7182b6a34238099a2187ea8e57025bd367081d38
[WebKit-https.git] / JSTests / ChangeLog
1 2017-12-04  JF Bastien  <jfbastien@apple.com>
2
3         Proxy all functions, except the $ objects
4         https://bugs.webkit.org/show_bug.cgi?id=180375
5
6         Reviewed by Saam Barati.
7
8         It looks like this test may have broken some executions because I
9         call some internal objects. Explicitly ignore objects whose name
10         starts with "$" because it's a bad idea anyways.
11
12         * stress/proxy-all-the-parameters.js:
13         (generateObjects):
14         (get throw):
15
16 2017-12-04  Saam Barati  <sbarati@apple.com>
17
18         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
19         https://bugs.webkit.org/show_bug.cgi?id=180366
20         <rdar://problem/35685877>
21
22         Reviewed by Michael Saboff.
23
24         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
25         (theParent):
26         (test1.base.getParentStaticValue):
27         (test1.base):
28         (test1.__v_24888.prototype.set prop):
29         (test1.__v_24888):
30         (test2.base.getParentStaticValue):
31         (test2.base):
32         (test2.__v_24888.prototype.set prop):
33         (test2.__v_24888):
34         (test2):
35
36 2017-12-01  JF Bastien  <jfbastien@apple.com>
37
38         Try proxying all function arguments
39         https://bugs.webkit.org/show_bug.cgi?id=180306
40
41         Reviewed by Saam Barati.
42
43         * stress/proxy-all-the-parameters.js: Added.
44         (isPropertyOfType):
45         (getProperties):
46         (generateObjects):
47         (getObjects):
48         (getFunctions):
49         (get throw):
50         (let.o.of.getObjects.let.f.of.getFunctions.catch):
51
52 2017-12-01  JF Bastien  <jfbastien@apple.com>
53
54         JavaScriptCore: missing exception checks in Math functions that take more than one argument
55         https://bugs.webkit.org/show_bug.cgi?id=180297
56         <rdar://problem/35745556>
57
58         Reviewed by Mark Lam.
59
60         * stress/math-exceptions.js: Added.
61         (get try):
62         (catch):
63
64 2017-12-01  JF Bastien  <jfbastien@apple.com>
65
66         JavaScriptCore: add test for weird class static getters
67         https://bugs.webkit.org/show_bug.cgi?id=180281
68         <rdar://problem/35592139>
69
70         Reviewed by Mark Lam.
71
72         I fixed a bug for it in r224927 and didn't add a test. Do so.
73
74         * stress/class-static-get-weird.js: Added.
75         (c.prototype.get name):
76         (c):
77         (c.prototype.get arguments):
78         (c.prototype.get caller):
79         (c.prototype.get length):
80
81 2017-12-01  Saam Barati  <sbarati@apple.com>
82
83         Having a bad time needs to handle ArrayClass indexing type as well
84         https://bugs.webkit.org/show_bug.cgi?id=180274
85         <rdar://problem/35667869>
86
87         Reviewed by Keith Miller and Mark Lam.
88
89         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
90         (assert):
91         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
92         (assert):
93
94 2017-12-01  JF Bastien  <jfbastien@apple.com>
95
96         WebAssembly: restore cached stack limit after out-call
97         https://bugs.webkit.org/show_bug.cgi?id=179106
98         <rdar://problem/35337525>
99
100         Reviewed by Saam Barati.
101
102         * wasm/function-tests/double-instance.js: Added.
103         (const.imp.boom):
104         (const.imp.get callAnother):
105
106 2017-11-30  JF Bastien  <jfbastien@apple.com>
107
108         WebAssembly: improve stack trace
109         https://bugs.webkit.org/show_bug.cgi?id=179343
110
111         Reviewed by Saam Barati.
112
113         Update the tests to follow the new format. Notably, SHA1 module
114         hash is now included in traces, and stubs are properly identified.
115
116         * wasm/assert.js: Add an assertion which matches regular expressions.
117         * wasm/function-tests/nameSection.js:
118         * wasm/function-tests/stack-overflow.js:
119         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
120         (assertOverflows.assertThrows.wasm.1):
121         (assertOverflows.assertThrows.wasm.0):
122         (assertOverflows.assertThrows):
123         (assertOverflows):
124         * wasm/function-tests/stack-trace.js:
125         (import.Builder.from.string_appeared_here.assert): Deleted.
126         * wasm/function-tests/trap-after-cross-instance-call.js:
127         (wasmFrameCountFromError):
128         * wasm/function-tests/trap-load-2.js:
129         (wasmFrameCountFromError):
130         * wasm/function-tests/trap-load.js:
131         (wasmFrameCountFromError):
132
133 2017-11-30  Mark Lam  <mark.lam@apple.com>
134
135         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
136         https://bugs.webkit.org/show_bug.cgi?id=180219
137         <rdar://problem/35696536>
138
139         Reviewed by Filip Pizlo.
140
141         * stress/regress-180219.js: Added.
142
143 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
144
145         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
146         https://bugs.webkit.org/show_bug.cgi?id=180190
147
148         Reviewed by Mark Lam.
149
150         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
151         (shouldBe):
152         (test1):
153         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
154         (shouldBe):
155         (test1):
156         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
157         (shouldBe):
158         (test1):
159         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
160         (shouldBe):
161         (test1):
162         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
163         (shouldBe):
164         (test1):
165         * stress/operation-in-may-have-negative-int32.js: Added.
166         (shouldBe):
167         (test2):
168         * stress/operation-in-negative-int32-cast.js: Added.
169         (shouldBe):
170         (test1):
171
172 2017-11-28  JF Bastien  <jfbastien@apple.com>
173
174         Strict and sloppy functions shouldn't share structure
175         https://bugs.webkit.org/show_bug.cgi?id=180103
176         <rdar://problem/35667847>
177
178         Reviewed by Saam Barati.
179
180         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
181         because the IC was wrong.
182         (foo):
183         (bar):
184         (baz):
185         (catch):
186         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
187         in this patch, but may as well test odd strict mode corner cases.
188         (bar):
189         (baz):
190         (catch):
191         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
192         (foo):
193         (bar):
194         (baz):
195         (catch):
196         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
197         next file, but with invalidation of the FunctionExecutable's
198         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
199         slower path.
200         (foo):
201         (bar.const.x):
202         (bar.const.y):
203         (bar):
204         (catch):
205         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
206         strict nesting works correctly.
207         (foo):
208         (bar.baz):
209         (bar):
210         * stress/strict-function-structure.js: Added. The test used to
211         assert in objectProtoFuncHasOwnProperty.
212         (foo):
213         (bar):
214         (baz):
215         * stress/strict-nested-function-structure.js: Added. Nesting.
216         (foo):
217         (bar):
218         (baz.boo):
219         (baz):
220
221 2017-11-29  Robin Morisset  <rmorisset@apple.com>
222
223         The recursive tail call optimisation is wrong on closures
224         https://bugs.webkit.org/show_bug.cgi?id=179835
225
226         Reviewed by Saam Barati.
227
228         * stress/closure-recursive-tail-call.js: Added.
229         (makeClosure):
230
231 2017-11-27  JF Bastien  <jfbastien@apple.com>
232
233         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
234         https://bugs.webkit.org/show_bug.cgi?id=180051
235         <rdar://problem/35614371>
236
237         Reviewed by Saam Barati.
238
239         * stress/rest-parameter-negative.js: Added.
240         (__f_5484):
241         (catch):
242         (__f_5485):
243         (__v_22598.catch):
244
245 2017-11-27  Saam Barati  <sbarati@apple.com>
246
247         Spread can escape when CreateRest does not
248         https://bugs.webkit.org/show_bug.cgi?id=180057
249         <rdar://problem/35676119>
250
251         Reviewed by JF Bastien.
252
253         * stress/spread-escapes-but-create-rest-does-not.js: Added.
254         (assert):
255         (getProperties):
256         (theFunc):
257         (let.obj.valueOf):
258
259 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
260
261         [DFG] Add NormalizeMapKey DFG IR
262         https://bugs.webkit.org/show_bug.cgi?id=179912
263
264         Reviewed by Saam Barati.
265
266         * stress/map-untyped-normalize-cse.js: Added.
267         (shouldBe):
268         (test):
269         * stress/map-untyped-normalize.js: Added.
270         (shouldBe):
271         (test):
272         * stress/set-untyped-normalize-cse.js: Added.
273         (shouldBe):
274         (set return.set has.set has):
275         * stress/set-untyped-normalize.js: Added.
276         (shouldBe):
277         (set return.set has):
278
279 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
280
281         [FTL] Support DeleteById and DeleteByVal
282         https://bugs.webkit.org/show_bug.cgi?id=180022
283
284         Reviewed by Saam Barati.
285
286         * stress/delete-by-id.js: Added.
287         (shouldBe):
288         (test1):
289         (test2):
290         * stress/delete-by-val-ftl.js: Added.
291         (shouldBe):
292         (test1):
293         (test2):
294
295 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
296
297         [DFG] Introduce {Set,Map,WeakMap}Fields
298         https://bugs.webkit.org/show_bug.cgi?id=179925
299
300         Reviewed by Saam Barati.
301
302         * stress/map-set-clobber-map-get.js: Added.
303         (shouldBe):
304         (test):
305         * stress/map-set-does-not-clobber-set-has.js: Added.
306         (shouldBe):
307         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
308         (shouldBe):
309         (test):
310         * stress/set-add-clobber-set-has.js: Added.
311         (shouldBe):
312         * stress/set-add-does-not-clobber-map-get.js: Added.
313         (shouldBe):
314
315 2017-11-24  Mark Lam  <mark.lam@apple.com>
316
317         Move unsafe jsc shell test functions to the $vm object.
318         https://bugs.webkit.org/show_bug.cgi?id=179980
319
320         Reviewed by Yusuke Suzuki.
321
322         * controlFlowProfiler/driver/driver.js:
323         * controlFlowProfiler/execution-count.js:
324         * controlFlowProfiler/if-statement.js:
325         * controlFlowProfiler/loop-statements.js:
326         * controlFlowProfiler/switch-statements.js:
327         * controlFlowProfiler/test-jit.js:
328         * exceptionFuzz/3d-cube.js:
329         * exceptionFuzz/date-format-xparb.js:
330         * exceptionFuzz/earley-boyer.js:
331         * heapProfiler/basic-edges.js:
332         * heapProfiler/property-edge-types.js:
333         * microbenchmarks/try-get-by-id-basic.js:
334         * microbenchmarks/try-get-by-id-polymorphic.js:
335         * modules/namespace-object-try-get.js:
336         * stress/argument-count-bytecode.js:
337         * stress/argument-intrinsic-basic.js:
338         * stress/argument-intrinsic-inlining-use-caller-arg.js:
339         * stress/argument-intrinsic-inlining-with-result-escape.js:
340         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
341         * stress/argument-intrinsic-inlining-with-vararg.js:
342         * stress/argument-intrinsic-nested-inlining.js:
343         * stress/argument-intrinsic-not-convert-to-get-argument.js:
344         * stress/argument-intrinsic-with-stack-write.js:
345         * stress/arity-mismatch-get-argument.js:
346         * stress/array-message-passing.js:
347         * stress/array-push-with-force-exit.js:
348         * stress/check-dom-with-signature.js:
349         * stress/check-sub-class.js:
350         * stress/compare-eq-incomplete-profile.js:
351         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
352         * stress/do-eval-virtual-call-correctly.js:
353         * stress/dom-jit-with-poly-proto.js:
354         * stress/domjit-exception-ic.js:
355         * stress/domjit-exception.js:
356         * stress/domjit-getter-complex-with-incorrect-object.js:
357         * stress/domjit-getter-complex.js:
358         * stress/domjit-getter-poly.js:
359         * stress/domjit-getter-proto.js:
360         * stress/domjit-getter-super-poly.js:
361         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
362         * stress/domjit-getter-type-check.js:
363         * stress/domjit-getter.js:
364         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
365         * stress/for-in-proxy-target-changed-structure.js:
366         * stress/for-in-proxy.js:
367         * stress/generational-opaque-roots.js:
368         * stress/global-const-redeclaration-setting-2.js:
369         * stress/global-const-redeclaration-setting-3.js:
370         * stress/global-const-redeclaration-setting-4.js:
371         * stress/global-const-redeclaration-setting-5.js:
372         * stress/global-const-redeclaration-setting.js:
373         * stress/import-basic.js:
374         * stress/import-from-eval.js:
375         * stress/import-reject-with-exception.js:
376         * stress/import-syntax.js:
377         * stress/impure-get-own-property-slot-inline-cache.js:
378         * stress/is-constructor.js:
379         * stress/istypedarrayview-intrinsic.js:
380         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
381         * stress/jsc-test-functions-should-be-more-robust.js:
382         * stress/object-toString-with-proxy.js:
383         * stress/poly-proto-custom-value-and-accessor.js:
384         * stress/proxy-inline-cache.js:
385         * stress/re-execute-error-module.js:
386         * stress/regress-150532.js:
387         * stress/regress-156992.js:
388         * stress/regress-179619.js:
389         * stress/resources/shadow-chicken-support.js:
390         * stress/runtime-array.js:
391         * stress/sampling-profiler-microtasks.js:
392         * stress/shadow-chicken-enabled.js:
393         * stress/spread-correct-global-object-on-exception.js:
394         * stress/super-get-by-id.js:
395         * stress/tailCallForwardArguments.js:
396         * stress/to-object-intrinsic-boolean-edge.js:
397         * stress/to-object-intrinsic-null-or-undefined-edge.js:
398         * stress/to-object-intrinsic-number-edge.js:
399         * stress/to-object-intrinsic-object-edge.js:
400         * stress/to-object-intrinsic-string-edge.js:
401         * stress/to-object-intrinsic-symbol-edge.js:
402         * stress/to-object-intrinsic.js:
403         * stress/try-catch-custom-getter-as-get-by-id.js:
404         * stress/try-get-by-id-poly-proto.js:
405         * stress/try-get-by-id-should-spill-registers-dfg.js:
406         * stress/try-get-by-id.js:
407         * typeProfiler/arrow-functions.js:
408         * typeProfiler/basic.js:
409         * typeProfiler/captured.js:
410         * typeProfiler/classes.js:
411         * typeProfiler/dfg-jit-optimizations.js:
412         * typeProfiler/dictionary-mode.js:
413         * typeProfiler/es6-block-scoping.js:
414         * typeProfiler/es6-classes.js:
415         * typeProfiler/inheritance.js:
416         * typeProfiler/int52-dfg.js:
417         * typeProfiler/loop.js:
418         * typeProfiler/optional-fields.js:
419         * typeProfiler/overflow.js:
420         * typeProfiler/return.js:
421         * typeProfiler/symbol.js:
422         * typeProfiler/weird-prototype-chain.js:
423
424 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
425
426         [DFG][FTL] Support MapSet / SetAdd intrinsics
427         https://bugs.webkit.org/show_bug.cgi?id=179858
428
429         Reviewed by Saam Barati.
430
431         * microbenchmarks/map-has-and-set.js: Added.
432         (test):
433         * stress/map-set-check-failure.js: Added.
434         (shouldBe):
435         (shouldThrow):
436         (target):
437         * stress/map-set-cse.js: Added.
438         (shouldBe):
439         (test):
440         * stress/set-add-check-failure.js: Added.
441         (shouldBe):
442         (shouldThrow):
443         (set shouldThrow):
444         * stress/set-add-cse.js: Added.
445         (shouldBe):
446
447 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
448
449         [JSC] Allow poly proto for intrinsic getters
450         https://bugs.webkit.org/show_bug.cgi?id=179550
451
452         Reviewed by Saam Barati.
453
454         This change is also tested by existing tests.
455
456             1. stress/intrinsic-getter-with-poly-proto.js
457             2. stress/poly-proto-intrinsic-getter-correctness.js
458
459         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
460         (shouldBe):
461         (makePolyProtoObject.foo.C):
462         (makePolyProtoObject.foo):
463         (makePolyProtoObject):
464         (target):
465         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
466         (shouldBe):
467         (makePolyProtoObject.foo.C):
468         (makePolyProtoObject.foo):
469         (makePolyProtoObject):
470         (target):
471
472 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
473
474         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
475         https://bugs.webkit.org/show_bug.cgi?id=179744
476
477         Reviewed by Michael Catanzaro.
478
479         This test uses too much memory for our buildbots on these platforms
480         and gets OOM-killed.
481
482         * stress/unshiftCountSlowCase-correct-postCapacity.js:
483         Skip if $memoryLimited and linux.
484
485 2017-11-17  JF Bastien  <jfbastien@apple.com>
486
487         WebAssembly JS API: throw when a promise can't be created
488         https://bugs.webkit.org/show_bug.cgi?id=179826
489         <rdar://problem/35455813>
490
491         Reviewed by Mark Lam.
492
493         Test WebAssembly.{compile,instantiate} where promise creation
494         fails because of a stack overflow.
495
496         * wasm/js-api/promise-stack-overflow.js: Added.
497         (const.runNearStackLimit.f.const.t):
498         (async.testCompile):
499         (async.testInstantiate):
500
501 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
502
503         Unreviewed, mark regress-178385.js as memory exhausting
504
505         * stress/regress-178385.js:
506
507 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
508
509         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
510
511         Unreviewed test gardening.
512
513         * test262.yaml:
514
515 2017-11-16  Robin Morisset  <rmorisset@apple.com>
516
517         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
518         https://bugs.webkit.org/show_bug.cgi?id=179763
519         <rdar://problem/35550513>
520
521         Reviewed by Keith Miller.
522
523         Just adding a slightly cleaned-up version of the original fuzzer-found test.
524
525         * stress/tdz-this-in-try-catch.js: Added.
526         (__v_6388):
527         (__v_6392):
528
529 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
530
531         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
532         https://bugs.webkit.org/show_bug.cgi?id=179594
533
534         Reviewed by Saam Barati.
535
536         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
537         (shouldBe):
538         (args):
539         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
540         (shouldBe):
541         (args):
542
543 2017-11-14  Saam Barati  <sbarati@apple.com>
544
545         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
546         https://bugs.webkit.org/show_bug.cgi?id=179639
547         <rdar://problem/35513018>
548
549         Reviewed by JF Bastien.
550
551         * wasm/function-tests/grow-memory-cause-gc.js: Added.
552         (escape):
553         (i.func):
554
555 2017-11-13  Mark Lam  <mark.lam@apple.com>
556
557         Add more overflow check book-keeping for MarkedArgumentBuffer.
558         https://bugs.webkit.org/show_bug.cgi?id=179634
559         <rdar://problem/35492517>
560
561         Reviewed by Saam Barati.
562
563         * stress/regress-179634.js: Added.
564
565 2017-11-13  Mark Lam  <mark.lam@apple.com>
566
567         Make the jsc shell loadGetterFromGetterSetter() function more robust.
568         https://bugs.webkit.org/show_bug.cgi?id=179619
569         <rdar://problem/35492518>
570
571         Reviewed by Saam Barati.
572
573         * stress/regress-179619.js: Added.
574
575 2017-11-12  Mark Lam  <mark.lam@apple.com>
576
577         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
578         https://bugs.webkit.org/show_bug.cgi?id=179562
579         <rdar://problem/35467022>
580
581         Reviewed by Saam Barati.
582
583         * regress-179562.js: Added.
584
585 2017-11-08  Saam Barati  <sbarati@apple.com>
586
587         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
588         https://bugs.webkit.org/show_bug.cgi?id=177792
589
590         Reviewed by Yusuke Suzuki.
591
592         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
593         (assert):
594         (foo.Foo.prototype.ensureX):
595         (foo.Foo):
596         (foo):
597         (access):
598
599 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
600
601         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
602         https://bugs.webkit.org/show_bug.cgi?id=178592
603
604         Unreviewed test gardening.
605
606         * test262.yaml:
607
608 2017-11-08  Robin Morisset  <rmorisset@apple.com>
609
610         Turn recursive tail calls into loops
611         https://bugs.webkit.org/show_bug.cgi?id=176601
612
613         Reviewed by Saam Barati.
614
615         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
616
617         Add some simple test that computes factorial in several ways, and other trivial computations.
618         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
619         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
620         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
621         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
622
623         * stress/inline-call-to-recursive-tail-call.js: Added.
624         (factorial.aux):
625         (factorial):
626         (factorial2.aux2):
627         (factorial2.id):
628         (factorial2):
629         (factorial3.aux3):
630         (factorial3):
631         (aux4):
632         (factorial4):
633         (foo):
634         (auxBar):
635         (bar):
636         (test):
637
638 2017-11-07  Mark Lam  <mark.lam@apple.com>
639
640         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
641         https://bugs.webkit.org/show_bug.cgi?id=179355
642         <rdar://problem/35263053>
643
644         Reviewed by Saam Barati.
645
646         * stress/regress-179355.js: Added.
647
648 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
649
650         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
651         https://bugs.webkit.org/show_bug.cgi?id=144458
652
653         Reviewed by Saam Barati.
654
655         * microbenchmarks/dfg-internal-function-call.js: Added.
656         (target):
657         * microbenchmarks/dfg-internal-function-construct.js: Added.
658         (target):
659         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
660         (target):
661         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
662         (target):
663         * stress/dfg-internal-function-call.js: Added.
664         (shouldBe):
665         (target):
666         * stress/dfg-internal-function-construct.js: Added.
667         (shouldBe):
668         (target):
669         * stress/internal-function-call.js: Added.
670         (shouldBe):
671         * stress/internal-function-construct.js: Added.
672         (shouldBe):
673
674 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
675
676         [Win] Skip stress/regress-178385.js.
677         https://bugs.webkit.org/show_bug.cgi?id=179298
678
679         Unreviewed test gardening.
680
681         * stress/regress-178385.js:
682
683 2017-11-03  Keith Miller  <keith_miller@apple.com>
684
685         Add test for ic with side effects
686         https://bugs.webkit.org/show_bug.cgi?id=179268
687
688         Reviewed by Saam Barati.
689
690         * stress/put-inline-cache-side-effects.js: Added.
691         (let.i.of.objs.keys):
692         (f):
693
694 2017-11-03  Mark Lam  <mark.lam@apple.com>
695
696         CachedCall (and its clients) needs overflow checks.
697         https://bugs.webkit.org/show_bug.cgi?id=179185
698
699         Reviewed by JF Bastien.
700
701         * stress/regress-179185.js: Added.
702
703 2017-11-02  Michael Saboff  <msaboff@apple.com>
704
705         DFG needs to handle code motion of code in for..in loop bodies
706         https://bugs.webkit.org/show_bug.cgi?id=179212
707
708         Reviewed by Keith Miller.
709
710         New regression test.
711
712         * stress/for-in-side-effects.js: Added.
713         (getPrototypeOf):
714         (reset):
715         (testWithoutFTL.f):
716         (testWithoutFTL):
717         (testWithFTL.f):
718         (testWithFTL):
719
720 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
721
722         AI does not correctly model the clobber case of ArithClz32
723         https://bugs.webkit.org/show_bug.cgi?id=179188
724
725         Reviewed by Michael Saboff.
726
727         * stress/arith-clz32-effects.js: Added.
728         (foo):
729         (valueOf):
730
731 2017-11-01  Michael Saboff  <msaboff@apple.com>
732
733         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
734         https://bugs.webkit.org/show_bug.cgi?id=179140
735
736         Reviewed by Saam Barati.
737
738         New regression test.
739
740         * stress/regress-179140.js: Added.
741         (testWithoutFTL):
742         (testWithFTL):
743
744 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
745
746         [JSC] Introduce @toObject
747         https://bugs.webkit.org/show_bug.cgi?id=178726
748
749         Reviewed by Saam Barati.
750
751         * stress/array-copywithin.js:
752         (shouldThrow):
753         * stress/object-constructor-boolean-edge.js: Added.
754         (shouldBe):
755         (test):
756         * stress/object-constructor-global.js: Added.
757         (shouldBe):
758         * stress/object-constructor-null-edge.js: Added.
759         (shouldBe):
760         (test):
761         * stress/object-constructor-number-edge.js: Added.
762         (shouldBe):
763         (test):
764         * stress/object-constructor-object-edge.js: Added.
765         (shouldBe):
766         (test):
767         (i.arg):
768         * stress/object-constructor-string-edge.js: Added.
769         (shouldBe):
770         (test):
771         * stress/object-constructor-symbol-edge.js: Added.
772         (shouldBe):
773         (test):
774         * stress/object-constructor-undefined-edge.js: Added.
775         (shouldBe):
776         (test):
777         * stress/symbol-array-from.js: Added.
778         (shouldBe):
779         * stress/to-object-intrinsic-boolean-edge.js: Added.
780         (shouldBe):
781         (builtin.createBuiltin):
782         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
783         (shouldThrow):
784         * stress/to-object-intrinsic-number-edge.js: Added.
785         (shouldBe):
786         (builtin.createBuiltin):
787         * stress/to-object-intrinsic-object-edge.js: Added.
788         (shouldBe):
789         (builtin.createBuiltin):
790         (i.arg):
791         * stress/to-object-intrinsic-string-edge.js: Added.
792         (shouldBe):
793         (builtin.createBuiltin):
794         * stress/to-object-intrinsic-symbol-edge.js: Added.
795         (shouldBe):
796         (builtin.createBuiltin):
797         * stress/to-object-intrinsic.js: Added.
798         (shouldBe):
799         (shouldThrow):
800         (builtin.createBuiltin):
801
802 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
803
804         [DFG][FTL] Introduce StringSlice
805         https://bugs.webkit.org/show_bug.cgi?id=178934
806
807         Reviewed by Saam Barati.
808
809         * microbenchmarks/string-slice-empty.js: Added.
810         (slice):
811         * microbenchmarks/string-slice-one-char.js: Added.
812         (slice):
813         * microbenchmarks/string-slice.js: Added.
814         (slice):
815
816 2017-10-26  Michael Saboff  <msaboff@apple.com>
817
818         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
819         https://bugs.webkit.org/show_bug.cgi?id=178890
820
821         Reviewed by Keith Miller.
822
823         New regression test.
824
825         * stress/regress-178890.js: Added.
826
827 2017-10-26  Mark Lam  <mark.lam@apple.com>
828
829         JSRopeString::RopeBuilder::append() should check for overflows.
830         https://bugs.webkit.org/show_bug.cgi?id=178385
831         <rdar://problem/35027468>
832
833         Reviewed by Saam Barati.
834
835         * stress/regress-178385.js: Added.
836
837 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
838
839         Unreviewed, rolling out r223961.
840
841         The change that required this has been rolled out.
842
843         Reverted changeset:
844
845         "Mark test262.yaml/test262/test/language/statements/try/tco-
846         catch.js as passing."
847         https://bugs.webkit.org/show_bug.cgi?id=178592
848         https://trac.webkit.org/changeset/223961
849
850 2017-10-25  Commit Queue  <commit-queue@webkit.org>
851
852         Unreviewed, rolling out r223691 and r223729.
853         https://bugs.webkit.org/show_bug.cgi?id=178834
854
855         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
856         by rniwa on #webkit).
857
858         Reverted changesets:
859
860         "Turn recursive tail calls into loops"
861         https://bugs.webkit.org/show_bug.cgi?id=176601
862         https://trac.webkit.org/changeset/223691
863
864         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
865         comparison is always false due to limited range of data type
866         [-Wtype-limits]"
867         https://bugs.webkit.org/show_bug.cgi?id=178543
868         https://trac.webkit.org/changeset/223729
869
870 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
871
872         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
873         https://bugs.webkit.org/show_bug.cgi?id=178592
874
875         Unreviewed test gardening.
876
877         * test262.yaml:
878
879 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
880
881         [FTL] Support NewStringObject
882         https://bugs.webkit.org/show_bug.cgi?id=178737
883
884         Reviewed by Saam Barati.
885
886         * stress/new-string-object.js: Added.
887         (shouldBe):
888         (test):
889
890 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
891
892         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
893         https://bugs.webkit.org/show_bug.cgi?id=178308
894
895         Reviewed by Mark Lam.
896
897         * test262.yaml:
898
899 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
900
901         [JSC] Use fastJoin in Array#toString
902         https://bugs.webkit.org/show_bug.cgi?id=178062
903
904         Reviewed by Darin Adler.
905
906         * microbenchmarks/contiguous-array-to-string.js: Added.
907         (target):
908         * microbenchmarks/double-array-to-string.js: Added.
909         (target):
910         * microbenchmarks/int32-array-to-string.js: Added.
911         (target):
912
913 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
914
915         stress/check-string-ident.js is improperly skipped
916         https://bugs.webkit.org/show_bug.cgi?id=178642
917
918         Reviewed by Saam Barati.
919
920         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
921         since it enforces the run-jsc-stress-tests script to still set up the
922         test to run, despite the skip directive that's used before.
923
924 2017-10-20  Mark Lam  <mark.lam@apple.com>
925
926         Add a test case for r214334.
927         https://bugs.webkit.org/show_bug.cgi?id=169941
928         <rdar://problem/31221258>
929
930         Reviewed by JF Bastien.
931
932         * stress/regress-169941.js: Added.
933
934 2017-10-19  JF Bastien  <jfbastien@apple.com>
935
936         WebAssembly: no VM / JS version of everything but Instance
937         https://bugs.webkit.org/show_bug.cgi?id=177473
938
939         Reviewed by Filip Pizlo, Saam Barati.
940
941         - Exceeding max on memory growth now returns a range error as per
942         spec. This is a (very minor) breaking change: it used to throw OOM
943         error. Update the corresponding test.
944
945         * wasm/js-api/memory-grow.js:
946         (assertEq):
947         * wasm/js-api/table.js:
948         (assert.throws):
949
950 2017-10-19  Mark Lam  <mark.lam@apple.com>
951
952         Stringifier::appendStringifiedValue() is missing an exception check.
953         https://bugs.webkit.org/show_bug.cgi?id=178386
954         <rdar://problem/35027610>
955
956         Reviewed by Saam Barati.
957
958         * stress/regress-178386.js: Added.
959
960 2017-10-19  Michael Saboff  <msaboff@apple.com>
961
962         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
963         https://bugs.webkit.org/show_bug.cgi?id=178521
964
965         Reviewed by JF Bastien.
966
967         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
968         now passes with the current version (5.0) of the Emoji spec.
969
970 2017-10-19  Robin Morisset  <rmorisset@apple.com>
971
972         Turn recursive tail calls into loops
973         https://bugs.webkit.org/show_bug.cgi?id=176601
974
975         Reviewed by Saam Barati.
976
977         Add some simple test that computes factorial in several ways, and other trivial computations.
978         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
979         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
980         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
981         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
982
983         * stress/inline-call-to-recursive-tail-call.js: Added.
984         (factorial.aux):
985         (factorial):
986         (factorial2.aux):
987         (factorial2.id):
988         (factorial2):
989         (factorial3.aux):
990         (factorial3):
991         (aux):
992         (factorial4):
993         (test):
994
995 2017-10-18  Mark Lam  <mark.lam@apple.com>
996
997         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
998         https://bugs.webkit.org/show_bug.cgi?id=177600
999         <rdar://problem/34710985>
1000
1001         Reviewed by Saam Barati.
1002
1003         * stress/regress-177600.js: Added.
1004
1005 2017-10-18  Mark Lam  <mark.lam@apple.com>
1006
1007         The compiler should always register a structure when it adds its transitionWatchPointSet.
1008         https://bugs.webkit.org/show_bug.cgi?id=178420
1009         <rdar://problem/34814024>
1010
1011         Reviewed by Saam Barati and Filip Pizlo.
1012
1013         * stress/regress-178420.js: Added.
1014         (new.Array.10000.map):
1015
1016 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1017
1018         [JSC] __proto__ getter should be fast
1019         https://bugs.webkit.org/show_bug.cgi?id=178067
1020
1021         Reviewed by Saam Barati.
1022
1023         * stress/dfg-object-proto-accessor.js: Added.
1024         (shouldBe):
1025         (shouldThrow):
1026         (target):
1027         * stress/dfg-object-proto-getter.js: Added.
1028         (shouldBe):
1029         (shouldThrow):
1030         (target):
1031         * stress/dfg-object-prototype-of.js: Added.
1032         (shouldBe):
1033         (shouldThrow):
1034         (target):
1035         * stress/dfg-reflect-get-prototype-of.js: Added.
1036         (shouldBe):
1037         (shouldThrow):
1038         (target):
1039         * stress/intrinsic-getter-with-poly-proto.js: Added.
1040         (shouldBe):
1041         (makePolyProtoObject.foo.C):
1042         (makePolyProtoObject.foo):
1043         (makePolyProtoObject):
1044         (target):
1045         * stress/object-get-prototype-of-filtered.js: Added.
1046         (shouldBe):
1047         (shouldThrow):
1048         (target):
1049         (i.Cocoa):
1050         * stress/object-get-prototype-of-mono-proto.js: Added.
1051         (shouldBe):
1052         (makePolyProtoObject.foo.C):
1053         (makePolyProtoObject.foo):
1054         (makePolyProtoObject):
1055         (target):
1056         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1057         (shouldBe):
1058         (makePolyProtoObject.foo.C):
1059         (makePolyProtoObject.foo):
1060         (makePolyProtoObject):
1061         (target):
1062         * stress/object-get-prototype-of-poly-proto.js: Added.
1063         (shouldBe):
1064         (makePolyProtoObject.foo.C):
1065         (makePolyProtoObject.foo):
1066         (makePolyProtoObject):
1067         (target):
1068         * stress/object-proto-getter-filtered.js: Added.
1069         (shouldBe):
1070         (shouldThrow):
1071         (target):
1072         (i.Cocoa):
1073         * stress/object-proto-getter-poly-mono-proto.js: Added.
1074         (shouldBe):
1075         (makePolyProtoObject.foo.C):
1076         (makePolyProtoObject.foo):
1077         (makePolyProtoObject):
1078         (target):
1079         * stress/object-proto-getter-poly-proto.js: Added.
1080         (shouldBe):
1081         (makePolyProtoObject.foo.C):
1082         (makePolyProtoObject.foo):
1083         (makePolyProtoObject):
1084         (target):
1085         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1086         * stress/string-proto.js: Added.
1087         (shouldBe):
1088         (target):
1089
1090 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1091
1092         Unreviewed, rolling out r223523.
1093
1094         A test for this change is failing on debug JSC bots.
1095
1096         Reverted changeset:
1097
1098         "[JSC] __proto__ getter should be fast"
1099         https://bugs.webkit.org/show_bug.cgi?id=178067
1100         https://trac.webkit.org/changeset/223523
1101
1102 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1103
1104         [JSC] __proto__ getter should be fast
1105         https://bugs.webkit.org/show_bug.cgi?id=178067
1106
1107         Reviewed by Saam Barati.
1108
1109         * stress/dfg-object-proto-accessor.js: Added.
1110         (shouldBe):
1111         (shouldThrow):
1112         (target):
1113         * stress/dfg-object-proto-getter.js: Added.
1114         (shouldBe):
1115         (shouldThrow):
1116         (target):
1117         * stress/dfg-object-prototype-of.js: Added.
1118         (shouldBe):
1119         (shouldThrow):
1120         (target):
1121         * stress/dfg-reflect-get-prototype-of.js: Added.
1122         (shouldBe):
1123         (shouldThrow):
1124         (target):
1125         * stress/object-get-prototype-of-filtered.js: Added.
1126         (shouldBe):
1127         (shouldThrow):
1128         (target):
1129         (i.Cocoa):
1130         * stress/object-get-prototype-of-mono-proto.js: Added.
1131         (shouldBe):
1132         (makePolyProtoObject.foo.C):
1133         (makePolyProtoObject.foo):
1134         (makePolyProtoObject):
1135         (target):
1136         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1137         (shouldBe):
1138         (makePolyProtoObject.foo.C):
1139         (makePolyProtoObject.foo):
1140         (makePolyProtoObject):
1141         (target):
1142         * stress/object-get-prototype-of-poly-proto.js: Added.
1143         (shouldBe):
1144         (makePolyProtoObject.foo.C):
1145         (makePolyProtoObject.foo):
1146         (makePolyProtoObject):
1147         (target):
1148         * stress/object-proto-getter-filtered.js: Added.
1149         (shouldBe):
1150         (shouldThrow):
1151         (target):
1152         (i.Cocoa):
1153         * stress/object-proto-getter-poly-mono-proto.js: Added.
1154         (shouldBe):
1155         (makePolyProtoObject.foo.C):
1156         (makePolyProtoObject.foo):
1157         (makePolyProtoObject):
1158         (target):
1159         * stress/object-proto-getter-poly-proto.js: Added.
1160         (shouldBe):
1161         (makePolyProtoObject.foo.C):
1162         (makePolyProtoObject.foo):
1163         (makePolyProtoObject):
1164         (target):
1165         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1166         * stress/string-proto.js: Added.
1167         (shouldBe):
1168         (target):
1169
1170 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1171
1172         Reland "Add Above/Below comparisons for UInt32 patterns"
1173         https://bugs.webkit.org/show_bug.cgi?id=177281
1174
1175         Reviewed by Saam Barati.
1176
1177         * stress/uint32-comparison-jump.js: Added.
1178         (shouldBe):
1179         (above):
1180         (aboveOrEqual):
1181         (below):
1182         (belowOrEqual):
1183         (notAbove):
1184         (notAboveOrEqual):
1185         (notBelow):
1186         (notBelowOrEqual):
1187         * stress/uint32-comparison.js: Added.
1188         (shouldBe):
1189         (above):
1190         (aboveOrEqual):
1191         (below):
1192         (belowOrEqual):
1193         (aboveTest):
1194         (aboveOrEqualTest):
1195         (belowTest):
1196         (belowOrEqualTest):
1197
1198 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1199
1200         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1201         https://bugs.webkit.org/show_bug.cgi?id=178210
1202
1203         Reviewed by Saam Barati.
1204
1205         * wasm/function-tests/trap-from-start-async.js:
1206         (async.StartTrapsAsync):
1207         * wasm/function-tests/trap-from-start.js:
1208         (StartTraps):
1209         * wasm/js-api/web-assembly-function.js:
1210         (assert.eq.Object.getPrototypeOf):
1211         * wasm/js-api/wrapper-function.js:
1212         (return.new.WebAssembly.Module):
1213         (assert.throws.makeInstance): Deleted.
1214         (assert.throws.Bar): Deleted.
1215         (assert.throws): Deleted.
1216
1217 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1218
1219         Enable gigacage on iOS
1220         https://bugs.webkit.org/show_bug.cgi?id=177586
1221
1222         Reviewed by JF Bastien.
1223         
1224         Add tests for when Gigacage gets runtime disabled.
1225
1226         * stress/disable-gigacage-arrays.js: Added.
1227         (foo):
1228         * stress/disable-gigacage-strings.js: Added.
1229         (foo):
1230         * stress/disable-gigacage-typed-arrays.js: Added.
1231         (foo):
1232
1233 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1234
1235         import.meta should not be assignable
1236         https://bugs.webkit.org/show_bug.cgi?id=178202
1237
1238         Reviewed by Saam Barati.
1239
1240         * modules/import-meta-assignment.js: Added.
1241         (shouldThrow):
1242         (SyntaxError.import.meta.can.shouldThrow):
1243
1244 2017-10-11  Saam Barati  <sbarati@apple.com>
1245
1246         Unreviewed. Actually skip certain type profiler tests in debug.
1247
1248         * typeProfiler.yaml:
1249         * typeProfiler/deltablue-for-of.js:
1250         * typeProfiler/getter-richards.js:
1251
1252 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1253
1254         Unreviewed, rolling out r223113 and r223121.
1255         https://bugs.webkit.org/show_bug.cgi?id=178182
1256
1257         Reintroduced 20% regression on Kraken (Requested by rniwa on
1258         #webkit).
1259
1260         Reverted changesets:
1261
1262         "Enable gigacage on iOS"
1263         https://bugs.webkit.org/show_bug.cgi?id=177586
1264         https://trac.webkit.org/changeset/223113
1265
1266         "Use one virtual allocation for all gigacages and their
1267         runways"
1268         https://bugs.webkit.org/show_bug.cgi?id=178050
1269         https://trac.webkit.org/changeset/223121
1270
1271 2017-10-11  Michael Saboff  <msaboff@apple.com>
1272
1273         Disable test262 named capture group tests with direct unicode names and with references before definitions
1274         https://bugs.webkit.org/show_bug.cgi?id=178177
1275
1276         Reviewed by Keith Miller.
1277
1278         Bugs to track fixing these test are:
1279         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1280             "Add support in named capture group identifiers for direct surrogate pairs"
1281         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1282             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1283
1284         * test262.yaml:
1285
1286 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1287
1288         Object properties are undefined in super.call() but not in this.call()
1289         https://bugs.webkit.org/show_bug.cgi?id=177230
1290
1291         Reviewed by Saam Barati.
1292
1293         * stress/super-call-function-subclass.js: Added.
1294         (assert):
1295         (A.prototype.t):
1296         (A):
1297         * stress/super-dot-call-and-apply.js: Added.
1298         (assert):
1299         (A):
1300         (A.prototype.call):
1301         (A.prototype.apply):
1302         (B.prototype.testSuper):
1303         (B):
1304         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1305         (D.prototype.testSuper):
1306         (D):
1307
1308 2017-10-10  Saam Barati  <sbarati@apple.com>
1309
1310         The prototype cache should be aware of the Executable it generates a Structure for
1311         https://bugs.webkit.org/show_bug.cgi?id=177907
1312
1313         Reviewed by Filip Pizlo.
1314
1315         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1316         (assert):
1317         (foo.C):
1318         (foo):
1319         (bar.C):
1320         (bar):
1321         (access):
1322         (makeLongChain):
1323         (accessY):
1324
1325 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1326
1327         `async` should be able to be used as an imported binding name
1328         https://bugs.webkit.org/show_bug.cgi?id=176573
1329
1330         Reviewed by Saam Barati.
1331
1332         * modules/import-default-async.js: Added.
1333         * modules/import-named-async-as.js: Added.
1334         * modules/import-named-async.js: Added.
1335         * modules/import-named-async/target.js: Added.
1336         * modules/import-namespace-async.js: Added.
1337         * test262.yaml:
1338
1339 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1340
1341         Enable gigacage on iOS
1342         https://bugs.webkit.org/show_bug.cgi?id=177586
1343
1344         Reviewed by JF Bastien.
1345         
1346         Add tests for when Gigacage gets runtime disabled.
1347
1348         * stress/disable-gigacage-arrays.js: Added.
1349         (foo):
1350         * stress/disable-gigacage-strings.js: Added.
1351         (foo):
1352         * stress/disable-gigacage-typed-arrays.js: Added.
1353         (foo):
1354
1355 2017-10-09  Michael Saboff  <msaboff@apple.com>
1356
1357         Implement RegExp Unicode property escapes
1358         https://bugs.webkit.org/show_bug.cgi?id=172069
1359
1360         Reviewed by JF Bastien.
1361
1362         Enabled Unicode Property tests.
1363
1364         * test262.yaml:
1365
1366 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1367
1368         Unreviewed, rolling out r223015 and r223025.
1369         https://bugs.webkit.org/show_bug.cgi?id=178093
1370
1371         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1372         #webkit).
1373
1374         Reverted changesets:
1375
1376         "Enable gigacage on iOS"
1377         https://bugs.webkit.org/show_bug.cgi?id=177586
1378         http://trac.webkit.org/changeset/223015
1379
1380         "Unreviewed, disable Gigacage on ARM64 Linux"
1381         https://bugs.webkit.org/show_bug.cgi?id=177586
1382         http://trac.webkit.org/changeset/223025
1383
1384 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1385
1386         Update expectations for test262 tests that pass after r223043.
1387         https://bugs.webkit.org/show_bug.cgi?id=176685
1388
1389         Unreviewed test gardening.
1390
1391         * test262.yaml:
1392
1393 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1394
1395         Unreviewed, rolling out r223022.
1396
1397         This change introduced 18 test262 failures.
1398
1399         Reverted changeset:
1400
1401         "`async` should be able to be used as an imported binding
1402         name"
1403         https://bugs.webkit.org/show_bug.cgi?id=176573
1404         http://trac.webkit.org/changeset/223022
1405
1406 2017-10-09  Saam Barati  <sbarati@apple.com>
1407
1408         3 poly-proto JSC tests timing out on debug after r222827
1409         https://bugs.webkit.org/show_bug.cgi?id=177880
1410         <rdar://problem/34817122>
1411
1412         Unreviewed.
1413
1414         I'm skipping these type profiler tests on debug since they are long running.
1415
1416         * typeProfiler/deltablue-for-of.js:
1417         * typeProfiler/getter-richards.js:
1418
1419 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1420
1421         Safari 10 /11 problem with if (!await get(something)).
1422         https://bugs.webkit.org/show_bug.cgi?id=176685
1423
1424         Reviewed by Saam Barati.
1425
1426         * stress/async-await-basic.js:
1427         (awaitEpression.async):
1428         * stress/async-await-syntax.js:
1429         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1430         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1431
1432 2017-10-08  Saam Barati  <sbarati@apple.com>
1433
1434         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1435
1436         * typeProfiler/deltablue-for-of.js:
1437         * typeProfiler/getter-richards.js:
1438
1439 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1440
1441         `async` should be able to be used as an imported binding name
1442         https://bugs.webkit.org/show_bug.cgi?id=176573
1443
1444         Reviewed by Darin Adler.
1445
1446         * modules/import-default-async.js: Added.
1447         * modules/import-named-async-as.js: Added.
1448         * modules/import-named-async.js: Added.
1449         * modules/import-named-async/target.js: Added.
1450         * modules/import-namespace-async.js: Added.
1451
1452 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1453
1454         Enable gigacage on iOS
1455         https://bugs.webkit.org/show_bug.cgi?id=177586
1456
1457         Reviewed by JF Bastien.
1458         
1459         Add tests for when Gigacage gets runtime disabled.
1460
1461         * stress/disable-gigacage-arrays.js: Added.
1462         (foo):
1463         * stress/disable-gigacage-strings.js: Added.
1464         (foo):
1465         * stress/disable-gigacage-typed-arrays.js: Added.
1466         (foo):
1467
1468 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1469
1470         Unreviewed, rolling out r222791 and r222873.
1471         https://bugs.webkit.org/show_bug.cgi?id=178031
1472
1473         Caused crashes with workers/wasm LayoutTests (Requested by
1474         ryanhaddad on #webkit).
1475
1476         Reverted changesets:
1477
1478         "WebAssembly: no VM / JS version of everything but Instance"
1479         https://bugs.webkit.org/show_bug.cgi?id=177473
1480         http://trac.webkit.org/changeset/222791
1481
1482         "WebAssembly: address no VM / JS follow-ups"
1483         https://bugs.webkit.org/show_bug.cgi?id=177887
1484         http://trac.webkit.org/changeset/222873
1485
1486 2017-10-05  Saam Barati  <sbarati@apple.com>
1487
1488         Make sure all prototypes under poly proto get added into the VM's prototype map
1489         https://bugs.webkit.org/show_bug.cgi?id=177909
1490
1491         Reviewed by Keith Miller.
1492
1493         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1494         (assert):
1495         (foo.C):
1496         (foo):
1497         (set x):
1498
1499 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1500
1501         [JSC] Introduce import.meta
1502         https://bugs.webkit.org/show_bug.cgi?id=177703
1503
1504         Reviewed by Filip Pizlo.
1505
1506         * modules/import-meta-syntax.js: Added.
1507         (shouldThrow):
1508         (shouldNotThrow):
1509         * modules/import-meta.js: Added.
1510         * modules/import-meta/cocoa.js: Added.
1511         * modules/resources/assert.js:
1512         (export.shouldNotThrow):
1513         * stress/import-syntax.js:
1514
1515 2017-10-04  Saam Barati  <sbarati@apple.com>
1516
1517         Make pertinent AccessCases watch the poly proto watchpoint
1518         https://bugs.webkit.org/show_bug.cgi?id=177765
1519
1520         Reviewed by Keith Miller.
1521
1522         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1523         (assert):
1524         (foo.C):
1525         (foo):
1526         (validate):
1527         * stress/poly-proto-clear-stub.js: Added.
1528         (assert):
1529         (foo.C):
1530         (foo):
1531
1532 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1533
1534         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1535
1536         Unreviewed test gardening.
1537
1538         * test262.yaml:
1539
1540 2017-10-04  Saam Barati  <sbarati@apple.com>
1541
1542         3 poly-proto JSC tests timing out on debug after r222827
1543         https://bugs.webkit.org/show_bug.cgi?id=177880
1544
1545         Rubber stamped by Mark Lam.
1546
1547         * microbenchmarks/poly-proto-access.js:
1548         * typeProfiler/deltablue-for-of.js:
1549         * typeProfiler/getter-richards.js:
1550
1551 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1552
1553         Unreviewed, marking tco-catch.js as a failure after test262 update
1554         https://bugs.webkit.org/show_bug.cgi?id=177859
1555
1556         * test262.yaml:
1557
1558 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1559
1560         Unreviewed, marking one async iterator test262 test failed
1561         https://bugs.webkit.org/show_bug.cgi?id=177859
1562
1563         * test262.yaml:
1564
1565 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1566
1567         [Test262] Update Test262 to Oct 4 version
1568         https://bugs.webkit.org/show_bug.cgi?id=177859
1569
1570         Reviewed by Sam Weinig.
1571
1572         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1573         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1574
1575         * test262.yaml:
1576         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1577         (checkSequence):
1578         * test262/harness/typeCoercion.js:
1579         (testCoercibleToIndexZero):
1580         (testCoercibleToIndexOne):
1581         (testCoercibleToIndexFromIndex):
1582         (testNotCoercibleToIndex.testPrimitiveValue):
1583         (testNotCoercibleToInteger):
1584         (testCoercibleToBigIntZero.testPrimitiveValue):
1585         (testCoercibleToBigIntZero):
1586         (testCoercibleToBigIntOne.testPrimitiveValue):
1587         (testCoercibleToBigIntOne):
1588         (testPrimitiveValue):
1589         (testCoercibleToBigIntFromBigInt):
1590         (testNotCoercibleToBigInt.testPrimitiveValue):
1591         (testNotCoercibleToBigInt.testStringValue):
1592         (testNotCoercibleToBigInt):
1593         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1594         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1595         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1596         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1597         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1598         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1599         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1600         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1601         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1602         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1603         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1604         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1605         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1606         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1607         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1608         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1609         (testCoercibleToBigIntZero):
1610         (testCoercibleToBigIntOne):
1611         (testNotCoercibleToBigInt):
1612         (MyError): Deleted.
1613         (valueOf): Deleted.
1614         (toString): Deleted.
1615         (Symbol.toPrimitive): Deleted.
1616         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1617         (testCoercibleToIndexZero):
1618         (testCoercibleToIndexOne):
1619         (testNotCoercibleToIndex):
1620         (MyError): Deleted.
1621         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1622         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1623         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1624         (BigInt.asIntN.valueOf): Deleted.
1625         (BigInt.asIntN.toString): Deleted.
1626         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1627         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1628         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1629         (testCoercibleToBigIntZero):
1630         (testCoercibleToBigIntOne):
1631         (testNotCoercibleToBigInt):
1632         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1633         (testCoercibleToIndexZero):
1634         (testCoercibleToIndexOne):
1635         (testNotCoercibleToIndex):
1636         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1637         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1638         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1639         (bits.valueOf):
1640         (bigint.valueOf):
1641         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1642         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1643         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1644         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1645         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1646         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1647         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1648         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1649         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1650         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1651         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1652         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1653         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1654         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1655         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1656         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1657         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1658         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1659         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1660         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1661         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1662         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1663         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1664         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1665         (replacer):
1666         (BigInt.prototype.toJSON):
1667         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1668         (replacer):
1669         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1670         (BigInt.prototype.toJSON):
1671         * test262/test/built-ins/JSON/stringify/bigint.js:
1672         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1673         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1674         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1675         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1676         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1677         * test262/test/built-ins/Object/proto-from-ctor.js:
1678         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1679         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1680         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1681         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1682         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1683         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1684         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1685         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1686         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1687         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1688         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1689         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1690         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1691         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1692         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1693         * test262/test/built-ins/Proxy/get-fn-realm.js:
1694         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1695         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1696         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1697         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1698         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1699         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1700         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1701         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1702         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1703         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1704         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1705         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1706         (i6.replace):
1707         (i6b.replace):
1708         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1709         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1710         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1711         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1712         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1713         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1714         * test262/test/built-ins/RegExp/u180e.js: Added.
1715         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1716         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1717         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1718         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1719         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1720         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1721         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1722         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1723         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1724         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1725         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1726         * test262/test/built-ins/String/prototype/endsWith/length.js:
1727         * test262/test/built-ins/String/prototype/endsWith/name.js:
1728         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1729         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1730         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1731         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1732         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1733         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1734         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1735         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1736         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1737         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1738         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1739         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1740         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1741         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1742         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1743         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1744         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1745         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1746         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1747         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1748         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1749         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1750         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1751         * test262/test/built-ins/String/prototype/includes/includes.js:
1752         * test262/test/built-ins/String/prototype/includes/length.js:
1753         * test262/test/built-ins/String/prototype/includes/name.js:
1754         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1755         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1756         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1757         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1758         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1759         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1760         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1761         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1762         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1763         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1764         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1765         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1766         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1767         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1768         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1769         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1770         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1771         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1772         * test262/test/built-ins/String/prototype/trim/u180e.js:
1773         * test262/test/built-ins/Symbol/for/cross-realm.js:
1774         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1775         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1776         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1777         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1778         * test262/test/built-ins/Symbol/match/cross-realm.js:
1779         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1780         * test262/test/built-ins/Symbol/search/cross-realm.js:
1781         * test262/test/built-ins/Symbol/species/cross-realm.js:
1782         * test262/test/built-ins/Symbol/split/cross-realm.js:
1783         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1784         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1785         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1786         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1787         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1788         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1789         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1790         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1791         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1792         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1793         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1794         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1795         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1796         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1797         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1798         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1799         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1800         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1801         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1802         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1803         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1804         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1805         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1806         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1807         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1808         * test262/test/language/eval-code/indirect/realm.js:
1809         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1810         (o.get z):
1811         (o.get a):
1812         * test262/test/language/expressions/call/eval-realm-indirect.js:
1813         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1814         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1815         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1816         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1817         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1818         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1819         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1820         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1821         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1822         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1823         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1824         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1825         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1826         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1827         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1828         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1829         * test262/test/language/expressions/less-than/bigint-and-number.js:
1830         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1831         * test262/test/language/expressions/super/realm.js:
1832         * test262/test/language/expressions/tagged-template/cache-realm.js:
1833         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1834         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1835         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1836         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1837         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1838         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1839         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1840         (o.get z):
1841         (o.get a):
1842         * test262/test/language/statements/for-of/iterator-next-reference.js:
1843         (next):
1844         (iterator.next): Deleted.
1845         (x.of.iterable.): Deleted.
1846         (x.of.iterable.get return): Deleted.
1847         (x.of.iterable.iterator.next): Deleted.
1848         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1849         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1850         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1851         * test262/test/language/white-space/mongolian-vowel-separator.js:
1852         * test262/test262-Revision.txt:
1853
1854 2017-10-03  Saam Barati  <sbarati@apple.com>
1855
1856         Implement polymorphic prototypes
1857         https://bugs.webkit.org/show_bug.cgi?id=176391
1858
1859         Reviewed by Filip Pizlo.
1860
1861         * microbenchmarks/poly-proto-access.js: Added.
1862         (assert):
1863         (foo.C):
1864         (foo.C.prototype.get bar):
1865         (foo):
1866         (bar):
1867         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1868         (assert):
1869         (makePolyProtoObject.foo.C):
1870         (makePolyProtoObject.foo):
1871         (makePolyProtoObject):
1872         (performSet):
1873         * microbenchmarks/poly-proto-setter-speed.js: Added.
1874         (assert):
1875         (makePolyProtoObject.foo.C):
1876         (makePolyProtoObject.foo.C.prototype.set p):
1877         (makePolyProtoObject.foo):
1878         (makePolyProtoObject):
1879         (performSet):
1880         * stress/constructor-with-return.js:
1881         (i.tests.forEach.Constructor):
1882         (i.tests.forEach):
1883         (tests.forEach.Constructor): Deleted.
1884         (tests.forEach): Deleted.
1885         * stress/dom-jit-with-poly-proto.js: Added.
1886         (assert):
1887         (makePolyProtoObject.foo.C):
1888         (makePolyProtoObject.foo):
1889         (makePolyProtoObject):
1890         (validate):
1891         * stress/poly-proto-custom-value-and-accessor.js: Added.
1892         (assert):
1893         (makePolyProtoObject.foo.C):
1894         (makePolyProtoObject.foo):
1895         (makePolyProtoObject):
1896         (items.forEach):
1897         (set get for):
1898         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1899         (assert):
1900         (makePolyProtoObject.foo.C):
1901         (makePolyProtoObject.foo):
1902         (makePolyProtoObject):
1903         (foo):
1904         * stress/poly-proto-miss.js: Added.
1905         (makePolyProtoInstanceWithNullPrototype.foo.C):
1906         (makePolyProtoInstanceWithNullPrototype.foo):
1907         (makePolyProtoInstanceWithNullPrototype):
1908         (assert):
1909         (validate):
1910         * stress/poly-proto-op-in-caching.js: Added.
1911         (assert):
1912         (makePolyProtoObject.foo.C):
1913         (makePolyProtoObject.foo):
1914         (makePolyProtoObject):
1915         (validate):
1916         (validate2):
1917         * stress/poly-proto-put-transition.js: Added.
1918         (assert):
1919         (makePolyProtoObject.foo.C):
1920         (makePolyProtoObject.foo):
1921         (makePolyProtoObject):
1922         (performSet):
1923         (i.obj.__proto__.set p):
1924         * stress/poly-proto-set-prototype.js: Added.
1925         (assert):
1926         (let.alternateProto.get x):
1927         (let.alternateProto2.get y):
1928         (let.alternateProto2.get x):
1929         (foo.C):
1930         (foo):
1931         (validate):
1932         * stress/poly-proto-setter.js: Added.
1933         (assert):
1934         (makePolyProtoObject.foo.C):
1935         (makePolyProtoObject.foo.C.prototype.set p):
1936         (makePolyProtoObject.foo.C.prototype.get p):
1937         (makePolyProtoObject.foo):
1938         (makePolyProtoObject):
1939         (performSet):
1940         * stress/poly-proto-using-inheritance.js: Added.
1941         (assert):
1942         (foo.C):
1943         (foo.C.prototype.get baz):
1944         (foo):
1945         (bar.C):
1946         (bar):
1947         (validate):
1948         * stress/primitive-poly-proto.js: Added.
1949         (makePolyProtoInstance.foo.C):
1950         (makePolyProtoInstance.foo):
1951         (makePolyProtoInstance):
1952         (assert):
1953         (validate):
1954         * stress/prototype-is-not-js-object.js: Added.
1955         (foo.bar):
1956         (foo):
1957         (assert):
1958         (validate):
1959         * stress/try-get-by-id-poly-proto.js: Added.
1960         (assert):
1961         (makePolyProtoObject.foo.C):
1962         (makePolyProtoObject.foo):
1963         (makePolyProtoObject):
1964         (tryGetByIdText):
1965         (x.__proto__.get bar):
1966         (validate):
1967         * typeProfiler/overflow.js:
1968
1969 2017-10-03  JF Bastien  <jfbastien@apple.com>
1970
1971         WebAssembly: no VM / JS version of everything but Instance
1972         https://bugs.webkit.org/show_bug.cgi?id=177473
1973
1974         Reviewed by Filip Pizlo.
1975
1976         - Exceeding max on memory growth now returns a range error as per
1977         spec. This is a (very minor) breaking change: it used to throw OOM
1978         error. Update the corresponding test.
1979
1980         * wasm/js-api/memory-grow.js:
1981         (assertEq):
1982         * wasm/js-api/table.js:
1983         (assert.throws):
1984
1985 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1986
1987         Skip JSC test stress/regress-159779-2.js on debug.
1988         https://bugs.webkit.org/show_bug.cgi?id=177204
1989
1990         Unreviewed test gardening.
1991
1992         * stress/regress-159779-2.js:
1993
1994 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1995
1996         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1997         https://bugs.webkit.org/show_bug.cgi?id=175642
1998
1999         Reviewed by Darin Adler.
2000
2001         * ChakraCore/test/Function/apply3.baseline-jsc:
2002
2003 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2004
2005         Unreviewed, rolling out r222564.
2006         https://bugs.webkit.org/show_bug.cgi?id=177720
2007
2008         "It regressed JetStream by 2% on iOS caused by a 50%
2009         regression on the bigfib subtest" (Requested by saamyjoon on
2010         #webkit).
2011
2012         Reverted changeset:
2013
2014         "Add Above/Below comparisons for UInt32 patterns"
2015         https://bugs.webkit.org/show_bug.cgi?id=177281
2016         http://trac.webkit.org/changeset/222564
2017
2018 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2019
2020         [DFG] Support ArrayPush with multiple args
2021         https://bugs.webkit.org/show_bug.cgi?id=175823
2022
2023         Reviewed by Saam Barati.
2024
2025         * microbenchmarks/array-push-0.js: Added.
2026         (arrayPush0):
2027         * microbenchmarks/array-push-1.js: Added.
2028         (arrayPush1):
2029         * microbenchmarks/array-push-2.js: Added.
2030         (arrayPush2):
2031         * microbenchmarks/array-push-3.js: Added.
2032         (arrayPush3):
2033         * stress/array-push-multiple-contiguous.js: Added.
2034         (shouldBe):
2035         (test):
2036         * stress/array-push-multiple-double-nan.js: Added.
2037         (shouldBe):
2038         (test):
2039         * stress/array-push-multiple-double.js: Added.
2040         (shouldBe):
2041         (test):
2042         * stress/array-push-multiple-int32.js: Added.
2043         (shouldBe):
2044         (test):
2045         * stress/array-push-multiple-many-contiguous.js: Added.
2046         (shouldBe):
2047         (test):
2048         * stress/array-push-multiple-many-double.js: Added.
2049         (shouldBe):
2050         (test):
2051         * stress/array-push-multiple-many-int32.js: Added.
2052         (shouldBe):
2053         (test):
2054         * stress/array-push-multiple-many-storage.js: Added.
2055         (shouldBe):
2056         (test):
2057         * stress/array-push-multiple-storage.js: Added.
2058         (shouldBe):
2059         (test):
2060         * stress/array-push-with-force-exit.js: Added.
2061         (target.createBuiltin):
2062
2063 2017-09-29  Saam Barati  <sbarati@apple.com>
2064
2065         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2066         https://bugs.webkit.org/show_bug.cgi?id=177639
2067
2068         Reviewed by Geoffrey Garen.
2069
2070         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2071         (assert):
2072         (Class):
2073         (items.forEach):
2074         (set get for):
2075
2076 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2077
2078         Unreviewed, rolling out r222563, r222565, and r222581.
2079         https://bugs.webkit.org/show_bug.cgi?id=177675
2080
2081         "It causes a crash when playing youtube videos" (Requested by
2082         saamyjoon on #webkit).
2083
2084         Reverted changesets:
2085
2086         "[DFG] Support ArrayPush with multiple args"
2087         https://bugs.webkit.org/show_bug.cgi?id=175823
2088         http://trac.webkit.org/changeset/222563
2089
2090         "Unreviewed, build fix after r222563"
2091         https://bugs.webkit.org/show_bug.cgi?id=175823
2092         http://trac.webkit.org/changeset/222565
2093
2094         "Unreviewed, fix x86 breaking due to exhausted registers"
2095         https://bugs.webkit.org/show_bug.cgi?id=175823
2096         http://trac.webkit.org/changeset/222581
2097
2098 2017-09-28  Mark Lam  <mark.lam@apple.com>
2099
2100         test262: Unexpected passes after r222617 and r222618.
2101         https://bugs.webkit.org/show_bug.cgi?id=177622
2102         <rdar://problem/34725960>
2103
2104         Reviewed by Saam Barati.
2105
2106         Update test262.yaml for tests that are now passing.
2107
2108         * test262.yaml:
2109
2110 2017-09-27  Michael Saboff  <msaboff@apple.com>
2111
2112         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2113         https://bugs.webkit.org/show_bug.cgi?id=177570
2114
2115         Reviewed by Filip Pizlo.
2116
2117         New regression test.
2118
2119         * stress/regress-177570.js: Added.
2120
2121 2017-09-28  Michael Saboff  <msaboff@apple.com>
2122
2123         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2124         https://bugs.webkit.org/show_bug.cgi?id=177423
2125
2126         Reviewed by Mark Lam.
2127
2128         Updated regression test.
2129
2130         * stress/regress-177423.js:
2131         (catch):
2132
2133 2017-09-27  Mark Lam  <mark.lam@apple.com>
2134
2135         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2136         https://bugs.webkit.org/show_bug.cgi?id=177584
2137         <rdar://problem/34463903>
2138
2139         Reviewed by Saam Barati.
2140
2141         * stress/regress-177584.js: Added.
2142         (assertEqual):
2143         (Array.prototype.Symbol.species):
2144
2145 2017-09-27  Saam Barati  <sbarati@apple.com>
2146
2147         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2148         https://bugs.webkit.org/show_bug.cgi?id=177523
2149
2150         Reviewed by Mark Lam.
2151
2152         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2153         (assert):
2154         (Test):
2155         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2156         (addMethods):
2157         (i.Test.prototype.propName):
2158
2159 2017-09-27  Mark Lam  <mark.lam@apple.com>
2160
2161         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2162         https://bugs.webkit.org/show_bug.cgi?id=177423
2163         <rdar://problem/34621320>
2164
2165         Reviewed by Keith Miller.
2166
2167         * stress/regress-177423.js: Added.
2168
2169 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2170
2171         Add Above/Below comparisons for UInt32 patterns
2172         https://bugs.webkit.org/show_bug.cgi?id=177281
2173
2174         Reviewed by Saam Barati.
2175
2176         * stress/uint32-comparison-jump.js: Added.
2177         (shouldBe):
2178         (above):
2179         (aboveOrEqual):
2180         (below):
2181         (belowOrEqual):
2182         (notAbove):
2183         (notAboveOrEqual):
2184         (notBelow):
2185         (notBelowOrEqual):
2186         * stress/uint32-comparison.js: Added.
2187         (shouldBe):
2188         (above):
2189         (aboveOrEqual):
2190         (below):
2191         (belowOrEqual):
2192         (aboveTest):
2193         (aboveOrEqualTest):
2194         (belowTest):
2195         (belowOrEqualTest):
2196
2197 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2198
2199         [DFG] Support ArrayPush with multiple args
2200         https://bugs.webkit.org/show_bug.cgi?id=175823
2201
2202         Reviewed by Saam Barati.
2203
2204         * microbenchmarks/array-push-0.js: Added.
2205         (arrayPush0):
2206         * microbenchmarks/array-push-1.js: Added.
2207         (arrayPush1):
2208         * microbenchmarks/array-push-2.js: Added.
2209         (arrayPush2):
2210         * microbenchmarks/array-push-3.js: Added.
2211         (arrayPush3):
2212         * stress/array-push-multiple-contiguous.js: Added.
2213         (shouldBe):
2214         (test):
2215         * stress/array-push-multiple-double-nan.js: Added.
2216         (shouldBe):
2217         (test):
2218         * stress/array-push-multiple-double.js: Added.
2219         (shouldBe):
2220         (test):
2221         * stress/array-push-multiple-int32.js: Added.
2222         (shouldBe):
2223         (test):
2224         * stress/array-push-multiple-many-contiguous.js: Added.
2225         (shouldBe):
2226         (test):
2227         * stress/array-push-multiple-many-double.js: Added.
2228         (shouldBe):
2229         (test):
2230         * stress/array-push-multiple-many-int32.js: Added.
2231         (shouldBe):
2232         (test):
2233         * stress/array-push-multiple-many-storage.js: Added.
2234         (shouldBe):
2235         (test):
2236         * stress/array-push-multiple-storage.js: Added.
2237         (shouldBe):
2238         (test):
2239
2240 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2241
2242         Unreviewed, rolling out r222518.
2243         https://bugs.webkit.org/show_bug.cgi?id=177507
2244
2245         Break the High Sierra build (Requested by yusukesuzuki on
2246         #webkit).
2247
2248         Reverted changeset:
2249
2250         "Add Above/Below comparisons for UInt32 patterns"
2251         https://bugs.webkit.org/show_bug.cgi?id=177281
2252         http://trac.webkit.org/changeset/222518
2253
2254 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2255
2256         Add Above/Below comparisons for UInt32 patterns
2257         https://bugs.webkit.org/show_bug.cgi?id=177281
2258
2259         Reviewed by Saam Barati.
2260
2261         * stress/uint32-comparison-jump.js: Added.
2262         (shouldBe):
2263         (above):
2264         (aboveOrEqual):
2265         (below):
2266         (belowOrEqual):
2267         (notAbove):
2268         (notAboveOrEqual):
2269         (notBelow):
2270         (notBelowOrEqual):
2271         * stress/uint32-comparison.js: Added.
2272         (shouldBe):
2273         (above):
2274         (aboveOrEqual):
2275         (below):
2276         (belowOrEqual):
2277         (aboveTest):
2278         (aboveOrEqualTest):
2279         (belowTest):
2280         (belowOrEqualTest):
2281
2282 2017-09-23  Keith Miller  <keith_miller@apple.com>
2283
2284         Fix infinite looping test262 test
2285         https://bugs.webkit.org/show_bug.cgi?id=177412
2286
2287         Reviewed by Yusuke Suzuki.
2288
2289         This test was poorly designed since failing it would cause the vm
2290         to inifinite loop. I've fixed it locally and will fix it on github pending
2291         the results of next weeks tc39 meeting.
2292
2293         * test262.yaml:
2294         * test262/test/language/statements/for-of/iterator-next-reference.js:
2295
2296 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2297
2298         test262: $.agent became $262.agent in test262 update
2299         https://bugs.webkit.org/show_bug.cgi?id=177407
2300
2301         Reviewed by Yusuke Suzuki.
2302
2303         * test262.yaml:
2304         ~320 tests pass now that we correctly make $262 available.
2305
2306 2017-09-22  Keith Miller  <keith_miller@apple.com>
2307
2308         Speculatively change iteration protocall to use the same next function
2309         https://bugs.webkit.org/show_bug.cgi?id=175653
2310
2311         Reviewed by Saam Barati.
2312
2313         Change test to match the new iteration behavior.
2314
2315         * stress/spread-optimized-properly.js:
2316
2317 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2318
2319         [DFG][FTL] Profile array vector length for array allocation
2320         https://bugs.webkit.org/show_bug.cgi?id=177051
2321
2322         Reviewed by Saam Barati.
2323
2324         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2325         (target):
2326
2327 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2328
2329         Unreviewed, rolling out r222380.
2330         https://bugs.webkit.org/show_bug.cgi?id=177352
2331
2332         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2333         #webkit).
2334
2335         Reverted changeset:
2336
2337         "[DFG][FTL] Profile array vector length for array allocation"
2338         https://bugs.webkit.org/show_bug.cgi?id=177051
2339         http://trac.webkit.org/changeset/222380
2340
2341 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2342
2343         [DFG][FTL] Profile array vector length for array allocation
2344         https://bugs.webkit.org/show_bug.cgi?id=177051
2345
2346         Reviewed by Saam Barati.
2347
2348         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2349         (target):
2350
2351 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2352
2353         Skip new hanging test262 tests.
2354         https://bugs.webkit.org/show_bug.cgi?id=177326
2355
2356         Unreviewed test gardening.
2357
2358         * test262.yaml:
2359
2360 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2361
2362         Mark 6 test262 tests as passing.
2363         https://bugs.webkit.org/show_bug.cgi?id=177307
2364
2365         Unreviewed test gardening.
2366
2367         * test262.yaml:
2368
2369 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2370
2371         Unreviewed follow-up to r222311.
2372
2373         * test262/harness/sta.js:
2374         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2375         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2376         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2377         * test262/test/built-ins/Array/from/elements-added-after.js:
2378         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2379         * test262/test/built-ins/Array/from/elements-updated-after.js:
2380         * test262/test/built-ins/Array/from/from-array.js:
2381         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2382         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2383         * test262/test/built-ins/Array/from/source-array-boundary.js:
2384         * test262/test/built-ins/Array/from/source-object-constructor.js:
2385         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2386         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2387         * test262/test/built-ins/Array/from/source-object-length.js:
2388         * test262/test/built-ins/Array/from/source-object-missing.js:
2389         * test262/test/built-ins/Array/from/source-object-without.js:
2390         * test262/test/built-ins/Array/from/this-null.js:
2391         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2392         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2393         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2394         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2395         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2396         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2397         * test262/test/language/literals/string/7.8.4-1gs.js:
2398         Fix some files that I failed to update when I applied my patch.
2399
2400 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2401
2402         Update test262 tests
2403         https://bugs.webkit.org/show_bug.cgi?id=177220
2404
2405         Reviewed by Saam Barati and Yusuke Suzuki.
2406
2407         * test262.yaml:
2408         * test262/test262-Revision.txt:
2409         New rebaselined expectations for all tests.
2410
2411         * test262/*:
2412         Updated.
2413
2414 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2415
2416         [DFG] Remove ToThis more aggressively
2417         https://bugs.webkit.org/show_bug.cgi?id=177056
2418
2419         Reviewed by Saam Barati.
2420
2421         * stress/generator-with-this-strict.js: Added.
2422         (shouldBe):
2423         (generator):
2424         (target):
2425         * stress/generator-with-this.js: Added.
2426         (shouldBe):
2427         (generator):
2428         (target):
2429
2430 2017-09-17  Michael Saboff  <msaboff@apple.com>
2431
2432         https://bugs.webkit.org/show_bug.cgi?id=177038
2433         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2434
2435         Reviewed by JF Bastien.
2436
2437         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2438         as it dies using too much memory.
2439
2440 2017-09-15  Saam Barati  <sbarati@apple.com>
2441
2442         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2443         https://bugs.webkit.org/show_bug.cgi?id=176981
2444
2445         Reviewed by Yusuke Suzuki.
2446
2447         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2448         (assert):
2449         (verify):
2450         (func):
2451         (const.bar.createBuiltin):
2452
2453 2017-09-14  Saam Barati  <sbarati@apple.com>
2454
2455         It should be valid to exit before each set when doing arity fixup when inlining
2456         https://bugs.webkit.org/show_bug.cgi?id=176948
2457
2458         Reviewed by Keith Miller.
2459
2460         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2461         (baz):
2462         (bar):
2463         (foo):
2464
2465 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2466
2467         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2468         https://bugs.webkit.org/show_bug.cgi?id=176867
2469
2470         Reviewed by Sam Weinig.
2471
2472         * microbenchmarks/object-get-own-property-symbols.js: Added.
2473         (test):
2474
2475 2017-09-13  Mark Lam  <mark.lam@apple.com>
2476
2477         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2478         https://bugs.webkit.org/show_bug.cgi?id=176888
2479         <rdar://problem/34381832>
2480
2481         Not reviewed.
2482
2483         * stress/op_mod-ConstVar.js:
2484         * stress/op_mod-VarConst.js:
2485         * stress/op_mod-VarVar.js:
2486
2487 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2488
2489         Skip 3 op_mod tests on Debug JSC bots.
2490         https://bugs.webkit.org/show_bug.cgi?id=176630
2491
2492         Unreviewed test gardening.
2493
2494         * stress/op_mod-ConstVar.js:
2495         * stress/op_mod-VarConst.js:
2496         * stress/op_mod-VarVar.js:
2497
2498 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2499
2500         [JSC] Fix Array allocation in Object.keys
2501         https://bugs.webkit.org/show_bug.cgi?id=176826
2502
2503         Reviewed by Saam Barati.
2504
2505         * stress/object-own-property-keys.js: Added.
2506         (shouldBe):
2507
2508 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2509
2510         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2511         https://bugs.webkit.org/show_bug.cgi?id=176010
2512
2513         Reviewed by Filip Pizlo.
2514
2515         * microbenchmarks/weak-map-key.js: Added.
2516         (assert):
2517         (objectKey):
2518         (let.start.Date.now):
2519
2520 2017-09-12  Mark Lam  <mark.lam@apple.com>
2521
2522         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2523         https://bugs.webkit.org/show_bug.cgi?id=176630
2524
2525         Reviewed by JF Bastien.
2526
2527         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2528         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2529         a speculative fix for the bots that are seeing these fail.
2530
2531         I also undid the skipping of the op_mod tests for debug builds.
2532
2533         * stress/op_div-ConstVar.js:
2534         * stress/op_div-VarConst.js:
2535         * stress/op_div-VarVar.js:
2536         * stress/op_mod-ConstVar.js:
2537         * stress/op_mod-VarConst.js:
2538         * stress/op_mod-VarVar.js:
2539
2540 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2541
2542         Skip stress/value-to-boolean.js on Debug bots.
2543         https://bugs.webkit.org/show_bug.cgi?id=176787
2544
2545         Unreviewed test gardening.
2546
2547         * stress/value-to-boolean.js:
2548
2549 2017-09-11  Mark Lam  <mark.lam@apple.com>
2550
2551         Change test expectation for test262/test/language/statements/try/tco-catch.js
2552         https://bugs.webkit.org/show_bug.cgi?id=176749
2553
2554         Rubber stamped by Keith Miller.
2555
2556         It's been failing since at least r221821.  I'm changing the test expectation to
2557         fail to green the bots while I investigate some more.
2558
2559         * test262.yaml:
2560
2561 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2562
2563         Unreviewed, rolling out r221854.
2564
2565         The test added with this change fails on 32-bit JSC bots.
2566
2567         Reverted changeset:
2568
2569         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2570         https://bugs.webkit.org/show_bug.cgi?id=176010
2571         http://trac.webkit.org/changeset/221854
2572
2573 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2574
2575         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2576         https://bugs.webkit.org/show_bug.cgi?id=176010
2577
2578         Reviewed by Filip Pizlo.
2579
2580         * microbenchmarks/weak-map-key.js: Added.
2581         (assert):
2582         (objectKey):
2583         (let.start.Date.now):
2584
2585 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2586
2587         [JSC] Optimize Object.keys by using careful array allocation
2588         https://bugs.webkit.org/show_bug.cgi?id=176654
2589
2590         Reviewed by Darin Adler.
2591
2592         * microbenchmarks/object-keys.js: Added.
2593         (test):
2594
2595 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2596
2597         Error should compute .stack and friends lazily
2598         https://bugs.webkit.org/show_bug.cgi?id=176645
2599
2600         Reviewed by Saam Barati.
2601
2602         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2603         * microbenchmarks/new-error.js: Added.
2604         * microbenchmarks/throw.js: Added.
2605
2606 2017-09-09  Mark Lam  <mark.lam@apple.com>
2607
2608         [Re-landing] Use JIT probes for DFG OSR exit.
2609         https://bugs.webkit.org/show_bug.cgi?id=175144
2610         <rdar://problem/33437050>
2611
2612         Not reviewed.  Original patch reviewed by Saam Barati.
2613
2614         Disable these tests for debug builds because they run too slow with the new OSR exit.
2615
2616         * stress/op_mod-ConstVar.js:
2617         * stress/op_mod-VarConst.js:
2618         * stress/op_mod-VarVar.js:
2619
2620 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2621
2622         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2623         https://bugs.webkit.org/show_bug.cgi?id=176300
2624
2625         Reviewed by Saam Barati.
2626
2627         * stress/new-array-with-size-div.js: Added.
2628         (shouldBe):
2629         (test):
2630         (i.i):
2631
2632 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2633
2634         [DFG] PutByVal with Array::Generic is too generic
2635         https://bugs.webkit.org/show_bug.cgi?id=176345
2636
2637         Reviewed by Filip Pizlo.
2638
2639         * stress/object-assign-symbols.js: Added.
2640         (shouldBe):
2641         (test):
2642         * stress/object-assign.js: Added.
2643         (shouldBe):
2644         (test):
2645         (i.shouldBe.JSON.stringify.test):
2646
2647 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2648
2649         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2650         https://bugs.webkit.org/show_bug.cgi?id=176590
2651
2652         Reviewed by Saam Barati.
2653
2654         * microbenchmarks/object-iterate-symbols.js: Added.
2655         (test):
2656         * microbenchmarks/object-iterate.js: Added.
2657         (test):
2658         * stress/object-iterate-symbols.js: Added.
2659         (shouldBe):
2660         (test):
2661         * stress/object-iterate.js: Added.
2662         (shouldBe):
2663         (test):
2664
2665 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2666
2667         [Win32] 10 JSC stress tests are failing.
2668         https://bugs.webkit.org/show_bug.cgi?id=176538
2669
2670         Reviewed by Mark Lam.
2671
2672         Skip tests on Windows to make the bots green.
2673
2674         * ChakraCore.yaml:
2675         * stress/date-relaxed.js:
2676
2677 2017-09-06  Mark Lam  <mark.lam@apple.com>
2678
2679         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2680         https://bugs.webkit.org/show_bug.cgi?id=176485
2681         <rdar://problem/33898874>
2682
2683         Reviewed by Keith Miller.
2684
2685         * stress/regress-176485.js: Added.
2686
2687 2017-09-05  Saam Barati  <sbarati@apple.com>
2688
2689         isNotCellSpeculation is wrong with respect to SpecEmpty
2690         https://bugs.webkit.org/show_bug.cgi?id=176429
2691
2692         Reviewed by Michael Saboff.
2693
2694         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2695         (Foo):
2696
2697 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2698
2699         test262: Completion values for control flow do not match the spec
2700         https://bugs.webkit.org/show_bug.cgi?id=171265
2701
2702         Reviewed by Saam Barati.
2703
2704         * stress/completion-value.js:
2705         Condensed test for completion values in top level statements.
2706
2707         * stress/super-get-by-id.js:
2708         ClassDeclaration when evaled no longer produce values. Convert
2709         these to ClassExpressions so they produce the class value.
2710         
2711         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2712         This is a progression for currect spec behavior.
2713
2714         * mozilla/mozilla-tests.yaml:
2715         This test is now outdated, so mark it as failing for that reason.
2716
2717         * test262.yaml:
2718         Passing all "cptn" completion value tests.
2719
2720 2017-09-04  Saam Barati  <sbarati@apple.com>
2721
2722         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2723         https://bugs.webkit.org/show_bug.cgi?id=176317
2724
2725         Reviewed by Keith Miller.
2726
2727         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2728         (Foo):
2729
2730 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2731
2732         [DFG][FTL] Efficiently execute number#toString()
2733         https://bugs.webkit.org/show_bug.cgi?id=170007
2734
2735         Reviewed by Keith Miller.
2736
2737         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2738         (test):
2739         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2740         (test):
2741         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2742         (test):
2743         * microbenchmarks/number-to-string-with-radix.js: Added.
2744         (test):
2745         * stress/number-to-string-strength-reduction.js: Added.
2746         (shouldBe):
2747         (test):
2748         * stress/number-to-string-with-radix-10.js: Added.
2749         (shouldBe):
2750         (test):
2751         * stress/number-to-string-with-radix-cse.js: Added.
2752         (shouldBe):
2753         (test):
2754         * stress/number-to-string-with-radix-invalid.js: Added.
2755         (shouldThrow):
2756         * stress/number-to-string-with-radix-watchpoint.js: Added.
2757         (shouldBe):
2758         (test):
2759         (i.i.1e3.Number.prototype.toString):
2760         * stress/number-to-string-with-radix.js: Added.
2761         (shouldBe):
2762         (test):
2763
2764 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2765
2766         [DFG] Relax arity requirement
2767         https://bugs.webkit.org/show_bug.cgi?id=175523
2768
2769         Reviewed by Saam Barati.
2770
2771         * stress/arity-mismatch-arguments-length.js: Added.
2772         (shouldBe):
2773         (test1):
2774         (test):
2775         * stress/arity-mismatch-get-argument.js: Added.
2776         (shouldBe):
2777         (builtin.createBuiltin):
2778         (test):
2779         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2780         (shouldBe):
2781         (inlineTarget):
2782         (test):
2783         * stress/arity-mismatch-inlining.js: Added.
2784         (shouldBe):
2785         (inlineTarget):
2786         (test):
2787         * stress/arity-mismatch-rest.js: Added.
2788         (shouldBe):
2789         (test2):
2790         (test1):
2791         (test):
2792
2793 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2794
2795         [JSC] Fix "name" and "length" of Proxy revoke function
2796         https://bugs.webkit.org/show_bug.cgi?id=176155
2797
2798         Reviewed by Mark Lam.
2799
2800         * test262.yaml:
2801
2802 2017-08-31  Saam Barati  <sbarati@apple.com>
2803
2804         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2805         https://bugs.webkit.org/show_bug.cgi?id=176206
2806
2807         Reviewed by Keith Miller.
2808
2809         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2810         (a):
2811         (b):
2812         (foo):
2813
2814 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2815
2816         Skip two slow JSC tests after r221422.
2817
2818         Unreviewed test gardening.
2819
2820         * stress/regexp-prototype-match-on-too-long-rope.js:
2821         * stress/regexp-prototype-test-on-too-long-rope.js:
2822
2823 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2824
2825         Unreviewed, skipping slow tests.
2826         
2827         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2828         work differently now.
2829
2830         * stress/regexp-prototype-exec-on-too-long-rope.js:
2831         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2832
2833 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2834
2835         [JSC] Use reifying system for "name" property of builtin JSFunction
2836         https://bugs.webkit.org/show_bug.cgi?id=175260
2837
2838         Reviewed by Saam Barati.
2839
2840         * stress/accessors-get-set-prefix.js:
2841         * stress/builtin-function-name.js: Added.
2842         (shouldBe):
2843         (shouldThrow):
2844         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2845         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2846         * stress/private-name-as-anonymous-builtin.js: Added.
2847         (shouldBe):
2848         (NotPromise):
2849
2850 2017-08-30  Saam Barati  <sbarati@apple.com>
2851
2852         Unreviewed. Make test stop printing.
2853
2854         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2855
2856 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2857
2858         Unreviewed, rolling out r221327.
2859
2860         This change caused test262 failures.
2861
2862         Reverted changeset:
2863
2864         "[JSC] Use reifying system for "name" property of builtin
2865         JSFunction"
2866         https://bugs.webkit.org/show_bug.cgi?id=175260
2867         http://trac.webkit.org/changeset/221327
2868
2869 2017-08-30  Saam Barati  <sbarati@apple.com>
2870
2871         semicolon is being interpreted as an = in the LiteralParser
2872         https://bugs.webkit.org/show_bug.cgi?id=176114
2873
2874         Reviewed by Oliver Hunt.
2875
2876         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2877         * stress/resources/literal-parser-test-case.js: Added.
2878
2879 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2880
2881         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2882         https://bugs.webkit.org/show_bug.cgi?id=166698
2883
2884         Reviewed by Yusuke Suzuki.
2885
2886         * stress/async-iteration-for-await-of-syntax.js: Added.
2887         (assert):
2888         (checkSyntax):
2889         (checkSyntaxError):
2890         (checkSimpleAsyncGeneratorSloppyMode):
2891         (checkSimpleAsyncGeneratorStrictMode):
2892         (checkNestedAsyncGenerators):
2893         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2894         * stress/async-iteration-for-await-of.js: Added.
2895         (assert):
2896         (async.foo):
2897         (async.boo):
2898         (const.boo.async):
2899
2900 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2901
2902         [JSC] Use reifying system for "name" property of builtin JSFunction
2903         https://bugs.webkit.org/show_bug.cgi?id=175260
2904
2905         Reviewed by Saam Barati.
2906
2907         * stress/accessors-get-set-prefix.js:
2908         * stress/builtin-function-name.js: Added.
2909         (shouldBe):
2910         (shouldThrow):
2911         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2912         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2913
2914 2017-08-25  Saam Barati  <sbarati@apple.com>
2915
2916         Support compiling catch in the DFG
2917         https://bugs.webkit.org/show_bug.cgi?id=174590
2918         <rdar://problem/34047845>
2919
2920         Reviewed by Filip Pizlo.
2921
2922         * microbenchmarks/delta-blue-try-catch.js: Added.
2923         (exception):
2924         (value):
2925         (OrderedCollection):
2926         (OrderedCollection.prototype.add):
2927         (OrderedCollection.prototype.at):
2928         (OrderedCollection.prototype.size):
2929         (OrderedCollection.prototype.removeFirst):
2930         (OrderedCollection.prototype.remove):
2931         (Strength):
2932         (Strength.stronger):
2933         (Strength.weaker):
2934         (Strength.weakestOf):
2935         (Strength.strongest):
2936         (Strength.prototype.nextWeaker):
2937         (Constraint):
2938         (Constraint.prototype.addConstraint):
2939         (Constraint.prototype.satisfy):
2940         (Constraint.prototype.destroyConstraint):
2941         (Constraint.prototype.isInput):
2942         (UnaryConstraint):
2943         (UnaryConstraint.prototype.addToGraph):
2944         (UnaryConstraint.prototype.chooseMethod):
2945         (UnaryConstraint.prototype.isSatisfied):
2946         (UnaryConstraint.prototype.markInputs):
2947         (UnaryConstraint.prototype.output):
2948         (UnaryConstraint.prototype.recalculate):
2949         (UnaryConstraint.prototype.markUnsatisfied):
2950         (UnaryConstraint.prototype.inputsKnown):
2951         (UnaryConstraint.prototype.removeFromGraph):
2952         (StayConstraint):
2953         (StayConstraint.prototype.execute):
2954         (EditConstraint.prototype.isInput):
2955         (EditConstraint.prototype.execute):
2956         (BinaryConstraint):
2957         (BinaryConstraint.prototype.chooseMethod):
2958         (BinaryConstraint.prototype.addToGraph):
2959         (BinaryConstraint.prototype.isSatisfied):
2960         (BinaryConstraint.prototype.markInputs):
2961         (BinaryConstraint.prototype.input):
2962         (BinaryConstraint.prototype.output):
2963         (BinaryConstraint.prototype.recalculate):
2964         (BinaryConstraint.prototype.markUnsatisfied):
2965         (BinaryConstraint.prototype.inputsKnown):
2966         (BinaryConstraint.prototype.removeFromGraph):
2967         (ScaleConstraint):
2968         (ScaleConstraint.prototype.addToGraph):
2969         (ScaleConstraint.prototype.removeFromGraph):
2970         (ScaleConstraint.prototype.markInputs):
2971         (ScaleConstraint.prototype.execute):
2972         (ScaleConstraint.prototype.recalculate):
2973         (EqualityConstraint):
2974         (EqualityConstraint.prototype.execute):
2975         (Variable):
2976         (Variable.prototype.addConstraint):
2977         (Variable.prototype.removeConstraint):
2978         (Planner):
2979         (Planner.prototype.incrementalAdd):
2980         (Planner.prototype.incrementalRemove):
2981         (Planner.prototype.newMark):
2982         (Planner.prototype.makePlan):
2983         (Planner.prototype.extractPlanFromConstraints):
2984         (Planner.prototype.addPropagate):
2985         (Planner.prototype.removePropagateFrom):
2986         (Planner.prototype.addConstraintsConsumingTo):
2987         (Plan):
2988         (Plan.prototype.addConstraint):
2989         (Plan.prototype.size):
2990         (Plan.prototype.constraintAt):
2991         (Plan.prototype.execute):
2992         (chainTest):
2993         (projectionTest):
2994         (change):
2995         (deltaBlue):
2996         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2997         (assert):
2998         (Numbers):
2999         (Numbers.prototype.next):
3000         (return.Transpose):
3001         (return.Transpose.prototype.next):
3002         (transpose):
3003         (verifyEven):
3004         (verifyString):
3005         (foo):
3006         (runIterators):
3007         * microbenchmarks/try-catch-word-count.js: Added.
3008         (let.assert):
3009         (EOF):
3010         (let.texts):
3011         (let.o.apply):
3012         (foo):
3013         (bar):
3014         (f):
3015         (run):
3016         (test1):
3017         (test2):
3018         (test3):
3019         (fn):
3020         (A):
3021         (B):
3022         (A.prototype.getValue):
3023         (B.prototype.getParentValue):
3024         (strlen):
3025         (sum.0):
3026         (test):
3027         (result.test.o):
3028         (set add.set add):
3029         (set forEach):
3030         (stringHash):
3031         (set if):
3032         (testFunction):
3033         (set delete.set has.set add):
3034         * stress/catch-set-argument-speculation-failure.js: Added.
3035         (o):
3036         (e):
3037         (e2):
3038         (escape):
3039         (baz):
3040         (noInline.run):
3041         (noInline):
3042         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3043         (foo):
3044         (e):
3045         (baz):
3046         (bar):
3047
3048 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3049
3050         Unreviewed, rolling out r221119, r221124, and r221143.
3051         https://bugs.webkit.org/show_bug.cgi?id=175973
3052
3053         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3054         on #webkit).
3055
3056         Reverted changesets:
3057
3058         "Support compiling catch in the DFG"
3059         https://bugs.webkit.org/show_bug.cgi?id=174590
3060         http://trac.webkit.org/changeset/221119
3061
3062         "Unreviewed, build fix in GTK port"
3063         https://bugs.webkit.org/show_bug.cgi?id=174590
3064         http://trac.webkit.org/changeset/221124
3065
3066         "DFG::JITCode::osrEntry should get sorted since we perform a
3067         binary search on it"
3068         https://bugs.webkit.org/show_bug.cgi?id=175893
3069         http://trac.webkit.org/changeset/221143
3070
3071 2017-08-24  Michael Saboff  <msaboff@apple.com>
3072
3073         Add support for RegExp "dotAll" flag
3074         https://bugs.webkit.org/show_bug.cgi?id=175924
3075
3076         Reviewed by Keith Miller.
3077
3078         Updated tests for new dotAll ('s' flag) changes.
3079
3080         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3081         * stress/static-getter-in-names.js:
3082
3083 2017-08-24  Mark Lam  <mark.lam@apple.com>
3084
3085         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3086         https://bugs.webkit.org/show_bug.cgi?id=175940
3087         <rdar://problem/29003921>
3088
3089         Reviewed by Saam Barati.
3090
3091         * stress/regress-164081.js: Added.
3092         (shouldEqual):
3093         (testcase):
3094
3095 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3096
3097         Skip flaky JSC test stress/test-finally.js.
3098         https://bugs.webkit.org/show_bug.cgi?id=160283
3099
3100         Unreviewed test gardening.
3101
3102         * stress/test-finally.js:
3103
3104 2017-08-23  Saam Barati  <sbarati@apple.com>
3105
3106         Support compiling catch in the DFG
3107         https://bugs.webkit.org/show_bug.cgi?id=174590
3108
3109         Reviewed by Filip Pizlo.
3110
3111         * microbenchmarks/delta-blue-try-catch.js: Added.
3112         (exception):
3113         (value):
3114         (OrderedCollection):
3115         (OrderedCollection.prototype.add):
3116         (OrderedCollection.prototype.at):
3117         (OrderedCollection.prototype.size):
3118         (OrderedCollection.prototype.removeFirst):
3119         (OrderedCollection.prototype.remove):
3120         (Strength):
3121         (Strength.stronger):
3122         (Strength.weaker):
3123         (Strength.weakestOf):
3124         (Strength.strongest):
3125         (Strength.prototype.nextWeaker):
3126         (Constraint):
3127         (Constraint.prototype.addConstraint):
3128         (Constraint.prototype.satisfy):
3129         (Constraint.prototype.destroyConstraint):
3130         (Constraint.prototype.isInput):
3131         (UnaryConstraint):
3132         (UnaryConstraint.prototype.addToGraph):
3133         (UnaryConstraint.prototype.chooseMethod):
3134         (UnaryConstraint.prototype.isSatisfied):
3135         (UnaryConstraint.prototype.markInputs):
3136         (UnaryConstraint.prototype.output):
3137         (UnaryConstraint.prototype.recalculate):
3138         (UnaryConstraint.prototype.markUnsatisfied):
3139         (UnaryConstraint.prototype.inputsKnown):
3140         (UnaryConstraint.prototype.removeFromGraph):
3141         (StayConstraint):
3142         (StayConstraint.prototype.execute):
3143         (EditConstraint.prototype.isInput):
3144         (EditConstraint.prototype.execute):
3145         (BinaryConstraint):
3146         (BinaryConstraint.prototype.chooseMethod):
3147         (BinaryConstraint.prototype.addToGraph):
3148         (BinaryConstraint.prototype.isSatisfied):
3149         (BinaryConstraint.prototype.markInputs):
3150         (BinaryConstraint.prototype.input):
3151         (BinaryConstraint.prototype.output):
3152         (BinaryConstraint.prototype.recalculate):
3153         (BinaryConstraint.prototype.markUnsatisfied):
3154         (BinaryConstraint.prototype.inputsKnown):
3155         (BinaryConstraint.prototype.removeFromGraph):
3156         (ScaleConstraint):
3157         (ScaleConstraint.prototype.addToGraph):
3158         (ScaleConstraint.prototype.removeFromGraph):
3159         (ScaleConstraint.prototype.markInputs):
3160         (ScaleConstraint.prototype.execute):
3161         (ScaleConstraint.prototype.recalculate):
3162         (EqualityConstraint):
3163         (EqualityConstraint.prototype.execute):
3164         (Variable):
3165         (Variable.prototype.addConstraint):
3166         (Variable.prototype.removeConstraint):
3167         (Planner):
3168         (Planner.prototype.incrementalAdd):
3169         (Planner.prototype.incrementalRemove):
3170         (Planner.prototype.newMark):
3171         (Planner.prototype.makePlan):
3172         (Planner.prototype.extractPlanFromConstraints):
3173         (Planner.prototype.addPropagate):
3174         (Planner.prototype.removePropagateFrom):
3175         (Planner.prototype.addConstraintsConsumingTo):
3176         (Plan):
3177         (Plan.prototype.addConstraint):
3178         (Plan.prototype.size):
3179         (Plan.prototype.constraintAt):
3180         (Plan.prototype.execute):
3181         (chainTest):
3182         (projectionTest):
3183         (change):
3184         (deltaBlue):
3185         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3186         (assert):
3187         (Numbers):
3188         (Numbers.prototype.next):
3189         (return.Transpose):
3190         (return.Transpose.prototype.next):
3191         (transpose):
3192         (verifyEven):
3193         (verifyString):
3194         (foo):
3195         (runIterators):
3196         * microbenchmarks/try-catch-word-count.js: Added.
3197         (let.assert):
3198         (EOF):
3199         (let.texts):
3200         (let.o.apply):
3201         (foo):
3202         (bar):
3203         (f):
3204         (run):
3205         (test1):
3206         (test2):
3207         (test3):
3208         (fn):
3209         (A):
3210         (B):
3211         (A.prototype.getValue):
3212         (B.prototype.getParentValue):
3213         (strlen):
3214         (sum.0):
3215         (test):
3216         (result.test.o):
3217         (set add.set add):
3218         (set forEach):
3219         (stringHash):
3220         (set if):
3221         (testFunction):
3222         (set delete.set has.set add):
3223         * stress/catch-set-argument-speculation-failure.js: Added.
3224         (o):
3225         (e):
3226         (e2):
3227         (escape):
3228         (baz):
3229         (noInline.run):
3230         (noInline):
3231         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3232         (foo):
3233         (e):
3234         (baz):
3235         (bar):
3236
3237 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3238
3239         [JSC] Optimize Map iteration with intrinsic
3240         https://bugs.webkit.org/show_bug.cgi?id=174355
3241
3242         Reviewed by Saam Barati.
3243
3244         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3245         (shouldBe):
3246         (throw.new.Error):
3247         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3248         (shouldBe):
3249         (throw.new.Error.let.iterator.set Symbol):
3250         (throw.new.Error.set add):
3251         (let.iterator.set Symbol):
3252
3253 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3254
3255         Add a micro-benchmark for checking that accessing a variable within a 'with'
3256         block does not automatically prevent type prediction.
3257         https://bugs.webkit.org/show_bug.cgi?id=175738
3258
3259         Reviewed by Saam Barati.
3260
3261         * stress/with_and_arith.js: Added.
3262         (with):
3263
3264 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3265
3266         [ESNext] Async iteration - Implement Async Generator - runtime
3267         https://bugs.webkit.org/show_bug.cgi?id=175240
3268
3269         Reviewed by Yusuke Suzuki.
3270
3271         * stress/async-iteration-async-from-sync.js: Added.
3272         (assert):
3273         (const.Logger):
3274         (this.fullfilled):
3275         (this.fullfilledDone):
3276         (this.rejected):
3277         (this.catched):
3278         (this.isFinal):
3279         (_assertLogger):
3280         (const.assertLogger):
3281         (const.getPromise.promiseHolder.return.new.Promise):
3282         (foo):
3283         (async.boo):
3284         (bar):
3285         (async.baz):
3286         (async.goo):
3287         * stress/async-iteration-basic.js: Added.
3288         (assert):
3289         (const.Logger):
3290         (this.fullfilled):
3291         (this.fullfilledDone):
3292         (this.rejected):
3293         (this.catched):
3294         (this.isFinal):
3295         (_assertLogger):
3296         (const.assertLogger):
3297         (const.getPromise.promiseHolder.return.new.Promise):
3298         (async.generator):
3299         (iterator.next.then):
3300         (async.baz):
3301         (async.boo):
3302         (async.foo):
3303         (async.goo):
3304         (A.prototype.async.foo):
3305         (A.prototype.async.boo):
3306         (A):
3307         (asyncGenExp.async):
3308         (async.joo):
3309         (j.next.then):
3310         (then):
3311         (async.koo):
3312         (async.loo):
3313         (async.moo):
3314         (async.noo):
3315         (async.ooo):
3316         (async.roo):
3317         (async.poo):
3318         (async.soo):
3319         (async.too):
3320         * stress/async-iteration-evaluation.js: Added.
3321         (assert):
3322         (async.foo):
3323         (catch):
3324         * stress/async-iteration-syntax.js:
3325         * stress/async-iteration-yield-promise.js: Added.
3326         (assert):
3327         (const.Logger):
3328         (this.fullfilled):
3329         (this.fullfilledDone):
3330         (this.rejected):
3331         (this.catched):
3332         (this.isFinal):
3333         (_assertLogger):
3334         (const.assertLogger):
3335         (const.getPromise.promiseHolder.return.new.Promise):
3336         (async.foo):
3337         (async.boo):
3338         (async.bar):
3339         * stress/async-iteration-yield-star-interface.js: Added.
3340         (assert):
3341         (const.getPromise.promiseHolder.return.new.Promise):
3342         (const.Logger):
3343         (this.fullfilled):
3344         (this.fullfilledDone):
3345         (this.rejected):
3346         (this.catched):
3347         (this.custom):
3348         (this.isFinal):
3349         (_assertLogger):
3350         (const.assertLogger):
3351         (let.asyncIter.Symbol.asyncIterator):
3352         (let.asyncIter.next):
3353         (let.asyncIter.throw):
3354         (let.asyncIter.return):
3355         (async.foo):
3356         (asyncIter.Symbol.asyncIterator):
3357         (asyncIter.next):
3358         (async.boo):
3359         (asyncIter.return):
3360         (async.bar):
3361         (async.baz):
3362         (async.foobar):
3363         * stress/async-iteration-yield-star.js: Added.
3364         (assert):
3365         (const.Logger):
3366         (this.fullfilled):
3367         (this.fullfilledDone):
3368         (this.rejected):
3369         (this.catched):
3370         (this.custom):
3371         (this.isFinal):
3372         (_assertLogger):
3373         (const.assertLogger):
3374         (const.getPromise.promiseHolder.return.new.Promise):
3375         (async.foo):
3376         (async.boo):
3377         (async.bar):
3378         (async.baz):
3379         (async.joo):
3380         (async.goo):
3381         (async.koo):
3382         (async.loo):
3383         (let.asyncIter.Symbol.asyncIterator):
3384         (let.asyncIter.next):
3385         (let.asyncIter.throw):
3386         (let.asyncIter.return):
3387         (async.moo):
3388         (async.noo):
3389         * test262.yaml:
3390
3391 2017-08-23  JF Bastien  <jfbastien@apple.com>
3392
3393         Fix printing in test
3394
3395         Unreviewed: fixing verbosity, shouldn't have been there.
3396
3397         * wasm/regress/175693.js:
3398         (else.else):
3399         (catch):
3400
3401 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3402
3403         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3404         https://bugs.webkit.org/show_bug.cgi?id=172543
3405
3406         Unreviewed test gardening.
3407
3408         * microbenchmarks/generator-with-several-types.js:
3409
3410 2017-08-17  JF Bastien  <jfbastien@apple.com>
3411
3412         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3413         https://bugs.webkit.org/show_bug.cgi?id=175693
3414         <rdar://problem/33952443>
3415
3416         Reviewed by Saam Barati.
3417
3418         Add a regression directory for WebAssembly tests.
3419
3420         * wasm.yaml:
3421         * wasm/regress/175693.js: Added.
3422         (else.else):
3423         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3424         (catch):
3425         * wasm/regress/175693.wasm: Added.
3426
3427 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3428
3429         Support the 'with' keyword in FTL.
3430         https://bugs.webkit.org/show_bug.cgi?id=175585
3431
3432         Reviewed by Saam Barati.
3433
3434         Also improve the JSTest/stress/with.js file to test
3435         what happens when non-objects are passed to with.
3436
3437         * stress/with.js:
3438         (foo):
3439         (i.catch):
3440         (i.with): Deleted.
3441
3442 2017-08-14  Keith Miller  <keith_miller@apple.com>
3443
3444         Add testing tool to lie to the DFG about profiles
3445         https://bugs.webkit.org/show_bug.cgi?id=175487
3446
3447         Reviewed by Saam Barati.
3448
3449         * stress/compare-eq-incomplete-profile.js: Added.
3450         (const.test.createBuiltin):
3451
3452 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3453
3454         Support the with keyword in DFG
3455         https://bugs.webkit.org/show_bug.cgi?id=175470
3456
3457         Reviewed by Saam Barati.
3458
3459         Added a new stress-test for the 'with' keyword, that caught a bug in a
3460         previous version of this code.
3461
3462         * stress/with.js: Added.
3463         (i.with):
3464
3465 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3466
3467         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3468         https://bugs.webkit.org/show_bug.cgi?id=175544
3469
3470         Unreviewed test gardening.
3471
3472         * ChakraCore.yaml:
3473
3474 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3475
3476         Early error on ANY operator before new.target
3477         https://bugs.webkit.org/show_bug.cgi?id=157970
3478
3479         Reviewed by Saam Barati.
3480
3481         Instead of throwing if any unary operator precedes new.target, only
3482         throw if the unary operator updates the reference.
3483
3484         The following become legal in JSC:
3485
3486         ```
3487         !new.target
3488         ~new.target
3489         typeof new.target
3490         delete new.target
3491         void new.target
3492         ```
3493
3494         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3495
3496         * stress/new-target-syntax-errors.js:
3497         * stress/new-target.js:
3498
3499 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3500
3501         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3502         https://bugs.webkit.org/show_bug.cgi?id=175255
3503
3504         Unreviewed test gardening.
3505
3506         * stress/regress-169783.js:
3507         * wasm/stress/oom.js:
3508
3509 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3510
3511         REGRESSION: 2 test262/test/language/statements/async-function failures
3512         https://bugs.webkit.org/show_bug.cgi?id=175334
3513
3514         Reviewed by Yusuke Suzuki.
3515
3516         Add @skip parameters to tests, and remove test for async iterator from 
3517         async await syntax test because it is already covered by async-iterator-syntax.js
3518
3519         * stress/async-await-syntax.js:
3520         * stress/async-iteration-syntax.js:
3521
3522 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3523
3524         Unreviewed, gardening test262 for Promise resolve / reject function length
3525         https://bugs.webkit.org/show_bug.cgi?id=175333
3526
3527         * test262.yaml:
3528
3529 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3530
3531         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3532         https://bugs.webkit.org/show_bug.cgi?id=175307
3533
3534         Reviewed by Saam Barati.
3535
3536         * stress/typedarray-getownproperty-not-configurable.js: Added.
3537         (assert):
3538         (foo):
3539
3540 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3541
3542         Promise resolve and reject function should have length = 1
3543         https://bugs.webkit.org/show_bug.cgi?id=175242
3544
3545         Reviewed by Saam Barati.
3546
3547         * stress/builtin-function-length.js: Added.
3548         (shouldBe):
3549         (shouldThrow):
3550         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3551         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3552
3553 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3554
3555         [ESNext] Async iteration - Implement Async Generator - parser
3556         https://bugs.webkit.org/show_bug.cgi?id=175210
3557
3558         Reviewed by Yusuke Suzuki.
3559
3560         * stress/async-await-syntax.js:
3561         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3562         * stress/async-iteration-syntax.js: Added.
3563         (assert):
3564         (checkSyntax):
3565         (checkSyntaxError):
3566         (checkSimpleAsyncGeneratorSloppyMode):
3567         (checkSimpleAsyncGeneratorStrictMode):
3568         (checkNestedAsyncGenerators):
3569         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3570         * stress/generator-class-methods-syntax.js:
3571
3572 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3573
3574         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3575         https://bugs.webkit.org/show_bug.cgi?id=175150
3576
3577         Unreviewed test gardening.
3578
3579         * wasm/js-api/test_memory_constructor.js:
3580
3581 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3582
3583         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3584         https://bugs.webkit.org/show_bug.cgi?id=175100
3585
3586         Reviewed by Mark Lam.
3587
3588         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3589         available memory until an out of memory exception happens.
3590
3591         The Linux kernel is more tuned for server workloads than for GUI
3592         responsiveness. When a process tries to use a lot of memory, Linux
3593         will do its best to serve the request. This usually translates to
3594         free physical RAM by writing to disk dirty pages and/or moving out
3595         less recently used pages to swap (disk storage).
3596         Meanwhile it does this, the system will become unresponsive and this
3597         leads to freezes that can last even some minutes on the worst cases.
3598
3599         Therefore, let's skip this test on Linux as it will cause more harm
3600         than good on the Linux bots or on the machines of Linux developers.
3601
3602         * wasm/stress/oom.js:
3603
3604 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3605
3606         [JSC] Remove unnecessary print from stress\promise-finally.js test
3607         https://bugs.webkit.org/show_bug.cgi?id=175015
3608
3609         Reviewed by Yusuke Suzuki.
3610
3611         * stress/promise-finally.js:
3612         (p.finally):
3613         (then):
3614
3615 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3616
3617         Unreviewed, update test262 results for optional catch binding
3618
3619         * test262.yaml:
3620
3621 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3622
3623         [JSC] Support optional catch binding
3624         https://bugs.webkit.org/show_bug.cgi?id=174981
3625
3626         Reviewed by Saam Barati.
3627
3628         * stress/optional-catch-binding-syntax.js: Added.
3629         (testSyntax):
3630         (testSyntaxError):
3631         (catch.catch):
3632         * stress/optional-catch-binding.js: Added.
3633         (shouldBe):
3634         (throwException):
3635
3636 2017-07-28  Mark Lam  <mark.lam@apple.com>
3637
3638         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3639         https://bugs.webkit.org/show_bug.cgi?id=174948
3640         <rdar://problem/33495680>
3641
3642         Reviewed by Filip Pizlo.
3643
3644         * stress/regress-174948.js: Added.
3645
3646 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3647
3648         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3649         https://bugs.webkit.org/show_bug.cgi?id=174900
3650
3651         Reviewed by Saam Barati.
3652
3653         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3654         (sideEffect):
3655         (args):
3656         (test):
3657
3658 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3659
3660         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3661         https://bugs.webkit.org/show_bug.cgi?id=171637
3662
3663         Reviewed by Darin Adler.
3664
3665         * stress/domjit-getter-complex-with-incorrect-object.js:
3666         (i.shouldThrow):
3667         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3668         (shouldBe):
3669         (i.shouldThrow):
3670
3671 2017-07-26  JF Bastien  <jfbastien@apple.com>
3672
3673         WebAssembly: test throwing out of the start function
3674         https://bugs.webkit.org/show_bug.cgi?id=165714
3675         <rdar://problem/29760251>
3676
3677         Reviewed by Keith Miller.
3678
3679         * wasm/assert.js:
3680         * wasm/function-tests/trap-from-start.js: Added.
3681         (StartTraps):
3682         * wasm/function-tests/trap-from-start-async.js: Added.
3683         (async.StartTrapsAsync):
3684
3685 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3686
3687         [FTL] Arguments elimination is suppressed by unreachable blocks
3688         https://bugs.webkit.org/show_bug.cgi?id=174352
3689
3690         Reviewed by Filip Pizlo.
3691
3692         * stress/arguments-elimination-force-exit.js: Added.
3693         (shouldBe):
3694         (strict):
3695         (sloppy):
3696         * stress/arguments-elimination-throw.js: Added.
3697         (shouldBe):
3698         (shouldThrow):
3699         (sloppy):
3700         (isArguments):
3701
3702 2017-07-13  Mark Lam  <mark.lam@apple.com>
3703
3704         Add some additional test cases for bug 170896.
3705         https://bugs.webkit.org/show_bug.cgi?id=174491
3706
3707         Reviewed by Filip Pizlo.
3708
3709         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3710         * stress/regress-170896-with-double-shape-profile.js: Added.
3711         (test):
3712         * stress/regress-170896-with-int32-shape-profile.js: Added.
3713         (test):
3714         * stress/regress-170896.js: Removed.
3715
3716 2017-07-13  Saam Barati  <sbarati@apple.com>
3717
3718         Missing exception check in JSObject::hasInstance
3719         https://bugs.webkit.org/show_bug.cgi?id=174455
3720         <rdar://problem/31384608>
3721
3722         Reviewed by Mark Lam.
3723
3724         * stress/has-instance-exception-check.js: Added.
3725         (assert):
3726         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3727
3728 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3729
3730         [ESnext] Implement Object Spread
3731         https://bugs.webkit.org/show_bug.cgi?id=167963
3732
3733         Reviewed by Saam Barati.
3734
3735         * stress/obj-rest-destructuring-order.js: Added.
3736         (assert):
3737         (o.get z):
3738         (o.get a):
3739         * stress/obj-spread-order.js: Added.
3740         (assert):
3741         (o.get z):
3742         (o.get a):
3743         * stress/object-spread.js: Added.
3744         (let.assert):
3745         (assert.sameValue):
3746         (let.o.get a):
3747         (let.obj.get c):
3748         (cthulhu.get x):
3749         (let.obj.set c):
3750         (calls.o.get z):
3751         (calls.o.get a):
3752         (try.let.obj.get foo):
3753         (get calls):
3754
3755 2017-07-12  Saam Barati  <sbarati@apple.com>
3756
3757         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3758         https://bugs.webkit.org/show_bug.cgi?id=174411
3759         <rdar://problem/31696186>
3760
3761         Reviewed by Mark Lam.
3762
3763         * stress/generic-arguments-correct-delete-behavior.js: Added.
3764         (assert):
3765         (makeTest):
3766
3767 2017-07-07  Mark Lam  <mark.lam@apple.com>
3768
3769         \n\r is not the same as \r\n.
3770         https://bugs.webkit.org/show_bug.cgi?id=173053
3771
3772         Reviewed by Keith Miller.
3773
3774         * stress/regress-173053.js: Added.
3775         * stress/template-literal-line-terminators.js:
3776
3777 2017-07-06  Saam Barati  <sbarati@apple.com>
3778
3779         We are missing places where we invalidate the for-in context
3780         https://bugs.webkit.org/show_bug.cgi?id=174184
3781
3782         Reviewed by Geoffrey Garen.
3783
3784         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3785         (assert):
3786         (test):
3787
3788 2017-07-05  Saam Barati  <sbarati@apple.com>
3789
3790         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3791         https://bugs.webkit.org/show_bug.cgi?id=174188
3792         <rdar://problem/30581423>
3793
3794         Reviewed by Mark Lam.
3795
3796         * stress/new-array-having-a-bad-time-double.js: Added.
3797         (assert):
3798         (foo):
3799
3800 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3801
3802         WTF::StringImpl::copyChars segfaults when built with GCC 7
3803         https://bugs.webkit.org/show_bug.cgi?id=173407
3804
3805         Reviewed by Andreas Kling.
3806
3807         * stress/string-repeat-copy-chars-crash.js: Added.
3808         (shouldBe):
3809
3810 2017-07-03  Saam Barati  <sbarati@apple.com>
3811
3812         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3813
3814         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3815
3816 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3817
3818         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3819
3820         It requires too much memory.
3821
3822         * stress/dont-reserve-huge-capacity-lexer.js:
3823
3824 2017-06-30  Michael Saboff  <msaboff@apple.com>
3825
3826         Skip a test on ARM64 platform since we run out of address space.
3827
3828         Rubber stamped by Saam Barati.
3829
3830         * stress/dont-reserve-huge-capacity-lexer.js:
3831
3832 2017-06-30  Michael Saboff  <msaboff@apple.com>
3833
3834         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3835         https://bugs.webkit.org/show_bug.cgi?id=174044
3836
3837         Reviewed by Oliver Hunt.
3838
3839         New regression test.
3840
3841         * stress/regress-174044.js: Added.
3842         (test1):
3843         (test2):
3844
3845 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3846
3847         RegExpCachedResult::setInput should reify left and right contexts
3848         https://bugs.webkit.org/show_bug.cgi?id=173818
3849
3850         Reviewed by Keith Miller.
3851
3852         * stress/right-left-context-invalidated-by-input.js: Added.
3853         (test.validateContexts):
3854         (test):
3855
3856 2017-06-29  Saam Barati  <sbarati@apple.com>
3857
3858         Calculating postCapacity in unshiftCountSlowCase is wrong
3859         https://bugs.webkit.org/show_bug.cgi?id=173992
3860         <rdar://problem/32283199>
3861
3862         Reviewed by Keith Miller.
3863
3864         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3865         (temp):
3866
3867 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3868
3869         Unreviewed, rolling out r218512.
3870         https://bugs.webkit.org/show_bug.cgi?id=173981
3871
3872         "It changes the behavior of the JS API's JSEvaluateScript
3873         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3874
3875         Reverted changeset:
3876
3877         "test262: Completion values for control flow do not match the
3878         spec"
3879         https://bugs.webkit.org/show_bug.cgi?id=171265
3880         http://trac.webkit.org/changeset/218512
3881
3882 2017-06-27  JF Bastien  <jfbastien@apple.com>
3883
3884         WebAssembly: running out of executable memory should throw OoM
3885         https://bugs.webkit.org/show_bug.cgi?id=171537
3886         <rdar://problem/32963338>
3887
3888         Reviewed by Saam Barati.
3889
3890         * wasm.yaml:
3891         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3892         (const.invoke):
3893         (failCount.0.catch):
3894         (failCount.0.module.undefined.catch):
3895         * wasm/lowExecutableMemory/exports-oom.js: Added.
3896         (const.type):
3897         (const.params):
3898         (const.randomProgram):
3899         (failCount.0.catch):
3900         (failCount.0.module.undefined.catch):
3901         * wasm/lowExecutableMemory/imports-oom.js: Added.
3902         (const.type):
3903         (const.params):
3904         (const.randomProgram):
3905         (f.imports.push):
3906         (failCount.0.catch):
3907         (failCount.0.module.undefined.catch):
3908
3909 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3910
3911         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3912         https://bugs.webkit.org/show_bug.cgi?id=167962
3913
3914         Reviewed by Saam Barati.
3915
3916         * stress/object-rest-deconstruct.js: Added.
3917         (let.assert):
3918         (let.assertPropDescriptor):
3919         (catch):
3920         (get 3):
3921         (foo):
3922         (let.src.get y):
3923         (let.src.set y):
3924         (let.gen):
3925
3926 2017-06-27  Saam Barati  <sbarati@apple.com>
3927
3928         Function constructor needs to follow the spec and validate parameters and body independently
3929         https://bugs.webkit.org/show_bug.cgi?id=173303
3930         <rdar://problem/32732526>
3931
3932         Reviewed by Keith Miller.
3933
3934         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3935         * stress/function-constructor-semantics.js: Added.
3936         (assert):
3937         (hasSyntaxError):
3938         (foo):
3939         (async.foo):
3940         (testError):
3941         (testOK.toString):
3942         (toString):
3943
3944 2017-06-26  Saam Barati  <sbarati@apple.com>
3945
3946         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3947         https://bugs.webkit.org/show_bug.cgi?id=173740
3948
3949         Reviewed by Mark Lam.
3950
3951         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3952         (Array.prototype.Symbol.iterator):
3953
3954 2017-06-26  Saam Barati  <sbarati@apple.com>
3955
3956         Skip a test on 32-bit platforms since we run out of address space.
3957
3958         Rubber stamped by Mark Lam.
3959
3960         * stress/dont-reserve-huge-capacity-lexer.js:
3961
3962 2017-06-26  Saam Barati  <sbarati@apple.com>
3963
3964         Crash in JSC::Lexer<unsigned char>::setCode
3965         https://bugs.webkit.org/show_bug.cgi?id=172754
3966
3967         Reviewed by Mark Lam.
3968
3969         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3970         (catch):
3971
3972 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3973
3974         [JSC] Clean up Object.entries implementation
3975         https://bugs.webkit.org/show_bug.cgi?id=173759
3976
3977         Reviewed by Sam Weinig.
3978
3979         * microbenchmarks/object-entries.js: Added.
3980         (test):
3981
3982 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3983
3984         Remove Reflect.enumerate
3985         https://bugs.webkit.org/show_bug.cgi?id=173806
3986
3987         Reviewed by Yusuke Suzuki.
3988
3989         * ChakraCore.yaml:
3990         * es6.yaml:
3991         These tests now fail because they use Reflect.enumerate.
3992
3993         * test262.yaml:
3994         This test now passes, it checked that Reflect.enumerate is undefined!
3995
3996         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3997         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3998
3999         * stress/reflect-enumerate.js: Removed.
4000         Remove a test solely for Reflect.enumerate.
4001
4002 2017-06-22  Saam Barati  <sbarati@apple.com>
4003
4004         ValueRep(DoubleRep(@v)) can not simply convert to @v
4005         https://bugs.webkit.org/show_bug.cgi?id=173687
4006         <rdar://problem/32855563>
4007
4008         Reviewed by Mark Lam.
4009
4010         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
4011         (i.catch):
4012
4013 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
4014
4015         [JSC] Object.values should be implemented in C++
4016         https://bugs.webkit.org/show_bug.cgi?id=173703
4017
4018         Reviewed by Sam Weinig.
4019
4020         * microbenchmarks/object-keys-map-values.js: Added.
4021         (test):
4022         * microbenchmarks/object-values.js: Added.
4023         (test):
4024         * stress/object-values-changing-properties.js: Added.
4025         (shouldBe):
4026         (throw.new.Error.let.source.get x):
4027         (throw.new.Error):
4028         (shouldBe.let.handler.get order):
4029         (get let):
4030         (shouldBe.let.handler.get return):
4031         (let.handler.get order):
4032
4033 2017-06-21  Saam Barati  <sbarati@apple.com>
4034
4035         eval virtual call is incorrect in the baseline JIT
4036         https://bugs.webkit.org/show_bug.cgi?id=173587
4037         <rdar://problem/32867897>
4038
4039         Reviewed by Michael Saboff.
4040
4041         * stress/do-eval-virtual-call-correctly.js: Added.
4042         (assert):
4043         (f):
4044         (i.test):
4045         (catch):
4046
4047 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
4048
4049         Update test262 test expectations after r218581.
4050
4051         Unreviewed test gardening.
4052
4053         * test262.yaml:
4054
4055 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
4056
4057         Revert changes in bug#160417 about extending `null` not being a derived class
4058         https://bugs.webkit.org/show_bug.cgi?id=169293
4059
4060         Reviewed by Saam Barati.
4061
4062         * stress/class-derived-from-null.js:
4063         (assertThrow):
4064         (test1):
4065         (test2):
4066         (test3):
4067         (test4):
4068         (test5):
4069         (test6):
4070
4071 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
4072
4073         [DFG] More ArrayIndexOf fixups for various types
4074         https://bugs.webkit.org/show_bug.cgi?id=173176
4075
4076         Reviewed by Saam Barati.
4077
4078         * stress/array-indexof-arraystorage.js: Added.
4079         (shouldBe):
4080         (indexOfInt32Other):
4081         (indexOfInt32Cell):
4082         (indexOfInt32Boolean):
4083         (indexOfDoubleOther):
4084         (indexOfDoubleCell):
4085         (indexOfDoubleBoolean):
4086         (indexOfInt32):
4087         (indexOfDouble):
4088         * stress/array-indexof-constant-folding.js: Added.
4089         (shouldBe):
4090         (indexOfInt32Other):
4091         (indexOfInt32Cell):
4092         (indexOfInt32Boolean):
4093         (indexOfDoubleOther):
4094         (indexOfDoubleCell):
4095         (indexOfDoubleBoolean):
4096         * stress/array-indexof-hole-and-other.js: Added.
4097         (shouldBe):
4098         (indexOf):
4099         * stress/array-indexof-other.js: Added.
4100         (shouldBe):
4101         (indexOfInt32):
4102         (indexOfDouble):
4103         (indexOfString):
4104         (indexOfObject):
4105         * stress/array-indexof-symbol.js: Added.
4106         (shouldBe):
4107         (indexOfInt32):
4108         (indexOfDouble):
4109         (indexOfString):
4110         (indexOfObject):
4111
4112 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
4113
4114         test262: Completion values for control flow do not match the spec
4115         https://bugs.webkit.org/show_bug.cgi?id=171265
4116
4117         Reviewed by Saam Barati.
4118
4119         * stress/completion-value.js:
4120         Condensed test for completion values in top level statements.
4121
4122         * stress/super-get-by-id.js:
4123         ClassDeclaration when evaled no longer produce values. Convert
4124         these to ClassExpressions so they produce the class value.
4125         
4126         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
4127         This is a progression for currect spec behavior.
4128
4129         * mozilla/mozilla-tests.yaml:
4130         This test is now outdated, so mark it as failing for that reason.
4131
4132         * test262.yaml:
4133         Passing all "cptn" completion value tests.
4134
4135 2017-06-17  Keith Miller  <keith_miller@apple.com>
4136
4137         ArrayBuffer constructor needs to create subclass structures before its buffer
4138         https://bugs.webkit.org/show_bug.cgi?id=173510
4139
4140         Reviewed by Yusuke Suzuki.
4141
4142         * test262.yaml:
4143
4144 2017-06-17  Keith Miller  <keith_miller@apple.com>
4145
4146         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
4147         https://bugs.webkit.org/show_bug.cgi?id=173506
4148
4149         Reviewed by Ryosuke Niwa.
4150
4151         Re-baseline tests.
4152
4153         * ChakraCore/test/Function/apply3.baseline-jsc:
4154         * test262.yaml:
4155
4156 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4157
4158         [JSC] Add fast path for Object.assign
4159         https://bugs.webkit.org/show_bug.cgi?id=173416
4160
4161         Reviewed by Mark Lam.
4162
4163         * stress/object-assign-changing-properties.js: Added.
4164         (shouldBe):
4165         (throw.new.Error.let.source.get x):
4166         (throw.new.Error):
4167         (shouldBe.let.source.get x):
4168         (shouldBe.let.target.set x):
4169         (shouldBe.let.target.get x):
4170         * stress/object-assign-proxy.js: Added.
4171         (shouldBe):
4172         (throw.new.Error.let.handler.get order):
4173
4174 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
4175
4176         [JSC] Implement Object.assign in C++
4177         https://bugs.webkit.org/show_bug.cgi?id=173414
4178
4179         Reviewed by Saam Barati.
4180
4181         * stress/object-assign-string-first.js: Added.
4182         (shouldBe):
4183         (source.get Symbol):
4184         (source.get 1):
4185         (source.get cocoa):
4186
4187 2017-06-14  JF Bastien  <jfbastien@apple.com>
4188
4189         WebAssembly: remove empty test files
4190         https://bugs.webkit.org/show_bug.cgi?id=173382
4191
4192         Reviewed by Saam Barati.
4193
4194         The following files:
4195                 JSTests/wasm/function-tests/call-indirect-params.js
4196                 JSTests/wasm/function-tests/call-indirect.js
4197                 JSTests/wasm/js-api/call-indirect-results.js
4198         Were changed to empty files in https://trac.webkit.org/changeset/209771
4199
4200         They were testing call_indirect with the wrong semantics, before
4201         we implemented tables. That change implemented tables and
4202         therefore removed the erroneous tests.
4203
4204         We have a few tests for call_indirect which already do the right thing:
4205                 JSTests/wasm/function-tests/context-switch.js
4206                 JSTests/wasm/function-tests/exceptions.js
4207                 JSTests/wasm/function-tests/grow-memory-2.js
4208                 JSTests/wasm/function-tests/stack-overflow.js
4209                 JSTests/wasm/function-tests/table-basic-2.js
4210                 JSTests/wasm/function-tests/table-basic.js
4211                 JSTests/wasm/js-api/call-indirect.js
4212                 JSTests/wasm/js-api/table.js
4213                 JSTests/wasm/js-api/unique-signature.js
4214                 JSTests/wasm/js-api/wrapper-function.js
4215
4216         I also just imported the updated spec tests which, among other
4217         things, test call_indirect:
4218                 core/br.wast
4219                 core/br_table.wast
4220                 core/call_indirect.wast
4221                 core/func.wast
4222                 core/func_ptrs.wast
4223                 core/imports.wast
4224                 core/left-to-right.wast
4225                 core/linking.wast
4226                 core/nop.wast
4227                 core/return.wast
4228                 core/typecheck.wast
4229                 core/unreachable.wast
4230
4231         So I think it's OK to just delete the tests which should just have
4232         been deleted back when tables were added.
4233
4234         * wasm/function-tests/call-indirect-params.js: Removed.
4235         * wasm/function-tests/call-indirect.js: Removed.
4236         * wasm/js-api/call-indirect-results.js: Removed.
4237
4238 2017-06-13  JF Bastien  <jfbastien@apple.com>
4239
4240         WebAssembly: import updated spec tests
4241         https://bugs.webkit.org/show_bug.cgi?id=173287
4242         <rdar://problem/32725975>
4243
4244         Reviewed by Saam Barati.
4245
4246         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
4247         with a few modifications so things work.
4248
4249         Fix a bunch of bugs found through this process, and punt a few tests (which I
4250         marked as blocked by this bug).
4251
4252         Fixes:
4253
4254         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
4255         instead of byte alignment. It was also missing memory-alignment.js despite it
4256         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
4257         pass.
4258
4259         Tables can be imported or in a section. There can be only one, but sections can
4260         be empty. An Elements section can exist if there's no Table, as long as it is
4261         also empty.
4262
4263         Memories can be imported or in a section. There can be only one, but sections
4264         can be empty. A Data section can exist if there's no Memory, as long as it is
4265         also empty.
4266
4267         Prototypes: stringify without .prototype. in the string.
4268
4269         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
4270         not a final size, and throws a RangeError on failure, not a TypeError.
4271
4272         Fix compile / instantiate so the reject the promise if given an argument of the
4273         wrong type (instead of failing instantly).
4274
4275         Fix async on neuter test.
4276
4277         Element section shouldn't affect any Table if any of the elements are out of
4278         bounds. We need to process it in two passes.
4279
4280         Segment section shouldn't affect any Data if any of the segments are out of
4281         bounds. We need to process it in two passes.
4282
4283         Empty data segments are valid, but only when there is no memory. Their index
4284         still gets validated, and has to be zero.
4285
4286         Punts:
4287
4288         Error messages with context, the test seems overly restrictive but this is
4289         minor.
4290
4291         compile/instantiate/validate property descriptors.
4292
4293         UTF-8 bugs.
4294
4295         Temporarily disable NaN tests. We need to go back and implement the following
4296         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
4297         much as getting all the other tests passing.
4298
4299         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
4300         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
4301         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
4302         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
4303         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
4304         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
4305         why they're not allowed.
4306
4307         * wasm.yaml:
4308         * wasm/function-tests/i32-load8-s.js:
4309         * wasm/function-tests/memory-access-past-4gib.js:
4310         (const.op.of.WASM.opcodes):
4311         * wasm/function-tests/memory-alignment.js: Added.
4312         (const.op.of.WASM.opcodes):
4313         * wasm/function-tests/memory-section-and-import.js:
4314         * wasm/js-api/Module-compile.js:
4315         (async.testPromiseAPI):
4316         * wasm/js-api/dont-mmap-zero-byte-memory.js:
4317         (testMems):
4318         * wasm/js-api/element.js:
4319         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
4320         * wasm/js-api/neutered-inputs.js:
4321         (const.testFunction): Deleted.
4322         (const.testConstructor): Deleted.
4323         * wasm/js-api/table.js:
4324         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
4325         (new.WebAssembly.Module):
4326         (assert.throws):
4327         (assertBadTableImport):
4328         (assert.throws.WebAssembly.Table.prototype.grow):
4329         (assertBadTableInstance): Deleted.
4330         * wasm/js-api/test_Data.js:
4331         (DataSectionWithoutMemory):
4332         * wasm/spec-harness/index.js:
4333         (module):
4334         (uniqueTest): Deleted.
4335         (assert_invalid): Deleted.
4336         (assert_soft_invalid): Deleted.
4337         (register): Deleted.
4338         (call): Deleted.
4339         (get instance): Deleted.
4340         (exports): Deleted.
4341         (run): Deleted.
4342         (assert_unlinkable): Deleted.
4343         (assert_uninstantiable): Deleted.
4344         (assert_trap): Deleted.
4345         (try.f): Deleted.
4346         (catch): Deleted.
4347         (assert_exhaustion): Deleted.
4348         (assert_return): Deleted.
4349         (assert_return_nan): Deleted.
4350         * wasm/spec-harness/testharness.css: Removed.
4351         * wasm/spec-harness/testharness.js: Removed.
4352         * wasm/spec-harness/testharnessreport.js: Removed.
4353         * wasm/spec-harness/wasm-constants.js:
4354         (assertTraps):
4355         (assertWasmThrows):
4356         * wasm/spec-harness/wasm-module-builder.js:
4357         (Binary.prototype.emit_section):
4358         (Binary):
4359         (WasmFunctionBuilder.prototype.addBody):
4360         (WasmFunctionBuilder.prototype.end):
4361         (WasmFunctionBuilder):
4362         (WasmModuleBuilder.prototype.stringToBytes):
4363         (WasmModuleBuilder.prototype.addCustomSection):
4364         (WasmModuleBuilder.prototype.addFunctionTableInit):
4365         (WasmModuleBuilder.prototype.appendToTable):
4366         (WasmModuleBuilder.prototype.toArray):
4367         (WasmModuleBuilder.prototype.toBuffer):
4368         (WasmModuleBuilder.prototype.instantiate):
4369         (WasmModuleBuilder):
4370         * wasm/spec-tests/address.wast.js:
4371         * wasm/spec-tests/align.wast.js: Added.
4372         * wasm/spec-tests/binary.wast.js:
4373         * wasm/spec-tests/block.wast.js:
4374         * wasm/spec-tests/br.wast.js:
4375         * wasm/spec-tests/br_if.wast.js:
4376         * wasm/spec-tests/br_table.wast.js:
4377         * wasm/spec-tests/call.wast.js:
4378         * wasm/spec-tests/call_indirect.wast.js:
4379         * wasm/spec-tests/comments.wast.js:
4380         * wasm/spec-tests/const.wast.js: Added.
4381         * wasm/spec-tests/conversions.wast.js: Added.
4382         * wasm/spec-tests/custom_section.wast.js:
4383         * wasm/spec-tests/exports.wast.js:
4384         * wasm/spec-tests/f32.wast.js: Added.
4385         * wasm/spec-tests/f64.wast.js: Added.
4386         * wasm/spec-tests/fac.wast.js:
4387         * wasm/spec-tests/float_exprs.wast.js: Added.
4388         * wasm/spec-tests/float_misc.wast.js: Added.
4389         * wasm/spec-tests/func.wast.js:
4390         * wasm/spec-tests/globals.wast.js:
4391         * wasm/spec-tests/if.wast.js:
4392         * wasm/spec-tests/imports.wast.js:
4393         * wasm/spec-tests/inline-module.wast.js: Added.
4394         * wasm/spec-tests/jsapi.js:
4395         (testJSAPI.test):
4396         (testJSAPI):
4397         * wasm/spec-tests/labels.wast.js:
4398         * wasm/spec-tests/loop.wast.js:
4399         * wasm/spec-tests/memory.wast.js:
4400         * wasm/spec-tests/memory_trap.wast.js: Added.
4401         * wasm/spec-tests/names.wast.js:
4402         * wasm/spec-tests/nop.wast.js:
4403         * wasm/spec-tests/return.wast.js:
4404         * wasm/spec-tests/stack.wast.js:
4405         * wasm/spec-tests/token.wast.js: Added.
4406         * wasm/spec-tests/type.wast.js: Added.
4407         * wasm/spec-tests/typecheck.wast.js:
4408         * wasm/spec-tests/unreachable.wast.js:
4409         * wasm/spec-tests/unreached-invalid.wast.js:
4410         * wasm/spec-tests/unwind.wast.js:
4411         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
4412         * wasm/spec-tests/utf8-import-field.wast.js: Added.
4413         * wasm/spec-tests/utf8-import-module.wast.js: Added.
4414
4415 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
4416
4417         Unreviewed JSC test gardening.
4418
4419         * stress/check-string-ident.js:
4420         * stress/new-largeish-contiguous-array-with-size.js:
4421
4422 2017-06-13  Michael Saboff  <msaboff@apple.com>
4423
4424         DFG doesn't properly handle a property that is change to read only in a prototype