gs.js:
3299         * test262/test/language/literals/regexp/7.8.5-1gs.js:
3300         * test262/test/language/literals/string/7.8.4-1gs.js:
3301         Fix some files that I failed to update when I applied my patch.
3302
3303 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
3304
3305         Update test262 tests
3306         https://bugs.webkit.org/show_bug.cgi?id=177220
3307
3308         Reviewed by Saam Barati and Yusuke Suzuki.
3309
3310         * test262.yaml:
3311         * test262/test262-Revision.txt:
3312         New rebaselined expectations for all tests.
3313
3314         * test262/*:
3315         Updated.
3316
3317 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
3318
3319         [DFG] Remove ToThis more aggressively
3320         https://bugs.webkit.org/show_bug.cgi?id=177056
3321
3322         Reviewed by Saam Barati.
3323
3324         * stress/generator-with-this-strict.js: Added.
3325         (shouldBe):
3326         (generator):
3327         (target):
3328         * stress/generator-with-this.js: Added.
3329         (shouldBe):
3330         (generator):
3331         (target):
3332
3333 2017-09-17  Michael Saboff  <msaboff@apple.com>
3334
3335         https://bugs.webkit.org/show_bug.cgi?id=177038
3336         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
3337
3338         Reviewed by JF Bastien.
3339
3340         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
3341         as it dies using too much memory.
3342
3343 2017-09-15  Saam Barati  <sbarati@apple.com>
3344
3345         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
3346         https://bugs.webkit.org/show_bug.cgi?id=176981
3347
3348         Reviewed by Yusuke Suzuki.
3349
3350         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
3351         (assert):
3352         (verify):
3353         (func):
3354         (const.bar.createBuiltin):
3355
3356 2017-09-14  Saam Barati  <sbarati@apple.com>
3357
3358         It should be valid to exit before each set when doing arity fixup when inlining
3359         https://bugs.webkit.org/show_bug.cgi?id=176948
3360
3361         Reviewed by Keith Miller.
3362
3363         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
3364         (baz):
3365         (bar):
3366         (foo):
3367
3368 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
3369
3370         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
3371         https://bugs.webkit.org/show_bug.cgi?id=176867
3372
3373         Reviewed by Sam Weinig.
3374
3375         * microbenchmarks/object-get-own-property-symbols.js: Added.
3376         (test):
3377
3378 2017-09-13  Mark Lam  <mark.lam@apple.com>
3379
3380         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
3381         https://bugs.webkit.org/show_bug.cgi?id=176888
3382         <rdar://problem/34381832>
3383
3384         Not reviewed.
3385
3386         * stress/op_mod-ConstVar.js:
3387         * stress/op_mod-VarConst.js:
3388         * stress/op_mod-VarVar.js:
3389
3390 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
3391
3392         Skip 3 op_mod tests on Debug JSC bots.
3393         https://bugs.webkit.org/show_bug.cgi?id=176630
3394
3395         Unreviewed test gardening.
3396
3397         * stress/op_mod-ConstVar.js:
3398         * stress/op_mod-VarConst.js:
3399         * stress/op_mod-VarVar.js:
3400
3401 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3402
3403         [JSC] Fix Array allocation in Object.keys
3404         https://bugs.webkit.org/show_bug.cgi?id=176826
3405
3406         Reviewed by Saam Barati.
3407
3408         * stress/object-own-property-keys.js: Added.
3409         (shouldBe):
3410
3411 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3412
3413         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3414         https://bugs.webkit.org/show_bug.cgi?id=176010
3415
3416         Reviewed by Filip Pizlo.
3417
3418         * microbenchmarks/weak-map-key.js: Added.
3419         (assert):
3420         (objectKey):
3421         (let.start.Date.now):
3422
3423 2017-09-12  Mark Lam  <mark.lam@apple.com>
3424
3425         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
3426         https://bugs.webkit.org/show_bug.cgi?id=176630
3427
3428         Reviewed by JF Bastien.
3429
3430         Debug builds are just slow, and these tests do a lot.  They pass when I run them
3431         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
3432         a speculative fix for the bots that are seeing these fail.
3433
3434         I also undid the skipping of the op_mod tests for debug builds.
3435
3436         * stress/op_div-ConstVar.js:
3437         * stress/op_div-VarConst.js:
3438         * stress/op_div-VarVar.js:
3439         * stress/op_mod-ConstVar.js:
3440         * stress/op_mod-VarConst.js:
3441         * stress/op_mod-VarVar.js:
3442
3443 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
3444
3445         Skip stress/value-to-boolean.js on Debug bots.
3446         https://bugs.webkit.org/show_bug.cgi?id=176787
3447
3448         Unreviewed test gardening.
3449
3450         * stress/value-to-boolean.js:
3451
3452 2017-09-11  Mark Lam  <mark.lam@apple.com>
3453
3454         Change test expectation for test262/test/language/statements/try/tco-catch.js
3455         https://bugs.webkit.org/show_bug.cgi?id=176749
3456
3457         Rubber stamped by Keith Miller.
3458
3459         It's been failing since at least r221821.  I'm changing the test expectation to
3460         fail to green the bots while I investigate some more.
3461
3462         * test262.yaml:
3463
3464 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
3465
3466         Unreviewed, rolling out r221854.
3467
3468         The test added with this change fails on 32-bit JSC bots.
3469
3470         Reverted changeset:
3471
3472         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
3473         https://bugs.webkit.org/show_bug.cgi?id=176010
3474         http://trac.webkit.org/changeset/221854
3475
3476 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3477
3478         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3479         https://bugs.webkit.org/show_bug.cgi?id=176010
3480
3481         Reviewed by Filip Pizlo.
3482
3483         * microbenchmarks/weak-map-key.js: Added.
3484         (assert):
3485         (objectKey):
3486         (let.start.Date.now):
3487
3488 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3489
3490         [JSC] Optimize Object.keys by using careful array allocation
3491         https://bugs.webkit.org/show_bug.cgi?id=176654
3492
3493         Reviewed by Darin Adler.
3494
3495         * microbenchmarks/object-keys.js: Added.
3496         (test):
3497
3498 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
3499
3500         Error should compute .stack and friends lazily
3501         https://bugs.webkit.org/show_bug.cgi?id=176645
3502
3503         Reviewed by Saam Barati.
3504
3505         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
3506         * microbenchmarks/new-error.js: Added.
3507         * microbenchmarks/throw.js: Added.
3508
3509 2017-09-09  Mark Lam  <mark.lam@apple.com>
3510
3511         [Re-landing] Use JIT probes for DFG OSR exit.
3512         https://bugs.webkit.org/show_bug.cgi?id=175144
3513         <rdar://problem/33437050>
3514
3515         Not reviewed.  Original patch reviewed by Saam Barati.
3516
3517         Disable these tests for debug builds because they run too slow with the new OSR exit.
3518
3519         * stress/op_mod-ConstVar.js:
3520         * stress/op_mod-VarConst.js:
3521         * stress/op_mod-VarVar.js:
3522
3523 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3524
3525         [DFG] NewArrayWithSize(size)'s size does not care negative zero
3526         https://bugs.webkit.org/show_bug.cgi?id=176300
3527
3528         Reviewed by Saam Barati.
3529
3530         * stress/new-array-with-size-div.js: Added.
3531         (shouldBe):
3532         (test):
3533         (i.i):
3534
3535 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3536
3537         [DFG] PutByVal with Array::Generic is too generic
3538         https://bugs.webkit.org/show_bug.cgi?id=176345
3539
3540         Reviewed by Filip Pizlo.
3541
3542         * stress/object-assign-symbols.js: Added.
3543         (shouldBe):
3544         (test):
3545         * stress/object-assign.js: Added.
3546         (shouldBe):
3547         (test):
3548         (i.shouldBe.JSON.stringify.test):
3549
3550 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3551
3552         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3553         https://bugs.webkit.org/show_bug.cgi?id=176590
3554
3555         Reviewed by Saam Barati.
3556
3557         * microbenchmarks/object-iterate-symbols.js: Added.
3558         (test):
3559         * microbenchmarks/object-iterate.js: Added.
3560         (test):
3561         * stress/object-iterate-symbols.js: Added.
3562         (shouldBe):
3563         (test):
3564         * stress/object-iterate.js: Added.
3565         (shouldBe):
3566         (test):
3567
3568 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3569
3570         [Win32] 10 JSC stress tests are failing.
3571         https://bugs.webkit.org/show_bug.cgi?id=176538
3572
3573         Reviewed by Mark Lam.
3574
3575         Skip tests on Windows to make the bots green.
3576
3577         * ChakraCore.yaml:
3578         * stress/date-relaxed.js:
3579
3580 2017-09-06  Mark Lam  <mark.lam@apple.com>
3581
3582         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3583         https://bugs.webkit.org/show_bug.cgi?id=176485
3584         <rdar://problem/33898874>
3585
3586         Reviewed by Keith Miller.
3587
3588         * stress/regress-176485.js: Added.
3589
3590 2017-09-05  Saam Barati  <sbarati@apple.com>
3591
3592         isNotCellSpeculation is wrong with respect to SpecEmpty
3593         https://bugs.webkit.org/show_bug.cgi?id=176429
3594
3595         Reviewed by Michael Saboff.
3596
3597         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3598         (Foo):
3599
3600 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3601
3602         test262: Completion values for control flow do not match the spec
3603         https://bugs.webkit.org/show_bug.cgi?id=171265
3604
3605         Reviewed by Saam Barati.
3606
3607         * stress/completion-value.js:
3608         Condensed test for completion values in top level statements.
3609
3610         * stress/super-get-by-id.js:
3611         ClassDeclaration when evaled no longer produce values. Convert
3612         these to ClassExpressions so they produce the class value.
3613
3614         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3615         This is a progression for currect spec behavior.
3616
3617         * mozilla/mozilla-tests.yaml:
3618         This test is now outdated, so mark it as failing for that reason.
3619
3620         * test262.yaml:
3621         Passing all "cptn" completion value tests.
3622
3623 2017-09-04  Saam Barati  <sbarati@apple.com>
3624
3625         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3626         https://bugs.webkit.org/show_bug.cgi?id=176317
3627
3628         Reviewed by Keith Miller.
3629
3630         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3631         (Foo):
3632
3633 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3634
3635         [DFG][FTL] Efficiently execute number#toString()
3636         https://bugs.webkit.org/show_bug.cgi?id=170007
3637
3638         Reviewed by Keith Miller.
3639
3640         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3641         (test):
3642         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3643         (test):
3644         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3645         (test):
3646         * microbenchmarks/number-to-string-with-radix.js: Added.
3647         (test):
3648         * stress/number-to-string-strength-reduction.js: Added.
3649         (shouldBe):
3650         (test):
3651         * stress/number-to-string-with-radix-10.js: Added.
3652         (shouldBe):
3653         (test):
3654         * stress/number-to-string-with-radix-cse.js: Added.
3655         (shouldBe):
3656         (test):
3657         * stress/number-to-string-with-radix-invalid.js: Added.
3658         (shouldThrow):
3659         * stress/number-to-string-with-radix-watchpoint.js: Added.
3660         (shouldBe):
3661         (test):
3662         (i.i.1e3.Number.prototype.toString):
3663         * stress/number-to-string-with-radix.js: Added.
3664         (shouldBe):
3665         (test):
3666
3667 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3668
3669         [DFG] Relax arity requirement
3670         https://bugs.webkit.org/show_bug.cgi?id=175523
3671
3672         Reviewed by Saam Barati.
3673
3674         * stress/arity-mismatch-arguments-length.js: Added.
3675         (shouldBe):
3676         (test1):
3677         (test):
3678         * stress/arity-mismatch-get-argument.js: Added.
3679         (shouldBe):
3680         (builtin.createBuiltin):
3681         (test):
3682         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3683         (shouldBe):
3684         (inlineTarget):
3685         (test):
3686         * stress/arity-mismatch-inlining.js: Added.
3687         (shouldBe):
3688         (inlineTarget):
3689         (test):
3690         * stress/arity-mismatch-rest.js: Added.
3691         (shouldBe):
3692         (test2):
3693         (test1):
3694         (test):
3695
3696 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3697
3698         [JSC] Fix "name" and "length" of Proxy revoke function
3699         https://bugs.webkit.org/show_bug.cgi?id=176155
3700
3701         Reviewed by Mark Lam.
3702
3703         * test262.yaml:
3704
3705 2017-08-31  Saam Barati  <sbarati@apple.com>
3706
3707         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3708         https://bugs.webkit.org/show_bug.cgi?id=176206
3709
3710         Reviewed by Keith Miller.
3711
3712         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3713         (a):
3714         (b):
3715         (foo):
3716
3717 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3718
3719         Skip two slow JSC tests after r221422.
3720
3721         Unreviewed test gardening.
3722
3723         * stress/regexp-prototype-match-on-too-long-rope.js:
3724         * stress/regexp-prototype-test-on-too-long-rope.js:
3725
3726 2017-08-31  Filip Pizlo  <fpizlo@apple.com>