Inlining of a function that ends in op_unreachable crashes
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-03  Robin Morisset  <rmorisset@apple.com>
2
3         Inlining of a function that ends in op_unreachable crashes
4         https://bugs.webkit.org/show_bug.cgi?id=181027
5
6         Reviewed by Filip Pizlo.
7
8         * stress/inlining-unreachable.js: Added.
9         (bar):
10         (baz):
11         (i.catch):
12
13 2018-01-02  Saam Barati  <sbarati@apple.com>
14
15         Incorrect assertion inside AccessCase
16         https://bugs.webkit.org/show_bug.cgi?id=181200
17         <rdar://problem/35494754>
18
19         Reviewed by Yusuke Suzuki.
20
21         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
22         (ctor):
23         (theFunc):
24         (run):
25
26 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
27
28         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
29         https://bugs.webkit.org/show_bug.cgi?id=175359
30
31         Reviewed by Yusuke Suzuki.
32
33         * bigIntTests.yaml:
34         * stress/big-int-as-key.js: Added.
35         * stress/big-int-constructor-gc.js: Added.
36         * stress/big-int-constructor-oom.js: Added.
37         * stress/big-int-constructor-properties.js: Added.
38         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
39         * stress/big-int-constructor-prototype.js: Added.
40         * stress/big-int-constructor.js: Added.
41         * stress/big-int-function-apply.js:
42         * stress/big-int-length.js: Added.
43         * stress/big-int-prop-descriptor.js: Added.
44         * stress/big-int-proto-constructor.js: Added.
45         * stress/big-int-proto-name.js: Added.
46         * stress/big-int-prototype-properties.js: Added.
47         * stress/big-int-prototype-proto.js: Added.
48         * stress/big-int-prototype-value-of.js: Added.
49         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
50         * stress/big-int-prototype-to-string-apply.js: Added.
51         * stress/big-int-to-object.js: Added.
52         * stress/big-int-to-string.js: Added.
53
54 2017-12-28  Saam Barati  <sbarati@apple.com>
55
56         Assertion used to determine if something is an async generator is wrong
57         https://bugs.webkit.org/show_bug.cgi?id=181168
58         <rdar://problem/35640560>
59
60         Reviewed by Yusuke Suzuki.
61
62         * stress/async-generator-assertion.js: Added.
63
64 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
65
66         Skip stress/splay-flash-access tests on memory limited platforms
67         https://bugs.webkit.org/show_bug.cgi?id=181086
68
69         Reviewed by Carlos Alberto Lopez Perez.
70
71         These tests use about 185M of memory, and occasionally get OOM-killed
72         on memory limited platforms.
73
74         * stress/splay-flash-access-1ms.js:
75         * stress/splay-flash-access.js:
76
77 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
78
79         Skip slow jsc tests on embedded platforms
80         https://bugs.webkit.org/show_bug.cgi?id=180937
81
82         Reviewed by Carlos Alberto Lopez Perez.
83
84         The tests typeProfiler/deltablue-for-of.js and
85         typeProfiler/getter-richards.js take a very long time in the
86         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
87         thus always timeout. They should be skipped on these platforms.
88
89         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
90         * typeProfiler/getter-richards.js: Skip on arm*/mips.
91
92 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
93
94         [JSC] Do not check isValid() in op_new_regexp
95         https://bugs.webkit.org/show_bug.cgi?id=180970
96
97         Reviewed by Saam Barati.
98
99         * stress/regexp-syntax-error-invalid-flags.js: Added.
100         (shouldThrow):
101
102 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
103
104         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
105         https://bugs.webkit.org/show_bug.cgi?id=180712
106
107         Reviewed by Michael Catanzaro.
108
109         stress/call-apply-exponential-bytecode-size.js crashes if the
110         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
111         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
112         should skip the test on other platforms.
113
114         * stress/call-apply-exponential-bytecode-size.js:
115
116 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
117
118         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
119         https://bugs.webkit.org/show_bug.cgi?id=179762
120
121         Reviewed by Saam Barati.
122
123         * stress/call-varargs-double-new-array-buffer.js: Added.
124         (assert):
125         (bar):
126         (foo):
127         * stress/call-varargs-spread-new-array-buffer.js: Added.
128         (assert):
129         (bar):
130         (foo):
131         * stress/call-varargs-spread-new-array-buffer2.js: Added.
132         (assert):
133         (bar):
134         (foo):
135         * stress/forward-varargs-double-new-array-buffer.js: Added.
136         (assert):
137         (test.baz):
138         (test.bar):
139         (test.foo):
140         (test):
141         * stress/new-array-buffer-sinking-osrexit.js: Added.
142         (target):
143         (test):
144         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
145         (shouldBe):
146         (test):
147         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
148         (shouldBe):
149         (target):
150         (test):
151         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
152         (assert):
153         (test1.bar):
154         (test1.foo):
155         (test1):
156         (test2.bar):
157         (test2.foo):
158         (test3.baz):
159         (test3.bar):
160         (test3.foo):
161         (test4.baz):
162         (test4.bar):
163         (test4.foo):
164         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
165         (assert):
166         (test.baz):
167         (test.bar):
168         (test.foo):
169         (test):
170         * stress/phantom-new-array-buffer-osr-exit.js: Added.
171         (assert):
172         (baz):
173         (bar):
174         (effects):
175         (foo):
176
177 2017-12-14  Saam Barati  <sbarati@apple.com>
178
179         The CleanUp after LICM is erroneously removing a Check
180         https://bugs.webkit.org/show_bug.cgi?id=180852
181         <rdar://problem/36063494>
182
183         Reviewed by Filip Pizlo.
184
185         * stress/dont-run-cleanup-after-licm.js: Added.
186
187 2017-12-14  Michael Saboff  <msaboff@apple.com>
188
189         REGRESSION (r225695): Repro crash on yahoo login page
190         https://bugs.webkit.org/show_bug.cgi?id=180761
191
192         Reviewed by JF Bastien.
193
194         New regression test.
195
196         * stress/regress-180761.js: Added.
197
198 2017-12-13  Keith Miller  <keith_miller@apple.com>
199
200         JSObjects should have a mask for loading indexed properties
201         https://bugs.webkit.org/show_bug.cgi?id=180768
202
203         Reviewed by Mark Lam.
204
205         * stress/int16-put-by-val-in-and-out-of-bounds.js:
206         (test):
207
208 2017-12-13  Saam Barati  <sbarati@apple.com>
209
210         Arrow functions need their own structure because they have different properties than sloppy functions
211         https://bugs.webkit.org/show_bug.cgi?id=180779
212         <rdar://problem/35814591>
213
214         Reviewed by Mark Lam.
215
216         * stress/arrow-function-needs-its-own-structure.js: Added.
217         (assert):
218         (readPrototype):
219         (noInline.let.f1):
220         (noInline):
221
222 2017-12-13  Saam Barati  <sbarati@apple.com>
223
224         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
225         https://bugs.webkit.org/show_bug.cgi?id=163579
226         <rdar://problem/35455798>
227
228         Reviewed by Mark Lam.
229
230         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
231         (assert):
232         (test1):
233         (i.test1):
234         (i.test1.C):
235         (i.test1.async.foo):
236         (i.test1.foo):
237         (test2):
238
239 2017-12-13  Saam Barati  <sbarati@apple.com>
240
241         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
242         https://bugs.webkit.org/show_bug.cgi?id=180734
243         <rdar://problem/35640547>
244
245         Reviewed by Yusuke Suzuki.
246
247         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
248         (__isPropertyOfType):
249         (__getProperties):
250         (__getObjects):
251         (__getRandomObject):
252         (theClass.):
253         (theClass):
254         (childClass):
255         (counter.catch):
256
257 2017-12-12  Saam Barati  <sbarati@apple.com>
258
259         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
260         https://bugs.webkit.org/show_bug.cgi?id=180725
261         <rdar://problem/35970511>
262
263         Reviewed by Michael Saboff.
264
265         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
266         (f1):
267         (f2):
268         (let.o2.valueOf):
269
270 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
271
272         [JSC] Implement optimized WeakMap and WeakSet
273         https://bugs.webkit.org/show_bug.cgi?id=179929
274
275         Reviewed by Saam Barati.
276
277         * microbenchmarks/weak-map-key.js:
278         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
279         (assert):
280         (objectKey):
281         (let.start.Date.now):
282         * stress/basic-weakmap.js: Added.
283         (shouldBe):
284         (test):
285         * stress/basic-weakset.js: Added.
286         (shouldBe):
287         (test.set new):
288         * stress/weakmap-cse-set-break.js: Added.
289         (shouldBe):
290         (test):
291         * stress/weakmap-cse.js: Added.
292         (shouldBe):
293         (test):
294         * stress/weakmap-gc.js: Added.
295         (test):
296         * stress/weakset-cse-add-break.js: Added.
297         (shouldBe):
298         (test.set new):
299         * stress/weakset-cse.js: Added.
300         (shouldBe):
301         (test.set new):
302         * stress/weakset-gc.js: Added.
303         (test.set add):
304         (test.set new):
305         (test):
306
307 2017-12-12  Saam Barati  <sbarati@apple.com>
308
309         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
310         https://bugs.webkit.org/show_bug.cgi?id=180723
311         <rdar://problem/35859726>
312
313         Reviewed by JF Bastien.
314
315         * stress/get-my-argument-by-val-constant-folding.js: Added.
316         (test):
317         (catch):
318
319 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
320
321         [ESNext][BigInt] Implement BigInt literals and JSBigInt
322         https://bugs.webkit.org/show_bug.cgi?id=179000
323
324         Reviewed by Darin Adler and Yusuke Suzuki.
325
326         * bigIntTests.yaml: Added.
327         * stress/big-int-literal-line-terminator.js: Added.
328         * stress/big-int-literals.js: Added.
329         * stress/big-int-operations-error.js: Added.
330         * stress/big-int-type-of.js: Added.
331         * stress/big-int-white-space-trailing-leading.js: Added.
332         * stress/big-int-function-apply.js: Added.
333
334 2017-12-11  Saam Barati  <sbarati@apple.com>
335
336         We need to disableCaching() in ErrorInstance when we materialize properties
337         https://bugs.webkit.org/show_bug.cgi?id=180343
338         <rdar://problem/35833002>
339
340         Reviewed by Mark Lam.
341
342         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
343         (assert):
344         (makeError):
345         (storeToStack):
346         (storeToStackAlreadyMaterialized):
347
348 2017-12-05  JF Bastien  <jfbastien@apple.com>
349
350         WebAssembly: don't eagerly checksum
351         https://bugs.webkit.org/show_bug.cgi?id=180441
352         <rdar://problem/35156628>
353
354         Reviewed by Saam Barati.
355
356         Checksum is now disabled, so tests only have <?> as the module
357         name.
358
359         * wasm/function-tests/nameSection.js:
360         * wasm/function-tests/stack-overflow.js:
361         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
362         (assertOverflows.assertThrows):
363         (assertOverflows):
364         * wasm/function-tests/stack-trace.js:
365
366 2017-12-04  JF Bastien  <jfbastien@apple.com>
367
368         Proxy all functions, except the $ objects
369         https://bugs.webkit.org/show_bug.cgi?id=180375
370
371         Reviewed by Saam Barati.
372
373         It looks like this test may have broken some executions because I
374         call some internal objects. Explicitly ignore objects whose name
375         starts with "$" because it's a bad idea anyways.
376
377         * stress/proxy-all-the-parameters.js:
378         (generateObjects):
379         (get throw):
380
381 2017-12-04  Saam Barati  <sbarati@apple.com>
382
383         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
384         https://bugs.webkit.org/show_bug.cgi?id=180366
385         <rdar://problem/35685877>
386
387         Reviewed by Michael Saboff.
388
389         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
390         (theParent):
391         (test1.base.getParentStaticValue):
392         (test1.base):
393         (test1.__v_24888.prototype.set prop):
394         (test1.__v_24888):
395         (test2.base.getParentStaticValue):
396         (test2.base):
397         (test2.__v_24888.prototype.set prop):
398         (test2.__v_24888):
399         (test2):
400
401 2017-12-01  JF Bastien  <jfbastien@apple.com>
402
403         Try proxying all function arguments
404         https://bugs.webkit.org/show_bug.cgi?id=180306
405
406         Reviewed by Saam Barati.
407
408         * stress/proxy-all-the-parameters.js: Added.
409         (isPropertyOfType):
410         (getProperties):
411         (generateObjects):
412         (getObjects):
413         (getFunctions):
414         (get throw):
415         (let.o.of.getObjects.let.f.of.getFunctions.catch):
416
417 2017-12-01  JF Bastien  <jfbastien@apple.com>
418
419         JavaScriptCore: missing exception checks in Math functions that take more than one argument
420         https://bugs.webkit.org/show_bug.cgi?id=180297
421         <rdar://problem/35745556>
422
423         Reviewed by Mark Lam.
424
425         * stress/math-exceptions.js: Added.
426         (get try):
427         (catch):
428
429 2017-12-01  JF Bastien  <jfbastien@apple.com>
430
431         JavaScriptCore: add test for weird class static getters
432         https://bugs.webkit.org/show_bug.cgi?id=180281
433         <rdar://problem/35592139>
434
435         Reviewed by Mark Lam.
436
437         I fixed a bug for it in r224927 and didn't add a test. Do so.
438
439         * stress/class-static-get-weird.js: Added.
440         (c.prototype.get name):
441         (c):
442         (c.prototype.get arguments):
443         (c.prototype.get caller):
444         (c.prototype.get length):
445
446 2017-12-01  Saam Barati  <sbarati@apple.com>
447
448         Having a bad time needs to handle ArrayClass indexing type as well
449         https://bugs.webkit.org/show_bug.cgi?id=180274
450         <rdar://problem/35667869>
451
452         Reviewed by Keith Miller and Mark Lam.
453
454         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
455         (assert):
456         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
457         (assert):
458
459 2017-12-01  JF Bastien  <jfbastien@apple.com>
460
461         WebAssembly: restore cached stack limit after out-call
462         https://bugs.webkit.org/show_bug.cgi?id=179106
463         <rdar://problem/35337525>
464
465         Reviewed by Saam Barati.
466
467         * wasm/function-tests/double-instance.js: Added.
468         (const.imp.boom):
469         (const.imp.get callAnother):
470
471 2017-11-30  JF Bastien  <jfbastien@apple.com>
472
473         WebAssembly: improve stack trace
474         https://bugs.webkit.org/show_bug.cgi?id=179343
475
476         Reviewed by Saam Barati.
477
478         Update the tests to follow the new format. Notably, SHA1 module
479         hash is now included in traces, and stubs are properly identified.
480
481         * wasm/assert.js: Add an assertion which matches regular expressions.
482         * wasm/function-tests/nameSection.js:
483         * wasm/function-tests/stack-overflow.js:
484         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
485         (assertOverflows.assertThrows.wasm.1):
486         (assertOverflows.assertThrows.wasm.0):
487         (assertOverflows.assertThrows):
488         (assertOverflows):
489         * wasm/function-tests/stack-trace.js:
490         (import.Builder.from.string_appeared_here.assert): Deleted.
491         * wasm/function-tests/trap-after-cross-instance-call.js:
492         (wasmFrameCountFromError):
493         * wasm/function-tests/trap-load-2.js:
494         (wasmFrameCountFromError):
495         * wasm/function-tests/trap-load.js:
496         (wasmFrameCountFromError):
497
498 2017-11-30  Mark Lam  <mark.lam@apple.com>
499
500         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
501         https://bugs.webkit.org/show_bug.cgi?id=180219
502         <rdar://problem/35696536>
503
504         Reviewed by Filip Pizlo.
505
506         * stress/regress-180219.js: Added.
507
508 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
509
510         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
511         https://bugs.webkit.org/show_bug.cgi?id=180190
512
513         Reviewed by Mark Lam.
514
515         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
516         (shouldBe):
517         (test1):
518         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
519         (shouldBe):
520         (test1):
521         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
522         (shouldBe):
523         (test1):
524         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
525         (shouldBe):
526         (test1):
527         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
528         (shouldBe):
529         (test1):
530         * stress/operation-in-may-have-negative-int32.js: Added.
531         (shouldBe):
532         (test2):
533         * stress/operation-in-negative-int32-cast.js: Added.
534         (shouldBe):
535         (test1):
536
537 2017-11-28  JF Bastien  <jfbastien@apple.com>
538
539         Strict and sloppy functions shouldn't share structure
540         https://bugs.webkit.org/show_bug.cgi?id=180103
541         <rdar://problem/35667847>
542
543         Reviewed by Saam Barati.
544
545         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
546         because the IC was wrong.
547         (foo):
548         (bar):
549         (baz):
550         (catch):
551         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
552         in this patch, but may as well test odd strict mode corner cases.
553         (bar):
554         (baz):
555         (catch):
556         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
557         (foo):
558         (bar):
559         (baz):
560         (catch):
561         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
562         next file, but with invalidation of the FunctionExecutable's
563         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
564         slower path.
565         (foo):
566         (bar.const.x):
567         (bar.const.y):
568         (bar):
569         (catch):
570         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
571         strict nesting works correctly.
572         (foo):
573         (bar.baz):
574         (bar):
575         * stress/strict-function-structure.js: Added. The test used to
576         assert in objectProtoFuncHasOwnProperty.
577         (foo):
578         (bar):
579         (baz):
580         * stress/strict-nested-function-structure.js: Added. Nesting.
581         (foo):
582         (bar):
583         (baz.boo):
584         (baz):
585
586 2017-11-29  Robin Morisset  <rmorisset@apple.com>
587
588         The recursive tail call optimisation is wrong on closures
589         https://bugs.webkit.org/show_bug.cgi?id=179835
590
591         Reviewed by Saam Barati.
592
593         * stress/closure-recursive-tail-call.js: Added.
594         (makeClosure):
595
596 2017-11-27  JF Bastien  <jfbastien@apple.com>
597
598         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
599         https://bugs.webkit.org/show_bug.cgi?id=180051
600         <rdar://problem/35614371>
601
602         Reviewed by Saam Barati.
603
604         * stress/rest-parameter-negative.js: Added.
605         (__f_5484):
606         (catch):
607         (__f_5485):
608         (__v_22598.catch):
609
610 2017-11-27  Saam Barati  <sbarati@apple.com>
611
612         Spread can escape when CreateRest does not
613         https://bugs.webkit.org/show_bug.cgi?id=180057
614         <rdar://problem/35676119>
615
616         Reviewed by JF Bastien.
617
618         * stress/spread-escapes-but-create-rest-does-not.js: Added.
619         (assert):
620         (getProperties):
621         (theFunc):
622         (let.obj.valueOf):
623
624 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
625
626         [DFG] Add NormalizeMapKey DFG IR
627         https://bugs.webkit.org/show_bug.cgi?id=179912
628
629         Reviewed by Saam Barati.
630
631         * stress/map-untyped-normalize-cse.js: Added.
632         (shouldBe):
633         (test):
634         * stress/map-untyped-normalize.js: Added.
635         (shouldBe):
636         (test):
637         * stress/set-untyped-normalize-cse.js: Added.
638         (shouldBe):
639         (set return.set has.set has):
640         * stress/set-untyped-normalize.js: Added.
641         (shouldBe):
642         (set return.set has):
643
644 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
645
646         [FTL] Support DeleteById and DeleteByVal
647         https://bugs.webkit.org/show_bug.cgi?id=180022
648
649         Reviewed by Saam Barati.
650
651         * stress/delete-by-id.js: Added.
652         (shouldBe):
653         (test1):
654         (test2):
655         * stress/delete-by-val-ftl.js: Added.
656         (shouldBe):
657         (test1):
658         (test2):
659
660 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
661
662         [DFG] Introduce {Set,Map,WeakMap}Fields
663         https://bugs.webkit.org/show_bug.cgi?id=179925
664
665         Reviewed by Saam Barati.
666
667         * stress/map-set-clobber-map-get.js: Added.
668         (shouldBe):
669         (test):
670         * stress/map-set-does-not-clobber-set-has.js: Added.
671         (shouldBe):
672         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
673         (shouldBe):
674         (test):
675         * stress/set-add-clobber-set-has.js: Added.
676         (shouldBe):
677         * stress/set-add-does-not-clobber-map-get.js: Added.
678         (shouldBe):
679
680 2017-11-24  Mark Lam  <mark.lam@apple.com>
681
682         Move unsafe jsc shell test functions to the $vm object.
683         https://bugs.webkit.org/show_bug.cgi?id=179980
684
685         Reviewed by Yusuke Suzuki.
686
687         * controlFlowProfiler/driver/driver.js:
688         * controlFlowProfiler/execution-count.js:
689         * controlFlowProfiler/if-statement.js:
690         * controlFlowProfiler/loop-statements.js:
691         * controlFlowProfiler/switch-statements.js:
692         * controlFlowProfiler/test-jit.js:
693         * exceptionFuzz/3d-cube.js:
694         * exceptionFuzz/date-format-xparb.js:
695         * exceptionFuzz/earley-boyer.js:
696         * heapProfiler/basic-edges.js:
697         * heapProfiler/property-edge-types.js:
698         * microbenchmarks/try-get-by-id-basic.js:
699         * microbenchmarks/try-get-by-id-polymorphic.js:
700         * modules/namespace-object-try-get.js:
701         * stress/argument-count-bytecode.js:
702         * stress/argument-intrinsic-basic.js:
703         * stress/argument-intrinsic-inlining-use-caller-arg.js:
704         * stress/argument-intrinsic-inlining-with-result-escape.js:
705         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
706         * stress/argument-intrinsic-inlining-with-vararg.js:
707         * stress/argument-intrinsic-nested-inlining.js:
708         * stress/argument-intrinsic-not-convert-to-get-argument.js:
709         * stress/argument-intrinsic-with-stack-write.js:
710         * stress/arity-mismatch-get-argument.js:
711         * stress/array-message-passing.js:
712         * stress/array-push-with-force-exit.js:
713         * stress/check-dom-with-signature.js:
714         * stress/check-sub-class.js:
715         * stress/compare-eq-incomplete-profile.js:
716         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
717         * stress/do-eval-virtual-call-correctly.js:
718         * stress/dom-jit-with-poly-proto.js:
719         * stress/domjit-exception-ic.js:
720         * stress/domjit-exception.js:
721         * stress/domjit-getter-complex-with-incorrect-object.js:
722         * stress/domjit-getter-complex.js:
723         * stress/domjit-getter-poly.js:
724         * stress/domjit-getter-proto.js:
725         * stress/domjit-getter-super-poly.js:
726         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
727         * stress/domjit-getter-type-check.js:
728         * stress/domjit-getter.js:
729         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
730         * stress/for-in-proxy-target-changed-structure.js:
731         * stress/for-in-proxy.js:
732         * stress/generational-opaque-roots.js:
733         * stress/global-const-redeclaration-setting-2.js:
734         * stress/global-const-redeclaration-setting-3.js:
735         * stress/global-const-redeclaration-setting-4.js:
736         * stress/global-const-redeclaration-setting-5.js:
737         * stress/global-const-redeclaration-setting.js:
738         * stress/import-basic.js:
739         * stress/import-from-eval.js:
740         * stress/import-reject-with-exception.js:
741         * stress/import-syntax.js:
742         * stress/impure-get-own-property-slot-inline-cache.js:
743         * stress/is-constructor.js:
744         * stress/istypedarrayview-intrinsic.js:
745         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
746         * stress/jsc-test-functions-should-be-more-robust.js:
747         * stress/object-toString-with-proxy.js:
748         * stress/poly-proto-custom-value-and-accessor.js:
749         * stress/proxy-inline-cache.js:
750         * stress/re-execute-error-module.js:
751         * stress/regress-150532.js:
752         * stress/regress-156992.js:
753         * stress/regress-179619.js:
754         * stress/resources/shadow-chicken-support.js:
755         * stress/runtime-array.js:
756         * stress/sampling-profiler-microtasks.js:
757         * stress/shadow-chicken-enabled.js:
758         * stress/spread-correct-global-object-on-exception.js:
759         * stress/super-get-by-id.js:
760         * stress/tailCallForwardArguments.js:
761         * stress/to-object-intrinsic-boolean-edge.js:
762         * stress/to-object-intrinsic-null-or-undefined-edge.js:
763         * stress/to-object-intrinsic-number-edge.js:
764         * stress/to-object-intrinsic-object-edge.js:
765         * stress/to-object-intrinsic-string-edge.js:
766         * stress/to-object-intrinsic-symbol-edge.js:
767         * stress/to-object-intrinsic.js:
768         * stress/try-catch-custom-getter-as-get-by-id.js:
769         * stress/try-get-by-id-poly-proto.js:
770         * stress/try-get-by-id-should-spill-registers-dfg.js:
771         * stress/try-get-by-id.js:
772         * typeProfiler/arrow-functions.js:
773         * typeProfiler/basic.js:
774         * typeProfiler/captured.js:
775         * typeProfiler/classes.js:
776         * typeProfiler/dfg-jit-optimizations.js:
777         * typeProfiler/dictionary-mode.js:
778         * typeProfiler/es6-block-scoping.js:
779         * typeProfiler/es6-classes.js:
780         * typeProfiler/inheritance.js:
781         * typeProfiler/int52-dfg.js:
782         * typeProfiler/loop.js:
783         * typeProfiler/optional-fields.js:
784         * typeProfiler/overflow.js:
785         * typeProfiler/return.js:
786         * typeProfiler/symbol.js:
787         * typeProfiler/weird-prototype-chain.js:
788
789 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
790
791         [DFG][FTL] Support MapSet / SetAdd intrinsics
792         https://bugs.webkit.org/show_bug.cgi?id=179858
793
794         Reviewed by Saam Barati.
795
796         * microbenchmarks/map-has-and-set.js: Added.
797         (test):
798         * stress/map-set-check-failure.js: Added.
799         (shouldBe):
800         (shouldThrow):
801         (target):
802         * stress/map-set-cse.js: Added.
803         (shouldBe):
804         (test):
805         * stress/set-add-check-failure.js: Added.
806         (shouldBe):
807         (shouldThrow):
808         (set shouldThrow):
809         * stress/set-add-cse.js: Added.
810         (shouldBe):
811
812 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
813
814         [JSC] Allow poly proto for intrinsic getters
815         https://bugs.webkit.org/show_bug.cgi?id=179550
816
817         Reviewed by Saam Barati.
818
819         This change is also tested by existing tests.
820
821             1. stress/intrinsic-getter-with-poly-proto.js
822             2. stress/poly-proto-intrinsic-getter-correctness.js
823
824         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
825         (shouldBe):
826         (makePolyProtoObject.foo.C):
827         (makePolyProtoObject.foo):
828         (makePolyProtoObject):
829         (target):
830         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
831         (shouldBe):
832         (makePolyProtoObject.foo.C):
833         (makePolyProtoObject.foo):
834         (makePolyProtoObject):
835         (target):
836
837 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
838
839         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
840         https://bugs.webkit.org/show_bug.cgi?id=179744
841
842         Reviewed by Michael Catanzaro.
843
844         This test uses too much memory for our buildbots on these platforms
845         and gets OOM-killed.
846
847         * stress/unshiftCountSlowCase-correct-postCapacity.js:
848         Skip if $memoryLimited and linux.
849
850 2017-11-17  JF Bastien  <jfbastien@apple.com>
851
852         WebAssembly JS API: throw when a promise can't be created
853         https://bugs.webkit.org/show_bug.cgi?id=179826
854         <rdar://problem/35455813>
855
856         Reviewed by Mark Lam.
857
858         Test WebAssembly.{compile,instantiate} where promise creation
859         fails because of a stack overflow.
860
861         * wasm/js-api/promise-stack-overflow.js: Added.
862         (const.runNearStackLimit.f.const.t):
863         (async.testCompile):
864         (async.testInstantiate):
865
866 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
867
868         Unreviewed, mark regress-178385.js as memory exhausting
869
870         * stress/regress-178385.js:
871
872 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
873
874         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
875
876         Unreviewed test gardening.
877
878         * test262.yaml:
879
880 2017-11-16  Robin Morisset  <rmorisset@apple.com>
881
882         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
883         https://bugs.webkit.org/show_bug.cgi?id=179763
884         <rdar://problem/35550513>
885
886         Reviewed by Keith Miller.
887
888         Just adding a slightly cleaned-up version of the original fuzzer-found test.
889
890         * stress/tdz-this-in-try-catch.js: Added.
891         (__v_6388):
892         (__v_6392):
893
894 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
895
896         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
897         https://bugs.webkit.org/show_bug.cgi?id=179594
898
899         Reviewed by Saam Barati.
900
901         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
902         (shouldBe):
903         (args):
904         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
905         (shouldBe):
906         (args):
907
908 2017-11-14  Saam Barati  <sbarati@apple.com>
909
910         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
911         https://bugs.webkit.org/show_bug.cgi?id=179639
912         <rdar://problem/35513018>
913
914         Reviewed by JF Bastien.
915
916         * wasm/function-tests/grow-memory-cause-gc.js: Added.
917         (escape):
918         (i.func):
919
920 2017-11-13  Mark Lam  <mark.lam@apple.com>
921
922         Add more overflow check book-keeping for MarkedArgumentBuffer.
923         https://bugs.webkit.org/show_bug.cgi?id=179634
924         <rdar://problem/35492517>
925
926         Reviewed by Saam Barati.
927
928         * stress/regress-179634.js: Added.
929
930 2017-11-13  Mark Lam  <mark.lam@apple.com>
931
932         Make the jsc shell loadGetterFromGetterSetter() function more robust.
933         https://bugs.webkit.org/show_bug.cgi?id=179619
934         <rdar://problem/35492518>
935
936         Reviewed by Saam Barati.
937
938         * stress/regress-179619.js: Added.
939
940 2017-11-12  Mark Lam  <mark.lam@apple.com>
941
942         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
943         https://bugs.webkit.org/show_bug.cgi?id=179562
944         <rdar://problem/35467022>
945
946         Reviewed by Saam Barati.
947
948         * regress-179562.js: Added.
949
950 2017-11-08  Saam Barati  <sbarati@apple.com>
951
952         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
953         https://bugs.webkit.org/show_bug.cgi?id=177792
954
955         Reviewed by Yusuke Suzuki.
956
957         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
958         (assert):
959         (foo.Foo.prototype.ensureX):
960         (foo.Foo):
961         (foo):
962         (access):
963
964 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
965
966         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
967         https://bugs.webkit.org/show_bug.cgi?id=178592
968
969         Unreviewed test gardening.
970
971         * test262.yaml:
972
973 2017-11-08  Robin Morisset  <rmorisset@apple.com>
974
975         Turn recursive tail calls into loops
976         https://bugs.webkit.org/show_bug.cgi?id=176601
977
978         Reviewed by Saam Barati.
979
980         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
981
982         Add some simple test that computes factorial in several ways, and other trivial computations.
983         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
984         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
985         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
986         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
987
988         * stress/inline-call-to-recursive-tail-call.js: Added.
989         (factorial.aux):
990         (factorial):
991         (factorial2.aux2):
992         (factorial2.id):
993         (factorial2):
994         (factorial3.aux3):
995         (factorial3):
996         (aux4):
997         (factorial4):
998         (foo):
999         (auxBar):
1000         (bar):
1001         (test):
1002
1003 2017-11-07  Mark Lam  <mark.lam@apple.com>
1004
1005         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1006         https://bugs.webkit.org/show_bug.cgi?id=179355
1007         <rdar://problem/35263053>
1008
1009         Reviewed by Saam Barati.
1010
1011         * stress/regress-179355.js: Added.
1012
1013 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1014
1015         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1016         https://bugs.webkit.org/show_bug.cgi?id=144458
1017
1018         Reviewed by Saam Barati.
1019
1020         * microbenchmarks/dfg-internal-function-call.js: Added.
1021         (target):
1022         * microbenchmarks/dfg-internal-function-construct.js: Added.
1023         (target):
1024         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1025         (target):
1026         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1027         (target):
1028         * stress/dfg-internal-function-call.js: Added.
1029         (shouldBe):
1030         (target):
1031         * stress/dfg-internal-function-construct.js: Added.
1032         (shouldBe):
1033         (target):
1034         * stress/internal-function-call.js: Added.
1035         (shouldBe):
1036         * stress/internal-function-construct.js: Added.
1037         (shouldBe):
1038
1039 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1040
1041         [Win] Skip stress/regress-178385.js.
1042         https://bugs.webkit.org/show_bug.cgi?id=179298
1043
1044         Unreviewed test gardening.
1045
1046         * stress/regress-178385.js:
1047
1048 2017-11-03  Keith Miller  <keith_miller@apple.com>
1049
1050         Add test for ic with side effects
1051         https://bugs.webkit.org/show_bug.cgi?id=179268
1052
1053         Reviewed by Saam Barati.
1054
1055         * stress/put-inline-cache-side-effects.js: Added.
1056         (let.i.of.objs.keys):
1057         (f):
1058
1059 2017-11-03  Mark Lam  <mark.lam@apple.com>
1060
1061         CachedCall (and its clients) needs overflow checks.
1062         https://bugs.webkit.org/show_bug.cgi?id=179185
1063
1064         Reviewed by JF Bastien.
1065
1066         * stress/regress-179185.js: Added.
1067
1068 2017-11-02  Michael Saboff  <msaboff@apple.com>
1069
1070         DFG needs to handle code motion of code in for..in loop bodies
1071         https://bugs.webkit.org/show_bug.cgi?id=179212
1072
1073         Reviewed by Keith Miller.
1074
1075         New regression test.
1076
1077         * stress/for-in-side-effects.js: Added.
1078         (getPrototypeOf):
1079         (reset):
1080         (testWithoutFTL.f):
1081         (testWithoutFTL):
1082         (testWithFTL.f):
1083         (testWithFTL):
1084
1085 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1086
1087         AI does not correctly model the clobber case of ArithClz32
1088         https://bugs.webkit.org/show_bug.cgi?id=179188
1089
1090         Reviewed by Michael Saboff.
1091
1092         * stress/arith-clz32-effects.js: Added.
1093         (foo):
1094         (valueOf):
1095
1096 2017-11-01  Michael Saboff  <msaboff@apple.com>
1097
1098         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1099         https://bugs.webkit.org/show_bug.cgi?id=179140
1100
1101         Reviewed by Saam Barati.
1102
1103         New regression test.
1104
1105         * stress/regress-179140.js: Added.
1106         (testWithoutFTL):
1107         (testWithFTL):
1108
1109 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1110
1111         [JSC] Introduce @toObject
1112         https://bugs.webkit.org/show_bug.cgi?id=178726
1113
1114         Reviewed by Saam Barati.
1115
1116         * stress/array-copywithin.js:
1117         (shouldThrow):
1118         * stress/object-constructor-boolean-edge.js: Added.
1119         (shouldBe):
1120         (test):
1121         * stress/object-constructor-global.js: Added.
1122         (shouldBe):
1123         * stress/object-constructor-null-edge.js: Added.
1124         (shouldBe):
1125         (test):
1126         * stress/object-constructor-number-edge.js: Added.
1127         (shouldBe):
1128         (test):
1129         * stress/object-constructor-object-edge.js: Added.
1130         (shouldBe):
1131         (test):
1132         (i.arg):
1133         * stress/object-constructor-string-edge.js: Added.
1134         (shouldBe):
1135         (test):
1136         * stress/object-constructor-symbol-edge.js: Added.
1137         (shouldBe):
1138         (test):
1139         * stress/object-constructor-undefined-edge.js: Added.
1140         (shouldBe):
1141         (test):
1142         * stress/symbol-array-from.js: Added.
1143         (shouldBe):
1144         * stress/to-object-intrinsic-boolean-edge.js: Added.
1145         (shouldBe):
1146         (builtin.createBuiltin):
1147         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1148         (shouldThrow):
1149         * stress/to-object-intrinsic-number-edge.js: Added.
1150         (shouldBe):
1151         (builtin.createBuiltin):
1152         * stress/to-object-intrinsic-object-edge.js: Added.
1153         (shouldBe):
1154         (builtin.createBuiltin):
1155         (i.arg):
1156         * stress/to-object-intrinsic-string-edge.js: Added.
1157         (shouldBe):
1158         (builtin.createBuiltin):
1159         * stress/to-object-intrinsic-symbol-edge.js: Added.
1160         (shouldBe):
1161         (builtin.createBuiltin):
1162         * stress/to-object-intrinsic.js: Added.
1163         (shouldBe):
1164         (shouldThrow):
1165         (builtin.createBuiltin):
1166
1167 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1168
1169         [DFG][FTL] Introduce StringSlice
1170         https://bugs.webkit.org/show_bug.cgi?id=178934
1171
1172         Reviewed by Saam Barati.
1173
1174         * microbenchmarks/string-slice-empty.js: Added.
1175         (slice):
1176         * microbenchmarks/string-slice-one-char.js: Added.
1177         (slice):
1178         * microbenchmarks/string-slice.js: Added.
1179         (slice):
1180
1181 2017-10-26  Michael Saboff  <msaboff@apple.com>
1182
1183         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1184         https://bugs.webkit.org/show_bug.cgi?id=178890
1185
1186         Reviewed by Keith Miller.
1187
1188         New regression test.
1189
1190         * stress/regress-178890.js: Added.
1191
1192 2017-10-26  Mark Lam  <mark.lam@apple.com>
1193
1194         JSRopeString::RopeBuilder::append() should check for overflows.
1195         https://bugs.webkit.org/show_bug.cgi?id=178385
1196         <rdar://problem/35027468>
1197
1198         Reviewed by Saam Barati.
1199
1200         * stress/regress-178385.js: Added.
1201
1202 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1203
1204         Unreviewed, rolling out r223961.
1205
1206         The change that required this has been rolled out.
1207
1208         Reverted changeset:
1209
1210         "Mark test262.yaml/test262/test/language/statements/try/tco-
1211         catch.js as passing."
1212         https://bugs.webkit.org/show_bug.cgi?id=178592
1213         https://trac.webkit.org/changeset/223961
1214
1215 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1216
1217         Unreviewed, rolling out r223691 and r223729.
1218         https://bugs.webkit.org/show_bug.cgi?id=178834
1219
1220         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1221         by rniwa on #webkit).
1222
1223         Reverted changesets:
1224
1225         "Turn recursive tail calls into loops"
1226         https://bugs.webkit.org/show_bug.cgi?id=176601
1227         https://trac.webkit.org/changeset/223691
1228
1229         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1230         comparison is always false due to limited range of data type
1231         [-Wtype-limits]"
1232         https://bugs.webkit.org/show_bug.cgi?id=178543
1233         https://trac.webkit.org/changeset/223729
1234
1235 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1236
1237         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1238         https://bugs.webkit.org/show_bug.cgi?id=178592
1239
1240         Unreviewed test gardening.
1241
1242         * test262.yaml:
1243
1244 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1245
1246         [FTL] Support NewStringObject
1247         https://bugs.webkit.org/show_bug.cgi?id=178737
1248
1249         Reviewed by Saam Barati.
1250
1251         * stress/new-string-object.js: Added.
1252         (shouldBe):
1253         (test):
1254
1255 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1256
1257         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1258         https://bugs.webkit.org/show_bug.cgi?id=178308
1259
1260         Reviewed by Mark Lam.
1261
1262         * test262.yaml:
1263
1264 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1265
1266         [JSC] Use fastJoin in Array#toString
1267         https://bugs.webkit.org/show_bug.cgi?id=178062
1268
1269         Reviewed by Darin Adler.
1270
1271         * microbenchmarks/contiguous-array-to-string.js: Added.
1272         (target):
1273         * microbenchmarks/double-array-to-string.js: Added.
1274         (target):
1275         * microbenchmarks/int32-array-to-string.js: Added.
1276         (target):
1277
1278 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1279
1280         stress/check-string-ident.js is improperly skipped
1281         https://bugs.webkit.org/show_bug.cgi?id=178642
1282
1283         Reviewed by Saam Barati.
1284
1285         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1286         since it enforces the run-jsc-stress-tests script to still set up the
1287         test to run, despite the skip directive that's used before.
1288
1289 2017-10-20  Mark Lam  <mark.lam@apple.com>
1290
1291         Add a test case for r214334.
1292         https://bugs.webkit.org/show_bug.cgi?id=169941
1293         <rdar://problem/31221258>
1294
1295         Reviewed by JF Bastien.
1296
1297         * stress/regress-169941.js: Added.
1298
1299 2017-10-19  JF Bastien  <jfbastien@apple.com>
1300
1301         WebAssembly: no VM / JS version of everything but Instance
1302         https://bugs.webkit.org/show_bug.cgi?id=177473
1303
1304         Reviewed by Filip Pizlo, Saam Barati.
1305
1306         - Exceeding max on memory growth now returns a range error as per
1307         spec. This is a (very minor) breaking change: it used to throw OOM
1308         error. Update the corresponding test.
1309
1310         * wasm/js-api/memory-grow.js:
1311         (assertEq):
1312         * wasm/js-api/table.js:
1313         (assert.throws):
1314
1315 2017-10-19  Mark Lam  <mark.lam@apple.com>
1316
1317         Stringifier::appendStringifiedValue() is missing an exception check.
1318         https://bugs.webkit.org/show_bug.cgi?id=178386
1319         <rdar://problem/35027610>
1320
1321         Reviewed by Saam Barati.
1322
1323         * stress/regress-178386.js: Added.
1324
1325 2017-10-19  Michael Saboff  <msaboff@apple.com>
1326
1327         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1328         https://bugs.webkit.org/show_bug.cgi?id=178521
1329
1330         Reviewed by JF Bastien.
1331
1332         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1333         now passes with the current version (5.0) of the Emoji spec.
1334
1335 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1336
1337         Turn recursive tail calls into loops
1338         https://bugs.webkit.org/show_bug.cgi?id=176601
1339
1340         Reviewed by Saam Barati.
1341
1342         Add some simple test that computes factorial in several ways, and other trivial computations.
1343         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1344         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1345         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1346         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1347
1348         * stress/inline-call-to-recursive-tail-call.js: Added.
1349         (factorial.aux):
1350         (factorial):
1351         (factorial2.aux):
1352         (factorial2.id):
1353         (factorial2):
1354         (factorial3.aux):
1355         (factorial3):
1356         (aux):
1357         (factorial4):
1358         (test):
1359
1360 2017-10-18  Mark Lam  <mark.lam@apple.com>
1361
1362         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1363         https://bugs.webkit.org/show_bug.cgi?id=177600
1364         <rdar://problem/34710985>
1365
1366         Reviewed by Saam Barati.
1367
1368         * stress/regress-177600.js: Added.
1369
1370 2017-10-18  Mark Lam  <mark.lam@apple.com>
1371
1372         The compiler should always register a structure when it adds its transitionWatchPointSet.
1373         https://bugs.webkit.org/show_bug.cgi?id=178420
1374         <rdar://problem/34814024>
1375
1376         Reviewed by Saam Barati and Filip Pizlo.
1377
1378         * stress/regress-178420.js: Added.
1379         (new.Array.10000.map):
1380
1381 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1382
1383         [JSC] __proto__ getter should be fast
1384         https://bugs.webkit.org/show_bug.cgi?id=178067
1385
1386         Reviewed by Saam Barati.
1387
1388         * stress/dfg-object-proto-accessor.js: Added.
1389         (shouldBe):
1390         (shouldThrow):
1391         (target):
1392         * stress/dfg-object-proto-getter.js: Added.
1393         (shouldBe):
1394         (shouldThrow):
1395         (target):
1396         * stress/dfg-object-prototype-of.js: Added.
1397         (shouldBe):
1398         (shouldThrow):
1399         (target):
1400         * stress/dfg-reflect-get-prototype-of.js: Added.
1401         (shouldBe):
1402         (shouldThrow):
1403         (target):
1404         * stress/intrinsic-getter-with-poly-proto.js: Added.
1405         (shouldBe):
1406         (makePolyProtoObject.foo.C):
1407         (makePolyProtoObject.foo):
1408         (makePolyProtoObject):
1409         (target):
1410         * stress/object-get-prototype-of-filtered.js: Added.
1411         (shouldBe):
1412         (shouldThrow):
1413         (target):
1414         (i.Cocoa):
1415         * stress/object-get-prototype-of-mono-proto.js: Added.
1416         (shouldBe):
1417         (makePolyProtoObject.foo.C):
1418         (makePolyProtoObject.foo):
1419         (makePolyProtoObject):
1420         (target):
1421         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1422         (shouldBe):
1423         (makePolyProtoObject.foo.C):
1424         (makePolyProtoObject.foo):
1425         (makePolyProtoObject):
1426         (target):
1427         * stress/object-get-prototype-of-poly-proto.js: Added.
1428         (shouldBe):
1429         (makePolyProtoObject.foo.C):
1430         (makePolyProtoObject.foo):
1431         (makePolyProtoObject):
1432         (target):
1433         * stress/object-proto-getter-filtered.js: Added.
1434         (shouldBe):
1435         (shouldThrow):
1436         (target):
1437         (i.Cocoa):
1438         * stress/object-proto-getter-poly-mono-proto.js: Added.
1439         (shouldBe):
1440         (makePolyProtoObject.foo.C):
1441         (makePolyProtoObject.foo):
1442         (makePolyProtoObject):
1443         (target):
1444         * stress/object-proto-getter-poly-proto.js: Added.
1445         (shouldBe):
1446         (makePolyProtoObject.foo.C):
1447         (makePolyProtoObject.foo):
1448         (makePolyProtoObject):
1449         (target):
1450         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1451         * stress/string-proto.js: Added.
1452         (shouldBe):
1453         (target):
1454
1455 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1456
1457         Unreviewed, rolling out r223523.
1458
1459         A test for this change is failing on debug JSC bots.
1460
1461         Reverted changeset:
1462
1463         "[JSC] __proto__ getter should be fast"
1464         https://bugs.webkit.org/show_bug.cgi?id=178067
1465         https://trac.webkit.org/changeset/223523
1466
1467 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1468
1469         [JSC] __proto__ getter should be fast
1470         https://bugs.webkit.org/show_bug.cgi?id=178067
1471
1472         Reviewed by Saam Barati.
1473
1474         * stress/dfg-object-proto-accessor.js: Added.
1475         (shouldBe):
1476         (shouldThrow):
1477         (target):
1478         * stress/dfg-object-proto-getter.js: Added.
1479         (shouldBe):
1480         (shouldThrow):
1481         (target):
1482         * stress/dfg-object-prototype-of.js: Added.
1483         (shouldBe):
1484         (shouldThrow):
1485         (target):
1486         * stress/dfg-reflect-get-prototype-of.js: Added.
1487         (shouldBe):
1488         (shouldThrow):
1489         (target):
1490         * stress/object-get-prototype-of-filtered.js: Added.
1491         (shouldBe):
1492         (shouldThrow):
1493         (target):
1494         (i.Cocoa):
1495         * stress/object-get-prototype-of-mono-proto.js: Added.
1496         (shouldBe):
1497         (makePolyProtoObject.foo.C):
1498         (makePolyProtoObject.foo):
1499         (makePolyProtoObject):
1500         (target):
1501         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1502         (shouldBe):
1503         (makePolyProtoObject.foo.C):
1504         (makePolyProtoObject.foo):
1505         (makePolyProtoObject):
1506         (target):
1507         * stress/object-get-prototype-of-poly-proto.js: Added.
1508         (shouldBe):
1509         (makePolyProtoObject.foo.C):
1510         (makePolyProtoObject.foo):
1511         (makePolyProtoObject):
1512         (target):
1513         * stress/object-proto-getter-filtered.js: Added.
1514         (shouldBe):
1515         (shouldThrow):
1516         (target):
1517         (i.Cocoa):
1518         * stress/object-proto-getter-poly-mono-proto.js: Added.
1519         (shouldBe):
1520         (makePolyProtoObject.foo.C):
1521         (makePolyProtoObject.foo):
1522         (makePolyProtoObject):
1523         (target):
1524         * stress/object-proto-getter-poly-proto.js: Added.
1525         (shouldBe):
1526         (makePolyProtoObject.foo.C):
1527         (makePolyProtoObject.foo):
1528         (makePolyProtoObject):
1529         (target):
1530         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1531         * stress/string-proto.js: Added.
1532         (shouldBe):
1533         (target):
1534
1535 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1536
1537         Reland "Add Above/Below comparisons for UInt32 patterns"
1538         https://bugs.webkit.org/show_bug.cgi?id=177281
1539
1540         Reviewed by Saam Barati.
1541
1542         * stress/uint32-comparison-jump.js: Added.
1543         (shouldBe):
1544         (above):
1545         (aboveOrEqual):
1546         (below):
1547         (belowOrEqual):
1548         (notAbove):
1549         (notAboveOrEqual):
1550         (notBelow):
1551         (notBelowOrEqual):
1552         * stress/uint32-comparison.js: Added.
1553         (shouldBe):
1554         (above):
1555         (aboveOrEqual):
1556         (below):
1557         (belowOrEqual):
1558         (aboveTest):
1559         (aboveOrEqualTest):
1560         (belowTest):
1561         (belowOrEqualTest):
1562
1563 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1564
1565         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1566         https://bugs.webkit.org/show_bug.cgi?id=178210
1567
1568         Reviewed by Saam Barati.
1569
1570         * wasm/function-tests/trap-from-start-async.js:
1571         (async.StartTrapsAsync):
1572         * wasm/function-tests/trap-from-start.js:
1573         (StartTraps):
1574         * wasm/js-api/web-assembly-function.js:
1575         (assert.eq.Object.getPrototypeOf):
1576         * wasm/js-api/wrapper-function.js:
1577         (return.new.WebAssembly.Module):
1578         (assert.throws.makeInstance): Deleted.
1579         (assert.throws.Bar): Deleted.
1580         (assert.throws): Deleted.
1581
1582 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1583
1584         Enable gigacage on iOS
1585         https://bugs.webkit.org/show_bug.cgi?id=177586
1586
1587         Reviewed by JF Bastien.
1588         
1589         Add tests for when Gigacage gets runtime disabled.
1590
1591         * stress/disable-gigacage-arrays.js: Added.
1592         (foo):
1593         * stress/disable-gigacage-strings.js: Added.
1594         (foo):
1595         * stress/disable-gigacage-typed-arrays.js: Added.
1596         (foo):
1597
1598 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1599
1600         import.meta should not be assignable
1601         https://bugs.webkit.org/show_bug.cgi?id=178202
1602
1603         Reviewed by Saam Barati.
1604
1605         * modules/import-meta-assignment.js: Added.
1606         (shouldThrow):
1607         (SyntaxError.import.meta.can.shouldThrow):
1608
1609 2017-10-11  Saam Barati  <sbarati@apple.com>
1610
1611         Unreviewed. Actually skip certain type profiler tests in debug.
1612
1613         * typeProfiler.yaml:
1614         * typeProfiler/deltablue-for-of.js:
1615         * typeProfiler/getter-richards.js:
1616
1617 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1618
1619         Unreviewed, rolling out r223113 and r223121.
1620         https://bugs.webkit.org/show_bug.cgi?id=178182
1621
1622         Reintroduced 20% regression on Kraken (Requested by rniwa on
1623         #webkit).
1624
1625         Reverted changesets:
1626
1627         "Enable gigacage on iOS"
1628         https://bugs.webkit.org/show_bug.cgi?id=177586
1629         https://trac.webkit.org/changeset/223113
1630
1631         "Use one virtual allocation for all gigacages and their
1632         runways"
1633         https://bugs.webkit.org/show_bug.cgi?id=178050
1634         https://trac.webkit.org/changeset/223121
1635
1636 2017-10-11  Michael Saboff  <msaboff@apple.com>
1637
1638         Disable test262 named capture group tests with direct unicode names and with references before definitions
1639         https://bugs.webkit.org/show_bug.cgi?id=178177
1640
1641         Reviewed by Keith Miller.
1642
1643         Bugs to track fixing these test are:
1644         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1645             "Add support in named capture group identifiers for direct surrogate pairs"
1646         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1647             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1648
1649         * test262.yaml:
1650
1651 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1652
1653         Object properties are undefined in super.call() but not in this.call()
1654         https://bugs.webkit.org/show_bug.cgi?id=177230
1655
1656         Reviewed by Saam Barati.
1657
1658         * stress/super-call-function-subclass.js: Added.
1659         (assert):
1660         (A.prototype.t):
1661         (A):
1662         * stress/super-dot-call-and-apply.js: Added.
1663         (assert):
1664         (A):
1665         (A.prototype.call):
1666         (A.prototype.apply):
1667         (B.prototype.testSuper):
1668         (B):
1669         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1670         (D.prototype.testSuper):
1671         (D):
1672
1673 2017-10-10  Saam Barati  <sbarati@apple.com>
1674
1675         The prototype cache should be aware of the Executable it generates a Structure for
1676         https://bugs.webkit.org/show_bug.cgi?id=177907
1677
1678         Reviewed by Filip Pizlo.
1679
1680         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1681         (assert):
1682         (foo.C):
1683         (foo):
1684         (bar.C):
1685         (bar):
1686         (access):
1687         (makeLongChain):
1688         (accessY):
1689
1690 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1691
1692         `async` should be able to be used as an imported binding name
1693         https://bugs.webkit.org/show_bug.cgi?id=176573
1694
1695         Reviewed by Saam Barati.
1696
1697         * modules/import-default-async.js: Added.
1698         * modules/import-named-async-as.js: Added.
1699         * modules/import-named-async.js: Added.
1700         * modules/import-named-async/target.js: Added.
1701         * modules/import-namespace-async.js: Added.
1702         * test262.yaml:
1703
1704 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1705
1706         Enable gigacage on iOS
1707         https://bugs.webkit.org/show_bug.cgi?id=177586
1708
1709         Reviewed by JF Bastien.
1710         
1711         Add tests for when Gigacage gets runtime disabled.
1712
1713         * stress/disable-gigacage-arrays.js: Added.
1714         (foo):
1715         * stress/disable-gigacage-strings.js: Added.
1716         (foo):
1717         * stress/disable-gigacage-typed-arrays.js: Added.
1718         (foo):
1719
1720 2017-10-09  Michael Saboff  <msaboff@apple.com>
1721
1722         Implement RegExp Unicode property escapes
1723         https://bugs.webkit.org/show_bug.cgi?id=172069
1724
1725         Reviewed by JF Bastien.
1726
1727         Enabled Unicode Property tests.
1728
1729         * test262.yaml:
1730
1731 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1732
1733         Unreviewed, rolling out r223015 and r223025.
1734         https://bugs.webkit.org/show_bug.cgi?id=178093
1735
1736         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1737         #webkit).
1738
1739         Reverted changesets:
1740
1741         "Enable gigacage on iOS"
1742         https://bugs.webkit.org/show_bug.cgi?id=177586
1743         http://trac.webkit.org/changeset/223015
1744
1745         "Unreviewed, disable Gigacage on ARM64 Linux"
1746         https://bugs.webkit.org/show_bug.cgi?id=177586
1747         http://trac.webkit.org/changeset/223025
1748
1749 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1750
1751         Update expectations for test262 tests that pass after r223043.
1752         https://bugs.webkit.org/show_bug.cgi?id=176685
1753
1754         Unreviewed test gardening.
1755
1756         * test262.yaml:
1757
1758 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1759
1760         Unreviewed, rolling out r223022.
1761
1762         This change introduced 18 test262 failures.
1763
1764         Reverted changeset:
1765
1766         "`async` should be able to be used as an imported binding
1767         name"
1768         https://bugs.webkit.org/show_bug.cgi?id=176573
1769         http://trac.webkit.org/changeset/223022
1770
1771 2017-10-09  Saam Barati  <sbarati@apple.com>
1772
1773         3 poly-proto JSC tests timing out on debug after r222827
1774         https://bugs.webkit.org/show_bug.cgi?id=177880
1775         <rdar://problem/34817122>
1776
1777         Unreviewed.
1778
1779         I'm skipping these type profiler tests on debug since they are long running.
1780
1781         * typeProfiler/deltablue-for-of.js:
1782         * typeProfiler/getter-richards.js:
1783
1784 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1785
1786         Safari 10 /11 problem with if (!await get(something)).
1787         https://bugs.webkit.org/show_bug.cgi?id=176685
1788
1789         Reviewed by Saam Barati.
1790
1791         * stress/async-await-basic.js:
1792         (awaitEpression.async):
1793         * stress/async-await-syntax.js:
1794         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1795         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1796
1797 2017-10-08  Saam Barati  <sbarati@apple.com>
1798
1799         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1800
1801         * typeProfiler/deltablue-for-of.js:
1802         * typeProfiler/getter-richards.js:
1803
1804 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1805
1806         `async` should be able to be used as an imported binding name
1807         https://bugs.webkit.org/show_bug.cgi?id=176573
1808
1809         Reviewed by Darin Adler.
1810
1811         * modules/import-default-async.js: Added.
1812         * modules/import-named-async-as.js: Added.
1813         * modules/import-named-async.js: Added.
1814         * modules/import-named-async/target.js: Added.
1815         * modules/import-namespace-async.js: Added.
1816
1817 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1818
1819         Enable gigacage on iOS
1820         https://bugs.webkit.org/show_bug.cgi?id=177586
1821
1822         Reviewed by JF Bastien.
1823         
1824         Add tests for when Gigacage gets runtime disabled.
1825
1826         * stress/disable-gigacage-arrays.js: Added.
1827         (foo):
1828         * stress/disable-gigacage-strings.js: Added.
1829         (foo):
1830         * stress/disable-gigacage-typed-arrays.js: Added.
1831         (foo):
1832
1833 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1834
1835         Unreviewed, rolling out r222791 and r222873.
1836         https://bugs.webkit.org/show_bug.cgi?id=178031
1837
1838         Caused crashes with workers/wasm LayoutTests (Requested by
1839         ryanhaddad on #webkit).
1840
1841         Reverted changesets:
1842
1843         "WebAssembly: no VM / JS version of everything but Instance"
1844         https://bugs.webkit.org/show_bug.cgi?id=177473
1845         http://trac.webkit.org/changeset/222791
1846
1847         "WebAssembly: address no VM / JS follow-ups"
1848         https://bugs.webkit.org/show_bug.cgi?id=177887
1849         http://trac.webkit.org/changeset/222873
1850
1851 2017-10-05  Saam Barati  <sbarati@apple.com>
1852
1853         Make sure all prototypes under poly proto get added into the VM's prototype map
1854         https://bugs.webkit.org/show_bug.cgi?id=177909
1855
1856         Reviewed by Keith Miller.
1857
1858         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1859         (assert):
1860         (foo.C):
1861         (foo):
1862         (set x):
1863
1864 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1865
1866         [JSC] Introduce import.meta
1867         https://bugs.webkit.org/show_bug.cgi?id=177703
1868
1869         Reviewed by Filip Pizlo.
1870
1871         * modules/import-meta-syntax.js: Added.
1872         (shouldThrow):
1873         (shouldNotThrow):
1874         * modules/import-meta.js: Added.
1875         * modules/import-meta/cocoa.js: Added.
1876         * modules/resources/assert.js:
1877         (export.shouldNotThrow):
1878         * stress/import-syntax.js:
1879
1880 2017-10-04  Saam Barati  <sbarati@apple.com>
1881
1882         Make pertinent AccessCases watch the poly proto watchpoint
1883         https://bugs.webkit.org/show_bug.cgi?id=177765
1884
1885         Reviewed by Keith Miller.
1886
1887         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1888         (assert):
1889         (foo.C):
1890         (foo):
1891         (validate):
1892         * stress/poly-proto-clear-stub.js: Added.
1893         (assert):
1894         (foo.C):
1895         (foo):
1896
1897 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1898
1899         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1900
1901         Unreviewed test gardening.
1902
1903         * test262.yaml:
1904
1905 2017-10-04  Saam Barati  <sbarati@apple.com>
1906
1907         3 poly-proto JSC tests timing out on debug after r222827
1908         https://bugs.webkit.org/show_bug.cgi?id=177880
1909
1910         Rubber stamped by Mark Lam.
1911
1912         * microbenchmarks/poly-proto-access.js:
1913         * typeProfiler/deltablue-for-of.js:
1914         * typeProfiler/getter-richards.js:
1915
1916 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1917
1918         Unreviewed, marking tco-catch.js as a failure after test262 update
1919         https://bugs.webkit.org/show_bug.cgi?id=177859
1920
1921         * test262.yaml:
1922
1923 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1924
1925         Unreviewed, marking one async iterator test262 test failed
1926         https://bugs.webkit.org/show_bug.cgi?id=177859
1927
1928         * test262.yaml:
1929
1930 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1931
1932         [Test262] Update Test262 to Oct 4 version
1933         https://bugs.webkit.org/show_bug.cgi?id=177859
1934
1935         Reviewed by Sam Weinig.
1936
1937         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1938         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1939
1940         * test262.yaml:
1941         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1942         (checkSequence):
1943         * test262/harness/typeCoercion.js:
1944         (testCoercibleToIndexZero):
1945         (testCoercibleToIndexOne):
1946         (testCoercibleToIndexFromIndex):
1947         (testNotCoercibleToIndex.testPrimitiveValue):
1948         (testNotCoercibleToInteger):
1949         (testCoercibleToBigIntZero.testPrimitiveValue):
1950         (testCoercibleToBigIntZero):
1951         (testCoercibleToBigIntOne.testPrimitiveValue):
1952         (testCoercibleToBigIntOne):
1953         (testPrimitiveValue):
1954         (testCoercibleToBigIntFromBigInt):
1955         (testNotCoercibleToBigInt.testPrimitiveValue):
1956         (testNotCoercibleToBigInt.testStringValue):
1957         (testNotCoercibleToBigInt):
1958         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1959         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1960         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1961         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1962         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1963         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1964         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1965         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1966         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1967         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1968         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1969         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1970         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1971         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1972         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1973         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1974         (testCoercibleToBigIntZero):
1975         (testCoercibleToBigIntOne):
1976         (testNotCoercibleToBigInt):
1977         (MyError): Deleted.
1978         (valueOf): Deleted.
1979         (toString): Deleted.
1980         (Symbol.toPrimitive): Deleted.
1981         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1982         (testCoercibleToIndexZero):
1983         (testCoercibleToIndexOne):
1984         (testNotCoercibleToIndex):
1985         (MyError): Deleted.
1986         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1987         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1988         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1989         (BigInt.asIntN.valueOf): Deleted.
1990         (BigInt.asIntN.toString): Deleted.
1991         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1992         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1993         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1994         (testCoercibleToBigIntZero):
1995         (testCoercibleToBigIntOne):
1996         (testNotCoercibleToBigInt):
1997         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1998         (testCoercibleToIndexZero):
1999         (testCoercibleToIndexOne):
2000         (testNotCoercibleToIndex):
2001         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2002         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2003         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2004         (bits.valueOf):
2005         (bigint.valueOf):
2006         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2007         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2008         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2009         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2010         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2011         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2012         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2013         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2014         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2015         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2016         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2017         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2018         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2019         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2020         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2021         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2022         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2023         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2024         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2025         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2026         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2027         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2028         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2029         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2030         (replacer):
2031         (BigInt.prototype.toJSON):
2032         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2033         (replacer):
2034         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2035         (BigInt.prototype.toJSON):
2036         * test262/test/built-ins/JSON/stringify/bigint.js:
2037         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2038         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2039         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2040         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2041         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2042         * test262/test/built-ins/Object/proto-from-ctor.js:
2043         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2044         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2045         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2046         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2047         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2048         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2049         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2050         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2051         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2052         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2053         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2054         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2055         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2056         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2057         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2058         * test262/test/built-ins/Proxy/get-fn-realm.js:
2059         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2060         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2061         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2062         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2063         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2064         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2065         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2066         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2067         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2068         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2069         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2070         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2071         (i6.replace):
2072         (i6b.replace):
2073         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2074         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2075         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2076         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2077         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2078         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2079         * test262/test/built-ins/RegExp/u180e.js: Added.
2080         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2081         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2082         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2083         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2084         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2085         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2086         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2087         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2088         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2089         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2090         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2091         * test262/test/built-ins/String/prototype/endsWith/length.js:
2092         * test262/test/built-ins/String/prototype/endsWith/name.js:
2093         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2094         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2095         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2096         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2097         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2098         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2099         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2100         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2101         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2102         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2103         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2104         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2105         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2106         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2107         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2108         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2109         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2110         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2111         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2112         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2113         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2114         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2115         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2116         * test262/test/built-ins/String/prototype/includes/includes.js:
2117         * test262/test/built-ins/String/prototype/includes/length.js:
2118         * test262/test/built-ins/String/prototype/includes/name.js:
2119         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2120         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2121         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2122         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2123         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2124         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2125         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2126         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2127         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2128         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2129         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2130         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2131         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2132         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2133         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2134         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2135         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2136         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2137         * test262/test/built-ins/String/prototype/trim/u180e.js:
2138         * test262/test/built-ins/Symbol/for/cross-realm.js:
2139         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2140         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2141         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2142         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2143         * test262/test/built-ins/Symbol/match/cross-realm.js:
2144         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2145         * test262/test/built-ins/Symbol/search/cross-realm.js:
2146         * test262/test/built-ins/Symbol/species/cross-realm.js:
2147         * test262/test/built-ins/Symbol/split/cross-realm.js:
2148         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2149         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2150         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2151         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2152         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2153         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2154         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2155         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2156         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2157         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2158         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2159         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2160         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2161         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2162         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2163         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2164         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2165         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2166         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2167         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2168         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2169         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2170         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2171         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2172         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2173         * test262/test/language/eval-code/indirect/realm.js:
2174         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2175         (o.get z):
2176         (o.get a):
2177         * test262/test/language/expressions/call/eval-realm-indirect.js:
2178         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2179         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2180         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2181         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2182         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2183         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2184         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2185         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2186         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2187         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2188         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2189         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2190         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2191         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2192         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2193         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2194         * test262/test/language/expressions/less-than/bigint-and-number.js:
2195         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2196         * test262/test/language/expressions/super/realm.js:
2197         * test262/test/language/expressions/tagged-template/cache-realm.js:
2198         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2199         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2200         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2201         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2202         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2203         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2204         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2205         (o.get z):
2206         (o.get a):
2207         * test262/test/language/statements/for-of/iterator-next-reference.js:
2208         (next):
2209         (iterator.next): Deleted.
2210         (x.of.iterable.): Deleted.
2211         (x.of.iterable.get return): Deleted.
2212         (x.of.iterable.iterator.next): Deleted.
2213         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2214         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2215         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2216         * test262/test/language/white-space/mongolian-vowel-separator.js:
2217         * test262/test262-Revision.txt:
2218
2219 2017-10-03  Saam Barati  <sbarati@apple.com>
2220
2221         Implement polymorphic prototypes
2222         https://bugs.webkit.org/show_bug.cgi?id=176391
2223
2224         Reviewed by Filip Pizlo.
2225
2226         * microbenchmarks/poly-proto-access.js: Added.
2227         (assert):
2228         (foo.C):
2229         (foo.C.prototype.get bar):
2230         (foo):
2231         (bar):
2232         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2233         (assert):
2234         (makePolyProtoObject.foo.C):
2235         (makePolyProtoObject.foo):
2236         (makePolyProtoObject):
2237         (performSet):
2238         * microbenchmarks/poly-proto-setter-speed.js: Added.
2239         (assert):
2240         (makePolyProtoObject.foo.C):
2241         (makePolyProtoObject.foo.C.prototype.set p):
2242         (makePolyProtoObject.foo):
2243         (makePolyProtoObject):
2244         (performSet):
2245         * stress/constructor-with-return.js:
2246         (i.tests.forEach.Constructor):
2247         (i.tests.forEach):
2248         (tests.forEach.Constructor): Deleted.
2249         (tests.forEach): Deleted.
2250         * stress/dom-jit-with-poly-proto.js: Added.
2251         (assert):
2252         (makePolyProtoObject.foo.C):
2253         (makePolyProtoObject.foo):
2254         (makePolyProtoObject):
2255         (validate):
2256         * stress/poly-proto-custom-value-and-accessor.js: Added.
2257         (assert):
2258         (makePolyProtoObject.foo.C):
2259         (makePolyProtoObject.foo):
2260         (makePolyProtoObject):
2261         (items.forEach):
2262         (set get for):
2263         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2264         (assert):
2265         (makePolyProtoObject.foo.C):
2266         (makePolyProtoObject.foo):
2267         (makePolyProtoObject):
2268         (foo):
2269         * stress/poly-proto-miss.js: Added.
2270         (makePolyProtoInstanceWithNullPrototype.foo.C):
2271         (makePolyProtoInstanceWithNullPrototype.foo):
2272         (makePolyProtoInstanceWithNullPrototype):
2273         (assert):
2274         (validate):
2275         * stress/poly-proto-op-in-caching.js: Added.
2276         (assert):
2277         (makePolyProtoObject.foo.C):
2278         (makePolyProtoObject.foo):
2279         (makePolyProtoObject):
2280         (validate):
2281         (validate2):
2282         * stress/poly-proto-put-transition.js: Added.
2283         (assert):
2284         (makePolyProtoObject.foo.C):
2285         (makePolyProtoObject.foo):
2286         (makePolyProtoObject):
2287         (performSet):
2288         (i.obj.__proto__.set p):
2289         * stress/poly-proto-set-prototype.js: Added.
2290         (assert):
2291         (let.alternateProto.get x):
2292         (let.alternateProto2.get y):
2293         (let.alternateProto2.get x):
2294         (foo.C):
2295         (foo):
2296         (validate):
2297         * stress/poly-proto-setter.js: Added.
2298         (assert):
2299         (makePolyProtoObject.foo.C):
2300         (makePolyProtoObject.foo.C.prototype.set p):
2301         (makePolyProtoObject.foo.C.prototype.get p):
2302         (makePolyProtoObject.foo):
2303         (makePolyProtoObject):
2304         (performSet):
2305         * stress/poly-proto-using-inheritance.js: Added.
2306         (assert):
2307         (foo.C):
2308         (foo.C.prototype.get baz):
2309         (foo):
2310         (bar.C):
2311         (bar):
2312         (validate):
2313         * stress/primitive-poly-proto.js: Added.
2314         (makePolyProtoInstance.foo.C):
2315         (makePolyProtoInstance.foo):
2316         (makePolyProtoInstance):
2317         (assert):
2318         (validate):
2319         * stress/prototype-is-not-js-object.js: Added.
2320         (foo.bar):
2321         (foo):
2322         (assert):
2323         (validate):
2324         * stress/try-get-by-id-poly-proto.js: Added.
2325         (assert):
2326         (makePolyProtoObject.foo.C):
2327         (makePolyProtoObject.foo):
2328         (makePolyProtoObject):
2329         (tryGetByIdText):
2330         (x.__proto__.get bar):
2331         (validate):
2332         * typeProfiler/overflow.js:
2333
2334 2017-10-03  JF Bastien  <jfbastien@apple.com>
2335
2336         WebAssembly: no VM / JS version of everything but Instance
2337         https://bugs.webkit.org/show_bug.cgi?id=177473
2338
2339         Reviewed by Filip Pizlo.
2340
2341         - Exceeding max on memory growth now returns a range error as per
2342         spec. This is a (very minor) breaking change: it used to throw OOM
2343         error. Update the corresponding test.
2344
2345         * wasm/js-api/memory-grow.js:
2346         (assertEq):
2347         * wasm/js-api/table.js:
2348         (assert.throws):
2349
2350 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2351
2352         Skip JSC test stress/regress-159779-2.js on debug.
2353         https://bugs.webkit.org/show_bug.cgi?id=177204
2354
2355         Unreviewed test gardening.
2356
2357         * stress/regress-159779-2.js:
2358
2359 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2360
2361         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2362         https://bugs.webkit.org/show_bug.cgi?id=175642
2363
2364         Reviewed by Darin Adler.
2365
2366         * ChakraCore/test/Function/apply3.baseline-jsc:
2367
2368 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2369
2370         Unreviewed, rolling out r222564.
2371         https://bugs.webkit.org/show_bug.cgi?id=177720
2372
2373         "It regressed JetStream by 2% on iOS caused by a 50%
2374         regression on the bigfib subtest" (Requested by saamyjoon on
2375         #webkit).
2376
2377         Reverted changeset:
2378
2379         "Add Above/Below comparisons for UInt32 patterns"
2380         https://bugs.webkit.org/show_bug.cgi?id=177281
2381         http://trac.webkit.org/changeset/222564
2382
2383 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2384
2385         [DFG] Support ArrayPush with multiple args
2386         https://bugs.webkit.org/show_bug.cgi?id=175823
2387
2388         Reviewed by Saam Barati.
2389
2390         * microbenchmarks/array-push-0.js: Added.
2391         (arrayPush0):
2392         * microbenchmarks/array-push-1.js: Added.
2393         (arrayPush1):
2394         * microbenchmarks/array-push-2.js: Added.
2395         (arrayPush2):
2396         * microbenchmarks/array-push-3.js: Added.
2397         (arrayPush3):
2398         * stress/array-push-multiple-contiguous.js: Added.
2399         (shouldBe):
2400         (test):
2401         * stress/array-push-multiple-double-nan.js: Added.
2402         (shouldBe):
2403         (test):
2404         * stress/array-push-multiple-double.js: Added.
2405         (shouldBe):
2406         (test):
2407         * stress/array-push-multiple-int32.js: Added.
2408         (shouldBe):
2409         (test):
2410         * stress/array-push-multiple-many-contiguous.js: Added.
2411         (shouldBe):
2412         (test):
2413         * stress/array-push-multiple-many-double.js: Added.
2414         (shouldBe):
2415         (test):
2416         * stress/array-push-multiple-many-int32.js: Added.
2417         (shouldBe):
2418         (test):
2419         * stress/array-push-multiple-many-storage.js: Added.
2420         (shouldBe):
2421         (test):
2422         * stress/array-push-multiple-storage.js: Added.
2423         (shouldBe):
2424         (test):
2425         * stress/array-push-with-force-exit.js: Added.
2426         (target.createBuiltin):
2427
2428 2017-09-29  Saam Barati  <sbarati@apple.com>
2429
2430         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2431         https://bugs.webkit.org/show_bug.cgi?id=177639
2432
2433         Reviewed by Geoffrey Garen.
2434
2435         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2436         (assert):
2437         (Class):
2438         (items.forEach):
2439         (set get for):
2440
2441 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2442
2443         Unreviewed, rolling out r222563, r222565, and r222581.
2444         https://bugs.webkit.org/show_bug.cgi?id=177675
2445
2446         "It causes a crash when playing youtube videos" (Requested by
2447         saamyjoon on #webkit).
2448
2449         Reverted changesets:
2450
2451         "[DFG] Support ArrayPush with multiple args"
2452         https://bugs.webkit.org/show_bug.cgi?id=175823
2453         http://trac.webkit.org/changeset/222563
2454
2455         "Unreviewed, build fix after r222563"
2456         https://bugs.webkit.org/show_bug.cgi?id=175823
2457         http://trac.webkit.org/changeset/222565
2458
2459         "Unreviewed, fix x86 breaking due to exhausted registers"
2460         https://bugs.webkit.org/show_bug.cgi?id=175823
2461         http://trac.webkit.org/changeset/222581
2462
2463 2017-09-28  Mark Lam  <mark.lam@apple.com>
2464
2465         test262: Unexpected passes after r222617 and r222618.
2466         https://bugs.webkit.org/show_bug.cgi?id=177622
2467         <rdar://problem/34725960>
2468
2469         Reviewed by Saam Barati.
2470
2471         Update test262.yaml for tests that are now passing.
2472
2473         * test262.yaml:
2474
2475 2017-09-27  Michael Saboff  <msaboff@apple.com>
2476
2477         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2478         https://bugs.webkit.org/show_bug.cgi?id=177570
2479
2480         Reviewed by Filip Pizlo.
2481
2482         New regression test.
2483
2484         * stress/regress-177570.js: Added.
2485
2486 2017-09-28  Michael Saboff  <msaboff@apple.com>
2487
2488         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2489         https://bugs.webkit.org/show_bug.cgi?id=177423
2490
2491         Reviewed by Mark Lam.
2492
2493         Updated regression test.
2494
2495         * stress/regress-177423.js:
2496         (catch):
2497
2498 2017-09-27  Mark Lam  <mark.lam@apple.com>
2499
2500         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2501         https://bugs.webkit.org/show_bug.cgi?id=177584
2502         <rdar://problem/34463903>
2503
2504         Reviewed by Saam Barati.
2505
2506         * stress/regress-177584.js: Added.
2507         (assertEqual):
2508         (Array.prototype.Symbol.species):
2509
2510 2017-09-27  Saam Barati  <sbarati@apple.com>
2511
2512         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2513         https://bugs.webkit.org/show_bug.cgi?id=177523
2514
2515         Reviewed by Mark Lam.
2516
2517         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2518         (assert):
2519         (Test):
2520         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2521         (addMethods):
2522         (i.Test.prototype.propName):
2523
2524 2017-09-27  Mark Lam  <mark.lam@apple.com>
2525
2526         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2527         https://bugs.webkit.org/show_bug.cgi?id=177423
2528         <rdar://problem/34621320>
2529
2530         Reviewed by Keith Miller.
2531
2532         * stress/regress-177423.js: Added.
2533
2534 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2535
2536         Add Above/Below comparisons for UInt32 patterns
2537         https://bugs.webkit.org/show_bug.cgi?id=177281
2538
2539         Reviewed by Saam Barati.
2540
2541         * stress/uint32-comparison-jump.js: Added.
2542         (shouldBe):
2543         (above):
2544         (aboveOrEqual):
2545         (below):
2546         (belowOrEqual):
2547         (notAbove):
2548         (notAboveOrEqual):
2549         (notBelow):
2550         (notBelowOrEqual):
2551         * stress/uint32-comparison.js: Added.
2552         (shouldBe):
2553         (above):
2554         (aboveOrEqual):
2555         (below):
2556         (belowOrEqual):
2557         (aboveTest):
2558         (aboveOrEqualTest):
2559         (belowTest):
2560         (belowOrEqualTest):
2561
2562 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2563
2564         [DFG] Support ArrayPush with multiple args
2565         https://bugs.webkit.org/show_bug.cgi?id=175823
2566
2567         Reviewed by Saam Barati.
2568
2569         * microbenchmarks/array-push-0.js: Added.
2570         (arrayPush0):
2571         * microbenchmarks/array-push-1.js: Added.
2572         (arrayPush1):
2573         * microbenchmarks/array-push-2.js: Added.
2574         (arrayPush2):
2575         * microbenchmarks/array-push-3.js: Added.
2576         (arrayPush3):
2577         * stress/array-push-multiple-contiguous.js: Added.
2578         (shouldBe):
2579         (test):
2580         * stress/array-push-multiple-double-nan.js: Added.
2581         (shouldBe):
2582         (test):
2583         * stress/array-push-multiple-double.js: Added.
2584         (shouldBe):
2585         (test):
2586         * stress/array-push-multiple-int32.js: Added.
2587         (shouldBe):
2588         (test):
2589         * stress/array-push-multiple-many-contiguous.js: Added.
2590         (shouldBe):
2591         (test):
2592         * stress/array-push-multiple-many-double.js: Added.
2593         (shouldBe):
2594         (test):
2595         * stress/array-push-multiple-many-int32.js: Added.
2596         (shouldBe):
2597         (test):
2598         * stress/array-push-multiple-many-storage.js: Added.
2599         (shouldBe):
2600         (test):
2601         * stress/array-push-multiple-storage.js: Added.
2602         (shouldBe):
2603         (test):
2604
2605 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2606
2607         Unreviewed, rolling out r222518.
2608         https://bugs.webkit.org/show_bug.cgi?id=177507
2609
2610         Break the High Sierra build (Requested by yusukesuzuki on
2611         #webkit).
2612
2613         Reverted changeset:
2614
2615         "Add Above/Below comparisons for UInt32 patterns"
2616         https://bugs.webkit.org/show_bug.cgi?id=177281
2617         http://trac.webkit.org/changeset/222518
2618
2619 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2620
2621         Add Above/Below comparisons for UInt32 patterns
2622         https://bugs.webkit.org/show_bug.cgi?id=177281
2623
2624         Reviewed by Saam Barati.
2625
2626         * stress/uint32-comparison-jump.js: Added.
2627         (shouldBe):
2628         (above):
2629         (aboveOrEqual):
2630         (below):
2631         (belowOrEqual):
2632         (notAbove):
2633         (notAboveOrEqual):
2634         (notBelow):
2635         (notBelowOrEqual):
2636         * stress/uint32-comparison.js: Added.
2637         (shouldBe):
2638         (above):
2639         (aboveOrEqual):
2640         (below):
2641         (belowOrEqual):
2642         (aboveTest):
2643         (aboveOrEqualTest):
2644         (belowTest):
2645         (belowOrEqualTest):
2646
2647 2017-09-23  Keith Miller  <keith_miller@apple.com>
2648
2649         Fix infinite looping test262 test
2650         https://bugs.webkit.org/show_bug.cgi?id=177412
2651
2652         Reviewed by Yusuke Suzuki.
2653
2654         This test was poorly designed since failing it would cause the vm
2655         to inifinite loop. I've fixed it locally and will fix it on github pending
2656         the results of next weeks tc39 meeting.
2657
2658         * test262.yaml:
2659         * test262/test/language/statements/for-of/iterator-next-reference.js:
2660
2661 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2662
2663         test262: $.agent became $262.agent in test262 update
2664         https://bugs.webkit.org/show_bug.cgi?id=177407
2665
2666         Reviewed by Yusuke Suzuki.
2667
2668         * test262.yaml:
2669         ~320 tests pass now that we correctly make $262 available.
2670
2671 2017-09-22  Keith Miller  <keith_miller@apple.com>
2672
2673         Speculatively change iteration protocall to use the same next function
2674         https://bugs.webkit.org/show_bug.cgi?id=175653
2675
2676         Reviewed by Saam Barati.
2677
2678         Change test to match the new iteration behavior.
2679
2680         * stress/spread-optimized-properly.js:
2681
2682 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2683
2684         [DFG][FTL] Profile array vector length for array allocation
2685         https://bugs.webkit.org/show_bug.cgi?id=177051
2686
2687         Reviewed by Saam Barati.
2688
2689         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2690         (target):
2691
2692 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2693
2694         Unreviewed, rolling out r222380.
2695         https://bugs.webkit.org/show_bug.cgi?id=177352
2696
2697         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2698         #webkit).
2699
2700         Reverted changeset:
2701
2702         "[DFG][FTL] Profile array vector length for array allocation"
2703         https://bugs.webkit.org/show_bug.cgi?id=177051
2704         http://trac.webkit.org/changeset/222380
2705
2706 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2707
2708         [DFG][FTL] Profile array vector length for array allocation
2709         https://bugs.webkit.org/show_bug.cgi?id=177051
2710
2711         Reviewed by Saam Barati.
2712
2713         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2714         (target):
2715
2716 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2717
2718         Skip new hanging test262 tests.
2719         https://bugs.webkit.org/show_bug.cgi?id=177326
2720
2721         Unreviewed test gardening.
2722
2723         * test262.yaml:
2724
2725 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2726
2727         Mark 6 test262 tests as passing.
2728         https://bugs.webkit.org/show_bug.cgi?id=177307
2729
2730         Unreviewed test gardening.
2731
2732         * test262.yaml:
2733
2734 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2735
2736         Unreviewed follow-up to r222311.
2737
2738         * test262/harness/sta.js:
2739         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2740         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2741         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2742         * test262/test/built-ins/Array/from/elements-added-after.js:
2743         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2744         * test262/test/built-ins/Array/from/elements-updated-after.js:
2745         * test262/test/built-ins/Array/from/from-array.js:
2746         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2747         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2748         * test262/test/built-ins/Array/from/source-array-boundary.js:
2749         * test262/test/built-ins/Array/from/source-object-constructor.js:
2750         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2751         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2752         * test262/test/built-ins/Array/from/source-object-length.js:
2753         * test262/test/built-ins/Array/from/source-object-missing.js:
2754         * test262/test/built-ins/Array/from/source-object-without.js:
2755         * test262/test/built-ins/Array/from/this-null.js:
2756         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2757         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2758         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2759         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2760         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2761         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2762         * test262/test/language/literals/string/7.8.4-1gs.js:
2763         Fix some files that I failed to update when I applied my patch.
2764
2765 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2766
2767         Update test262 tests
2768         https://bugs.webkit.org/show_bug.cgi?id=177220
2769
2770         Reviewed by Saam Barati and Yusuke Suzuki.
2771
2772         * test262.yaml:
2773         * test262/test262-Revision.txt:
2774         New rebaselined expectations for all tests.
2775
2776         * test262/*:
2777         Updated.
2778
2779 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2780
2781         [DFG] Remove ToThis more aggressively
2782         https://bugs.webkit.org/show_bug.cgi?id=177056
2783
2784         Reviewed by Saam Barati.
2785
2786         * stress/generator-with-this-strict.js: Added.
2787         (shouldBe):
2788         (generator):
2789         (target):
2790         * stress/generator-with-this.js: Added.
2791         (shouldBe):
2792         (generator):
2793         (target):
2794
2795 2017-09-17  Michael Saboff  <msaboff@apple.com>
2796
2797         https://bugs.webkit.org/show_bug.cgi?id=177038
2798         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2799
2800         Reviewed by JF Bastien.
2801
2802         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2803         as it dies using too much memory.
2804
2805 2017-09-15  Saam Barati  <sbarati@apple.com>
2806
2807         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2808         https://bugs.webkit.org/show_bug.cgi?id=176981
2809
2810         Reviewed by Yusuke Suzuki.
2811
2812         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2813         (assert):
2814         (verify):
2815         (func):
2816         (const.bar.createBuiltin):
2817
2818 2017-09-14  Saam Barati  <sbarati@apple.com>
2819
2820         It should be valid to exit before each set when doing arity fixup when inlining
2821         https://bugs.webkit.org/show_bug.cgi?id=176948
2822
2823         Reviewed by Keith Miller.
2824
2825         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2826         (baz):
2827         (bar):
2828         (foo):
2829
2830 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2831
2832         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2833         https://bugs.webkit.org/show_bug.cgi?id=176867
2834
2835         Reviewed by Sam Weinig.
2836
2837         * microbenchmarks/object-get-own-property-symbols.js: Added.
2838         (test):
2839
2840 2017-09-13  Mark Lam  <mark.lam@apple.com>
2841
2842         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2843         https://bugs.webkit.org/show_bug.cgi?id=176888
2844         <rdar://problem/34381832>
2845
2846         Not reviewed.
2847
2848         * stress/op_mod-ConstVar.js:
2849         * stress/op_mod-VarConst.js:
2850         * stress/op_mod-VarVar.js:
2851
2852 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2853
2854         Skip 3 op_mod tests on Debug JSC bots.
2855         https://bugs.webkit.org/show_bug.cgi?id=176630
2856
2857         Unreviewed test gardening.
2858
2859         * stress/op_mod-ConstVar.js:
2860         * stress/op_mod-VarConst.js:
2861         * stress/op_mod-VarVar.js:
2862
2863 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2864
2865         [JSC] Fix Array allocation in Object.keys
2866         https://bugs.webkit.org/show_bug.cgi?id=176826
2867
2868         Reviewed by Saam Barati.
2869
2870         * stress/object-own-property-keys.js: Added.
2871         (shouldBe):
2872
2873 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2874
2875         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2876         https://bugs.webkit.org/show_bug.cgi?id=176010
2877
2878         Reviewed by Filip Pizlo.
2879
2880         * microbenchmarks/weak-map-key.js: Added.
2881         (assert):
2882         (objectKey):
2883         (let.start.Date.now):
2884
2885 2017-09-12  Mark Lam  <mark.lam@apple.com>
2886
2887         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2888         https://bugs.webkit.org/show_bug.cgi?id=176630
2889
2890         Reviewed by JF Bastien.
2891
2892         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2893         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2894         a speculative fix for the bots that are seeing these fail.
2895
2896         I also undid the skipping of the op_mod tests for debug builds.
2897
2898         * stress/op_div-ConstVar.js:
2899         * stress/op_div-VarConst.js:
2900         * stress/op_div-VarVar.js:
2901         * stress/op_mod-ConstVar.js:
2902         * stress/op_mod-VarConst.js:
2903         * stress/op_mod-VarVar.js:
2904
2905 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2906
2907         Skip stress/value-to-boolean.js on Debug bots.
2908         https://bugs.webkit.org/show_bug.cgi?id=176787
2909
2910         Unreviewed test gardening.
2911
2912         * stress/value-to-boolean.js:
2913
2914 2017-09-11  Mark Lam  <mark.lam@apple.com>
2915
2916         Change test expectation for test262/test/language/statements/try/tco-catch.js
2917         https://bugs.webkit.org/show_bug.cgi?id=176749
2918
2919         Rubber stamped by Keith Miller.
2920
2921         It's been failing since at least r221821.  I'm changing the test expectation to
2922         fail to green the bots while I investigate some more.
2923
2924         * test262.yaml:
2925
2926 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2927
2928         Unreviewed, rolling out r221854.
2929
2930         The test added with this change fails on 32-bit JSC bots.
2931
2932         Reverted changeset:
2933
2934         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2935         https://bugs.webkit.org/show_bug.cgi?id=176010
2936         http://trac.webkit.org/changeset/221854
2937
2938 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2939
2940         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2941         https://bugs.webkit.org/show_bug.cgi?id=176010
2942
2943         Reviewed by Filip Pizlo.
2944
2945         * microbenchmarks/weak-map-key.js: Added.
2946         (assert):
2947         (objectKey):
2948         (let.start.Date.now):
2949
2950 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2951
2952         [JSC] Optimize Object.keys by using careful array allocation
2953         https://bugs.webkit.org/show_bug.cgi?id=176654
2954
2955         Reviewed by Darin Adler.
2956
2957         * microbenchmarks/object-keys.js: Added.
2958         (test):
2959
2960 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2961
2962         Error should compute .stack and friends lazily
2963         https://bugs.webkit.org/show_bug.cgi?id=176645
2964
2965         Reviewed by Saam Barati.
2966
2967         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2968         * microbenchmarks/new-error.js: Added.
2969         * microbenchmarks/throw.js: Added.
2970
2971 2017-09-09  Mark Lam  <mark.lam@apple.com>
2972
2973         [Re-landing] Use JIT probes for DFG OSR exit.
2974         https://bugs.webkit.org/show_bug.cgi?id=175144
2975         <rdar://problem/33437050>
2976
2977         Not reviewed.  Original patch reviewed by Saam Barati.
2978
2979         Disable these tests for debug builds because they run too slow with the new OSR exit.
2980
2981         * stress/op_mod-ConstVar.js:
2982         * stress/op_mod-VarConst.js:
2983         * stress/op_mod-VarVar.js:
2984
2985 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2986
2987         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2988         https://bugs.webkit.org/show_bug.cgi?id=176300
2989
2990         Reviewed by Saam Barati.
2991
2992         * stress/new-array-with-size-div.js: Added.
2993         (shouldBe):
2994         (test):
2995         (i.i):
2996
2997 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2998
2999         [DFG] PutByVal with Array::Generic is too generic
3000         https://bugs.webkit.org/show_bug.cgi?id=176345
3001
3002         Reviewed by Filip Pizlo.
3003
3004         * stress/object-assign-symbols.js: Added.
3005         (shouldBe):
3006         (test):
3007         * stress/object-assign.js: Added.
3008         (shouldBe):
3009         (test):
3010         (i.shouldBe.JSON.stringify.test):
3011
3012 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3013
3014         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3015         https://bugs.webkit.org/show_bug.cgi?id=176590
3016
3017         Reviewed by Saam Barati.
3018
3019         * microbenchmarks/object-iterate-symbols.js: Added.
3020         (test):
3021         * microbenchmarks/object-iterate.js: Added.
3022         (test):
3023         * stress/object-iterate-symbols.js: Added.
3024         (shouldBe):
3025         (test):
3026         * stress/object-iterate.js: Added.
3027         (shouldBe):
3028         (test):
3029
3030 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3031
3032         [Win32] 10 JSC stress tests are failing.
3033         https://bugs.webkit.org/show_bug.cgi?id=176538
3034
3035         Reviewed by Mark Lam.
3036
3037         Skip tests on Windows to make the bots green.
3038
3039         * ChakraCore.yaml:
3040         * stress/date-relaxed.js:
3041
3042 2017-09-06  Mark Lam  <mark.lam@apple.com>
3043
3044         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3045         https://bugs.webkit.org/show_bug.cgi?id=176485
3046         <rdar://problem/33898874>
3047
3048         Reviewed by Keith Miller.
3049
3050         * stress/regress-176485.js: Added.
3051
3052 2017-09-05  Saam Barati  <sbarati@apple.com>
3053
3054         isNotCellSpeculation is wrong with respect to SpecEmpty
3055         https://bugs.webkit.org/show_bug.cgi?id=176429
3056
3057         Reviewed by Michael Saboff.
3058
3059         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3060         (Foo):
3061
3062 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3063
3064         test262: Completion values for control flow do not match the spec
3065         https://bugs.webkit.org/show_bug.cgi?id=171265
3066
3067         Reviewed by Saam Barati.
3068
3069         * stress/completion-value.js:
3070         Condensed test for completion values in top level statements.
3071
3072         * stress/super-get-by-id.js:
3073         ClassDeclaration when evaled no longer produce values. Convert
3074         these to ClassExpressions so they produce the class value.
3075         
3076         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3077         This is a progression for currect spec behavior.
3078
3079         * mozilla/mozilla-tests.yaml:
3080         This test is now outdated, so mark it as failing for that reason.
3081
3082         * test262.yaml:
3083         Passing all "cptn" completion value tests.
3084
3085 2017-09-04  Saam Barati  <sbarati@apple.com>
3086
3087         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3088         https://bugs.webkit.org/show_bug.cgi?id=176317
3089
3090         Reviewed by Keith Miller.
3091
3092         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3093         (Foo):
3094
3095 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3096
3097         [DFG][FTL] Efficiently execute number#toString()
3098         https://bugs.webkit.org/show_bug.cgi?id=170007
3099
3100         Reviewed by Keith Miller.
3101
3102         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3103         (test):
3104         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3105         (test):
3106         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3107         (test):
3108         * microbenchmarks/number-to-string-with-radix.js: Added.
3109         (test):
3110         * stress/number-to-string-strength-reduction.js: Added.
3111         (shouldBe):
3112         (test):
3113         * stress/number-to-string-with-radix-10.js: Added.
3114         (shouldBe):
3115         (test):
3116         * stress/number-to-string-with-radix-cse.js: Added.
3117         (shouldBe):
3118         (test):
3119         * stress/number-to-string-with-radix-invalid.js: Added.
3120         (shouldThrow):
3121         * stress/number-to-string-with-radix-watchpoint.js: Added.
3122         (shouldBe):
3123         (test):
3124         (i.i.1e3.Number.prototype.toString):
3125         * stress/number-to-string-with-radix.js: Added.
3126         (shouldBe):
3127         (test):
3128
3129 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3130
3131         [DFG] Relax arity requirement
3132         https://bugs.webkit.org/show_bug.cgi?id=175523
3133
3134         Reviewed by Saam Barati.
3135
3136         * stress/arity-mismatch-arguments-length.js: Added.
3137         (shouldBe):
3138         (test1):
3139         (test):
3140         * stress/arity-mismatch-get-argument.js: Added.
3141         (shouldBe):
3142         (builtin.createBuiltin):
3143         (test):
3144         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3145         (shouldBe):
3146         (inlineTarget):
3147         (test):
3148         * stress/arity-mismatch-inlining.js: Added.
3149         (shouldBe):
3150         (inlineTarget):
3151         (test):
3152         * stress/arity-mismatch-rest.js: Added.
3153         (shouldBe):
3154         (test2):
3155         (test1):
3156         (test):
3157
3158 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3159
3160         [JSC] Fix "name" and "length" of Proxy revoke function
3161         https://bugs.webkit.org/show_bug.cgi?id=176155
3162
3163         Reviewed by Mark Lam.
3164
3165         * test262.yaml:
3166
3167 2017-08-31  Saam Barati  <sbarati@apple.com>
3168
3169         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3170         https://bugs.webkit.org/show_bug.cgi?id=176206
3171
3172         Reviewed by Keith Miller.
3173
3174         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3175         (a):
3176         (b):
3177         (foo):
3178
3179 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3180
3181         Skip two slow JSC tests after r221422.
3182
3183         Unreviewed test gardening.
3184
3185         * stress/regexp-prototype-match-on-too-long-rope.js:
3186         * stress/regexp-prototype-test-on-too-long-rope.js:
3187
3188 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3189
3190         Unreviewed, skipping slow tests.
3191         
3192         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3193         work differently now.
3194
3195         * stress/regexp-prototype-exec-on-too-long-rope.js:
3196         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3197
3198 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3199
3200         [JSC] Use reifying system for "name" property of builtin JSFunction
3201         https://bugs.webkit.org/show_bug.cgi?id=175260
3202
3203         Reviewed by Saam Barati.
3204
3205         * stress/accessors-get-set-prefix.js:
3206         * stress/builtin-function-name.js: Added.
3207         (shouldBe):
3208         (shouldThrow):
3209         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3210         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3211         * stress/private-name-as-anonymous-builtin.js: Added.
3212         (shouldBe):
3213         (NotPromise):
3214
3215 2017-08-30  Saam Barati  <sbarati@apple.com>
3216
3217         Unreviewed. Make test stop printing.
3218
3219         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3220
3221 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3222
3223         Unreviewed, rolling out r221327.
3224
3225         This change caused test262 failures.
3226
3227         Reverted changeset:
3228
3229         "[JSC] Use reifying system for "name" property of builtin
3230         JSFunction"
3231         https://bugs.webkit.org/show_bug.cgi?id=175260
3232         http://trac.webkit.org/changeset/221327
3233
3234 2017-08-30  Saam Barati  <sbarati@apple.com>
3235
3236         semicolon is being interpreted as an = in the LiteralParser
3237         https://bugs.webkit.org/show_bug.cgi?id=176114
3238
3239         Reviewed by Oliver Hunt.
3240
3241         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3242         * stress/resources/literal-parser-test-case.js: Added.
3243
3244 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3245
3246         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3247         https://bugs.webkit.org/show_bug.cgi?id=166698
3248
3249         Reviewed by Yusuke Suzuki.
3250
3251         * stress/async-iteration-for-await-of-syntax.js: Added.
3252         (assert):
3253         (checkSyntax):
3254         (checkSyntaxError):
3255         (checkSimpleAsyncGeneratorSloppyMode):
3256         (checkSimpleAsyncGeneratorStrictMode):
3257         (checkNestedAsyncGenerators):
3258         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3259         * stress/async-iteration-for-await-of.js: Added.
3260         (assert):
3261         (async.foo):
3262         (async.boo):
3263         (const.boo.async):
3264
3265 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3266
3267         [JSC] Use reifying system for "name" property of builtin JSFunction
3268         https://bugs.webkit.org/show_bug.cgi?id=175260
3269
3270         Reviewed by Saam Barati.
3271
3272         * stress/accessors-get-set-prefix.js:
3273         * stress/builtin-function-name.js: Added.
3274         (shouldBe):
3275         (shouldThrow):
3276         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3277         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3278
3279 2017-08-25  Saam Barati  <sbarati@apple.com>
3280
3281         Support compiling catch in the DFG
3282         https://bugs.webkit.org/show_bug.cgi?id=174590
3283         <rdar://problem/34047845>
3284
3285         Reviewed by Filip Pizlo.
3286
3287         * microbenchmarks/delta-blue-try-catch.js: Added.
3288         (exception):
3289         (value):
3290         (OrderedCollection):
3291         (OrderedCollection.prototype.add):
3292         (OrderedCollection.prototype.at):
3293         (OrderedCollection.prototype.size):
3294         (OrderedCollection.prototype.removeFirst):
3295         (OrderedCollection.prototype.remove):
3296         (Strength):
3297         (Strength.stronger):
3298         (Strength.weaker):
3299         (Strength.weakestOf):
3300         (Strength.strongest):
3301         (Strength.prototype.nextWeaker):
3302         (Constraint):
3303         (Constraint.prototype.addConstraint):
3304         (Constraint.prototype.satisfy):
3305         (Constraint.prototype.destroyConstraint):
3306         (Constraint.prototype.isInput):
3307         (UnaryConstraint):
3308         (UnaryConstraint.prototype.addToGraph):
3309         (UnaryConstraint.prototype.chooseMethod):
3310         (UnaryConstraint.prototype.isSatisfied):
3311         (UnaryConstraint.prototype.markInputs):
3312         (UnaryConstraint.prototype.output):
3313         (UnaryConstraint.prototype.recalculate):
3314         (UnaryConstraint.prototype.markUnsatisfied):
3315         (UnaryConstraint.prototype.inputsKnown):
3316         (UnaryConstraint.prototype.removeFromGraph):
3317         (StayConstraint):
3318         (StayConstraint.prototype.execute):
3319         (EditConstraint.prototype.isInput):
3320         (EditConstraint.prototype.execute):
3321         (BinaryConstraint):
3322         (BinaryConstraint.prototype.chooseMethod):
3323         (BinaryConstraint.prototype.addToGraph):
3324         (BinaryConstraint.prototype.isSatisfied):
3325         (BinaryConstraint.prototype.markInputs):
3326         (BinaryConstraint.prototype.input):
3327         (BinaryConstraint.prototype.output):
3328         (BinaryConstraint.prototype.recalculate):
3329         (BinaryConstraint.prototype.markUnsatisfied):
3330         (BinaryConstraint.prototype.inputsKnown):
3331         (BinaryConstraint.prototype.removeFromGraph):
3332         (ScaleConstraint):
3333         (ScaleConstraint.prototype.addToGraph):
3334         (ScaleConstraint.prototype.removeFromGraph):
3335         (ScaleConstraint.prototype.markInputs):
3336         (ScaleConstraint.prototype.execute):
3337         (ScaleConstraint.prototype.recalculate):
3338         (EqualityConstraint):
3339         (EqualityConstraint.prototype.execute):
3340         (Variable):
3341         (Variable.prototype.addConstraint):
3342         (Variable.prototype.removeConstraint):
3343         (Planner):
3344         (Planner.prototype.incrementalAdd):
3345         (Planner.prototype.incrementalRemove):
3346         (Planner.prototype.newMark):
3347         (Planner.prototype.makePlan):
3348         (Planner.prototype.extractPlanFromConstraints):
3349         (Planner.prototype.addPropagate):
3350         (Planner.prototype.removePropagateFrom):
3351         (Planner.prototype.addConstraintsConsumingTo):
3352         (Plan):
3353         (Plan.prototype.addConstraint):
3354         (Plan.prototype.size):
3355         (Plan.prototype.constraintAt):
3356         (Plan.prototype.execute):
3357         (chainTest):
3358         (projectionTest):
3359         (change):
3360         (deltaBlue):
3361         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3362         (assert):
3363         (Numbers):
3364         (Numbers.prototype.next):
3365         (return.Transpose):
3366         (return.Transpose.prototype.next):
3367         (transpose):
3368         (verifyEven):
3369         (verifyString):
3370         (foo):
3371         (runIterators):
3372         * microbenchmarks/try-catch-word-count.js: Added.
3373         (let.assert):
3374         (EOF):
3375         (let.texts):
3376         (let.o.apply):
3377         (foo):
3378         (bar):
3379         (f):
3380         (run):
3381         (test1):
3382         (test2):
3383         (test3):
3384         (fn):
3385         (A):
3386         (B):
3387         (A.prototype.getValue):
3388         (B.prototype.getParentValue):
3389         (strlen):
3390         (sum.0):
3391         (test):
3392         (result.test.o):
3393         (set add.set add):
3394         (set forEach):
3395         (stringHash):
3396         (set if):
3397         (testFunction):
3398         (set delete.set has.set add):
3399         * stress/catch-set-argument-speculation-failure.js: Added.
3400         (o):
3401         (e):
3402         (e2):
3403         (escape):
3404         (baz):
3405         (noInline.run):
3406         (noInline):
3407         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3408         (foo):
3409         (e):
3410         (baz):
3411         (bar):
3412
3413 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3414
3415         Unreviewed, rolling out r221119, r221124, and r221143.
3416         https://bugs.webkit.org/show_bug.cgi?id=175973
3417
3418         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3419         on #webkit).
3420
3421         Reverted changesets:
3422
3423         "Support compiling catch in the DFG"
3424         https://bugs.webkit.org/show_bug.cgi?id=174590
3425         http://trac.webkit.org/changeset/221119
3426
3427         "Unreviewed, build fix in GTK port"
3428         https://bugs.webkit.org/show_bug.cgi?id=174590
3429         http://trac.webkit.org/changeset/221124
3430
3431         "DFG::JITCode::osrEntry should get sorted since we perform a
3432         binary search on it"
3433         https://bugs.webkit.org/show_bug.cgi?id=175893
3434         http://trac.webkit.org/changeset/221143
3435
3436 2017-08-24  Michael Saboff  <msaboff@apple.com>
3437
3438         Add support for RegExp "dotAll" flag
3439         https://bugs.webkit.org/show_bug.cgi?id=175924
3440
3441         Reviewed by Keith Miller.
3442
3443         Updated tests for new dotAll ('s' flag) changes.
3444
3445         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3446         * stress/static-getter-in-names.js:
3447
3448 2017-08-24  Mark Lam  <mark.lam@apple.com>
3449
3450         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3451         https://bugs.webkit.org/show_bug.cgi?id=175940
3452         <rdar://problem/29003921>
3453
3454         Reviewed by Saam Barati.
3455
3456         * stress/regress-164081.js: Added.
3457         (shouldEqual):
3458         (testcase):
3459
3460 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3461
3462         Skip flaky JSC test stress/test-finally.js.
3463         https://bugs.webkit.org/show_bug.cgi?id=160283
3464
3465         Unreviewed test gardening.
3466
3467         * stress/test-finally.js:
3468
3469 2017-08-23  Saam Barati  <sbarati@apple.com>
3470
3471         Support compiling catch in the DFG
3472         https://bugs.webkit.org/show_bug.cgi?id=174590
3473
3474         Reviewed by Filip Pizlo.
3475
3476         * microbenchmarks/delta-blue-try-catch.js: Added.
3477         (exception):
3478         (value):
3479         (OrderedCollection):
3480         (OrderedCollection.prototype.add):
3481         (OrderedCollection.prototype.at):
3482         (OrderedCollection.prototype.size):
3483         (OrderedCollection.prototype.removeFirst):
3484         (OrderedCollection.prototype.remove):
3485         (Strength):
3486         (Strength.stronger):
3487         (Strength.weaker):
3488         (Strength.weakestOf):
3489         (Strength.strongest):
3490         (Strength.prototype.nextWeaker):
3491         (Constraint):
3492         (Constraint.prototype.addConstraint):
3493         (Constraint.prototype.satisfy):
3494         (Constraint.prototype.destroyConstraint):
3495         (Constraint.prototype.isInput):
3496         (UnaryConstraint):
3497         (UnaryConstraint.prototype.addToGraph):
3498         (UnaryConstraint.prototype.chooseMethod):
3499         (UnaryConstraint.prototype.isSatisfied):
3500         (UnaryConstraint.prototype.markInputs):
3501         (UnaryConstraint.prototype.output):
3502         (UnaryConstraint.prototype.recalculate):
3503         (UnaryConstraint.prototype.markUnsatisfied):
3504         (UnaryConstraint.prototype.inputsKnown):
3505         (UnaryConstraint.prototype.removeFromGraph):
3506         (StayConstraint):
3507         (StayConstraint.prototype.execute):
3508         (EditConstraint.prototype.isInput):
3509         (EditConstraint.prototype.execute):
3510         (BinaryConstraint):
3511         (BinaryConstraint.prototype.chooseMethod):
3512         (BinaryConstraint.prototype.addToGraph):
3513         (BinaryConstraint.prototype.isSatisfied):
3514         (BinaryConstraint.prototype.markInputs):
3515         (BinaryConstraint.prototype.input):
3516         (BinaryConstraint.prototype.output):
3517         (BinaryConstraint.prototype.recalculate):
3518         (BinaryConstraint.prototype.markUnsatisfied):
3519         (BinaryConstraint.prototype.inputsKnown):
3520         (BinaryConstraint.prototype.removeFromGraph):
3521         (ScaleConstraint):
3522         (ScaleConstraint.prototype.addToGraph):
3523         (ScaleConstraint.prototype.removeFromGraph):
3524         (ScaleConstraint.prototype.markInputs):
3525         (ScaleConstraint.prototype.execute):
3526         (ScaleConstraint.prototype.recalculate):
3527         (EqualityConstraint):
3528         (EqualityConstraint.prototype.execute):
3529         (Variable):
3530         (Variable.prototype.addConstraint):
3531         (Variable.prototype.removeConstraint):
3532         (Planner):
3533         (Planner.prototype.incrementalAdd):
3534         (Planner.prototype.incrementalRemove):
3535         (Planner.prototype.newMark):
3536         (Planner.prototype.makePlan):
3537         (Planner.prototype.extractPlanFromConstraints):
3538         (Planner.prototype.addPropagate):
3539         (Planner.prototype.removePropagateFrom):
3540         (Planner.prototype.addConstraintsConsumingTo):
3541         (Plan):
3542         (Plan.prototype.addConstraint):
3543         (Plan.prototype.size):
3544         (Plan.prototype.constraintAt):
3545         (Plan.prototype.execute):
3546         (chainTest):
3547         (projectionTest):
3548         (change):
3549         (deltaBlue):
3550         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3551         (assert):
3552         (Numbers):
3553         (Numbers.prototype.next):
3554         (return.Transpose):
3555         (return.Transpose.prototype.next):
3556         (transpose):
3557         (verifyEven):
3558         (verifyString):
3559         (foo):
3560         (runIterators):
3561         * microbenchmarks/try-catch-word-count.js: Added.
3562         (let.assert):
3563         (EOF):
3564         (let.texts):
3565         (let.o.apply):
3566         (foo):
3567         (bar):
3568         (f):
3569         (run):
3570         (test1):
3571         (test2):
3572         (test3):
3573         (fn):
3574         (A):
3575         (B):
3576         (A.prototype.getValue):
3577         (B.prototype.getParentValue):
3578         (strlen):
3579         (sum.0):
3580         (test):
3581         (result.test.o):
3582         (set add.set add):
3583         (set forEach):
3584         (stringHash):
3585         (set if):
3586         (testFunction):
3587         (set delete.set has.set add):
3588         * stress/catch-set-argument-speculation-failure.js: Added.
3589         (o):
3590         (e):
3591         (e2):
3592         (escape):
3593         (baz):
3594         (noInline.run):
3595         (noInline):
3596         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3597         (foo):
3598         (e):
3599         (baz):
3600         (bar):
3601
3602 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3603
3604         [JSC] Optimize Map iteration with intrinsic
3605         https://bugs.webkit.org/show_bug.cgi?id=174355
3606
3607         Reviewed by Saam Barati.
3608
3609         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3610         (shouldBe):
3611         (throw.new.Error):
3612         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3613         (shouldBe):
3614         (throw.new.Error.let.iterator.set Symbol):
3615         (throw.new.Error.set add):
3616         (let.iterator.set Symbol):
3617
3618 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3619
3620         Add a micro-benchmark for checking that accessing a variable within a 'with'
3621         block does not automatically prevent type prediction.
3622         https://bugs.webkit.org/show_bug.cgi?id=175738
3623
3624         Reviewed by Saam Barati.
3625
3626         * stress/with_and_arith.js: Added.
3627         (with):
3628
3629 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3630
3631         [ESNext] Async iteration - Implement Async Generator - runtime
3632         https://bugs.webkit.org/show_bug.cgi?id=175240
3633
3634         Reviewed by Yusuke Suzuki.
3635
3636         * stress/async-iteration-async-from-sync.js: Added.
3637         (assert):
3638         (const.Logger):
3639         (this.fullfilled):
3640         (this.fullfilledDone):
3641         (this.rejected):
3642         (this.catched):
3643         (this.isFinal):
3644         (_assertLogger):
3645         (const.assertLogger):
3646         (const.getPromise.promiseHolder.return.new.Promise):
3647         (foo):
3648         (async.boo):
3649         (bar):
3650         (async.baz):
3651         (async.goo):
3652         * stress/async-iteration-basic.js: Added.
3653         (assert):
3654         (const.Logger):
3655         (this.fullfilled):
3656         (this.fullfilledDone):
3657         (this.rejected):
3658         (this.catched):
3659         (this.isFinal):
3660         (_assertLogger):
3661         (const.assertLogger):
3662         (const.getPromise.promiseHolder.return.new.Promise):
3663         (async.generator):
3664         (iterator.next.then):
3665         (async.baz):
3666         (async.boo):
3667         (async.foo):
3668         (async.goo):
3669         (A.prototype.async.foo):
3670         (A.prototype.async.boo):
3671         (A):
3672         (asyncGenExp.async):
3673         (async.joo):
3674         (j.next.then):
3675         (then):
3676         (async.koo):
3677         (async.loo):
3678         (async.moo):
3679         (async.noo):
3680         (async.ooo):
3681         (async.roo):
3682         (async.poo):
3683         (async.soo):
3684         (async.too):
3685         * stress/async-iteration-evaluation.js: Added.
3686         (assert):
3687         (async.foo):
3688         (catch):
3689         * stress/async-iteration-syntax.js:
3690         * stress/async-iteration-yield-promise.js: Added.
3691         (assert):
3692         (const.Logger):
3693         (this.fullfilled):
3694         (this.fullfilledDone):
3695         (this.rejected):
3696         (this.catched):
3697         (this.isFinal):
3698         (_assertLogger):
3699         (const.assertLogger):
3700         (const.getPromise.promiseHolder.return.new.Promise):
3701         (async.foo):
3702         (async.boo):
3703         (async.bar):
3704         * stress/async-iteration-yield-star-interface.js: Added.
3705         (assert):
3706         (const.getPromise.promiseHolder.return.new.Promise):
3707         (const.Logger):
3708         (this.fullfilled):
3709         (this.fullfilledDone):
3710         (this.rejected):
3711         (this.catched):
3712         (this.custom):
3713         (this.isFinal):
3714         (_assertLogger):
3715         (const.assertLogger):
3716         (let.asyncIter.Symbol.asyncIterator):
3717         (let.asyncIter.next):
3718         (let.asyncIter.throw):
3719         (let.asyncIter.return):
3720         (async.foo):
3721         (asyncIter.Symbol.asyncIterator):
3722         (asyncIter.next):
3723         (async.boo):
3724         (asyncIter.return):
3725         (async.bar):
3726         (async.baz):