WebAssembly: improve stack trace
[WebKit-https.git] / JSTests / ChangeLog
1 2017-11-30  JF Bastien  <jfbastien@apple.com>
2
3         WebAssembly: improve stack trace
4         https://bugs.webkit.org/show_bug.cgi?id=179343
5
6         Reviewed by Saam Barati.
7
8         Update the tests to follow the new format. Notably, SHA1 module
9         hash is now included in traces, and stubs are properly identified.
10
11         * wasm/assert.js: Add an assertion which matches regular expressions.
12         * wasm/function-tests/nameSection.js:
13         * wasm/function-tests/stack-overflow.js:
14         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
15         (assertOverflows.assertThrows.wasm.1):
16         (assertOverflows.assertThrows.wasm.0):
17         (assertOverflows.assertThrows):
18         (assertOverflows):
19         * wasm/function-tests/stack-trace.js:
20         (import.Builder.from.string_appeared_here.assert): Deleted.
21         * wasm/function-tests/trap-after-cross-instance-call.js:
22         (wasmFrameCountFromError):
23         * wasm/function-tests/trap-load-2.js:
24         (wasmFrameCountFromError):
25         * wasm/function-tests/trap-load.js:
26         (wasmFrameCountFromError):
27
28 2017-11-30  Mark Lam  <mark.lam@apple.com>
29
30         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
31         https://bugs.webkit.org/show_bug.cgi?id=180219
32         <rdar://problem/35696536>
33
34         Reviewed by Filip Pizlo.
35
36         * stress/regress-180219.js: Added.
37
38 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
39
40         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
41         https://bugs.webkit.org/show_bug.cgi?id=180190
42
43         Reviewed by Mark Lam.
44
45         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
46         (shouldBe):
47         (test1):
48         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
49         (shouldBe):
50         (test1):
51         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
52         (shouldBe):
53         (test1):
54         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
55         (shouldBe):
56         (test1):
57         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
58         (shouldBe):
59         (test1):
60         * stress/operation-in-may-have-negative-int32.js: Added.
61         (shouldBe):
62         (test2):
63         * stress/operation-in-negative-int32-cast.js: Added.
64         (shouldBe):
65         (test1):
66
67 2017-11-28  JF Bastien  <jfbastien@apple.com>
68
69         Strict and sloppy functions shouldn't share structure
70         https://bugs.webkit.org/show_bug.cgi?id=180103
71         <rdar://problem/35667847>
72
73         Reviewed by Saam Barati.
74
75         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
76         because the IC was wrong.
77         (foo):
78         (bar):
79         (baz):
80         (catch):
81         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
82         in this patch, but may as well test odd strict mode corner cases.
83         (bar):
84         (baz):
85         (catch):
86         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
87         (foo):
88         (bar):
89         (baz):
90         (catch):
91         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
92         next file, but with invalidation of the FunctionExecutable's
93         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
94         slower path.
95         (foo):
96         (bar.const.x):
97         (bar.const.y):
98         (bar):
99         (catch):
100         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
101         strict nesting works correctly.
102         (foo):
103         (bar.baz):
104         (bar):
105         * stress/strict-function-structure.js: Added. The test used to
106         assert in objectProtoFuncHasOwnProperty.
107         (foo):
108         (bar):
109         (baz):
110         * stress/strict-nested-function-structure.js: Added. Nesting.
111         (foo):
112         (bar):
113         (baz.boo):
114         (baz):
115
116 2017-11-29  Robin Morisset  <rmorisset@apple.com>
117
118         The recursive tail call optimisation is wrong on closures
119         https://bugs.webkit.org/show_bug.cgi?id=179835
120
121         Reviewed by Saam Barati.
122
123         * stress/closure-recursive-tail-call.js: Added.
124         (makeClosure):
125
126 2017-11-27  JF Bastien  <jfbastien@apple.com>
127
128         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
129         https://bugs.webkit.org/show_bug.cgi?id=180051
130         <rdar://problem/35614371>
131
132         Reviewed by Saam Barati.
133
134         * stress/rest-parameter-negative.js: Added.
135         (__f_5484):
136         (catch):
137         (__f_5485):
138         (__v_22598.catch):
139
140 2017-11-27  Saam Barati  <sbarati@apple.com>
141
142         Spread can escape when CreateRest does not
143         https://bugs.webkit.org/show_bug.cgi?id=180057
144         <rdar://problem/35676119>
145
146         Reviewed by JF Bastien.
147
148         * stress/spread-escapes-but-create-rest-does-not.js: Added.
149         (assert):
150         (getProperties):
151         (theFunc):
152         (let.obj.valueOf):
153
154 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
155
156         [DFG] Add NormalizeMapKey DFG IR
157         https://bugs.webkit.org/show_bug.cgi?id=179912
158
159         Reviewed by Saam Barati.
160
161         * stress/map-untyped-normalize-cse.js: Added.
162         (shouldBe):
163         (test):
164         * stress/map-untyped-normalize.js: Added.
165         (shouldBe):
166         (test):
167         * stress/set-untyped-normalize-cse.js: Added.
168         (shouldBe):
169         (set return.set has.set has):
170         * stress/set-untyped-normalize.js: Added.
171         (shouldBe):
172         (set return.set has):
173
174 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
175
176         [FTL] Support DeleteById and DeleteByVal
177         https://bugs.webkit.org/show_bug.cgi?id=180022
178
179         Reviewed by Saam Barati.
180
181         * stress/delete-by-id.js: Added.
182         (shouldBe):
183         (test1):
184         (test2):
185         * stress/delete-by-val-ftl.js: Added.
186         (shouldBe):
187         (test1):
188         (test2):
189
190 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
191
192         [DFG] Introduce {Set,Map,WeakMap}Fields
193         https://bugs.webkit.org/show_bug.cgi?id=179925
194
195         Reviewed by Saam Barati.
196
197         * stress/map-set-clobber-map-get.js: Added.
198         (shouldBe):
199         (test):
200         * stress/map-set-does-not-clobber-set-has.js: Added.
201         (shouldBe):
202         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
203         (shouldBe):
204         (test):
205         * stress/set-add-clobber-set-has.js: Added.
206         (shouldBe):
207         * stress/set-add-does-not-clobber-map-get.js: Added.
208         (shouldBe):
209
210 2017-11-24  Mark Lam  <mark.lam@apple.com>
211
212         Move unsafe jsc shell test functions to the $vm object.
213         https://bugs.webkit.org/show_bug.cgi?id=179980
214
215         Reviewed by Yusuke Suzuki.
216
217         * controlFlowProfiler/driver/driver.js:
218         * controlFlowProfiler/execution-count.js:
219         * controlFlowProfiler/if-statement.js:
220         * controlFlowProfiler/loop-statements.js:
221         * controlFlowProfiler/switch-statements.js:
222         * controlFlowProfiler/test-jit.js:
223         * exceptionFuzz/3d-cube.js:
224         * exceptionFuzz/date-format-xparb.js:
225         * exceptionFuzz/earley-boyer.js:
226         * heapProfiler/basic-edges.js:
227         * heapProfiler/property-edge-types.js:
228         * microbenchmarks/try-get-by-id-basic.js:
229         * microbenchmarks/try-get-by-id-polymorphic.js:
230         * modules/namespace-object-try-get.js:
231         * stress/argument-count-bytecode.js:
232         * stress/argument-intrinsic-basic.js:
233         * stress/argument-intrinsic-inlining-use-caller-arg.js:
234         * stress/argument-intrinsic-inlining-with-result-escape.js:
235         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
236         * stress/argument-intrinsic-inlining-with-vararg.js:
237         * stress/argument-intrinsic-nested-inlining.js:
238         * stress/argument-intrinsic-not-convert-to-get-argument.js:
239         * stress/argument-intrinsic-with-stack-write.js:
240         * stress/arity-mismatch-get-argument.js:
241         * stress/array-message-passing.js:
242         * stress/array-push-with-force-exit.js:
243         * stress/check-dom-with-signature.js:
244         * stress/check-sub-class.js:
245         * stress/compare-eq-incomplete-profile.js:
246         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
247         * stress/do-eval-virtual-call-correctly.js:
248         * stress/dom-jit-with-poly-proto.js:
249         * stress/domjit-exception-ic.js:
250         * stress/domjit-exception.js:
251         * stress/domjit-getter-complex-with-incorrect-object.js:
252         * stress/domjit-getter-complex.js:
253         * stress/domjit-getter-poly.js:
254         * stress/domjit-getter-proto.js:
255         * stress/domjit-getter-super-poly.js:
256         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
257         * stress/domjit-getter-type-check.js:
258         * stress/domjit-getter.js:
259         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
260         * stress/for-in-proxy-target-changed-structure.js:
261         * stress/for-in-proxy.js:
262         * stress/generational-opaque-roots.js:
263         * stress/global-const-redeclaration-setting-2.js:
264         * stress/global-const-redeclaration-setting-3.js:
265         * stress/global-const-redeclaration-setting-4.js:
266         * stress/global-const-redeclaration-setting-5.js:
267         * stress/global-const-redeclaration-setting.js:
268         * stress/import-basic.js:
269         * stress/import-from-eval.js:
270         * stress/import-reject-with-exception.js:
271         * stress/import-syntax.js:
272         * stress/impure-get-own-property-slot-inline-cache.js:
273         * stress/is-constructor.js:
274         * stress/istypedarrayview-intrinsic.js:
275         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
276         * stress/jsc-test-functions-should-be-more-robust.js:
277         * stress/object-toString-with-proxy.js:
278         * stress/poly-proto-custom-value-and-accessor.js:
279         * stress/proxy-inline-cache.js:
280         * stress/re-execute-error-module.js:
281         * stress/regress-150532.js:
282         * stress/regress-156992.js:
283         * stress/regress-179619.js:
284         * stress/resources/shadow-chicken-support.js:
285         * stress/runtime-array.js:
286         * stress/sampling-profiler-microtasks.js:
287         * stress/shadow-chicken-enabled.js:
288         * stress/spread-correct-global-object-on-exception.js:
289         * stress/super-get-by-id.js:
290         * stress/tailCallForwardArguments.js:
291         * stress/to-object-intrinsic-boolean-edge.js:
292         * stress/to-object-intrinsic-null-or-undefined-edge.js:
293         * stress/to-object-intrinsic-number-edge.js:
294         * stress/to-object-intrinsic-object-edge.js:
295         * stress/to-object-intrinsic-string-edge.js:
296         * stress/to-object-intrinsic-symbol-edge.js:
297         * stress/to-object-intrinsic.js:
298         * stress/try-catch-custom-getter-as-get-by-id.js:
299         * stress/try-get-by-id-poly-proto.js:
300         * stress/try-get-by-id-should-spill-registers-dfg.js:
301         * stress/try-get-by-id.js:
302         * typeProfiler/arrow-functions.js:
303         * typeProfiler/basic.js:
304         * typeProfiler/captured.js:
305         * typeProfiler/classes.js:
306         * typeProfiler/dfg-jit-optimizations.js:
307         * typeProfiler/dictionary-mode.js:
308         * typeProfiler/es6-block-scoping.js:
309         * typeProfiler/es6-classes.js:
310         * typeProfiler/inheritance.js:
311         * typeProfiler/int52-dfg.js:
312         * typeProfiler/loop.js:
313         * typeProfiler/optional-fields.js:
314         * typeProfiler/overflow.js:
315         * typeProfiler/return.js:
316         * typeProfiler/symbol.js:
317         * typeProfiler/weird-prototype-chain.js:
318
319 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
320
321         [DFG][FTL] Support MapSet / SetAdd intrinsics
322         https://bugs.webkit.org/show_bug.cgi?id=179858
323
324         Reviewed by Saam Barati.
325
326         * microbenchmarks/map-has-and-set.js: Added.
327         (test):
328         * stress/map-set-check-failure.js: Added.
329         (shouldBe):
330         (shouldThrow):
331         (target):
332         * stress/map-set-cse.js: Added.
333         (shouldBe):
334         (test):
335         * stress/set-add-check-failure.js: Added.
336         (shouldBe):
337         (shouldThrow):
338         (set shouldThrow):
339         * stress/set-add-cse.js: Added.
340         (shouldBe):
341
342 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
343
344         [JSC] Allow poly proto for intrinsic getters
345         https://bugs.webkit.org/show_bug.cgi?id=179550
346
347         Reviewed by Saam Barati.
348
349         This change is also tested by existing tests.
350
351             1. stress/intrinsic-getter-with-poly-proto.js
352             2. stress/poly-proto-intrinsic-getter-correctness.js
353
354         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
355         (shouldBe):
356         (makePolyProtoObject.foo.C):
357         (makePolyProtoObject.foo):
358         (makePolyProtoObject):
359         (target):
360         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
361         (shouldBe):
362         (makePolyProtoObject.foo.C):
363         (makePolyProtoObject.foo):
364         (makePolyProtoObject):
365         (target):
366
367 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
368
369         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
370         https://bugs.webkit.org/show_bug.cgi?id=179744
371
372         Reviewed by Michael Catanzaro.
373
374         This test uses too much memory for our buildbots on these platforms
375         and gets OOM-killed.
376
377         * stress/unshiftCountSlowCase-correct-postCapacity.js:
378         Skip if $memoryLimited and linux.
379
380 2017-11-17  JF Bastien  <jfbastien@apple.com>
381
382         WebAssembly JS API: throw when a promise can't be created
383         https://bugs.webkit.org/show_bug.cgi?id=179826
384         <rdar://problem/35455813>
385
386         Reviewed by Mark Lam.
387
388         Test WebAssembly.{compile,instantiate} where promise creation
389         fails because of a stack overflow.
390
391         * wasm/js-api/promise-stack-overflow.js: Added.
392         (const.runNearStackLimit.f.const.t):
393         (async.testCompile):
394         (async.testInstantiate):
395
396 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
397
398         Unreviewed, mark regress-178385.js as memory exhausting
399
400         * stress/regress-178385.js:
401
402 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
403
404         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
405
406         Unreviewed test gardening.
407
408         * test262.yaml:
409
410 2017-11-16  Robin Morisset  <rmorisset@apple.com>
411
412         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
413         https://bugs.webkit.org/show_bug.cgi?id=179763
414         <rdar://problem/35550513>
415
416         Reviewed by Keith Miller.
417
418         Just adding a slightly cleaned-up version of the original fuzzer-found test.
419
420         * stress/tdz-this-in-try-catch.js: Added.
421         (__v_6388):
422         (__v_6392):
423
424 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
425
426         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
427         https://bugs.webkit.org/show_bug.cgi?id=179594
428
429         Reviewed by Saam Barati.
430
431         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
432         (shouldBe):
433         (args):
434         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
435         (shouldBe):
436         (args):
437
438 2017-11-14  Saam Barati  <sbarati@apple.com>
439
440         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
441         https://bugs.webkit.org/show_bug.cgi?id=179639
442         <rdar://problem/35513018>
443
444         Reviewed by JF Bastien.
445
446         * wasm/function-tests/grow-memory-cause-gc.js: Added.
447         (escape):
448         (i.func):
449
450 2017-11-13  Mark Lam  <mark.lam@apple.com>
451
452         Add more overflow check book-keeping for MarkedArgumentBuffer.
453         https://bugs.webkit.org/show_bug.cgi?id=179634
454         <rdar://problem/35492517>
455
456         Reviewed by Saam Barati.
457
458         * stress/regress-179634.js: Added.
459
460 2017-11-13  Mark Lam  <mark.lam@apple.com>
461
462         Make the jsc shell loadGetterFromGetterSetter() function more robust.
463         https://bugs.webkit.org/show_bug.cgi?id=179619
464         <rdar://problem/35492518>
465
466         Reviewed by Saam Barati.
467
468         * stress/regress-179619.js: Added.
469
470 2017-11-12  Mark Lam  <mark.lam@apple.com>
471
472         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
473         https://bugs.webkit.org/show_bug.cgi?id=179562
474         <rdar://problem/35467022>
475
476         Reviewed by Saam Barati.
477
478         * regress-179562.js: Added.
479
480 2017-11-08  Saam Barati  <sbarati@apple.com>
481
482         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
483         https://bugs.webkit.org/show_bug.cgi?id=177792
484
485         Reviewed by Yusuke Suzuki.
486
487         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
488         (assert):
489         (foo.Foo.prototype.ensureX):
490         (foo.Foo):
491         (foo):
492         (access):
493
494 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
495
496         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
497         https://bugs.webkit.org/show_bug.cgi?id=178592
498
499         Unreviewed test gardening.
500
501         * test262.yaml:
502
503 2017-11-08  Robin Morisset  <rmorisset@apple.com>
504
505         Turn recursive tail calls into loops
506         https://bugs.webkit.org/show_bug.cgi?id=176601
507
508         Reviewed by Saam Barati.
509
510         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
511
512         Add some simple test that computes factorial in several ways, and other trivial computations.
513         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
514         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
515         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
516         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
517
518         * stress/inline-call-to-recursive-tail-call.js: Added.
519         (factorial.aux):
520         (factorial):
521         (factorial2.aux2):
522         (factorial2.id):
523         (factorial2):
524         (factorial3.aux3):
525         (factorial3):
526         (aux4):
527         (factorial4):
528         (foo):
529         (auxBar):
530         (bar):
531         (test):
532
533 2017-11-07  Mark Lam  <mark.lam@apple.com>
534
535         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
536         https://bugs.webkit.org/show_bug.cgi?id=179355
537         <rdar://problem/35263053>
538
539         Reviewed by Saam Barati.
540
541         * stress/regress-179355.js: Added.
542
543 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
544
545         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
546         https://bugs.webkit.org/show_bug.cgi?id=144458
547
548         Reviewed by Saam Barati.
549
550         * microbenchmarks/dfg-internal-function-call.js: Added.
551         (target):
552         * microbenchmarks/dfg-internal-function-construct.js: Added.
553         (target):
554         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
555         (target):
556         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
557         (target):
558         * stress/dfg-internal-function-call.js: Added.
559         (shouldBe):
560         (target):
561         * stress/dfg-internal-function-construct.js: Added.
562         (shouldBe):
563         (target):
564         * stress/internal-function-call.js: Added.
565         (shouldBe):
566         * stress/internal-function-construct.js: Added.
567         (shouldBe):
568
569 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
570
571         [Win] Skip stress/regress-178385.js.
572         https://bugs.webkit.org/show_bug.cgi?id=179298
573
574         Unreviewed test gardening.
575
576         * stress/regress-178385.js:
577
578 2017-11-03  Keith Miller  <keith_miller@apple.com>
579
580         Add test for ic with side effects
581         https://bugs.webkit.org/show_bug.cgi?id=179268
582
583         Reviewed by Saam Barati.
584
585         * stress/put-inline-cache-side-effects.js: Added.
586         (let.i.of.objs.keys):
587         (f):
588
589 2017-11-03  Mark Lam  <mark.lam@apple.com>
590
591         CachedCall (and its clients) needs overflow checks.
592         https://bugs.webkit.org/show_bug.cgi?id=179185
593
594         Reviewed by JF Bastien.
595
596         * stress/regress-179185.js: Added.
597
598 2017-11-02  Michael Saboff  <msaboff@apple.com>
599
600         DFG needs to handle code motion of code in for..in loop bodies
601         https://bugs.webkit.org/show_bug.cgi?id=179212
602
603         Reviewed by Keith Miller.
604
605         New regression test.
606
607         * stress/for-in-side-effects.js: Added.
608         (getPrototypeOf):
609         (reset):
610         (testWithoutFTL.f):
611         (testWithoutFTL):
612         (testWithFTL.f):
613         (testWithFTL):
614
615 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
616
617         AI does not correctly model the clobber case of ArithClz32
618         https://bugs.webkit.org/show_bug.cgi?id=179188
619
620         Reviewed by Michael Saboff.
621
622         * stress/arith-clz32-effects.js: Added.
623         (foo):
624         (valueOf):
625
626 2017-11-01  Michael Saboff  <msaboff@apple.com>
627
628         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
629         https://bugs.webkit.org/show_bug.cgi?id=179140
630
631         Reviewed by Saam Barati.
632
633         New regression test.
634
635         * stress/regress-179140.js: Added.
636         (testWithoutFTL):
637         (testWithFTL):
638
639 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
640
641         [JSC] Introduce @toObject
642         https://bugs.webkit.org/show_bug.cgi?id=178726
643
644         Reviewed by Saam Barati.
645
646         * stress/array-copywithin.js:
647         (shouldThrow):
648         * stress/object-constructor-boolean-edge.js: Added.
649         (shouldBe):
650         (test):
651         * stress/object-constructor-global.js: Added.
652         (shouldBe):
653         * stress/object-constructor-null-edge.js: Added.
654         (shouldBe):
655         (test):
656         * stress/object-constructor-number-edge.js: Added.
657         (shouldBe):
658         (test):
659         * stress/object-constructor-object-edge.js: Added.
660         (shouldBe):
661         (test):
662         (i.arg):
663         * stress/object-constructor-string-edge.js: Added.
664         (shouldBe):
665         (test):
666         * stress/object-constructor-symbol-edge.js: Added.
667         (shouldBe):
668         (test):
669         * stress/object-constructor-undefined-edge.js: Added.
670         (shouldBe):
671         (test):
672         * stress/symbol-array-from.js: Added.
673         (shouldBe):
674         * stress/to-object-intrinsic-boolean-edge.js: Added.
675         (shouldBe):
676         (builtin.createBuiltin):
677         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
678         (shouldThrow):
679         * stress/to-object-intrinsic-number-edge.js: Added.
680         (shouldBe):
681         (builtin.createBuiltin):
682         * stress/to-object-intrinsic-object-edge.js: Added.
683         (shouldBe):
684         (builtin.createBuiltin):
685         (i.arg):
686         * stress/to-object-intrinsic-string-edge.js: Added.
687         (shouldBe):
688         (builtin.createBuiltin):
689         * stress/to-object-intrinsic-symbol-edge.js: Added.
690         (shouldBe):
691         (builtin.createBuiltin):
692         * stress/to-object-intrinsic.js: Added.
693         (shouldBe):
694         (shouldThrow):
695         (builtin.createBuiltin):
696
697 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
698
699         [DFG][FTL] Introduce StringSlice
700         https://bugs.webkit.org/show_bug.cgi?id=178934
701
702         Reviewed by Saam Barati.
703
704         * microbenchmarks/string-slice-empty.js: Added.
705         (slice):
706         * microbenchmarks/string-slice-one-char.js: Added.
707         (slice):
708         * microbenchmarks/string-slice.js: Added.
709         (slice):
710
711 2017-10-26  Michael Saboff  <msaboff@apple.com>
712
713         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
714         https://bugs.webkit.org/show_bug.cgi?id=178890
715
716         Reviewed by Keith Miller.
717
718         New regression test.
719
720         * stress/regress-178890.js: Added.
721
722 2017-10-26  Mark Lam  <mark.lam@apple.com>
723
724         JSRopeString::RopeBuilder::append() should check for overflows.
725         https://bugs.webkit.org/show_bug.cgi?id=178385
726         <rdar://problem/35027468>
727
728         Reviewed by Saam Barati.
729
730         * stress/regress-178385.js: Added.
731
732 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
733
734         Unreviewed, rolling out r223961.
735
736         The change that required this has been rolled out.
737
738         Reverted changeset:
739
740         "Mark test262.yaml/test262/test/language/statements/try/tco-
741         catch.js as passing."
742         https://bugs.webkit.org/show_bug.cgi?id=178592
743         https://trac.webkit.org/changeset/223961
744
745 2017-10-25  Commit Queue  <commit-queue@webkit.org>
746
747         Unreviewed, rolling out r223691 and r223729.
748         https://bugs.webkit.org/show_bug.cgi?id=178834
749
750         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
751         by rniwa on #webkit).
752
753         Reverted changesets:
754
755         "Turn recursive tail calls into loops"
756         https://bugs.webkit.org/show_bug.cgi?id=176601
757         https://trac.webkit.org/changeset/223691
758
759         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
760         comparison is always false due to limited range of data type
761         [-Wtype-limits]"
762         https://bugs.webkit.org/show_bug.cgi?id=178543
763         https://trac.webkit.org/changeset/223729
764
765 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
766
767         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
768         https://bugs.webkit.org/show_bug.cgi?id=178592
769
770         Unreviewed test gardening.
771
772         * test262.yaml:
773
774 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
775
776         [FTL] Support NewStringObject
777         https://bugs.webkit.org/show_bug.cgi?id=178737
778
779         Reviewed by Saam Barati.
780
781         * stress/new-string-object.js: Added.
782         (shouldBe):
783         (test):
784
785 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
786
787         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
788         https://bugs.webkit.org/show_bug.cgi?id=178308
789
790         Reviewed by Mark Lam.
791
792         * test262.yaml:
793
794 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
795
796         [JSC] Use fastJoin in Array#toString
797         https://bugs.webkit.org/show_bug.cgi?id=178062
798
799         Reviewed by Darin Adler.
800
801         * microbenchmarks/contiguous-array-to-string.js: Added.
802         (target):
803         * microbenchmarks/double-array-to-string.js: Added.
804         (target):
805         * microbenchmarks/int32-array-to-string.js: Added.
806         (target):
807
808 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
809
810         stress/check-string-ident.js is improperly skipped
811         https://bugs.webkit.org/show_bug.cgi?id=178642
812
813         Reviewed by Saam Barati.
814
815         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
816         since it enforces the run-jsc-stress-tests script to still set up the
817         test to run, despite the skip directive that's used before.
818
819 2017-10-20  Mark Lam  <mark.lam@apple.com>
820
821         Add a test case for r214334.
822         https://bugs.webkit.org/show_bug.cgi?id=169941
823         <rdar://problem/31221258>
824
825         Reviewed by JF Bastien.
826
827         * stress/regress-169941.js: Added.
828
829 2017-10-19  JF Bastien  <jfbastien@apple.com>
830
831         WebAssembly: no VM / JS version of everything but Instance
832         https://bugs.webkit.org/show_bug.cgi?id=177473
833
834         Reviewed by Filip Pizlo, Saam Barati.
835
836         - Exceeding max on memory growth now returns a range error as per
837         spec. This is a (very minor) breaking change: it used to throw OOM
838         error. Update the corresponding test.
839
840         * wasm/js-api/memory-grow.js:
841         (assertEq):
842         * wasm/js-api/table.js:
843         (assert.throws):
844
845 2017-10-19  Mark Lam  <mark.lam@apple.com>
846
847         Stringifier::appendStringifiedValue() is missing an exception check.
848         https://bugs.webkit.org/show_bug.cgi?id=178386
849         <rdar://problem/35027610>
850
851         Reviewed by Saam Barati.
852
853         * stress/regress-178386.js: Added.
854
855 2017-10-19  Michael Saboff  <msaboff@apple.com>
856
857         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
858         https://bugs.webkit.org/show_bug.cgi?id=178521
859
860         Reviewed by JF Bastien.
861
862         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
863         now passes with the current version (5.0) of the Emoji spec.
864
865 2017-10-19  Robin Morisset  <rmorisset@apple.com>
866
867         Turn recursive tail calls into loops
868         https://bugs.webkit.org/show_bug.cgi?id=176601
869
870         Reviewed by Saam Barati.
871
872         Add some simple test that computes factorial in several ways, and other trivial computations.
873         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
874         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
875         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
876         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
877
878         * stress/inline-call-to-recursive-tail-call.js: Added.
879         (factorial.aux):
880         (factorial):
881         (factorial2.aux):
882         (factorial2.id):
883         (factorial2):
884         (factorial3.aux):
885         (factorial3):
886         (aux):
887         (factorial4):
888         (test):
889
890 2017-10-18  Mark Lam  <mark.lam@apple.com>
891
892         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
893         https://bugs.webkit.org/show_bug.cgi?id=177600
894         <rdar://problem/34710985>
895
896         Reviewed by Saam Barati.
897
898         * stress/regress-177600.js: Added.
899
900 2017-10-18  Mark Lam  <mark.lam@apple.com>
901
902         The compiler should always register a structure when it adds its transitionWatchPointSet.
903         https://bugs.webkit.org/show_bug.cgi?id=178420
904         <rdar://problem/34814024>
905
906         Reviewed by Saam Barati and Filip Pizlo.
907
908         * stress/regress-178420.js: Added.
909         (new.Array.10000.map):
910
911 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
912
913         [JSC] __proto__ getter should be fast
914         https://bugs.webkit.org/show_bug.cgi?id=178067
915
916         Reviewed by Saam Barati.
917
918         * stress/dfg-object-proto-accessor.js: Added.
919         (shouldBe):
920         (shouldThrow):
921         (target):
922         * stress/dfg-object-proto-getter.js: Added.
923         (shouldBe):
924         (shouldThrow):
925         (target):
926         * stress/dfg-object-prototype-of.js: Added.
927         (shouldBe):
928         (shouldThrow):
929         (target):
930         * stress/dfg-reflect-get-prototype-of.js: Added.
931         (shouldBe):
932         (shouldThrow):
933         (target):
934         * stress/intrinsic-getter-with-poly-proto.js: Added.
935         (shouldBe):
936         (makePolyProtoObject.foo.C):
937         (makePolyProtoObject.foo):
938         (makePolyProtoObject):
939         (target):
940         * stress/object-get-prototype-of-filtered.js: Added.
941         (shouldBe):
942         (shouldThrow):
943         (target):
944         (i.Cocoa):
945         * stress/object-get-prototype-of-mono-proto.js: Added.
946         (shouldBe):
947         (makePolyProtoObject.foo.C):
948         (makePolyProtoObject.foo):
949         (makePolyProtoObject):
950         (target):
951         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
952         (shouldBe):
953         (makePolyProtoObject.foo.C):
954         (makePolyProtoObject.foo):
955         (makePolyProtoObject):
956         (target):
957         * stress/object-get-prototype-of-poly-proto.js: Added.
958         (shouldBe):
959         (makePolyProtoObject.foo.C):
960         (makePolyProtoObject.foo):
961         (makePolyProtoObject):
962         (target):
963         * stress/object-proto-getter-filtered.js: Added.
964         (shouldBe):
965         (shouldThrow):
966         (target):
967         (i.Cocoa):
968         * stress/object-proto-getter-poly-mono-proto.js: Added.
969         (shouldBe):
970         (makePolyProtoObject.foo.C):
971         (makePolyProtoObject.foo):
972         (makePolyProtoObject):
973         (target):
974         * stress/object-proto-getter-poly-proto.js: Added.
975         (shouldBe):
976         (makePolyProtoObject.foo.C):
977         (makePolyProtoObject.foo):
978         (makePolyProtoObject):
979         (target):
980         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
981         * stress/string-proto.js: Added.
982         (shouldBe):
983         (target):
984
985 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
986
987         Unreviewed, rolling out r223523.
988
989         A test for this change is failing on debug JSC bots.
990
991         Reverted changeset:
992
993         "[JSC] __proto__ getter should be fast"
994         https://bugs.webkit.org/show_bug.cgi?id=178067
995         https://trac.webkit.org/changeset/223523
996
997 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
998
999         [JSC] __proto__ getter should be fast
1000         https://bugs.webkit.org/show_bug.cgi?id=178067
1001
1002         Reviewed by Saam Barati.
1003
1004         * stress/dfg-object-proto-accessor.js: Added.
1005         (shouldBe):
1006         (shouldThrow):
1007         (target):
1008         * stress/dfg-object-proto-getter.js: Added.
1009         (shouldBe):
1010         (shouldThrow):
1011         (target):
1012         * stress/dfg-object-prototype-of.js: Added.
1013         (shouldBe):
1014         (shouldThrow):
1015         (target):
1016         * stress/dfg-reflect-get-prototype-of.js: Added.
1017         (shouldBe):
1018         (shouldThrow):
1019         (target):
1020         * stress/object-get-prototype-of-filtered.js: Added.
1021         (shouldBe):
1022         (shouldThrow):
1023         (target):
1024         (i.Cocoa):
1025         * stress/object-get-prototype-of-mono-proto.js: Added.
1026         (shouldBe):
1027         (makePolyProtoObject.foo.C):
1028         (makePolyProtoObject.foo):
1029         (makePolyProtoObject):
1030         (target):
1031         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1032         (shouldBe):
1033         (makePolyProtoObject.foo.C):
1034         (makePolyProtoObject.foo):
1035         (makePolyProtoObject):
1036         (target):
1037         * stress/object-get-prototype-of-poly-proto.js: Added.
1038         (shouldBe):
1039         (makePolyProtoObject.foo.C):
1040         (makePolyProtoObject.foo):
1041         (makePolyProtoObject):
1042         (target):
1043         * stress/object-proto-getter-filtered.js: Added.
1044         (shouldBe):
1045         (shouldThrow):
1046         (target):
1047         (i.Cocoa):
1048         * stress/object-proto-getter-poly-mono-proto.js: Added.
1049         (shouldBe):
1050         (makePolyProtoObject.foo.C):
1051         (makePolyProtoObject.foo):
1052         (makePolyProtoObject):
1053         (target):
1054         * stress/object-proto-getter-poly-proto.js: Added.
1055         (shouldBe):
1056         (makePolyProtoObject.foo.C):
1057         (makePolyProtoObject.foo):
1058         (makePolyProtoObject):
1059         (target):
1060         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1061         * stress/string-proto.js: Added.
1062         (shouldBe):
1063         (target):
1064
1065 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1066
1067         Reland "Add Above/Below comparisons for UInt32 patterns"
1068         https://bugs.webkit.org/show_bug.cgi?id=177281
1069
1070         Reviewed by Saam Barati.
1071
1072         * stress/uint32-comparison-jump.js: Added.
1073         (shouldBe):
1074         (above):
1075         (aboveOrEqual):
1076         (below):
1077         (belowOrEqual):
1078         (notAbove):
1079         (notAboveOrEqual):
1080         (notBelow):
1081         (notBelowOrEqual):
1082         * stress/uint32-comparison.js: Added.
1083         (shouldBe):
1084         (above):
1085         (aboveOrEqual):
1086         (below):
1087         (belowOrEqual):
1088         (aboveTest):
1089         (aboveOrEqualTest):
1090         (belowTest):
1091         (belowOrEqualTest):
1092
1093 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1094
1095         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1096         https://bugs.webkit.org/show_bug.cgi?id=178210
1097
1098         Reviewed by Saam Barati.
1099
1100         * wasm/function-tests/trap-from-start-async.js:
1101         (async.StartTrapsAsync):
1102         * wasm/function-tests/trap-from-start.js:
1103         (StartTraps):
1104         * wasm/js-api/web-assembly-function.js:
1105         (assert.eq.Object.getPrototypeOf):
1106         * wasm/js-api/wrapper-function.js:
1107         (return.new.WebAssembly.Module):
1108         (assert.throws.makeInstance): Deleted.
1109         (assert.throws.Bar): Deleted.
1110         (assert.throws): Deleted.
1111
1112 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1113
1114         Enable gigacage on iOS
1115         https://bugs.webkit.org/show_bug.cgi?id=177586
1116
1117         Reviewed by JF Bastien.
1118         
1119         Add tests for when Gigacage gets runtime disabled.
1120
1121         * stress/disable-gigacage-arrays.js: Added.
1122         (foo):
1123         * stress/disable-gigacage-strings.js: Added.
1124         (foo):
1125         * stress/disable-gigacage-typed-arrays.js: Added.
1126         (foo):
1127
1128 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1129
1130         import.meta should not be assignable
1131         https://bugs.webkit.org/show_bug.cgi?id=178202
1132
1133         Reviewed by Saam Barati.
1134
1135         * modules/import-meta-assignment.js: Added.
1136         (shouldThrow):
1137         (SyntaxError.import.meta.can.shouldThrow):
1138
1139 2017-10-11  Saam Barati  <sbarati@apple.com>
1140
1141         Unreviewed. Actually skip certain type profiler tests in debug.
1142
1143         * typeProfiler.yaml:
1144         * typeProfiler/deltablue-for-of.js:
1145         * typeProfiler/getter-richards.js:
1146
1147 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1148
1149         Unreviewed, rolling out r223113 and r223121.
1150         https://bugs.webkit.org/show_bug.cgi?id=178182
1151
1152         Reintroduced 20% regression on Kraken (Requested by rniwa on
1153         #webkit).
1154
1155         Reverted changesets:
1156
1157         "Enable gigacage on iOS"
1158         https://bugs.webkit.org/show_bug.cgi?id=177586
1159         https://trac.webkit.org/changeset/223113
1160
1161         "Use one virtual allocation for all gigacages and their
1162         runways"
1163         https://bugs.webkit.org/show_bug.cgi?id=178050
1164         https://trac.webkit.org/changeset/223121
1165
1166 2017-10-11  Michael Saboff  <msaboff@apple.com>
1167
1168         Disable test262 named capture group tests with direct unicode names and with references before definitions
1169         https://bugs.webkit.org/show_bug.cgi?id=178177
1170
1171         Reviewed by Keith Miller.
1172
1173         Bugs to track fixing these test are:
1174         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1175             "Add support in named capture group identifiers for direct surrogate pairs"
1176         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1177             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1178
1179         * test262.yaml:
1180
1181 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1182
1183         Object properties are undefined in super.call() but not in this.call()
1184         https://bugs.webkit.org/show_bug.cgi?id=177230
1185
1186         Reviewed by Saam Barati.
1187
1188         * stress/super-call-function-subclass.js: Added.
1189         (assert):
1190         (A.prototype.t):
1191         (A):
1192         * stress/super-dot-call-and-apply.js: Added.
1193         (assert):
1194         (A):
1195         (A.prototype.call):
1196         (A.prototype.apply):
1197         (B.prototype.testSuper):
1198         (B):
1199         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1200         (D.prototype.testSuper):
1201         (D):
1202
1203 2017-10-10  Saam Barati  <sbarati@apple.com>
1204
1205         The prototype cache should be aware of the Executable it generates a Structure for
1206         https://bugs.webkit.org/show_bug.cgi?id=177907
1207
1208         Reviewed by Filip Pizlo.
1209
1210         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1211         (assert):
1212         (foo.C):
1213         (foo):
1214         (bar.C):
1215         (bar):
1216         (access):
1217         (makeLongChain):
1218         (accessY):
1219
1220 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1221
1222         `async` should be able to be used as an imported binding name
1223         https://bugs.webkit.org/show_bug.cgi?id=176573
1224
1225         Reviewed by Saam Barati.
1226
1227         * modules/import-default-async.js: Added.
1228         * modules/import-named-async-as.js: Added.
1229         * modules/import-named-async.js: Added.
1230         * modules/import-named-async/target.js: Added.
1231         * modules/import-namespace-async.js: Added.
1232         * test262.yaml:
1233
1234 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1235
1236         Enable gigacage on iOS
1237         https://bugs.webkit.org/show_bug.cgi?id=177586
1238
1239         Reviewed by JF Bastien.
1240         
1241         Add tests for when Gigacage gets runtime disabled.
1242
1243         * stress/disable-gigacage-arrays.js: Added.
1244         (foo):
1245         * stress/disable-gigacage-strings.js: Added.
1246         (foo):
1247         * stress/disable-gigacage-typed-arrays.js: Added.
1248         (foo):
1249
1250 2017-10-09  Michael Saboff  <msaboff@apple.com>
1251
1252         Implement RegExp Unicode property escapes
1253         https://bugs.webkit.org/show_bug.cgi?id=172069
1254
1255         Reviewed by JF Bastien.
1256
1257         Enabled Unicode Property tests.
1258
1259         * test262.yaml:
1260
1261 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1262
1263         Unreviewed, rolling out r223015 and r223025.
1264         https://bugs.webkit.org/show_bug.cgi?id=178093
1265
1266         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1267         #webkit).
1268
1269         Reverted changesets:
1270
1271         "Enable gigacage on iOS"
1272         https://bugs.webkit.org/show_bug.cgi?id=177586
1273         http://trac.webkit.org/changeset/223015
1274
1275         "Unreviewed, disable Gigacage on ARM64 Linux"
1276         https://bugs.webkit.org/show_bug.cgi?id=177586
1277         http://trac.webkit.org/changeset/223025
1278
1279 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1280
1281         Update expectations for test262 tests that pass after r223043.
1282         https://bugs.webkit.org/show_bug.cgi?id=176685
1283
1284         Unreviewed test gardening.
1285
1286         * test262.yaml:
1287
1288 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1289
1290         Unreviewed, rolling out r223022.
1291
1292         This change introduced 18 test262 failures.
1293
1294         Reverted changeset:
1295
1296         "`async` should be able to be used as an imported binding
1297         name"
1298         https://bugs.webkit.org/show_bug.cgi?id=176573
1299         http://trac.webkit.org/changeset/223022
1300
1301 2017-10-09  Saam Barati  <sbarati@apple.com>
1302
1303         3 poly-proto JSC tests timing out on debug after r222827
1304         https://bugs.webkit.org/show_bug.cgi?id=177880
1305         <rdar://problem/34817122>
1306
1307         Unreviewed.
1308
1309         I'm skipping these type profiler tests on debug since they are long running.
1310
1311         * typeProfiler/deltablue-for-of.js:
1312         * typeProfiler/getter-richards.js:
1313
1314 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1315
1316         Safari 10 /11 problem with if (!await get(something)).
1317         https://bugs.webkit.org/show_bug.cgi?id=176685
1318
1319         Reviewed by Saam Barati.
1320
1321         * stress/async-await-basic.js:
1322         (awaitEpression.async):
1323         * stress/async-await-syntax.js:
1324         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1325         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1326
1327 2017-10-08  Saam Barati  <sbarati@apple.com>
1328
1329         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1330
1331         * typeProfiler/deltablue-for-of.js:
1332         * typeProfiler/getter-richards.js:
1333
1334 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1335
1336         `async` should be able to be used as an imported binding name
1337         https://bugs.webkit.org/show_bug.cgi?id=176573
1338
1339         Reviewed by Darin Adler.
1340
1341         * modules/import-default-async.js: Added.
1342         * modules/import-named-async-as.js: Added.
1343         * modules/import-named-async.js: Added.
1344         * modules/import-named-async/target.js: Added.
1345         * modules/import-namespace-async.js: Added.
1346
1347 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1348
1349         Enable gigacage on iOS
1350         https://bugs.webkit.org/show_bug.cgi?id=177586
1351
1352         Reviewed by JF Bastien.
1353         
1354         Add tests for when Gigacage gets runtime disabled.
1355
1356         * stress/disable-gigacage-arrays.js: Added.
1357         (foo):
1358         * stress/disable-gigacage-strings.js: Added.
1359         (foo):
1360         * stress/disable-gigacage-typed-arrays.js: Added.
1361         (foo):
1362
1363 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1364
1365         Unreviewed, rolling out r222791 and r222873.
1366         https://bugs.webkit.org/show_bug.cgi?id=178031
1367
1368         Caused crashes with workers/wasm LayoutTests (Requested by
1369         ryanhaddad on #webkit).
1370
1371         Reverted changesets:
1372
1373         "WebAssembly: no VM / JS version of everything but Instance"
1374         https://bugs.webkit.org/show_bug.cgi?id=177473
1375         http://trac.webkit.org/changeset/222791
1376
1377         "WebAssembly: address no VM / JS follow-ups"
1378         https://bugs.webkit.org/show_bug.cgi?id=177887
1379         http://trac.webkit.org/changeset/222873
1380
1381 2017-10-05  Saam Barati  <sbarati@apple.com>
1382
1383         Make sure all prototypes under poly proto get added into the VM's prototype map
1384         https://bugs.webkit.org/show_bug.cgi?id=177909
1385
1386         Reviewed by Keith Miller.
1387
1388         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1389         (assert):
1390         (foo.C):
1391         (foo):
1392         (set x):
1393
1394 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1395
1396         [JSC] Introduce import.meta
1397         https://bugs.webkit.org/show_bug.cgi?id=177703
1398
1399         Reviewed by Filip Pizlo.
1400
1401         * modules/import-meta-syntax.js: Added.
1402         (shouldThrow):
1403         (shouldNotThrow):
1404         * modules/import-meta.js: Added.
1405         * modules/import-meta/cocoa.js: Added.
1406         * modules/resources/assert.js:
1407         (export.shouldNotThrow):
1408         * stress/import-syntax.js:
1409
1410 2017-10-04  Saam Barati  <sbarati@apple.com>
1411
1412         Make pertinent AccessCases watch the poly proto watchpoint
1413         https://bugs.webkit.org/show_bug.cgi?id=177765
1414
1415         Reviewed by Keith Miller.
1416
1417         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1418         (assert):
1419         (foo.C):
1420         (foo):
1421         (validate):
1422         * stress/poly-proto-clear-stub.js: Added.
1423         (assert):
1424         (foo.C):
1425         (foo):
1426
1427 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1428
1429         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1430
1431         Unreviewed test gardening.
1432
1433         * test262.yaml:
1434
1435 2017-10-04  Saam Barati  <sbarati@apple.com>
1436
1437         3 poly-proto JSC tests timing out on debug after r222827
1438         https://bugs.webkit.org/show_bug.cgi?id=177880
1439
1440         Rubber stamped by Mark Lam.
1441
1442         * microbenchmarks/poly-proto-access.js:
1443         * typeProfiler/deltablue-for-of.js:
1444         * typeProfiler/getter-richards.js:
1445
1446 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1447
1448         Unreviewed, marking tco-catch.js as a failure after test262 update
1449         https://bugs.webkit.org/show_bug.cgi?id=177859
1450
1451         * test262.yaml:
1452
1453 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1454
1455         Unreviewed, marking one async iterator test262 test failed
1456         https://bugs.webkit.org/show_bug.cgi?id=177859
1457
1458         * test262.yaml:
1459
1460 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1461
1462         [Test262] Update Test262 to Oct 4 version
1463         https://bugs.webkit.org/show_bug.cgi?id=177859
1464
1465         Reviewed by Sam Weinig.
1466
1467         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1468         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1469
1470         * test262.yaml:
1471         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1472         (checkSequence):
1473         * test262/harness/typeCoercion.js:
1474         (testCoercibleToIndexZero):
1475         (testCoercibleToIndexOne):
1476         (testCoercibleToIndexFromIndex):
1477         (testNotCoercibleToIndex.testPrimitiveValue):
1478         (testNotCoercibleToInteger):
1479         (testCoercibleToBigIntZero.testPrimitiveValue):
1480         (testCoercibleToBigIntZero):
1481         (testCoercibleToBigIntOne.testPrimitiveValue):
1482         (testCoercibleToBigIntOne):
1483         (testPrimitiveValue):
1484         (testCoercibleToBigIntFromBigInt):
1485         (testNotCoercibleToBigInt.testPrimitiveValue):
1486         (testNotCoercibleToBigInt.testStringValue):
1487         (testNotCoercibleToBigInt):
1488         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1489         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1490         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1491         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1492         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1493         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1494         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1495         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1496         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1497         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1498         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1499         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1500         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1501         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1502         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1503         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1504         (testCoercibleToBigIntZero):
1505         (testCoercibleToBigIntOne):
1506         (testNotCoercibleToBigInt):
1507         (MyError): Deleted.
1508         (valueOf): Deleted.
1509         (toString): Deleted.
1510         (Symbol.toPrimitive): Deleted.
1511         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1512         (testCoercibleToIndexZero):
1513         (testCoercibleToIndexOne):
1514         (testNotCoercibleToIndex):
1515         (MyError): Deleted.
1516         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1517         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1518         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1519         (BigInt.asIntN.valueOf): Deleted.
1520         (BigInt.asIntN.toString): Deleted.
1521         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1522         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1523         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1524         (testCoercibleToBigIntZero):
1525         (testCoercibleToBigIntOne):
1526         (testNotCoercibleToBigInt):
1527         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1528         (testCoercibleToIndexZero):
1529         (testCoercibleToIndexOne):
1530         (testNotCoercibleToIndex):
1531         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1532         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1533         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1534         (bits.valueOf):
1535         (bigint.valueOf):
1536         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1537         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1538         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1539         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1540         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1541         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1542         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1543         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1544         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1545         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1546         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1547         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1548         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1549         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1550         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1551         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1552         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1553         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1554         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1555         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1556         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1557         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1558         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1559         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1560         (replacer):
1561         (BigInt.prototype.toJSON):
1562         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1563         (replacer):
1564         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1565         (BigInt.prototype.toJSON):
1566         * test262/test/built-ins/JSON/stringify/bigint.js:
1567         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1568         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1569         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1570         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1571         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1572         * test262/test/built-ins/Object/proto-from-ctor.js:
1573         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1574         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1575         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1576         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1577         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1578         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1579         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1580         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1581         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1582         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1583         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1584         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1585         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1586         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1587         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1588         * test262/test/built-ins/Proxy/get-fn-realm.js:
1589         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1590         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1591         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1592         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1593         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1594         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1595         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1596         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1597         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1598         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1599         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1600         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1601         (i6.replace):
1602         (i6b.replace):
1603         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1604         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1605         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1606         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1607         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1608         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1609         * test262/test/built-ins/RegExp/u180e.js: Added.
1610         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1611         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1612         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1613         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1614         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1615         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1616         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1617         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1618         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1619         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1620         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1621         * test262/test/built-ins/String/prototype/endsWith/length.js:
1622         * test262/test/built-ins/String/prototype/endsWith/name.js:
1623         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1624         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1625         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1626         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1627         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1628         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1629         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1630         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1631         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1632         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1633         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1634         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1635         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1636         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1637         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1638         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1639         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1640         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1641         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1642         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1643         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1644         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1645         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1646         * test262/test/built-ins/String/prototype/includes/includes.js:
1647         * test262/test/built-ins/String/prototype/includes/length.js:
1648         * test262/test/built-ins/String/prototype/includes/name.js:
1649         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1650         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1651         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1652         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1653         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1654         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1655         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1656         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1657         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1658         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1659         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1660         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1661         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1662         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1663         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1664         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1665         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1666         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1667         * test262/test/built-ins/String/prototype/trim/u180e.js:
1668         * test262/test/built-ins/Symbol/for/cross-realm.js:
1669         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1670         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1671         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1672         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1673         * test262/test/built-ins/Symbol/match/cross-realm.js:
1674         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1675         * test262/test/built-ins/Symbol/search/cross-realm.js:
1676         * test262/test/built-ins/Symbol/species/cross-realm.js:
1677         * test262/test/built-ins/Symbol/split/cross-realm.js:
1678         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1679         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1680         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1681         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1682         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1683         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1684         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1685         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1686         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1687         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1688         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1689         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1690         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1691         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1692         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1693         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1694         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1695         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1696         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1697         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1698         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1699         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1700         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1701         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1702         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1703         * test262/test/language/eval-code/indirect/realm.js:
1704         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1705         (o.get z):
1706         (o.get a):
1707         * test262/test/language/expressions/call/eval-realm-indirect.js:
1708         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1709         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1710         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1711         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1712         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1713         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1714         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1715         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1716         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1717         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1718         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1719         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1720         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1721         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1722         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1723         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1724         * test262/test/language/expressions/less-than/bigint-and-number.js:
1725         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1726         * test262/test/language/expressions/super/realm.js:
1727         * test262/test/language/expressions/tagged-template/cache-realm.js:
1728         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1729         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1730         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1731         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1732         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1733         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1734         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1735         (o.get z):
1736         (o.get a):
1737         * test262/test/language/statements/for-of/iterator-next-reference.js:
1738         (next):
1739         (iterator.next): Deleted.
1740         (x.of.iterable.): Deleted.
1741         (x.of.iterable.get return): Deleted.
1742         (x.of.iterable.iterator.next): Deleted.
1743         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1744         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1745         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1746         * test262/test/language/white-space/mongolian-vowel-separator.js:
1747         * test262/test262-Revision.txt:
1748
1749 2017-10-03  Saam Barati  <sbarati@apple.com>
1750
1751         Implement polymorphic prototypes
1752         https://bugs.webkit.org/show_bug.cgi?id=176391
1753
1754         Reviewed by Filip Pizlo.
1755
1756         * microbenchmarks/poly-proto-access.js: Added.
1757         (assert):
1758         (foo.C):
1759         (foo.C.prototype.get bar):
1760         (foo):
1761         (bar):
1762         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1763         (assert):
1764         (makePolyProtoObject.foo.C):
1765         (makePolyProtoObject.foo):
1766         (makePolyProtoObject):
1767         (performSet):
1768         * microbenchmarks/poly-proto-setter-speed.js: Added.
1769         (assert):
1770         (makePolyProtoObject.foo.C):
1771         (makePolyProtoObject.foo.C.prototype.set p):
1772         (makePolyProtoObject.foo):
1773         (makePolyProtoObject):
1774         (performSet):
1775         * stress/constructor-with-return.js:
1776         (i.tests.forEach.Constructor):
1777         (i.tests.forEach):
1778         (tests.forEach.Constructor): Deleted.
1779         (tests.forEach): Deleted.
1780         * stress/dom-jit-with-poly-proto.js: Added.
1781         (assert):
1782         (makePolyProtoObject.foo.C):
1783         (makePolyProtoObject.foo):
1784         (makePolyProtoObject):
1785         (validate):
1786         * stress/poly-proto-custom-value-and-accessor.js: Added.
1787         (assert):
1788         (makePolyProtoObject.foo.C):
1789         (makePolyProtoObject.foo):
1790         (makePolyProtoObject):
1791         (items.forEach):
1792         (set get for):
1793         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1794         (assert):
1795         (makePolyProtoObject.foo.C):
1796         (makePolyProtoObject.foo):
1797         (makePolyProtoObject):
1798         (foo):
1799         * stress/poly-proto-miss.js: Added.
1800         (makePolyProtoInstanceWithNullPrototype.foo.C):
1801         (makePolyProtoInstanceWithNullPrototype.foo):
1802         (makePolyProtoInstanceWithNullPrototype):
1803         (assert):
1804         (validate):
1805         * stress/poly-proto-op-in-caching.js: Added.
1806         (assert):
1807         (makePolyProtoObject.foo.C):
1808         (makePolyProtoObject.foo):
1809         (makePolyProtoObject):
1810         (validate):
1811         (validate2):
1812         * stress/poly-proto-put-transition.js: Added.
1813         (assert):
1814         (makePolyProtoObject.foo.C):
1815         (makePolyProtoObject.foo):
1816         (makePolyProtoObject):
1817         (performSet):
1818         (i.obj.__proto__.set p):
1819         * stress/poly-proto-set-prototype.js: Added.
1820         (assert):
1821         (let.alternateProto.get x):
1822         (let.alternateProto2.get y):
1823         (let.alternateProto2.get x):
1824         (foo.C):
1825         (foo):
1826         (validate):
1827         * stress/poly-proto-setter.js: Added.
1828         (assert):
1829         (makePolyProtoObject.foo.C):
1830         (makePolyProtoObject.foo.C.prototype.set p):
1831         (makePolyProtoObject.foo.C.prototype.get p):
1832         (makePolyProtoObject.foo):
1833         (makePolyProtoObject):
1834         (performSet):
1835         * stress/poly-proto-using-inheritance.js: Added.
1836         (assert):
1837         (foo.C):
1838         (foo.C.prototype.get baz):
1839         (foo):
1840         (bar.C):
1841         (bar):
1842         (validate):
1843         * stress/primitive-poly-proto.js: Added.
1844         (makePolyProtoInstance.foo.C):
1845         (makePolyProtoInstance.foo):
1846         (makePolyProtoInstance):
1847         (assert):
1848         (validate):
1849         * stress/prototype-is-not-js-object.js: Added.
1850         (foo.bar):
1851         (foo):
1852         (assert):
1853         (validate):
1854         * stress/try-get-by-id-poly-proto.js: Added.
1855         (assert):
1856         (makePolyProtoObject.foo.C):
1857         (makePolyProtoObject.foo):
1858         (makePolyProtoObject):
1859         (tryGetByIdText):
1860         (x.__proto__.get bar):
1861         (validate):
1862         * typeProfiler/overflow.js:
1863
1864 2017-10-03  JF Bastien  <jfbastien@apple.com>
1865
1866         WebAssembly: no VM / JS version of everything but Instance
1867         https://bugs.webkit.org/show_bug.cgi?id=177473
1868
1869         Reviewed by Filip Pizlo.
1870
1871         - Exceeding max on memory growth now returns a range error as per
1872         spec. This is a (very minor) breaking change: it used to throw OOM
1873         error. Update the corresponding test.
1874
1875         * wasm/js-api/memory-grow.js:
1876         (assertEq):
1877         * wasm/js-api/table.js:
1878         (assert.throws):
1879
1880 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1881
1882         Skip JSC test stress/regress-159779-2.js on debug.
1883         https://bugs.webkit.org/show_bug.cgi?id=177204
1884
1885         Unreviewed test gardening.
1886
1887         * stress/regress-159779-2.js:
1888
1889 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1890
1891         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1892         https://bugs.webkit.org/show_bug.cgi?id=175642
1893
1894         Reviewed by Darin Adler.
1895
1896         * ChakraCore/test/Function/apply3.baseline-jsc:
1897
1898 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1899
1900         Unreviewed, rolling out r222564.
1901         https://bugs.webkit.org/show_bug.cgi?id=177720
1902
1903         "It regressed JetStream by 2% on iOS caused by a 50%
1904         regression on the bigfib subtest" (Requested by saamyjoon on
1905         #webkit).
1906
1907         Reverted changeset:
1908
1909         "Add Above/Below comparisons for UInt32 patterns"
1910         https://bugs.webkit.org/show_bug.cgi?id=177281
1911         http://trac.webkit.org/changeset/222564
1912
1913 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1914
1915         [DFG] Support ArrayPush with multiple args
1916         https://bugs.webkit.org/show_bug.cgi?id=175823
1917
1918         Reviewed by Saam Barati.
1919
1920         * microbenchmarks/array-push-0.js: Added.
1921         (arrayPush0):
1922         * microbenchmarks/array-push-1.js: Added.
1923         (arrayPush1):
1924         * microbenchmarks/array-push-2.js: Added.
1925         (arrayPush2):
1926         * microbenchmarks/array-push-3.js: Added.
1927         (arrayPush3):
1928         * stress/array-push-multiple-contiguous.js: Added.
1929         (shouldBe):
1930         (test):
1931         * stress/array-push-multiple-double-nan.js: Added.
1932         (shouldBe):
1933         (test):
1934         * stress/array-push-multiple-double.js: Added.
1935         (shouldBe):
1936         (test):
1937         * stress/array-push-multiple-int32.js: Added.
1938         (shouldBe):
1939         (test):
1940         * stress/array-push-multiple-many-contiguous.js: Added.
1941         (shouldBe):
1942         (test):
1943         * stress/array-push-multiple-many-double.js: Added.
1944         (shouldBe):
1945         (test):
1946         * stress/array-push-multiple-many-int32.js: Added.
1947         (shouldBe):
1948         (test):
1949         * stress/array-push-multiple-many-storage.js: Added.
1950         (shouldBe):
1951         (test):
1952         * stress/array-push-multiple-storage.js: Added.
1953         (shouldBe):
1954         (test):
1955         * stress/array-push-with-force-exit.js: Added.
1956         (target.createBuiltin):
1957
1958 2017-09-29  Saam Barati  <sbarati@apple.com>
1959
1960         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1961         https://bugs.webkit.org/show_bug.cgi?id=177639
1962
1963         Reviewed by Geoffrey Garen.
1964
1965         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1966         (assert):
1967         (Class):
1968         (items.forEach):
1969         (set get for):
1970
1971 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1972
1973         Unreviewed, rolling out r222563, r222565, and r222581.
1974         https://bugs.webkit.org/show_bug.cgi?id=177675
1975
1976         "It causes a crash when playing youtube videos" (Requested by
1977         saamyjoon on #webkit).
1978
1979         Reverted changesets:
1980
1981         "[DFG] Support ArrayPush with multiple args"
1982         https://bugs.webkit.org/show_bug.cgi?id=175823
1983         http://trac.webkit.org/changeset/222563
1984
1985         "Unreviewed, build fix after r222563"
1986         https://bugs.webkit.org/show_bug.cgi?id=175823
1987         http://trac.webkit.org/changeset/222565
1988
1989         "Unreviewed, fix x86 breaking due to exhausted registers"
1990         https://bugs.webkit.org/show_bug.cgi?id=175823
1991         http://trac.webkit.org/changeset/222581
1992
1993 2017-09-28  Mark Lam  <mark.lam@apple.com>
1994
1995         test262: Unexpected passes after r222617 and r222618.
1996         https://bugs.webkit.org/show_bug.cgi?id=177622
1997         <rdar://problem/34725960>
1998
1999         Reviewed by Saam Barati.
2000
2001         Update test262.yaml for tests that are now passing.
2002
2003         * test262.yaml:
2004
2005 2017-09-27  Michael Saboff  <msaboff@apple.com>
2006
2007         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2008         https://bugs.webkit.org/show_bug.cgi?id=177570
2009
2010         Reviewed by Filip Pizlo.
2011
2012         New regression test.
2013
2014         * stress/regress-177570.js: Added.
2015
2016 2017-09-28  Michael Saboff  <msaboff@apple.com>
2017
2018         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2019         https://bugs.webkit.org/show_bug.cgi?id=177423
2020
2021         Reviewed by Mark Lam.
2022
2023         Updated regression test.
2024
2025         * stress/regress-177423.js:
2026         (catch):
2027
2028 2017-09-27  Mark Lam  <mark.lam@apple.com>
2029
2030         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2031         https://bugs.webkit.org/show_bug.cgi?id=177584
2032         <rdar://problem/34463903>
2033
2034         Reviewed by Saam Barati.
2035
2036         * stress/regress-177584.js: Added.
2037         (assertEqual):
2038         (Array.prototype.Symbol.species):
2039
2040 2017-09-27  Saam Barati  <sbarati@apple.com>
2041
2042         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2043         https://bugs.webkit.org/show_bug.cgi?id=177523
2044
2045         Reviewed by Mark Lam.
2046
2047         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2048         (assert):
2049         (Test):
2050         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2051         (addMethods):
2052         (i.Test.prototype.propName):
2053
2054 2017-09-27  Mark Lam  <mark.lam@apple.com>
2055
2056         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2057         https://bugs.webkit.org/show_bug.cgi?id=177423
2058         <rdar://problem/34621320>
2059
2060         Reviewed by Keith Miller.
2061
2062         * stress/regress-177423.js: Added.
2063
2064 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2065
2066         Add Above/Below comparisons for UInt32 patterns
2067         https://bugs.webkit.org/show_bug.cgi?id=177281
2068
2069         Reviewed by Saam Barati.
2070
2071         * stress/uint32-comparison-jump.js: Added.
2072         (shouldBe):
2073         (above):
2074         (aboveOrEqual):
2075         (below):
2076         (belowOrEqual):
2077         (notAbove):
2078         (notAboveOrEqual):
2079         (notBelow):
2080         (notBelowOrEqual):
2081         * stress/uint32-comparison.js: Added.
2082         (shouldBe):
2083         (above):
2084         (aboveOrEqual):
2085         (below):
2086         (belowOrEqual):
2087         (aboveTest):
2088         (aboveOrEqualTest):
2089         (belowTest):
2090         (belowOrEqualTest):
2091
2092 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2093
2094         [DFG] Support ArrayPush with multiple args
2095         https://bugs.webkit.org/show_bug.cgi?id=175823
2096
2097         Reviewed by Saam Barati.
2098
2099         * microbenchmarks/array-push-0.js: Added.
2100         (arrayPush0):
2101         * microbenchmarks/array-push-1.js: Added.
2102         (arrayPush1):
2103         * microbenchmarks/array-push-2.js: Added.
2104         (arrayPush2):
2105         * microbenchmarks/array-push-3.js: Added.
2106         (arrayPush3):
2107         * stress/array-push-multiple-contiguous.js: Added.
2108         (shouldBe):
2109         (test):
2110         * stress/array-push-multiple-double-nan.js: Added.
2111         (shouldBe):
2112         (test):
2113         * stress/array-push-multiple-double.js: Added.
2114         (shouldBe):
2115         (test):
2116         * stress/array-push-multiple-int32.js: Added.
2117         (shouldBe):
2118         (test):
2119         * stress/array-push-multiple-many-contiguous.js: Added.
2120         (shouldBe):
2121         (test):
2122         * stress/array-push-multiple-many-double.js: Added.
2123         (shouldBe):
2124         (test):
2125         * stress/array-push-multiple-many-int32.js: Added.
2126         (shouldBe):
2127         (test):
2128         * stress/array-push-multiple-many-storage.js: Added.
2129         (shouldBe):
2130         (test):
2131         * stress/array-push-multiple-storage.js: Added.
2132         (shouldBe):
2133         (test):
2134
2135 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2136
2137         Unreviewed, rolling out r222518.
2138         https://bugs.webkit.org/show_bug.cgi?id=177507
2139
2140         Break the High Sierra build (Requested by yusukesuzuki on
2141         #webkit).
2142
2143         Reverted changeset:
2144
2145         "Add Above/Below comparisons for UInt32 patterns"
2146         https://bugs.webkit.org/show_bug.cgi?id=177281
2147         http://trac.webkit.org/changeset/222518
2148
2149 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2150
2151         Add Above/Below comparisons for UInt32 patterns
2152         https://bugs.webkit.org/show_bug.cgi?id=177281
2153
2154         Reviewed by Saam Barati.
2155
2156         * stress/uint32-comparison-jump.js: Added.
2157         (shouldBe):
2158         (above):
2159         (aboveOrEqual):
2160         (below):
2161         (belowOrEqual):
2162         (notAbove):
2163         (notAboveOrEqual):
2164         (notBelow):
2165         (notBelowOrEqual):
2166         * stress/uint32-comparison.js: Added.
2167         (shouldBe):
2168         (above):
2169         (aboveOrEqual):
2170         (below):
2171         (belowOrEqual):
2172         (aboveTest):
2173         (aboveOrEqualTest):
2174         (belowTest):
2175         (belowOrEqualTest):
2176
2177 2017-09-23  Keith Miller  <keith_miller@apple.com>
2178
2179         Fix infinite looping test262 test
2180         https://bugs.webkit.org/show_bug.cgi?id=177412
2181
2182         Reviewed by Yusuke Suzuki.
2183
2184         This test was poorly designed since failing it would cause the vm
2185         to inifinite loop. I've fixed it locally and will fix it on github pending
2186         the results of next weeks tc39 meeting.
2187
2188         * test262.yaml:
2189         * test262/test/language/statements/for-of/iterator-next-reference.js:
2190
2191 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2192
2193         test262: $.agent became $262.agent in test262 update
2194         https://bugs.webkit.org/show_bug.cgi?id=177407
2195
2196         Reviewed by Yusuke Suzuki.
2197
2198         * test262.yaml:
2199         ~320 tests pass now that we correctly make $262 available.
2200
2201 2017-09-22  Keith Miller  <keith_miller@apple.com>
2202
2203         Speculatively change iteration protocall to use the same next function
2204         https://bugs.webkit.org/show_bug.cgi?id=175653
2205
2206         Reviewed by Saam Barati.
2207
2208         Change test to match the new iteration behavior.
2209
2210         * stress/spread-optimized-properly.js:
2211
2212 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2213
2214         [DFG][FTL] Profile array vector length for array allocation
2215         https://bugs.webkit.org/show_bug.cgi?id=177051
2216
2217         Reviewed by Saam Barati.
2218
2219         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2220         (target):
2221
2222 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2223
2224         Unreviewed, rolling out r222380.
2225         https://bugs.webkit.org/show_bug.cgi?id=177352
2226
2227         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2228         #webkit).
2229
2230         Reverted changeset:
2231
2232         "[DFG][FTL] Profile array vector length for array allocation"
2233         https://bugs.webkit.org/show_bug.cgi?id=177051
2234         http://trac.webkit.org/changeset/222380
2235
2236 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2237
2238         [DFG][FTL] Profile array vector length for array allocation
2239         https://bugs.webkit.org/show_bug.cgi?id=177051
2240
2241         Reviewed by Saam Barati.
2242
2243         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2244         (target):
2245
2246 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2247
2248         Skip new hanging test262 tests.
2249         https://bugs.webkit.org/show_bug.cgi?id=177326
2250
2251         Unreviewed test gardening.
2252
2253         * test262.yaml:
2254
2255 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2256
2257         Mark 6 test262 tests as passing.
2258         https://bugs.webkit.org/show_bug.cgi?id=177307
2259
2260         Unreviewed test gardening.
2261
2262         * test262.yaml:
2263
2264 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2265
2266         Unreviewed follow-up to r222311.
2267
2268         * test262/harness/sta.js:
2269         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2270         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2271         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2272         * test262/test/built-ins/Array/from/elements-added-after.js:
2273         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2274         * test262/test/built-ins/Array/from/elements-updated-after.js:
2275         * test262/test/built-ins/Array/from/from-array.js:
2276         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2277         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2278         * test262/test/built-ins/Array/from/source-array-boundary.js:
2279         * test262/test/built-ins/Array/from/source-object-constructor.js:
2280         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2281         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2282         * test262/test/built-ins/Array/from/source-object-length.js:
2283         * test262/test/built-ins/Array/from/source-object-missing.js:
2284         * test262/test/built-ins/Array/from/source-object-without.js:
2285         * test262/test/built-ins/Array/from/this-null.js:
2286         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2287         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2288         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2289         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2290         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2291         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2292         * test262/test/language/literals/string/7.8.4-1gs.js:
2293         Fix some files that I failed to update when I applied my patch.
2294
2295 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2296
2297         Update test262 tests
2298         https://bugs.webkit.org/show_bug.cgi?id=177220
2299
2300         Reviewed by Saam Barati and Yusuke Suzuki.
2301
2302         * test262.yaml:
2303         * test262/test262-Revision.txt:
2304         New rebaselined expectations for all tests.
2305
2306         * test262/*:
2307         Updated.
2308
2309 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2310
2311         [DFG] Remove ToThis more aggressively
2312         https://bugs.webkit.org/show_bug.cgi?id=177056
2313
2314         Reviewed by Saam Barati.
2315
2316         * stress/generator-with-this-strict.js: Added.
2317         (shouldBe):
2318         (generator):
2319         (target):
2320         * stress/generator-with-this.js: Added.
2321         (shouldBe):
2322         (generator):
2323         (target):
2324
2325 2017-09-17  Michael Saboff  <msaboff@apple.com>
2326
2327         https://bugs.webkit.org/show_bug.cgi?id=177038
2328         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2329
2330         Reviewed by JF Bastien.
2331
2332         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2333         as it dies using too much memory.
2334
2335 2017-09-15  Saam Barati  <sbarati@apple.com>
2336
2337         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2338         https://bugs.webkit.org/show_bug.cgi?id=176981
2339
2340         Reviewed by Yusuke Suzuki.
2341
2342         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2343         (assert):
2344         (verify):
2345         (func):
2346         (const.bar.createBuiltin):
2347
2348 2017-09-14  Saam Barati  <sbarati@apple.com>
2349
2350         It should be valid to exit before each set when doing arity fixup when inlining
2351         https://bugs.webkit.org/show_bug.cgi?id=176948
2352
2353         Reviewed by Keith Miller.
2354
2355         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2356         (baz):
2357         (bar):
2358         (foo):
2359
2360 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2361
2362         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2363         https://bugs.webkit.org/show_bug.cgi?id=176867
2364
2365         Reviewed by Sam Weinig.
2366
2367         * microbenchmarks/object-get-own-property-symbols.js: Added.
2368         (test):
2369
2370 2017-09-13  Mark Lam  <mark.lam@apple.com>
2371
2372         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2373         https://bugs.webkit.org/show_bug.cgi?id=176888
2374         <rdar://problem/34381832>
2375
2376         Not reviewed.
2377
2378         * stress/op_mod-ConstVar.js:
2379         * stress/op_mod-VarConst.js:
2380         * stress/op_mod-VarVar.js:
2381
2382 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2383
2384         Skip 3 op_mod tests on Debug JSC bots.
2385         https://bugs.webkit.org/show_bug.cgi?id=176630
2386
2387         Unreviewed test gardening.
2388
2389         * stress/op_mod-ConstVar.js:
2390         * stress/op_mod-VarConst.js:
2391         * stress/op_mod-VarVar.js:
2392
2393 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2394
2395         [JSC] Fix Array allocation in Object.keys
2396         https://bugs.webkit.org/show_bug.cgi?id=176826
2397
2398         Reviewed by Saam Barati.
2399
2400         * stress/object-own-property-keys.js: Added.
2401         (shouldBe):
2402
2403 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2404
2405         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2406         https://bugs.webkit.org/show_bug.cgi?id=176010
2407
2408         Reviewed by Filip Pizlo.
2409
2410         * microbenchmarks/weak-map-key.js: Added.
2411         (assert):
2412         (objectKey):
2413         (let.start.Date.now):
2414
2415 2017-09-12  Mark Lam  <mark.lam@apple.com>
2416
2417         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2418         https://bugs.webkit.org/show_bug.cgi?id=176630
2419
2420         Reviewed by JF Bastien.
2421
2422         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2423         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2424         a speculative fix for the bots that are seeing these fail.
2425
2426         I also undid the skipping of the op_mod tests for debug builds.
2427
2428         * stress/op_div-ConstVar.js:
2429         * stress/op_div-VarConst.js:
2430         * stress/op_div-VarVar.js:
2431         * stress/op_mod-ConstVar.js:
2432         * stress/op_mod-VarConst.js:
2433         * stress/op_mod-VarVar.js:
2434
2435 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2436
2437         Skip stress/value-to-boolean.js on Debug bots.
2438         https://bugs.webkit.org/show_bug.cgi?id=176787
2439
2440         Unreviewed test gardening.
2441
2442         * stress/value-to-boolean.js:
2443
2444 2017-09-11  Mark Lam  <mark.lam@apple.com>
2445
2446         Change test expectation for test262/test/language/statements/try/tco-catch.js
2447         https://bugs.webkit.org/show_bug.cgi?id=176749
2448
2449         Rubber stamped by Keith Miller.
2450
2451         It's been failing since at least r221821.  I'm changing the test expectation to
2452         fail to green the bots while I investigate some more.
2453
2454         * test262.yaml:
2455
2456 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2457
2458         Unreviewed, rolling out r221854.
2459
2460         The test added with this change fails on 32-bit JSC bots.
2461
2462         Reverted changeset:
2463
2464         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2465         https://bugs.webkit.org/show_bug.cgi?id=176010
2466         http://trac.webkit.org/changeset/221854
2467
2468 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2469
2470         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2471         https://bugs.webkit.org/show_bug.cgi?id=176010
2472
2473         Reviewed by Filip Pizlo.
2474
2475         * microbenchmarks/weak-map-key.js: Added.
2476         (assert):
2477         (objectKey):
2478         (let.start.Date.now):
2479
2480 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2481
2482         [JSC] Optimize Object.keys by using careful array allocation
2483         https://bugs.webkit.org/show_bug.cgi?id=176654
2484
2485         Reviewed by Darin Adler.
2486
2487         * microbenchmarks/object-keys.js: Added.
2488         (test):
2489
2490 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2491
2492         Error should compute .stack and friends lazily
2493         https://bugs.webkit.org/show_bug.cgi?id=176645
2494
2495         Reviewed by Saam Barati.
2496
2497         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2498         * microbenchmarks/new-error.js: Added.
2499         * microbenchmarks/throw.js: Added.
2500
2501 2017-09-09  Mark Lam  <mark.lam@apple.com>
2502
2503         [Re-landing] Use JIT probes for DFG OSR exit.
2504         https://bugs.webkit.org/show_bug.cgi?id=175144
2505         <rdar://problem/33437050>
2506
2507         Not reviewed.  Original patch reviewed by Saam Barati.
2508
2509         Disable these tests for debug builds because they run too slow with the new OSR exit.
2510
2511         * stress/op_mod-ConstVar.js:
2512         * stress/op_mod-VarConst.js:
2513         * stress/op_mod-VarVar.js:
2514
2515 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2516
2517         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2518         https://bugs.webkit.org/show_bug.cgi?id=176300
2519
2520         Reviewed by Saam Barati.
2521
2522         * stress/new-array-with-size-div.js: Added.
2523         (shouldBe):
2524         (test):
2525         (i.i):
2526
2527 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2528
2529         [DFG] PutByVal with Array::Generic is too generic
2530         https://bugs.webkit.org/show_bug.cgi?id=176345
2531
2532         Reviewed by Filip Pizlo.
2533
2534         * stress/object-assign-symbols.js: Added.
2535         (shouldBe):
2536         (test):
2537         * stress/object-assign.js: Added.
2538         (shouldBe):
2539         (test):
2540         (i.shouldBe.JSON.stringify.test):
2541
2542 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2543
2544         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2545         https://bugs.webkit.org/show_bug.cgi?id=176590
2546
2547         Reviewed by Saam Barati.
2548
2549         * microbenchmarks/object-iterate-symbols.js: Added.
2550         (test):
2551         * microbenchmarks/object-iterate.js: Added.
2552         (test):
2553         * stress/object-iterate-symbols.js: Added.
2554         (shouldBe):
2555         (test):
2556         * stress/object-iterate.js: Added.
2557         (shouldBe):
2558         (test):
2559
2560 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2561
2562         [Win32] 10 JSC stress tests are failing.
2563         https://bugs.webkit.org/show_bug.cgi?id=176538
2564
2565         Reviewed by Mark Lam.
2566
2567         Skip tests on Windows to make the bots green.
2568
2569         * ChakraCore.yaml:
2570         * stress/date-relaxed.js:
2571
2572 2017-09-06  Mark Lam  <mark.lam@apple.com>
2573
2574         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2575         https://bugs.webkit.org/show_bug.cgi?id=176485
2576         <rdar://problem/33898874>
2577
2578         Reviewed by Keith Miller.
2579
2580         * stress/regress-176485.js: Added.
2581
2582 2017-09-05  Saam Barati  <sbarati@apple.com>
2583
2584         isNotCellSpeculation is wrong with respect to SpecEmpty
2585         https://bugs.webkit.org/show_bug.cgi?id=176429
2586
2587         Reviewed by Michael Saboff.
2588
2589         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2590         (Foo):
2591
2592 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2593
2594         test262: Completion values for control flow do not match the spec
2595         https://bugs.webkit.org/show_bug.cgi?id=171265
2596
2597         Reviewed by Saam Barati.
2598
2599         * stress/completion-value.js:
2600         Condensed test for completion values in top level statements.
2601
2602         * stress/super-get-by-id.js:
2603         ClassDeclaration when evaled no longer produce values. Convert
2604         these to ClassExpressions so they produce the class value.
2605         
2606         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2607         This is a progression for currect spec behavior.
2608
2609         * mozilla/mozilla-tests.yaml:
2610         This test is now outdated, so mark it as failing for that reason.
2611
2612         * test262.yaml:
2613         Passing all "cptn" completion value tests.
2614
2615 2017-09-04  Saam Barati  <sbarati@apple.com>
2616
2617         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2618         https://bugs.webkit.org/show_bug.cgi?id=176317
2619
2620         Reviewed by Keith Miller.
2621
2622         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2623         (Foo):
2624
2625 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2626
2627         [DFG][FTL] Efficiently execute number#toString()
2628         https://bugs.webkit.org/show_bug.cgi?id=170007
2629
2630         Reviewed by Keith Miller.
2631
2632         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2633         (test):
2634         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2635         (test):
2636         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2637         (test):
2638         * microbenchmarks/number-to-string-with-radix.js: Added.
2639         (test):
2640         * stress/number-to-string-strength-reduction.js: Added.
2641         (shouldBe):
2642         (test):
2643         * stress/number-to-string-with-radix-10.js: Added.
2644         (shouldBe):
2645         (test):
2646         * stress/number-to-string-with-radix-cse.js: Added.
2647         (shouldBe):
2648         (test):
2649         * stress/number-to-string-with-radix-invalid.js: Added.
2650         (shouldThrow):
2651         * stress/number-to-string-with-radix-watchpoint.js: Added.
2652         (shouldBe):
2653         (test):
2654         (i.i.1e3.Number.prototype.toString):
2655         * stress/number-to-string-with-radix.js: Added.
2656         (shouldBe):
2657         (test):
2658
2659 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2660
2661         [DFG] Relax arity requirement
2662         https://bugs.webkit.org/show_bug.cgi?id=175523
2663
2664         Reviewed by Saam Barati.
2665
2666         * stress/arity-mismatch-arguments-length.js: Added.
2667         (shouldBe):
2668         (test1):
2669         (test):
2670         * stress/arity-mismatch-get-argument.js: Added.
2671         (shouldBe):
2672         (builtin.createBuiltin):
2673         (test):
2674         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2675         (shouldBe):
2676         (inlineTarget):
2677         (test):
2678         * stress/arity-mismatch-inlining.js: Added.
2679         (shouldBe):
2680         (inlineTarget):
2681         (test):
2682         * stress/arity-mismatch-rest.js: Added.
2683         (shouldBe):
2684         (test2):
2685         (test1):
2686         (test):
2687
2688 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2689
2690         [JSC] Fix "name" and "length" of Proxy revoke function
2691         https://bugs.webkit.org/show_bug.cgi?id=176155
2692
2693         Reviewed by Mark Lam.
2694
2695         * test262.yaml:
2696
2697 2017-08-31  Saam Barati  <sbarati@apple.com>
2698
2699         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2700         https://bugs.webkit.org/show_bug.cgi?id=176206
2701
2702         Reviewed by Keith Miller.
2703
2704         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2705         (a):
2706         (b):
2707         (foo):
2708
2709 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2710
2711         Skip two slow JSC tests after r221422.
2712
2713         Unreviewed test gardening.
2714
2715         * stress/regexp-prototype-match-on-too-long-rope.js:
2716         * stress/regexp-prototype-test-on-too-long-rope.js:
2717
2718 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2719
2720         Unreviewed, skipping slow tests.
2721         
2722         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2723         work differently now.
2724
2725         * stress/regexp-prototype-exec-on-too-long-rope.js:
2726         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2727
2728 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2729
2730         [JSC] Use reifying system for "name" property of builtin JSFunction
2731         https://bugs.webkit.org/show_bug.cgi?id=175260
2732
2733         Reviewed by Saam Barati.
2734
2735         * stress/accessors-get-set-prefix.js:
2736         * stress/builtin-function-name.js: Added.
2737         (shouldBe):
2738         (shouldThrow):
2739         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2740         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2741         * stress/private-name-as-anonymous-builtin.js: Added.
2742         (shouldBe):
2743         (NotPromise):
2744
2745 2017-08-30  Saam Barati  <sbarati@apple.com>
2746
2747         Unreviewed. Make test stop printing.
2748
2749         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2750
2751 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2752
2753         Unreviewed, rolling out r221327.
2754
2755         This change caused test262 failures.
2756
2757         Reverted changeset:
2758
2759         "[JSC] Use reifying system for "name" property of builtin
2760         JSFunction"
2761         https://bugs.webkit.org/show_bug.cgi?id=175260
2762         http://trac.webkit.org/changeset/221327
2763
2764 2017-08-30  Saam Barati  <sbarati@apple.com>
2765
2766         semicolon is being interpreted as an = in the LiteralParser
2767         https://bugs.webkit.org/show_bug.cgi?id=176114
2768
2769         Reviewed by Oliver Hunt.
2770
2771         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2772         * stress/resources/literal-parser-test-case.js: Added.
2773
2774 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2775
2776         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2777         https://bugs.webkit.org/show_bug.cgi?id=166698
2778
2779         Reviewed by Yusuke Suzuki.
2780
2781         * stress/async-iteration-for-await-of-syntax.js: Added.
2782         (assert):
2783         (checkSyntax):
2784         (checkSyntaxError):
2785         (checkSimpleAsyncGeneratorSloppyMode):
2786         (checkSimpleAsyncGeneratorStrictMode):
2787         (checkNestedAsyncGenerators):
2788         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2789         * stress/async-iteration-for-await-of.js: Added.
2790         (assert):
2791         (async.foo):
2792         (async.boo):
2793         (const.boo.async):
2794
2795 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2796
2797         [JSC] Use reifying system for "name" property of builtin JSFunction
2798         https://bugs.webkit.org/show_bug.cgi?id=175260
2799
2800         Reviewed by Saam Barati.
2801
2802         * stress/accessors-get-set-prefix.js:
2803         * stress/builtin-function-name.js: Added.
2804         (shouldBe):
2805         (shouldThrow):
2806         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2807         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2808
2809 2017-08-25  Saam Barati  <sbarati@apple.com>
2810
2811         Support compiling catch in the DFG
2812         https://bugs.webkit.org/show_bug.cgi?id=174590
2813         <rdar://problem/34047845>
2814
2815         Reviewed by Filip Pizlo.
2816
2817         * microbenchmarks/delta-blue-try-catch.js: Added.
2818         (exception):
2819         (value):
2820         (OrderedCollection):
2821         (OrderedCollection.prototype.add):
2822         (OrderedCollection.prototype.at):
2823         (OrderedCollection.prototype.size):
2824         (OrderedCollection.prototype.removeFirst):
2825         (OrderedCollection.prototype.remove):
2826         (Strength):
2827         (Strength.stronger):
2828         (Strength.weaker):
2829         (Strength.weakestOf):
2830         (Strength.strongest):
2831         (Strength.prototype.nextWeaker):
2832         (Constraint):
2833         (Constraint.prototype.addConstraint):
2834         (Constraint.prototype.satisfy):
2835         (Constraint.prototype.destroyConstraint):
2836         (Constraint.prototype.isInput):
2837         (UnaryConstraint):
2838         (UnaryConstraint.prototype.addToGraph):
2839         (UnaryConstraint.prototype.chooseMethod):
2840         (UnaryConstraint.prototype.isSatisfied):
2841         (UnaryConstraint.prototype.markInputs):
2842         (UnaryConstraint.prototype.output):
2843         (UnaryConstraint.prototype.recalculate):
2844         (UnaryConstraint.prototype.markUnsatisfied):
2845         (UnaryConstraint.prototype.inputsKnown):
2846         (UnaryConstraint.prototype.removeFromGraph):
2847         (StayConstraint):
2848         (StayConstraint.prototype.execute):
2849         (EditConstraint.prototype.isInput):
2850         (EditConstraint.prototype.execute):
2851         (BinaryConstraint):
2852         (BinaryConstraint.prototype.chooseMethod):
2853         (BinaryConstraint.prototype.addToGraph):
2854         (BinaryConstraint.prototype.isSatisfied):
2855         (BinaryConstraint.prototype.markInputs):
2856         (BinaryConstraint.prototype.input):
2857         (BinaryConstraint.prototype.output):
2858         (BinaryConstraint.prototype.recalculate):
2859         (BinaryConstraint.prototype.markUnsatisfied):
2860         (BinaryConstraint.prototype.inputsKnown):
2861         (BinaryConstraint.prototype.removeFromGraph):
2862         (ScaleConstraint):
2863         (ScaleConstraint.prototype.addToGraph):
2864         (ScaleConstraint.prototype.removeFromGraph):
2865         (ScaleConstraint.prototype.markInputs):
2866         (ScaleConstraint.prototype.execute):
2867         (ScaleConstraint.prototype.recalculate):
2868         (EqualityConstraint):
2869         (EqualityConstraint.prototype.execute):
2870         (Variable):
2871         (Variable.prototype.addConstraint):
2872         (Variable.prototype.removeConstraint):
2873         (Planner):
2874         (Planner.prototype.incrementalAdd):
2875         (Planner.prototype.incrementalRemove):
2876         (Planner.prototype.newMark):
2877         (Planner.prototype.makePlan):
2878         (Planner.prototype.extractPlanFromConstraints):
2879         (Planner.prototype.addPropagate):
2880         (Planner.prototype.removePropagateFrom):
2881         (Planner.prototype.addConstraintsConsumingTo):
2882         (Plan):
2883         (Plan.prototype.addConstraint):
2884         (Plan.prototype.size):
2885         (Plan.prototype.constraintAt):
2886         (Plan.prototype.execute):
2887         (chainTest):
2888         (projectionTest):
2889         (change):
2890         (deltaBlue):
2891         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2892         (assert):
2893         (Numbers):
2894         (Numbers.prototype.next):
2895         (return.Transpose):
2896         (return.Transpose.prototype.next):
2897         (transpose):
2898         (verifyEven):
2899         (verifyString):
2900         (foo):
2901         (runIterators):
2902         * microbenchmarks/try-catch-word-count.js: Added.
2903         (let.assert):
2904         (EOF):
2905         (let.texts):
2906         (let.o.apply):
2907         (foo):
2908         (bar):
2909         (f):
2910         (run):
2911         (test1):
2912         (test2):
2913         (test3):
2914         (fn):
2915         (A):
2916         (B):
2917         (A.prototype.getValue):
2918         (B.prototype.getParentValue):
2919         (strlen):
2920         (sum.0):
2921         (test):
2922         (result.test.o):
2923         (set add.set add):
2924         (set forEach):
2925         (stringHash):
2926         (set if):
2927         (testFunction):
2928         (set delete.set has.set add):
2929         * stress/catch-set-argument-speculation-failure.js: Added.
2930         (o):
2931         (e):
2932         (e2):
2933         (escape):
2934         (baz):
2935         (noInline.run):
2936         (noInline):
2937         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2938         (foo):
2939         (e):
2940         (baz):
2941         (bar):
2942
2943 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2944
2945         Unreviewed, rolling out r221119, r221124, and r221143.
2946         https://bugs.webkit.org/show_bug.cgi?id=175973
2947
2948         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2949         on #webkit).
2950
2951         Reverted changesets:
2952
2953         "Support compiling catch in the DFG"
2954         https://bugs.webkit.org/show_bug.cgi?id=174590
2955         http://trac.webkit.org/changeset/221119
2956
2957         "Unreviewed, build fix in GTK port"
2958         https://bugs.webkit.org/show_bug.cgi?id=174590
2959         http://trac.webkit.org/changeset/221124
2960
2961         "DFG::JITCode::osrEntry should get sorted since we perform a
2962         binary search on it"
2963         https://bugs.webkit.org/show_bug.cgi?id=175893
2964         http://trac.webkit.org/changeset/221143
2965
2966 2017-08-24  Michael Saboff  <msaboff@apple.com>
2967
2968         Add support for RegExp "dotAll" flag
2969         https://bugs.webkit.org/show_bug.cgi?id=175924
2970
2971         Reviewed by Keith Miller.
2972
2973         Updated tests for new dotAll ('s' flag) changes.
2974
2975         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2976         * stress/static-getter-in-names.js:
2977
2978 2017-08-24  Mark Lam  <mark.lam@apple.com>
2979
2980         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2981         https://bugs.webkit.org/show_bug.cgi?id=175940
2982         <rdar://problem/29003921>
2983
2984         Reviewed by Saam Barati.
2985
2986         * stress/regress-164081.js: Added.
2987         (shouldEqual):
2988         (testcase):
2989
2990 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2991
2992         Skip flaky JSC test stress/test-finally.js.
2993         https://bugs.webkit.org/show_bug.cgi?id=160283
2994
2995         Unreviewed test gardening.
2996
2997         * stress/test-finally.js:
2998
2999 2017-08-23  Saam Barati  <sbarati@apple.com>
3000
3001         Support compiling catch in the DFG
3002         https://bugs.webkit.org/show_bug.cgi?id=174590
3003
3004         Reviewed by Filip Pizlo.
3005
3006         * microbenchmarks/delta-blue-try-catch.js: Added.
3007         (exception):
3008         (value):
3009         (OrderedCollection):
3010         (OrderedCollection.prototype.add):
3011         (OrderedCollection.prototype.at):
3012         (OrderedCollection.prototype.size):
3013         (OrderedCollection.prototype.removeFirst):
3014         (OrderedCollection.prototype.remove):
3015         (Strength):
3016         (Strength.stronger):
3017         (Strength.weaker):
3018         (Strength.weakestOf):
3019         (Strength.strongest):
3020         (Strength.prototype.nextWeaker):
3021         (Constraint):
3022         (Constraint.prototype.addConstraint):
3023         (Constraint.prototype.satisfy):
3024         (Constraint.prototype.destroyConstraint):
3025         (Constraint.prototype.isInput):
3026         (UnaryConstraint):
3027         (UnaryConstraint.prototype.addToGraph):
3028         (UnaryConstraint.prototype.chooseMethod):
3029         (UnaryConstraint.prototype.isSatisfied):
3030         (UnaryConstraint.prototype.markInputs):
3031         (UnaryConstraint.prototype.output):
3032         (UnaryConstraint.prototype.recalculate):
3033         (UnaryConstraint.prototype.markUnsatisfied):
3034         (UnaryConstraint.prototype.inputsKnown):
3035         (UnaryConstraint.prototype.removeFromGraph):
3036         (StayConstraint):
3037         (StayConstraint.prototype.execute):
3038         (EditConstraint.prototype.isInput):
3039         (EditConstraint.prototype.execute):
3040         (BinaryConstraint):
3041         (BinaryConstraint.prototype.chooseMethod):
3042         (BinaryConstraint.prototype.addToGraph):
3043         (BinaryConstraint.prototype.isSatisfied):
3044         (BinaryConstraint.prototype.markInputs):
3045         (BinaryConstraint.prototype.input):
3046         (BinaryConstraint.prototype.output):
3047         (BinaryConstraint.prototype.recalculate):
3048         (BinaryConstraint.prototype.markUnsatisfied):
3049         (BinaryConstraint.prototype.inputsKnown):
3050         (BinaryConstraint.prototype.removeFromGraph):
3051         (ScaleConstraint):
3052         (ScaleConstraint.prototype.addToGraph):
3053         (ScaleConstraint.prototype.removeFromGraph):
3054         (ScaleConstraint.prototype.markInputs):
3055         (ScaleConstraint.prototype.execute):
3056         (ScaleConstraint.prototype.recalculate):
3057         (EqualityConstraint):
3058         (EqualityConstraint.prototype.execute):
3059         (Variable):
3060         (Variable.prototype.addConstraint):
3061         (Variable.prototype.removeConstraint):
3062         (Planner):
3063         (Planner.prototype.incrementalAdd):
3064         (Planner.prototype.incrementalRemove):
3065         (Planner.prototype.newMark):
3066         (Planner.prototype.makePlan):
3067         (Planner.prototype.extractPlanFromConstraints):
3068         (Planner.prototype.addPropagate):
3069         (Planner.prototype.removePropagateFrom):
3070         (Planner.prototype.addConstraintsConsumingTo):
3071         (Plan):
3072         (Plan.prototype.addConstraint):
3073         (Plan.prototype.size):
3074         (Plan.prototype.constraintAt):
3075         (Plan.prototype.execute):
3076         (chainTest):
3077         (projectionTest):
3078         (change):
3079         (deltaBlue):
3080         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3081         (assert):
3082         (Numbers):
3083         (Numbers.prototype.next):
3084         (return.Transpose):
3085         (return.Transpose.prototype.next):
3086         (transpose):
3087         (verifyEven):
3088         (verifyString):
3089         (foo):
3090         (runIterators):
3091         * microbenchmarks/try-catch-word-count.js: Added.
3092         (let.assert):
3093         (EOF):
3094         (let.texts):
3095         (let.o.apply):
3096         (foo):
3097         (bar):
3098         (f):
3099         (run):
3100         (test1):
3101         (test2):
3102         (test3):
3103         (fn):
3104         (A):
3105         (B):
3106         (A.prototype.getValue):
3107         (B.prototype.getParentValue):
3108         (strlen):
3109         (sum.0):
3110         (test):
3111         (result.test.o):
3112         (set add.set add):
3113         (set forEach):
3114         (stringHash):
3115         (set if):
3116         (testFunction):
3117         (set delete.set has.set add):
3118         * stress/catch-set-argument-speculation-failure.js: Added.
3119         (o):
3120         (e):
3121         (e2):
3122         (escape):
3123         (baz):
3124         (noInline.run):
3125         (noInline):
3126         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3127         (foo):
3128         (e):
3129         (baz):
3130         (bar):
3131
3132 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3133
3134         [JSC] Optimize Map iteration with intrinsic
3135         https://bugs.webkit.org/show_bug.cgi?id=174355
3136
3137         Reviewed by Saam Barati.
3138
3139         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3140         (shouldBe):
3141         (throw.new.Error):
3142         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3143         (shouldBe):
3144         (throw.new.Error.let.iterator.set Symbol):
3145         (throw.new.Error.set add):
3146         (let.iterator.set Symbol):
3147
3148 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3149
3150         Add a micro-benchmark for checking that accessing a variable within a 'with'
3151         block does not automatically prevent type prediction.
3152         https://bugs.webkit.org/show_bug.cgi?id=175738
3153
3154         Reviewed by Saam Barati.
3155
3156         * stress/with_and_arith.js: Added.
3157         (with):
3158
3159 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3160
3161         [ESNext] Async iteration - Implement Async Generator - runtime
3162         https://bugs.webkit.org/show_bug.cgi?id=175240
3163
3164         Reviewed by Yusuke Suzuki.
3165
3166         * stress/async-iteration-async-from-sync.js: Added.
3167         (assert):
3168         (const.Logger):
3169         (this.fullfilled):
3170         (this.fullfilledDone):
3171         (this.rejected):
3172         (this.catched):
3173         (this.isFinal):
3174         (_assertLogger):
3175         (const.assertLogger):
3176         (const.getPromise.promiseHolder.return.new.Promise):
3177         (foo):
3178         (async.boo):
3179         (bar):
3180         (async.baz):
3181         (async.goo):
3182         * stress/async-iteration-basic.js: Added.
3183         (assert):
3184         (const.Logger):
3185         (this.fullfilled):
3186         (this.fullfilledDone):
3187         (this.rejected):
3188         (this.catched):
3189         (this.isFinal):
3190         (_assertLogger):
3191         (const.assertLogger):
3192         (const.getPromise.promiseHolder.return.new.Promise):
3193         (async.generator):
3194         (iterator.next.then):
3195         (async.baz):
3196         (async.boo):
3197         (async.foo):
3198         (async.goo):
3199         (A.prototype.async.foo):
3200         (A.prototype.async.boo):
3201         (A):
3202         (asyncGenExp.async):
3203         (async.joo):
3204         (j.next.then):
3205         (then):
3206         (async.koo):
3207         (async.loo):
3208         (async.moo):
3209         (async.noo):
3210         (async.ooo):
3211         (async.roo):
3212         (async.poo):
3213         (async.soo):
3214         (async.too):
3215         * stress/async-iteration-evaluation.js: Added.
3216         (assert):
3217         (async.foo):
3218         (catch):
3219         * stress/async-iteration-syntax.js:
3220         * stress/async-iteration-yield-promise.js: Added.
3221         (assert):
3222         (const.Logger):
3223         (this.fullfilled):
3224         (this.fullfilledDone):
3225         (this.rejected):
3226         (this.catched):
3227         (this.isFinal):
3228         (_assertLogger):
3229         (const.assertLogger):
3230         (const.getPromise.promiseHolder.return.new.Promise):
3231         (async.foo):
3232         (async.boo):
3233         (async.bar):
3234         * stress/async-iteration-yield-star-interface.js: Added.
3235         (assert):
3236         (const.getPromise.promiseHolder.return.new.Promise):
3237         (const.Logger):
3238         (this.fullfilled):
3239         (this.fullfilledDone):
3240         (this.rejected):
3241         (this.catched):
3242         (this.custom):
3243         (this.isFinal):
3244         (_assertLogger):
3245         (const.assertLogger):
3246         (let.asyncIter.Symbol.asyncIterator):
3247         (let.asyncIter.next):
3248         (let.asyncIter.throw):
3249         (let.asyncIter.return):
3250         (async.foo):
3251         (asyncIter.Symbol.asyncIterator):
3252         (asyncIter.next):
3253         (async.boo):
3254         (asyncIter.return):
3255         (async.bar):
3256         (async.baz):
3257         (async.foobar):
3258         * stress/async-iteration-yield-star.js: Added.
3259         (assert):
3260         (const.Logger):
3261         (this.fullfilled):
3262         (this.fullfilledDone):
3263         (this.rejected):
3264         (this.catched):
3265         (this.custom):
3266         (this.isFinal):
3267         (_assertLogger):
3268         (const.assertLogger):
3269         (const.getPromise.promiseHolder.return.new.Promise):
3270         (async.foo):
3271         (async.boo):
3272         (async.bar):
3273         (async.baz):
3274         (async.joo):
3275         (async.goo):
3276         (async.koo):
3277         (async.loo):
3278         (let.asyncIter.Symbol.asyncIterator):
3279         (let.asyncIter.next):
3280         (let.asyncIter.throw):
3281         (let.asyncIter.return):
3282         (async.moo):
3283         (async.noo):
3284         * test262.yaml:
3285
3286 2017-08-23  JF Bastien  <jfbastien@apple.com>
3287
3288         Fix printing in test
3289
3290         Unreviewed: fixing verbosity, shouldn't have been there.
3291
3292         * wasm/regress/175693.js:
3293         (else.else):
3294         (catch):
3295
3296 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3297
3298         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3299         https://bugs.webkit.org/show_bug.cgi?id=172543
3300
3301         Unreviewed test gardening.
3302
3303         * microbenchmarks/generator-with-several-types.js:
3304
3305 2017-08-17  JF Bastien  <jfbastien@apple.com>
3306
3307         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3308         https://bugs.webkit.org/show_bug.cgi?id=175693
3309         <rdar://problem/33952443>
3310
3311         Reviewed by Saam Barati.
3312
3313         Add a regression directory for WebAssembly tests.
3314
3315         * wasm.yaml:
3316         * wasm/regress/175693.js: Added.
3317         (else.else):
3318         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3319         (catch):
3320         * wasm/regress/175693.wasm: Added.
3321
3322 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3323
3324         Support the 'with' keyword in FTL.
3325         https://bugs.webkit.org/show_bug.cgi?id=175585
3326
3327         Reviewed by Saam Barati.
3328
3329         Also improve the JSTest/stress/with.js file to test
3330         what happens when non-objects are passed to with.
3331
3332         * stress/with.js:
3333         (foo):
3334         (i.catch):
3335         (i.with): Deleted.
3336
3337 2017-08-14  Keith Miller  <keith_miller@apple.com>
3338
3339         Add testing tool to lie to the DFG about profiles
3340         https://bugs.webkit.org/show_bug.cgi?id=175487
3341
3342         Reviewed by Saam Barati.
3343
3344         * stress/compare-eq-incomplete-profile.js: Added.
3345         (const.test.createBuiltin):
3346
3347 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3348
3349         Support the with keyword in DFG
3350         https://bugs.webkit.org/show_bug.cgi?id=175470
3351
3352         Reviewed by Saam Barati.
3353
3354         Added a new stress-test for the 'with' keyword, that caught a bug in a
3355         previous version of this code.
3356
3357         * stress/with.js: Added.
3358         (i.with):
3359
3360 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3361
3362         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3363         https://bugs.webkit.org/show_bug.cgi?id=175544
3364
3365         Unreviewed test gardening.
3366
3367         * ChakraCore.yaml:
3368
3369 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3370
3371         Early error on ANY operator before new.target
3372         https://bugs.webkit.org/show_bug.cgi?id=157970
3373
3374         Reviewed by Saam Barati.
3375
3376         Instead of throwing if any unary operator precedes new.target, only
3377         throw if the unary operator updates the reference.
3378
3379         The following become legal in JSC:
3380
3381         ```
3382         !new.target
3383         ~new.target
3384         typeof new.target
3385         delete new.target
3386         void new.target
3387         ```
3388
3389         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3390
3391         * stress/new-target-syntax-errors.js:
3392         * stress/new-target.js:
3393
3394 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3395
3396         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3397         https://bugs.webkit.org/show_bug.cgi?id=175255
3398
3399         Unreviewed test gardening.
3400
3401         * stress/regress-169783.js:
3402         * wasm/stress/oom.js:
3403
3404 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3405
3406         REGRESSION: 2 test262/test/language/statements/async-function failures
3407         https://bugs.webkit.org/show_bug.cgi?id=175334
3408
3409         Reviewed by Yusuke Suzuki.
3410
3411         Add @skip parameters to tests, and remove test for async iterator from 
3412         async await syntax test because it is already covered by async-iterator-syntax.js
3413
3414         * stress/async-await-syntax.js:
3415         * stress/async-iteration-syntax.js:
3416
3417 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3418
3419         Unreviewed, gardening test262 for Promise resolve / reject function length
3420         https://bugs.webkit.org/show_bug.cgi?id=175333
3421
3422         * test262.yaml:
3423
3424 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3425
3426         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3427         https://bugs.webkit.org/show_bug.cgi?id=175307
3428
3429         Reviewed by Saam Barati.
3430
3431         * stress/typedarray-getownproperty-not-configurable.js: Added.
3432         (assert):
3433         (foo):
3434
3435 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3436
3437         Promise resolve and reject function should have length = 1
3438         https://bugs.webkit.org/show_bug.cgi?id=175242
3439
3440         Reviewed by Saam Barati.
3441
3442         * stress/builtin-function-length.js: Added.
3443         (shouldBe):
3444         (shouldThrow):
3445         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3446         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3447
3448 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3449
3450         [ESNext] Async iteration - Implement Async Generator - parser
3451         https://bugs.webkit.org/show_bug.cgi?id=175210
3452
3453         Reviewed by Yusuke Suzuki.
3454
3455         * stress/async-await-syntax.js:
3456         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3457         * stress/async-iteration-syntax.js: Added.
3458         (assert):
3459         (checkSyntax):
3460         (checkSyntaxError):
3461         (checkSimpleAsyncGeneratorSloppyMode):
3462         (checkSimpleAsyncGeneratorStrictMode):
3463         (checkNestedAsyncGenerators):
3464         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3465         * stress/generator-class-methods-syntax.js:
3466
3467 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3468
3469         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3470         https://bugs.webkit.org/show_bug.cgi?id=175150
3471
3472         Unreviewed test gardening.
3473
3474         * wasm/js-api/test_memory_constructor.js:
3475
3476 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3477
3478         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3479         https://bugs.webkit.org/show_bug.cgi?id=175100
3480
3481         Reviewed by Mark Lam.
3482
3483         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3484         available memory until an out of memory exception happens.
3485
3486         The Linux kernel is more tuned for server workloads than for GUI
3487         responsiveness. When a process tries to use a lot of memory, Linux
3488         will do its best to serve the request. This usually translates to
3489         free physical RAM by writing to disk dirty pages and/or moving out
3490         less recently used pages to swap (disk storage).
3491         Meanwhile it does this, the system will become unresponsive and this
3492         leads to freezes that can last even some minutes on the worst cases.
3493
3494         Therefore, let's skip this test on Linux as it will cause more harm
3495         than good on the Linux bots or on the machines of Linux developers.
3496
3497         * wasm/stress/oom.js:
3498
3499 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3500
3501         [JSC] Remove unnecessary print from stress\promise-finally.js test
3502         https://bugs.webkit.org/show_bug.cgi?id=175015
3503
3504         Reviewed by Yusuke Suzuki.
3505
3506         * stress/promise-finally.js:
3507         (p.finally):
3508         (then):
3509
3510 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3511
3512         Unreviewed, update test262 results for optional catch binding
3513
3514         * test262.yaml:
3515
3516 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3517
3518         [JSC] Support optional catch binding
3519         https://bugs.webkit.org/show_bug.cgi?id=174981
3520
3521         Reviewed by Saam Barati.
3522
3523         * stress/optional-catch-binding-syntax.js: Added.
3524         (testSyntax):
3525         (testSyntaxError):
3526         (catch.catch):
3527         * stress/optional-catch-binding.js: Added.
3528         (shouldBe):
3529         (throwException):
3530
3531 2017-07-28  Mark Lam  <mark.lam@apple.com>
3532
3533         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3534         https://bugs.webkit.org/show_bug.cgi?id=174948
3535         <rdar://problem/33495680>
3536
3537         Reviewed by Filip Pizlo.
3538
3539         * stress/regress-174948.js: Added.
3540
3541 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3542
3543         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3544         https://bugs.webkit.org/show_bug.cgi?id=174900
3545
3546         Reviewed by Saam Barati.
3547
3548         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3549         (sideEffect):
3550         (args):
3551         (test):
3552
3553 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3554
3555         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3556         https://bugs.webkit.org/show_bug.cgi?id=171637
3557
3558         Reviewed by Darin Adler.
3559
3560         * stress/domjit-getter-complex-with-incorrect-object.js:
3561         (i.shouldThrow):
3562         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3563         (shouldBe):
3564         (i.shouldThrow):
3565
3566 2017-07-26  JF Bastien  <jfbastien@apple.com>
3567
3568         WebAssembly: test throwing out of the start function
3569         https://bugs.webkit.org/show_bug.cgi?id=165714
3570         <rdar://problem/29760251>
3571
3572         Reviewed by Keith Miller.
3573
3574         * wasm/assert.js:
3575         * wasm/function-tests/trap-from-start.js: Added.
3576         (StartTraps):
3577         * wasm/function-tests/trap-from-start-async.js: Added.
3578         (async.StartTrapsAsync):
3579
3580 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3581
3582         [FTL] Arguments elimination is suppressed by unreachable blocks
3583         https://bugs.webkit.org/show_bug.cgi?id=174352
3584
3585         Reviewed by Filip Pizlo.
3586
3587         * stress/arguments-elimination-force-exit.js: Added.
3588         (shouldBe):
3589         (strict):
3590         (sloppy):
3591         * stress/arguments-elimination-throw.js: Added.
3592         (shouldBe):
3593         (shouldThrow):
3594         (sloppy):
3595         (isArguments):
3596
3597 2017-07-13  Mark Lam  <mark.lam@apple.com>
3598
3599         Add some additional test cases for bug 170896.
3600         https://bugs.webkit.org/show_bug.cgi?id=174491
3601
3602         Reviewed by Filip Pizlo.
3603
3604         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3605         * stress/regress-170896-with-double-shape-profile.js: Added.
3606         (test):
3607         * stress/regress-170896-with-int32-shape-profile.js: Added.
3608         (test):
3609         * stress/regress-170896.js: Removed.
3610
3611 2017-07-13  Saam Barati  <sbarati@apple.com>
3612
3613         Missing exception check in JSObject::hasInstance
3614         https://bugs.webkit.org/show_bug.cgi?id=174455
3615         <rdar://problem/31384608>
3616
3617         Reviewed by Mark Lam.
3618
3619         * stress/has-instance-exception-check.js: Added.
3620         (assert):
3621         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3622
3623 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3624
3625         [ESnext] Implement Object Spread
3626         https://bugs.webkit.org/show_bug.cgi?id=167963
3627
3628         Reviewed by Saam Barati.
3629
3630         * stress/obj-rest-destructuring-order.js: Added.
3631         (assert):
3632         (o.get z):
3633         (o.get a):
3634         * stress/obj-spread-order.js: Added.
3635         (assert):
3636         (o.get z):
3637         (o.get a):
3638         * stress/object-spread.js: Added.
3639         (let.assert):
3640         (assert.sameValue):
3641         (let.o.get a):
3642         (let.obj.get c):
3643         (cthulhu.get x):
3644         (let.obj.set c):
3645         (calls.o.get z):
3646         (calls.o.get a):
3647         (try.let.obj.get foo):
3648         (get calls):
3649
3650 2017-07-12  Saam Barati  <sbarati@apple.com>
3651
3652         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3653         https://bugs.webkit.org/show_bug.cgi?id=174411
3654         <rdar://problem/31696186>
3655
3656         Reviewed by Mark Lam.
3657
3658         * stress/generic-arguments-correct-delete-behavior.js: Added.
3659         (assert):
3660         (makeTest):
3661
3662 2017-07-07  Mark Lam  <mark.lam@apple.com>
3663
3664         \n\r is not the same as \r\n.
3665         https://bugs.webkit.org/show_bug.cgi?id=173053
3666
3667         Reviewed by Keith Miller.
3668
3669         * stress/regress-173053.js: Added.
3670         * stress/template-literal-line-terminators.js:
3671
3672 2017-07-06  Saam Barati  <sbarati@apple.com>
3673
3674         We are missing places where we invalidate the for-in context
3675         https://bugs.webkit.org/show_bug.cgi?id=174184
3676
3677         Reviewed by Geoffrey Garen.
3678
3679         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3680         (assert):
3681         (test):
3682
3683 2017-07-05  Saam Barati  <sbarati@apple.com>
3684
3685         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3686         https://bugs.webkit.org/show_bug.cgi?id=174188
3687         <rdar://problem/30581423>
3688
3689         Reviewed by Mark Lam.
3690
3691         * stress/new-array-having-a-bad-time-double.js: Added.
3692         (assert):
3693         (foo):
3694
3695 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3696
3697         WTF::StringImpl::copyChars segfaults when built with GCC 7
3698         https://bugs.webkit.org/show_bug.cgi?id=173407
3699
3700         Reviewed by Andreas Kling.
3701
3702         * stress/string-repeat-copy-chars-crash.js: Added.
3703         (shouldBe):
3704
3705 2017-07-03  Saam Barati  <sbarati@apple.com>
3706
3707         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3708
3709         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3710
3711 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3712
3713         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3714
3715         It requires too much memory.
3716
3717         * stress/dont-reserve-huge-capacity-lexer.js:
3718
3719 2017-06-30  Michael Saboff  <msaboff@apple.com>
3720
3721         Skip a test on ARM64 platform since we run out of address space.
3722
3723         Rubber stamped by Saam Barati.
3724
3725         * stress/dont-reserve-huge-capacity-lexer.js:
3726
3727 2017-06-30  Michael Saboff  <msaboff@apple.com>
3728
3729         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3730         https://bugs.webkit.org/show_bug.cgi?id=174044
3731