JSTests/ChangeLog

   1 2017-11-07  Mark Lam  <mark.lam@apple.com>
   2
   3         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
   4         https://bugs.webkit.org/show_bug.cgi?id=179355
   5         <rdar://problem/35263053>
   6
   7         Reviewed by Saam Barati.
   8
   9         * stress/regress-179355.js: Added.
  10
  11 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
  12
  13         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
  14         https://bugs.webkit.org/show_bug.cgi?id=144458
  15
  16         Reviewed by Saam Barati.
  17
  18         * microbenchmarks/dfg-internal-function-call.js: Added.
  19         (target):
  20         * microbenchmarks/dfg-internal-function-construct.js: Added.
  21         (target):
  22         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
  23         (target):
  24         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
  25         (target):
  26         * stress/dfg-internal-function-call.js: Added.
  27         (shouldBe):
  28         (target):
  29         * stress/dfg-internal-function-construct.js: Added.
  30         (shouldBe):
  31         (target):
  32         * stress/internal-function-call.js: Added.
  33         (shouldBe):
  34         * stress/internal-function-construct.js: Added.
  35         (shouldBe):
  36
  37 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
  38
  39         [Win] Skip stress/regress-178385.js.
  40         https://bugs.webkit.org/show_bug.cgi?id=179298
  41
  42         Unreviewed test gardening.
  43
  44         * stress/regress-178385.js:
  45
  46 2017-11-03  Keith Miller  <keith_miller@apple.com>
  47
  48         Add test for ic with side effects
  49         https://bugs.webkit.org/show_bug.cgi?id=179268
  50
  51         Reviewed by Saam Barati.
  52
  53         * stress/put-inline-cache-side-effects.js: Added.
  54         (let.i.of.objs.keys):
  55         (f):
  56
  57 2017-11-03  Mark Lam  <mark.lam@apple.com>
  58
  59         CachedCall (and its clients) needs overflow checks.
  60         https://bugs.webkit.org/show_bug.cgi?id=179185
  61
  62         Reviewed by JF Bastien.
  63
  64         * stress/regress-179185.js: Added.
  65
  66 2017-11-02  Michael Saboff  <msaboff@apple.com>
  67
  68         DFG needs to handle code motion of code in for..in loop bodies
  69         https://bugs.webkit.org/show_bug.cgi?id=179212
  70
  71         Reviewed by Keith Miller.
  72
  73         New regression test.
  74
  75         * stress/for-in-side-effects.js: Added.
  76         (getPrototypeOf):
  77         (reset):
  78         (testWithoutFTL.f):
  79         (testWithoutFTL):
  80         (testWithFTL.f):
  81         (testWithFTL):
  82
  83 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
  84
  85         AI does not correctly model the clobber case of ArithClz32
  86         https://bugs.webkit.org/show_bug.cgi?id=179188
  87
  88         Reviewed by Michael Saboff.
  89
  90         * stress/arith-clz32-effects.js: Added.
  91         (foo):
  92         (valueOf):
  93
  94 2017-11-01  Michael Saboff  <msaboff@apple.com>
  95
  96         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
  97         https://bugs.webkit.org/show_bug.cgi?id=179140
  98
  99         Reviewed by Saam Barati.
 100
 101         New regression test.
 102
 103         * stress/regress-179140.js: Added.
 104         (testWithoutFTL):
 105         (testWithFTL):
 106
 107 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 108
 109         [JSC] Introduce @toObject
 110         https://bugs.webkit.org/show_bug.cgi?id=178726
 111
 112         Reviewed by Saam Barati.
 113
 114         * stress/array-copywithin.js:
 115         (shouldThrow):
 116         * stress/object-constructor-boolean-edge.js: Added.
 117         (shouldBe):
 118         (test):
 119         * stress/object-constructor-global.js: Added.
 120         (shouldBe):
 121         * stress/object-constructor-null-edge.js: Added.
 122         (shouldBe):
 123         (test):
 124         * stress/object-constructor-number-edge.js: Added.
 125         (shouldBe):
 126         (test):
 127         * stress/object-constructor-object-edge.js: Added.
 128         (shouldBe):
 129         (test):
 130         (i.arg):
 131         * stress/object-constructor-string-edge.js: Added.
 132         (shouldBe):
 133         (test):
 134         * stress/object-constructor-symbol-edge.js: Added.
 135         (shouldBe):
 136         (test):
 137         * stress/object-constructor-undefined-edge.js: Added.
 138         (shouldBe):
 139         (test):
 140         * stress/symbol-array-from.js: Added.
 141         (shouldBe):
 142         * stress/to-object-intrinsic-boolean-edge.js: Added.
 143         (shouldBe):
 144         (builtin.createBuiltin):
 145         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
 146         (shouldThrow):
 147         * stress/to-object-intrinsic-number-edge.js: Added.
 148         (shouldBe):
 149         (builtin.createBuiltin):
 150         * stress/to-object-intrinsic-object-edge.js: Added.
 151         (shouldBe):
 152         (builtin.createBuiltin):
 153         (i.arg):
 154         * stress/to-object-intrinsic-string-edge.js: Added.
 155         (shouldBe):
 156         (builtin.createBuiltin):
 157         * stress/to-object-intrinsic-symbol-edge.js: Added.
 158         (shouldBe):
 159         (builtin.createBuiltin):
 160         * stress/to-object-intrinsic.js: Added.
 161         (shouldBe):
 162         (shouldThrow):
 163         (builtin.createBuiltin):
 164
 165 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
 166
 167         [DFG][FTL] Introduce StringSlice
 168         https://bugs.webkit.org/show_bug.cgi?id=178934
 169
 170         Reviewed by Saam Barati.
 171
 172         * microbenchmarks/string-slice-empty.js: Added.
 173         (slice):
 174         * microbenchmarks/string-slice-one-char.js: Added.
 175         (slice):
 176         * microbenchmarks/string-slice.js: Added.
 177         (slice):
 178
 179 2017-10-26  Michael Saboff  <msaboff@apple.com>
 180
 181         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
 182         https://bugs.webkit.org/show_bug.cgi?id=178890
 183
 184         Reviewed by Keith Miller.
 185
 186         New regression test.
 187
 188         * stress/regress-178890.js: Added.
 189
 190 2017-10-26  Mark Lam  <mark.lam@apple.com>
 191
 192         JSRopeString::RopeBuilder::append() should check for overflows.
 193         https://bugs.webkit.org/show_bug.cgi?id=178385
 194         <rdar://problem/35027468>
 195
 196         Reviewed by Saam Barati.
 197
 198         * stress/regress-178385.js: Added.
 199
 200 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
 201
 202         Unreviewed, rolling out r223961.
 203
 204         The change that required this has been rolled out.
 205
 206         Reverted changeset:
 207
 208         "Mark test262.yaml/test262/test/language/statements/try/tco-
 209         catch.js as passing."
 210         https://bugs.webkit.org/show_bug.cgi?id=178592
 211         https://trac.webkit.org/changeset/223961
 212
 213 2017-10-25  Commit Queue  <commit-queue@webkit.org>
 214
 215         Unreviewed, rolling out r223691 and r223729.
 216         https://bugs.webkit.org/show_bug.cgi?id=178834
 217
 218         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
 219         by rniwa on #webkit).
 220
 221         Reverted changesets:
 222
 223         "Turn recursive tail calls into loops"
 224         https://bugs.webkit.org/show_bug.cgi?id=176601
 225         https://trac.webkit.org/changeset/223691
 226
 227         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
 228         comparison is always false due to limited range of data type
 229         [-Wtype-limits]"
 230         https://bugs.webkit.org/show_bug.cgi?id=178543
 231         https://trac.webkit.org/changeset/223729
 232
 233 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
 234
 235         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
 236         https://bugs.webkit.org/show_bug.cgi?id=178592
 237
 238         Unreviewed test gardening.
 239
 240         * test262.yaml:
 241
 242 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
 243
 244         [FTL] Support NewStringObject
 245         https://bugs.webkit.org/show_bug.cgi?id=178737
 246
 247         Reviewed by Saam Barati.
 248
 249         * stress/new-string-object.js: Added.
 250         (shouldBe):
 251         (test):
 252
 253 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 254
 255         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
 256         https://bugs.webkit.org/show_bug.cgi?id=178308
 257
 258         Reviewed by Mark Lam.
 259
 260         * test262.yaml:
 261
 262 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 263
 264         [JSC] Use fastJoin in Array#toString
 265         https://bugs.webkit.org/show_bug.cgi?id=178062
 266
 267         Reviewed by Darin Adler.
 268
 269         * microbenchmarks/contiguous-array-to-string.js: Added.
 270         (target):
 271         * microbenchmarks/double-array-to-string.js: Added.
 272         (target):
 273         * microbenchmarks/int32-array-to-string.js: Added.
 274         (target):
 275
 276 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
 277
 278         stress/check-string-ident.js is improperly skipped
 279         https://bugs.webkit.org/show_bug.cgi?id=178642
 280
 281         Reviewed by Saam Barati.
 282
 283         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
 284         since it enforces the run-jsc-stress-tests script to still set up the
 285         test to run, despite the skip directive that's used before.
 286
 287 2017-10-20  Mark Lam  <mark.lam@apple.com>
 288
 289         Add a test case for r214334.
 290         https://bugs.webkit.org/show_bug.cgi?id=169941
 291         <rdar://problem/31221258>
 292
 293         Reviewed by JF Bastien.
 294
 295         * stress/regress-169941.js: Added.
 296
 297 2017-10-19  JF Bastien  <jfbastien@apple.com>
 298
 299         WebAssembly: no VM / JS version of everything but Instance
 300         https://bugs.webkit.org/show_bug.cgi?id=177473
 301
 302         Reviewed by Filip Pizlo, Saam Barati.
 303
 304         - Exceeding max on memory growth now returns a range error as per
 305         spec. This is a (very minor) breaking change: it used to throw OOM
 306         error. Update the corresponding test.
 307
 308         * wasm/js-api/memory-grow.js:
 309         (assertEq):
 310         * wasm/js-api/table.js:
 311         (assert.throws):
 312
 313 2017-10-19  Mark Lam  <mark.lam@apple.com>
 314
 315         Stringifier::appendStringifiedValue() is missing an exception check.
 316         https://bugs.webkit.org/show_bug.cgi?id=178386
 317         <rdar://problem/35027610>
 318
 319         Reviewed by Saam Barati.
 320
 321         * stress/regress-178386.js: Added.
 322
 323 2017-10-19  Michael Saboff  <msaboff@apple.com>
 324
 325         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
 326         https://bugs.webkit.org/show_bug.cgi?id=178521
 327
 328         Reviewed by JF Bastien.
 329
 330         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
 331         now passes with the current version (5.0) of the Emoji spec.
 332
 333 2017-10-19  Robin Morisset  <rmorisset@apple.com>
 334
 335         Turn recursive tail calls into loops
 336         https://bugs.webkit.org/show_bug.cgi?id=176601
 337
 338         Reviewed by Saam Barati.
 339
 340         Add some simple test that computes factorial in several ways, and other trivial computations.
 341         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
 342         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
 343         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
 344         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
 345
 346         * stress/inline-call-to-recursive-tail-call.js: Added.
 347         (factorial.aux):
 348         (factorial):
 349         (factorial2.aux):
 350         (factorial2.id):
 351         (factorial2):
 352         (factorial3.aux):
 353         (factorial3):
 354         (aux):
 355         (factorial4):
 356         (test):
 357
 358 2017-10-18  Mark Lam  <mark.lam@apple.com>
 359
 360         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
 361         https://bugs.webkit.org/show_bug.cgi?id=177600
 362         <rdar://problem/34710985>
 363
 364         Reviewed by Saam Barati.
 365
 366         * stress/regress-177600.js: Added.
 367
 368 2017-10-18  Mark Lam  <mark.lam@apple.com>
 369
 370         The compiler should always register a structure when it adds its transitionWatchPointSet.
 371         https://bugs.webkit.org/show_bug.cgi?id=178420
 372         <rdar://problem/34814024>
 373
 374         Reviewed by Saam Barati and Filip Pizlo.
 375
 376         * stress/regress-178420.js: Added.
 377         (new.Array.10000.map):
 378
 379 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 380
 381         [JSC] __proto__ getter should be fast
 382         https://bugs.webkit.org/show_bug.cgi?id=178067
 383
 384         Reviewed by Saam Barati.
 385
 386         * stress/dfg-object-proto-accessor.js: Added.
 387         (shouldBe):
 388         (shouldThrow):
 389         (target):
 390         * stress/dfg-object-proto-getter.js: Added.
 391         (shouldBe):
 392         (shouldThrow):
 393         (target):
 394         * stress/dfg-object-prototype-of.js: Added.
 395         (shouldBe):
 396         (shouldThrow):
 397         (target):
 398         * stress/dfg-reflect-get-prototype-of.js: Added.
 399         (shouldBe):
 400         (shouldThrow):
 401         (target):
 402         * stress/intrinsic-getter-with-poly-proto.js: Added.
 403         (shouldBe):
 404         (makePolyProtoObject.foo.C):
 405         (makePolyProtoObject.foo):
 406         (makePolyProtoObject):
 407         (target):
 408         * stress/object-get-prototype-of-filtered.js: Added.
 409         (shouldBe):
 410         (shouldThrow):
 411         (target):
 412         (i.Cocoa):
 413         * stress/object-get-prototype-of-mono-proto.js: Added.
 414         (shouldBe):
 415         (makePolyProtoObject.foo.C):
 416         (makePolyProtoObject.foo):
 417         (makePolyProtoObject):
 418         (target):
 419         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 420         (shouldBe):
 421         (makePolyProtoObject.foo.C):
 422         (makePolyProtoObject.foo):
 423         (makePolyProtoObject):
 424         (target):
 425         * stress/object-get-prototype-of-poly-proto.js: Added.
 426         (shouldBe):
 427         (makePolyProtoObject.foo.C):
 428         (makePolyProtoObject.foo):
 429         (makePolyProtoObject):
 430         (target):
 431         * stress/object-proto-getter-filtered.js: Added.
 432         (shouldBe):
 433         (shouldThrow):
 434         (target):
 435         (i.Cocoa):
 436         * stress/object-proto-getter-poly-mono-proto.js: Added.
 437         (shouldBe):
 438         (makePolyProtoObject.foo.C):
 439         (makePolyProtoObject.foo):
 440         (makePolyProtoObject):
 441         (target):
 442         * stress/object-proto-getter-poly-proto.js: Added.
 443         (shouldBe):
 444         (makePolyProtoObject.foo.C):
 445         (makePolyProtoObject.foo):
 446         (makePolyProtoObject):
 447         (target):
 448         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 449         * stress/string-proto.js: Added.
 450         (shouldBe):
 451         (target):
 452
 453 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
 454
 455         Unreviewed, rolling out r223523.
 456
 457         A test for this change is failing on debug JSC bots.
 458
 459         Reverted changeset:
 460
 461         "[JSC] __proto__ getter should be fast"
 462         https://bugs.webkit.org/show_bug.cgi?id=178067
 463         https://trac.webkit.org/changeset/223523
 464
 465 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
 466
 467         [JSC] __proto__ getter should be fast
 468         https://bugs.webkit.org/show_bug.cgi?id=178067
 469
 470         Reviewed by Saam Barati.
 471
 472         * stress/dfg-object-proto-accessor.js: Added.
 473         (shouldBe):
 474         (shouldThrow):
 475         (target):
 476         * stress/dfg-object-proto-getter.js: Added.
 477         (shouldBe):
 478         (shouldThrow):
 479         (target):
 480         * stress/dfg-object-prototype-of.js: Added.
 481         (shouldBe):
 482         (shouldThrow):
 483         (target):
 484         * stress/dfg-reflect-get-prototype-of.js: Added.
 485         (shouldBe):
 486         (shouldThrow):
 487         (target):
 488         * stress/object-get-prototype-of-filtered.js: Added.
 489         (shouldBe):
 490         (shouldThrow):
 491         (target):
 492         (i.Cocoa):
 493         * stress/object-get-prototype-of-mono-proto.js: Added.
 494         (shouldBe):
 495         (makePolyProtoObject.foo.C):
 496         (makePolyProtoObject.foo):
 497         (makePolyProtoObject):
 498         (target):
 499         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 500         (shouldBe):
 501         (makePolyProtoObject.foo.C):
 502         (makePolyProtoObject.foo):
 503         (makePolyProtoObject):
 504         (target):
 505         * stress/object-get-prototype-of-poly-proto.js: Added.
 506         (shouldBe):
 507         (makePolyProtoObject.foo.C):
 508         (makePolyProtoObject.foo):
 509         (makePolyProtoObject):
 510         (target):
 511         * stress/object-proto-getter-filtered.js: Added.
 512         (shouldBe):
 513         (shouldThrow):
 514         (target):
 515         (i.Cocoa):
 516         * stress/object-proto-getter-poly-mono-proto.js: Added.
 517         (shouldBe):
 518         (makePolyProtoObject.foo.C):
 519         (makePolyProtoObject.foo):
 520         (makePolyProtoObject):
 521         (target):
 522         * stress/object-proto-getter-poly-proto.js: Added.
 523         (shouldBe):
 524         (makePolyProtoObject.foo.C):
 525         (makePolyProtoObject.foo):
 526         (makePolyProtoObject):
 527         (target):
 528         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 529         * stress/string-proto.js: Added.
 530         (shouldBe):
 531         (target):
 532
 533 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 534
 535         Reland "Add Above/Below comparisons for UInt32 patterns"
 536         https://bugs.webkit.org/show_bug.cgi?id=177281
 537
 538         Reviewed by Saam Barati.
 539
 540         * stress/uint32-comparison-jump.js: Added.
 541         (shouldBe):
 542         (above):
 543         (aboveOrEqual):
 544         (below):
 545         (belowOrEqual):
 546         (notAbove):
 547         (notAboveOrEqual):
 548         (notBelow):
 549         (notBelowOrEqual):
 550         * stress/uint32-comparison.js: Added.
 551         (shouldBe):
 552         (above):
 553         (aboveOrEqual):
 554         (below):
 555         (belowOrEqual):
 556         (aboveTest):
 557         (aboveOrEqualTest):
 558         (belowTest):
 559         (belowOrEqualTest):
 560
 561 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
 562
 563         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
 564         https://bugs.webkit.org/show_bug.cgi?id=178210
 565
 566         Reviewed by Saam Barati.
 567
 568         * wasm/function-tests/trap-from-start-async.js:
 569         (async.StartTrapsAsync):
 570         * wasm/function-tests/trap-from-start.js:
 571         (StartTraps):
 572         * wasm/js-api/web-assembly-function.js:
 573         (assert.eq.Object.getPrototypeOf):
 574         * wasm/js-api/wrapper-function.js:
 575         (return.new.WebAssembly.Module):
 576         (assert.throws.makeInstance): Deleted.
 577         (assert.throws.Bar): Deleted.
 578         (assert.throws): Deleted.
 579
 580 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 581
 582         Enable gigacage on iOS
 583         https://bugs.webkit.org/show_bug.cgi?id=177586
 584
 585         Reviewed by JF Bastien.
 586
 587         Add tests for when Gigacage gets runtime disabled.
 588
 589         * stress/disable-gigacage-arrays.js: Added.
 590         (foo):
 591         * stress/disable-gigacage-strings.js: Added.
 592         (foo):
 593         * stress/disable-gigacage-typed-arrays.js: Added.
 594         (foo):
 595
 596 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 597
 598         import.meta should not be assignable
 599         https://bugs.webkit.org/show_bug.cgi?id=178202
 600
 601         Reviewed by Saam Barati.
 602
 603         * modules/import-meta-assignment.js: Added.
 604         (shouldThrow):
 605         (SyntaxError.import.meta.can.shouldThrow):
 606
 607 2017-10-11  Saam Barati  <sbarati@apple.com>
 608
 609         Unreviewed. Actually skip certain type profiler tests in debug.
 610
 611         * typeProfiler.yaml:
 612         * typeProfiler/deltablue-for-of.js:
 613         * typeProfiler/getter-richards.js:
 614
 615 2017-10-11  Commit Queue  <commit-queue@webkit.org>
 616
 617         Unreviewed, rolling out r223113 and r223121.
 618         https://bugs.webkit.org/show_bug.cgi?id=178182
 619
 620         Reintroduced 20% regression on Kraken (Requested by rniwa on
 621         #webkit).
 622
 623         Reverted changesets:
 624
 625         "Enable gigacage on iOS"
 626         https://bugs.webkit.org/show_bug.cgi?id=177586
 627         https://trac.webkit.org/changeset/223113
 628
 629         "Use one virtual allocation for all gigacages and their
 630         runways"
 631         https://bugs.webkit.org/show_bug.cgi?id=178050
 632         https://trac.webkit.org/changeset/223121
 633
 634 2017-10-11  Michael Saboff  <msaboff@apple.com>
 635
 636         Disable test262 named capture group tests with direct unicode names and with references before definitions
 637         https://bugs.webkit.org/show_bug.cgi?id=178177
 638
 639         Reviewed by Keith Miller.
 640
 641         Bugs to track fixing these test are:
 642         https://bugs.webkit.org/show_bug.cgi?id=178174 -
 643             "Add support in named capture group identifiers for direct surrogate pairs"
 644         https://bugs.webkit.org/show_bug.cgi?id=178175 -
 645             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
 646
 647         * test262.yaml:
 648
 649 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
 650
 651         Object properties are undefined in super.call() but not in this.call()
 652         https://bugs.webkit.org/show_bug.cgi?id=177230
 653
 654         Reviewed by Saam Barati.
 655
 656         * stress/super-call-function-subclass.js: Added.
 657         (assert):
 658         (A.prototype.t):
 659         (A):
 660         * stress/super-dot-call-and-apply.js: Added.
 661         (assert):
 662         (A):
 663         (A.prototype.call):
 664         (A.prototype.apply):
 665         (B.prototype.testSuper):
 666         (B):
 667         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
 668         (D.prototype.testSuper):
 669         (D):
 670
 671 2017-10-10  Saam Barati  <sbarati@apple.com>
 672
 673         The prototype cache should be aware of the Executable it generates a Structure for
 674         https://bugs.webkit.org/show_bug.cgi?id=177907
 675
 676         Reviewed by Filip Pizlo.
 677
 678         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
 679         (assert):
 680         (foo.C):
 681         (foo):
 682         (bar.C):
 683         (bar):
 684         (access):
 685         (makeLongChain):
 686         (accessY):
 687
 688 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
 689
 690         `async` should be able to be used as an imported binding name
 691         https://bugs.webkit.org/show_bug.cgi?id=176573
 692
 693         Reviewed by Saam Barati.
 694
 695         * modules/import-default-async.js: Added.
 696         * modules/import-named-async-as.js: Added.
 697         * modules/import-named-async.js: Added.
 698         * modules/import-named-async/target.js: Added.
 699         * modules/import-namespace-async.js: Added.
 700         * test262.yaml:
 701
 702 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 703
 704         Enable gigacage on iOS
 705         https://bugs.webkit.org/show_bug.cgi?id=177586
 706
 707         Reviewed by JF Bastien.
 708
 709         Add tests for when Gigacage gets runtime disabled.
 710
 711         * stress/disable-gigacage-arrays.js: Added.
 712         (foo):
 713         * stress/disable-gigacage-strings.js: Added.
 714         (foo):
 715         * stress/disable-gigacage-typed-arrays.js: Added.
 716         (foo):
 717
 718 2017-10-09  Michael Saboff  <msaboff@apple.com>
 719
 720         Implement RegExp Unicode property escapes
 721         https://bugs.webkit.org/show_bug.cgi?id=172069
 722
 723         Reviewed by JF Bastien.
 724
 725         Enabled Unicode Property tests.
 726
 727         * test262.yaml:
 728
 729 2017-10-09  Commit Queue  <commit-queue@webkit.org>
 730
 731         Unreviewed, rolling out r223015 and r223025.
 732         https://bugs.webkit.org/show_bug.cgi?id=178093
 733
 734         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
 735         #webkit).
 736
 737         Reverted changesets:
 738
 739         "Enable gigacage on iOS"
 740         https://bugs.webkit.org/show_bug.cgi?id=177586
 741         http://trac.webkit.org/changeset/223015
 742
 743         "Unreviewed, disable Gigacage on ARM64 Linux"
 744         https://bugs.webkit.org/show_bug.cgi?id=177586
 745         http://trac.webkit.org/changeset/223025
 746
 747 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 748
 749         Update expectations for test262 tests that pass after r223043.
 750         https://bugs.webkit.org/show_bug.cgi?id=176685
 751
 752         Unreviewed test gardening.
 753
 754         * test262.yaml:
 755
 756 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 757
 758         Unreviewed, rolling out r223022.
 759
 760         This change introduced 18 test262 failures.
 761
 762         Reverted changeset:
 763
 764         "`async` should be able to be used as an imported binding
 765         name"
 766         https://bugs.webkit.org/show_bug.cgi?id=176573
 767         http://trac.webkit.org/changeset/223022
 768
 769 2017-10-09  Saam Barati  <sbarati@apple.com>
 770
 771         3 poly-proto JSC tests timing out on debug after r222827
 772         https://bugs.webkit.org/show_bug.cgi?id=177880
 773         <rdar://problem/34817122>
 774
 775         Unreviewed.
 776
 777         I'm skipping these type profiler tests on debug since they are long running.
 778
 779         * typeProfiler/deltablue-for-of.js:
 780         * typeProfiler/getter-richards.js:
 781
 782 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
 783
 784         Safari 10 /11 problem with if (!await get(something)).
 785         https://bugs.webkit.org/show_bug.cgi?id=176685
 786
 787         Reviewed by Saam Barati.
 788
 789         * stress/async-await-basic.js:
 790         (awaitEpression.async):
 791         * stress/async-await-syntax.js:
 792         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
 793         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
 794
 795 2017-10-08  Saam Barati  <sbarati@apple.com>
 796
 797         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
 798
 799         * typeProfiler/deltablue-for-of.js:
 800         * typeProfiler/getter-richards.js:
 801
 802 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 803
 804         `async` should be able to be used as an imported binding name
 805         https://bugs.webkit.org/show_bug.cgi?id=176573
 806
 807         Reviewed by Darin Adler.
 808
 809         * modules/import-default-async.js: Added.
 810         * modules/import-named-async-as.js: Added.
 811         * modules/import-named-async.js: Added.
 812         * modules/import-named-async/target.js: Added.
 813         * modules/import-namespace-async.js: Added.
 814
 815 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 816
 817         Enable gigacage on iOS
 818         https://bugs.webkit.org/show_bug.cgi?id=177586
 819
 820         Reviewed by JF Bastien.
 821
 822         Add tests for when Gigacage gets runtime disabled.
 823
 824         * stress/disable-gigacage-arrays.js: Added.
 825         (foo):
 826         * stress/disable-gigacage-strings.js: Added.
 827         (foo):
 828         * stress/disable-gigacage-typed-arrays.js: Added.
 829         (foo):
 830
 831 2017-10-06  Commit Queue  <commit-queue@webkit.org>
 832
 833         Unreviewed, rolling out r222791 and r222873.
 834         https://bugs.webkit.org/show_bug.cgi?id=178031
 835
 836         Caused crashes with workers/wasm LayoutTests (Requested by
 837         ryanhaddad on #webkit).
 838
 839         Reverted changesets:
 840
 841         "WebAssembly: no VM / JS version of everything but Instance"
 842         https://bugs.webkit.org/show_bug.cgi?id=177473
 843         http://trac.webkit.org/changeset/222791
 844
 845         "WebAssembly: address no VM / JS follow-ups"
 846         https://bugs.webkit.org/show_bug.cgi?id=177887
 847         http://trac.webkit.org/changeset/222873
 848
 849 2017-10-05  Saam Barati  <sbarati@apple.com>
 850
 851         Make sure all prototypes under poly proto get added into the VM's prototype map
 852         https://bugs.webkit.org/show_bug.cgi?id=177909
 853
 854         Reviewed by Keith Miller.
 855
 856         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
 857         (assert):
 858         (foo.C):
 859         (foo):
 860         (set x):
 861
 862 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
 863
 864         [JSC] Introduce import.meta
 865         https://bugs.webkit.org/show_bug.cgi?id=177703
 866
 867         Reviewed by Filip Pizlo.
 868
 869         * modules/import-meta-syntax.js: Added.
 870         (shouldThrow):
 871         (shouldNotThrow):
 872         * modules/import-meta.js: Added.
 873         * modules/import-meta/cocoa.js: Added.
 874         * modules/resources/assert.js:
 875         (export.shouldNotThrow):
 876         * stress/import-syntax.js:
 877
 878 2017-10-04  Saam Barati  <sbarati@apple.com>
 879
 880         Make pertinent AccessCases watch the poly proto watchpoint
 881         https://bugs.webkit.org/show_bug.cgi?id=177765
 882
 883         Reviewed by Keith Miller.
 884
 885         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
 886         (assert):
 887         (foo.C):
 888         (foo):
 889         (validate):
 890         * stress/poly-proto-clear-stub.js: Added.
 891         (assert):
 892         (foo.C):
 893         (foo):
 894
 895 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
 896
 897         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
 898
 899         Unreviewed test gardening.
 900
 901         * test262.yaml:
 902
 903 2017-10-04  Saam Barati  <sbarati@apple.com>
 904
 905         3 poly-proto JSC tests timing out on debug after r222827
 906         https://bugs.webkit.org/show_bug.cgi?id=177880
 907
 908         Rubber stamped by Mark Lam.
 909
 910         * microbenchmarks/poly-proto-access.js:
 911         * typeProfiler/deltablue-for-of.js:
 912         * typeProfiler/getter-richards.js:
 913
 914 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
 915
 916         Unreviewed, marking tco-catch.js as a failure after test262 update
 917         https://bugs.webkit.org/show_bug.cgi?id=177859
 918
 919         * test262.yaml:
 920
 921 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 922
 923         Unreviewed, marking one async iterator test262 test failed
 924         https://bugs.webkit.org/show_bug.cgi?id=177859
 925
 926         * test262.yaml:
 927
 928 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 929
 930         [Test262] Update Test262 to Oct 4 version
 931         https://bugs.webkit.org/show_bug.cgi?id=177859
 932
 933         Reviewed by Sam Weinig.
 934
 935         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
 936         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
 937
 938         * test262.yaml:
 939         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
 940         (checkSequence):
 941         * test262/harness/typeCoercion.js:
 942         (testCoercibleToIndexZero):
 943         (testCoercibleToIndexOne):
 944         (testCoercibleToIndexFromIndex):
 945         (testNotCoercibleToIndex.testPrimitiveValue):
 946         (testNotCoercibleToInteger):
 947         (testCoercibleToBigIntZero.testPrimitiveValue):
 948         (testCoercibleToBigIntZero):
 949         (testCoercibleToBigIntOne.testPrimitiveValue):
 950         (testCoercibleToBigIntOne):
 951         (testPrimitiveValue):
 952         (testCoercibleToBigIntFromBigInt):
 953         (testNotCoercibleToBigInt.testPrimitiveValue):
 954         (testNotCoercibleToBigInt.testStringValue):
 955         (testNotCoercibleToBigInt):
 956         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
 957         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
 958         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
 959         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
 960         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
 961         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
 962         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
 963         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
 964         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
 965         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
 966         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
 967         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
 968         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
 969         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
 970         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
 971         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
 972         (testCoercibleToBigIntZero):
 973         (testCoercibleToBigIntOne):
 974         (testNotCoercibleToBigInt):
 975         (MyError): Deleted.
 976         (valueOf): Deleted.
 977         (toString): Deleted.
 978         (Symbol.toPrimitive): Deleted.
 979         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
 980         (testCoercibleToIndexZero):
 981         (testCoercibleToIndexOne):
 982         (testNotCoercibleToIndex):
 983         (MyError): Deleted.
 984         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
 985         (assert.sameValue.BigInt.asIntN.toString): Deleted.
 986         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
 987         (BigInt.asIntN.valueOf): Deleted.
 988         (BigInt.asIntN.toString): Deleted.
 989         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
 990         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
 991         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
 992         (testCoercibleToBigIntZero):
 993         (testCoercibleToBigIntOne):
 994         (testNotCoercibleToBigInt):
 995         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
 996         (testCoercibleToIndexZero):
 997         (testCoercibleToIndexOne):
 998         (testNotCoercibleToIndex):
 999         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1000         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1001         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1002         (bits.valueOf):
1003         (bigint.valueOf):
1004         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1005         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1006         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1007         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1008         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1009         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1010         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1011         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1012         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1013         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1014         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1015         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1016         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1017         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1018         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1019         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1020         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1021         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1022         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1023         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1024         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1025         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1026         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1027         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1028         (replacer):
1029         (BigInt.prototype.toJSON):
1030         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1031         (replacer):
1032         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1033         (BigInt.prototype.toJSON):
1034         * test262/test/built-ins/JSON/stringify/bigint.js:
1035         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1036         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1037         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1038         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1039         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1040         * test262/test/built-ins/Object/proto-from-ctor.js:
1041         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1042         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1043         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1044         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1045         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1046         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1047         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1048         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1049         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1050         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1051         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1052         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1053         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1054         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1055         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1056         * test262/test/built-ins/Proxy/get-fn-realm.js:
1057         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1058         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1059         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1060         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1061         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1062         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1063         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1064         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1065         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1066         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1067         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1068         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1069         (i6.replace):
1070         (i6b.replace):
1071         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1072         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1073         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1074         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1075         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1076         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1077         * test262/test/built-ins/RegExp/u180e.js: Added.
1078         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1079         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1080         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1081         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1082         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1083         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1084         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1085         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1086         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1087         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1088         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1089         * test262/test/built-ins/String/prototype/endsWith/length.js:
1090         * test262/test/built-ins/String/prototype/endsWith/name.js:
1091         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1092         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1093         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1094         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1095         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1096         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1097         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1098         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1099         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1100         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1101         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1102         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1103         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1104         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1105         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1106         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1107         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1108         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1109         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1110         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1111         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1112         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1113         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1114         * test262/test/built-ins/String/prototype/includes/includes.js:
1115         * test262/test/built-ins/String/prototype/includes/length.js:
1116         * test262/test/built-ins/String/prototype/includes/name.js:
1117         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1118         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1119         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1120         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1121         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1122         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1123         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1124         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1125         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1126         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1127         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1128         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1129         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1130         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1131         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1132         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1133         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1134         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1135         * test262/test/built-ins/String/prototype/trim/u180e.js:
1136         * test262/test/built-ins/Symbol/for/cross-realm.js:
1137         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1138         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1139         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1140         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1141         * test262/test/built-ins/Symbol/match/cross-realm.js:
1142         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1143         * test262/test/built-ins/Symbol/search/cross-realm.js:
1144         * test262/test/built-ins/Symbol/species/cross-realm.js:
1145         * test262/test/built-ins/Symbol/split/cross-realm.js:
1146         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1147         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1148         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1149         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1150         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1151         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1152         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1153         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1154         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1155         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1156         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1157         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1158         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1159         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1160         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1161         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1162         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1163         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1164         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1165         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1166         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1167         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1168         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1169         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1170         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1171         * test262/test/language/eval-code/indirect/realm.js:
1172         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1173         (o.get z):
1174         (o.get a):
1175         * test262/test/language/expressions/call/eval-realm-indirect.js:
1176         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1177         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1178         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1179         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1180         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1181         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1182         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1183         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1184         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1185         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1186         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1187         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1188         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1189         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1190         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1191         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1192         * test262/test/language/expressions/less-than/bigint-and-number.js:
1193         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1194         * test262/test/language/expressions/super/realm.js:
1195         * test262/test/language/expressions/tagged-template/cache-realm.js:
1196         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1197         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1198         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1199         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1200         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1201         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1202         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1203         (o.get z):
1204         (o.get a):
1205         * test262/test/language/statements/for-of/iterator-next-reference.js:
1206         (next):
1207         (iterator.next): Deleted.
1208         (x.of.iterable.): Deleted.
1209         (x.of.iterable.get return): Deleted.
1210         (x.of.iterable.iterator.next): Deleted.
1211         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1212         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1213         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1214         * test262/test/language/white-space/mongolian-vowel-separator.js:
1215         * test262/test262-Revision.txt:
1216
1217 2017-10-03  Saam Barati  <sbarati@apple.com>
1218
1219         Implement polymorphic prototypes
1220         https://bugs.webkit.org/show_bug.cgi?id=176391
1221
1222         Reviewed by Filip Pizlo.
1223
1224         * microbenchmarks/poly-proto-access.js: Added.
1225         (assert):
1226         (foo.C):
1227         (foo.C.prototype.get bar):
1228         (foo):
1229         (bar):
1230         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1231         (assert):
1232         (makePolyProtoObject.foo.C):
1233         (makePolyProtoObject.foo):
1234         (makePolyProtoObject):
1235         (performSet):
1236         * microbenchmarks/poly-proto-setter-speed.js: Added.
1237         (assert):
1238         (makePolyProtoObject.foo.C):
1239         (makePolyProtoObject.foo.C.prototype.set p):
1240         (makePolyProtoObject.foo):
1241         (makePolyProtoObject):
1242         (performSet):
1243         * stress/constructor-with-return.js:
1244         (i.tests.forEach.Constructor):
1245         (i.tests.forEach):
1246         (tests.forEach.Constructor): Deleted.
1247         (tests.forEach): Deleted.
1248         * stress/dom-jit-with-poly-proto.js: Added.
1249         (assert):
1250         (makePolyProtoObject.foo.C):
1251         (makePolyProtoObject.foo):
1252         (makePolyProtoObject):
1253         (validate):
1254         * stress/poly-proto-custom-value-and-accessor.js: Added.
1255         (assert):
1256         (makePolyProtoObject.foo.C):
1257         (makePolyProtoObject.foo):
1258         (makePolyProtoObject):
1259         (items.forEach):
1260         (set get for):
1261         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1262         (assert):
1263         (makePolyProtoObject.foo.C):
1264         (makePolyProtoObject.foo):
1265         (makePolyProtoObject):
1266         (foo):
1267         * stress/poly-proto-miss.js: Added.
1268         (makePolyProtoInstanceWithNullPrototype.foo.C):
1269         (makePolyProtoInstanceWithNullPrototype.foo):
1270         (makePolyProtoInstanceWithNullPrototype):
1271         (assert):
1272         (validate):
1273         * stress/poly-proto-op-in-caching.js: Added.
1274         (assert):
1275         (makePolyProtoObject.foo.C):
1276         (makePolyProtoObject.foo):
1277         (makePolyProtoObject):
1278         (validate):
1279         (validate2):
1280         * stress/poly-proto-put-transition.js: Added.
1281         (assert):
1282         (makePolyProtoObject.foo.C):
1283         (makePolyProtoObject.foo):
1284         (makePolyProtoObject):
1285         (performSet):
1286         (i.obj.__proto__.set p):
1287         * stress/poly-proto-set-prototype.js: Added.
1288         (assert):
1289         (let.alternateProto.get x):
1290         (let.alternateProto2.get y):
1291         (let.alternateProto2.get x):
1292         (foo.C):
1293         (foo):
1294         (validate):
1295         * stress/poly-proto-setter.js: Added.
1296         (assert):
1297         (makePolyProtoObject.foo.C):
1298         (makePolyProtoObject.foo.C.prototype.set p):
1299         (makePolyProtoObject.foo.C.prototype.get p):
1300         (makePolyProtoObject.foo):
1301         (makePolyProtoObject):
1302         (performSet):
1303         * stress/poly-proto-using-inheritance.js: Added.
1304         (assert):
1305         (foo.C):
1306         (foo.C.prototype.get baz):
1307         (foo):
1308         (bar.C):
1309         (bar):
1310         (validate):
1311         * stress/primitive-poly-proto.js: Added.
1312         (makePolyProtoInstance.foo.C):
1313         (makePolyProtoInstance.foo):
1314         (makePolyProtoInstance):
1315         (assert):
1316         (validate):
1317         * stress/prototype-is-not-js-object.js: Added.
1318         (foo.bar):
1319         (foo):
1320         (assert):
1321         (validate):
1322         * stress/try-get-by-id-poly-proto.js: Added.
1323         (assert):
1324         (makePolyProtoObject.foo.C):
1325         (makePolyProtoObject.foo):
1326         (makePolyProtoObject):
1327         (tryGetByIdText):
1328         (x.__proto__.get bar):
1329         (validate):
1330         * typeProfiler/overflow.js:
1331
1332 2017-10-03  JF Bastien  <jfbastien@apple.com>
1333
1334         WebAssembly: no VM / JS version of everything but Instance
1335         https://bugs.webkit.org/show_bug.cgi?id=177473
1336
1337         Reviewed by Filip Pizlo.
1338
1339         - Exceeding max on memory growth now returns a range error as per
1340         spec. This is a (very minor) breaking change: it used to throw OOM
1341         error. Update the corresponding test.
1342
1343         * wasm/js-api/memory-grow.js:
1344         (assertEq):
1345         * wasm/js-api/table.js:
1346         (assert.throws):
1347
1348 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1349
1350         Skip JSC test stress/regress-159779-2.js on debug.
1351         https://bugs.webkit.org/show_bug.cgi?id=177204
1352
1353         Unreviewed test gardening.
1354
1355         * stress/regress-159779-2.js:
1356
1357 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1358
1359         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1360         https://bugs.webkit.org/show_bug.cgi?id=175642
1361
1362         Reviewed by Darin Adler.
1363
1364         * ChakraCore/test/Function/apply3.baseline-jsc:
1365
1366 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1367
1368         Unreviewed, rolling out r222564.
1369         https://bugs.webkit.org/show_bug.cgi?id=177720
1370
1371         "It regressed JetStream by 2% on iOS caused by a 50%
1372         regression on the bigfib subtest" (Requested by saamyjoon on
1373         #webkit).
1374
1375         Reverted changeset:
1376
1377         "Add Above/Below comparisons for UInt32 patterns"
1378         https://bugs.webkit.org/show_bug.cgi?id=177281
1379         http://trac.webkit.org/changeset/222564
1380
1381 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1382
1383         [DFG] Support ArrayPush with multiple args
1384         https://bugs.webkit.org/show_bug.cgi?id=175823
1385
1386         Reviewed by Saam Barati.
1387
1388         * microbenchmarks/array-push-0.js: Added.
1389         (arrayPush0):
1390         * microbenchmarks/array-push-1.js: Added.
1391         (arrayPush1):
1392         * microbenchmarks/array-push-2.js: Added.
1393         (arrayPush2):
1394         * microbenchmarks/array-push-3.js: Added.
1395         (arrayPush3):
1396         * stress/array-push-multiple-contiguous.js: Added.
1397         (shouldBe):
1398         (test):
1399         * stress/array-push-multiple-double-nan.js: Added.
1400         (shouldBe):
1401         (test):
1402         * stress/array-push-multiple-double.js: Added.
1403         (shouldBe):
1404         (test):
1405         * stress/array-push-multiple-int32.js: Added.
1406         (shouldBe):
1407         (test):
1408         * stress/array-push-multiple-many-contiguous.js: Added.
1409         (shouldBe):
1410         (test):
1411         * stress/array-push-multiple-many-double.js: Added.
1412         (shouldBe):
1413         (test):
1414         * stress/array-push-multiple-many-int32.js: Added.
1415         (shouldBe):
1416         (test):
1417         * stress/array-push-multiple-many-storage.js: Added.
1418         (shouldBe):
1419         (test):
1420         * stress/array-push-multiple-storage.js: Added.
1421         (shouldBe):
1422         (test):
1423         * stress/array-push-with-force-exit.js: Added.
1424         (target.createBuiltin):
1425
1426 2017-09-29  Saam Barati  <sbarati@apple.com>
1427
1428         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1429         https://bugs.webkit.org/show_bug.cgi?id=177639
1430
1431         Reviewed by Geoffrey Garen.
1432
1433         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1434         (assert):
1435         (Class):
1436         (items.forEach):
1437         (set get for):
1438
1439 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1440
1441         Unreviewed, rolling out r222563, r222565, and r222581.
1442         https://bugs.webkit.org/show_bug.cgi?id=177675
1443
1444         "It causes a crash when playing youtube videos" (Requested by
1445         saamyjoon on #webkit).
1446
1447         Reverted changesets:
1448
1449         "[DFG] Support ArrayPush with multiple args"
1450         https://bugs.webkit.org/show_bug.cgi?id=175823
1451         http://trac.webkit.org/changeset/222563
1452
1453         "Unreviewed, build fix after r222563"
1454         https://bugs.webkit.org/show_bug.cgi?id=175823
1455         http://trac.webkit.org/changeset/222565
1456
1457         "Unreviewed, fix x86 breaking due to exhausted registers"
1458         https://bugs.webkit.org/show_bug.cgi?id=175823
1459         http://trac.webkit.org/changeset/222581
1460
1461 2017-09-28  Mark Lam  <mark.lam@apple.com>
1462
1463         test262: Unexpected passes after r222617 and r222618.
1464         https://bugs.webkit.org/show_bug.cgi?id=177622
1465         <rdar://problem/34725960>
1466
1467         Reviewed by Saam Barati.
1468
1469         Update test262.yaml for tests that are now passing.
1470
1471         * test262.yaml:
1472
1473 2017-09-27  Michael Saboff  <msaboff@apple.com>
1474
1475         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1476         https://bugs.webkit.org/show_bug.cgi?id=177570
1477
1478         Reviewed by Filip Pizlo.
1479
1480         New regression test.
1481
1482         * stress/regress-177570.js: Added.
1483
1484 2017-09-28  Michael Saboff  <msaboff@apple.com>
1485
1486         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1487         https://bugs.webkit.org/show_bug.cgi?id=177423
1488
1489         Reviewed by Mark Lam.
1490
1491         Updated regression test.
1492
1493         * stress/regress-177423.js:
1494         (catch):
1495
1496 2017-09-27  Mark Lam  <mark.lam@apple.com>
1497
1498         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1499         https://bugs.webkit.org/show_bug.cgi?id=177584
1500         <rdar://problem/34463903>
1501
1502         Reviewed by Saam Barati.
1503
1504         * stress/regress-177584.js: Added.
1505         (assertEqual):
1506         (Array.prototype.Symbol.species):
1507
1508 2017-09-27  Saam Barati  <sbarati@apple.com>
1509
1510         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1511         https://bugs.webkit.org/show_bug.cgi?id=177523
1512
1513         Reviewed by Mark Lam.
1514
1515         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1516         (assert):
1517         (Test):
1518         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1519         (addMethods):
1520         (i.Test.prototype.propName):
1521
1522 2017-09-27  Mark Lam  <mark.lam@apple.com>
1523
1524         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1525         https://bugs.webkit.org/show_bug.cgi?id=177423
1526         <rdar://problem/34621320>
1527
1528         Reviewed by Keith Miller.
1529
1530         * stress/regress-177423.js: Added.
1531
1532 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1533
1534         Add Above/Below comparisons for UInt32 patterns
1535         https://bugs.webkit.org/show_bug.cgi?id=177281
1536
1537         Reviewed by Saam Barati.
1538
1539         * stress/uint32-comparison-jump.js: Added.
1540         (shouldBe):
1541         (above):
1542         (aboveOrEqual):
1543         (below):
1544         (belowOrEqual):
1545         (notAbove):
1546         (notAboveOrEqual):
1547         (notBelow):
1548         (notBelowOrEqual):
1549         * stress/uint32-comparison.js: Added.
1550         (shouldBe):
1551         (above):
1552         (aboveOrEqual):
1553         (below):
1554         (belowOrEqual):
1555         (aboveTest):
1556         (aboveOrEqualTest):
1557         (belowTest):
1558         (belowOrEqualTest):
1559
1560 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1561
1562         [DFG] Support ArrayPush with multiple args
1563         https://bugs.webkit.org/show_bug.cgi?id=175823
1564
1565         Reviewed by Saam Barati.
1566
1567         * microbenchmarks/array-push-0.js: Added.
1568         (arrayPush0):
1569         * microbenchmarks/array-push-1.js: Added.
1570         (arrayPush1):
1571         * microbenchmarks/array-push-2.js: Added.
1572         (arrayPush2):
1573         * microbenchmarks/array-push-3.js: Added.
1574         (arrayPush3):
1575         * stress/array-push-multiple-contiguous.js: Added.
1576         (shouldBe):
1577         (test):
1578         * stress/array-push-multiple-double-nan.js: Added.
1579         (shouldBe):
1580         (test):
1581         * stress/array-push-multiple-double.js: Added.
1582         (shouldBe):
1583         (test):
1584         * stress/array-push-multiple-int32.js: Added.
1585         (shouldBe):
1586         (test):
1587         * stress/array-push-multiple-many-contiguous.js: Added.
1588         (shouldBe):
1589         (test):
1590         * stress/array-push-multiple-many-double.js: Added.
1591         (shouldBe):
1592         (test):
1593         * stress/array-push-multiple-many-int32.js: Added.
1594         (shouldBe):
1595         (test):
1596         * stress/array-push-multiple-many-storage.js: Added.
1597         (shouldBe):
1598         (test):
1599         * stress/array-push-multiple-storage.js: Added.
1600         (shouldBe):
1601         (test):
1602
1603 2017-09-26  Commit Queue  <commit-queue@webkit.org>
1604
1605         Unreviewed, rolling out r222518.
1606         https://bugs.webkit.org/show_bug.cgi?id=177507
1607
1608         Break the High Sierra build (Requested by yusukesuzuki on
1609         #webkit).
1610
1611         Reverted changeset:
1612
1613         "Add Above/Below comparisons for UInt32 patterns"
1614         https://bugs.webkit.org/show_bug.cgi?id=177281
1615         http://trac.webkit.org/changeset/222518
1616
1617 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1618
1619         Add Above/Below comparisons for UInt32 patterns
1620         https://bugs.webkit.org/show_bug.cgi?id=177281
1621
1622         Reviewed by Saam Barati.
1623
1624         * stress/uint32-comparison-jump.js: Added.
1625         (shouldBe):
1626         (above):
1627         (aboveOrEqual):
1628         (below):
1629         (belowOrEqual):
1630         (notAbove):
1631         (notAboveOrEqual):
1632         (notBelow):
1633         (notBelowOrEqual):
1634         * stress/uint32-comparison.js: Added.
1635         (shouldBe):
1636         (above):
1637         (aboveOrEqual):
1638         (below):
1639         (belowOrEqual):
1640         (aboveTest):
1641         (aboveOrEqualTest):
1642         (belowTest):
1643         (belowOrEqualTest):
1644
1645 2017-09-23  Keith Miller  <keith_miller@apple.com>
1646
1647         Fix infinite looping test262 test
1648         https://bugs.webkit.org/show_bug.cgi?id=177412
1649
1650         Reviewed by Yusuke Suzuki.
1651
1652         This test was poorly designed since failing it would cause the vm
1653         to inifinite loop. I've fixed it locally and will fix it on github pending
1654         the results of next weeks tc39 meeting.
1655
1656         * test262.yaml:
1657         * test262/test/language/statements/for-of/iterator-next-reference.js:
1658
1659 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
1660
1661         test262: $.agent became $262.agent in test262 update
1662         https://bugs.webkit.org/show_bug.cgi?id=177407
1663
1664         Reviewed by Yusuke Suzuki.
1665
1666         * test262.yaml:
1667         ~320 tests pass now that we correctly make $262 available.
1668
1669 2017-09-22  Keith Miller  <keith_miller@apple.com>
1670
1671         Speculatively change iteration protocall to use the same next function
1672         https://bugs.webkit.org/show_bug.cgi?id=175653
1673
1674         Reviewed by Saam Barati.
1675
1676         Change test to match the new iteration behavior.
1677
1678         * stress/spread-optimized-properly.js:
1679
1680 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1681
1682         [DFG][FTL] Profile array vector length for array allocation
1683         https://bugs.webkit.org/show_bug.cgi?id=177051
1684
1685         Reviewed by Saam Barati.
1686
1687         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1688         (target):
1689
1690 2017-09-22  Commit Queue  <commit-queue@webkit.org>
1691
1692         Unreviewed, rolling out r222380.
1693         https://bugs.webkit.org/show_bug.cgi?id=177352
1694
1695         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
1696         #webkit).
1697
1698         Reverted changeset:
1699
1700         "[DFG][FTL] Profile array vector length for array allocation"
1701         https://bugs.webkit.org/show_bug.cgi?id=177051
1702         http://trac.webkit.org/changeset/222380
1703
1704 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1705
1706         [DFG][FTL] Profile array vector length for array allocation
1707         https://bugs.webkit.org/show_bug.cgi?id=177051
1708
1709         Reviewed by Saam Barati.
1710
1711         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1712         (target):
1713
1714 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
1715
1716         Skip new hanging test262 tests.
1717         https://bugs.webkit.org/show_bug.cgi?id=177326
1718
1719         Unreviewed test gardening.
1720
1721         * test262.yaml:
1722
1723 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
1724
1725         Mark 6 test262 tests as passing.
1726         https://bugs.webkit.org/show_bug.cgi?id=177307
1727
1728         Unreviewed test gardening.
1729
1730         * test262.yaml:
1731
1732 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1733
1734         Unreviewed follow-up to r222311.
1735
1736         * test262/harness/sta.js:
1737         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
1738         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
1739         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
1740         * test262/test/built-ins/Array/from/elements-added-after.js:
1741         * test262/test/built-ins/Array/from/elements-deleted-after.js:
1742         * test262/test/built-ins/Array/from/elements-updated-after.js:
1743         * test262/test/built-ins/Array/from/from-array.js:
1744         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
1745         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
1746         * test262/test/built-ins/Array/from/source-array-boundary.js:
1747         * test262/test/built-ins/Array/from/source-object-constructor.js:
1748         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
1749         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
1750         * test262/test/built-ins/Array/from/source-object-length.js:
1751         * test262/test/built-ins/Array/from/source-object-missing.js:
1752         * test262/test/built-ins/Array/from/source-object-without.js:
1753         * test262/test/built-ins/Array/from/this-null.js:
1754         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1755         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
1756         * test262/test/language/literals/numeric/7.8.3-1gs.js:
1757         * test262/test/language/literals/numeric/7.8.3-2gs.js:
1758         * test262/test/language/literals/numeric/7.8.3-3gs.js:
1759         * test262/test/language/literals/regexp/7.8.5-1gs.js:
1760         * test262/test/language/literals/string/7.8.4-1gs.js:
1761         Fix some files that I failed to update when I applied my patch.
1762
1763 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1764
1765         Update test262 tests
1766         https://bugs.webkit.org/show_bug.cgi?id=177220
1767
1768         Reviewed by Saam Barati and Yusuke Suzuki.
1769
1770         * test262.yaml:
1771         * test262/test262-Revision.txt:
1772         New rebaselined expectations for all tests.
1773
1774         * test262/*:
1775         Updated.
1776
1777 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1778
1779         [DFG] Remove ToThis more aggressively
1780         https://bugs.webkit.org/show_bug.cgi?id=177056
1781
1782         Reviewed by Saam Barati.
1783
1784         * stress/generator-with-this-strict.js: Added.
1785         (shouldBe):
1786         (generator):
1787         (target):
1788         * stress/generator-with-this.js: Added.
1789         (shouldBe):
1790         (generator):
1791         (target):
1792
1793 2017-09-17  Michael Saboff  <msaboff@apple.com>
1794
1795         https://bugs.webkit.org/show_bug.cgi?id=177038
1796         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
1797
1798         Reviewed by JF Bastien.
1799
1800         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
1801         as it dies using too much memory.
1802
1803 2017-09-15  Saam Barati  <sbarati@apple.com>
1804
1805         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
1806         https://bugs.webkit.org/show_bug.cgi?id=176981
1807
1808         Reviewed by Yusuke Suzuki.
1809
1810         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
1811         (assert):
1812         (verify):
1813         (func):
1814         (const.bar.createBuiltin):
1815
1816 2017-09-14  Saam Barati  <sbarati@apple.com>
1817
1818         It should be valid to exit before each set when doing arity fixup when inlining
1819         https://bugs.webkit.org/show_bug.cgi?id=176948
1820
1821         Reviewed by Keith Miller.
1822
1823         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
1824         (baz):
1825         (bar):
1826         (foo):
1827
1828 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1829
1830         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
1831         https://bugs.webkit.org/show_bug.cgi?id=176867
1832
1833         Reviewed by Sam Weinig.
1834
1835         * microbenchmarks/object-get-own-property-symbols.js: Added.
1836         (test):
1837
1838 2017-09-13  Mark Lam  <mark.lam@apple.com>
1839
1840         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
1841         https://bugs.webkit.org/show_bug.cgi?id=176888
1842         <rdar://problem/34381832>
1843
1844         Not reviewed.
1845
1846         * stress/op_mod-ConstVar.js:
1847         * stress/op_mod-VarConst.js:
1848         * stress/op_mod-VarVar.js:
1849
1850 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
1851
1852         Skip 3 op_mod tests on Debug JSC bots.
1853         https://bugs.webkit.org/show_bug.cgi?id=176630
1854
1855         Unreviewed test gardening.
1856
1857         * stress/op_mod-ConstVar.js:
1858         * stress/op_mod-VarConst.js:
1859         * stress/op_mod-VarVar.js:
1860
1861 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1862
1863         [JSC] Fix Array allocation in Object.keys
1864         https://bugs.webkit.org/show_bug.cgi?id=176826
1865
1866         Reviewed by Saam Barati.
1867
1868         * stress/object-own-property-keys.js: Added.
1869         (shouldBe):
1870
1871 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1872
1873         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1874         https://bugs.webkit.org/show_bug.cgi?id=176010
1875
1876         Reviewed by Filip Pizlo.
1877
1878         * microbenchmarks/weak-map-key.js: Added.
1879         (assert):
1880         (objectKey):
1881         (let.start.Date.now):
1882
1883 2017-09-12  Mark Lam  <mark.lam@apple.com>
1884
1885         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
1886         https://bugs.webkit.org/show_bug.cgi?id=176630
1887
1888         Reviewed by JF Bastien.
1889
1890         Debug builds are just slow, and these tests do a lot.  They pass when I run them
1891         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
1892         a speculative fix for the bots that are seeing these fail.
1893
1894         I also undid the skipping of the op_mod tests for debug builds.
1895
1896         * stress/op_div-ConstVar.js:
1897         * stress/op_div-VarConst.js:
1898         * stress/op_div-VarVar.js:
1899         * stress/op_mod-ConstVar.js:
1900         * stress/op_mod-VarConst.js:
1901         * stress/op_mod-VarVar.js:
1902
1903 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
1904
1905         Skip stress/value-to-boolean.js on Debug bots.
1906         https://bugs.webkit.org/show_bug.cgi?id=176787
1907
1908         Unreviewed test gardening.
1909
1910         * stress/value-to-boolean.js:
1911
1912 2017-09-11  Mark Lam  <mark.lam@apple.com>
1913
1914         Change test expectation for test262/test/language/statements/try/tco-catch.js
1915         https://bugs.webkit.org/show_bug.cgi?id=176749
1916
1917         Rubber stamped by Keith Miller.
1918
1919         It's been failing since at least r221821.  I'm changing the test expectation to
1920         fail to green the bots while I investigate some more.
1921
1922         * test262.yaml:
1923
1924 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
1925
1926         Unreviewed, rolling out r221854.
1927
1928         The test added with this change fails on 32-bit JSC bots.
1929
1930         Reverted changeset:
1931
1932         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
1933         https://bugs.webkit.org/show_bug.cgi?id=176010
1934         http://trac.webkit.org/changeset/221854
1935
1936 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1937
1938         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1939         https://bugs.webkit.org/show_bug.cgi?id=176010
1940
1941         Reviewed by Filip Pizlo.
1942
1943         * microbenchmarks/weak-map-key.js: Added.
1944         (assert):
1945         (objectKey):
1946         (let.start.Date.now):
1947
1948 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1949
1950         [JSC] Optimize Object.keys by using careful array allocation
1951         https://bugs.webkit.org/show_bug.cgi?id=176654
1952
1953         Reviewed by Darin Adler.
1954
1955         * microbenchmarks/object-keys.js: Added.
1956         (test):
1957
1958 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
1959
1960         Error should compute .stack and friends lazily
1961         https://bugs.webkit.org/show_bug.cgi?id=176645
1962
1963         Reviewed by Saam Barati.
1964
1965         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
1966         * microbenchmarks/new-error.js: Added.
1967         * microbenchmarks/throw.js: Added.
1968
1969 2017-09-09  Mark Lam  <mark.lam@apple.com>
1970
1971         [Re-landing] Use JIT probes for DFG OSR exit.
1972         https://bugs.webkit.org/show_bug.cgi?id=175144
1973         <rdar://problem/33437050>
1974
1975         Not reviewed.  Original patch reviewed by Saam Barati.
1976
1977         Disable these tests for debug builds because they run too slow with the new OSR exit.
1978
1979         * stress/op_mod-ConstVar.js:
1980         * stress/op_mod-VarConst.js:
1981         * stress/op_mod-VarVar.js:
1982
1983 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1984
1985         [DFG] NewArrayWithSize(size)'s size does not care negative zero
1986         https://bugs.webkit.org/show_bug.cgi?id=176300
1987
1988         Reviewed by Saam Barati.
1989
1990         * stress/new-array-with-size-div.js: Added.
1991         (shouldBe):
1992         (test):
1993         (i.i):
1994
1995 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1996
1997         [DFG] PutByVal with Array::Generic is too generic
1998         https://bugs.webkit.org/show_bug.cgi?id=176345
1999
2000         Reviewed by Filip Pizlo.
2001
2002         * stress/object-assign-symbols.js: Added.
2003         (shouldBe):
2004         (test):
2005         * stress/object-assign.js: Added.
2006         (shouldBe):
2007         (test):
2008         (i.shouldBe.JSON.stringify.test):
2009
2010 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2011
2012         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2013         https://bugs.webkit.org/show_bug.cgi?id=176590
2014
2015         Reviewed by Saam Barati.
2016
2017         * microbenchmarks/object-iterate-symbols.js: Added.
2018         (test):
2019         * microbenchmarks/object-iterate.js: Added.
2020         (test):
2021         * stress/object-iterate-symbols.js: Added.
2022         (shouldBe):
2023         (test):
2024         * stress/object-iterate.js: Added.
2025         (shouldBe):
2026         (test):
2027
2028 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2029
2030         [Win32] 10 JSC stress tests are failing.
2031         https://bugs.webkit.org/show_bug.cgi?id=176538
2032
2033         Reviewed by Mark Lam.
2034
2035         Skip tests on Windows to make the bots green.
2036
2037         * ChakraCore.yaml:
2038         * stress/date-relaxed.js:
2039
2040 2017-09-06  Mark Lam  <mark.lam@apple.com>
2041
2042         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2043         https://bugs.webkit.org/show_bug.cgi?id=176485
2044         <rdar://problem/33898874>
2045
2046         Reviewed by Keith Miller.
2047
2048         * stress/regress-176485.js: Added.
2049
2050 2017-09-05  Saam Barati  <sbarati@apple.com>
2051
2052         isNotCellSpeculation is wrong with respect to SpecEmpty
2053         https://bugs.webkit.org/show_bug.cgi?id=176429
2054
2055         Reviewed by Michael Saboff.
2056
2057         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2058         (Foo):
2059
2060 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2061
2062         test262: Completion values for control flow do not match the spec
2063         https://bugs.webkit.org/show_bug.cgi?id=171265
2064
2065         Reviewed by Saam Barati.
2066
2067         * stress/completion-value.js:
2068         Condensed test for completion values in top level statements.
2069
2070         * stress/super-get-by-id.js:
2071         ClassDeclaration when evaled no longer produce values. Convert
2072         these to ClassExpressions so they produce the class value.
2073
2074         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2075         This is a progression for currect spec behavior.
2076
2077         * mozilla/mozilla-tests.yaml:
2078         This test is now outdated, so mark it as failing for that reason.
2079
2080         * test262.yaml:
2081         Passing all "cptn" completion value tests.
2082
2083 2017-09-04  Saam Barati  <sbarati@apple.com>
2084
2085         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2086         https://bugs.webkit.org/show_bug.cgi?id=176317
2087
2088         Reviewed by Keith Miller.
2089
2090         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2091         (Foo):
2092
2093 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2094
2095         [DFG][FTL] Efficiently execute number#toString()
2096         https://bugs.webkit.org/show_bug.cgi?id=170007
2097
2098         Reviewed by Keith Miller.
2099
2100         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2101         (test):
2102         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2103         (test):
2104         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2105         (test):
2106         * microbenchmarks/number-to-string-with-radix.js: Added.
2107         (test):
2108         * stress/number-to-string-strength-reduction.js: Added.
2109         (shouldBe):
2110         (test):
2111         * stress/number-to-string-with-radix-10.js: Added.
2112         (shouldBe):
2113         (test):
2114         * stress/number-to-string-with-radix-cse.js: Added.
2115         (shouldBe):
2116         (test):
2117         * stress/number-to-string-with-radix-invalid.js: Added.
2118         (shouldThrow):
2119         * stress/number-to-string-with-radix-watchpoint.js: Added.
2120         (shouldBe):
2121         (test):
2122         (i.i.1e3.Number.prototype.toString):
2123         * stress/number-to-string-with-radix.js: Added.
2124         (shouldBe):
2125         (test):
2126
2127 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2128
2129         [DFG] Relax arity requirement
2130         https://bugs.webkit.org/show_bug.cgi?id=175523
2131
2132         Reviewed by Saam Barati.
2133
2134         * stress/arity-mismatch-arguments-length.js: Added.
2135         (shouldBe):
2136         (test1):
2137         (test):
2138         * stress/arity-mismatch-get-argument.js: Added.
2139         (shouldBe):
2140         (builtin.createBuiltin):
2141         (test):
2142         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2143         (shouldBe):
2144         (inlineTarget):
2145         (test):
2146         * stress/arity-mismatch-inlining.js: Added.
2147         (shouldBe):
2148         (inlineTarget):
2149         (test):
2150         * stress/arity-mismatch-rest.js: Added.
2151         (shouldBe):
2152         (test2):
2153         (test1):
2154         (test):
2155
2156 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2157
2158         [JSC] Fix "name" and "length" of Proxy revoke function
2159         https://bugs.webkit.org/show_bug.cgi?id=176155
2160
2161         Reviewed by Mark Lam.
2162
2163         * test262.yaml:
2164
2165 2017-08-31  Saam Barati  <sbarati@apple.com>
2166
2167         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2168         https://bugs.webkit.org/show_bug.cgi?id=176206
2169
2170         Reviewed by Keith Miller.
2171
2172         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2173         (a):
2174         (b):
2175         (foo):
2176
2177 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2178
2179         Skip two slow JSC tests after r221422.
2180
2181         Unreviewed test gardening.
2182
2183         * stress/regexp-prototype-match-on-too-long-rope.js:
2184         * stress/regexp-prototype-test-on-too-long-rope.js:
2185
2186 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2187
2188         Unreviewed, skipping slow tests.
2189
2190         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2191         work differently now.
2192
2193         * stress/regexp-prototype-exec-on-too-long-rope.js:
2194         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2195
2196 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2197
2198         [JSC] Use reifying system for "name" property of builtin JSFunction
2199         https://bugs.webkit.org/show_bug.cgi?id=175260
2200
2201         Reviewed by Saam Barati.
2202
2203         * stress/accessors-get-set-prefix.js:
2204         * stress/builtin-function-name.js: Added.
2205         (shouldBe):
2206         (shouldThrow):
2207         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2208         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2209         * stress/private-name-as-anonymous-builtin.js: Added.
2210         (shouldBe):
2211         (NotPromise):
2212
2213 2017-08-30  Saam Barati  <sbarati@apple.com>
2214
2215         Unreviewed. Make test stop printing.
2216
2217         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2218
2219 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2220
2221         Unreviewed, rolling out r221327.
2222
2223         This change caused test262 failures.
2224
2225         Reverted changeset:
2226
2227         "[JSC] Use reifying system for "name" property of builtin
2228         JSFunction"
2229         https://bugs.webkit.org/show_bug.cgi?id=175260
2230         http://trac.webkit.org/changeset/221327
2231
2232 2017-08-30  Saam Barati  <sbarati@apple.com>
2233
2234         semicolon is being interpreted as an = in the LiteralParser
2235         https://bugs.webkit.org/show_bug.cgi?id=176114
2236
2237         Reviewed by Oliver Hunt.
2238
2239         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2240         * stress/resources/literal-parser-test-case.js: Added.
2241
2242 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2243
2244         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2245         https://bugs.webkit.org/show_bug.cgi?id=166698
2246
2247         Reviewed by Yusuke Suzuki.
2248
2249         * stress/async-iteration-for-await-of-syntax.js: Added.
2250         (assert):
2251         (checkSyntax):
2252         (checkSyntaxError):
2253         (checkSimpleAsyncGeneratorSloppyMode):
2254         (checkSimpleAsyncGeneratorStrictMode):
2255         (checkNestedAsyncGenerators):
2256         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2257         * stress/async-iteration-for-await-of.js: Added.
2258         (assert):
2259         (async.foo):
2260         (async.boo):
2261         (const.boo.async):
2262
2263 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2264
2265         [JSC] Use reifying system for "name" property of builtin JSFunction
2266         https://bugs.webkit.org/show_bug.cgi?id=175260
2267
2268         Reviewed by Saam Barati.
2269
2270         * stress/accessors-get-set-prefix.js:
2271         * stress/builtin-function-name.js: Added.
2272         (shouldBe):
2273         (shouldThrow):
2274         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2275         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2276
2277 2017-08-25  Saam Barati  <sbarati@apple.com>
2278
2279         Support compiling catch in the DFG
2280         https://bugs.webkit.org/show_bug.cgi?id=174590
2281         <rdar://problem/34047845>
2282
2283         Reviewed by Filip Pizlo.
2284
2285         * microbenchmarks/delta-blue-try-catch.js: Added.
2286         (exception):
2287         (value):
2288         (OrderedCollection):
2289         (OrderedCollection.prototype.add):
2290         (OrderedCollection.prototype.at):
2291         (OrderedCollection.prototype.size):
2292         (OrderedCollection.prototype.removeFirst):
2293         (OrderedCollection.prototype.remove):
2294         (Strength):
2295         (Strength.stronger):
2296         (Strength.weaker):
2297         (Strength.weakestOf):
2298         (Strength.strongest):
2299         (Strength.prototype.nextWeaker):
2300         (Constraint):
2301         (Constraint.prototype.addConstraint):
2302         (Constraint.prototype.satisfy):
2303         (Constraint.prototype.destroyConstraint):
2304         (Constraint.prototype.isInput):
2305         (UnaryConstraint):
2306         (UnaryConstraint.prototype.addToGraph):
2307         (UnaryConstraint.prototype.chooseMethod):
2308         (UnaryConstraint.prototype.isSatisfied):
2309         (UnaryConstraint.prototype.markInputs):
2310         (UnaryConstraint.prototype.output):
2311         (UnaryConstraint.prototype.recalculate):
2312         (UnaryConstraint.prototype.markUnsatisfied):
2313         (UnaryConstraint.prototype.inputsKnown):
2314         (UnaryConstraint.prototype.removeFromGraph):
2315         (StayConstraint):
2316         (StayConstraint.prototype.execute):
2317         (EditConstraint.prototype.isInput):
2318         (EditConstraint.prototype.execute):
2319         (BinaryConstraint):
2320         (BinaryConstraint.prototype.chooseMethod):
2321         (BinaryConstraint.prototype.addToGraph):
2322         (BinaryConstraint.prototype.isSatisfied):
2323         (BinaryConstraint.prototype.markInputs):
2324         (BinaryConstraint.prototype.input):
2325         (BinaryConstraint.prototype.output):
2326         (BinaryConstraint.prototype.recalculate):
2327         (BinaryConstraint.prototype.markUnsatisfied):
2328         (BinaryConstraint.prototype.inputsKnown):
2329         (BinaryConstraint.prototype.removeFromGraph):
2330         (ScaleConstraint):
2331         (ScaleConstraint.prototype.addToGraph):
2332         (ScaleConstraint.prototype.removeFromGraph):
2333         (ScaleConstraint.prototype.markInputs):
2334         (ScaleConstraint.prototype.execute):
2335         (ScaleConstraint.prototype.recalculate):
2336         (EqualityConstraint):
2337         (EqualityConstraint.prototype.execute):
2338         (Variable):
2339         (Variable.prototype.addConstraint):
2340         (Variable.prototype.removeConstraint):
2341         (Planner):
2342         (Planner.prototype.incrementalAdd):
2343         (Planner.prototype.incrementalRemove):
2344         (Planner.prototype.newMark):
2345         (Planner.prototype.makePlan):
2346         (Planner.prototype.extractPlanFromConstraints):
2347         (Planner.prototype.addPropagate):
2348         (Planner.prototype.removePropagateFrom):
2349         (Planner.prototype.addConstraintsConsumingTo):
2350         (Plan):
2351         (Plan.prototype.addConstraint):
2352         (Plan.prototype.size):
2353         (Plan.prototype.constraintAt):
2354         (Plan.prototype.execute):
2355         (chainTest):
2356         (projectionTest):
2357         (change):
2358         (deltaBlue):
2359         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2360         (assert):
2361         (Numbers):
2362         (Numbers.prototype.next):
2363         (return.Transpose):
2364         (return.Transpose.prototype.next):
2365         (transpose):
2366         (verifyEven):
2367         (verifyString):
2368         (foo):
2369         (runIterators):
2370         * microbenchmarks/try-catch-word-count.js: Added.
2371         (let.assert):
2372         (EOF):
2373         (let.texts):
2374         (let.o.apply):
2375         (foo):
2376         (bar):
2377         (f):
2378         (run):
2379         (test1):
2380         (test2):
2381         (test3):
2382         (fn):
2383         (A):
2384         (B):
2385         (A.prototype.getValue):
2386         (B.prototype.getParentValue):
2387         (strlen):
2388         (sum.0):
2389         (test):
2390         (result.test.o):
2391         (set add.set add):
2392         (set forEach):
2393         (stringHash):
2394         (set if):
2395         (testFunction):
2396         (set delete.set has.set add):
2397         * stress/catch-set-argument-speculation-failure.js: Added.
2398         (o):
2399         (e):
2400         (e2):
2401         (escape):
2402         (baz):
2403         (noInline.run):
2404         (noInline):
2405         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2406         (foo):
2407         (e):
2408         (baz):
2409         (bar):
2410
2411 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2412
2413         Unreviewed, rolling out r221119, r221124, and r221143.
2414         https://bugs.webkit.org/show_bug.cgi?id=175973
2415
2416         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2417         on #webkit).
2418
2419         Reverted changesets:
2420
2421         "Support compiling catch in the DFG"
2422         https://bugs.webkit.org/show_bug.cgi?id=174590
2423         http://trac.webkit.org/changeset/221119
2424
2425         "Unreviewed, build fix in GTK port"
2426         https://bugs.webkit.org/show_bug.cgi?id=174590
2427         http://trac.webkit.org/changeset/221124
2428
2429         "DFG::JITCode::osrEntry should get sorted since we perform a
2430         binary search on it"
2431         https://bugs.webkit.org/show_bug.cgi?id=175893
2432         http://trac.webkit.org/changeset/221143
2433
2434 2017-08-24  Michael Saboff  <msaboff@apple.com>
2435
2436         Add support for RegExp "dotAll" flag
2437         https://bugs.webkit.org/show_bug.cgi?id=175924
2438
2439         Reviewed by Keith Miller.
2440
2441         Updated tests for new dotAll ('s' flag) changes.
2442
2443         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2444         * stress/static-getter-in-names.js:
2445
2446 2017-08-24  Mark Lam  <mark.lam@apple.com>
2447
2448         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2449         https://bugs.webkit.org/show_bug.cgi?id=175940
2450         <rdar://problem/29003921>
2451
2452         Reviewed by Saam Barati.
2453
2454         * stress/regress-164081.js: Added.
2455         (shouldEqual):
2456         (testcase):
2457
2458 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2459
2460         Skip flaky JSC test stress/test-finally.js.
2461         https://bugs.webkit.org/show_bug.cgi?id=160283
2462
2463         Unreviewed test gardening.
2464
2465         * stress/test-finally.js:
2466
2467 2017-08-23  Saam Barati  <sbarati@apple.com>
2468
2469         Support compiling catch in the DFG
2470         https://bugs.webkit.org/show_bug.cgi?id=174590
2471
2472         Reviewed by Filip Pizlo.
2473
2474         * microbenchmarks/delta-blue-try-catch.js: Added.
2475         (exception):
2476         (value):
2477         (OrderedCollection):
2478         (OrderedCollection.prototype.add):
2479         (OrderedCollection.prototype.at):
2480         (OrderedCollection.prototype.size):
2481         (OrderedCollection.prototype.removeFirst):
2482         (OrderedCollection.prototype.remove):
2483         (Strength):
2484         (Strength.stronger):
2485         (Strength.weaker):
2486         (Strength.weakestOf):
2487         (Strength.strongest):
2488         (Strength.prototype.nextWeaker):
2489         (Constraint):
2490         (Constraint.prototype.addConstraint):
2491         (Constraint.prototype.satisfy):
2492         (Constraint.prototype.destroyConstraint):
2493         (Constraint.prototype.isInput):
2494         (UnaryConstraint):
2495         (UnaryConstraint.prototype.addToGraph):
2496         (UnaryConstraint.prototype.chooseMethod):
2497         (UnaryConstraint.prototype.isSatisfied):
2498         (UnaryConstraint.prototype.markInputs):
2499         (UnaryConstraint.prototype.output):
2500         (UnaryConstraint.prototype.recalculate):
2501         (UnaryConstraint.prototype.markUnsatisfied):
2502         (UnaryConstraint.prototype.inputsKnown):
2503         (UnaryConstraint.prototype.removeFromGraph):
2504         (StayConstraint):
2505         (StayConstraint.prototype.execute):
2506         (EditConstraint.prototype.isInput):
2507         (EditConstraint.prototype.execute):
2508         (BinaryConstraint):
2509         (BinaryConstraint.prototype.chooseMethod):
2510         (BinaryConstraint.prototype.addToGraph):
2511         (BinaryConstraint.prototype.isSatisfied):
2512         (BinaryConstraint.prototype.markInputs):
2513         (BinaryConstraint.prototype.input):
2514         (BinaryConstraint.prototype.output):
2515         (BinaryConstraint.prototype.recalculate):
2516         (BinaryConstraint.prototype.markUnsatisfied):
2517         (BinaryConstraint.prototype.inputsKnown):
2518         (BinaryConstraint.prototype.removeFromGraph):
2519         (ScaleConstraint):
2520         (ScaleConstraint.prototype.addToGraph):
2521         (ScaleConstraint.prototype.removeFromGraph):
2522         (ScaleConstraint.prototype.markInputs):
2523         (ScaleConstraint.prototype.execute):
2524         (ScaleConstraint.prototype.recalculate):
2525         (EqualityConstraint):
2526         (EqualityConstraint.prototype.execute):
2527         (Variable):
2528         (Variable.prototype.addConstraint):
2529         (Variable.prototype.removeConstraint):
2530         (Planner):
2531         (Planner.prototype.incrementalAdd):
2532         (Planner.prototype.incrementalRemove):
2533         (Planner.prototype.newMark):
2534         (Planner.prototype.makePlan):
2535         (Planner.prototype.extractPlanFromConstraints):
2536         (Planner.prototype.addPropagate):
2537         (Planner.prototype.removePropagateFrom):
2538         (Planner.prototype.addConstraintsConsumingTo):
2539         (Plan):
2540         (Plan.prototype.addConstraint):
2541         (Plan.prototype.size):
2542         (Plan.prototype.constraintAt):
2543         (Plan.prototype.execute):
2544         (chainTest):
2545         (projectionTest):
2546         (change):
2547         (deltaBlue):
2548         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2549         (assert):
2550         (Numbers):
2551         (Numbers.prototype.next):
2552         (return.Transpose):
2553         (return.Transpose.prototype.next):
2554         (transpose):
2555         (verifyEven):
2556         (verifyString):
2557         (foo):
2558         (runIterators):
2559         * microbenchmarks/try-catch-word-count.js: Added.
2560         (let.assert):
2561         (EOF):
2562         (let.texts):
2563         (let.o.apply):
2564         (foo):
2565         (bar):
2566         (f):
2567         (run):
2568         (test1):
2569         (test2):
2570         (test3):
2571         (fn):
2572         (A):
2573         (B):
2574         (A.prototype.getValue):
2575         (B.prototype.getParentValue):
2576         (strlen):
2577         (sum.0):
2578         (test):
2579         (result.test.o):
2580         (set add.set add):
2581         (set forEach):
2582         (stringHash):
2583         (set if):
2584         (testFunction):
2585         (set delete.set has.set add):
2586         * stress/catch-set-argument-speculation-failure.js: Added.
2587         (o):
2588         (e):
2589         (e2):
2590         (escape):
2591         (baz):
2592         (noInline.run):
2593         (noInline):
2594         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2595         (foo):
2596         (e):
2597         (baz):
2598         (bar):
2599
2600 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2601
2602         [JSC] Optimize Map iteration with intrinsic
2603         https://bugs.webkit.org/show_bug.cgi?id=174355
2604
2605         Reviewed by Saam Barati.
2606
2607         * stress/map-iterator-result-should-have-expected-shape.js: Added.
2608         (shouldBe):
2609         (throw.new.Error):
2610         * stress/set-iterator-result-should-have-expected-shape.js: Added.
2611         (shouldBe):
2612         (throw.new.Error.let.iterator.set Symbol):
2613         (throw.new.Error.set add):
2614         (let.iterator.set Symbol):
2615
2616 2017-08-23  Robin Morisset  <rmorisset@apple.com>
2617
2618         Add a micro-benchmark for checking that accessing a variable within a 'with'
2619         block does not automatically prevent type prediction.
2620         https://bugs.webkit.org/show_bug.cgi?id=175738
2621
2622         Reviewed by Saam Barati.
2623
2624         * stress/with_and_arith.js: Added.
2625         (with):
2626
2627 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
2628
2629         [ESNext] Async iteration - Implement Async Generator - runtime
2630         https://bugs.webkit.org/show_bug.cgi?id=175240
2631
2632         Reviewed by Yusuke Suzuki.
2633
2634         * stress/async-iteration-async-from-sync.js: Added.
2635         (assert):
2636         (const.Logger):
2637         (this.fullfilled):
2638         (this.fullfilledDone):
2639         (this.rejected):
2640         (this.catched):
2641         (this.isFinal):
2642         (_assertLogger):
2643         (const.assertLogger):
2644         (const.getPromise.promiseHolder.return.new.Promise):
2645         (foo):
2646         (async.boo):
2647         (bar):
2648         (async.baz):
2649         (async.goo):
2650         * stress/async-iteration-basic.js: Added.
2651         (assert):
2652         (const.Logger):
2653         (this.fullfilled):
2654         (this.fullfilledDone):
2655         (this.rejected):
2656         (this.catched):
2657         (this.isFinal):
2658         (_assertLogger):
2659         (const.assertLogger):
2660         (const.getPromise.promiseHolder.return.new.Promise):
2661         (async.generator):
2662         (iterator.next.then):
2663         (async.baz):
2664         (async.boo):
2665         (async.foo):
2666         (async.goo):
2667         (A.prototype.async.foo):
2668         (A.prototype.async.boo):
2669         (A):
2670         (asyncGenExp.async):
2671         (async.joo):
2672         (j.next.then):
2673         (then):
2674         (async.koo):
2675         (async.loo):
2676         (async.moo):
2677         (async.noo):
2678         (async.ooo):
2679         (async.roo):
2680         (async.poo):
2681         (async.soo):
2682         (async.too):
2683         * stress/async-iteration-evaluation.js: Added.
2684         (assert):
2685         (async.foo):
2686         (catch):
2687         * stress/async-iteration-syntax.js:
2688         * stress/async-iteration-yield-promise.js: Added.
2689         (assert):
2690         (const.Logger):
2691         (this.fullfilled):
2692         (this.fullfilledDone):
2693         (this.rejected):
2694         (this.catched):
2695         (this.isFinal):
2696         (_assertLogger):
2697         (const.assertLogger):
2698         (const.getPromise.promiseHolder.return.new.Promise):
2699         (async.foo):
2700         (async.boo):
2701         (async.bar):
2702         * stress/async-iteration-yield-star-interface.js: Added.
2703         (assert):
2704         (const.getPromise.promiseHolder.return.new.Promise):
2705         (const.Logger):
2706         (this.fullfilled):
2707         (this.fullfilledDone):
2708         (this.rejected):
2709         (this.catched):
2710         (this.custom):
2711         (this.isFinal):
2712         (_assertLogger):
2713         (const.assertLogger):
2714         (let.asyncIter.Symbol.asyncIterator):
2715         (let.asyncIter.next):
2716         (let.asyncIter.throw):
2717         (let.asyncIter.return):
2718         (async.foo):
2719         (asyncIter.Symbol.asyncIterator):
2720         (asyncIter.next):
2721         (async.boo):
2722         (asyncIter.return):
2723         (async.bar):
2724         (async.baz):
2725         (async.foobar):
2726         * stress/async-iteration-yield-star.js: Added.
2727         (assert):
2728         (const.Logger):
2729         (this.fullfilled):
2730         (this.fullfilledDone):
2731         (this.rejected):
2732         (this.catched):
2733         (this.custom):
2734         (this.isFinal):
2735         (_assertLogger):
2736         (const.assertLogger):
2737         (const.getPromise.promiseHolder.return.new.Promise):
2738         (async.foo):
2739         (async.boo):
2740         (async.bar):
2741         (async.baz):
2742         (async.joo):
2743         (async.goo):
2744         (async.koo):
2745         (async.loo):
2746         (let.asyncIter.Symbol.asyncIterator):
2747         (let.asyncIter.next):
2748         (let.asyncIter.throw):
2749         (let.asyncIter.return):
2750         (async.moo):
2751         (async.noo):
2752         * test262.yaml:
2753
2754 2017-08-23  JF Bastien  <jfbastien@apple.com>
2755
2756         Fix printing in test
2757
2758         Unreviewed: fixing verbosity, shouldn't have been there.
2759
2760         * wasm/regress/175693.js:
2761         (else.else):
2762         (catch):
2763
2764 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
2765
2766         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
2767         https://bugs.webkit.org/show_bug.cgi?id=172543
2768
2769         Unreviewed test gardening.
2770
2771         * microbenchmarks/generator-with-several-types.js:
2772
2773 2017-08-17  JF Bastien  <jfbastien@apple.com>
2774
2775         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
2776         https://bugs.webkit.org/show_bug.cgi?id=175693
2777         <rdar://problem/33952443>
2778
2779         Reviewed by Saam Barati.
2780
2781         Add a regression directory for WebAssembly tests.
2782
2783         * wasm.yaml:
2784         * wasm/regress/175693.js: Added.
2785         (else.else):
2786         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
2787         (catch):
2788         * wasm/regress/175693.wasm: Added.
2789
2790 2017-08-15  Robin Morisset  <rmorisset@apple.com>
2791
2792         Support the 'with' keyword in FTL.
2793         https://bugs.webkit.org/show_bug.cgi?id=175585
2794
2795         Reviewed by Saam Barati.
2796
2797         Also improve the JSTest/stress/with.js file to test
2798         what happens when non-objects are passed to with.
2799
2800         * stress/with.js:
2801         (foo):
2802         (i.catch):
2803         (i.with): Deleted.
2804
2805 2017-08-14  Keith Miller  <keith_miller@apple.com>
2806
2807         Add testing tool to lie to the DFG about profiles
2808         https://bugs.webkit.org/show_bug.cgi?id=175487
2809
2810         Reviewed by Saam Barati.
2811
2812         * stress/compare-eq-incomplete-profile.js: Added.
2813         (const.test.createBuiltin):
2814
2815 2017-08-14  Robin Morisset  <rmorisset@apple.com>
2816
2817         Support the with keyword in DFG
2818         https://bugs.webkit.org/show_bug.cgi?id=175470
2819
2820         Reviewed by Saam Barati.
2821
2822         Added a new stress-test for the 'with' keyword, that caught a bug in a
2823         previous version of this code.
2824
2825         * stress/with.js: Added.
2826         (i.with):
2827
2828 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
2829
2830         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
2831         https://bugs.webkit.org/show_bug.cgi?id=175544
2832
2833         Unreviewed test gardening.
2834
2835         * ChakraCore.yaml:
2836
2837 2017-08-09  Caitlin Potter  <caitp@igalia.com>
2838
2839         Early error on ANY operator before new.target
2840         https://bugs.webkit.org/show_bug.cgi?id=157970
2841
2842         Reviewed by Saam Barati.
2843
2844         Instead of throwing if any unary operator precedes new.target, only
2845         throw if the unary operator updates the reference.
2846
2847         The following become legal in JSC:
2848
2849         ```
2850         !new.target
2851         ~new.target
2852         typeof new.target
2853         delete new.target
2854         void new.target
2855         ```
2856
2857         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
2858
2859         * stress/new-target-syntax-errors.js:
2860         * stress/new-target.js:
2861
2862 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
2863
2864         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
2865         https://bugs.webkit.org/show_bug.cgi?id=175255
2866
2867         Unreviewed test gardening.
2868
2869         * stress/regress-169783.js:
2870         * wasm/stress/oom.js:
2871
2872 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2873
2874         REGRESSION: 2 test262/test/language/statements/async-function failures
2875         https://bugs.webkit.org/show_bug.cgi?id=175334
2876
2877         Reviewed by Yusuke Suzuki.
2878
2879         Add @skip parameters to tests, and remove test for async iterator from
2880         async await syntax test because it is already covered by async-iterator-syntax.js
2881
2882         * stress/async-await-syntax.js:
2883         * stress/async-iteration-syntax.js:
2884
2885 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2886
2887         Unreviewed, gardening test262 for Promise resolve / reject function length
2888         https://bugs.webkit.org/show_bug.cgi?id=175333
2889
2890         * test262.yaml:
2891
2892 2017-08-07  Robin Morisset  <rmorisset@apple.com>
2893
2894         GetOwnProperty of TypedArray indexed fields is wrongly configurable
2895         https://bugs.webkit.org/show_bug.cgi?id=175307
2896
2897         Reviewed by Saam Barati.
2898
2899         * stress/typedarray-getownproperty-not-configurable.js: Added.
2900         (assert):
2901         (foo):
2902
2903 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2904
2905         Promise resolve and reject function should have length = 1
2906         https://bugs.webkit.org/show_bug.cgi?id=175242
2907
2908         Reviewed by Saam Barati.
2909
2910         * stress/builtin-function-length.js: Added.
2911         (shouldBe):
2912         (shouldThrow):
2913         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2914         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2915
2916 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2917
2918         [ESNext] Async iteration - Implement Async Generator - parser
2919         https://bugs.webkit.org/show_bug.cgi?id=175210
2920
2921         Reviewed by Yusuke Suzuki.
2922
2923         * stress/async-await-syntax.js:
2924         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2925         * stress/async-iteration-syntax.js: Added.
2926         (assert):
2927         (checkSyntax):
2928         (checkSyntaxError):
2929         (checkSimpleAsyncGeneratorSloppyMode):
2930         (checkSimpleAsyncGeneratorStrictMode):
2931         (checkNestedAsyncGenerators):
2932         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2933         * stress/generator-class-methods-syntax.js:
2934
2935 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2936
2937         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
2938         https://bugs.webkit.org/show_bug.cgi?id=175150
2939
2940         Unreviewed test gardening.
2941
2942         * wasm/js-api/test_memory_constructor.js:
2943
2944 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2945
2946         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
2947         https://bugs.webkit.org/show_bug.cgi?id=175100
2948
2949         Reviewed by Mark Lam.
2950
2951         The JSC test JSTests/wasm/stress/oom.js tries to use all the
2952         available memory until an out of memory exception happens.
2953
2954         The Linux kernel is more tuned for server workloads than for GUI
2955         responsiveness. When a process tries to use a lot of memory, Linux
2956         will do its best to serve the request. This usually translates to
2957         free physical RAM by writing to disk dirty pages and/or moving out
2958         less recently used pages to swap (disk storage).
2959         Meanwhile it does this, the system will become unresponsive and this
2960         leads to freezes that can last even some minutes on the worst cases.
2961
2962         Therefore, let's skip this test on Linux as it will cause more harm
2963         than good on the Linux bots or on the machines of Linux developers.
2964
2965         * wasm/stress/oom.js:
2966
2967 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2968
2969         [JSC] Remove unnecessary print from stress\promise-finally.js test
2970         https://bugs.webkit.org/show_bug.cgi?id=175015
2971
2972         Reviewed by Yusuke Suzuki.
2973
2974         * stress/promise-finally.js:
2975         (p.finally):
2976         (then):
2977
2978 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2979
2980         Unreviewed, update test262 results for optional catch binding
2981
2982         * test262.yaml:
2983
2984 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2985
2986         [JSC] Support optional catch binding
2987         https://bugs.webkit.org/show_bug.cgi?id=174981
2988
2989         Reviewed by Saam Barati.
2990
2991         * stress/optional-catch-binding-syntax.js: Added.
2992         (testSyntax):
2993         (testSyntaxError):
2994         (catch.catch):
2995         * stress/optional-catch-binding.js: Added.
2996         (shouldBe):
2997         (throwException):
2998
2999 2017-07-28  Mark Lam  <mark.lam@apple.com>
3000
3001         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3002         https://bugs.webkit.org/show_bug.cgi?id=174948
3003         <rdar://problem/33495680>
3004
3005         Reviewed by Filip Pizlo.
3006
3007         * stress/regress-174948.js: Added.
3008
3009 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3010
3011         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3012         https://bugs.webkit.org/show_bug.cgi?id=174900
3013
3014         Reviewed by Saam Barati.
3015
3016         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3017         (sideEffect):
3018         (args):
3019         (test):
3020
3021 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3022
3023         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3024         https://bugs.webkit.org/show_bug.cgi?id=171637
3025
3026         Reviewed by Darin Adler.
3027
3028         * stress/domjit-getter-complex-with-incorrect-object.js:
3029         (i.shouldThrow):
3030         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3031         (shouldBe):
3032         (i.shouldThrow):
3033
3034 2017-07-26  JF Bastien  <jfbastien@apple.com>
3035
3036         WebAssembly: test throwing out of the start function
3037         https://bugs.webkit.org/show_bug.cgi?id=165714
3038         <rdar://problem/29760251>
3039
3040         Reviewed by Keith Miller.
3041
3042         * wasm/assert.js:
3043         * wasm/function-tests/trap-from-start.js: Added.
3044         (StartTraps):
3045         * wasm/function-tests/trap-from-start-async.js: Added.
3046         (async.StartTrapsAsync):
3047
3048 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3049
3050         [FTL] Arguments elimination is suppressed by unreachable blocks
3051         https://bugs.webkit.org/show_bug.cgi?id=174352
3052
3053         Reviewed by Filip Pizlo.
3054
3055         * stress/arguments-elimination-force-exit.js: Added.
3056         (shouldBe):
3057         (strict):
3058         (sloppy):
3059         * stress/arguments-elimination-throw.js: Added.
3060         (shouldBe):
3061         (shouldThrow):
3062         (sloppy):
3063         (isArguments):
3064
3065 2017-07-13  Mark Lam  <mark.lam@apple.com>
3066
3067         Add some additional test cases for bug 170896.
3068         https://bugs.webkit.org/show_bug.cgi?id=174491
3069
3070         Reviewed by Filip Pizlo.
3071
3072         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3073         * stress/regress-170896-with-double-shape-profile.js: Added.
3074         (test):
3075         * stress/regress-170896-with-int32-shape-profile.js: Added.
3076         (test):
3077         * stress/regress-170896.js: Removed.
3078
3079 2017-07-13  Saam Barati  <sbarati@apple.com>
3080
3081         Missing exception check in JSObject::hasInstance
3082         https://bugs.webkit.org/show_bug.cgi?id=174455
3083         <rdar://problem/31384608>
3084
3085         Reviewed by Mark Lam.
3086
3087         * stress/has-instance-exception-check.js: Added.
3088         (assert):
3089         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3090
3091 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3092
3093         [ESnext] Implement Object Spread
3094         https://bugs.webkit.org/show_bug.cgi?id=167963
3095
3096         Reviewed by Saam Barati.
3097
3098         * stress/obj-rest-destructuring-order.js: Added.
3099         (assert):
3100         (o.get z):
3101         (o.get a):
3102         * stress/obj-spread-order.js: Added.
3103         (assert):
3104         (o.get z):
3105         (o.get a):
3106         * stress/object-spread.js: Added.
3107         (let.assert):
3108         (assert.sameValue):
3109         (let.o.get a):
3110         (let.obj.get c):
3111         (cthulhu.get x):
3112         (let.obj.set c):
3113         (calls.o.get z):
3114         (calls.o.get a):
3115         (try.let.obj.get foo):
3116         (get calls):
3117
3118 2017-07-12  Saam Barati  <sbarati@apple.com>
3119
3120         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3121         https://bugs.webkit.org/show_bug.cgi?id=174411
3122         <rdar://problem/31696186>
3123
3124         Reviewed by Mark Lam.
3125
3126         * stress/generic-arguments-correct-delete-behavior.js: Added.
3127         (assert):
3128         (makeTest):
3129
3130 2017-07-07  Mark Lam  <mark.lam@apple.com>
3131
3132         \n\r is not the same as \r\n.
3133         https://bugs.webkit.org/show_bug.cgi?id=173053
3134
3135         Reviewed by Keith Miller.
3136
3137         * stress/regress-173053.js: Added.
3138         * stress/template-literal-line-terminators.js:
3139
3140 2017-07-06  Saam Barati  <sbarati@apple.com>
3141
3142         We are missing places where we invalidate the for-in context
3143         https://bugs.webkit.org/show_bug.cgi?id=174184
3144
3145         Reviewed by Geoffrey Garen.
3146
3147         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3148         (assert):
3149         (test):
3150
3151 2017-07-05  Saam Barati  <sbarati@apple.com>
3152
3153         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3154         https://bugs.webkit.org/show_bug.cgi?id=174188
3155         <rdar://problem/30581423>
3156
3157         Reviewed by Mark Lam.
3158
3159         * stress/new-array-having-a-bad-time-double.js: Added.
3160         (assert):
3161         (foo):
3162
3163 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3164
3165         WTF::StringImpl::copyChars segfaults when built with GCC 7
3166         https://bugs.webkit.org/show_bug.cgi?id=173407
3167
3168         Reviewed by Andreas Kling.
3169
3170         * stress/string-repeat-copy-chars-crash.js: Added.
3171         (shouldBe):
3172
3173 2017-07-03  Saam Barati  <sbarati@apple.com>
3174
3175         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3176
3177         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3178
3179 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3180
3181         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3182
3183         It requires too much memory.
3184
3185         * stress/dont-reserve-huge-capacity-lexer.js:
3186
3187 2017-06-30  Michael Saboff  <msaboff@apple.com>
3188
3189         Skip a test on ARM64 platform since we run out of address space.
3190
3191         Rubber stamped by Saam Barati.
3192
3193         * stress/dont-reserve-huge-capacity-lexer.js:
3194
3195 2017-06-30  Michael Saboff  <msaboff@apple.com>
3196
3197         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3198         https://bugs.webkit.org/show_bug.cgi?id=174044
3199
3200         Reviewed by Oliver Hunt.
3201
3202         New regression test.
3203
3204         * stress/regress-174044.js: Added.
3205         (test1):
3206         (test2):
3207
3208 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3209
3210         RegExpCachedResult::setInput should reify left and right contexts
3211         https://bugs.webkit.org/show_bug.cgi?id=173818
3212
3213         Reviewed by Keith Miller.
3214
3215         * stress/right-left-context-invalidated-by-input.js: Added.
3216         (test.validateContexts):
3217         (test):
3218
3219 2017-06-29  Saam Barati  <sbarati@apple.com>
3220
3221         Calculating postCapacity in unshiftCountSlowCase is wrong
3222         https://bugs.webkit.org/show_bug.cgi?id=173992
3223         <rdar://problem/32283199>
3224
3225         Reviewed by Keith Miller.
3226
3227         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3228         (temp):
3229
3230 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3231
3232         Unreviewed, rolling out r218512.
3233         https://bugs.webkit.org/show_bug.cgi?id=173981
3234
3235         "It changes the behavior of the JS API's JSEvaluateScript
3236         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3237
3238         Reverted changeset:
3239
3240         "test262: Completion values for control flow do not match the
3241         spec"
3242         https://bugs.webkit.org/show_bug.cgi?id=171265
3243         http://trac.webkit.org/changeset/218512
3244
3245 2017-06-27  JF Bastien  <jfbastien@apple.com>
3246
3247         WebAssembly: running out of executable memory should throw OoM
3248         https://bugs.webkit.org/show_bug.cgi?id=171537
3249         <rdar://problem/32963338>
3250
3251         Reviewed by Saam Barati.
3252
3253         * wasm.yaml:
3254         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3255         (const.invoke):
3256         (failCount.0.catch):
3257         (failCount.0.module.undefined.catch):
3258         * wasm/lowExecutableMemory/exports-oom.js: Added.
3259         (const.type):
3260         (const.params):
3261         (const.randomProgram):
3262         (failCount.0.catch):
3263         (failCount.0.module.undefined.catch):
3264         * wasm/lowExecutableMemory/imports-oom.js: Added.
3265         (const.type):
3266         (const.params):
3267         (const.randomProgram):
3268         (f.imports.push):
3269         (failCount.0.catch):
3270         (failCount.0.module.undefined.catch):
3271
3272 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3273
3274         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3275         https://bugs.webkit.org/show_bug.cgi?id=167962
3276
3277         Reviewed by Saam Barati.
3278
3279         * stress/object-rest-deconstruct.js: Added.
3280         (let.assert):
3281         (let.assertPropDescriptor):
3282         (catch):
3283         (get 3):
3284         (foo):
3285         (let.src.get y):
3286         (let.src.set y):
3287         (let.gen):
3288
3289 2017-06-27  Saam Barati  <sbarati@apple.com>
3290
3291         Function constructor needs to follow the spec and validate parameters and body independently
3292         https://bugs.webkit.org/show_bug.cgi?id=173303
3293         <rdar://problem/32732526>
3294
3295         Reviewed by Keith Miller.
3296
3297         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3298         * stress/function-constructor-semantics.js: Added.
3299         (assert):
3300         (hasSyntaxError):
3301         (foo):
3302         (async.foo):
3303         (testError):
3304         (testOK.toString):
3305         (toString):
3306
3307 2017-06-26  Saam Barati  <sbarati@apple.com>
3308
3309         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3310         https://bugs.webkit.org/show_bug.cgi?id=173740
3311
3312         Reviewed by Mark Lam.
3313
3314         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3315         (Array.prototype.Symbol.iterator):
3316
3317 2017-06-26  Saam Barati  <sbarati@apple.com>
3318
3319         Skip a test on 32-bit platforms since we run out of address space.
3320
3321         Rubber stamped by Mark Lam.
3322
3323         * stress/dont-reserve-huge-capacity-lexer.js:
3324
3325 2017-06-26  Saam Barati  <sbarati@apple.com>
3326
3327         Crash in JSC::Lexer<unsigned char>::setCode
3328         https://bugs.webkit.org/show_bug.cgi?id=172754
3329
3330         Reviewed by Mark Lam.
3331
3332         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3333         (catch):
3334
3335 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3336
3337         [JSC] Clean up Object.entries implementation
3338         https://bugs.webkit.org/show_bug.cgi?id=173759
3339
3340         Reviewed by Sam Weinig.
3341
3342         * microbenchmarks/object-entries.js: Added.
3343         (test):
3344
3345 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3346
3347         Remove Reflect.enumerate
3348         https://bugs.webkit.org/show_bug.cgi?id=173806
3349
3350         Reviewed by Yusuke Suzuki.
3351
3352         * ChakraCore.yaml:
3353         * es6.yaml:
3354         These tests now fail because they use Reflect.enumerate.
3355
3356         * test262.yaml:
3357         This test now passes, it checked that Reflect.enumerate is undefined!
3358
3359         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3360         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3361
3362         * stress/reflect-enumerate.js: Removed.
3363         Remove a test solely for Reflect.enumerate.
3364
3365 2017-06-22  Saam Barati  <sbarati@apple.com>
3366
3367         ValueRep(DoubleRep(@v)) can not simply convert to @v
3368         https://bugs.webkit.org/show_bug.cgi?id=173687
3369         <rdar://problem/32855563>
3370
3371         Reviewed by Mark Lam.
3372
3373         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3374         (i.catch):
3375
3376 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3377
3378         [JSC] Object.values should be implemented in C++
3379         https://bugs.webkit.org/show_bug.cgi?id=173703
3380
3381         Reviewed by Sam Weinig.
3382
3383         * microbenchmarks/object-keys-map-values.js: Added.
3384         (test):
3385         * microbenchmarks/object-values.js: Added.
3386         (test):
3387         * stress/object-values-changing-properties.js: Added.
3388         (shouldBe):
3389         (throw.new.Error.let.source.get x):
3390         (throw.new.Error):
3391         (shouldBe.let.handler.get order):
3392         (get let):
3393         (shouldBe.let.handler.get return):
3394         (let.handler.get order):
3395
3396 2017-06-21  Saam Barati  <sbarati@apple.com>
3397
3398         eval virtual call is incorrect in the baseline JIT
3399         https://bugs.webkit.org/show_bug.cgi?id=173587
3400         <rdar://problem/32867897>
3401
3402         Reviewed by Michael Saboff.
3403
3404         * stress/do-eval-virtual-call-correctly.js: Added.
3405         (assert):
3406         (f):
3407         (i.test):
3408         (catch):
3409
3410 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3411
3412         Update test262 test expectations after r218581.
3413
3414         Unreviewed test gardening.
3415
3416         * test262.yaml:
3417
3418 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
3419
3420         Revert changes in bug#160417 about extending `null` not being a derived class
3421         https://bugs.webkit.org/show_bug.cgi?id=169293
3422
3423         Reviewed by Saam Barati.
3424
3425         * stress/class-derived-from-null.js:
3426         (assertThrow):
3427         (test1):
3428         (test2):
3429         (test3):
3430         (test4):
3431         (test5):
3432         (test6):
3433
3434 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3435
3436         [DFG] More ArrayIndexOf fixups for various types
3437         https://bugs.webkit.org/show_bug.cgi?id=173176
3438
3439         Reviewed by Saam Barati.
3440
3441         * stress/array-indexof-arraystorage.js: Added.
3442         (shouldBe):
3443         (indexOfInt32Other):
3444         (indexOfInt32Cell):
3445         (indexOfInt32Boolean):
3446         (indexOfDoubleOther):
3447         (indexOfDoubleCell):
3448         (indexOfDoubleBoolean):
3449         (indexOfInt32):
3450         (indexOfDouble):
3451         * stress/array-indexof-constant-folding.js: Added.
3452         (shouldBe):
3453         (indexOfInt32Other):
3454         (indexOfInt32Cell):
3455         (indexOfInt32Boolean):
3456         (indexOfDoubleOther):
3457         (indexOfDoubleCell):
3458         (indexOfDoubleBoolean):
3459         * stress/array-indexof-hole-and-other.js: Added.
3460         (shouldBe):
3461         (indexOf):
3462         * stress/array-indexof-other.js: Added.
3463         (shouldBe):
3464         (indexOfInt32):
3465         (indexOfDouble):
3466         (indexOfString):
3467         (indexOfObject):
3468         * stress/array-indexof-symbol.js: Added.
3469         (shouldBe):
3470         (indexOfInt32):
3471         (indexOfDouble):
3472         (indexOfString):
3473         (indexOfObject):
3474
3475 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
3476
3477         test262: Completion values for control flow do not match the spec
3478         https://bugs.webkit.org/show_bug.cgi?id=171265
3479
3480         Reviewed by Saam Barati.
3481
3482         * stress/completion-value.js:
3483         Condensed test for completion values in top level statements.
3484
3485         * stress/super-get-by-id.js:
3486         ClassDeclaration when evaled no longer produce values. Convert
3487         these to ClassExpressions so they produce the class value.
3488
3489         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3490         This is a progression for currect spec behavior.
3491
3492         * mozilla/mozilla-tests.yaml:
3493         This test is now outdated, so mark it as failing for that reason.
3494
3495         * test262.yaml:
3496         Passing all "cptn" completion value tests.
3497
3498 2017-06-17  Keith Miller  <keith_miller@apple.com>
3499
3500         ArrayBuffer constructor needs to create subclass structures before its buffer
3501         https://bugs.webkit.org/show_bug.cgi?id=173510
3502
3503         Reviewed by Yusuke Suzuki.
3504
3505         * test262.yaml:
3506
3507 2017-06-17  Keith Miller  <keith_miller@apple.com>
3508
3509         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
3510         https://bugs.webkit.org/show_bug.cgi?id=173506
3511
3512         Reviewed by Ryosuke Niwa.
3513
3514         Re-baseline tests.
3515
3516         * ChakraCore/test/Function/apply3.baseline-jsc:
3517         * test262.yaml:
3518
3519 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3520
3521         [JSC] Add fast path for Object.assign
3522         https://bugs.webkit.org/show_bug.cgi?id=173416
3523
3524         Reviewed by Mark Lam.
3525
3526         * stress/object-assign-changing-properties.js: Added.
3527         (shouldBe):
3528         (throw.new.Error.let.source.get x):
3529         (throw.new.Error):
3530         (shouldBe.let.source.get x):
3531         (shouldBe.let.target.set x):
3532         (shouldBe.let.target.get x):
3533         * stress/object-assign-proxy.js: Added.
3534         (shouldBe):
3535         (throw.new.Error.let.handler.get order):
3536
3537 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3538
3539         [JSC] Implement Object.assign in C++
3540         https://bugs.webkit.org/show_bug.cgi?id=173414
3541
3542         Reviewed by Saam Barati.
3543
3544         * stress/object-assign-string-first.js: Added.
3545         (shouldBe):
3546         (source.get Symbol):
3547         (source.get 1):
3548         (source.get cocoa):
3549
3550 2017-06-14  JF Bastien  <jfbastien@apple.com>
3551
3552         WebAssembly: remove empty test files
3553         https://bugs.webkit.org/show_bug.cgi?id=173382
3554
3555         Reviewed by Saam Barati.
3556
3557         The following files:
3558                 JSTests/wasm/function-tests/call-indirect-params.js
3559                 JSTests/wasm/function-tests/call-indirect.js
3560                 JSTests/wasm/js-api/call-indirect-results.js
3561         Were changed to empty files in https://trac.webkit.org/changeset/209771
3562
3563         They were testing call_indirect with the wrong semantics, before
3564         we implemented tables. That change implemented tables and
3565         therefore removed the erroneous tests.
3566
3567         We have a few tests for call_indirect which already do the right thing:
3568                 JSTests/wasm/function-tests/context-switch.js
3569                 JSTests/wasm/function-tests/exceptions.js
3570                 JSTests/wasm/function-tests/grow-memory-2.js
3571                 JSTests/wasm/function-tests/stack-overflow.js
3572                 JSTests/wasm/function-tests/table-basic-2.js
3573                 JSTests/wasm/function-tests/table-basic.js
3574                 JSTests/wasm/js-api/call-indirect.js
3575                 JSTests/wasm/js-api/table.js
3576                 JSTests/wasm/js-api/unique-signature.js
3577                 JSTests/wasm/js-api/wrapper-function.js
3578
3579         I also just imported the updated spec tests which, among other
3580         things, test call_indirect:
3581                 core/br.wast
3582                 core/br_table.wast
3583                 core/call_indirect.wast
3584                 core/func.wast
3585                 core/func_ptrs.wast
3586                 core/imports.wast
3587                 core/left-to-right.wast
3588                 core/linking.wast
3589                 core/nop.wast
3590                 core/return.wast
3591                 core/typecheck.wast
3592                 core/unreachable.wast
3593
3594         So I think it's OK to just delete the tests which should just have
3595         been deleted back when tables were added.
3596
3597         * wasm/function-tests/call-indirect-params.js: Removed.
3598         * wasm/function-tests/call-indirect.js: Removed.
3599         * wasm/js-api/call-indirect-results.js: Removed.
3600
3601 2017-06-13  JF Bastien  <jfbastien@apple.com>
3602
3603         WebAssembly: import updated spec tests
3604         https://bugs.webkit.org/show_bug.cgi?id=173287
3605         <rdar://problem/32725975>
3606
3607         Reviewed by Saam Barati.
3608
3609         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
3610         with a few modifications so things work.
3611
3612         Fix a bunch of bugs found through this process, and punt a few tests (which I
3613         marked as blocked by this bug).
3614
3615         Fixes:
3616
3617         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
3618         instead of byte alignment. It was also missing memory-alignment.js despite it
3619         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
3620         pass.
3621
3622         Tables can be imported or in a section. There can be only one, but sections can
3623         be empty. An Elements section can exist if there's no Table, as long as it is
3624         also empty.
3625
3626         Memories can be imported or in a section. There can be only one, but sections
3627         can be empty. A Data section can exist if there's no Memory, as long as it is
3628         also empty.
3629
3630         Prototypes: stringify without .prototype. in the string.
3631
3632         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
3633         not a final size, and throws a RangeError on failure, not a TypeError.
3634
3635         Fix compile / instantiate so the reject the promise if given an argument of the
3636         wrong type (instead of failing instantly).
3637
3638         Fix async on neuter test.
3639
3640         Element section shouldn't affect any Table if any of the elements are out of
3641         bounds. We need to process it in two passes.
3642
3643         Segment section shouldn't affect any Data if any of the segments are out of
3644         bounds. We need to process it in two passes.
3645
3646         Empty data segments are valid, but only when there is no memory. Their index
3647         still gets validated, and has to be zero.
3648
3649         Punts:
3650
3651         Error messages with context, the test seems overly restrictive but this is
3652         minor.
3653
3654         compile/instantiate/validate property descriptors.
3655
3656         UTF-8 bugs.
3657
3658         Temporarily disable NaN tests. We need to go back and implement the following
3659         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
3660         much as getting all the other tests passing.
3661
3662         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
3663         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
3664         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
3665         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
3666         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
3667         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
3668         why they're not allowed.
3669
3670         * wasm.yaml:
3671         * wasm/function-tests/i32-load8-s.js:
3672         * wasm/function-tests/memory-access-past-4gib.js:
3673         (const.op.of.WASM.opcodes):
3674         * wasm/function-tests/memory-alignment.js: Added.
3675         (const.op.of.WASM.opcodes):
3676         * wasm/function-tests/memory-section-and-import.js:
3677         * wasm/js-api/Module-compile.js:
3678         (async.testPromiseAPI):
3679         * wasm/js-api/dont-mmap-zero-byte-memory.js:
3680         (testMems):
3681         * wasm/js-api/element.js:
3682         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3683         * wasm/js-api/neutered-inputs.js:
3684         (const.testFunction): Deleted.
3685         (const.testConstructor): Deleted.
3686         * wasm/js-api/table.js:
3687         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3688         (new.WebAssembly.Module):
3689         (assert.throws):
3690         (assertBadTableImport):
3691         (assert.throws.WebAssembly.Table.prototype.grow):
3692         (assertBadTableInstance): Deleted.
3693         * wasm/js-api/test_Data.js:
3694         (DataSectionWithoutMemory):
3695         * wasm/spec-harness/index.js:
3696         (module):
3697         (uniqueTest): Deleted.
3698         (assert_invalid): Deleted.
3699         (assert_soft_invalid): Deleted.
3700         (register): Deleted.
3701         (call): Deleted.
3702         (get instance): Deleted.
3703         (exports): Deleted.
3704         (run): Deleted.
3705         (assert_unlinkable): Deleted.
3706         (assert_uninstantiable): Deleted.
3707         (assert_trap): Deleted.
3708         (try.f): Deleted.
3709         (catch): Deleted.
3710         (assert_exhaustion): Deleted.
3711         (assert_return): Deleted.
3712         (assert_return_nan): Deleted.
3713         * wasm/spec-harness/testharness.css: Removed.
3714         * wasm/spec-harness/testharness.js: Removed.
3715         * wasm/spec-harness/testharnessreport.js: Removed.
3716         * wasm/spec-harness/wasm-constants.js:
3717         (assertTraps):
3718         (assertWasmThrows):
3719         * wasm/spec-harness/wasm-module-builder.js:
3720         (Binary.prototype.emit_section):
3721         (Binary):
3722         (WasmFunctionBuilder.prototype.addBody):
3723         (WasmFunctionBuilder.prototype.end):
3724         (WasmFunctionBuilder):
3725         (WasmModuleBuilder.prototype.stringToBytes):
3726         (WasmModuleBuilder.prototype.addCustomSection):
3727         (WasmModuleBuilder.prototype.addFunctionTableInit):
3728         (WasmModuleBuilder.prototype.appendToTable):
3729         (WasmModuleBuilder.prototype.toArray):