Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
4         https://bugs.webkit.org/show_bug.cgi?id=181321
5
6         Reviewed by Saam Barati.
7
8         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
9         (shouldBe):
10         (testFunction):
11         * test262.yaml:
12
13 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
14
15         Unreviewed, attempt to fix test262 after r226386.
16
17         * test262.yaml:
18
19 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
20
21         [DFG] Define defs for MapSet/SetAdd to participate in CSE
22         https://bugs.webkit.org/show_bug.cgi?id=179911
23
24         Reviewed by Saam Barati.
25
26         In addition to these tests, map-set-cse.js and set-add-cse.js work.
27
28         * stress/map-set-change-get.js: Added.
29         (shouldBe):
30         (test):
31         * stress/map-set-create-bucket.js: Added.
32         (shouldBe):
33         (test):
34         * stress/set-add-create-bucket.js: Added.
35         (shouldBe):
36
37 2018-01-03  Michael Saboff  <msaboff@apple.com>
38
39         Disable SharedArrayBuffers from Web API
40         https://bugs.webkit.org/show_bug.cgi?id=181266
41
42         Reviewed by Saam Barati.
43
44         Disabled SharedArrayBuffer tests.
45
46         * stress/SharedArrayBuffer-opt.js:
47         * stress/SharedArrayBuffer.js:
48         * stress/array-buffer-byte-length.js:
49         * stress/atomics-add-uint32.js:
50         * stress/atomics-known-int-use.js:
51         * stress/atomics-neg-zero.js:
52         * stress/atomics-store-return.js:
53         * stress/lars-sab-workers.js:
54         * stress/regress-159779-1.js:
55         * stress/regress-159779-2.js:
56         * stress/regress-170473.js:
57         * test262.yaml:
58
59 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
60
61         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
62         https://bugs.webkit.org/show_bug.cgi?id=181258
63
64         Reviewed by Antonio Gomes.
65
66         * stress/big-int-constructor-gc.js:
67         * stress/big-int-constructor-oom.js:
68
69 2018-01-03  Robin Morisset  <rmorisset@apple.com>
70
71         Inlining of a function that ends in op_unreachable crashes
72         https://bugs.webkit.org/show_bug.cgi?id=181027
73
74         Reviewed by Filip Pizlo.
75
76         * stress/inlining-unreachable.js: Added.
77         (bar):
78         (baz):
79         (i.catch):
80
81 2018-01-02  Saam Barati  <sbarati@apple.com>
82
83         Incorrect assertion inside AccessCase
84         https://bugs.webkit.org/show_bug.cgi?id=181200
85         <rdar://problem/35494754>
86
87         Reviewed by Yusuke Suzuki.
88
89         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
90         (ctor):
91         (theFunc):
92         (run):
93
94 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
95
96         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
97         https://bugs.webkit.org/show_bug.cgi?id=175359
98
99         Reviewed by Yusuke Suzuki.
100
101         * bigIntTests.yaml:
102         * stress/big-int-as-key.js: Added.
103         * stress/big-int-constructor-gc.js: Added.
104         * stress/big-int-constructor-oom.js: Added.
105         * stress/big-int-constructor-properties.js: Added.
106         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
107         * stress/big-int-constructor-prototype.js: Added.
108         * stress/big-int-constructor.js: Added.
109         * stress/big-int-function-apply.js:
110         * stress/big-int-length.js: Added.
111         * stress/big-int-prop-descriptor.js: Added.
112         * stress/big-int-proto-constructor.js: Added.
113         * stress/big-int-proto-name.js: Added.
114         * stress/big-int-prototype-properties.js: Added.
115         * stress/big-int-prototype-proto.js: Added.
116         * stress/big-int-prototype-value-of.js: Added.
117         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
118         * stress/big-int-prototype-to-string-apply.js: Added.
119         * stress/big-int-to-object.js: Added.
120         * stress/big-int-to-string.js: Added.
121
122 2017-12-28  Saam Barati  <sbarati@apple.com>
123
124         Assertion used to determine if something is an async generator is wrong
125         https://bugs.webkit.org/show_bug.cgi?id=181168
126         <rdar://problem/35640560>
127
128         Reviewed by Yusuke Suzuki.
129
130         * stress/async-generator-assertion.js: Added.
131
132 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
133
134         Skip stress/splay-flash-access tests on memory limited platforms
135         https://bugs.webkit.org/show_bug.cgi?id=181086
136
137         Reviewed by Carlos Alberto Lopez Perez.
138
139         These tests use about 185M of memory, and occasionally get OOM-killed
140         on memory limited platforms.
141
142         * stress/splay-flash-access-1ms.js:
143         * stress/splay-flash-access.js:
144
145 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
146
147         Skip slow jsc tests on embedded platforms
148         https://bugs.webkit.org/show_bug.cgi?id=180937
149
150         Reviewed by Carlos Alberto Lopez Perez.
151
152         The tests typeProfiler/deltablue-for-of.js and
153         typeProfiler/getter-richards.js take a very long time in the
154         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
155         thus always timeout. They should be skipped on these platforms.
156
157         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
158         * typeProfiler/getter-richards.js: Skip on arm*/mips.
159
160 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
161
162         [JSC] Do not check isValid() in op_new_regexp
163         https://bugs.webkit.org/show_bug.cgi?id=180970
164
165         Reviewed by Saam Barati.
166
167         * stress/regexp-syntax-error-invalid-flags.js: Added.
168         (shouldThrow):
169
170 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
171
172         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
173         https://bugs.webkit.org/show_bug.cgi?id=180712
174
175         Reviewed by Michael Catanzaro.
176
177         stress/call-apply-exponential-bytecode-size.js crashes if the
178         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
179         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
180         should skip the test on other platforms.
181
182         * stress/call-apply-exponential-bytecode-size.js:
183
184 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
185
186         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
187         https://bugs.webkit.org/show_bug.cgi?id=179762
188
189         Reviewed by Saam Barati.
190
191         * stress/call-varargs-double-new-array-buffer.js: Added.
192         (assert):
193         (bar):
194         (foo):
195         * stress/call-varargs-spread-new-array-buffer.js: Added.
196         (assert):
197         (bar):
198         (foo):
199         * stress/call-varargs-spread-new-array-buffer2.js: Added.
200         (assert):
201         (bar):
202         (foo):
203         * stress/forward-varargs-double-new-array-buffer.js: Added.
204         (assert):
205         (test.baz):
206         (test.bar):
207         (test.foo):
208         (test):
209         * stress/new-array-buffer-sinking-osrexit.js: Added.
210         (target):
211         (test):
212         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
213         (shouldBe):
214         (test):
215         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
216         (shouldBe):
217         (target):
218         (test):
219         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
220         (assert):
221         (test1.bar):
222         (test1.foo):
223         (test1):
224         (test2.bar):
225         (test2.foo):
226         (test3.baz):
227         (test3.bar):
228         (test3.foo):
229         (test4.baz):
230         (test4.bar):
231         (test4.foo):
232         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
233         (assert):
234         (test.baz):
235         (test.bar):
236         (test.foo):
237         (test):
238         * stress/phantom-new-array-buffer-osr-exit.js: Added.
239         (assert):
240         (baz):
241         (bar):
242         (effects):
243         (foo):
244
245 2017-12-14  Saam Barati  <sbarati@apple.com>
246
247         The CleanUp after LICM is erroneously removing a Check
248         https://bugs.webkit.org/show_bug.cgi?id=180852
249         <rdar://problem/36063494>
250
251         Reviewed by Filip Pizlo.
252
253         * stress/dont-run-cleanup-after-licm.js: Added.
254
255 2017-12-14  Michael Saboff  <msaboff@apple.com>
256
257         REGRESSION (r225695): Repro crash on yahoo login page
258         https://bugs.webkit.org/show_bug.cgi?id=180761
259
260         Reviewed by JF Bastien.
261
262         New regression test.
263
264         * stress/regress-180761.js: Added.
265
266 2017-12-13  Keith Miller  <keith_miller@apple.com>
267
268         JSObjects should have a mask for loading indexed properties
269         https://bugs.webkit.org/show_bug.cgi?id=180768
270
271         Reviewed by Mark Lam.
272
273         * stress/int16-put-by-val-in-and-out-of-bounds.js:
274         (test):
275
276 2017-12-13  Saam Barati  <sbarati@apple.com>
277
278         Arrow functions need their own structure because they have different properties than sloppy functions
279         https://bugs.webkit.org/show_bug.cgi?id=180779
280         <rdar://problem/35814591>
281
282         Reviewed by Mark Lam.
283
284         * stress/arrow-function-needs-its-own-structure.js: Added.
285         (assert):
286         (readPrototype):
287         (noInline.let.f1):
288         (noInline):
289
290 2017-12-13  Saam Barati  <sbarati@apple.com>
291
292         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
293         https://bugs.webkit.org/show_bug.cgi?id=163579
294         <rdar://problem/35455798>
295
296         Reviewed by Mark Lam.
297
298         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
299         (assert):
300         (test1):
301         (i.test1):
302         (i.test1.C):
303         (i.test1.async.foo):
304         (i.test1.foo):
305         (test2):
306
307 2017-12-13  Saam Barati  <sbarati@apple.com>
308
309         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
310         https://bugs.webkit.org/show_bug.cgi?id=180734
311         <rdar://problem/35640547>
312
313         Reviewed by Yusuke Suzuki.
314
315         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
316         (__isPropertyOfType):
317         (__getProperties):
318         (__getObjects):
319         (__getRandomObject):
320         (theClass.):
321         (theClass):
322         (childClass):
323         (counter.catch):
324
325 2017-12-12  Saam Barati  <sbarati@apple.com>
326
327         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
328         https://bugs.webkit.org/show_bug.cgi?id=180725
329         <rdar://problem/35970511>
330
331         Reviewed by Michael Saboff.
332
333         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
334         (f1):
335         (f2):
336         (let.o2.valueOf):
337
338 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
339
340         [JSC] Implement optimized WeakMap and WeakSet
341         https://bugs.webkit.org/show_bug.cgi?id=179929
342
343         Reviewed by Saam Barati.
344
345         * microbenchmarks/weak-map-key.js:
346         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
347         (assert):
348         (objectKey):
349         (let.start.Date.now):
350         * stress/basic-weakmap.js: Added.
351         (shouldBe):
352         (test):
353         * stress/basic-weakset.js: Added.
354         (shouldBe):
355         (test.set new):
356         * stress/weakmap-cse-set-break.js: Added.
357         (shouldBe):
358         (test):
359         * stress/weakmap-cse.js: Added.
360         (shouldBe):
361         (test):
362         * stress/weakmap-gc.js: Added.
363         (test):
364         * stress/weakset-cse-add-break.js: Added.
365         (shouldBe):
366         (test.set new):
367         * stress/weakset-cse.js: Added.
368         (shouldBe):
369         (test.set new):
370         * stress/weakset-gc.js: Added.
371         (test.set add):
372         (test.set new):
373         (test):
374
375 2017-12-12  Saam Barati  <sbarati@apple.com>
376
377         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
378         https://bugs.webkit.org/show_bug.cgi?id=180723
379         <rdar://problem/35859726>
380
381         Reviewed by JF Bastien.
382
383         * stress/get-my-argument-by-val-constant-folding.js: Added.
384         (test):
385         (catch):
386
387 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
388
389         [ESNext][BigInt] Implement BigInt literals and JSBigInt
390         https://bugs.webkit.org/show_bug.cgi?id=179000
391
392         Reviewed by Darin Adler and Yusuke Suzuki.
393
394         * bigIntTests.yaml: Added.
395         * stress/big-int-literal-line-terminator.js: Added.
396         * stress/big-int-literals.js: Added.
397         * stress/big-int-operations-error.js: Added.
398         * stress/big-int-type-of.js: Added.
399         * stress/big-int-white-space-trailing-leading.js: Added.
400         * stress/big-int-function-apply.js: Added.
401
402 2017-12-11  Saam Barati  <sbarati@apple.com>
403
404         We need to disableCaching() in ErrorInstance when we materialize properties
405         https://bugs.webkit.org/show_bug.cgi?id=180343
406         <rdar://problem/35833002>
407
408         Reviewed by Mark Lam.
409
410         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
411         (assert):
412         (makeError):
413         (storeToStack):
414         (storeToStackAlreadyMaterialized):
415
416 2017-12-05  JF Bastien  <jfbastien@apple.com>
417
418         WebAssembly: don't eagerly checksum
419         https://bugs.webkit.org/show_bug.cgi?id=180441
420         <rdar://problem/35156628>
421
422         Reviewed by Saam Barati.
423
424         Checksum is now disabled, so tests only have <?> as the module
425         name.
426
427         * wasm/function-tests/nameSection.js:
428         * wasm/function-tests/stack-overflow.js:
429         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
430         (assertOverflows.assertThrows):
431         (assertOverflows):
432         * wasm/function-tests/stack-trace.js:
433
434 2017-12-04  JF Bastien  <jfbastien@apple.com>
435
436         Proxy all functions, except the $ objects
437         https://bugs.webkit.org/show_bug.cgi?id=180375
438
439         Reviewed by Saam Barati.
440
441         It looks like this test may have broken some executions because I
442         call some internal objects. Explicitly ignore objects whose name
443         starts with "$" because it's a bad idea anyways.
444
445         * stress/proxy-all-the-parameters.js:
446         (generateObjects):
447         (get throw):
448
449 2017-12-04  Saam Barati  <sbarati@apple.com>
450
451         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
452         https://bugs.webkit.org/show_bug.cgi?id=180366
453         <rdar://problem/35685877>
454
455         Reviewed by Michael Saboff.
456
457         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
458         (theParent):
459         (test1.base.getParentStaticValue):
460         (test1.base):
461         (test1.__v_24888.prototype.set prop):
462         (test1.__v_24888):
463         (test2.base.getParentStaticValue):
464         (test2.base):
465         (test2.__v_24888.prototype.set prop):
466         (test2.__v_24888):
467         (test2):
468
469 2017-12-01  JF Bastien  <jfbastien@apple.com>
470
471         Try proxying all function arguments
472         https://bugs.webkit.org/show_bug.cgi?id=180306
473
474         Reviewed by Saam Barati.
475
476         * stress/proxy-all-the-parameters.js: Added.
477         (isPropertyOfType):
478         (getProperties):
479         (generateObjects):
480         (getObjects):
481         (getFunctions):
482         (get throw):
483         (let.o.of.getObjects.let.f.of.getFunctions.catch):
484
485 2017-12-01  JF Bastien  <jfbastien@apple.com>
486
487         JavaScriptCore: missing exception checks in Math functions that take more than one argument
488         https://bugs.webkit.org/show_bug.cgi?id=180297
489         <rdar://problem/35745556>
490
491         Reviewed by Mark Lam.
492
493         * stress/math-exceptions.js: Added.
494         (get try):
495         (catch):
496
497 2017-12-01  JF Bastien  <jfbastien@apple.com>
498
499         JavaScriptCore: add test for weird class static getters
500         https://bugs.webkit.org/show_bug.cgi?id=180281
501         <rdar://problem/35592139>
502
503         Reviewed by Mark Lam.
504
505         I fixed a bug for it in r224927 and didn't add a test. Do so.
506
507         * stress/class-static-get-weird.js: Added.
508         (c.prototype.get name):
509         (c):
510         (c.prototype.get arguments):
511         (c.prototype.get caller):
512         (c.prototype.get length):
513
514 2017-12-01  Saam Barati  <sbarati@apple.com>
515
516         Having a bad time needs to handle ArrayClass indexing type as well
517         https://bugs.webkit.org/show_bug.cgi?id=180274
518         <rdar://problem/35667869>
519
520         Reviewed by Keith Miller and Mark Lam.
521
522         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
523         (assert):
524         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
525         (assert):
526
527 2017-12-01  JF Bastien  <jfbastien@apple.com>
528
529         WebAssembly: restore cached stack limit after out-call
530         https://bugs.webkit.org/show_bug.cgi?id=179106
531         <rdar://problem/35337525>
532
533         Reviewed by Saam Barati.
534
535         * wasm/function-tests/double-instance.js: Added.
536         (const.imp.boom):
537         (const.imp.get callAnother):
538
539 2017-11-30  JF Bastien  <jfbastien@apple.com>
540
541         WebAssembly: improve stack trace
542         https://bugs.webkit.org/show_bug.cgi?id=179343
543
544         Reviewed by Saam Barati.
545
546         Update the tests to follow the new format. Notably, SHA1 module
547         hash is now included in traces, and stubs are properly identified.
548
549         * wasm/assert.js: Add an assertion which matches regular expressions.
550         * wasm/function-tests/nameSection.js:
551         * wasm/function-tests/stack-overflow.js:
552         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
553         (assertOverflows.assertThrows.wasm.1):
554         (assertOverflows.assertThrows.wasm.0):
555         (assertOverflows.assertThrows):
556         (assertOverflows):
557         * wasm/function-tests/stack-trace.js:
558         (import.Builder.from.string_appeared_here.assert): Deleted.
559         * wasm/function-tests/trap-after-cross-instance-call.js:
560         (wasmFrameCountFromError):
561         * wasm/function-tests/trap-load-2.js:
562         (wasmFrameCountFromError):
563         * wasm/function-tests/trap-load.js:
564         (wasmFrameCountFromError):
565
566 2017-11-30  Mark Lam  <mark.lam@apple.com>
567
568         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
569         https://bugs.webkit.org/show_bug.cgi?id=180219
570         <rdar://problem/35696536>
571
572         Reviewed by Filip Pizlo.
573
574         * stress/regress-180219.js: Added.
575
576 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
577
578         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
579         https://bugs.webkit.org/show_bug.cgi?id=180190
580
581         Reviewed by Mark Lam.
582
583         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
584         (shouldBe):
585         (test1):
586         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
587         (shouldBe):
588         (test1):
589         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
590         (shouldBe):
591         (test1):
592         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
593         (shouldBe):
594         (test1):
595         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
596         (shouldBe):
597         (test1):
598         * stress/operation-in-may-have-negative-int32.js: Added.
599         (shouldBe):
600         (test2):
601         * stress/operation-in-negative-int32-cast.js: Added.
602         (shouldBe):
603         (test1):
604
605 2017-11-28  JF Bastien  <jfbastien@apple.com>
606
607         Strict and sloppy functions shouldn't share structure
608         https://bugs.webkit.org/show_bug.cgi?id=180103
609         <rdar://problem/35667847>
610
611         Reviewed by Saam Barati.
612
613         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
614         because the IC was wrong.
615         (foo):
616         (bar):
617         (baz):
618         (catch):
619         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
620         in this patch, but may as well test odd strict mode corner cases.
621         (bar):
622         (baz):
623         (catch):
624         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
625         (foo):
626         (bar):
627         (baz):
628         (catch):
629         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
630         next file, but with invalidation of the FunctionExecutable's
631         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
632         slower path.
633         (foo):
634         (bar.const.x):
635         (bar.const.y):
636         (bar):
637         (catch):
638         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
639         strict nesting works correctly.
640         (foo):
641         (bar.baz):
642         (bar):
643         * stress/strict-function-structure.js: Added. The test used to
644         assert in objectProtoFuncHasOwnProperty.
645         (foo):
646         (bar):
647         (baz):
648         * stress/strict-nested-function-structure.js: Added. Nesting.
649         (foo):
650         (bar):
651         (baz.boo):
652         (baz):
653
654 2017-11-29  Robin Morisset  <rmorisset@apple.com>
655
656         The recursive tail call optimisation is wrong on closures
657         https://bugs.webkit.org/show_bug.cgi?id=179835
658
659         Reviewed by Saam Barati.
660
661         * stress/closure-recursive-tail-call.js: Added.
662         (makeClosure):
663
664 2017-11-27  JF Bastien  <jfbastien@apple.com>
665
666         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
667         https://bugs.webkit.org/show_bug.cgi?id=180051
668         <rdar://problem/35614371>
669
670         Reviewed by Saam Barati.
671
672         * stress/rest-parameter-negative.js: Added.
673         (__f_5484):
674         (catch):
675         (__f_5485):
676         (__v_22598.catch):
677
678 2017-11-27  Saam Barati  <sbarati@apple.com>
679
680         Spread can escape when CreateRest does not
681         https://bugs.webkit.org/show_bug.cgi?id=180057
682         <rdar://problem/35676119>
683
684         Reviewed by JF Bastien.
685
686         * stress/spread-escapes-but-create-rest-does-not.js: Added.
687         (assert):
688         (getProperties):
689         (theFunc):
690         (let.obj.valueOf):
691
692 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
693
694         [DFG] Add NormalizeMapKey DFG IR
695         https://bugs.webkit.org/show_bug.cgi?id=179912
696
697         Reviewed by Saam Barati.
698
699         * stress/map-untyped-normalize-cse.js: Added.
700         (shouldBe):
701         (test):
702         * stress/map-untyped-normalize.js: Added.
703         (shouldBe):
704         (test):
705         * stress/set-untyped-normalize-cse.js: Added.
706         (shouldBe):
707         (set return.set has.set has):
708         * stress/set-untyped-normalize.js: Added.
709         (shouldBe):
710         (set return.set has):
711
712 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
713
714         [FTL] Support DeleteById and DeleteByVal
715         https://bugs.webkit.org/show_bug.cgi?id=180022
716
717         Reviewed by Saam Barati.
718
719         * stress/delete-by-id.js: Added.
720         (shouldBe):
721         (test1):
722         (test2):
723         * stress/delete-by-val-ftl.js: Added.
724         (shouldBe):
725         (test1):
726         (test2):
727
728 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
729
730         [DFG] Introduce {Set,Map,WeakMap}Fields
731         https://bugs.webkit.org/show_bug.cgi?id=179925
732
733         Reviewed by Saam Barati.
734
735         * stress/map-set-clobber-map-get.js: Added.
736         (shouldBe):
737         (test):
738         * stress/map-set-does-not-clobber-set-has.js: Added.
739         (shouldBe):
740         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
741         (shouldBe):
742         (test):
743         * stress/set-add-clobber-set-has.js: Added.
744         (shouldBe):
745         * stress/set-add-does-not-clobber-map-get.js: Added.
746         (shouldBe):
747
748 2017-11-24  Mark Lam  <mark.lam@apple.com>
749
750         Move unsafe jsc shell test functions to the $vm object.
751         https://bugs.webkit.org/show_bug.cgi?id=179980
752
753         Reviewed by Yusuke Suzuki.
754
755         * controlFlowProfiler/driver/driver.js:
756         * controlFlowProfiler/execution-count.js:
757         * controlFlowProfiler/if-statement.js:
758         * controlFlowProfiler/loop-statements.js:
759         * controlFlowProfiler/switch-statements.js:
760         * controlFlowProfiler/test-jit.js:
761         * exceptionFuzz/3d-cube.js:
762         * exceptionFuzz/date-format-xparb.js:
763         * exceptionFuzz/earley-boyer.js:
764         * heapProfiler/basic-edges.js:
765         * heapProfiler/property-edge-types.js:
766         * microbenchmarks/try-get-by-id-basic.js:
767         * microbenchmarks/try-get-by-id-polymorphic.js:
768         * modules/namespace-object-try-get.js:
769         * stress/argument-count-bytecode.js:
770         * stress/argument-intrinsic-basic.js:
771         * stress/argument-intrinsic-inlining-use-caller-arg.js:
772         * stress/argument-intrinsic-inlining-with-result-escape.js:
773         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
774         * stress/argument-intrinsic-inlining-with-vararg.js:
775         * stress/argument-intrinsic-nested-inlining.js:
776         * stress/argument-intrinsic-not-convert-to-get-argument.js:
777         * stress/argument-intrinsic-with-stack-write.js:
778         * stress/arity-mismatch-get-argument.js:
779         * stress/array-message-passing.js:
780         * stress/array-push-with-force-exit.js:
781         * stress/check-dom-with-signature.js:
782         * stress/check-sub-class.js:
783         * stress/compare-eq-incomplete-profile.js:
784         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
785         * stress/do-eval-virtual-call-correctly.js:
786         * stress/dom-jit-with-poly-proto.js:
787         * stress/domjit-exception-ic.js:
788         * stress/domjit-exception.js:
789         * stress/domjit-getter-complex-with-incorrect-object.js:
790         * stress/domjit-getter-complex.js:
791         * stress/domjit-getter-poly.js:
792         * stress/domjit-getter-proto.js:
793         * stress/domjit-getter-super-poly.js:
794         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
795         * stress/domjit-getter-type-check.js:
796         * stress/domjit-getter.js:
797         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
798         * stress/for-in-proxy-target-changed-structure.js:
799         * stress/for-in-proxy.js:
800         * stress/generational-opaque-roots.js:
801         * stress/global-const-redeclaration-setting-2.js:
802         * stress/global-const-redeclaration-setting-3.js:
803         * stress/global-const-redeclaration-setting-4.js:
804         * stress/global-const-redeclaration-setting-5.js:
805         * stress/global-const-redeclaration-setting.js:
806         * stress/import-basic.js:
807         * stress/import-from-eval.js:
808         * stress/import-reject-with-exception.js:
809         * stress/import-syntax.js:
810         * stress/impure-get-own-property-slot-inline-cache.js:
811         * stress/is-constructor.js:
812         * stress/istypedarrayview-intrinsic.js:
813         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
814         * stress/jsc-test-functions-should-be-more-robust.js:
815         * stress/object-toString-with-proxy.js:
816         * stress/poly-proto-custom-value-and-accessor.js:
817         * stress/proxy-inline-cache.js:
818         * stress/re-execute-error-module.js:
819         * stress/regress-150532.js:
820         * stress/regress-156992.js:
821         * stress/regress-179619.js:
822         * stress/resources/shadow-chicken-support.js:
823         * stress/runtime-array.js:
824         * stress/sampling-profiler-microtasks.js:
825         * stress/shadow-chicken-enabled.js:
826         * stress/spread-correct-global-object-on-exception.js:
827         * stress/super-get-by-id.js:
828         * stress/tailCallForwardArguments.js:
829         * stress/to-object-intrinsic-boolean-edge.js:
830         * stress/to-object-intrinsic-null-or-undefined-edge.js:
831         * stress/to-object-intrinsic-number-edge.js:
832         * stress/to-object-intrinsic-object-edge.js:
833         * stress/to-object-intrinsic-string-edge.js:
834         * stress/to-object-intrinsic-symbol-edge.js:
835         * stress/to-object-intrinsic.js:
836         * stress/try-catch-custom-getter-as-get-by-id.js:
837         * stress/try-get-by-id-poly-proto.js:
838         * stress/try-get-by-id-should-spill-registers-dfg.js:
839         * stress/try-get-by-id.js:
840         * typeProfiler/arrow-functions.js:
841         * typeProfiler/basic.js:
842         * typeProfiler/captured.js:
843         * typeProfiler/classes.js:
844         * typeProfiler/dfg-jit-optimizations.js:
845         * typeProfiler/dictionary-mode.js:
846         * typeProfiler/es6-block-scoping.js:
847         * typeProfiler/es6-classes.js:
848         * typeProfiler/inheritance.js:
849         * typeProfiler/int52-dfg.js:
850         * typeProfiler/loop.js:
851         * typeProfiler/optional-fields.js:
852         * typeProfiler/overflow.js:
853         * typeProfiler/return.js:
854         * typeProfiler/symbol.js:
855         * typeProfiler/weird-prototype-chain.js:
856
857 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
858
859         [DFG][FTL] Support MapSet / SetAdd intrinsics
860         https://bugs.webkit.org/show_bug.cgi?id=179858
861
862         Reviewed by Saam Barati.
863
864         * microbenchmarks/map-has-and-set.js: Added.
865         (test):
866         * stress/map-set-check-failure.js: Added.
867         (shouldBe):
868         (shouldThrow):
869         (target):
870         * stress/map-set-cse.js: Added.
871         (shouldBe):
872         (test):
873         * stress/set-add-check-failure.js: Added.
874         (shouldBe):
875         (shouldThrow):
876         (set shouldThrow):
877         * stress/set-add-cse.js: Added.
878         (shouldBe):
879
880 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
881
882         [JSC] Allow poly proto for intrinsic getters
883         https://bugs.webkit.org/show_bug.cgi?id=179550
884
885         Reviewed by Saam Barati.
886
887         This change is also tested by existing tests.
888
889             1. stress/intrinsic-getter-with-poly-proto.js
890             2. stress/poly-proto-intrinsic-getter-correctness.js
891
892         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
893         (shouldBe):
894         (makePolyProtoObject.foo.C):
895         (makePolyProtoObject.foo):
896         (makePolyProtoObject):
897         (target):
898         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
899         (shouldBe):
900         (makePolyProtoObject.foo.C):
901         (makePolyProtoObject.foo):
902         (makePolyProtoObject):
903         (target):
904
905 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
906
907         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
908         https://bugs.webkit.org/show_bug.cgi?id=179744
909
910         Reviewed by Michael Catanzaro.
911
912         This test uses too much memory for our buildbots on these platforms
913         and gets OOM-killed.
914
915         * stress/unshiftCountSlowCase-correct-postCapacity.js:
916         Skip if $memoryLimited and linux.
917
918 2017-11-17  JF Bastien  <jfbastien@apple.com>
919
920         WebAssembly JS API: throw when a promise can't be created
921         https://bugs.webkit.org/show_bug.cgi?id=179826
922         <rdar://problem/35455813>
923
924         Reviewed by Mark Lam.
925
926         Test WebAssembly.{compile,instantiate} where promise creation
927         fails because of a stack overflow.
928
929         * wasm/js-api/promise-stack-overflow.js: Added.
930         (const.runNearStackLimit.f.const.t):
931         (async.testCompile):
932         (async.testInstantiate):
933
934 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
935
936         Unreviewed, mark regress-178385.js as memory exhausting
937
938         * stress/regress-178385.js:
939
940 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
941
942         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
943
944         Unreviewed test gardening.
945
946         * test262.yaml:
947
948 2017-11-16  Robin Morisset  <rmorisset@apple.com>
949
950         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
951         https://bugs.webkit.org/show_bug.cgi?id=179763
952         <rdar://problem/35550513>
953
954         Reviewed by Keith Miller.
955
956         Just adding a slightly cleaned-up version of the original fuzzer-found test.
957
958         * stress/tdz-this-in-try-catch.js: Added.
959         (__v_6388):
960         (__v_6392):
961
962 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
963
964         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
965         https://bugs.webkit.org/show_bug.cgi?id=179594
966
967         Reviewed by Saam Barati.
968
969         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
970         (shouldBe):
971         (args):
972         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
973         (shouldBe):
974         (args):
975
976 2017-11-14  Saam Barati  <sbarati@apple.com>
977
978         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
979         https://bugs.webkit.org/show_bug.cgi?id=179639
980         <rdar://problem/35513018>
981
982         Reviewed by JF Bastien.
983
984         * wasm/function-tests/grow-memory-cause-gc.js: Added.
985         (escape):
986         (i.func):
987
988 2017-11-13  Mark Lam  <mark.lam@apple.com>
989
990         Add more overflow check book-keeping for MarkedArgumentBuffer.
991         https://bugs.webkit.org/show_bug.cgi?id=179634
992         <rdar://problem/35492517>
993
994         Reviewed by Saam Barati.
995
996         * stress/regress-179634.js: Added.
997
998 2017-11-13  Mark Lam  <mark.lam@apple.com>
999
1000         Make the jsc shell loadGetterFromGetterSetter() function more robust.
1001         https://bugs.webkit.org/show_bug.cgi?id=179619
1002         <rdar://problem/35492518>
1003
1004         Reviewed by Saam Barati.
1005
1006         * stress/regress-179619.js: Added.
1007
1008 2017-11-12  Mark Lam  <mark.lam@apple.com>
1009
1010         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
1011         https://bugs.webkit.org/show_bug.cgi?id=179562
1012         <rdar://problem/35467022>
1013
1014         Reviewed by Saam Barati.
1015
1016         * regress-179562.js: Added.
1017
1018 2017-11-08  Saam Barati  <sbarati@apple.com>
1019
1020         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
1021         https://bugs.webkit.org/show_bug.cgi?id=177792
1022
1023         Reviewed by Yusuke Suzuki.
1024
1025         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
1026         (assert):
1027         (foo.Foo.prototype.ensureX):
1028         (foo.Foo):
1029         (foo):
1030         (access):
1031
1032 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
1033
1034         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1035         https://bugs.webkit.org/show_bug.cgi?id=178592
1036
1037         Unreviewed test gardening.
1038
1039         * test262.yaml:
1040
1041 2017-11-08  Robin Morisset  <rmorisset@apple.com>
1042
1043         Turn recursive tail calls into loops
1044         https://bugs.webkit.org/show_bug.cgi?id=176601
1045
1046         Reviewed by Saam Barati.
1047
1048         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
1049
1050         Add some simple test that computes factorial in several ways, and other trivial computations.
1051         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1052         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1053         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1054         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1055
1056         * stress/inline-call-to-recursive-tail-call.js: Added.
1057         (factorial.aux):
1058         (factorial):
1059         (factorial2.aux2):
1060         (factorial2.id):
1061         (factorial2):
1062         (factorial3.aux3):
1063         (factorial3):
1064         (aux4):
1065         (factorial4):
1066         (foo):
1067         (auxBar):
1068         (bar):
1069         (test):
1070
1071 2017-11-07  Mark Lam  <mark.lam@apple.com>
1072
1073         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1074         https://bugs.webkit.org/show_bug.cgi?id=179355
1075         <rdar://problem/35263053>
1076
1077         Reviewed by Saam Barati.
1078
1079         * stress/regress-179355.js: Added.
1080
1081 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1082
1083         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1084         https://bugs.webkit.org/show_bug.cgi?id=144458
1085
1086         Reviewed by Saam Barati.
1087
1088         * microbenchmarks/dfg-internal-function-call.js: Added.
1089         (target):
1090         * microbenchmarks/dfg-internal-function-construct.js: Added.
1091         (target):
1092         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1093         (target):
1094         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1095         (target):
1096         * stress/dfg-internal-function-call.js: Added.
1097         (shouldBe):
1098         (target):
1099         * stress/dfg-internal-function-construct.js: Added.
1100         (shouldBe):
1101         (target):
1102         * stress/internal-function-call.js: Added.
1103         (shouldBe):
1104         * stress/internal-function-construct.js: Added.
1105         (shouldBe):
1106
1107 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1108
1109         [Win] Skip stress/regress-178385.js.
1110         https://bugs.webkit.org/show_bug.cgi?id=179298
1111
1112         Unreviewed test gardening.
1113
1114         * stress/regress-178385.js:
1115
1116 2017-11-03  Keith Miller  <keith_miller@apple.com>
1117
1118         Add test for ic with side effects
1119         https://bugs.webkit.org/show_bug.cgi?id=179268
1120
1121         Reviewed by Saam Barati.
1122
1123         * stress/put-inline-cache-side-effects.js: Added.
1124         (let.i.of.objs.keys):
1125         (f):
1126
1127 2017-11-03  Mark Lam  <mark.lam@apple.com>
1128
1129         CachedCall (and its clients) needs overflow checks.
1130         https://bugs.webkit.org/show_bug.cgi?id=179185
1131
1132         Reviewed by JF Bastien.
1133
1134         * stress/regress-179185.js: Added.
1135
1136 2017-11-02  Michael Saboff  <msaboff@apple.com>
1137
1138         DFG needs to handle code motion of code in for..in loop bodies
1139         https://bugs.webkit.org/show_bug.cgi?id=179212
1140
1141         Reviewed by Keith Miller.
1142
1143         New regression test.
1144
1145         * stress/for-in-side-effects.js: Added.
1146         (getPrototypeOf):
1147         (reset):
1148         (testWithoutFTL.f):
1149         (testWithoutFTL):
1150         (testWithFTL.f):
1151         (testWithFTL):
1152
1153 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1154
1155         AI does not correctly model the clobber case of ArithClz32
1156         https://bugs.webkit.org/show_bug.cgi?id=179188
1157
1158         Reviewed by Michael Saboff.
1159
1160         * stress/arith-clz32-effects.js: Added.
1161         (foo):
1162         (valueOf):
1163
1164 2017-11-01  Michael Saboff  <msaboff@apple.com>
1165
1166         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1167         https://bugs.webkit.org/show_bug.cgi?id=179140
1168
1169         Reviewed by Saam Barati.
1170
1171         New regression test.
1172
1173         * stress/regress-179140.js: Added.
1174         (testWithoutFTL):
1175         (testWithFTL):
1176
1177 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1178
1179         [JSC] Introduce @toObject
1180         https://bugs.webkit.org/show_bug.cgi?id=178726
1181
1182         Reviewed by Saam Barati.
1183
1184         * stress/array-copywithin.js:
1185         (shouldThrow):
1186         * stress/object-constructor-boolean-edge.js: Added.
1187         (shouldBe):
1188         (test):
1189         * stress/object-constructor-global.js: Added.
1190         (shouldBe):
1191         * stress/object-constructor-null-edge.js: Added.
1192         (shouldBe):
1193         (test):
1194         * stress/object-constructor-number-edge.js: Added.
1195         (shouldBe):
1196         (test):
1197         * stress/object-constructor-object-edge.js: Added.
1198         (shouldBe):
1199         (test):
1200         (i.arg):
1201         * stress/object-constructor-string-edge.js: Added.
1202         (shouldBe):
1203         (test):
1204         * stress/object-constructor-symbol-edge.js: Added.
1205         (shouldBe):
1206         (test):
1207         * stress/object-constructor-undefined-edge.js: Added.
1208         (shouldBe):
1209         (test):
1210         * stress/symbol-array-from.js: Added.
1211         (shouldBe):
1212         * stress/to-object-intrinsic-boolean-edge.js: Added.
1213         (shouldBe):
1214         (builtin.createBuiltin):
1215         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1216         (shouldThrow):
1217         * stress/to-object-intrinsic-number-edge.js: Added.
1218         (shouldBe):
1219         (builtin.createBuiltin):
1220         * stress/to-object-intrinsic-object-edge.js: Added.
1221         (shouldBe):
1222         (builtin.createBuiltin):
1223         (i.arg):
1224         * stress/to-object-intrinsic-string-edge.js: Added.
1225         (shouldBe):
1226         (builtin.createBuiltin):
1227         * stress/to-object-intrinsic-symbol-edge.js: Added.
1228         (shouldBe):
1229         (builtin.createBuiltin):
1230         * stress/to-object-intrinsic.js: Added.
1231         (shouldBe):
1232         (shouldThrow):
1233         (builtin.createBuiltin):
1234
1235 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1236
1237         [DFG][FTL] Introduce StringSlice
1238         https://bugs.webkit.org/show_bug.cgi?id=178934
1239
1240         Reviewed by Saam Barati.
1241
1242         * microbenchmarks/string-slice-empty.js: Added.
1243         (slice):
1244         * microbenchmarks/string-slice-one-char.js: Added.
1245         (slice):
1246         * microbenchmarks/string-slice.js: Added.
1247         (slice):
1248
1249 2017-10-26  Michael Saboff  <msaboff@apple.com>
1250
1251         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1252         https://bugs.webkit.org/show_bug.cgi?id=178890
1253
1254         Reviewed by Keith Miller.
1255
1256         New regression test.
1257
1258         * stress/regress-178890.js: Added.
1259
1260 2017-10-26  Mark Lam  <mark.lam@apple.com>
1261
1262         JSRopeString::RopeBuilder::append() should check for overflows.
1263         https://bugs.webkit.org/show_bug.cgi?id=178385
1264         <rdar://problem/35027468>
1265
1266         Reviewed by Saam Barati.
1267
1268         * stress/regress-178385.js: Added.
1269
1270 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1271
1272         Unreviewed, rolling out r223961.
1273
1274         The change that required this has been rolled out.
1275
1276         Reverted changeset:
1277
1278         "Mark test262.yaml/test262/test/language/statements/try/tco-
1279         catch.js as passing."
1280         https://bugs.webkit.org/show_bug.cgi?id=178592
1281         https://trac.webkit.org/changeset/223961
1282
1283 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1284
1285         Unreviewed, rolling out r223691 and r223729.
1286         https://bugs.webkit.org/show_bug.cgi?id=178834
1287
1288         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1289         by rniwa on #webkit).
1290
1291         Reverted changesets:
1292
1293         "Turn recursive tail calls into loops"
1294         https://bugs.webkit.org/show_bug.cgi?id=176601
1295         https://trac.webkit.org/changeset/223691
1296
1297         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1298         comparison is always false due to limited range of data type
1299         [-Wtype-limits]"
1300         https://bugs.webkit.org/show_bug.cgi?id=178543
1301         https://trac.webkit.org/changeset/223729
1302
1303 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1304
1305         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1306         https://bugs.webkit.org/show_bug.cgi?id=178592
1307
1308         Unreviewed test gardening.
1309
1310         * test262.yaml:
1311
1312 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1313
1314         [FTL] Support NewStringObject
1315         https://bugs.webkit.org/show_bug.cgi?id=178737
1316
1317         Reviewed by Saam Barati.
1318
1319         * stress/new-string-object.js: Added.
1320         (shouldBe):
1321         (test):
1322
1323 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1324
1325         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1326         https://bugs.webkit.org/show_bug.cgi?id=178308
1327
1328         Reviewed by Mark Lam.
1329
1330         * test262.yaml:
1331
1332 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1333
1334         [JSC] Use fastJoin in Array#toString
1335         https://bugs.webkit.org/show_bug.cgi?id=178062
1336
1337         Reviewed by Darin Adler.
1338
1339         * microbenchmarks/contiguous-array-to-string.js: Added.
1340         (target):
1341         * microbenchmarks/double-array-to-string.js: Added.
1342         (target):
1343         * microbenchmarks/int32-array-to-string.js: Added.
1344         (target):
1345
1346 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1347
1348         stress/check-string-ident.js is improperly skipped
1349         https://bugs.webkit.org/show_bug.cgi?id=178642
1350
1351         Reviewed by Saam Barati.
1352
1353         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1354         since it enforces the run-jsc-stress-tests script to still set up the
1355         test to run, despite the skip directive that's used before.
1356
1357 2017-10-20  Mark Lam  <mark.lam@apple.com>
1358
1359         Add a test case for r214334.
1360         https://bugs.webkit.org/show_bug.cgi?id=169941
1361         <rdar://problem/31221258>
1362
1363         Reviewed by JF Bastien.
1364
1365         * stress/regress-169941.js: Added.
1366
1367 2017-10-19  JF Bastien  <jfbastien@apple.com>
1368
1369         WebAssembly: no VM / JS version of everything but Instance
1370         https://bugs.webkit.org/show_bug.cgi?id=177473
1371
1372         Reviewed by Filip Pizlo, Saam Barati.
1373
1374         - Exceeding max on memory growth now returns a range error as per
1375         spec. This is a (very minor) breaking change: it used to throw OOM
1376         error. Update the corresponding test.
1377
1378         * wasm/js-api/memory-grow.js:
1379         (assertEq):
1380         * wasm/js-api/table.js:
1381         (assert.throws):
1382
1383 2017-10-19  Mark Lam  <mark.lam@apple.com>
1384
1385         Stringifier::appendStringifiedValue() is missing an exception check.
1386         https://bugs.webkit.org/show_bug.cgi?id=178386
1387         <rdar://problem/35027610>
1388
1389         Reviewed by Saam Barati.
1390
1391         * stress/regress-178386.js: Added.
1392
1393 2017-10-19  Michael Saboff  <msaboff@apple.com>
1394
1395         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1396         https://bugs.webkit.org/show_bug.cgi?id=178521
1397
1398         Reviewed by JF Bastien.
1399
1400         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1401         now passes with the current version (5.0) of the Emoji spec.
1402
1403 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1404
1405         Turn recursive tail calls into loops
1406         https://bugs.webkit.org/show_bug.cgi?id=176601
1407
1408         Reviewed by Saam Barati.
1409
1410         Add some simple test that computes factorial in several ways, and other trivial computations.
1411         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1412         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1413         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1414         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1415
1416         * stress/inline-call-to-recursive-tail-call.js: Added.
1417         (factorial.aux):
1418         (factorial):
1419         (factorial2.aux):
1420         (factorial2.id):
1421         (factorial2):
1422         (factorial3.aux):
1423         (factorial3):
1424         (aux):
1425         (factorial4):
1426         (test):
1427
1428 2017-10-18  Mark Lam  <mark.lam@apple.com>
1429
1430         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1431         https://bugs.webkit.org/show_bug.cgi?id=177600
1432         <rdar://problem/34710985>
1433
1434         Reviewed by Saam Barati.
1435
1436         * stress/regress-177600.js: Added.
1437
1438 2017-10-18  Mark Lam  <mark.lam@apple.com>
1439
1440         The compiler should always register a structure when it adds its transitionWatchPointSet.
1441         https://bugs.webkit.org/show_bug.cgi?id=178420
1442         <rdar://problem/34814024>
1443
1444         Reviewed by Saam Barati and Filip Pizlo.
1445
1446         * stress/regress-178420.js: Added.
1447         (new.Array.10000.map):
1448
1449 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1450
1451         [JSC] __proto__ getter should be fast
1452         https://bugs.webkit.org/show_bug.cgi?id=178067
1453
1454         Reviewed by Saam Barati.
1455
1456         * stress/dfg-object-proto-accessor.js: Added.
1457         (shouldBe):
1458         (shouldThrow):
1459         (target):
1460         * stress/dfg-object-proto-getter.js: Added.
1461         (shouldBe):
1462         (shouldThrow):
1463         (target):
1464         * stress/dfg-object-prototype-of.js: Added.
1465         (shouldBe):
1466         (shouldThrow):
1467         (target):
1468         * stress/dfg-reflect-get-prototype-of.js: Added.
1469         (shouldBe):
1470         (shouldThrow):
1471         (target):
1472         * stress/intrinsic-getter-with-poly-proto.js: Added.
1473         (shouldBe):
1474         (makePolyProtoObject.foo.C):
1475         (makePolyProtoObject.foo):
1476         (makePolyProtoObject):
1477         (target):
1478         * stress/object-get-prototype-of-filtered.js: Added.
1479         (shouldBe):
1480         (shouldThrow):
1481         (target):
1482         (i.Cocoa):
1483         * stress/object-get-prototype-of-mono-proto.js: Added.
1484         (shouldBe):
1485         (makePolyProtoObject.foo.C):
1486         (makePolyProtoObject.foo):
1487         (makePolyProtoObject):
1488         (target):
1489         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1490         (shouldBe):
1491         (makePolyProtoObject.foo.C):
1492         (makePolyProtoObject.foo):
1493         (makePolyProtoObject):
1494         (target):
1495         * stress/object-get-prototype-of-poly-proto.js: Added.
1496         (shouldBe):
1497         (makePolyProtoObject.foo.C):
1498         (makePolyProtoObject.foo):
1499         (makePolyProtoObject):
1500         (target):
1501         * stress/object-proto-getter-filtered.js: Added.
1502         (shouldBe):
1503         (shouldThrow):
1504         (target):
1505         (i.Cocoa):
1506         * stress/object-proto-getter-poly-mono-proto.js: Added.
1507         (shouldBe):
1508         (makePolyProtoObject.foo.C):
1509         (makePolyProtoObject.foo):
1510         (makePolyProtoObject):
1511         (target):
1512         * stress/object-proto-getter-poly-proto.js: Added.
1513         (shouldBe):
1514         (makePolyProtoObject.foo.C):
1515         (makePolyProtoObject.foo):
1516         (makePolyProtoObject):
1517         (target):
1518         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1519         * stress/string-proto.js: Added.
1520         (shouldBe):
1521         (target):
1522
1523 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1524
1525         Unreviewed, rolling out r223523.
1526
1527         A test for this change is failing on debug JSC bots.
1528
1529         Reverted changeset:
1530
1531         "[JSC] __proto__ getter should be fast"
1532         https://bugs.webkit.org/show_bug.cgi?id=178067
1533         https://trac.webkit.org/changeset/223523
1534
1535 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1536
1537         [JSC] __proto__ getter should be fast
1538         https://bugs.webkit.org/show_bug.cgi?id=178067
1539
1540         Reviewed by Saam Barati.
1541
1542         * stress/dfg-object-proto-accessor.js: Added.
1543         (shouldBe):
1544         (shouldThrow):
1545         (target):
1546         * stress/dfg-object-proto-getter.js: Added.
1547         (shouldBe):
1548         (shouldThrow):
1549         (target):
1550         * stress/dfg-object-prototype-of.js: Added.
1551         (shouldBe):
1552         (shouldThrow):
1553         (target):
1554         * stress/dfg-reflect-get-prototype-of.js: Added.
1555         (shouldBe):
1556         (shouldThrow):
1557         (target):
1558         * stress/object-get-prototype-of-filtered.js: Added.
1559         (shouldBe):
1560         (shouldThrow):
1561         (target):
1562         (i.Cocoa):
1563         * stress/object-get-prototype-of-mono-proto.js: Added.
1564         (shouldBe):
1565         (makePolyProtoObject.foo.C):
1566         (makePolyProtoObject.foo):
1567         (makePolyProtoObject):
1568         (target):
1569         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1570         (shouldBe):
1571         (makePolyProtoObject.foo.C):
1572         (makePolyProtoObject.foo):
1573         (makePolyProtoObject):
1574         (target):
1575         * stress/object-get-prototype-of-poly-proto.js: Added.
1576         (shouldBe):
1577         (makePolyProtoObject.foo.C):
1578         (makePolyProtoObject.foo):
1579         (makePolyProtoObject):
1580         (target):
1581         * stress/object-proto-getter-filtered.js: Added.
1582         (shouldBe):
1583         (shouldThrow):
1584         (target):
1585         (i.Cocoa):
1586         * stress/object-proto-getter-poly-mono-proto.js: Added.
1587         (shouldBe):
1588         (makePolyProtoObject.foo.C):
1589         (makePolyProtoObject.foo):
1590         (makePolyProtoObject):
1591         (target):
1592         * stress/object-proto-getter-poly-proto.js: Added.
1593         (shouldBe):
1594         (makePolyProtoObject.foo.C):
1595         (makePolyProtoObject.foo):
1596         (makePolyProtoObject):
1597         (target):
1598         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1599         * stress/string-proto.js: Added.
1600         (shouldBe):
1601         (target):
1602
1603 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1604
1605         Reland "Add Above/Below comparisons for UInt32 patterns"
1606         https://bugs.webkit.org/show_bug.cgi?id=177281
1607
1608         Reviewed by Saam Barati.
1609
1610         * stress/uint32-comparison-jump.js: Added.
1611         (shouldBe):
1612         (above):
1613         (aboveOrEqual):
1614         (below):
1615         (belowOrEqual):
1616         (notAbove):
1617         (notAboveOrEqual):
1618         (notBelow):
1619         (notBelowOrEqual):
1620         * stress/uint32-comparison.js: Added.
1621         (shouldBe):
1622         (above):
1623         (aboveOrEqual):
1624         (below):
1625         (belowOrEqual):
1626         (aboveTest):
1627         (aboveOrEqualTest):
1628         (belowTest):
1629         (belowOrEqualTest):
1630
1631 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1632
1633         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1634         https://bugs.webkit.org/show_bug.cgi?id=178210
1635
1636         Reviewed by Saam Barati.
1637
1638         * wasm/function-tests/trap-from-start-async.js:
1639         (async.StartTrapsAsync):
1640         * wasm/function-tests/trap-from-start.js:
1641         (StartTraps):
1642         * wasm/js-api/web-assembly-function.js:
1643         (assert.eq.Object.getPrototypeOf):
1644         * wasm/js-api/wrapper-function.js:
1645         (return.new.WebAssembly.Module):
1646         (assert.throws.makeInstance): Deleted.
1647         (assert.throws.Bar): Deleted.
1648         (assert.throws): Deleted.
1649
1650 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1651
1652         Enable gigacage on iOS
1653         https://bugs.webkit.org/show_bug.cgi?id=177586
1654
1655         Reviewed by JF Bastien.
1656         
1657         Add tests for when Gigacage gets runtime disabled.
1658
1659         * stress/disable-gigacage-arrays.js: Added.
1660         (foo):
1661         * stress/disable-gigacage-strings.js: Added.
1662         (foo):
1663         * stress/disable-gigacage-typed-arrays.js: Added.
1664         (foo):
1665
1666 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1667
1668         import.meta should not be assignable
1669         https://bugs.webkit.org/show_bug.cgi?id=178202
1670
1671         Reviewed by Saam Barati.
1672
1673         * modules/import-meta-assignment.js: Added.
1674         (shouldThrow):
1675         (SyntaxError.import.meta.can.shouldThrow):
1676
1677 2017-10-11  Saam Barati  <sbarati@apple.com>
1678
1679         Unreviewed. Actually skip certain type profiler tests in debug.
1680
1681         * typeProfiler.yaml:
1682         * typeProfiler/deltablue-for-of.js:
1683         * typeProfiler/getter-richards.js:
1684
1685 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1686
1687         Unreviewed, rolling out r223113 and r223121.
1688         https://bugs.webkit.org/show_bug.cgi?id=178182
1689
1690         Reintroduced 20% regression on Kraken (Requested by rniwa on
1691         #webkit).
1692
1693         Reverted changesets:
1694
1695         "Enable gigacage on iOS"
1696         https://bugs.webkit.org/show_bug.cgi?id=177586
1697         https://trac.webkit.org/changeset/223113
1698
1699         "Use one virtual allocation for all gigacages and their
1700         runways"
1701         https://bugs.webkit.org/show_bug.cgi?id=178050
1702         https://trac.webkit.org/changeset/223121
1703
1704 2017-10-11  Michael Saboff  <msaboff@apple.com>
1705
1706         Disable test262 named capture group tests with direct unicode names and with references before definitions
1707         https://bugs.webkit.org/show_bug.cgi?id=178177
1708
1709         Reviewed by Keith Miller.
1710
1711         Bugs to track fixing these test are:
1712         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1713             "Add support in named capture group identifiers for direct surrogate pairs"
1714         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1715             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1716
1717         * test262.yaml:
1718
1719 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1720
1721         Object properties are undefined in super.call() but not in this.call()
1722         https://bugs.webkit.org/show_bug.cgi?id=177230
1723
1724         Reviewed by Saam Barati.
1725
1726         * stress/super-call-function-subclass.js: Added.
1727         (assert):
1728         (A.prototype.t):
1729         (A):
1730         * stress/super-dot-call-and-apply.js: Added.
1731         (assert):
1732         (A):
1733         (A.prototype.call):
1734         (A.prototype.apply):
1735         (B.prototype.testSuper):
1736         (B):
1737         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1738         (D.prototype.testSuper):
1739         (D):
1740
1741 2017-10-10  Saam Barati  <sbarati@apple.com>
1742
1743         The prototype cache should be aware of the Executable it generates a Structure for
1744         https://bugs.webkit.org/show_bug.cgi?id=177907
1745
1746         Reviewed by Filip Pizlo.
1747
1748         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1749         (assert):
1750         (foo.C):
1751         (foo):
1752         (bar.C):
1753         (bar):
1754         (access):
1755         (makeLongChain):
1756         (accessY):
1757
1758 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1759
1760         `async` should be able to be used as an imported binding name
1761         https://bugs.webkit.org/show_bug.cgi?id=176573
1762
1763         Reviewed by Saam Barati.
1764
1765         * modules/import-default-async.js: Added.
1766         * modules/import-named-async-as.js: Added.
1767         * modules/import-named-async.js: Added.
1768         * modules/import-named-async/target.js: Added.
1769         * modules/import-namespace-async.js: Added.
1770         * test262.yaml:
1771
1772 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1773
1774         Enable gigacage on iOS
1775         https://bugs.webkit.org/show_bug.cgi?id=177586
1776
1777         Reviewed by JF Bastien.
1778         
1779         Add tests for when Gigacage gets runtime disabled.
1780
1781         * stress/disable-gigacage-arrays.js: Added.
1782         (foo):
1783         * stress/disable-gigacage-strings.js: Added.
1784         (foo):
1785         * stress/disable-gigacage-typed-arrays.js: Added.
1786         (foo):
1787
1788 2017-10-09  Michael Saboff  <msaboff@apple.com>
1789
1790         Implement RegExp Unicode property escapes
1791         https://bugs.webkit.org/show_bug.cgi?id=172069
1792
1793         Reviewed by JF Bastien.
1794
1795         Enabled Unicode Property tests.
1796
1797         * test262.yaml:
1798
1799 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1800
1801         Unreviewed, rolling out r223015 and r223025.
1802         https://bugs.webkit.org/show_bug.cgi?id=178093
1803
1804         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1805         #webkit).
1806
1807         Reverted changesets:
1808
1809         "Enable gigacage on iOS"
1810         https://bugs.webkit.org/show_bug.cgi?id=177586
1811         http://trac.webkit.org/changeset/223015
1812
1813         "Unreviewed, disable Gigacage on ARM64 Linux"
1814         https://bugs.webkit.org/show_bug.cgi?id=177586
1815         http://trac.webkit.org/changeset/223025
1816
1817 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1818
1819         Update expectations for test262 tests that pass after r223043.
1820         https://bugs.webkit.org/show_bug.cgi?id=176685
1821
1822         Unreviewed test gardening.
1823
1824         * test262.yaml:
1825
1826 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1827
1828         Unreviewed, rolling out r223022.
1829
1830         This change introduced 18 test262 failures.
1831
1832         Reverted changeset:
1833
1834         "`async` should be able to be used as an imported binding
1835         name"
1836         https://bugs.webkit.org/show_bug.cgi?id=176573
1837         http://trac.webkit.org/changeset/223022
1838
1839 2017-10-09  Saam Barati  <sbarati@apple.com>
1840
1841         3 poly-proto JSC tests timing out on debug after r222827
1842         https://bugs.webkit.org/show_bug.cgi?id=177880
1843         <rdar://problem/34817122>
1844
1845         Unreviewed.
1846
1847         I'm skipping these type profiler tests on debug since they are long running.
1848
1849         * typeProfiler/deltablue-for-of.js:
1850         * typeProfiler/getter-richards.js:
1851
1852 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1853
1854         Safari 10 /11 problem with if (!await get(something)).
1855         https://bugs.webkit.org/show_bug.cgi?id=176685
1856
1857         Reviewed by Saam Barati.
1858
1859         * stress/async-await-basic.js:
1860         (awaitEpression.async):
1861         * stress/async-await-syntax.js:
1862         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1863         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1864
1865 2017-10-08  Saam Barati  <sbarati@apple.com>
1866
1867         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1868
1869         * typeProfiler/deltablue-for-of.js:
1870         * typeProfiler/getter-richards.js:
1871
1872 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1873
1874         `async` should be able to be used as an imported binding name
1875         https://bugs.webkit.org/show_bug.cgi?id=176573
1876
1877         Reviewed by Darin Adler.
1878
1879         * modules/import-default-async.js: Added.
1880         * modules/import-named-async-as.js: Added.
1881         * modules/import-named-async.js: Added.
1882         * modules/import-named-async/target.js: Added.
1883         * modules/import-namespace-async.js: Added.
1884
1885 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1886
1887         Enable gigacage on iOS
1888         https://bugs.webkit.org/show_bug.cgi?id=177586
1889
1890         Reviewed by JF Bastien.
1891         
1892         Add tests for when Gigacage gets runtime disabled.
1893
1894         * stress/disable-gigacage-arrays.js: Added.
1895         (foo):
1896         * stress/disable-gigacage-strings.js: Added.
1897         (foo):
1898         * stress/disable-gigacage-typed-arrays.js: Added.
1899         (foo):
1900
1901 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1902
1903         Unreviewed, rolling out r222791 and r222873.
1904         https://bugs.webkit.org/show_bug.cgi?id=178031
1905
1906         Caused crashes with workers/wasm LayoutTests (Requested by
1907         ryanhaddad on #webkit).
1908
1909         Reverted changesets:
1910
1911         "WebAssembly: no VM / JS version of everything but Instance"
1912         https://bugs.webkit.org/show_bug.cgi?id=177473
1913         http://trac.webkit.org/changeset/222791
1914
1915         "WebAssembly: address no VM / JS follow-ups"
1916         https://bugs.webkit.org/show_bug.cgi?id=177887
1917         http://trac.webkit.org/changeset/222873
1918
1919 2017-10-05  Saam Barati  <sbarati@apple.com>
1920
1921         Make sure all prototypes under poly proto get added into the VM's prototype map
1922         https://bugs.webkit.org/show_bug.cgi?id=177909
1923
1924         Reviewed by Keith Miller.
1925
1926         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1927         (assert):
1928         (foo.C):
1929         (foo):
1930         (set x):
1931
1932 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1933
1934         [JSC] Introduce import.meta
1935         https://bugs.webkit.org/show_bug.cgi?id=177703
1936
1937         Reviewed by Filip Pizlo.
1938
1939         * modules/import-meta-syntax.js: Added.
1940         (shouldThrow):
1941         (shouldNotThrow):
1942         * modules/import-meta.js: Added.
1943         * modules/import-meta/cocoa.js: Added.
1944         * modules/resources/assert.js:
1945         (export.shouldNotThrow):
1946         * stress/import-syntax.js:
1947
1948 2017-10-04  Saam Barati  <sbarati@apple.com>
1949
1950         Make pertinent AccessCases watch the poly proto watchpoint
1951         https://bugs.webkit.org/show_bug.cgi?id=177765
1952
1953         Reviewed by Keith Miller.
1954
1955         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1956         (assert):
1957         (foo.C):
1958         (foo):
1959         (validate):
1960         * stress/poly-proto-clear-stub.js: Added.
1961         (assert):
1962         (foo.C):
1963         (foo):
1964
1965 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1966
1967         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1968
1969         Unreviewed test gardening.
1970
1971         * test262.yaml:
1972
1973 2017-10-04  Saam Barati  <sbarati@apple.com>
1974
1975         3 poly-proto JSC tests timing out on debug after r222827
1976         https://bugs.webkit.org/show_bug.cgi?id=177880
1977
1978         Rubber stamped by Mark Lam.
1979
1980         * microbenchmarks/poly-proto-access.js:
1981         * typeProfiler/deltablue-for-of.js:
1982         * typeProfiler/getter-richards.js:
1983
1984 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1985
1986         Unreviewed, marking tco-catch.js as a failure after test262 update
1987         https://bugs.webkit.org/show_bug.cgi?id=177859
1988
1989         * test262.yaml:
1990
1991 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1992
1993         Unreviewed, marking one async iterator test262 test failed
1994         https://bugs.webkit.org/show_bug.cgi?id=177859
1995
1996         * test262.yaml:
1997
1998 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1999
2000         [Test262] Update Test262 to Oct 4 version
2001         https://bugs.webkit.org/show_bug.cgi?id=177859
2002
2003         Reviewed by Sam Weinig.
2004
2005         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
2006         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
2007
2008         * test262.yaml:
2009         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
2010         (checkSequence):
2011         * test262/harness/typeCoercion.js:
2012         (testCoercibleToIndexZero):
2013         (testCoercibleToIndexOne):
2014         (testCoercibleToIndexFromIndex):
2015         (testNotCoercibleToIndex.testPrimitiveValue):
2016         (testNotCoercibleToInteger):
2017         (testCoercibleToBigIntZero.testPrimitiveValue):
2018         (testCoercibleToBigIntZero):
2019         (testCoercibleToBigIntOne.testPrimitiveValue):
2020         (testCoercibleToBigIntOne):
2021         (testPrimitiveValue):
2022         (testCoercibleToBigIntFromBigInt):
2023         (testNotCoercibleToBigInt.testPrimitiveValue):
2024         (testNotCoercibleToBigInt.testStringValue):
2025         (testNotCoercibleToBigInt):
2026         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
2027         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
2028         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
2029         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
2030         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
2031         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
2032         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
2033         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
2034         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
2035         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
2036         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
2037         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
2038         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
2039         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
2040         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
2041         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
2042         (testCoercibleToBigIntZero):
2043         (testCoercibleToBigIntOne):
2044         (testNotCoercibleToBigInt):
2045         (MyError): Deleted.
2046         (valueOf): Deleted.
2047         (toString): Deleted.
2048         (Symbol.toPrimitive): Deleted.
2049         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
2050         (testCoercibleToIndexZero):
2051         (testCoercibleToIndexOne):
2052         (testNotCoercibleToIndex):
2053         (MyError): Deleted.
2054         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
2055         (assert.sameValue.BigInt.asIntN.toString): Deleted.
2056         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
2057         (BigInt.asIntN.valueOf): Deleted.
2058         (BigInt.asIntN.toString): Deleted.
2059         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
2060         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
2061         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
2062         (testCoercibleToBigIntZero):
2063         (testCoercibleToBigIntOne):
2064         (testNotCoercibleToBigInt):
2065         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
2066         (testCoercibleToIndexZero):
2067         (testCoercibleToIndexOne):
2068         (testNotCoercibleToIndex):
2069         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2070         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2071         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2072         (bits.valueOf):
2073         (bigint.valueOf):
2074         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2075         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2076         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2077         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2078         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2079         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2080         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2081         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2082         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2083         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2084         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2085         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2086         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2087         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2088         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2089         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2090         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2091         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2092         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2093         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2094         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2095         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2096         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2097         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2098         (replacer):
2099         (BigInt.prototype.toJSON):
2100         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2101         (replacer):
2102         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2103         (BigInt.prototype.toJSON):
2104         * test262/test/built-ins/JSON/stringify/bigint.js:
2105         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2106         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2107         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2108         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2109         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2110         * test262/test/built-ins/Object/proto-from-ctor.js:
2111         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2112         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2113         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2114         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2115         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2116         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2117         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2118         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2119         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2120         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2121         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2122         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2123         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2124         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2125         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2126         * test262/test/built-ins/Proxy/get-fn-realm.js:
2127         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2128         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2129         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2130         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2131         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2132         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2133         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2134         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2135         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2136         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2137         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2138         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2139         (i6.replace):
2140         (i6b.replace):
2141         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2142         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2143         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2144         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2145         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2146         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2147         * test262/test/built-ins/RegExp/u180e.js: Added.
2148         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2149         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2150         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2151         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2152         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2153         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2154         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2155         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2156         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2157         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2158         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2159         * test262/test/built-ins/String/prototype/endsWith/length.js:
2160         * test262/test/built-ins/String/prototype/endsWith/name.js:
2161         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2162         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2163         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2164         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2165         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2166         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2167         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2168         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2169         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2170         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2171         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2172         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2173         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2174         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2175         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2176         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2177         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2178         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2179         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2180         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2181         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2182         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2183         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2184         * test262/test/built-ins/String/prototype/includes/includes.js:
2185         * test262/test/built-ins/String/prototype/includes/length.js:
2186         * test262/test/built-ins/String/prototype/includes/name.js:
2187         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2188         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2189         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2190         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2191         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2192         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2193         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2194         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2195         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2196         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2197         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2198         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2199         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2200         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2201         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2202         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2203         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2204         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2205         * test262/test/built-ins/String/prototype/trim/u180e.js:
2206         * test262/test/built-ins/Symbol/for/cross-realm.js:
2207         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2208         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2209         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2210         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2211         * test262/test/built-ins/Symbol/match/cross-realm.js:
2212         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2213         * test262/test/built-ins/Symbol/search/cross-realm.js:
2214         * test262/test/built-ins/Symbol/species/cross-realm.js:
2215         * test262/test/built-ins/Symbol/split/cross-realm.js:
2216         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2217         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2218         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2219         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2220         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2221         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2222         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2223         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2224         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2225         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2226         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2227         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2228         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2229         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2230         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2231         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2232         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2233         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2234         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2235         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2236         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2237         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2238         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2239         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2240         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2241         * test262/test/language/eval-code/indirect/realm.js:
2242         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2243         (o.get z):
2244         (o.get a):
2245         * test262/test/language/expressions/call/eval-realm-indirect.js:
2246         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2247         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2248         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2249         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2250         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2251         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2252         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2253         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2254         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2255         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2256         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2257         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2258         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2259         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2260         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2261         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2262         * test262/test/language/expressions/less-than/bigint-and-number.js:
2263         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2264         * test262/test/language/expressions/super/realm.js:
2265         * test262/test/language/expressions/tagged-template/cache-realm.js:
2266         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2267         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2268         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2269         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2270         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2271         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2272         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2273         (o.get z):
2274         (o.get a):
2275         * test262/test/language/statements/for-of/iterator-next-reference.js:
2276         (next):
2277         (iterator.next): Deleted.
2278         (x.of.iterable.): Deleted.
2279         (x.of.iterable.get return): Deleted.
2280         (x.of.iterable.iterator.next): Deleted.
2281         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2282         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2283         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2284         * test262/test/language/white-space/mongolian-vowel-separator.js:
2285         * test262/test262-Revision.txt:
2286
2287 2017-10-03  Saam Barati  <sbarati@apple.com>
2288
2289         Implement polymorphic prototypes
2290         https://bugs.webkit.org/show_bug.cgi?id=176391
2291
2292         Reviewed by Filip Pizlo.
2293
2294         * microbenchmarks/poly-proto-access.js: Added.
2295         (assert):
2296         (foo.C):
2297         (foo.C.prototype.get bar):
2298         (foo):
2299         (bar):
2300         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2301         (assert):
2302         (makePolyProtoObject.foo.C):
2303         (makePolyProtoObject.foo):
2304         (makePolyProtoObject):
2305         (performSet):
2306         * microbenchmarks/poly-proto-setter-speed.js: Added.
2307         (assert):
2308         (makePolyProtoObject.foo.C):
2309         (makePolyProtoObject.foo.C.prototype.set p):
2310         (makePolyProtoObject.foo):
2311         (makePolyProtoObject):
2312         (performSet):
2313         * stress/constructor-with-return.js:
2314         (i.tests.forEach.Constructor):
2315         (i.tests.forEach):
2316         (tests.forEach.Constructor): Deleted.
2317         (tests.forEach): Deleted.
2318         * stress/dom-jit-with-poly-proto.js: Added.
2319         (assert):
2320         (makePolyProtoObject.foo.C):
2321         (makePolyProtoObject.foo):
2322         (makePolyProtoObject):
2323         (validate):
2324         * stress/poly-proto-custom-value-and-accessor.js: Added.
2325         (assert):
2326         (makePolyProtoObject.foo.C):
2327         (makePolyProtoObject.foo):
2328         (makePolyProtoObject):
2329         (items.forEach):
2330         (set get for):
2331         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2332         (assert):
2333         (makePolyProtoObject.foo.C):
2334         (makePolyProtoObject.foo):
2335         (makePolyProtoObject):
2336         (foo):
2337         * stress/poly-proto-miss.js: Added.
2338         (makePolyProtoInstanceWithNullPrototype.foo.C):
2339         (makePolyProtoInstanceWithNullPrototype.foo):
2340         (makePolyProtoInstanceWithNullPrototype):
2341         (assert):
2342         (validate):
2343         * stress/poly-proto-op-in-caching.js: Added.
2344         (assert):
2345         (makePolyProtoObject.foo.C):
2346         (makePolyProtoObject.foo):
2347         (makePolyProtoObject):
2348         (validate):
2349         (validate2):
2350         * stress/poly-proto-put-transition.js: Added.
2351         (assert):
2352         (makePolyProtoObject.foo.C):
2353         (makePolyProtoObject.foo):
2354         (makePolyProtoObject):
2355         (performSet):
2356         (i.obj.__proto__.set p):
2357         * stress/poly-proto-set-prototype.js: Added.
2358         (assert):
2359         (let.alternateProto.get x):
2360         (let.alternateProto2.get y):
2361         (let.alternateProto2.get x):
2362         (foo.C):
2363         (foo):
2364         (validate):
2365         * stress/poly-proto-setter.js: Added.
2366         (assert):
2367         (makePolyProtoObject.foo.C):
2368         (makePolyProtoObject.foo.C.prototype.set p):
2369         (makePolyProtoObject.foo.C.prototype.get p):
2370         (makePolyProtoObject.foo):
2371         (makePolyProtoObject):
2372         (performSet):
2373         * stress/poly-proto-using-inheritance.js: Added.
2374         (assert):
2375         (foo.C):
2376         (foo.C.prototype.get baz):
2377         (foo):
2378         (bar.C):
2379         (bar):
2380         (validate):
2381         * stress/primitive-poly-proto.js: Added.
2382         (makePolyProtoInstance.foo.C):
2383         (makePolyProtoInstance.foo):
2384         (makePolyProtoInstance):
2385         (assert):
2386         (validate):
2387         * stress/prototype-is-not-js-object.js: Added.
2388         (foo.bar):
2389         (foo):
2390         (assert):
2391         (validate):
2392         * stress/try-get-by-id-poly-proto.js: Added.
2393         (assert):
2394         (makePolyProtoObject.foo.C):
2395         (makePolyProtoObject.foo):
2396         (makePolyProtoObject):
2397         (tryGetByIdText):
2398         (x.__proto__.get bar):
2399         (validate):
2400         * typeProfiler/overflow.js:
2401
2402 2017-10-03  JF Bastien  <jfbastien@apple.com>
2403
2404         WebAssembly: no VM / JS version of everything but Instance
2405         https://bugs.webkit.org/show_bug.cgi?id=177473
2406
2407         Reviewed by Filip Pizlo.
2408
2409         - Exceeding max on memory growth now returns a range error as per
2410         spec. This is a (very minor) breaking change: it used to throw OOM
2411         error. Update the corresponding test.
2412
2413         * wasm/js-api/memory-grow.js:
2414         (assertEq):
2415         * wasm/js-api/table.js:
2416         (assert.throws):
2417
2418 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2419
2420         Skip JSC test stress/regress-159779-2.js on debug.
2421         https://bugs.webkit.org/show_bug.cgi?id=177204
2422
2423         Unreviewed test gardening.
2424
2425         * stress/regress-159779-2.js:
2426
2427 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2428
2429         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2430         https://bugs.webkit.org/show_bug.cgi?id=175642
2431
2432         Reviewed by Darin Adler.
2433
2434         * ChakraCore/test/Function/apply3.baseline-jsc:
2435
2436 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2437
2438         Unreviewed, rolling out r222564.
2439         https://bugs.webkit.org/show_bug.cgi?id=177720
2440
2441         "It regressed JetStream by 2% on iOS caused by a 50%
2442         regression on the bigfib subtest" (Requested by saamyjoon on
2443         #webkit).
2444
2445         Reverted changeset:
2446
2447         "Add Above/Below comparisons for UInt32 patterns"
2448         https://bugs.webkit.org/show_bug.cgi?id=177281
2449         http://trac.webkit.org/changeset/222564
2450
2451 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2452
2453         [DFG] Support ArrayPush with multiple args
2454         https://bugs.webkit.org/show_bug.cgi?id=175823
2455
2456         Reviewed by Saam Barati.
2457
2458         * microbenchmarks/array-push-0.js: Added.
2459         (arrayPush0):
2460         * microbenchmarks/array-push-1.js: Added.
2461         (arrayPush1):
2462         * microbenchmarks/array-push-2.js: Added.
2463         (arrayPush2):
2464         * microbenchmarks/array-push-3.js: Added.
2465         (arrayPush3):
2466         * stress/array-push-multiple-contiguous.js: Added.
2467         (shouldBe):
2468         (test):
2469         * stress/array-push-multiple-double-nan.js: Added.
2470         (shouldBe):
2471         (test):
2472         * stress/array-push-multiple-double.js: Added.
2473         (shouldBe):
2474         (test):
2475         * stress/array-push-multiple-int32.js: Added.
2476         (shouldBe):
2477         (test):
2478         * stress/array-push-multiple-many-contiguous.js: Added.
2479         (shouldBe):
2480         (test):
2481         * stress/array-push-multiple-many-double.js: Added.
2482         (shouldBe):
2483         (test):
2484         * stress/array-push-multiple-many-int32.js: Added.
2485         (shouldBe):
2486         (test):
2487         * stress/array-push-multiple-many-storage.js: Added.
2488         (shouldBe):
2489         (test):
2490         * stress/array-push-multiple-storage.js: Added.
2491         (shouldBe):
2492         (test):
2493         * stress/array-push-with-force-exit.js: Added.
2494         (target.createBuiltin):
2495
2496 2017-09-29  Saam Barati  <sbarati@apple.com>
2497
2498         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2499         https://bugs.webkit.org/show_bug.cgi?id=177639
2500
2501         Reviewed by Geoffrey Garen.
2502
2503         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2504         (assert):
2505         (Class):
2506         (items.forEach):
2507         (set get for):
2508
2509 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2510
2511         Unreviewed, rolling out r222563, r222565, and r222581.
2512         https://bugs.webkit.org/show_bug.cgi?id=177675
2513
2514         "It causes a crash when playing youtube videos" (Requested by
2515         saamyjoon on #webkit).
2516
2517         Reverted changesets:
2518
2519         "[DFG] Support ArrayPush with multiple args"
2520         https://bugs.webkit.org/show_bug.cgi?id=175823
2521         http://trac.webkit.org/changeset/222563
2522
2523         "Unreviewed, build fix after r222563"
2524         https://bugs.webkit.org/show_bug.cgi?id=175823
2525         http://trac.webkit.org/changeset/222565
2526
2527         "Unreviewed, fix x86 breaking due to exhausted registers"
2528         https://bugs.webkit.org/show_bug.cgi?id=175823
2529         http://trac.webkit.org/changeset/222581
2530
2531 2017-09-28  Mark Lam  <mark.lam@apple.com>
2532
2533         test262: Unexpected passes after r222617 and r222618.
2534         https://bugs.webkit.org/show_bug.cgi?id=177622
2535         <rdar://problem/34725960>
2536
2537         Reviewed by Saam Barati.
2538
2539         Update test262.yaml for tests that are now passing.
2540
2541         * test262.yaml:
2542
2543 2017-09-27  Michael Saboff  <msaboff@apple.com>
2544
2545         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2546         https://bugs.webkit.org/show_bug.cgi?id=177570
2547
2548         Reviewed by Filip Pizlo.
2549
2550         New regression test.
2551
2552         * stress/regress-177570.js: Added.
2553
2554 2017-09-28  Michael Saboff  <msaboff@apple.com>
2555
2556         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2557         https://bugs.webkit.org/show_bug.cgi?id=177423
2558
2559         Reviewed by Mark Lam.
2560
2561         Updated regression test.
2562
2563         * stress/regress-177423.js:
2564         (catch):
2565
2566 2017-09-27  Mark Lam  <mark.lam@apple.com>
2567
2568         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2569         https://bugs.webkit.org/show_bug.cgi?id=177584
2570         <rdar://problem/34463903>
2571
2572         Reviewed by Saam Barati.
2573
2574         * stress/regress-177584.js: Added.
2575         (assertEqual):
2576         (Array.prototype.Symbol.species):
2577
2578 2017-09-27  Saam Barati  <sbarati@apple.com>
2579
2580         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2581         https://bugs.webkit.org/show_bug.cgi?id=177523
2582
2583         Reviewed by Mark Lam.
2584
2585         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2586         (assert):
2587         (Test):
2588         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2589         (addMethods):
2590         (i.Test.prototype.propName):
2591
2592 2017-09-27  Mark Lam  <mark.lam@apple.com>
2593
2594         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2595         https://bugs.webkit.org/show_bug.cgi?id=177423
2596         <rdar://problem/34621320>
2597
2598         Reviewed by Keith Miller.
2599
2600         * stress/regress-177423.js: Added.
2601
2602 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2603
2604         Add Above/Below comparisons for UInt32 patterns
2605         https://bugs.webkit.org/show_bug.cgi?id=177281
2606
2607         Reviewed by Saam Barati.
2608
2609         * stress/uint32-comparison-jump.js: Added.
2610         (shouldBe):
2611         (above):
2612         (aboveOrEqual):
2613         (below):
2614         (belowOrEqual):
2615         (notAbove):
2616         (notAboveOrEqual):
2617         (notBelow):
2618         (notBelowOrEqual):
2619         * stress/uint32-comparison.js: Added.
2620         (shouldBe):
2621         (above):
2622         (aboveOrEqual):
2623         (below):
2624         (belowOrEqual):
2625         (aboveTest):
2626         (aboveOrEqualTest):
2627         (belowTest):
2628         (belowOrEqualTest):
2629
2630 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2631
2632         [DFG] Support ArrayPush with multiple args
2633         https://bugs.webkit.org/show_bug.cgi?id=175823
2634
2635         Reviewed by Saam Barati.
2636
2637         * microbenchmarks/array-push-0.js: Added.
2638         (arrayPush0):
2639         * microbenchmarks/array-push-1.js: Added.
2640         (arrayPush1):
2641         * microbenchmarks/array-push-2.js: Added.
2642         (arrayPush2):
2643         * microbenchmarks/array-push-3.js: Added.
2644         (arrayPush3):
2645         * stress/array-push-multiple-contiguous.js: Added.
2646         (shouldBe):
2647         (test):
2648         * stress/array-push-multiple-double-nan.js: Added.
2649         (shouldBe):
2650         (test):
2651         * stress/array-push-multiple-double.js: Added.
2652         (shouldBe):
2653         (test):
2654         * stress/array-push-multiple-int32.js: Added.
2655         (shouldBe):
2656         (test):
2657         * stress/array-push-multiple-many-contiguous.js: Added.
2658         (shouldBe):
2659         (test):
2660         * stress/array-push-multiple-many-double.js: Added.
2661         (shouldBe):
2662         (test):
2663         * stress/array-push-multiple-many-int32.js: Added.
2664         (shouldBe):
2665         (test):
2666         * stress/array-push-multiple-many-storage.js: Added.
2667         (shouldBe):
2668         (test):
2669         * stress/array-push-multiple-storage.js: Added.
2670         (shouldBe):
2671         (test):
2672
2673 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2674
2675         Unreviewed, rolling out r222518.
2676         https://bugs.webkit.org/show_bug.cgi?id=177507
2677
2678         Break the High Sierra build (Requested by yusukesuzuki on
2679         #webkit).
2680
2681         Reverted changeset:
2682
2683         "Add Above/Below comparisons for UInt32 patterns"
2684         https://bugs.webkit.org/show_bug.cgi?id=177281
2685         http://trac.webkit.org/changeset/222518
2686
2687 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2688
2689         Add Above/Below comparisons for UInt32 patterns
2690         https://bugs.webkit.org/show_bug.cgi?id=177281
2691
2692         Reviewed by Saam Barati.
2693
2694         * stress/uint32-comparison-jump.js: Added.
2695         (shouldBe):
2696         (above):
2697         (aboveOrEqual):
2698         (below):
2699         (belowOrEqual):
2700         (notAbove):
2701         (notAboveOrEqual):
2702         (notBelow):
2703         (notBelowOrEqual):
2704         * stress/uint32-comparison.js: Added.
2705         (shouldBe):
2706         (above):
2707         (aboveOrEqual):
2708         (below):
2709         (belowOrEqual):
2710         (aboveTest):
2711         (aboveOrEqualTest):
2712         (belowTest):
2713         (belowOrEqualTest):
2714
2715 2017-09-23  Keith Miller  <keith_miller@apple.com>
2716
2717         Fix infinite looping test262 test
2718         https://bugs.webkit.org/show_bug.cgi?id=177412
2719
2720         Reviewed by Yusuke Suzuki.
2721
2722         This test was poorly designed since failing it would cause the vm
2723         to inifinite loop. I've fixed it locally and will fix it on github pending
2724         the results of next weeks tc39 meeting.
2725
2726         * test262.yaml:
2727         * test262/test/language/statements/for-of/iterator-next-reference.js:
2728
2729 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2730
2731         test262: $.agent became $262.agent in test262 update
2732         https://bugs.webkit.org/show_bug.cgi?id=177407
2733
2734         Reviewed by Yusuke Suzuki.
2735
2736         * test262.yaml:
2737         ~320 tests pass now that we correctly make $262 available.
2738
2739 2017-09-22  Keith Miller  <keith_miller@apple.com>
2740
2741         Speculatively change iteration protocall to use the same next function
2742         https://bugs.webkit.org/show_bug.cgi?id=175653
2743
2744         Reviewed by Saam Barati.
2745
2746         Change test to match the new iteration behavior.
2747
2748         * stress/spread-optimized-properly.js:
2749
2750 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2751
2752         [DFG][FTL] Profile array vector length for array allocation
2753         https://bugs.webkit.org/show_bug.cgi?id=177051
2754
2755         Reviewed by Saam Barati.
2756
2757         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2758         (target):
2759
2760 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2761
2762         Unreviewed, rolling out r222380.
2763         https://bugs.webkit.org/show_bug.cgi?id=177352
2764
2765         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2766         #webkit).
2767
2768         Reverted changeset:
2769
2770         "[DFG][FTL] Profile array vector length for array allocation"
2771         https://bugs.webkit.org/show_bug.cgi?id=177051
2772         http://trac.webkit.org/changeset/222380
2773
2774 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2775
2776         [DFG][FTL] Profile array vector length for array allocation
2777         https://bugs.webkit.org/show_bug.cgi?id=177051
2778
2779         Reviewed by Saam Barati.
2780
2781         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2782         (target):
2783
2784 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2785
2786         Skip new hanging test262 tests.
2787         https://bugs.webkit.org/show_bug.cgi?id=177326
2788
2789         Unreviewed test gardening.
2790
2791         * test262.yaml:
2792
2793 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2794
2795         Mark 6 test262 tests as passing.
2796         https://bugs.webkit.org/show_bug.cgi?id=177307
2797
2798         Unreviewed test gardening.
2799
2800         * test262.yaml:
2801
2802 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2803
2804         Unreviewed follow-up to r222311.
2805
2806         * test262/harness/sta.js:
2807         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2808         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2809         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2810         * test262/test/built-ins/Array/from/elements-added-after.js:
2811         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2812         * test262/test/built-ins/Array/from/elements-updated-after.js:
2813         * test262/test/built-ins/Array/from/from-array.js:
2814         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2815         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2816         * test262/test/built-ins/Array/from/source-array-boundary.js:
2817         * test262/test/built-ins/Array/from/source-object-constructor.js:
2818         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2819         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2820         * test262/test/built-ins/Array/from/source-object-length.js:
2821         * test262/test/built-ins/Array/from/source-object-missing.js:
2822         * test262/test/built-ins/Array/from/source-object-without.js:
2823         * test262/test/built-ins/Array/from/this-null.js:
2824         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2825         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2826         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2827         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2828         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2829         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2830         * test262/test/language/literals/string/7.8.4-1gs.js:
2831         Fix some files that I failed to update when I applied my patch.
2832
2833 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2834
2835         Update test262 tests
2836         https://bugs.webkit.org/show_bug.cgi?id=177220
2837
2838         Reviewed by Saam Barati and Yusuke Suzuki.
2839
2840         * test262.yaml:
2841         * test262/test262-Revision.txt:
2842         New rebaselined expectations for all tests.
2843
2844         * test262/*:
2845         Updated.
2846
2847 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2848
2849         [DFG] Remove ToThis more aggressively
2850         https://bugs.webkit.org/show_bug.cgi?id=177056
2851
2852         Reviewed by Saam Barati.
2853
2854         * stress/generator-with-this-strict.js: Added.
2855         (shouldBe):
2856         (generator):
2857         (target):
2858         * stress/generator-with-this.js: Added.
2859         (shouldBe):
2860         (generator):
2861         (target):
2862
2863 2017-09-17  Michael Saboff  <msaboff@apple.com>
2864
2865         https://bugs.webkit.org/show_bug.cgi?id=177038
2866         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2867
2868         Reviewed by JF Bastien.
2869
2870         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2871         as it dies using too much memory.
2872
2873 2017-09-15  Saam Barati  <sbarati@apple.com>
2874
2875         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2876         https://bugs.webkit.org/show_bug.cgi?id=176981
2877
2878         Reviewed by Yusuke Suzuki.
2879
2880         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2881         (assert):
2882         (verify):
2883         (func):
2884         (const.bar.createBuiltin):
2885
2886 2017-09-14  Saam Barati  <sbarati@apple.com>
2887
2888         It should be valid to exit before each set when doing arity fixup when inlining
2889         https://bugs.webkit.org/show_bug.cgi?id=176948
2890
2891         Reviewed by Keith Miller.
2892
2893         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2894         (baz):
2895         (bar):
2896         (foo):
2897
2898 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2899
2900         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2901         https://bugs.webkit.org/show_bug.cgi?id=176867
2902
2903         Reviewed by Sam Weinig.
2904
2905         * microbenchmarks/object-get-own-property-symbols.js: Added.
2906         (test):
2907
2908 2017-09-13  Mark Lam  <mark.lam@apple.com>
2909
2910         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2911         https://bugs.webkit.org/show_bug.cgi?id=176888
2912         <rdar://problem/34381832>
2913
2914         Not reviewed.
2915
2916         * stress/op_mod-ConstVar.js:
2917         * stress/op_mod-VarConst.js:
2918         * stress/op_mod-VarVar.js:
2919
2920 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2921
2922         Skip 3 op_mod tests on Debug JSC bots.
2923         https://bugs.webkit.org/show_bug.cgi?id=176630
2924
2925         Unreviewed test gardening.
2926
2927         * stress/op_mod-ConstVar.js:
2928         * stress/op_mod-VarConst.js:
2929         * stress/op_mod-VarVar.js:
2930
2931 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2932
2933         [JSC] Fix Array allocation in Object.keys
2934         https://bugs.webkit.org/show_bug.cgi?id=176826
2935
2936         Reviewed by Saam Barati.
2937
2938         * stress/object-own-property-keys.js: Added.
2939         (shouldBe):
2940
2941 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2942
2943         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2944         https://bugs.webkit.org/show_bug.cgi?id=176010
2945
2946         Reviewed by Filip Pizlo.
2947
2948         * microbenchmarks/weak-map-key.js: Added.
2949         (assert):
2950         (objectKey):
2951         (let.start.Date.now):
2952
2953 2017-09-12  Mark Lam  <mark.lam@apple.com>
2954
2955         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2956         https://bugs.webkit.org/show_bug.cgi?id=176630
2957
2958         Reviewed by JF Bastien.
2959
2960         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2961         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2962         a speculative fix for the bots that are seeing these fail.
2963
2964         I also undid the skipping of the op_mod tests for debug builds.
2965
2966         * stress/op_div-ConstVar.js:
2967         * stress/op_div-VarConst.js:
2968         * stress/op_div-VarVar.js:
2969         * stress/op_mod-ConstVar.js:
2970         * stress/op_mod-VarConst.js:
2971         * stress/op_mod-VarVar.js:
2972
2973 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2974
2975         Skip stress/value-to-boolean.js on Debug bots.
2976         https://bugs.webkit.org/show_bug.cgi?id=176787
2977
2978         Unreviewed test gardening.
2979
2980         * stress/value-to-boolean.js:
2981
2982 2017-09-11  Mark Lam  <mark.lam@apple.com>
2983
2984         Change test expectation for test262/test/language/statements/try/tco-catch.js
2985         https://bugs.webkit.org/show_bug.cgi?id=176749
2986
2987         Rubber stamped by Keith Miller.
2988
2989         It's been failing since at least r221821.  I'm changing the test expectation to
2990         fail to green the bots while I investigate some more.
2991
2992         * test262.yaml:
2993
2994 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2995
2996         Unreviewed, rolling out r221854.
2997
2998         The test added with this change fails on 32-bit JSC bots.
2999
3000         Reverted changeset:
3001
3002         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
3003         https://bugs.webkit.org/show_bug.cgi?id=176010
3004         http://trac.webkit.org/changeset/221854
3005
3006 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3007
3008         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3009         https://bugs.webkit.org/show_bug.cgi?id=176010
3010
3011         Reviewed by Filip Pizlo.
3012
3013         * microbenchmarks/weak-map-key.js: Added.
3014         (assert):
3015         (objectKey):
3016         (let.start.Date.now):
3017
3018 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3019
3020         [JSC] Optimize Object.keys by using careful array allocation
3021         https://bugs.webkit.org/show_bug.cgi?id=176654
3022
3023         Reviewed by Darin Adler.
3024
3025         * microbenchmarks/object-keys.js: Added.
3026         (test):
3027
3028 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
3029
3030         Error should compute .stack and friends lazily
3031         https://bugs.webkit.org/show_bug.cgi?id=176645
3032
3033         Reviewed by Saam Barati.
3034
3035         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
3036         * microbenchmarks/new-error.js: Added.
3037         * microbenchmarks/throw.js: Added.
3038
3039 2017-09-09  Mark Lam  <mark.lam@apple.com>
3040
3041         [Re-landing] Use JIT probes for DFG OSR exit.
3042         https://bugs.webkit.org/show_bug.cgi?id=175144
3043         <rdar://problem/33437050>
3044
3045         Not reviewed.  Original patch reviewed by Saam Barati.
3046
3047         Disable these tests for debug builds because they run too slow with the new OSR exit.
3048
3049         * stress/op_mod-ConstVar.js:
3050         * stress/op_mod-VarConst.js:
3051         * stress/op_mod-VarVar.js:
3052
3053 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3054
3055         [DFG] NewArrayWithSize(size)'s size does not care negative zero
3056         https://bugs.webkit.org/show_bug.cgi?id=176300
3057
3058         Reviewed by Saam Barati.
3059
3060         * stress/new-array-with-size-div.js: Added.
3061         (shouldBe):
3062         (test):
3063         (i.i):
3064
3065 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3066
3067         [DFG] PutByVal with Array::Generic is too generic
3068         https://bugs.webkit.org/show_bug.cgi?id=176345
3069
3070         Reviewed by Filip Pizlo.
3071
3072         * stress/object-assign-symbols.js: Added.
3073         (shouldBe):
3074         (test):
3075         * stress/object-assign.js: Added.
3076         (shouldBe):
3077         (test):
3078         (i.shouldBe.JSON.stringify.test):
3079
3080 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3081
3082         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3083         https://bugs.webkit.org/show_bug.cgi?id=176590
3084
3085         Reviewed by Saam Barati.
3086
3087         * microbenchmarks/object-iterate-symbols.js: Added.
3088         (test):
3089         * microbenchmarks/object-iterate.js: Added.
3090         (test):
3091         * stress/object-iterate-symbols.js: Added.
3092         (shouldBe):
3093         (test):
3094         * stress/object-iterate.js: Added.
3095         (shouldBe):
3096         (test):
3097
3098 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3099
3100         [Win32] 10 JSC stress tests are failing.
3101         https://bugs.webkit.org/show_bug.cgi?id=176538
3102
3103         Reviewed by Mark Lam.
3104
3105         Skip tests on Windows to make the bots green.
3106
3107         * ChakraCore.yaml:
3108         * stress/date-relaxed.js:
3109
3110 2017-09-06  Mark Lam  <mark.lam@apple.com>
3111
3112         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3113         https://bugs.webkit.org/show_bug.cgi?id=176485
3114         <rdar://problem/33898874>
3115
3116         Reviewed by Keith Miller.
3117
3118         * stress/regress-176485.js: Added.
3119
3120 2017-09-05  Saam Barati  <sbarati@apple.com>
3121
3122         isNotCellSpeculation is wrong with respect to SpecEmpty
3123         https://bugs.webkit.org/show_bug.cgi?id=176429
3124
3125         Reviewed by Michael Saboff.
3126
3127         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3128         (Foo):
3129
3130 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3131
3132         test262: Completion values for control flow do not match the spec
3133         https://bugs.webkit.org/show_bug.cgi?id=171265
3134
3135         Reviewed by Saam Barati.
3136
3137         * stress/completion-value.js:
3138         Condensed test for completion values in top level statements.
3139
3140         * stress/super-get-by-id.js:
3141         ClassDeclaration when evaled no longer produce values. Convert
3142         these to ClassExpressions so they produce the class value.
3143         
3144         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3145         This is a progression for currect spec behavior.
3146
3147         * mozilla/mozilla-tests.yaml:
3148         This test is now outdated, so mark it as failing for that reason.
3149
3150         * test262.yaml:
3151         Passing all "cptn" completion value tests.
3152
3153 2017-09-04  Saam Barati  <sbarati@apple.com>
3154
3155         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3156         https://bugs.webkit.org/show_bug.cgi?id=176317
3157
3158         Reviewed by Keith Miller.
3159
3160         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3161         (Foo):
3162
3163 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3164
3165         [DFG][FTL] Efficiently execute number#toString()
3166         https://bugs.webkit.org/show_bug.cgi?id=170007
3167
3168         Reviewed by Keith Miller.
3169
3170         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3171         (test):
3172         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3173         (test):
3174         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3175         (test):
3176         * microbenchmarks/number-to-string-with-radix.js: Added.
3177         (test):
3178         * stress/number-to-string-strength-reduction.js: Added.
3179         (shouldBe):
3180         (test):
3181         * stress/number-to-string-with-radix-10.js: Added.
3182         (shouldBe):
3183         (test):
3184         * stress/number-to-string-with-radix-cse.js: Added.
3185         (shouldBe):
3186         (test):
3187         * stress/number-to-string-with-radix-invalid.js: Added.
3188         (shouldThrow):
3189         * stress/number-to-string-with-radix-watchpoint.js: Added.
3190         (shouldBe):
3191         (test):
3192         (i.i.1e3.Number.prototype.toString):
3193         * stress/number-to-string-with-radix.js: Added.
3194         (shouldBe):
3195         (test):
3196
3197 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3198
3199         [DFG] Relax arity requirement
3200         https://bugs.webkit.org/show_bug.cgi?id=175523
3201
3202         Reviewed by Saam Barati.
3203
3204         * stress/arity-mismatch-arguments-length.js: Added.
3205         (shouldBe):
3206         (test1):
3207         (test):
3208         * stress/arity-mismatch-get-argument.js: Added.
3209         (shouldBe):
3210         (builtin.createBuiltin):
3211         (test):
3212         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3213         (shouldBe):
3214         (inlineTarget):
3215         (test):
3216         * stress/arity-mismatch-inlining.js: Added.
3217         (shouldBe):
3218         (inlineTarget):
3219         (test):
3220         * stress/arity-mismatch-rest.js: Added.
3221         (shouldBe):
3222         (test2):
3223         (test1):
3224         (test):
3225
3226 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3227
3228         [JSC] Fix "name" and "length" of Proxy revoke function
3229         https://bugs.webkit.org/show_bug.cgi?id=176155
3230
3231         Reviewed by Mark Lam.
3232
3233         * test262.yaml:
3234
3235 2017-08-31  Saam Barati  <sbarati@apple.com>
3236
3237         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3238         https://bugs.webkit.org/show_bug.cgi?id=176206
3239
3240         Reviewed by Keith Miller.
3241
3242         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3243         (a):
3244         (b):
3245         (foo):
3246
3247 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3248
3249         Skip two slow JSC tests after r221422.
3250
3251         Unreviewed test gardening.
3252
3253         * stress/regexp-prototype-match-on-too-long-rope.js:
3254         * stress/regexp-prototype-test-on-too-long-rope.js:
3255
3256 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3257
3258         Unreviewed, skipping slow tests.
3259         
3260         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3261         work differently now.
3262
3263         * stress/regexp-prototype-exec-on-too-long-rope.js:
3264         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3265
3266 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3267
3268         [JSC] Use reifying system for "name" property of builtin JSFunction
3269         https://bugs.webkit.org/show_bug.cgi?id=175260
3270
3271         Reviewed by Saam Barati.
3272
3273         * stress/accessors-get-set-prefix.js:
3274         * stress/builtin-function-name.js: Added.
3275         (shouldBe):
3276         (shouldThrow):
3277         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3278         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3279         * stress/private-name-as-anonymous-builtin.js: Added.
3280         (shouldBe):
3281         (NotPromise):
3282
3283 2017-08-30  Saam Barati  <sbarati@apple.com>
3284
3285         Unreviewed. Make test stop printing.
3286
3287         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3288
3289 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3290
3291         Unreviewed, rolling out r221327.
3292
3293         This change caused test262 failures.
3294
3295         Reverted changeset:
3296
3297         "[JSC] Use reifying system for "name" property of builtin
3298         JSFunction"
3299         https://bugs.webkit.org/show_bug.cgi?id=175260
3300         http://trac.webkit.org/changeset/221327
3301
3302 2017-08-30  Saam Barati  <sbarati@apple.com>
3303
3304         semicolon is being interpreted as an = in the LiteralParser
3305         https://bugs.webkit.org/show_bug.cgi?id=176114
3306
3307         Reviewed by Oliver Hunt.
3308
3309         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3310         * stress/resources/literal-parser-test-case.js: Added.
3311
3312 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3313
3314         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3315         https://bugs.webkit.org/show_bug.cgi?id=166698
3316
3317         Reviewed by Yusuke Suzuki.
3318
3319         * stress/async-iteration-for-await-of-syntax.js: Added.
3320         (assert):
3321         (checkSyntax):
3322         (checkSyntaxError):
3323         (checkSimpleAsyncGeneratorSloppyMode):
3324         (checkSimpleAsyncGeneratorStrictMode):
3325         (checkNestedAsyncGenerators):
3326         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3327         * stress/async-iteration-for-await-of.js: Added.
3328         (assert):
3329         (async.foo):
3330         (async.boo):
3331         (const.boo.async):
3332
3333 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3334
3335         [JSC] Use reifying system for "name" property of builtin JSFunction
3336         https://bugs.webkit.org/show_bug.cgi?id=175260
3337
3338         Reviewed by Saam Barati.
3339
3340         * stress/accessors-get-set-prefix.js:
3341         * stress/builtin-function-name.js: Added.
3342         (shouldBe):
3343         (shouldThrow):
3344         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3345         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3346
3347 2017-08-25  Saam Barati  <sbarati@apple.com>
3348
3349         Support compiling catch in the DFG
3350         https://bugs.webkit.org/show_bug.cgi?id=174590
3351         <rdar://problem/34047845>
3352
3353         Reviewed by Filip Pizlo.
3354
3355         * microbenchmarks/delta-blue-try-catch.js: Added.
3356         (exception):
3357         (value):
3358         (OrderedCollection):
3359         (OrderedCollection.prototype.add):
3360         (OrderedCollection.prototype.at):
3361         (OrderedCollection.prototype.size):
3362         (OrderedCollection.prototype.removeFirst):
3363         (OrderedCollection.prototype.remove):
3364         (Strength):
3365         (Strength.stronger):
3366         (Strength.weaker):
3367         (Strength.weakestOf):
3368         (Strength.strongest):
3369         (Strength.prototype.nextWeaker):
3370         (Constraint):
3371         (Constraint.prototype.addConstraint):
3372         (Constraint.prototype.satisfy):
3373         (Constraint.prototype.destroyConstraint):
3374         (Constraint.prototype.isInput):
3375         (UnaryConstraint):
3376         (UnaryConstraint.prototype.addToGraph):
3377         (UnaryConstraint.prototype.chooseMethod):
3378         (UnaryConstraint.prototype.isSatisfied):
3379         (UnaryConstraint.prototype.markInputs):
3380         (UnaryConstraint.prototype.output):
3381         (UnaryConstraint.prototype.recalculate):
3382         (UnaryConstraint.prototype.markUnsatisfied):
3383         (UnaryConstraint.prototype.inputsKnown):
3384         (UnaryConstraint.prototype.removeFromGraph):
3385         (StayConstraint):
3386         (StayConstraint.prototype.execute):
3387         (EditConstraint.prototype.isInput):
3388         (EditConstraint.prototype.execute):
3389         (BinaryConstraint):
3390         (BinaryConstraint.prototype.chooseMethod):
3391         (BinaryConstraint.prototype.addToGraph):
3392         (BinaryConstraint.prototype.isSatisfied):
3393         (BinaryConstraint.prototype.markInputs):
3394         (BinaryConstraint.prototype.input):
3395         (BinaryConstraint.prototype.output):
3396         (BinaryConstraint.prototype.recalculate):
3397         (BinaryConstraint.prototype.markUnsatisfied):
3398         (BinaryConstraint.prototype.inputsKnown):
3399         (BinaryConstraint.prototype.removeFromGraph):
3400         (ScaleConstraint):
3401         (ScaleConstraint.prototype.addToGraph):
3402         (ScaleConstraint.prototype.removeFromGraph):
3403         (ScaleConstraint.prototype.markInputs):
3404         (ScaleConstraint.prototype.execute):
3405         (ScaleConstraint.prototype.recalculate):
3406         (EqualityConstraint):
3407         (EqualityConstraint.prototype.execute):
3408         (Variable):
3409         (Variable.prototype.addConstraint):
3410         (Variable.prototype.removeConstraint):
3411         (Planner):
3412         (Planner.prototype.incrementalAdd):
3413         (Planner.prototype.incrementalRemove):
3414         (Planner.prototype.newMark):
3415         (Planner.prototype.makePlan):
3416         (Planner.prototype.extractPlanFromConstraints):
3417         (Planner.prototype.addPropagate):
3418         (Planner.prototype.removePropagateFrom):
3419         (Planner.prototype.addConstraintsConsumingTo):
3420         (Plan):
3421         (Plan.prototype.addConstraint):
3422         (Plan.prototype.size):
3423         (Plan.prototype.constraintAt):
3424         (Plan.prototype.execute):
3425         (chainTest):
3426         (projectionTest):
3427         (change):
3428         (deltaBlue):
3429         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3430         (assert):
3431         (Numbers):
3432         (Numbers.prototype.next):
3433         (return.Transpose):
3434         (return.Transpose.prototype.next):
3435         (transpose):
3436         (verifyEven):
3437         (verifyString):
3438         (foo):
3439         (runIterators):
3440         * microbenchmarks/try-catch-word-count.js: Added.
3441         (let.assert):
3442         (EOF):
3443         (let.texts):
3444         (let.o.apply):
3445         (foo):
3446         (bar):
3447         (f):
3448         (run):
3449         (test1):
3450         (test2):
3451         (test3):
3452         (fn):
3453         (A):
3454         (B):
3455         (A.prototype.getValue):
3456         (B.prototype.getParentValue):
3457         (strlen):
3458         (sum.0):
3459         (test):
3460         (result.test.o):
3461         (set add.set add):
3462         (set forEach):
3463         (stringHash):
3464         (set if):
3465         (testFunction):
3466         (set delete.set has.set add):
3467         * stress/catch-set-argument-speculation-failure.js: Added.
3468         (o):
3469         (e):
3470         (e2):
3471         (escape):
3472         (baz):
3473         (noInline.run):
3474         (noInline):
3475         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3476         (foo):
3477         (e):
3478         (baz):
3479         (bar):
3480
3481 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3482
3483         Unreviewed, rolling out r221119, r221124, and r221143.
3484         https://bugs.webkit.org/show_bug.cgi?id=175973
3485
3486         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3487         on #webkit).
3488
3489         Reverted changesets:
3490
3491         "Support compiling catch in the DFG"
3492         https://bugs.webkit.org/show_bug.cgi?id=174590
3493         http://trac.webkit.org/changeset/221119
3494
3495         "Unreviewed, build fix in GTK port"
3496         https://bugs.webkit.org/show_bug.cgi?id=174590
3497         http://trac.webkit.org/changeset/221124
3498
3499         "DFG::JITCode::osrEntry should get sorted since we perform a
3500         binary search on it"
3501         https://bugs.webkit.org/show_bug.cgi?id=175893
3502         http://trac.webkit.org/changeset/221143
3503
3504 2017-08-24  Michael Saboff  <msaboff@apple.com>
3505
3506         Add support for RegExp "dotAll" flag
3507         https://bugs.webkit.org/show_bug.cgi?id=175924
3508
3509         Reviewed by Keith Miller.
3510
3511         Updated tests for new dotAll ('s' flag) changes.
3512
3513         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3514         * stress/static-getter-in-names.js:
3515
3516 2017-08-24  Mark Lam  <mark.lam@apple.com>
3517
3518         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3519         https://bugs.webkit.org/show_bug.cgi?id=175940
3520         <rdar://problem/29003921>
3521
3522         Reviewed by Saam Barati.
3523
3524         * stress/regress-164081.js: Added.
3525         (shouldEqual):
3526         (testcase):
3527
3528 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3529
3530         Skip flaky JSC test stress/test-finally.js.
3531         https://bugs.webkit.org/show_bug.cgi?id=160283
3532
3533         Unreviewed test gardening.
3534
3535         * stress/test-finally.js:
3536
3537 2017-08-23  Saam Barati  <sbarati@apple.com>
3538
3539         Support compiling catch in the DFG
3540         https://bugs.webkit.org/show_bug.cgi?id=174590
3541
3542         Reviewed by Filip Pizlo.
3543
3544         * microbenchmarks/delta-blue-try-catch.js: Added.
3545         (exception):
3546         (value):
3547         (OrderedCollection):
3548         (OrderedCollection.prototype.add):
3549         (OrderedCollection.prototype.at):
3550         (OrderedCollection.prototype.size):
3551         (OrderedCollection.prototype.removeFirst):
3552         (OrderedCollection.prototype.remove):
3553         (Strength):
3554         (Strength.stronger):
3555         (Strength.weaker):
3556         (Strength.weakestOf):
3557         (Strength.strongest):
3558         (Strength.prototype.nextWeaker):
3559         (Constraint):
3560         (Constraint.prototype.addConstraint):
3561         (Constraint.prototype.satisfy):
3562         (Constraint.prototype.destroyConstraint):
3563         (Constraint.prototype.isInput):
3564         (UnaryConstraint):
3565         (UnaryConstraint.prototype.addToGraph):
3566         (UnaryConstraint.prototype.chooseMethod):
3567         (UnaryConstraint.prototype.isSatisfied):
3568         (UnaryConstraint.prototype.markInputs):
3569         (UnaryConstraint.prototype.output):
3570         (UnaryConstraint.prototype.recalculate):
3571         (UnaryConstraint.prototype.markUnsatisfied):
3572         (UnaryConstraint.prototype.inputsKnown):
3573         (UnaryConstraint.prototype.removeFromGraph):
3574         (StayConstraint):
3575         (StayConstraint.prototype.execute):
3576         (EditConstraint.prototype.isInput):
3577         (EditConstraint.prototype.execute):
3578         (BinaryConstraint):
3579         (BinaryConstraint.prototype.chooseMethod):
3580         (BinaryConstraint.prototype.addToGraph):
3581         (BinaryConstraint.prototype.isSatisfied):
3582         (BinaryConstraint.prototype.markInputs):
3583         (BinaryConstraint.prototype.input):
3584         (BinaryConstraint.prototype.output):
3585         (BinaryConstraint.prototype.recalculate):
3586         (BinaryConstraint.prototype.markUnsatisfied):
3587         (BinaryConstraint.prototype.inputsKnown):
3588         (BinaryConstraint.prototype.removeFromGraph):
3589         (ScaleConstraint):
3590         (ScaleConstraint.prototype.addToGraph):
3591         (ScaleConstraint.prototype.removeFromGraph):
3592         (ScaleConstraint.prototype.markInputs):
3593         (ScaleConstraint.prototype.execute):
3594         (ScaleConstraint.prototype.recalculate):
3595         (EqualityConstraint):
3596         (EqualityConstraint.prototype.execute):
3597         (Variable):
3598         (Variable.prototype.addConstraint):
3599         (Variable.prototype.removeConstraint):
3600         (Planner):
3601         (Planner.prototype.incrementalAdd):
3602         (Planner.prototype.incrementalRemove):
3603         (Planner.prototype.newMark):
3604         (Planner.prototype.makePlan):
3605         (Planner.prototype.extractPlanFromConstraints):
3606         (Planner.prototype.addPropagate):
3607         (Planner.prototype.removePropagateFrom):
3608         (Planner.prototype.addConstraintsConsumingTo):
3609         (Plan):
3610         (Plan.prototype.addConstraint):
3611         (Plan.prototype.size):
3612         (Plan.prototype.constraintAt):
3613         (Plan.prototype.execute):
3614         (chainTest):
3615         (projectionTest):
3616         (change):
3617         (deltaBlue):
3618         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3619         (assert):
3620         (Numbers):
3621         (Numbers.prototype.next):
3622         (return.Transpose):
3623         (return.Transpose.prototype.next):
3624         (transpose):
3625         (verifyEven):
3626         (verifyString):
3627         (foo):
3628         (runIterators):
3629         * microbenchmarks/try-catch-word-count.js: Added.
3630         (let.assert):
3631         (EOF):
3632         (let.texts):
3633         (let.o.apply):
3634         (foo):
3635         (bar):
3636         (f):
3637         (run):
3638         (test1):
3639         (test2):
3640         (test3):
3641         (fn):
3642         (A):
3643         (B):
3644         (A.prototype.getValue):
3645         (B.prototype.getParentValue):
3646         (strlen):
3647         (sum.0):
3648         (test):
3649         (result.test.o):
3650         (set add.set add):
3651         (set forEach):
3652         (stringHash):
3653         (set if):
3654         (testFunction):
3655         (set delete.set has.set add):
3656         * stress/catch-set-argument-speculation-failure.js: Added.
3657         (o):
3658         (e):
3659         (e2):
3660         (escape):
3661         (baz):
3662         (noInline.run):
3663         (noInline):
3664         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3665         (foo):
3666         (e):
3667         (baz):
3668         (bar):
3669
3670 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3671
3672         [JSC] Optimize Map iteration with intrinsic
3673         https://bugs.webkit.org/show_bug.cgi?id=174355
3674
3675         Reviewed by Saam Barati.
3676
3677         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3678         (shouldBe):
3679         (throw.new.Error):
3680         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3681         (shouldBe):
3682         (throw.new.Error.let.iterator.set Symbol):
3683         (throw.new.Error.set add):
3684         (let.iterator.set Symbol):
3685
3686 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3687
3688         Add a micro-benchmark for checking that accessing a variable within a 'with'
3689         block does not automatically prevent type prediction.
3690         https://bugs.webkit.org/show_bug.cgi?id=175738
3691
3692         Reviewed by Saam Barati.
3693
3694         * stress/with_and_arith.js: Added.
3695         (with):
3696
3697 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3698
3699         [ESNext] Async iteration - Implement Async Generator - runtime
3700         https://bugs.webkit.org/show_bug.cgi?id=175240
3701
3702         Reviewed by Yusuke Suzuki.
3703
3704         * stress/async-iteration-async-from-sync.js: Added.
3705         (assert):
3706         (const.Logger):
3707         (this.fullfilled):
3708         (this.fullfilledDone):
3709         (this.rejected):
3710         (this.catched):
3711         (this.isFinal):
3712         (_assertLogger):
3713         (const.assertLogger):
3714         (const.getPromise.promiseHolder.return.new.Promise):
3715         (foo):
3716         (async.boo):
3717         (bar):
3718         (async.baz):
3719         (async.goo):
3720         * stress/async-iteration-basic.js: Added.
3721         (assert):
3722         (const.Logger):
3723         (this.fullfilled):
3724         (this.fullfilledDone):
3725         (this.rejected):
3726         (this.catched):
3727         (this.isFinal):
3728