WebAssembly: implement data section
[WebKit-https.git] / JSTests / ChangeLog
1 2016-12-09  JF Bastien  <jfbastien@apple.com>
2
3         WebAssembly: implement data section
4         https://bugs.webkit.org/show_bug.cgi?id=165696
5
6         Reviewed by Keith Miller.
7
8         As specified in https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md#data-section
9         Note that some of the interesting corner cases are ill-defined by the spec: https://github.com/WebAssembly/design/issues/897
10
11         * wasm/Builder.js: create a data section from JavaScript
12         * wasm/Builder_WebAssemblyBinary.js: assemble the data section into the proper binary encoding
13         (const.emitters.Data):
14         * wasm/js-api/test_Data.js: Added.
15         (DataSection):
16         (DataSectionOffTheEnd):
17         (DataSectionPartlyOffTheEnd):
18         (DataSectionEmptyOffTheEnd):
19         (DataSectionSeenByStart):
20         * wasm/self-test/test_BuilderJSON.js: make sure the JSON structure is fine (this sanity checks before going to binary)
21
22 2016-12-09  JF Bastien  <jfbastien@apple.com>
23
24         WebAssembly JS API: implement start function
25         https://bugs.webkit.org/show_bug.cgi?id=165150
26
27         Reviewed by Saam Barati.
28
29         * wasm/Builder.js: allow building a .Start()
30         * wasm/Builder_WebAssemblyBinary.js:
31         * wasm/js-api/test_Start.js: Added.
32         (const.emitters.Start): serialize a start section
33         * wasm/self-test/test_BuilderJSON.js: validate the start section's content
34
35 2016-12-09  Saam Barati  <sbarati@apple.com>
36
37         WebAssembly JS API: implement importing and defining Memory
38         https://bugs.webkit.org/show_bug.cgi?id=164134
39
40         Reviewed by Keith Miller.
41
42         * wasm/Builder.js:
43         (const._importMemoryContinuation.section):
44         (const._importMemoryContinuation.assert):
45         (const._importMemoryContinuation):
46         (const._exportFunctionContinuation.const): Deleted.
47         (const._exportFunctionContinuation): Deleted.
48         * wasm/Builder_WebAssemblyBinary.js:
49         (const.emitters.Import):
50         * wasm/js-api/test_basic_api.js:
51         (const.c.in.constructorProperties.switch):
52         * wasm/js-api/test_memory.js: Added.
53         (assert):
54         (binaryShouldNotParse):
55         (test):
56         (test.testMemImportError):
57         * wasm/js-api/test_memory_constructor.js: Added.
58         (assert):
59         (throw.new.Error):
60         (testInvalidSize):
61         (assert.testInvalidInitial):
62         (testInvalidInitial.testInvalidMaximum):
63         (testInvalidInitial):
64         (testInvalidMaximum):
65         * wasm/self-test/test_BuilderJSON.js:
66
67 2016-12-08  JF Bastien  <jfbastien@apple.com>
68
69         WebAssembly: JSC::link* shouldn't need a CodeBlock
70         https://bugs.webkit.org/show_bug.cgi?id=165591
71
72         Reviewed by Keith Miller.
73
74         test that wasm -> JS works, including the IC
75
76         * wasm/js-api/test_Instance.js:
77         (const.wasmModuleWhichImportJS):
78         (MonomorphicImport):
79         (Polyphic2Import):
80         (Polyphic3Import):
81         (VirtualImport):
82
83 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
84
85         Green the cloop bot by raising this threshold.
86
87         * mozilla/js1_5/Array/regress-101964.js:
88
89 2016-12-08  JF Bastien  <jfbastien@apple.com>
90
91         WebAssembly JS API: wire up Instance imports
92         https://bugs.webkit.org/show_bug.cgi?id=165118
93
94         Reviewed by Saam Barati.
95
96         * wasm/js-api/test_Instance.js: add the test, disabled for now
97
98 2016-12-07  Keith Miller  <keith_miller@apple.com>
99
100         Add more missing trivial wasm ops.
101         https://bugs.webkit.org/show_bug.cgi?id=165564
102
103         Add tests for drop and tee_local.
104
105         Reviewed by Geoffrey Garen.
106
107         * wasm/function-tests/drop.js: Added.
108         * wasm/function-tests/nop.js: Added.
109         * wasm/function-tests/tee-local.js: Added.
110
111 2016-12-06  Keith Miller  <keith_miller@apple.com>
112
113         Add support for truncation operators
114         https://bugs.webkit.org/show_bug.cgi?id=165519
115
116         Reviewed by Geoffrey Garen.
117
118         * wasm/function-tests/i32-trunc-s-f32.js: Added.
119         * wasm/function-tests/i32-trunc-s-f64.js: Added.
120         * wasm/function-tests/i32-trunc-u-f32.js: Added.
121         * wasm/function-tests/i32-trunc-u-f64.js: Added.
122         * wasm/function-tests/i64-trunc-s-f32.js: Added.
123         * wasm/function-tests/i64-trunc-s-f64.js: Added.
124         * wasm/function-tests/i64-trunc-u-f32.js: Added.
125         * wasm/function-tests/i64-trunc-u-f64.js: Added.
126
127 2016-12-06  Mark Lam  <mark.lam@apple.com>
128
129         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
130         https://bugs.webkit.org/show_bug.cgi?id=165227
131         <rdar://problem/29442665>
132
133         Reviewed by Saam Barati.
134
135         * stress/get-from-scope-dynamic-onto-proxy.js:
136         - Updated error message.
137
138         * stress/proxy-dont-infinite-loop.js: Removed.
139         * stress/proxy-json-path.js: Removed.
140         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.
141         - Removed these tests because the issue they are testing relies on being able to
142           set Object.prototype.__proto__ to something else (which is now not possible).
143
144 2016-12-05  Caitlin Potter  <caitp@igalia.com>
145
146         [JSC] report unexpected token when "async" is followed by identifier 
147         https://bugs.webkit.org/show_bug.cgi?id=165091
148
149         Reviewed by Mark Lam.
150
151         * stress/bug-165091.js:
152
153 2016-12-05  Keith Miller  <keith_miller@apple.com>
154
155         Add Wasm i64 to i32 conversion.
156         https://bugs.webkit.org/show_bug.cgi?id=165378
157
158         Reviewed by Filip Pizlo.
159
160         It turns out the wrap operation is just B3's Trunc.
161
162         * wasm/wasm.json:
163
164 2016-12-04  Keith Miller  <keith_miller@apple.com>
165
166         Add support for Wasm ctz and popcnt
167         https://bugs.webkit.org/show_bug.cgi?id=165369
168
169         Reviewed by Saam Barati.
170
171         * wasm/function-tests/ctz.js: Added.
172         * wasm/function-tests/popcnt.js: Added.
173
174 2016-12-03  JF Bastien  <jfbastien@apple.com>
175
176         WebAssembly: update binary format to 0xD version
177         https://bugs.webkit.org/show_bug.cgi?id=165345
178
179         Reviewed by Keith Miller.
180
181         As described in the following PR: https://github.com/WebAssembly/design/pull/836
182         Originally committed in r209175, reverted in r209242, and fixed in r209284.
183
184         * wasm/Builder.js:
185         (const._normalizeFunctionSignature):
186         * wasm/Builder_WebAssemblyBinary.js:
187         (const.emitters.Type):
188         (const.emitters.Code):
189         * wasm/LowLevelBinary.js:
190         (export.default.LowLevelBinary.prototype.block_type):
191         (export.default.LowLevelBinary.prototype.inline_signature_type): Deleted.
192         * wasm/WASM.js:
193         * wasm/js-api/test_basic_api.js:
194         * wasm/self-test/test_BuilderWebAssembly.js:
195         (EmptyModule):
196         (CustomSection):
197         * wasm/self-test/test_WASM.js:
198         * wasm/wasm.json:
199
200 2016-12-02  Keith Miller  <keith_miller@apple.com>
201
202         Add Wasm copysign
203         https://bugs.webkit.org/show_bug.cgi?id=165355
204
205         Reviewed by Filip Pizlo.
206
207         * wasm/function-tests/copysign.js: Added.
208
209 2016-12-03  Commit Queue  <commit-queue@webkit.org>
210
211         Unreviewed, rolling out r209298.
212         https://bugs.webkit.org/show_bug.cgi?id=165359
213
214         broke the build (Requested by smfr on #webkit).
215
216         Reverted changeset:
217
218         "Add Wasm copysign"
219         https://bugs.webkit.org/show_bug.cgi?id=165355
220         http://trac.webkit.org/changeset/209298
221
222 2016-12-02  Keith Miller  <keith_miller@apple.com>
223
224         Add Wasm copysign
225         https://bugs.webkit.org/show_bug.cgi?id=165355
226
227         Reviewed by Filip Pizlo.
228
229         * wasm/function-tests/copysign.js: Added.
230
231 2016-12-02  Keith Miller  <keith_miller@apple.com>
232
233         Unreviewed, fix git having a breakdown over trying to reland a rollout.
234
235 2016-12-02  Keith Miller  <keith_miller@apple.com>
236
237         Add Wasm floating point nearest and trunc
238         https://bugs.webkit.org/show_bug.cgi?id=165339
239
240         Reviewed by Saam Barati.
241
242         * wasm/function-tests/nearest.js: Added.
243         * wasm/function-tests/trunc.js: Added.
244
245 2016-12-02  Caitlin Potter  <caitp@igalia.com>
246
247 [JSC] add additional bit to JSTokenType bitfield
248         https://bugs.webkit.org/show_bug.cgi?id=165091
249
250         Reviewed by Geoffrey Garen.
251
252         * stress/bug-165091.js: Added.
253         (shouldThrowSyntaxError):
254
255 2016-12-02  Commit Queue  <commit-queue@webkit.org>
256
257         Unreviewed, rolling out r209275 and r209276.
258         https://bugs.webkit.org/show_bug.cgi?id=165348
259
260         "broke the arm build" (Requested by keith_miller on #webkit).
261
262         Reverted changesets:
263
264         "Add Wasm floating point nearest and trunc"
265         https://bugs.webkit.org/show_bug.cgi?id=165339
266         http://trac.webkit.org/changeset/209275
267
268         "Unreviewed, forgot to change instruction after renaming."
269         http://trac.webkit.org/changeset/209276
270
271 2016-12-02  Keith Miller  <keith_miller@apple.com>
272
273         Add Wasm floating point nearest and trunc
274         https://bugs.webkit.org/show_bug.cgi?id=165339
275
276         Reviewed by Filip Pizlo.
277
278         * wasm/function-tests/nearest.js: Added.
279         * wasm/function-tests/trunc.js: Added.
280
281 2016-12-02  JF Bastien  <jfbastien@apple.com>
282
283         WebAssembly: revert patch causing odd breakage
284         https://bugs.webkit.org/show_bug.cgi?id=165308
285
286         Unreviewed.
287
288         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
289         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
290
291         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
292
293         * wasm/Builder.js:
294         (const._normalizeFunctionSignature):
295         * wasm/Builder_WebAssemblyBinary.js:
296         (const.emitters.Type):
297         (const.emitters.Code):
298         * wasm/LowLevelBinary.js:
299         (export.default.LowLevelBinary.prototype.inline_signature_type):
300         (export.default.LowLevelBinary.prototype.block_type): Deleted.
301         * wasm/WASM.js:
302         * wasm/js-api/test_basic_api.js:
303         * wasm/self-test/test_BuilderWebAssembly.js:
304         (EmptyModule):
305         (CustomSection):
306         * wasm/self-test/test_WASM.js:
307         * wasm/wasm.json:
308
309 2016-12-01  Ryan Haddad  <ryanhaddad@apple.com>
310
311         Skip flaky test ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js
312         https://bugs.webkit.org/show_bug.cgi?id=162567
313
314         Reviewed by Saam Barati.
315
316         * ChakraCore.yaml:
317
318 2016-12-01  Keith Miller  <keith_miller@apple.com>
319
320         Add wasm int to floating point opcodes
321         https://bugs.webkit.org/show_bug.cgi?id=165252
322
323         Reviewed by Geoffrey Garen.
324
325         Add tests for Wasm integral to floating point conversion opcodes.
326
327         * wasm/function-tests/int-to-floating-point.js: Added.
328         * wasm/wasm.json:
329
330 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
331
332         Land a test case for <rdar://problem/27889416>
333         https://bugs.webkit.org/show_bug.cgi?id=165272
334
335         Reviewed by Saam Barati.
336
337         * stress/marked-argument-buffer.js: Added.
338         (allocate):
339         (test.o.toString):
340         (test):
341
342 2016-11-29  Per Arne Vollan  <pvollan@apple.com>
343
344         [Win] Skip failing JSC tests.
345         https://bugs.webkit.org/show_bug.cgi?id=165140
346
347         Reviewed by Mark Lam.
348
349         * ChakraCore.yaml:
350         * microbenchmarks/tan.js:
351
352 2016-11-30  JF Bastien  <jfbastien@apple.com>
353
354         WebAssembly builder: don't throw when checker not implemented
355         https://bugs.webkit.org/show_bug.cgi?id=165219
356
357         Reviewed by Mark Lam.
358
359         We should perform whichever checks we've implemented, and assume the rest are OK until bug #163421 is fixed.
360
361         * wasm/Builder.js:
362         * wasm/README.md:
363         * wasm/function-tests/add-12.js:
364         * wasm/function-tests/br-if-loop-less-than.js:
365         * wasm/function-tests/brTableAsIf.js:
366         * wasm/function-tests/brTableManyValues.js:
367         * wasm/function-tests/brTableWithLoop.js:
368         * wasm/function-tests/dumb-eq-if-then-else.js:
369         * wasm/function-tests/dumb-less-than-fallthrough.js:
370         * wasm/function-tests/dumb-less-than-ite.js:
371         * wasm/function-tests/eqz.js:
372         * wasm/function-tests/factorial.js:
373         * wasm/function-tests/float-sub.js:
374         * wasm/function-tests/i32-load.js:
375         * wasm/function-tests/i32-load8-s.js:
376         * wasm/function-tests/if-then-else-fallthrough.js:
377         * wasm/function-tests/if-then-fallthrough.js:
378         * wasm/function-tests/loop-mult.js:
379         * wasm/function-tests/loop-sum.js:
380         * wasm/function-tests/max.js:
381         * wasm/function-tests/min.js:
382         * wasm/function-tests/ret5.js:
383         * wasm/function-tests/select.js:
384         * wasm/self-test/test_BuilderJSON.js:
385
386 2016-11-29  JF Bastien  <jfbastien@apple.com>
387
388         WebAssembly JS API: improve Instance
389         https://bugs.webkit.org/show_bug.cgi?id=164757
390
391         Reviewed by Keith Miller.
392
393         An Instance's `exports` property wasn't populated with exports.
394
395         A follow-up patch will do imports.
396
397         A few things of note:
398
399          - LowLevelBinary: support 3-byte integers.
400          - LowLevelBinary: support proper UTF-8 2003 code points (instead of UTF-16).
401
402         * wasm/Builder.js:
403         * wasm/Builder_WebAssemblyBinary.js: wire up exports, stub other things out some more
404         (const.emitters.Export):
405         * wasm/LowLevelBinary.js:
406         (export.default.LowLevelBinary.prototype.uint24): add, used for UTF-8
407         (export.default.LowLevelBinary.prototype.string): support UTF-8
408         (export.default.LowLevelBinary.prototype.getUint24): add, used for UTF-8
409         (export.default.LowLevelBinary.prototype.getVaruint1): was missing
410         (export.default.LowLevelBinary.prototype.getString): support UTF-8
411         (export.default.LowLevelBinary):
412         * wasm/js-api/test_Instance.js: instance.exports.answer() // <-- this is where the magic of this entire patch is
413         (ExportedAnswerI32):
414         * wasm/js-api/test_basic_api.js: punt test to later
415         (const.c.in.constructorProperties.switch):
416         * wasm/self-test/test_BuilderWebAssembly.js: UTF-8
417         (CustomSection):
418         * wasm/self-test/test_LowLevelBinary_string.js: UTF-8 now works
419         * wasm/self-test/test_LowLevelBinary_uint16.js: was missing one value
420         * wasm/self-test/test_LowLevelBinary_uint24.js: Copied from JSTests/wasm/self-test/test_LowLevelBinary_uint8.js.
421         * wasm/self-test/test_LowLevelBinary_uint8.js: was missing one value
422         * wasm/self-test/test_LowLevelBinary_varuint1.js: Added.
423         * wasm/utilities.js: this `dump` thing was useful
424         (const._dump):
425
426 2016-11-29  Saam Barati  <sbarati@apple.com>
427
428         We should be able optimize the pattern where we spread a function's rest parameter to another call
429         https://bugs.webkit.org/show_bug.cgi?id=163865
430
431         Reviewed by Filip Pizlo.
432
433         * microbenchmarks/default-derived-constructor.js: Added.
434         (createClassHierarchy.let.currentClass):
435         (createClassHierarchy):
436         * stress/call-varargs-spread.js: Added.
437         (assert):
438         (bar):
439         (foo):
440         * stress/load-varargs-on-new-array-with-spread-convert-to-static-loads.js: Added.
441         (assert):
442         (baz):
443         (bar):
444         (foo):
445         * stress/new-array-with-spread-with-normal-spread-and-phantom-spread.js: Added.
446         (assert):
447         (foo):
448         (escape):
449         (bar):
450         * stress/phantom-new-array-with-spread-osr-exit.js: Added.
451         (assert):
452         (baz):
453         (bar):
454         (effects):
455         (foo):
456         * stress/phantom-spread-forward-varargs.js: Added.
457         (assert):
458         (test1.bar):
459         (test1.foo):
460         (test1):
461         (test2.bar):
462         (test2.foo):
463         (test3.baz):
464         (test3.bar):
465         (test3.foo):
466         (test4.baz):
467         (test4.bar):
468         (test4.foo):
469         (test5.baz):
470         (test5.bar):
471         (test5.foo):
472         * stress/phantom-spread-osr-exit.js: Added.
473         (assert):
474         (baz):
475         (bar):
476         (effects):
477         (foo):
478         * stress/spread-call-convert-to-static-call.js: Added.
479         (assert):
480         (baz):
481         (bar):
482         (foo):
483         * stress/spread-forward-call-varargs-stack-overflow.js: Added.
484         (assert):
485         (identity):
486         (bar):
487         (foo):
488         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol-2.js: Added.
489         (assert):
490         (baz.Array.prototype.Symbol.iterator):
491         (baz):
492         (bar):
493         (foo):
494         (test):
495         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol.js: Added.
496         (assert):
497         (baz.Array.prototype.Symbol.iterator):
498         (baz):
499         (bar):
500         (foo):
501         * stress/spread-forward-varargs-stack-overflow.js: Added.
502         (assert):
503         (bar):
504         (foo):
505
506 2016-11-29  Caitlin Potter  <caitp@igalia.com>
507
508         [JSC] always wrap AwaitExpression operand in a new Promise
509         https://bugs.webkit.org/show_bug.cgi?id=165181
510
511         Reviewed by Yusuke Suzuki.
512
513         * stress/async-await-basic.js:
514         (async.awaitedPromisesAreWrapped):
515
516 2016-11-29  Keith Miller  <keith_miller@apple.com>
517
518         Add simple way to implement Wasm ops that require more than one B3 opcode
519         https://bugs.webkit.org/show_bug.cgi?id=165129
520
521         Reviewed by Geoffrey Garen.
522
523         * wasm/function-tests/eqz.js: Added.
524         * wasm/function-tests/max.js: Added.
525         * wasm/function-tests/min.js: Added.
526         * wasm/wasm.json:
527
528 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
529
530         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
531         https://bugs.webkit.org/show_bug.cgi?id=164898
532
533         Reviewed by Darin Adler.
534
535         * stress/tagged-template-registry-key-collect.js: Added.
536         (shouldBe):
537         (tag):
538         (i.eval):
539         * stress/tagged-template-registry-key.js: Added.
540         (shouldBe):
541         (tag):
542         (a):
543         (b):
544
545 2016-11-20  Caitlin Potter  <caitp@igalia.com>
546
547         [JSC] speed up parsing of async functions
548         https://bugs.webkit.org/show_bug.cgi?id=164808
549
550         Reviewed by Yusuke Suzuki.
551
552         Add tests for line terminator following "async" keyword in async
553         function syntax.
554
555         * stress/async-await-syntax.js:
556         (shouldBe):
557
558 2016-11-19  Mark Lam  <mark.lam@apple.com>
559
560         op_mod-* JSC tests needs a longer timeout too.
561         https://bugs.webkit.org/show_bug.cgi?id=164994
562
563         Reviewed by Yusuke Suzuki.
564
565         * stress/op_mod-ConstVar.js:
566         * stress/op_mod-VarConst.js:
567         * stress/op_mod-VarVar.js:
568
569 2016-11-19  Mark Lam  <mark.lam@apple.com>
570
571         Add --timeoutMultiplier option to allow some tests more time to run.
572         https://bugs.webkit.org/show_bug.cgi?id=164951
573
574         Reviewed by Yusuke Suzuki.
575
576         Extended the timeout for these tests by 50% more because they run quite slow on
577         low-end machines.
578
579         * stress/op_div-ConstVar.js:
580         * stress/op_div-VarConst.js:
581         * stress/op_div-VarVar.js:
582
583 2016-11-18  Yusuke Suzuki  <utatane.tea@gmail.com>
584
585         REGRESSION(r208867): JSC test failure: ChakraCore.yaml/ChakraCore/test/strict/05.arguments_sm.js.default
586         https://bugs.webkit.org/show_bug.cgi?id=164929
587
588         Reviewed by Mark Lam.
589
590         ES2017 drops arguments.caller and JavaScriptCore is updated to meet the spec.
591         This patch rebaselines the result of ChakraCore test for JSC.
592
593         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
594
595 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
596
597         Web Inspector: Generator functions should have a displayable name when shown in stack traces
598         https://bugs.webkit.org/show_bug.cgi?id=164844
599         <rdar://problem/29300697>
600
601         Reviewed by Yusuke Suzuki.
602
603         * stress/generator-function-name.js:
604         Add another test now that we name the inner generator function
605         that we do not break the lexical resolution of names.
606
607 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
608
609         [JSC] Drop arguments.caller
610         https://bugs.webkit.org/show_bug.cgi?id=164859
611
612         Reviewed by Saam Barati.
613
614         * stress/strict-mode-arguments-caller.js: Added.
615         (strictArguments):
616         (shouldBe):
617
618 2016-11-17  Keith Miller  <keith_miller@apple.com>
619
620         Add rotate to Wasm
621         https://bugs.webkit.org/show_bug.cgi?id=164871
622
623         Reviewed by Filip Pizlo.
624
625         * wasm/wasm.json:
626
627 2016-11-17  Keith Miller  <keith_miller@apple.com>
628
629         Add sqrt to Wasm
630         https://bugs.webkit.org/show_bug.cgi?id=164877
631
632         Reviewed by Mark Lam.
633
634         B3 already has a Sqrt opcode we just need to map Wasm to it.
635
636         * wasm/wasm.json:
637
638 2016-11-17  Saam Barati  <sbarati@apple.com>
639
640         Remove async/await compile time flag and enable tests
641         https://bugs.webkit.org/show_bug.cgi?id=164828
642         <rdar://problem/28639334>
643
644         Reviewed by Yusuke Suzuki.
645
646         * stress/async-arrow-functions-lexical-arguments-binding.js:
647         * stress/async-arrow-functions-lexical-new.target-binding.js:
648         * stress/async-arrow-functions-lexical-super-binding.js:
649         * stress/async-arrow-functions-lexical-this-binding.js:
650         * stress/async-await-basic.js:
651         * stress/async-await-long-loop.js:
652         * stress/async-await-module-reserved-word.js:
653         * stress/async-await-mozilla.js:
654         (mozSyntaxErrors):
655         * stress/async-await-reserved-word.js:
656         * stress/async-await-syntax.js:
657         * stress/async-await-throw-loop.js:
658         * stress/async-function-create-nobaseline.js:
659         * stress/async-function-create-optimized.js:
660         * stress/async-function-declaration-sinking-no-double-allocate.js:
661         * stress/async-function-declaration-sinking-osrexit.js:
662         * stress/async-function-declaration-sinking-put.js:
663         * stress/async-function-expression-sinking-no-double-allocate.js:
664         * stress/async-function-expression-sinking-osrexit.js:
665         * stress/async-function-expression-sinking-put.js:
666         * test262.yaml:
667
668 2016-11-15  Mark Lam  <mark.lam@apple.com>
669
670         Make JSC test functions more robust.
671         https://bugs.webkit.org/show_bug.cgi?id=164807
672
673         Reviewed by Keith Miller.
674
675         * stress/jsc-test-functions-should-be-more-robust.js: Added.
676
677 2016-11-15  Keith Miller  <keith_miller@apple.com>
678
679         B3 should support UDiv/UMod
680         https://bugs.webkit.org/show_bug.cgi?id=164811
681
682         Reviewed by Filip Pizlo.
683
684         Link new instructions to wasm.
685
686         * wasm/wasm.json:
687
688 2016-11-15  Saam Barati  <sbarati@apple.com>
689
690         Debug JSC test timeout: stress/has-own-property-name-cache-symbols-and-strings.js.ftl-no-cjit-small-pool
691         https://bugs.webkit.org/show_bug.cgi?id=163012
692
693         Unreviewed. This patch makes a test run for less time because it's timing out on the bots.
694
695         * stress/has-own-property-name-cache-symbols-and-strings.js:
696
697 2016-11-15  Mark Lam  <mark.lam@apple.com>
698
699         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
700         https://bugs.webkit.org/show_bug.cgi?id=164781
701         <rdar://problem/28418590>
702
703         Reviewed by Geoffrey Garen and Michael Saboff.
704
705         * stress/jsc-setImpureGetterDelegate-on-bad-type.js: Added.
706
707 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
708
709         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
710         https://bugs.webkit.org/show_bug.cgi?id=164727
711
712         Reviewed by Filip Pizlo.
713
714         * stress/check-dom-with-signature.js: Added.
715         (shouldBe):
716         (calling):
717         (i.array.forEach):
718
719 2016-11-14  Caitlin Potter  <caitp@igalia.com>
720
721         [JSC] do not reference AwaitExpression Promises in async function Promise chain
722         https://bugs.webkit.org/show_bug.cgi?id=164753
723
724         Reviewed by Yusuke Suzuki.
725
726         * asyncFunctionTests.yaml:
727         * stress/async-await-long-loop.js: Added.
728         (shouldBe):
729         (async.longLoop):
730         * stress/async-await-throw-loop.js: Added.
731         (shouldBe):
732         (async.thrower):
733         (async.throwLoop):
734
735 2016-11-14  Keith Miller  <keith_miller@apple.com>
736
737         Add Wasm select
738         https://bugs.webkit.org/show_bug.cgi?id=164743
739
740         Reviewed by Saam Barati.
741
742         * wasm/function-tests/select.js: Added.
743
744 2016-11-14  Caitlin Potter  <caitp@igalia.com>
745
746         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
747         https://bugs.webkit.org/show_bug.cgi?id=164037
748
749         Reviewed by Yusuke Suzuki.
750
751         Add tests based on tests from https://trac.webkit.org/changeset/194216.
752
753         * asyncFunctionTests.yaml:
754         * stress/async-function-create-nobaseline.js: Added.
755         * stress/async-function-create-optimized.js: Added.
756         * stress/async-function-declaration-sinking-no-double-allocate.js: Added.
757         * stress/async-function-declaration-sinking-osrexit.js: Added.
758         * stress/async-function-declaration-sinking-put.js: Added.
759         * stress/async-function-expression-sinking-no-double-allocate.js: Added.
760         * stress/async-function-expression-sinking-osrexit.js: Added.
761         * stress/async-function-expression-sinking-put.js: Added.
762
763 2016-11-14  Mark Lam  <mark.lam@apple.com>
764
765         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
766         https://bugs.webkit.org/show_bug.cgi?id=164701
767         <rdar://problem/27462104>
768
769         Reviewed by Darin Adler.
770
771         * stress/string-prototype-charCodeAt-on-too-long-rope.js: Added.
772
773 2016-11-14  Mark Lam  <mark.lam@apple.com>
774
775         RegExpObject::exec/match should handle errors gracefully.
776         https://bugs.webkit.org/show_bug.cgi?id=155145
777         <rdar://problem/27435934>
778
779         Reviewed by Keith Miller.
780
781         * stress/regexp-prototype-exec-on-too-long-rope.js: Added.
782         * stress/regexp-prototype-match-on-too-long-rope.js: Added.
783         * stress/regexp-prototype-test-on-too-long-rope.js: Added.
784
785 2016-11-14  Mark Lam  <mark.lam@apple.com>
786
787         Enhance run-jsc-stress-test script to allow optional test specific options to be added for all test run configurations.
788         https://bugs.webkit.org/show_bug.cgi?id=164695
789
790         Reviewed by Keith Miller.
791
792         Replace use of runMisc* test run configurations with equivalents.
793
794         * stress/licm-no-pre-header-nested.js:
795         * stress/licm-no-pre-header.js:
796         * stress/licm-pre-header-cannot-exit-nested.js:
797         * stress/licm-pre-header-cannot-exit.js:
798         * stress/make-dictionary-repatch.js:
799         * stress/retry-cache-later.js:
800         * stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js:
801         * stress/slow-path-generator-updating-current-node-dfg.js:
802         * stress/unshift-array-storage.js:
803
804 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
805
806         test262: DataView with explicit undefined byteLength should be the same as it not being present
807         https://bugs.webkit.org/show_bug.cgi?id=164453
808
809         Reviewed by Darin Adler.
810
811         * stress/dataview-construct.js: Added.
812         (assert):
813         (shouldThrow):
814         * test262.yaml:
815
816 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
817
818         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
819         https://bugs.webkit.org/show_bug.cgi?id=164451
820
821         Reviewed by Darin Adler.
822
823         * test262.yaml:
824
825 2016-11-11  Saam Barati  <sbarati@apple.com>
826
827         We should have a more concise way of determining when we're varargs calling a function using rest parameters
828         https://bugs.webkit.org/show_bug.cgi?id=164258
829
830         Reviewed by Yusuke Suzuki.
831
832         * microbenchmarks/call-using-spread.js: Added.
833         (bar):
834         (foo):
835         * microbenchmarks/spread-large-array.js: Added.
836         (foo):
837         (arrays.push):
838         * microbenchmarks/spread-small-array.js: Added.
839         (foo):
840         * stress/spread-array-iterator-watchpoint-2.js: Added.
841         (foo):
842         (arrayIterator.next):
843         * stress/spread-array-iterator-watchpoint.js: Added.
844         (foo):
845         (Array.prototype.Symbol.iterator):
846         * stress/spread-non-array.js: Added.
847         (assert):
848         (foo):
849         (let.customIterator.Symbol.iterator):
850         (bar):
851
852 2016-11-11  Keith Miller  <keith_miller@apple.com>
853
854         Relocate wasm tests and actually add them to the test runner
855         https://bugs.webkit.org/show_bug.cgi?id=164668
856
857         Reviewed by Yusuke Suzuki.
858
859         This moves the Wasm tests from their current location down a level.
860         Without relocating, the tests cannot properly be run by the wasm test runner.
861
862         * wasm.yaml:
863         * wasm/Builder.js: Fix typos, yay lazy synatx checking!
864         * wasm/LowLevelBinary.js: Fix typos, yay lazy synatx checking!
865         (export.default.LowLevelBinary.prototype.get return):
866         * wasm/function-tests/add-12.js: Renamed from JSTests/wasm/js-api/function-tests/add-12.js.
867         * wasm/function-tests/br-if-loop-less-than.js: Renamed from JSTests/wasm/js-api/function-tests/br-if-loop-less-than.js.
868         * wasm/function-tests/brTableAsIf.js: Renamed from JSTests/wasm/js-api/function-tests/brTableAsIf.js.
869         * wasm/function-tests/brTableManyValues.js: Renamed from JSTests/wasm/js-api/function-tests/brTableManyValues.js.
870         * wasm/function-tests/brTableWithLoop.js: Renamed from JSTests/wasm/js-api/function-tests/brTableWithLoop.js.
871         * wasm/function-tests/dumb-eq-if-then-else.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-eq-if-then-else.js.
872         * wasm/function-tests/dumb-less-than-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-fallthrough.js.
873         * wasm/function-tests/dumb-less-than-ite.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-ite.js.
874         * wasm/function-tests/factorial.js: Renamed from JSTests/wasm/js-api/function-tests/factorial.js.
875         * wasm/function-tests/float-sub.js: Renamed from JSTests/wasm/js-api/function-tests/float-sub.js.
876         * wasm/function-tests/i32-load.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load.js.
877         * wasm/function-tests/i32-load8-s.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load8-s.js.
878         * wasm/function-tests/if-then-else-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-else-fallthrough.js.
879         * wasm/function-tests/if-then-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-fallthrough.js.
880         * wasm/function-tests/loop-mult.js: Renamed from JSTests/wasm/js-api/function-tests/loop-mult.js.
881         * wasm/function-tests/loop-sum.js: Renamed from JSTests/wasm/js-api/function-tests/loop-sum.js.
882         * wasm/function-tests/ret5.js: Renamed from JSTests/wasm/js-api/function-tests/ret5.js.
883         * wasm/self-test/test_BuilderJSON.js: Rebasline
884
885 2016-11-11  Keith Miller  <keith_miller@apple.com>
886
887         Move Wasm tests to JS
888         https://bugs.webkit.org/show_bug.cgi?id=164611
889
890         Reviewed by Geoffrey Garen.
891
892         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
893         ommited tests were earliest tests, which tested trivial things, like adding two
894         constants. Some tests are ommited for other reasons, however. These are:
895
896         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
897         Tests that would validate the memory of the module once wasm was done with it since that's
898         not really possible in JS.
899
900         In order to make such a translation easier this patch also adds some features to the JS
901         testing api:
902
903         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
904         opcode. For example one can do:
905             ...
906             .Block("i32", b => b.I32Const(1) )
907
908         and the nested lambda will automatically have an end attached.
909
910         2) The JS testing api can now handle inline signature types.
911
912         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
913
914         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
915         wasm.json without being remapped.
916
917         5) Add support for Memory and Function sections to the Builder.
918
919         6) Add support for local variables.
920
921         On the JSC side, we needed to expose a new function to validate the compiled wasm code
922         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
923         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
924         number of functions in the blob and tests for each of those functions.
925
926         * wasm/Builder.js:
927         (const._maybeRegisterType):
928         (const): Deleted.
929         (switch.typeof): Deleted.
930         * wasm/Builder_WebAssemblyBinary.js:
931         (const.emitters.Type):
932         (const.emitters.Import):
933         (const.emitters.Function):
934         (const.emitters.Memory):
935         (const.emitters.Code):
936         (export.const.Binary):
937         * wasm/LowLevelBinary.js:
938         (export.default.LowLevelBinary.prototype.get return):
939         (export.default.LowLevelBinary.prototype.varuint32):
940         (export.default.LowLevelBinary.prototype.varint32):
941         (export.default.LowLevelBinary.prototype.varuint1):
942         (export.default.LowLevelBinary.prototype.varint7):
943         (export.default.LowLevelBinary.prototype.varuint7):
944         (export.default.LowLevelBinary.prototype.inline_signature_type):
945         (export.default.LowLevelBinary.prototype.string):
946         (export.default.LowLevelBinary.prototype.getVaruint32):
947         (export.default.LowLevelBinary.prototype.getVarint32):
948         (export.default.LowLevelBinary.prototype.getVaruint7):
949         (export.default.LowLevelBinary.prototype.getString):
950         (export.default.LowLevelBinary):
951         (export.default.LowLevelBinary.prototype.varuint): Deleted.
952         (export.default.LowLevelBinary.prototype.varint): Deleted.
953         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
954         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
955         * wasm/js-api/test_old_tests.js: Added.
956         (ret5):
957         (brTableWithLoop):
958         (brTableManyValues):
959         (run.brTableManyValues.brTableAsIf):
960         (ifThenFallthrough):
961         (ifThenElseFallthrough):
962         (dumbLessThanFallthrough):
963         (run.dumbLessThanFallthrough.floatSub):
964         (run.floatSub.add12):
965         (run.add12.factorial):
966         (i32load):
967         (run.i32load.i32load8s):
968         (run.i32load8s.dumbEqIfThenElse):
969         (run.dumbEqIfThenElse.dumbEqIfThenElse):
970         (run.dumbEqIfThenElse.dumbLessThanIfThenElse):
971         (run.dumbLessThanIfThenElse.loopSum):
972         (run.loopSum.loopMult):
973         (brIfLoopLessThan):
974         (run.brIfLoopLessThan.run):
975         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
976         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
977
978         * wasm/Builder.js:
979         (const._maybeRegisterType):
980         (const): Deleted.
981         (switch.typeof): Deleted.
982         * wasm/Builder_WebAssemblyBinary.js:
983         (const.emitters.Type):
984         (const.emitters.Import):
985         (const.emitters.Function):
986         (const.emitters.Memory):
987         (const.emitters.Code):
988         (export.const.Binary):
989         * wasm/LowLevelBinary.js:
990         (export.default.LowLevelBinary.prototype.get return):
991         (export.default.LowLevelBinary.prototype.varuint32):
992         (export.default.LowLevelBinary.prototype.varint32):
993         (export.default.LowLevelBinary.prototype.varuint1):
994         (export.default.LowLevelBinary.prototype.varint7):
995         (export.default.LowLevelBinary.prototype.varuint7):
996         (export.default.LowLevelBinary.prototype.inline_signature_type):
997         (export.default.LowLevelBinary.prototype.string):
998         (export.default.LowLevelBinary.prototype.getVaruint32):
999         (export.default.LowLevelBinary.prototype.getVarint32):
1000         (export.default.LowLevelBinary.prototype.getVaruint7):
1001         (export.default.LowLevelBinary.prototype.getString):
1002         (export.default.LowLevelBinary):
1003         (export.default.LowLevelBinary.prototype.varuint): Deleted.
1004         (export.default.LowLevelBinary.prototype.varint): Deleted.
1005         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
1006         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
1007         * wasm/js-api/function-tests/add-12.js: Added.
1008         * wasm/js-api/function-tests/br-if-loop-less-than.js: Added.
1009         * wasm/js-api/function-tests/brTableAsIf.js: Added.
1010         * wasm/js-api/function-tests/brTableManyValues.js: Added.
1011         * wasm/js-api/function-tests/brTableWithLoop.js: Added.
1012         * wasm/js-api/function-tests/dumb-eq-if-then-else.js: Added.
1013         * wasm/js-api/function-tests/dumb-less-than-fallthrough.js: Added.
1014         * wasm/js-api/function-tests/dumb-less-than-ite.js: Added.
1015         * wasm/js-api/function-tests/factorial.js: Added.
1016         * wasm/js-api/function-tests/float-sub.js: Added.
1017         * wasm/js-api/function-tests/i32-load.js: Added.
1018         * wasm/js-api/function-tests/i32-load8-s.js: Added.
1019         * wasm/js-api/function-tests/if-then-else-fallthrough.js: Added.
1020         * wasm/js-api/function-tests/if-then-fallthrough.js: Added.
1021         * wasm/js-api/function-tests/loop-mult.js: Added.
1022         * wasm/js-api/function-tests/loop-sum.js: Added.
1023         * wasm/js-api/function-tests/ret5.js: Added.
1024         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
1025         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
1026
1027 2016-11-11  Saam Barati  <sbarati@apple.com>
1028
1029         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
1030         https://bugs.webkit.org/show_bug.cgi?id=164650
1031
1032         Reviewed by Geoffrey Garen.
1033
1034         * stress/dont-dead-lock-put-by-val-as-put-by-id.js: Added.
1035         (ident):
1036         (let.o.set foo):
1037         (foo):
1038
1039 2016-11-11  Chris Dumez  <cdumez@apple.com>
1040
1041         Unreviewed, rolling out r208584.
1042
1043         Seems to have regressed Speedometer by 1% on Mac
1044
1045         Reverted changeset:
1046
1047         "We should have a more concise way of determining when we're
1048         varargs calling a function using rest parameters"
1049         https://bugs.webkit.org/show_bug.cgi?id=164258
1050         http://trac.webkit.org/changeset/208584
1051
1052 2016-11-11  Chris Dumez  <cdumez@apple.com>
1053
1054         Unreviewed, rolling out r208117 and r208160.
1055
1056         Regressed Speedometer by >1.5%
1057
1058         Reverted changesets:
1059
1060         "We should have a way of profiling when a get_by_id is pure
1061         and to emit a PureGetById in the DFG/FTL"
1062         https://bugs.webkit.org/show_bug.cgi?id=163305
1063         http://trac.webkit.org/changeset/208117
1064
1065         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
1066         out"
1067         https://bugs.webkit.org/show_bug.cgi?id=164227
1068         http://trac.webkit.org/changeset/208160
1069
1070 2016-11-11  Saam Barati  <sbarati@apple.com>
1071
1072         We should have a more concise way of determining when we're varargs calling a function using rest parameters
1073         https://bugs.webkit.org/show_bug.cgi?id=164258
1074
1075         Reviewed by Yusuke Suzuki.
1076
1077         * microbenchmarks/call-using-spread.js: Added.
1078         (bar):
1079         (foo):
1080         * microbenchmarks/spread-large-array.js: Added.
1081         (foo):
1082         (arrays.push):
1083         * microbenchmarks/spread-small-array.js: Added.
1084         (foo):
1085         * stress/spread-array-iterator-watchpoint-2.js: Added.
1086         (foo):
1087         (arrayIterator.next):
1088         * stress/spread-array-iterator-watchpoint.js: Added.
1089         (foo):
1090         (Array.prototype.Symbol.iterator):
1091         * stress/spread-non-array.js: Added.
1092         (assert):
1093         (foo):
1094         (let.customIterator.Symbol.iterator):
1095         (bar):
1096
1097 2016-11-10  Mark Lam  <mark.lam@apple.com>
1098
1099         Fix broken have-a-bad-time-with-arguments.js test.
1100         https://bugs.webkit.org/show_bug.cgi?id=164626
1101
1102         Reviewed by Filip Pizlo.
1103
1104         But also saved a copy of the broken one as broken-have-a-bad-time-with-arguments-for-gc-testing.js
1105         because coincidentally, it stresses the GC in ways that help reveal bugs.
1106
1107         * stress/broken-have-a-bad-time-with-arguments-for-gc-testing.js: Added.
1108         (testFunction):
1109         (warmupFunction):
1110         (let.argsDeclIndex.in.argumentsDecls.let.indexToReturnIndex.in.indicesToReturn.let.insertElementActionIndex.in.insertElementActions.let.tierWarmupCountIndex.in.tierWarmupCounts.let.testArgsIndex.in.testArgsList.catch):
1111         * stress/have-a-bad-time-with-arguments.js:
1112
1113 2016-11-10  JF Bastien  <jfbastien@apple.com>
1114
1115         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
1116         https://bugs.webkit.org/show_bug.cgi?id=164597
1117
1118         Reviewed by Keith Miller.
1119
1120         Trim the array buffer before returning it: it's optimistically
1121         over-allocated to avoid growing all the time, but when parsed it
1122         can't have extra content.
1123
1124         * wasm/Builder_WebAssemblyBinary.js:
1125         (export.const.Binary):
1126         * wasm/LowLevelBinary.js:
1127         (export.default.LowLevelBinary.prototype.get return):
1128
1129 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
1130
1131         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
1132         https://bugs.webkit.org/show_bug.cgi?id=164450
1133
1134         Reviewed by Darin Adler.
1135
1136         * stress/dataview-typedarray-toindex.js: Added.
1137         Tests for all cases where ToIndex should be used.
1138
1139         * test262.yaml:
1140         New passing tests.
1141
1142 2016-11-10  Mark Lam  <mark.lam@apple.com>
1143
1144         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
1145         https://bugs.webkit.org/show_bug.cgi?id=164600
1146         <rdar://problem/28828676>
1147
1148         Reviewed by Filip Pizlo.
1149
1150         * stress/osr-exit-on-op-negate-should-no-fail-assertions.js: Added.
1151
1152 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1153
1154         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
1155         https://bugs.webkit.org/show_bug.cgi?id=164502
1156
1157         Reviewed by Saam Barati.
1158
1159         * stress/argument-intrinsic-basic.js: Added.
1160         (shouldBe):
1161         (builtin.createBuiltin):
1162         * stress/argument-intrinsic-inlining-with-result-escape.js: Added.
1163         (shouldBe):
1164         (builtin.createBuiltin):
1165         (escape):
1166         * stress/argument-intrinsic-nested-inlining.js: Added.
1167         (shouldBe):
1168         (builtin.createBuiltin):
1169         (builtinCaller1):
1170         (builtinCaller2):
1171         (escape):
1172         * stress/argument-intrinsic-not-convert-to-get-argument.js: Added.
1173         (shouldBe):
1174         (builtin.createBuiltin):
1175         * stress/argument-intrinsic-with-stack-write.js: Added.
1176         (shouldBe):
1177         (builtin.createBuiltin):
1178
1179 2016-11-09  Saam Barati  <sbarati@apple.com>
1180
1181         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
1182         https://bugs.webkit.org/show_bug.cgi?id=164464
1183         <rdar://problem/29131452>
1184
1185         Reviewed by Darin Adler.
1186
1187         * stress/math-max-min-no-arguments.js: Added.
1188         (assert):
1189         (min):
1190         (max):
1191         (test):
1192
1193 2016-11-09  Saam Barati  <sbarati@apple.com>
1194
1195         TypeProfiler and running GC collection on another thread don't play nicely with each other
1196         https://bugs.webkit.org/show_bug.cgi?id=164441
1197         <rdar://problem/29132174>
1198
1199         Reviewed by Geoffrey Garen.
1200
1201         * typeProfiler/type-profiler-gc.js: Added.
1202         (bar):
1203         (foo):
1204
1205 2016-11-04  Mark Lam  <mark.lam@apple.com>
1206
1207         Error description code should be able to handle Symbol values.
1208         https://bugs.webkit.org/show_bug.cgi?id=164436
1209         <rdar://problem/29115583>
1210
1211         Reviewed by Filip Pizlo and Saam Barati.
1212
1213         * stress/error-description-on-symbols-should-not-crash.js: Added.
1214
1215 2016-11-03  Geoffrey Garen  <ggaren@apple.com>
1216
1217         EvalCodeCache should not give up in strict mode and other cases
1218         https://bugs.webkit.org/show_bug.cgi?id=164357
1219
1220         Reviewed by Michael Saboff.
1221
1222         * microbenchmarks/eval-cached.js: Added. 45x faster now.
1223         * stress/eval-cached.js: Added. Try running the same eval text in a bunch
1224         of different scopes and verify that we access the right scope.
1225
1226 2016-11-04  JF Bastien  <jfbastien@apple.com>
1227
1228         WebAssembly JS API: implement more sections
1229         https://bugs.webkit.org/show_bug.cgi?id=164023
1230
1231         Reviewed by Keith Miller.
1232
1233         On the JSC side:
1234
1235          - Put in parser stubs for all WebAssembly sections.
1236          - Parse Import, Export sections.
1237          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
1238          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
1239          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
1240          - parseCode: avoid overflow through function size.
1241          - Remove all remainders of polyfill-prototype-1, and update license.
1242          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
1243
1244         On the Builder.js testing side:
1245
1246          - Implement Type, Import (function only), Export (function only) sections.
1247          - Check section order and uniqueness.
1248          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
1249          - Allow re-exporting an import.
1250
1251         * wasm/Builder.js: build type, import, and export sections
1252         (const._normalizeFunctionSignature):
1253         * wasm/Builder_WebAssemblyBinary.js: Added. Forked from Builder.js
1254         (const.emitters.Type):
1255         (const.emitters.Import):
1256         (const.emitters.Function):
1257         (const.emitters.Table):
1258         (const.emitters.Memory):
1259         (const.emitters.Global):
1260         (const.emitters.Export):
1261         (const.emitters.Start):
1262         (const.emitters.Element):
1263         (const.emitters.Code):
1264         (const.emitters.Data):
1265         (export.const.Binary):
1266         * wasm/LowLevelBinary.js: Add a few useful outputs
1267         (export.default.LowLevelBinary.prototype.varuint1):
1268         (export.default.LowLevelBinary.prototype.varint7):
1269         * wasm/WASM.js: value type and external kind helpers
1270         * wasm/assert.js: array element-wise equality comparison
1271         (const._eq):
1272         * wasm/js-api/test_Module.js:
1273         (ModuleWithImports):
1274         * wasm/self-test/test_BuilderJSON.js: many more tests for all the new Builder APIs, and update to some older tests which now require a Type section or rejiggered Function signature
1275         (const.assertOpThrows):
1276         (SectionsWithSameCustomName):
1277         (TwoTypeSections):
1278         (EmptyImportSection):
1279         (ImportBeforeTypeSections):
1280         * wasm/self-test/test_BuilderWebAssembly.js: remove a test which wasn't helpful and is now obsolete
1281         (CustomSection):
1282
1283 2016-11-03  Mark Lam  <mark.lam@apple.com>
1284
1285         ClonedArguments need to also support haveABadTime mode.
1286         https://bugs.webkit.org/show_bug.cgi?id=164200
1287         <rdar://problem/27211336>
1288
1289         Reviewed by Geoffrey Garen.
1290
1291         * stress/have-a-bad-time-with-arguments.js: Added.
1292
1293 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1294
1295         DFG plays fast and loose with the shadow values of a Phi
1296         https://bugs.webkit.org/show_bug.cgi?id=164309
1297
1298         Reviewed by Saam Barati.
1299         
1300         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1301
1302         * stress/dfg-ssa-swap.js: Added.
1303         (foo):
1304
1305 2016-11-03  Commit Queue  <commit-queue@webkit.org>
1306
1307         Unreviewed, rolling out r208364.
1308         https://bugs.webkit.org/show_bug.cgi?id=164402
1309
1310         broke the build (Requested by smfr on #webkit).
1311
1312         Reverted changeset:
1313
1314         "DFG plays fast and loose with the shadow values of a Phi"
1315         https://bugs.webkit.org/show_bug.cgi?id=164309
1316         http://trac.webkit.org/changeset/208364
1317
1318 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1319
1320         DFG plays fast and loose with the shadow values of a Phi
1321         https://bugs.webkit.org/show_bug.cgi?id=164309
1322
1323         Reviewed by Saam Barati.
1324         
1325         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1326
1327         * stress/dfg-ssa-swap.js: Added.
1328         (foo):
1329
1330 2016-11-03  Saam Barati  <sbarati@apple.com>
1331
1332         Asking for a value profile prediction should be defensive against not finding a value profile
1333         https://bugs.webkit.org/show_bug.cgi?id=164306
1334
1335         Reviewed by Mark Lam.
1336
1337         * stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js: Added.
1338         (let.o.set foo):
1339         (bar):
1340
1341 2016-11-02  Saam Barati  <sbarati@apple.com>
1342
1343         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
1344         https://bugs.webkit.org/show_bug.cgi?id=164301
1345
1346         Reviewed by Geoffrey Garen.
1347
1348         * stress/rest-parameter-allocation-elimination-watchpoints-2.js: Added.
1349         (assert):
1350         (foo):
1351         * stress/rest-parameter-allocation-elimination-watchpoints-3.js: Added.
1352         (assert):
1353         (foo):
1354         * stress/rest-parameter-allocation-elimination-watchpoints-4.js: Added.
1355         (assert):
1356         (foo):
1357         * stress/rest-parameter-allocation-elimination-watchpoints-5.js: Added.
1358         (assert):
1359         (foo):
1360         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Added.
1361         (assert):
1362         (foo):
1363         * stress/rest-parameter-allocation-elimination-watchpoints.js: Added.
1364         (assert):
1365         (foo):
1366
1367 2016-11-01  Saam Barati  <sbarati@apple.com>
1368
1369         We should be able to eliminate rest parameter allocations
1370         https://bugs.webkit.org/show_bug.cgi?id=163925
1371
1372         Reviewed by Filip Pizlo.
1373
1374         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1375         (assert):
1376         (test1.bar):
1377         (test1):
1378         (test2.jaz):
1379         (test2.jaz2.kaz):
1380         (test2.jaz2):
1381         (test2):
1382         (test3.foo):
1383         (test3.baz):
1384         (test3.jaz):
1385         (test3):
1386         (test4.baz):
1387         (test4.jaz):
1388         (test4):
1389         (test5.baz):
1390         (test5.jaz):
1391         (test5):
1392         (test6.baz):
1393         (test6.jaz):
1394         (test6):
1395         (test7.baz):
1396         (test7.jaz):
1397         (test7.check):
1398         (test7):
1399         (test8.baz):
1400         (test8.jaz):
1401         (test8.check):
1402         (test8):
1403         (test9.baz):
1404         (test9.jaz):
1405         (test9.check):
1406         (test9):
1407         (test10.baz):
1408         (test10.jaz):
1409         (test10):
1410         (test11.bar):
1411         (test11.foo):
1412         (test11.makeArguments):
1413         (test11.):
1414         (test12):
1415         (test12.bar):
1416         (test12.foo):
1417         (test12.makeArguments):
1418         (test12.):
1419         (test13.bar):
1420         (test13.top):
1421         (test13.foo):
1422         (test13.makeArguments):
1423         (test13.):
1424         (test13):
1425         (test14.bar):
1426         (test14.top):
1427         (test14.foo):
1428         (test14.makeArguments):
1429         (test14.):
1430         (test14):
1431         (test15.bar):
1432         (test15.top):
1433         (test15.foo):
1434         (test15.makeArguments):
1435         (test15.):
1436         (test15):
1437
1438 2016-11-01  Commit Queue  <commit-queue@webkit.org>
1439
1440         Unreviewed, rolling out r208208 and r208210.
1441         https://bugs.webkit.org/show_bug.cgi?id=164276
1442
1443         This change caused 28 JSC test failures. (Requested by
1444         ryanhaddad on #webkit).
1445
1446         Reverted changesets:
1447
1448         "We should be able to eliminate rest parameter allocations"
1449         https://bugs.webkit.org/show_bug.cgi?id=163925
1450         http://trac.webkit.org/changeset/208208
1451
1452         "Fix the EFL build."
1453         http://trac.webkit.org/changeset/208210
1454
1455 2016-10-31  Filip Pizlo  <fpizlo@apple.com>
1456
1457         JSC should support SharedArrayBuffer
1458         https://bugs.webkit.org/show_bug.cgi?id=163986
1459
1460         Reviewed by Keith Miller.
1461         
1462         This adds our own test for the various corner cases of SharedArrayBuffer. This test is meant to
1463         check all of the things that don't require concurrency.
1464
1465         * stress/SharedArrayBuffer.js: Added.
1466         (checkAtomics):
1467         (shouldFail):
1468         (Symbol):
1469         (runAtomic):
1470
1471 2016-10-31  Saam Barati  <sbarati@apple.com>
1472
1473         We should be able to eliminate rest parameter allocations
1474         https://bugs.webkit.org/show_bug.cgi?id=163925
1475
1476         Reviewed by Filip Pizlo.
1477
1478         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1479         (assert):
1480         (test1.bar):
1481         (test1):
1482         (test2.jaz):
1483         (test2.jaz2.kaz):
1484         (test2.jaz2):
1485         (test2):
1486         (test3.foo):
1487         (test3.baz):
1488         (test3.jaz):
1489         (test3):
1490         (test4.baz):
1491         (test4.jaz):
1492         (test4):
1493         (test5.baz):
1494         (test5.jaz):
1495         (test5):
1496         (test6.baz):
1497         (test6.jaz):
1498         (test6):
1499         (test7.baz):
1500         (test7.jaz):
1501         (test7.check):
1502         (test7):
1503         (test8.baz):
1504         (test8.jaz):
1505         (test8.check):
1506         (test8):
1507         (test9.baz):
1508         (test9.jaz):
1509         (test9.check):
1510         (test9):
1511         (test10.baz):
1512         (test10.jaz):
1513         (test10):
1514         (test11.bar):
1515         (test11.foo):
1516         (test11.makeArguments):
1517         (test11.):
1518         (test12):
1519         (test12.bar):
1520         (test12.foo):
1521         (test12.makeArguments):
1522         (test12.):
1523         (test13.bar):
1524         (test13.top):
1525         (test13.foo):
1526         (test13.makeArguments):
1527         (test13.):
1528         (test13):
1529         (test14.bar):
1530         (test14.top):
1531         (test14.foo):
1532         (test14.makeArguments):
1533         (test14.):
1534         (test14):
1535         (test15.bar):
1536         (test15.top):
1537         (test15.foo):
1538         (test15.makeArguments):
1539         (test15.):
1540         (test15):
1541
1542 2016-10-31  Saam Barati  <sbarati@apple.com>
1543
1544         Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing out
1545         https://bugs.webkit.org/show_bug.cgi?id=164227
1546
1547         Unreviewed timeout fix.
1548
1549         * microbenchmarks/pure-get-by-id-cse-2.js:
1550
1551 2016-10-31  Keith Miller  <keith_miller@apple.com>
1552
1553         autogenerated files from wasm.json should be in derived sources.
1554         https://bugs.webkit.org/show_bug.cgi?id=164152
1555
1556         Reviewed by Filip Pizlo.
1557
1558         Delete generation script since it is no longer used.
1559
1560         * wasm/generate-wasmops-header.js: Removed.
1561
1562 2016-10-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1563
1564         [JSC] JSON.stringify should handle Proxy which is non JSArray but isArray is true
1565         https://bugs.webkit.org/show_bug.cgi?id=164123
1566
1567         Reviewed by Mark Lam.
1568
1569         * stress/json-stringify-with-non-jsarray-array.js: Added.
1570         (shouldBe):
1571         (shouldBe.JSON.stringify.new.Proxy):
1572
1573 2016-10-29  Saam Barati  <sbarati@apple.com>
1574
1575         We should have a way of profiling when a get_by_id is pure and to emit a PureGetById in the DFG/FTL
1576         https://bugs.webkit.org/show_bug.cgi?id=163305
1577
1578         Reviewed by Keith Miller.
1579
1580         * microbenchmarks/pure-get-by-id-cse-2.js: Added.
1581         (foo):
1582         * microbenchmarks/pure-get-by-id-cse.js: Added.
1583         (foo):
1584         * stress/pure-get-by-id-cse-correctness.js: Added.
1585         (assert):
1586         (foo):
1587         * stress/pure-get-by-id-on-non-object.js: Added.
1588         (assert):
1589         (foo):
1590
1591 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1592
1593         Skip JSTests/microbenchmarks/dense-set.js on memory limited devices
1594         https://bugs.webkit.org/show_bug.cgi?id=164128
1595
1596         Reviewed by Mark Lam.
1597
1598         * microbenchmarks/dense-set.js:
1599
1600 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1601
1602         [JSC] implement runtime for async functions
1603         https://bugs.webkit.org/show_bug.cgi?id=163760
1604
1605         Reviewed by Yusuke Suzuki.
1606
1607         * stress/async-await-basic.js: Added.
1608         (shouldBe):
1609         (shouldBeAsync):
1610         (shouldThrow):
1611         (shouldThrowAsync):
1612         (shouldThrowSyntaxError):
1613         (let.AsyncFunction.async):
1614         (async.asyncFunctionForProto):
1615         (Object.getPrototypeOf.async):
1616         (Object.getPrototypeOf.async.method):
1617         (async):
1618         (async.method):
1619         (async.asyncNonConstructorDecl):
1620         (shouldThrow.new.async):
1621         (shouldThrow.new.async.nonConstructor):
1622         (async.asyncDecl):
1623         (async.f):
1624         (MyError):
1625         (async.asyncDeclThrower):
1626         (shouldThrowAsync.async):
1627         (resolveLater):
1628         (rejectLater):
1629         (async.resumeAfterNormal):
1630         (O.async.resumeAfterNormal):
1631         (resumeAfterNormalArrow.async):
1632         (async.resumeAfterThrow):
1633         (O.async.resumeAfterThrow):
1634         (resumeAfterThrowArrow.async):
1635         (catch):
1636         * stress/async-await-module-reserved-word.js: Added.
1637         (shouldThrow):
1638         (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
1639         (checkModuleSyntaxError.String.raw.await):
1640         (checkModuleSyntaxError.String.raw.async.await):
1641         (SyntaxError.Cannot.declare.named):
1642         * stress/async-await-mozilla.js: Added.
1643         (shouldBe):
1644         (shouldBeAsync):
1645         (shouldThrow):
1646         (shouldThrowAsync):
1647         (assert):
1648         (shouldThrowSyntaxError):
1649         (mozSemantics.async.empty):
1650         (mozSemantics.async.simpleReturn):
1651         (mozSemantics.async.simpleAwait):
1652         (mozSemantics.async.simpleAwaitAsync):
1653         (mozSemantics.async.returnOtherAsync):
1654         (mozSemantics.async.simpleThrower):
1655         (mozSemantics.async.delegatedThrower):
1656         (mozSemantics.async.tryCatch):
1657         (mozSemantics.async.tryCatchThrow):
1658         (mozSemantics.async.wellFinally):
1659         (mozSemantics.async.finallyMayFail):
1660         (mozSemantics.async.embedded.async.inner):
1661         (mozSemantics.async.embedded):
1662         (mozSemantics.async.fib):
1663         (mozSemantics.async.isOdd.async.isEven):
1664         (mozSemantics.async.isOdd):
1665         (mozSemantics.hardcoreFib.async.fib2):
1666         (mozSemantics.namedAsyncExpr.async.simple):
1667         (mozSemantics.async.executionOrder.async.first):
1668         (mozSemantics.async.executionOrder.async.second):
1669         (mozSemantics.async.executionOrder.async.third):
1670         (mozSemantics.async.executionOrder):
1671         (mozSemantics.async.miscellaneous):
1672         (mozSemantics.thrower):
1673         (mozSemantics.async.defaultArgs):
1674         (mozSemantics.shouldThrow):
1675         (mozSemantics):
1676         (mozMethods.X):
1677         (mozMethods.X.prototype.async.getValue):
1678         (mozMethods.X.prototype.setValue):
1679         (mozMethods.X.prototype.async.increment):
1680         (mozMethods.X.prototype.async.getBaseClassName):
1681         (mozMethods.X.async.getStaticValue):
1682         (mozMethods.Y.prototype.async.getBaseClassName):
1683         (mozMethods.Y):
1684         (mozFunctionNameInferrence.async.test):
1685         (mozSyntaxErrors):
1686         * stress/async-await-reserved-word.js: Added.
1687         (assert):
1688         (shouldThrowSyntaxError):
1689         (AsyncFunction.async):
1690         * stress/async_arrow_functions_lexical_arguments_binding.js: Added.
1691         (shouldBe):
1692         (shouldBeAsync):
1693         (shouldThrowAsync):
1694         (noArgumentsArrow2.async):
1695         * stress/async_arrow_functions_lexical_new.target_binding.js: Added.
1696         (shouldBe):
1697         (shouldBeAsync):
1698         (shouldThrowAsync):
1699         (C1):
1700         (C2):
1701         (shouldThrowAsync.async):
1702         * stress/async_arrow_functions_lexical_super_binding.js: Added.
1703         (shouldBe):
1704         (shouldBeAsync):
1705         (BaseClass.prototype.baseClassValue):
1706         (BaseClass.prototype.get property):
1707         (BaseClass):
1708         (ChildClass.prototype.asyncSuperProp):
1709         (ChildClass.prototype.asyncSuperProp2):
1710         (ChildClass):
1711         (ChildClass2):
1712         * stress/async_arrow_functions_lexical_this_binding.js: Added.
1713         (shouldBe):
1714         (shouldBeAsync):
1715         (d.y):
1716
1717 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1718
1719         Skip 2 JS stress tests on memory limited devices
1720         https://bugs.webkit.org/show_bug.cgi?id=164125
1721
1722         Unreviewed quick fix to unbreak JSCOnly ARM bots as soon as possible.
1723
1724         * stress/joined-strings-should-not-exceed-max-string-length.js:
1725         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1726
1727 2016-10-27  Caitlin Potter  <caitp@igalia.com>
1728
1729         [JSC] forbid lexical redeclaration of generator formal parameters
1730         https://bugs.webkit.org/show_bug.cgi?id=163930
1731
1732         Reviewed by Yusuke Suzuki.
1733
1734         * stress/async-await-syntax.js:
1735         * stress/generator-syntax.js:
1736         (testSyntaxError.gen):
1737         (testSyntaxError.arguments):
1738         (testSyntaxError.eval):
1739         * test262.yaml:
1740
1741 2016-10-26  JF Bastien  <jfbastien@apple.com>
1742
1743         WebAssembly API: implement Instance
1744
1745         As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-objects
1746
1747          - Take ownership of Wasm::Plan's compilation result when successfully creating a JSWebAssemblyModule object.
1748          - Construct a basic Instance with a Module.
1749          - Handle second argument (importObject) of WebAssembly.Instance.
1750          - Add reference text from the spec to WebAssembly.Module's code.
1751          - Expose and test an empty 'exports' ModuleNamespaceObject on WebAssembly.Instance.
1752
1753         The implementation isn't complete yet: it relies on further work for which I've filed bugs.
1754
1755         WebAssembly API: implement Instance
1756         https://bugs.webkit.org/show_bug.cgi?id=163998
1757
1758         Reviewed by Keith Miller.
1759
1760         * wasm/js-api/test_Instance.js: Added.
1761         (EmptyModule): use the Builder, create the simplest Module possible, and create an Instance from it
1762         * wasm/js-api/test_basic_api.js:
1763         (const.c.in.constructorProperties.switch): basic tests of the API
1764
1765 2016-10-26  Mark Lam  <mark.lam@apple.com>
1766
1767         JSGenericTypedArrayView::set() should check for exceptions.
1768         https://bugs.webkit.org/show_bug.cgi?id=164007
1769         <rdar://problem/28853775>
1770
1771         Reviewed by Filip Pizlo.
1772
1773         * stress/typed-array-view-set-should-not-crash-on-exception.js: Added.
1774
1775 2016-10-25  Mark Lam  <mark.lam@apple.com>
1776
1777         String.prototype.replace() should throw an OutOfMemoryError when using too much memory.
1778         https://bugs.webkit.org/show_bug.cgi?id=163996
1779         <rdar://problem/28263117>
1780
1781         Reviewed by Geoffrey Garen.
1782
1783         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: Added.
1784
1785 2016-10-25  Mark Lam  <mark.lam@apple.com>
1786
1787         JSStringJoiner::joinedLength() should limit joined string lengths to INT_MAX.
1788         https://bugs.webkit.org/show_bug.cgi?id=163937
1789         <rdar://problem/28642990>
1790
1791         Reviewed by Geoffrey Garen.
1792
1793         * stress/joined-strings-should-not-exceed-max-string-length.js: Added.
1794
1795 2016-10-25  JF Bastien  <jfbastien@apple.com>
1796
1797         WebAssembly JS API: simple Module test
1798         https://bugs.webkit.org/show_bug.cgi?id=163963
1799
1800         Reviewed by Filip Pizlo.
1801
1802         * wasm/LowLevelBinary.js:
1803         (export.default.LowLevelBinary.prototype.get return): get the ArrayBuffer
1804         (export.default.LowLevelBinary.prototype.hexdump): Deleted.
1805         (export.default.LowLevelBinary.prototype._maybeGrow): Deleted.
1806         * wasm/js-api/test_Module.js: Added.
1807         (EmptyModule): The most basic module possible
1808
1809 2016-10-25  JF Bastien  <jfbastien@apple.com>
1810
1811         WebAssembly JS API: implement Module
1812
1813         This implementation allows us to:
1814          - Syncrhonously create a WebAssembly.Module with a typed array.
1815          - Creates a compilation plan.
1816          - Parse the Module and creates corresponding code.
1817          - Throw WebAssembly.CompileError with mildly helpful [*] error messages on
1818            failure.
1819
1820         Consult the API documentation for expected behavior: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodule-constructor
1821
1822         For now the implementation discards the generated code.
1823
1824         The next steps will be:
1825          - Expose a Module's exports.
1826          - Implement WebAssembly.Instance, which allows instantiating and running a
1827            compiled Module.
1828          - Beef up the testing infrastructure under JSTests/wasm so that more complex
1829            modules can be created and tested (instead of writing the bits by hand).
1830
1831         This patch also:
1832          - Adds assert.instanceof in assert.js.
1833          - Refactors Wasm::Parser and friends to accept const uint8_t* as well as a
1834            Vector, to avoid copying when invoked synchronously.
1835          - Remove useless Structure from some of the wasm constructors: they're already
1836            on the JSGlobalObject, visited properly and all.
1837          - Fix off-by-one error in parsing: Parser::parseUInt32 failed if the integer
1838            was exactly at end of file.
1839
1840          [*] On error messages while parsing: I filed https://bugs.webkit.org/show_bug.cgi?id=163919
1841
1842         WebAssembly JS API: implement Module
1843         https://bugs.webkit.org/show_bug.cgi?id=163903
1844
1845         Reviewed by Keith Miller.
1846
1847         * wasm/assert.js: use underscore in name, and remove when exporting to avoid clasing with builtin names
1848         (const._notUndef):
1849         (const._isUndef):
1850         (const._eq):
1851         (const._ge):
1852         (const._throws):
1853         * wasm/js-api/test_basic_api.js: test the WebAssembly.Module API
1854         (const.c.in.constructorProperties.switch):
1855
1856 2016-10-25  Keith Miller  <keith_miller@apple.com>
1857
1858         Add trivial Wasm conversion opcodes
1859         https://bugs.webkit.org/show_bug.cgi?id=163950
1860
1861         Reviewed by Filip Pizlo.
1862
1863         This patch differentiates between Wasm opcodes that are trivially mapped to a B3 opcode and
1864         those that are not.  Some of the Wasm opcodes that are currently a non-simple opcode will
1865         become simple as we add B3 opcodes for Wasm operations.  The remaining opcodes will need to
1866         be added via patchpoints in a later patch.
1867
1868         * wasm/generate-wasmops-header.js:
1869         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.Wasm.inline.bool.isSimple):
1870         * wasm/wasm.json:
1871
1872 2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1873
1874         Arrow functions with concise bodies cannot return regular expressions
1875         https://bugs.webkit.org/show_bug.cgi?id=163162
1876
1877         Reviewed by Filip Pizlo.
1878
1879         * ChakraCore/test/Operators/instanceof.baseline-jsc:
1880         * ChakraCore/test/Regex/nul_character.baseline-jsc:
1881         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
1882         * stress/parse-regexp-as-token.js: Added.
1883         (shouldBe):
1884
1885 2016-10-24  Keith Miller  <keith_miller@apple.com>
1886
1887         Wasm should support floating point operations.
1888         https://bugs.webkit.org/show_bug.cgi?id=163770
1889
1890         Reviewed by Michael Saboff.
1891
1892         Add appropriate b3op names for floating point wasm bytecodes, where they exist.
1893         Also, fix some WASM => Wasm in WasmOps.h generator script that I missed
1894         the first time I made the change.
1895
1896         * wasm/generate-wasmops-header.js:
1897         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.template.typename.Int.inline.bool.isValidOpType): Deleted.
1898         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.BinaryOpType): Deleted.
1899         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.UnaryOpType): Deleted.
1900         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType): Deleted.
1901         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType): Deleted.
1902         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.undef.CREATE_ENUM_VALUE.inline.bool.isControlOp): Deleted.
1903         * wasm/wasm.json:
1904
1905 2016-10-21  Saam Barati  <sbarati@apple.com>
1906
1907         SpeculativeJIT::compileTryGetById needs to pass in NeedsToSpill along both the cell speculation and untyped speculation path
1908         https://bugs.webkit.org/show_bug.cgi?id=163622
1909
1910         Reviewed by Yusuke Suzuki.
1911
1912         * stress/try-get-by-id-should-spill-registers-dfg.js: Added.
1913         (let.f.createBuiltin):
1914
1915 2016-10-21  Caitlin Potter  <caitp@igalia.com>
1916
1917         [JSC] don't crash when arguments to `new Function()` produce unexpected AST
1918         https://bugs.webkit.org/show_bug.cgi?id=163748
1919
1920         Reviewed by Mark Lam.
1921
1922         * stress/regress-163748.js: Added.
1923         (assert):
1924         (shouldThrowSyntaxError):
1925         (GeneratorFunction):
1926
1927 2016-10-20  Keith Miller  <keith_miller@apple.com>
1928
1929         Add support for WASM calls
1930         https://bugs.webkit.org/show_bug.cgi?id=161727
1931
1932         Reviewed by Filip Pizlo and Michael Saboff.
1933
1934         Add members of the Call category to the WASMOps special group.
1935
1936         * wasm/generate-wasmops-header.js:
1937
1938 2016-10-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1939
1940         [JSC] Drop isEnvironmentRecord type info flag and use JSType information instead
1941         https://bugs.webkit.org/show_bug.cgi?id=163761
1942
1943         Reviewed by Keith Miller.
1944
1945         * modules/string-prototype-module-scope.js: Added.
1946         (shouldBe):
1947         (catch):
1948         (refer):
1949         * stress/string-prototype-scopes-global-lexical-environment-strict.js: Added.
1950         (shouldBe):
1951         (catch):
1952         * stress/string-prototype-scopes-global-lexical-environment.js: Added.
1953         (shouldBe):
1954         (catch):
1955         * stress/string-prototype-scopes-strict.js: Added.
1956         (shouldBe):
1957         (catch):
1958         (try.refer):
1959         (refer):
1960         * stress/string-prototype-scopes.js: Added.
1961         (shouldBe):
1962         (catch):
1963         (try.refer):
1964         (refer):
1965         (object.toString):
1966         (with):
1967
1968 2016-10-20  JF Bastien  <jfbastien@apple.com>
1969
1970         WebAssembly API: implement exception constructors properly
1971
1972          - Rename WebAssemblyObject to JSWebAssembly for consistency.
1973          - WebAssembly object now has its own prototype: add WebAssemblyPrototype, and
1974            use it to register JSWebAssembly's function properties through auto-generated
1975            .lut.h, instead of manually.
1976          - The error constructors used to throw (e.g. `new WebAssembly.CompileError()`).
1977          - Register WebAssembly's constructors from the global object, and hold a
1978            reference to their structure and prototype so that invoking the constructor
1979            can use the structure directly from the global object.
1980          - Add a prototype base field to global object creation. Previous ones all had
1981            Object's prototype as their base, but WebAssembly's error constructors have
1982            Error as their base.
1983          - Test for the error object's correctness.
1984          - Add missing #if ENABLE(WEBASSEMBLY)
1985
1986         WebAssembly API: implement exception constructors properly
1987         https://bugs.webkit.org/show_bug.cgi?id=163699
1988
1989         Reviewed by Keith Miller.
1990
1991         * wasm/js-api/test_basic_api.js:
1992         (const.c.in.constructorProperties): more tests
1993
1994 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1995
1996         [JSC] disallow references to `await` in AsyncFunction formal parameters
1997         https://bugs.webkit.org/show_bug.cgi?id=163694
1998
1999         Reviewed by Saam Barati.
2000
2001         * stress/async-await-syntax.js:
2002
2003 2016-10-20  Keith Miller  <keith_miller@apple.com>
2004
2005         Invalid assertion in arguments elimination
2006         https://bugs.webkit.org/show_bug.cgi?id=163740
2007         <rdar://problem/27911462>
2008
2009         Reviewed by Michael Saboff.
2010
2011         * stress/direct-arguments-osr-entry.js: Added.
2012         (foo.):
2013         (foo):
2014
2015 2016-10-20  Caitlin Potter  <caitp@igalia.com>
2016
2017         [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
2018         https://bugs.webkit.org/show_bug.cgi?id=163714
2019
2020         Reviewed by Mark Lam.
2021
2022         Add missing test coverage that dynamically created
2023         JSGeneratorFunctions can not be constructed.
2024
2025         * stress/generator-function-constructor.js:
2026         (shouldThrow):
2027
2028 2016-10-19  JF Bastien  <jfbastien@apple.com>
2029
2030         JavaScript WebAssembly API: baby steps
2031
2032          - Expand WebAssembly constructors into their own files. This requires a lot of
2033            boilerplate, as well as adding the .lut.h files. All of the
2034            JSWebAssembly*.{h,cpp}, as well as Constructor and Prototype files, are
2035            currently the same between the 4 specified WebAssembly constructors. It'll be
2036            easy to implement individual functions on constructed objects as per the
2037            spec, and have each of these files diverge. The error constructors are also
2038            similar, except that their instance derives from ErrorInstance.
2039          - Use constructor macro when initializing the global object.
2040          - Dramatically improve testing of the WebAssembly API by checking for
2041            properties specified in the spec [*].
2042          - Clean up assert.js' exception testing.
2043          - Fix a copy-paste bug in wasm.json: floating-point const return values were
2044            swapped.
2045
2046         [*] https://github.com/WebAssembly/design/blob/master/JS.md
2047
2048         Implement more of the JavaScript WebAssembly API
2049         https://bugs.webkit.org/show_bug.cgi?id=163571
2050
2051         Reviewed by Keith Miller.
2052
2053         * wasm/assert.js:
2054         (export.const.isUndef): add this useful helper
2055         (export.const.throws): fold other throw checks into this one, and check message as well
2056         * wasm/js-api/test_basic_api.js:
2057         (const.checkOwnPropertyDescriptor): check own property descriptor follows the spec
2058         * wasm/self-test/test_BuilderJSON.js:
2059         (const.assertOpThrows): use new assert API
2060         (CheckedOpcodeArgumentsTooMany): ditto
2061         (CheckedOpcodeArgumentsNotEnough): ditto
2062         (CallInvalid): ditto
2063         (I32ConstInvalid): ditto
2064         (F32ConstInvalid): ditto (and this caugth the JSON copy-paste bug)
2065         (F64ConstInvalid): ditto
2066         * wasm/self-test/test_LowLevelBinary_varint.js: use new assert API
2067         * wasm/self-test/test_LowLevelBinary_varuint.js: use new assert API
2068         * wasm/utilities.js: add "global" object, used in basic API test (to access global.WebAssembly).
2069         * wasm/wasm.json: fix copy-paste
2070
2071 2016-10-19  Caitlin Potter  <caitp@igalia.com>
2072
2073         [JSC] forbid "use strict" directive in generator functions with non-simple parameters
2074         https://bugs.webkit.org/show_bug.cgi?id=163683
2075
2076         Reviewed by Geoffrey Garen.
2077
2078         Update various generator*-non-simple-param.js tests to be passing.
2079
2080         * test262.yaml:
2081
2082 2016-10-18  Mark Lam  <mark.lam@apple.com>
2083
2084         Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
2085         https://bugs.webkit.org/show_bug.cgi?id=154377
2086         <rdar://problem/27330808>
2087
2088         Reviewed by Filip Pizlo and Saam Barati.
2089
2090         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.
2091
2092 2016-10-18  Keith Miller  <keith_miller@apple.com>
2093
2094         GetByVal to GetById conversion in the DFG is incorrect for getters with control flow
2095         https://bugs.webkit.org/show_bug.cgi?id=163629
2096
2097         Reviewed by Yusuke Suzuki.
2098
2099         * stress/get-by-val-to-id-with-getter.js: Added.
2100         (foo):
2101         (o.get hello):
2102
2103 2016-10-15  Filip Pizlo  <fpizlo@apple.com>
2104
2105         DFG and FTL should be able to use DirectCall ICs when they proved the callee or its executable
2106         https://bugs.webkit.org/show_bug.cgi?id=163371
2107
2108         Reviewed by Geoffrey Garen and Saam Barati.
2109         
2110         Add microbenchmarks for all of the cases that this patch optimizes.
2111
2112         * microbenchmarks/direct-call-arity-mismatch.js: Added.
2113         (foo):
2114         (bar):
2115         * microbenchmarks/direct-call.js: Added.
2116         (foo):
2117         (bar):
2118         * microbenchmarks/direct-construct-arity-mismatch.js: Added.
2119         (Foo):
2120         (bar):
2121         * microbenchmarks/direct-construct.js: Added.
2122         (Foo):
2123         (bar):
2124         * microbenchmarks/direct-tail-call-arity-mismatch.js: Added.
2125         (foo):
2126         (bar):
2127         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js: Added.
2128         (foo):
2129         (bar):
2130         (baz):
2131         * microbenchmarks/direct-tail-call-inlined-caller.js: Added.
2132         (foo):
2133         (bar):
2134         (baz):
2135         * microbenchmarks/direct-tail-call.js: Added.
2136         (foo):
2137         (bar):
2138
2139 2016-10-18  Caitlin Potter  <caitp@igalia.com>
2140
2141         [JSC] ES6 Method functions should not have prototype
2142         https://bugs.webkit.org/show_bug.cgi?id=162530
2143
2144         Reviewed by Saam Barati.
2145
2146         Fix test262 expectations about MethodDefinitions
2147
2148         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
2149         * stress/reflect-set.js:
2150         * test262.yaml:
2151
2152 2016-10-17  Keith Miller  <keith_miller@apple.com>
2153
2154         Add support for WASM Memory.
2155         https://bugs.webkit.org/show_bug.cgi?id=161710
2156
2157         Reviewed by Geoffrey Garen.
2158
2159         Add store and load opcodes to wasm.json. Additionally, add new
2160         enums for those opcodes in the generator.
2161
2162         * stress/wasm/generate-wasmops-header.js:
2163         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType):
2164         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType):
2165
2166 2016-10-17  Saam Barati  <sbarati@apple.com>
2167
2168         Add more tests for the double->String conversion in ValueAdd constant folding
2169         https://bugs.webkit.org/show_bug.cgi?id=163517
2170
2171         Reviewed by Yusuke Suzuki.
2172
2173         * microbenchmarks/string-add-constant-folding.js:
2174         (test):
2175
2176 2016-10-17  JF Bastien  <jfbastien@apple.com>
2177
2178         WebAssembly JS API: implement basic stub
2179
2180         Implement the global WebAssembly JavaScript object, and its constructor +
2181         function properties as described in:
2182           https://github.com/WebAssembly/design/blob/master/JS.md
2183
2184         These don't do anything at the moment, the parent bug will take care of adding
2185         more functionality and associated tests.
2186
2187         WebAssembly JS API: implement basic stub
2188         https://bugs.webkit.org/show_bug.cgi?id=163404
2189
2190         Reviewed by Keith Miller.
2191
2192         * wasm.yaml:
2193         * wasm/js-api/test_basic_api.js: Added.
2194         (const.f.of.functionProperties.WebAssembly.f.undefined.throw.new.Error.Couldn.const.c.of.constructorProperties.WebAssembly.c.undefined.throw.new.Error.Couldn):
2195         (const.c.of.constructorProperties.catch):
2196
2197 2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2198
2199         [DOMJIT] Use DOMJIT::Patchpoint in IC
2200         https://bugs.webkit.org/show_bug.cgi?id=163223
2201
2202         Reviewed by Saam Barati.
2203
2204         * stress/domjit-exception-ic.js: Added.
2205         (shouldBe):
2206         (access):
2207         * stress/domjit-exception.js: Added.
2208         (shouldBe):
2209         (access):
2210         * stress/domjit-getter-complex-with-incorrect-object.js: Added.
2211         (shouldThrow):
2212         (access):
2213         (i.shouldThrow):
2214         * stress/domjit-getter-complex.js: Added.
2215         (shouldBe):
2216         (access):
2217         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js: Added.
2218         (assert):
2219         (bar):
2220         (foo):
2221
2222 2016-10-15  Saam Barati  <sbarati@apple.com>
2223
2224         Assertion failed under operationToLowerCase with a rope with zero length
2225         https://bugs.webkit.org/show_bug.cgi?id=163314
2226
2227         Reviewed by Mark Lam.
2228
2229         * stress/to-lower-case-intrinsic-on-empty-rope.js: Added.
2230         (assert):
2231         (returnRope.helper):
2232         (returnRope):
2233         (lower):
2234
2235 2016-10-14  Benjamin Poulain  <bpoulain@apple.com>
2236
2237         [JSC] op_negate should with any type
2238         https://bugs.webkit.org/show_bug.cgi?id=162587
2239
2240         Reviewed by Saam Barati.
2241
2242         * stress/arith-abs-to-arith-negate-range-optimizaton.js: Added.
2243         Cover OSR Exits when converting Math.abs() into ArithNegate.
2244
2245         * stress/arith-negate-on-various-types.js: Added.
2246         Cover ArithNegate with all types.
2247
2248 2016-10-14  JF Bastien  <jfbastien@apple.com>
2249
2250         Basic WebAssembly testing
2251
2252         Create a small DSL in JavaScript which can build WebAssembly binary modules based on the JSON description of the format as described in:
2253         https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md
2254
2255         This DSL can then be used to write small text description of valid and invalid WebAssembly binaries, making testing the JSC implementation much easier.
2256
2257         Details and example in README.md.
2258
2259         Basic WebAssembly testing
2260         https://bugs.webkit.org/show_bug.cgi?id=163267
2261
2262         Reviewed by Keith Miller.
2263
2264         * stress/wasm/wasm.json: Removed.
2265         * wasm.yaml: Added.
2266         * wasm/Builder.js: Added.
2267         (const._isValidValue):
2268         (const._BuildWebAssemblyBinary):
2269         (export.default.Builder):
2270         (export.default.Builder.prototype.setChecked):
2271         (export.default.Builder.prototype.setPreamble):
2272         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2273         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
2274         (export.default.Builder.prototype._registerSectionBuilders):
2275         (export.default.Builder.prototype._addSection):
2276         (export.default.Builder.prototype.optimize):
2277         (export.default.Builder.prototype.json):
2278         (export.default.Builder.prototype.AsmJS):
2279         (export.default.Builder.prototype.WebAssembly):
2280         * wasm/LowLevelBinary.js: Added.
2281         (const._getterRangeCheck):
2282         (const._hexdump):
2283         (export.default.LowLevelBinary):
2284         (export.default.LowLevelBinary.prototype.newPatchable):
2285         (export.default.LowLevelBinary.prototype.hexdump):
2286         (export.default.LowLevelBinary.prototype._maybeGrow):
2287         (export.default.LowLevelBinary.prototype._push8):
2288         (export.default.LowLevelBinary.prototype.uint8):
2289         (export.default.LowLevelBinary.prototype.uint16):
2290         (export.default.LowLevelBinary.prototype.uint32):
2291         (export.default.LowLevelBinary.prototype.varuint):
2292         (export.default.LowLevelBinary.prototype.varint):
2293         (export.default.LowLevelBinary.prototype.varuint7):
2294         (export.default.LowLevelBinary.prototype.string):
2295         (export.default.LowLevelBinary.prototype.getSize):
2296         (export.default.LowLevelBinary.prototype.getUint8):
2297         (export.default.LowLevelBinary.prototype.getUint16):
2298         (export.default.LowLevelBinary.prototype.getUint32):
2299         (export.default.LowLevelBinary.prototype.getVaruint):
2300         (export.default.LowLevelBinary.prototype.getVarint):
2301         (export.default.LowLevelBinary.prototype.getVaruint7):
2302         (export.default.LowLevelBinary.prototype.getString):
2303         (PatchableLowLevelBinary):
2304         (PatchableLowLevelBinary.prototype._push8):
2305         (PatchableLowLevelBinary.prototype.apply):
2306         * wasm/README.md: Added.
2307         * wasm/WASM.js: Added.
2308         * wasm/assert.js: Added.
2309         (export.const.notUndef):
2310         (export.const.eq):
2311         (export.const.ge):
2312         (export.const.throwsError):
2313         (export.const.throwsRangeError):
2314         * wasm/generate-wasmops-header.js: Renamed from JSTests/stress/wasm/generate-wasmops-header.js.
2315         * wasm/self-test/test_BuilderJSON.js: Added.
2316         (const.assertOpThrows):
2317         (EmptyModule):
2318         (CustomMagicNumber):
2319         (CustomVersion):
2320         (CustomSection):
2321         (CustomSectionAllBytes):
2322         (CustomSectionInvalidByte):
2323         (TwoCustomSections):
2324         (EmptyCodeSection):
2325         (CodeSectionWithEmptyFunction):
2326         (CodeSectionWithEmptyFunctionWithParameters):
2327         (InvalidFunctionParameters):
2328         (SimpleFunction):
2329         (TwoSimpleFunctions):
2330         (TwoBuildersAtTheSameTime):
2331         (CheckedOpcodeArgumentsTooMany):
2332         (CheckedOpcodeArgumentsNotEnough):
2333         (CallNoArguments):
2334         (CallInvalid):
2335         (I32ConstInvalid):
2336         (F32ConstInvalid):
2337         (F64ConstInvalid):
2338         (CallManyFromStack):
2339         (OpcodeAdd):
2340         (OpcodeUnreachable):
2341         (OpcodeUnreachableCombinations):
2342         (OpcodeSelect):
2343         * wasm/self-test/test_BuilderWebAssembly.js: Added.
2344         (EmptyModule):
2345         (CustomSection):
2346         (Basic):
2347         * wasm/self-test/test_LowLevelBinary_encode.js: Added.
2348         * wasm/self-test/test_LowLevelBinary_string.js: Added.
2349         * wasm/self-test/test_LowLevelBinary_uint16.js: Added.
2350         * wasm/self-test/test_LowLevelBinary_uint32.js: Added.
2351         * wasm/self-test/test_LowLevelBinary_uint8.js: Added.
2352         * wasm/self-test/test_LowLevelBinary_varint.js: Added.
2353         * wasm/self-test/test_LowLevelBinary_varuint.js: Added.
2354         * wasm/self-test/test_LowLevelBinary_varuint7.js: Added.
2355         * wasm/self-test/test_WASM.js: Added.
2356         * wasm/test.sh: Added.
2357         * wasm/utilities.js: Added.
2358         (const._read.filename.switch):
2359         (const._load.filename.switch):
2360         (const._json.filename.switch):
2361         * wasm/wasm.json: Added.
2362
2363 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2364
2365         test262: @isConstructor incorrectly thinks Math.cos is a constructor
2366         https://bugs.webkit.org/show_bug.cgi?id=163437
2367
2368         Reviewed by Saam Barati.
2369
2370         * stress/is-constructor.js: Added.
2371         (assert):
2372         (prototype.assert):
2373         New test to cover the @isConstructor builtin.
2374
2375         * test262.yaml:
2376         Test now passes.
2377
2378 2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
2379
2380         Unreviewed, rolling out r207322.
2381
2382         This change caused JSC test failures
2383
2384         Reverted changeset:
2385
2386         "Fix Array.prototype.splice ES6 compliance."
2387         https://bugs.webkit.org/show_bug.cgi?id=163372
2388         http://trac.webkit.org/changeset/207322
2389
2390 2016-10-14  Mark Lam  <mark.lam@apple.com>
2391
2392         JSON.parse should not modify frozen objects.
2393         https://bugs.webkit.org/show_bug.cgi?id=163430
2394
2395         Reviewed by Saam Barati.
2396
2397         * stress/json-parse-on-frozen-object.js: Added.
2398
2399 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2400
2401         test262: Failure with RegExp.prototype.compile when pattern is undefined
2402         https://bugs.webkit.org/show_bug.cgi?id=163431
2403
2404         Reviewed by Yusuke Suzuki.
2405
2406         * test262.yaml:
2407
2408 2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
2409
2410         Exception message for expressions with multiple bracket accesses is inconsistent / incorrect
2411         https://bugs.webkit.org/show_bug.cgi?id=163426
2412
2413         Reviewed by Geoffrey Garen.
2414
2415         * ChakraCore/test/Error/CallNonFunction_3.baseline-jsc:
2416         * ChakraCore/test/Object/null.baseline-jsc:
2417         * stress/exception-in-to-property-key-should-be-handled-early.js:
2418         Better exception messages.
2419
2420 2016-10-13  Mark Lam  <mark.lam@apple.com>
2421
2422         Fix Array.prototype.splice ES6 compliance.
2423         https://bugs.webkit.org/show_bug.cgi?id=163372
2424
2425         Reviewed by Geoffrey Garen and Yusuke Suzuki.
2426
2427         * stress/array-splice-on-frozen-object.js: Added.
2428
2429 2016-10-12  Keith Miller  <keith_miller@apple.com>
2430
2431         Handle non-function, non-undefined comparator in Array.prototype.sort
2432         https://bugs.webkit.org/show_bug.cgi?id=163085
2433
2434         Reviewed by Yusuke Suzuki.
2435
2436         * ChakraCore/test/Array/array_sort.baseline-jsc:
2437         * stress/array-sort-bad-comparator.js: Added.
2438         (test):
2439
2440 2016-10-12  Mark Lam  <mark.lam@apple.com>
2441
2442         Array.prototype.slice should not modify frozen objects.
2443         https://bugs.webkit.org/show_bug.cgi?id=163338
2444
2445         Reviewed by Filip Pizlo.
2446
2447         * stress/array-slice-on-frozen-object.js: Added.
2448
2449 2016-10-11  Mark Lam  <mark.lam@apple.com>
2450
2451         Array.prototype.concat should not modify frozen objects.
2452         https://bugs.webkit.org/show_bug.cgi?id=163302
2453
2454         Reviewed by Filip Pizlo.
2455
2456         * stress/array-concat-on-frozen-object.js: Added.
2457
2458 2016-10-11  Saam Barati  <sbarati@apple.com>
2459
2460         ValueAdd should be constant folded if the operands are constant String,Primitive or Primitive,String
2461         https://bugs.webkit.org/show_bug.cgi?id=163182
2462
2463         Reviewed by Filip Pizlo.
2464
2465         * microbenchmarks/string-add-constant-folding.js: Added.
2466         (assert):
2467         (runTests):
2468         (add):
2469         (test):
2470
2471 2016-10-07  Mark Lam  <mark.lam@apple.com>
2472
2473         Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
2474         https://bugs.webkit.org/show_bug.cgi?id=163160
2475
2476         Reviewed by Saam Barati.
2477
2478         * stress/object-freeze-with-proxy-preventExtensions.js: Added.
2479         * stress/object-seal-with-proxy-preventExtensions.js: Added.
2480
2481 2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2482
2483         [DOMJIT] Add initial CheckDOM and CallDOM implementations
2484         https://bugs.webkit.org/show_bug.cgi?id=162941
2485
2486         Reviewed by Filip Pizlo.
2487
2488         * stress/domjit-getter-poly.js: Added.
2489         (shouldBe):
2490         (access):
2491         * stress/domjit-getter-proto.js: Added.
2492         (shouldBe):
2493         (access):
2494         * stress/domjit-getter-super-poly.js: Added.
2495         (shouldBe):
2496         (access):
2497         * stress/domjit-getter.js: Added.
2498         (shouldBe):
2499         (access):
2500
2501 2016-10-04  Saam Barati  <sbarati@apple.com>
2502
2503         String.prototype.toLowerCase should be a DFG/FTL intrinsic
2504         https://bugs.webkit.org/show_bug.cgi?id=162887
2505
2506         Reviewed by Filip Pizlo and Yusuke Suzuki.
2507
2508         * microbenchmarks/to-lower-case.js: Added.
2509         (assert):
2510         (foo):
2511         (bar):
2512         * stress/to-lower-case.js: Added.
2513         (assert):
2514         (foo):
2515
2516 2016-10-04  JF Bastien  <jfbastien@apple.com>
2517
2518         WebAssembly: handle a few corner cases
2519         https://bugs.webkit.org/show_bug.cgi?id=162884
2520
2521         Reviewed by Keith Miller.
2522
2523         * stress/wasm/generate-wasmops-header.js:
2524         (const.opcodeIterator): max opcode value
2525
2526 2016-10-03  JF Bastien  <jfbastien@apple.com>
2527
2528         Auto-generate WASMOps.h, share with testing JSON file
2529         https://bugs.webkit.org/show_bug.cgi?id=162870
2530
2531         Reviewed by Keith Miller.
2532
2533         * stress/wasm/to-c++.js: Added. Generates WASMOps.h, siilar to the current one but with more data.
2534         (const.opcode_iterator):
2535         (opcode_macroizer):
2536         * stress/wasm/wasm.json: Added. Data from 0xC binary format version.
2537
2538 2016-10-03  Saam Barati  <sbarati@apple.com>
2539
2540         MapHash should speculate on the type of its child node
2541         https://bugs.webkit.org/show_bug.cgi?id=161922
2542
2543         Reviewed by Filip Pizlo.
2544
2545         * microbenchmarks/map-key-well-typed.js: Added.
2546         (assert):
2547         (intKey):
2548         (doubleKey):
2549         (objectKey):
2550         (stringKey):
2551         (booleanKey):
2552         (symbolKey):
2553         (cellKey):
2554         (assert.doubleKey):
2555         (assert.booleanKey):
2556
2557 2016-10-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2558
2559         [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
2560         https://bugs.webkit.org/show_bug.cgi?id=162849
2561
2562         Reviewed by Geoffrey Garen.
2563
2564         * test262.yaml:
2565
2566 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2567
2568         [ES6] Align attributes of Generator related properties to spec
2569         https://bugs.webkit.org/show_bug.cgi?id=162839
2570
2571         Reviewed by Saam Barati.
2572
2573         * test262.yaml:
2574
2575 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2576
2577         [ES6] GeneratorFunction constructor should instantiate generator function
2578         https://bugs.webkit.org/show_bug.cgi?id=162838
2579
2580         Reviewed by Saam Barati.
2581
2582         * stress/generator-function-constructor-is-subclassible.js: Added.
2583         (shouldBe):
2584         (GeneratorFunction):
2585         (prototype.hello):
2586         * stress/generator-function-constructor.js:
2587         * test262.yaml:
2588
2589 2016-09-30  Saam Barati  <sbarati@apple.com>
2590
2591         Arrow functions should not allow duplicate parameter names
2592         https://bugs.webkit.org/show_bug.cgi?id=162741
2593
2594         Reviewed by Filip Pizlo.
2595
2596         * test262.yaml:
2597
2598 2016-09-30  Saam Barati  <sbarati@apple.com>
2599
2600         Make some microbenchmarks run for less time.
2601
2602         Rubber stamped by Filip Pizlo.
2603
2604         * microbenchmarks/bound-function-construction-performance.js:
2605         (foo):
2606         * microbenchmarks/getter-richards-try-catch.js:
2607
2608 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2609
2610         Arrow functions do not infer name from computed property but normal functions do
2611         https://bugs.webkit.org/show_bug.cgi?id=162720
2612
2613         Reviewed by Saam Barati.
2614
2615         * stress/inferred-names.js:
2616
2617 2016-09-29  Mark Lam  <mark.lam@apple.com>
2618
2619         Break some slow running tests into smaller bits so they don't time out.
2620         https://bugs.webkit.org/show_bug.cgi?id=162743
2621
2622         Reviewed by Keith Miller.
2623
2624         The following tests have shown to be slow running:
2625             op_div.js
2626             op_lshift.js
2627             op_mod.js
2628             op_mul.js
2629             op_rshift.js
2630             op_sub.js
2631             op_urshift
2632
2633         These tests auto-generate permutations of values to apply to binary operations.
2634         They also test the operations with 3 permutations of value types:
2635             1. VarVar - both operands variables
2636             2. VarConst - variable operand 1, constant / literal operand 2
2637             3. ConstVar - constant / literal operand 1, variable operand 2
2638
2639         We can prevent these tests from timing out by breaking each up to only run 1 of
2640         the 3 permutations of value types.
2641
2642         * stress/op_div-ConstVar.js: Added.
2643         * stress/op_div-VarConst.js: Added.
2644         * stress/op_div-VarVar.js: Copied from JSTests/stress/op_div.js.
2645         (o1.valueOf): Deleted.
2646         * stress/op_div.js: Removed.
2647         * stress/op_lshift-ConstVar.js: Added.
2648         * stress/op_lshift-VarConst.js: Added.
2649         * stress/op_lshift-VarVar.js: Copied from JSTests/stress/op_lshift.js.
2650         (o1.valueOf): Deleted.
2651         * stress/op_lshift.js: Removed.
2652         * stress/op_mod-ConstVar.js: Added.
2653         * stress/op_mod-VarConst.js: Added.
2654         * stress/op_mod-VarVar.js: Copied from JSTests/stress/op_mod.js.
2655         (o1.valueOf): Deleted.
2656         * stress/op_mod.js: Removed.
2657         * stress/op_mul-ConstVar.js: Added.
2658         * stress/op_mul-VarConst.js: Added.
2659         * stress/op_mul-VarVar.js: Copied from JSTests/stress/op_mul.js.
2660         (o1.valueOf): Deleted.
2661         * stress/op_mul.js: Removed.
2662         * stress/op_rshift-ConstVar.js: Added.
2663         * stress/op_rshift-VarConst.js: Added.
2664         * stress/op_rshift-VarVar.js: Copied from JSTests/stress/op_rshift.js.
2665         (o1.valueOf): Deleted.
2666         * stress/op_rshift.js: Removed.
2667         * stress/op_sub-ConstVar.js: Added.
2668         * stress/op_sub-VarConst.js: Added.
2669         * stress/op_sub-VarVar.js: Copied from JSTests/stress/op_sub.js.
2670         (o1.valueOf): Deleted.
2671         * stress/op_sub.js: Removed.
2672         * stress/op_urshift-ConstVar.js: Added.
2673         * stress/op_urshift-VarConst.js: Added.
2674         * stress/op_urshift-VarVar.js: Copied from JSTests/stress/op_urshift.js.
2675         (o1.valueOf): Deleted.
2676         * stress/op_urshift.js: Removed.
2677         * stress/resources/binary-op-values.js: Added.
2678         (o1.valueOf):
2679
2680 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2681
2682         test262: class and function names should be inferred in assignment
2683         https://bugs.webkit.org/show_bug.cgi?id=146262
2684
2685         Reviewed by Saam Barati.
2686
2687         * stress/arrowfunction-name.js: Added.
2688         Quick tests for arrow function names.
2689
2690         * stress/inferred-names.js: Added.
2691         General test for inferred function names.
2692
2693         * test262.yaml:
2694         Pass many tests checking inferred function names.
2695
2696 2016-09-29  Saam Barati  <sbarati@apple.com>
2697
2698         We don't properly propagate non-simple-parameter-list when parsing a setter
2699         https://bugs.webkit.org/show_bug.cgi?id=160483
2700
2701         Reviewed by Joseph Pecoraro.
2702
2703         * test262.yaml:
2704
2705 2016-09-28  Saam Barati  <sbarati@apple.com>
2706
2707         stringProtoFuncRepeatCharacter will return `null` when it should not
2708         https://bugs.webkit.org/show_bug.cgi?id=161944
2709
2710         Reviewed by Yusuke Suzuki.
2711
2712         * stress/pad-start-calls-repeat-character-with-double.js: Added.
2713         (logLinesWithContext):
2714
2715 2016-09-27  Filip Pizlo  <fpizlo@apple.com>
2716
2717         B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
2718         https://bugs.webkit.org/show_bug.cgi?id=162644
2719
2720         Reviewed by Keith Miller.
2721
2722         * stress/chill-mod-chill-mod.js: Added.
2723         (foo):
2724
2725 2016-09-26  Csaba Osztrogonác  <oszi@inf.u-szeged.hu>
2726
2727         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2728         https://bugs.webkit.org/show_bug.cgi?id=162386
2729
2730         Unreviewed, relanding r206317 after typo fix.
2731
2732         * stress/string-joining-long-strings-should-not-crash.js:
2733
2734 2016-09-24  Caitlin Potter  <caitp@igalia.com>
2735
2736         [JSTests] fix test262 expectations following r206333
2737         https://bugs.webkit.org/show_bug.cgi?id=162533
2738
2739         Reviewed by Yusuke Suzuki.
2740
2741         * test262.yaml:
2742
2743 2016-09-23  Caitlin Potter  <caitp@igalia.com>
2744
2745         [JSC] Implement parsing of Async Functions
2746         https://bugs.webkit.org/show_bug.cgi?id=161409
2747
2748         Reviewed by Yusuke Suzuki.
2749
2750         * stress/async-await-syntax.js: Added.
2751         (testSyntax):
2752         (testSyntaxError):
2753         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2754         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2755         (testTopLevelAsyncAwaitSyntaxStrictMode):
2756         (testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2757         (testNestedAsyncAwaitSyntax.async):
2758         (testNestedAsyncAwaitSyntax.foo):
2759         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2760
2761 2016-09-23  Ryan Haddad  <ryanhaddad@apple.com>
2762
2763         Unreviewed, rolling out r206317.
2764
2765         This change caused timeouts on El Capitan Release JSC tests
2766
2767         Reverted changeset:
2768
2769         "Skip stress/string-joining-long-strings-should-not-crash.js
2770         on memory limited devices"
2771         https://bugs.webkit.org/show_bug.cgi?id=162386
2772         http://trac.webkit.org/changeset/206317
2773
2774 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2775
2776         Skip mozilla-tests.yaml/js1_5/Array/regress-157652 on memory limited devices
2777         https://bugs.webkit.org/show_bug.cgi?id=162381
2778
2779         Reviewed by Mark Lam.
2780
2781         * mozilla/mozilla-tests.yaml:
2782
2783 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2784
2785         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2786         https://bugs.webkit.org/show_bug.cgi?id=162386
2787
2788         Reviewed by Mark Lam.
2789
2790         * stress/string-joining-long-strings-should-not-crash.js:
2791
2792 2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
2793
2794         [JSC] Use an inline cache to generate op_negate
2795         https://bugs.webkit.org/show_bug.cgi?id=162371
2796
2797         Reviewed by Saam Barati.
2798
2799         * stress/op-negate-inline-cache.js: Added.
2800
2801 2016-09-22  Mark Lam  <mark.lam@apple.com>
2802
2803         Array.prototype.join should do overflow checks on string joins.
2804         https://bugs.webkit.org/show_bug.cgi?id=162459
2805
2806         Reviewed by Saam Barati.
2807
2808         * stress/array-join-on-strings-need-overflow-checks.js: Added.
2809         (assert):
2810         (catch):
2811
2812 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
2813
2814         test262: Function length should be number of parameters before parameters with default values
2815         https://bugs.webkit.org/show_bug.cgi?id=162377
2816
2817         Reviewed by Saam Barati.
2818
2819         * stress/es6-default-parameters.js:
2820         Add our own tests for function lengths with default parameters.
2821
2822         * test262.yaml:
2823         We now pass all dflt-length tests.
2824
2825 2016-09-20  Benjamin Poulain  <bpoulain@apple.com>
2826
2827         [JSC] Do not use EagerRun on tests counting recompilation
2828         https://bugs.webkit.org/show_bug.cgi?id=162248
2829
2830         Reviewed by Geoffrey Garen.
2831
2832         This patch adds defaultNoEagerRun to all the tests
2833         for which recompilation is the symptom of a bug.
2834         The reason is that an OSR Exit can be unrelated to the tested
2835         nodes when we are running in Eager mode.
2836
2837         * stress/arith-abs-on-various-types.js:
2838         * stress/arith-ceil-on-various-types.js:
2839         * stress/arith-clz32-on-various-types.js:
2840         * stress/arith-cos-on-various-types.js:
2841         * stress/arith-floor-on-various-types.js:
2842         * stress/arith-fround-on-various-types.js:
2843         * stress/arith-log-on-various-types.js:
2844         * stress/arith-round-on-various-types.js:
2845         * stress/arith-sin-on-various-types.js:
2846         * stress/arith-sqrt-on-various-types.js:
2847         * stress/arith-tan-on-various-types.js:
2848         * stress/arith-trunc-on-various-types.js:
2849
2850         * stress/compare-strict-eq-on-various-types.js:
2851         (testAllTypesCall):
2852         The value 2 came from the other tests.
2853         CompareStrictEq supports many more cases, the worst case
2854         is bool->int->int52->number->polymorphic.
2855
2856 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
2857
2858         Make MarkedBlock state tracking support overlapped allocation and marking state
2859         https://bugs.webkit.org/show_bug.cgi?id=161581
2860
2861         Reviewed by Geoffrey Garen.
2862         
2863         Add a microbenchmark for why we want to reclaim empty blocks from other allocators.
2864
2865         * microbenchmarks/switching-size-classes.js: Added.
2866
2867 2016-09-20  Saam Barati  <sbarati@apple.com>
2868
2869         Unreviewed, added test for x86 32-bit failure for HasOwnProperty node in DFG.
2870
2871         * stress/has-own-property-called-on-non-object.js: Added.
2872         (let.objs):
2873         (new.String):
2874         (foo):
2875
2876 2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2877
2878         [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
2879         https://bugs.webkit.org/show_bug.cgi?id=162253
2880
2881         Reviewed by Sam Weinig.
2882
2883         * microbenchmarks/is-symbol-mixed.js: Added.
2884         (isSymbol):
2885         (i.let.pair.of.list.String):
2886         * microbenchmarks/is-symbol.js: Added.
2887         (isSymbol):
2888
2889 2016-09-19  Saam Barati  <sbarati@apple.com>
2890
2891         Make HasOwnProperty faster
2892         https://bugs.webkit.org/show_bug.cgi?id=161708
2893
2894         Reviewed by Geoffrey Garen.
2895
2896         * microbenchmarks/has-own-property-name-cache.js: Added.
2897         (foo):
2898         * stress/has-own-property-cache-basics.js: Added.
2899         (assert):
2900         (foo):
2901         * stress/has-own-property-name-cache-string-keys.js: Added.
2902         (assert):
2903         (foo):
2904         * stress/has-own-property-name-cache-symbol-keys.js: Added.
2905         (assert):
2906         (foo):
2907         * stress/has-own-property-name-cache-symbols-and-strings.js: Added.
2908         (assert):
2909         (foo):
2910
2911 2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
2912
2913         [JSC] Make the rounding-related nodes support any type
2914         https://bugs.webkit.org/show_bug.cgi?id=161895
2915
2916         Reviewed by Geoffrey Garen.
2917
2918         * stress/arith-ceil-on-various-types.js: Added.
2919         * stress/arith-floor-on-various-types.js: Added.
2920         * stress/arith-round-on-various-types.js: Added.
2921         * stress/arith-trunc-on-various-types.js: Added.
2922
2923 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
2924
2925         [JSC] Do not need to use defineProperty to define methods for object literals
2926         https://bugs.webkit.org/show_bug.cgi?id=162111
2927
2928         Reviewed by Saam Barati.
2929
2930         * stress/object-literal-methods.js: Added.
2931         (shouldBe):
2932         (throw.new.Error.let.object.get name):
2933         (throw.new.Error):
2934         (shouldBe.let.object.get name):
2935         (shouldBe.let.object.get prototype):
2936         (shouldBe.let.object.get 42):
2937
2938 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2939
2940         [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
2941         https://bugs.webkit.org/show_bug.cgi?id=162000
2942
2943         Reviewed by Filip Pizlo.
2944
2945         * microbenchmarks/is-array-for-array.js: Added.
2946         (isArray):
2947         * microbenchmarks/is-array-for-mixed-case.js: Added.
2948         (isArray):
2949         * microbenchmarks/is-array-for-non-array-object.js: Added.
2950         (isArray):
2951         * microbenchmarks/is-array-for-proxy.js: Added.
2952         (isArray):
2953         (isArray.proxy.throw.new.Error.isArray):
2954         (isArray.proxy.throw.new.Error):
2955
2956 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2957
2958         Unreviewed, gardening test262 results
2959
2960         Some tests are now passed with JSC, but marked as failed.
2961
2962         * test262.yaml:
2963
2964 2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
2965
2966         test262: Various Constructors length properties should be configurable
2967         https://bugs.webkit.org/show_bug.cgi?id=161998
2968
2969         Reviewed by Saam Barati.
2970
2971         * test262.yaml:
2972
2973 2016-09-15  Commit Queue  <commit-queue@webkit.org>
2974
2975         Unreviewed, rolling out r205931.
2976         https://bugs.webkit.org/show_bug.cgi?id=162021
2977
2978         Tests for this change fail on 32-bit JSC bots (Requested by
2979         ryanhaddad on #webkit).
2980
2981         Reverted changeset:
2982
2983         "[JSC] Make the rounding-related nodes support any type"
2984         https://bugs.webkit.org/show_bug.cgi?id=161895
2985         http://trac.webkit.org/changeset/205931
2986
2987 2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
2988
2989         test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
2990         https://bugs.webkit.org/show_bug.cgi?id=162013
2991
2992         Reviewed by Saam Barati.
2993
2994         * stress/es6-default-parameters.js:
2995         * test262.yaml:
2996
2997 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2998
2999         ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
3000         https://bugs.webkit.org/show_bug.cgi?id=162003
3001
3002         Reviewed by Saam Barati.
3003
3004         * stress/spread-calling.js:
3005         * test262.yaml:
3006
3007 2016-09-14  Michael Saboff  <msaboff@apple.com>
3008
3009         YARR doesn't check for invalid flags for literal regular expressions
3010         https://bugs.webkit.org/show_bug.cgi?id=161995
3011
3012         Reviewed by Mark Lam.
3013
3014         New test.
3015
3016         * stress/regress-161995.js: Added.
3017         (testStatic):
3018         (catch):
3019
3020 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3021
3022         test262: TypedArray constructors length should be 3 and configurable
3023         https://bugs.webkit.org/show_bug.cgi?id=161955
3024
3025         Reviewed by Mark Lam.
3026
3027         * test262.yaml:
3028
3029 2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
3030
3031         [JSC] Make the rounding-related nodes support any type
3032         https://bugs.webkit.org/show_bug.cgi?id=161895
3033
3034         Reviewed by Geoffrey Garen.
3035
3036         * stress/arith-ceil-on-various-types.js: Added.
3037         * stress/arith-floor-on-various-types.js: Added.
3038         * stress/arith-round-on-various-types.js: Added.
3039         * stress/arith-trunc-on-various-types.js: Added.
3040
3041 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3042
3043         TaggedTemplateString function calls should emit tail position calls
3044         https://bugs.webkit.org/show_bug.cgi?id=161948
3045
3046         Reviewed by Yusuke Suzuki.
3047
3048         * stress/tail-call-recognize.js:
3049         (runTests):
3050         Ensure a tagged template string function call is tail call.
3051
3052         * test262.yaml:
3053         These now pass.
3054
3055 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3056
3057         test262: Array.prototype.slice should always set length
3058         https://bugs.webkit.org/show_bug.cgi?id=161953
3059
3060         Reviewed by Mark Lam.
3061
3062         * test262.yaml:
3063
3064 2016-09-13  JF Bastien  <jfbastien@apple.com>
3065
3066         Support jsc shell builtin `read`
3067         https://bugs.webkit.org/show_bug.cgi?id=161662
3068
3069         Reviewed by Keith Miller.
3070
3071         * stress/jsc-read.js: Added.
3072         (test): test `read` and `readFile` shell builtins, in string and binary mode.
3073
3074 2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
3075
3076         ES6: Classes: Should be allowed to create a static method with name "arguments"
3077         https://bugs.webkit.org/show_bug.cgi?id=152985
3078
3079         Reviewed by Keith Miller.
3080
3081         * test262.yaml:
3082
3083 2016-09-12  Saam Barati  <sbarati@apple.com>
3084
3085         Speed up Function.prototype.bind a bit by making it a builtin
3086         https://bugs.webkit.org/show_bug.cgi?id=161879
3087
3088         Reviewed by Filip Pizlo.
3089
3090         * microbenchmarks/function-bind-inlining.js: Added.
3091         (assert):
3092         (test):
3093         (test2):
3094         (foo):
3095         * microbenchmarks/function-bind-no-inlining.js: Added.
3096         (assert):
3097         (test):
3098         (test2):
3099         (foo):
3100
3101 2016-09-12  Saam Barati  <sbarati@apple.com>
3102
3103         HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
3104         https://bugs.webkit.org/show_bug.cgi?id=161640
3105
3106         Reviewed by Geoffrey Garen.
3107
3108         * microbenchmarks/map-rehash.js: Added.
3109         * stress/map-delete.js: Added.
3110         (assert):
3111         * stress/map-rehash-2.js: Added.
3112         (assert):
3113         * stress/map-rehash.js: Added.
3114         (assert):
3115
3116 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3117
3118         Unreviewed, fix tests for different libm environments
3119         https://bugs.webkit.org/show_bug.cgi?id=161857
3120
3121         * stress/ftl-arithtan.js:
3122
3123 2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
3124
3125         [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
3126         https://bugs.webkit.org/show_bug.cgi?id=161671
3127
3128         Reviewed by Geoffrey Garen.
3129
3130         * stress/get-array-length-on-undecided.js: Added.
3131
3132 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3133
3134         [DFG][FTL] Add ArithTan
3135         https://bugs.webkit.org/show_bug.cgi?id=161857
3136
3137         Reviewed by Filip Pizlo.
3138
3139         * microbenchmarks/tan.js: Added.
3140         * stress/arith-tan-on-various-types.js: Added.
3141         (let.validInputTypedTestCases.validInputTestCases.map):
3142         (isIdentical):
3143         (opaqueTanNoArgument):
3144         (testNoArgument):
3145         (opaqueAllTypesTan):
3146         (testAllTypesCall):
3147         (testTangleTypeCall):
3148         (testConstant):
3149         (opaqueTanForSideEffects):
3150         (testSideEffect.let.testObject.valueOf):
3151         (testSideEffect):
3152         (opaqueTanForCSE):
3153         (testCSE.let.testObject.valueOf):
3154         (testCSE):
3155         (opaqueTanForDCE):
3156         (testDCE.let.testObject.valueOf):
3157         (testDCE):
3158         (testException.opaqueTanWithException):
3159         (testException):
3160         * stress/ftl-arithtan.js: Added.
3161         (foo):
3162
3163 2016-09-12  Saam Barati  <sbarati@apple.com>
3164
3165         MapHash should do constant folding when it has a constant argument and its legal to hash that value
3166         https://bugs.webkit.org/show_bug.cgi?id=161639
3167
3168         Reviewed by Filip Pizlo.
3169
3170         * microbenchmarks/map-constant-key.js: Added.
3171         (assert):
3172         (test):
3173         (foo):
3174
3175 2016-09-12  Michael Saboff  <msaboff@apple.com>
3176
3177         JSC test timeout: ChakraCore.yaml/ChakraCore/test/Bugs/bug56026_trycatch.js.default
3178         https://bugs.webkit.org/show_bug.cgi?id=161863
3179
3180         Reviewed by Saam Barati.
3181
3182         * ChakraCore.yaml:
3183         Disabled Bugs/bug56026_trycatch.js.
3184
3185 2016-09-09  Michael Saboff  <msaboff@apple.com>
3186
3187         Unreviewed, rolling r205759 back in with a fix.
3188
3189         The expectation file, JSTests/ChakraCore/test/Lib/tostring.baseline-jsc,
3190         should be named "toString.baseline-jsc".
3191
3192         * ChakraCore/test/Lib/toString.baseline-jsc: Copied from JSTests/ChakraCore/test/Lib/tostring.baseline-jsc.
3193         * ChakraCore/test/Lib/tostring.baseline-jsc: Removed.
3194
3195 2016-09-09  Michael Saboff  <msaboff@apple.com>
3196
3197         Disable three flakey Chakra Tests
3198         https://bugs.webkit.org/show_bug.cgi?id=161807
3199
3200         Reviewed by Saam Barati.
3201
3202         * ChakraCore.yaml: Disabled the flakey tests
3203         ChakraCore/test/Array/protoLookup_native.js
3204         ChakraCore/test/LetConst/delete.js
3205         ChakraCore/test/fieldopts/fieldhoist_sideeffect.js
3206
3207 2016-09-08  Saam Barati  <sbarati@apple.com>
3208
3209         We should inline operationConvertJSValueToBoolean into JIT code
3210         https://bugs.webkit.org/show_bug.cgi?id=161729
3211
3212         Reviewed by Filip Pizlo.
3213
3214         * stress/value-to-boolean.js: Added.
3215         (assert):
3216         (test1):
3217         (test2):
3218         (test3):
3219
3220 2016-09-08  Mark Lam  <mark.lam@apple.com>
3221
3222         REGRESSION (r205569?): 32-bit JSC test timeout: stress/rest-parameter-many-arguments.js.dfg-maximal-flush-validate-no-cjit
3223         https://bugs.webkit.org/show_bug.cgi?id=161756
3224
3225         Reviewed by Saam Barati.
3226
3227         It looks like the 32-bit JSC bot is just too slow at running this test with the
3228         dfg-maximal-flush-validate-no-cjit configuration.  We'll try excluding that
3229         configuration.
3230
3231         * stress/rest-parameter-many-arguments.js:
3232
3233 2016-09-08  JF Bastien  <jfbastien@apple.com>
3234
3235         Delete older WebAssembly tests
3236         https://bugs.webkit.org/show_bug.cgi?id=161758
3237
3238         Reviewed by Filip Pizlo.
3239
3240         They're not running, rely on the older polyfill prototype, and the older code was deleted in: https://trac.webkit.org/changeset/204180
3241
3242         * stress/wasm-arithmetic-float32.js: Removed.
3243         * stress/wasm-arithmetic-float64.js: Removed.
3244         * stress/wasm-arithmetic-int32.js: Removed.
3245         * stress/wasm-calls.js: Removed.
3246         * stress/wasm-comma.js: Removed.
3247         * stress/wasm-control-flow.js: Removed.
3248         * stress/wasm-globals.js: Removed.
3249         * stress/wasm-linear-memory.js: Removed.
3250         * stress/wasm-locals.js: Removed.
3251         * stress/wasm-relational.js: Removed.
3252         * stress/wasm-type-conversion.js: Removed.
3253         * stress/wasm/arithmetic-float32.wasm: Removed.
3254         * stress/wasm/arithmetic-float64.wasm: Removed.
3255         * stress/wasm/arithmetic-int32.wasm: Removed.
3256         * stress/wasm/calls.wasm: Removed.
3257         * stress/wasm/comma.wasm: Removed.
3258         * stress/wasm/control-flow.wasm: Removed.
3259         * stress/wasm/globals.wasm: Removed.
3260         * stress/wasm/linear-memory.wasm: Removed.
3261         * stress/wasm/locals.wasm: Removed.
3262         * stress/wasm/relational.wasm: Removed.
3263         * stress/wasm/type-conversion.wasm: Removed.
3264
3265 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
3266
3267         [Win] Exception fuzz tests fail
3268         https://bugs.webkit.org/show_bug.cgi?id=140928
3269
3270         Reviewed by Mark Lam.
3271
3272         Unskip tests.
3273
3274         * exceptionFuzz.yaml:
3275
3276 2016-09-06  Saam Barati  <sbarati@apple.com>
3277
3278         ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
3279         https://bugs.webkit.org/show_bug.cgi?id=161558
3280
3281         Reviewed by Benjamin Poulain.
3282
3283         * stress/proxy-get-prototype-of.js:
3284         * stress/proxy-set-prototype-of.js:
3285         (let.handler.setPrototypeOf): Deleted.
3286         * stress/proxy-underscore-proto.js: Added.
3287         (assert):
3288
3289 2016-09-06  Saam Barati  <sbarati@apple.com>
3290
3291         Make JSMap and JSSet faster
3292         https://bugs.webkit.org/show_bug.cgi?id=160989
3293
3294         Reviewed by Filip Pizlo.
3295
3296         * microbenchmarks/dense-set.js: Added.
3297         (bench):
3298         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3299         (bar):
3300         (foo):
3301         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3302         (bar):
3303         (foo):
3304         * microbenchmarks/large-map-iteration.js: Added.
3305         (bar):
3306         (foo):
3307         * microbenchmarks/map-get-get-cse.js: Added.
3308         (bar):
3309         (foo):
3310         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3311         (bar):
3312         (foo):
3313         * microbenchmarks/sparse-set.js: Added.
3314         (bench):
3315         * stress/map-cse-correctness.js: Added.
3316         (assert):
3317         (testHas):
3318         (testGet):
3319         (foo):
3320         * stress/map-iteration.js: Added.
3321         (assert):
3322         (test1):
3323         (test2):
3324         (test3):
3325         (test4):
3326         (test5):
3327         (test6):
3328         (test7):
3329         (test8):
3330         (test9):
3331         (test10):
3332         (test11):
3333         (test12):
3334         (test13):
3335         (test14):
3336         (test15):
3337         (test16):
3338         (test17):
3339         (test18):
3340
3341 2016-09-06  Benjamin Poulain  <bpoulain@apple.com>
3342
3343         [JSC] Make ArithClz32 work with Cell arguments
3344         https://bugs.webkit.org/show_bug.cgi?id=161369
3345
3346         Reviewed by Geoffrey Garen.
3347
3348         * stress/arith-clz32-on-various-types.js: Added.
3349
3350 2016-09-06  Commit Queue  <commit-queue@webkit.org>
3351
3352         Unreviewed, rolling out r205504.
3353         https://bugs.webkit.org/show_bug.cgi?id=161645
3354
3355         Broke the iOS device build (Requested by ryanhaddad on
3356         #webkit).
3357
3358         Reverted changeset:
3359
3360         "Make JSMap and JSSet faster"
3361         https://bugs.webkit.org/show_bug.cgi?id=160989
3362         http://trac.webkit.org/changeset/205504
3363
3364 2016-09-06  Saam Barati  <sbarati@apple.com>
3365
3366         Make JSMap and JSSet faster
3367         https://bugs.webkit.org/show_bug.cgi?id=160989
3368
3369         Reviewed by Filip Pizlo.
3370
3371         * microbenchmarks/dense-set.js: Added.
3372         (bench):
3373         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3374         (bar):
3375         (foo):
3376         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3377         (bar):
3378         (foo):
3379         * microbenchmarks/large-map-iteration.js: Added.
3380         (bar):
3381         (foo):
3382         * microbenchmarks/map-get-get-cse.js: Added.
3383         (bar):
3384         (foo):
3385         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3386         (bar):
3387         (foo):
3388         * microbenchmarks/sparse-set.js: Added.
3389         (bench):
3390         * stress/map-cse-correctness.js: Added.
3391         (assert):
3392         (testHas):
3393         (testGet):
3394         (foo):
3395         * stress/map-iteration.js: Added.
3396         (assert):
3397         (test1):
3398         (test2):
3399         (test3):
3400         (test4):
3401         (test5):
3402         (test6):
3403         (test7):
3404         (test8):
3405         (test9):
3406         (test10):
3407         (test11):
3408         (test12):
3409         (test13):
3410         (test14):
3411         (test15):
3412         (test16):
3413         (test17):
3414         (test18):
3415
3416 2016-08-31  Filip Pizlo  <fpizlo@apple.com>
3417
3418         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3419         https://bugs.webkit.org/show_bug.cgi?id=160125
3420
3421         Reviewed by Geoffrey Garen and Keith Miller.
3422         
3423         Most of the things I did properly covered by existing tests, but I found some simple cases of
3424         unshifting that had sketchy coverage.
3425
3426         * stress/array-storage-array-unshift.js: Added.
3427         * stress/contiguous-array-unshift.js: Added.
3428         * stress/double-array-unshift.js: Added.
3429         * stress/int32-array-unshift.js: Added.
3430
3431 2016-09-02  Michael Saboff  <msaboff@apple.com>
3432
3433         Unreviewed fix after importing Chakra test
3434
3435         * ChakraCore.yaml: Skipped ChakraCore/test/UnifiedRegex/crazy.js because the original
3436         test contained tab characters.  I removed the tabs before landing.  This test depended
3437         on the tab characters and now fails after they were removed.
3438         test.
3439
3440 2016-09-01  Michael Saboff  <msaboff@apple.com>
3441
3442         Import Chakra tests to JSC
3443         https://bugs.webkit.org/show_bug.cgi?id=154697
3444
3445         Reviewed by Saam Barati.
3446
3447         Added Chakra tests.  All these tests are under Chakra/test.  This is the same layout
3448         for tests in the Chakra tree.
3449
3450         Created a ChakraCore.yaml file to be used with run-jsc-stress-tests.  This file contains
3451         the tests that are run when the original Chakra runtests.py script is run.  That script
3452         is the test driver for *nix platforms and does not attempt to run all tests or all
3453         variations of tests.  The runtest.py driver consults rlexe.xml files in each test
3454         subdirectory to determine the test to run, the options to pass to the test and how to
3455         determine pass/fail of the test.  With runtests.py as the start, tests that didn't
3456         pass directly where either skipped, with a message describing why or through 
3457         adjustments to the test infrastructure, as described below, where made to pass.
3458         
3459         The only modification to the test infrastrucutre are:
3460
3461          1) Added simple mapping of Chakra expected exception text to JSC expected text in
3462             test/UnitTestFramework/UnitTestFramework.js.  It would make sense to also
3463             map some JSC specific exception text to more generic text for the cases where
3464             that text contains indetifier names or other source specific strings and the
3465             Chakra equivolent exception texts are generic.  
3466  
3467          2) Created JSC specific expected text files where it is clear that the text work
3468             as expected on JSC but the test output is different.  Typically the differences
3469             fall into three categories, different exception output, different output from
3470             toString() of a function, slight numeric differences, and test that rely on
3471             iteration order.
3472
3473          3) Stripped the CR's from the CR-LF line terminations of the files.  
3474
3475         No actual test .js files were modified.
3476
3477         * ChakraCore: Added.
3478         * ChakraCore.yaml: Added.
3479         * ChakraCore/CONTRIBUTING.md: Added.
3480         * ChakraCore/LICENSE.txt: Added.
3481         * ChakraCore/README.md: Added.
3482         * ChakraCore/THIRD-PARTY-NOTICES.txt: Added.
3483         * ChakraCore/test: Added this directory and the tests included therein.
3484
3485 2016-09-01  JF Bastien  <jfbastien@apple.com>
3486
3487         GetByIdWithThis/GetByValWithThis should have ValueProfiles so that they can predict their result types
3488         https://bugs.webkit.org/show_bug.cgi?id=160922
3489
3490         Reviewed by Keith Miller.
3491
3492         Benchmark GetBy{Id,Val}WithThis in monomorphic and polymorphic uses.
3493         The value profile is used by the calc functions, which do some mild math with the result.
3494         These benchmarks get ~4% faster with value profiling.
3495
3496         * microbenchmarks/super-get-by-id-with-this-monomorphic.js: Added.
3497         (A):
3498         (A.prototype.set value):
3499         (A.prototype.get value):
3500         (B.prototype.set value):
3501         (B.prototype.get value):
3502         (B):
3503         (const.bench):
3504         * microbenchmarks/super-get-by-id-with-this-polymorphic.js: Added.
3505         (A):
3506         (A.prototype.set value):
3507         (A.prototype.get value):
3508         (B.prototype.set value):
3509         (B.prototype.get value):
3510         (B):
3511         (const.bench):
3512         * microbenchmarks/super-get-by-val-with-this-monomorphic.js: Added.
3513         (value):
3514         (A):
3515         (A.prototype.set v):
3516         (A.prototype.get v):
3517         (B.prototype.set v):
3518         (B.prototype.get v):
3519         (B):
3520         (const.bench):
3521         * microbenchmarks/super-get-by-val-with-this-polymorphic.js: Added.
3522         (value):
3523         (A):
3524         (A.prototype.set v):
3525         (A.prototype.get v):
3526         (B.prototype.set v):
3527         (B.prototype.get v):
3528         (B):
3529         (const.bench):
3530
3531 2016-09-01  Benjamin Poulain  <bpoulain@apple.com>
3532
3533         arith-abs-on-various-types.js is flaky
3534
3535         Unreviewed.
3536
3537         * stress/arith-abs-on-various-types.js:
3538         Two compilation is too small for the worst case.
3539         Math.abs() can be typed integer->number->untyped if we are very unlucky.
3540
3541 2016-09-01  Filip Pizlo  <fpizlo@apple.com>
3542
3543         ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases
3544         https://bugs.webkit.org/show_bug.cgi?id=161492
3545
3546         Reviewed by Mark Lam.
3547         
3548         This bug affected function->activation references but not object->object field references,
3549         because object->object field references are !neededForMaterialization(). So, the object
3550         test always passed but the activation/function test used to always fail. It passes now.
3551
3552         * stress/materialize-activation-referenced-from-phantom-function.js: Added.
3553         (bar):
3554         (inc):
3555         (dec):
3556         (foo):
3557         (test):
3558         * stress/materialize-object-referenced-from-phantom-object.js: Added.
3559         (bar):
3560         (foo):
3561         (test):
3562
3563 2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3564
3565         stress/random-53bit.js.ftl-no-cjit-no-inline-validate sometimes fails
3566         https://bugs.webkit.org/show_bug.cgi?id=161436
3567
3568         Reviewed by Filip Pizlo.
3569
3570         The test checks Math.random() correctly produces 53bit random values.
3571         The test can fail by design, but this should be fairly rare.
3572
3573         However, when introducing, we wrap the `test()` with 1e4 to ensure the FTL compilation, and this
3574         increases the failure rate. By increasing the MAX in the test, we make the failures much more rare case.
3575
3576         And we also add getRandomSeed() and setRandomSeed(seed) JSC shell helpers to dump more useful information
3577         and reproduce the situation easily.
3578
3579         * stress/random-53bit.js:
3580         (test):
3581
3582 2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
3583
3584         [JSC] Improve ArithAbs with polymorphic input
3585         https://bugs.webkit.org/show_bug.cgi?id=161286
3586
3587         Reviewed by Saam Barati.
3588
3589         * stress/arith-abs-on-various-types.js: Added.
3590         New tests.
3591
3592         * stress/arith-cos-on-various-types.js:
3593         * stress/arith-fround-on-various-types.js:
3594         * stress/arith-log-on-various-types.js:
3595         * stress/arith-sin-on-various-types.js:
3596         * stress/arith-sqrt-on-various-types.js:
3597         Extend the existing tests to cover the DCE case.
3598
3599 2016-08-26  Benjamin Poulain  <benjamin@webkit.org>
3600
3601         [JSC] Implement CompareStrictEq(String, Untyped) in FTL
3602         https://bugs.webkit.org/show_bug.cgi?id=161229
3603
3604         Reviewed by Geoffrey Garen.
3605
3606         * stress/compare-strict-eq-on-various-types.js: Added.
3607
3608 2016-08-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3609
3610         [ES6] newPromiseCapabilities should check the given argument is constructor
3611         https://bugs.webkit.org/show_bug.cgi?id=161226
3612
3613         Reviewed by Mark Lam.
3614
3615         The arrow function should not be a constructor. So the error should be raised.
3616
3617         * stress/new-promise-capabilities-requires-constructor.js: Added.
3618         (shouldThrow):
3619
3620 2016-08-25  Benjamin Poulain  <bpoulain@apple.com>
3621
3622         [JSC] Clean up the abstract interpreter for cos/sin/sqrt/fround/log
3623         https://bugs.webkit.org/show_bug.cgi?id=161181
3624
3625         Reviewed by Geoffrey Garen.
3626
3627         Extend the tests to constants.
3628         Add no-argument cases where needed.
3629
3630         * stress/arith-cos-on-various-types.js:
3631         * stress/arith-fround-on-various-types.js:
3632         * stress/arith-log-on-various-types.js:
3633         * stress/arith-sin-on-various-types.js:
3634         * stress/arith-sqrt-on-various-types.js:
3635
3636 2016-08-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3637
3638         [DFG][FTL] Implement ES6 Generators in DFG / FTL
3639         https://bugs.webkit.org/show_bug.cgi?id=152723
3640
3641         Reviewed by Filip Pizlo.
3642
3643         * stress/generator-fib-ftl-and-array.js: Added.
3644         (fib):
3645         * stress/generator-fib-ftl-and-object.js: Added.
3646         (fib):
3647         * stress/generator-fib-ftl-and-string.js: Added.
3648         (fib):
3649         * stress/generator-fib-ftl.js: Added.
3650         (fib):
3651         * stress/generator-frame-empty.js: Added.
3652         (shouldThrow):
3653         (shouldThrow.fib):
3654         * stress/generator-reduced-save-point-put-to-scope.js: Added.
3655         (shouldBe):
3656         (gen):
3657         * stress/generator-transfer-register-beyond-mutiple-yields.js: Added.
3658         (shouldBe):
3659         (gen):
3660
3661 2016-08-25  JF Bastien  <jfbastien@apple.com>
3662
3663         TryGetById should have a ValueProfile so that it can predict its output type
3664         https://bugs.webkit.org/show_bug.cgi?id=160921
3665
3666         Reviewed by Saam Barati.
3667
3668         * microbenchmarks/try-get-by-id-basic.js: Added.
3669         (const.check):
3670         (const.bench.f.const.fooPlusBar.createBuiltin):
3671         * microbenchmarks/try-get-by-id-polymorphic.js: Added.
3672         (const.check):
3673         (fooPlusBar.createBuiltin):
3674         (bench):
3675
3676 2016-08-25  Caio Lima  <ticaiolima@gmail.com>
3677
3678         NewRegexp should not prevent inlining
3679         https://bugs.webkit.org/show_bug.cgi?id=154808
3680
3681         Reviewed by Geoffrey Garen.
3682
3683         Added test where functions with NewRegExp can be inlined right now.
3684
3685         * stress/new-regex-inline.js: Added.
3686         (assert):
3687         (testRegexpInline):
3688         (toInlineGlobal):
3689         (withRegexp):
3690         (inlineRegexpNotGlobal):
3691         (toInlineRecursive):
3692         (regexpContainsRecursive):
3693
3694 2016-08-24  Benjamin Poulain  <benjamin@webkit.org>
3695
3696         [JSC] Make FRound work with any type
3697         https://bugs.webkit.org/show_bug.cgi?id=161129
3698
3699         Reviewed by Geoffrey Garen.
3700
3701         * stress/arith-fround-on-various-types.js: Added.
3702
3703 2016-08-24  Filip Pizlo  <fpizlo@apple.com>
3704
3705         Unreviewed, roll out r204901, r204897, r204866, r204856, r204854.
3706
3707         * stress/array-storage-array-unshift.js: Removed.
3708         * stress/contiguous-array-unshift.js: Removed.
3709         * stress/double-array-unshift.js: Removed.
3710         * stress/int32-array-unshift.js: Removed.
3711
3712 2016-08-24  Skachkov Oleksandr  <gskachkov@gmail.com>
3713
3714         [ES2016] Allow assignment in