Enable gigacage on iOS
[WebKit-https.git] / JSTests / ChangeLog
1 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
2
3         Enable gigacage on iOS
4         https://bugs.webkit.org/show_bug.cgi?id=177586
5
6         Reviewed by JF Bastien.
7         
8         Add tests for when Gigacage gets runtime disabled.
9
10         * stress/disable-gigacage-arrays.js: Added.
11         (foo):
12         * stress/disable-gigacage-strings.js: Added.
13         (foo):
14         * stress/disable-gigacage-typed-arrays.js: Added.
15         (foo):
16
17 2017-10-06  Commit Queue  <commit-queue@webkit.org>
18
19         Unreviewed, rolling out r222791 and r222873.
20         https://bugs.webkit.org/show_bug.cgi?id=178031
21
22         Caused crashes with workers/wasm LayoutTests (Requested by
23         ryanhaddad on #webkit).
24
25         Reverted changesets:
26
27         "WebAssembly: no VM / JS version of everything but Instance"
28         https://bugs.webkit.org/show_bug.cgi?id=177473
29         http://trac.webkit.org/changeset/222791
30
31         "WebAssembly: address no VM / JS follow-ups"
32         https://bugs.webkit.org/show_bug.cgi?id=177887
33         http://trac.webkit.org/changeset/222873
34
35 2017-10-05  Saam Barati  <sbarati@apple.com>
36
37         Make sure all prototypes under poly proto get added into the VM's prototype map
38         https://bugs.webkit.org/show_bug.cgi?id=177909
39
40         Reviewed by Keith Miller.
41
42         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
43         (assert):
44         (foo.C):
45         (foo):
46         (set x):
47
48 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
49
50         [JSC] Introduce import.meta
51         https://bugs.webkit.org/show_bug.cgi?id=177703
52
53         Reviewed by Filip Pizlo.
54
55         * modules/import-meta-syntax.js: Added.
56         (shouldThrow):
57         (shouldNotThrow):
58         * modules/import-meta.js: Added.
59         * modules/import-meta/cocoa.js: Added.
60         * modules/resources/assert.js:
61         (export.shouldNotThrow):
62         * stress/import-syntax.js:
63
64 2017-10-04  Saam Barati  <sbarati@apple.com>
65
66         Make pertinent AccessCases watch the poly proto watchpoint
67         https://bugs.webkit.org/show_bug.cgi?id=177765
68
69         Reviewed by Keith Miller.
70
71         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
72         (assert):
73         (foo.C):
74         (foo):
75         (validate):
76         * stress/poly-proto-clear-stub.js: Added.
77         (assert):
78         (foo.C):
79         (foo):
80
81 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
82
83         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
84
85         Unreviewed test gardening.
86
87         * test262.yaml:
88
89 2017-10-04  Saam Barati  <sbarati@apple.com>
90
91         3 poly-proto JSC tests timing out on debug after r222827
92         https://bugs.webkit.org/show_bug.cgi?id=177880
93
94         Rubber stamped by Mark Lam.
95
96         * microbenchmarks/poly-proto-access.js:
97         * typeProfiler/deltablue-for-of.js:
98         * typeProfiler/getter-richards.js:
99
100 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
101
102         Unreviewed, marking tco-catch.js as a failure after test262 update
103         https://bugs.webkit.org/show_bug.cgi?id=177859
104
105         * test262.yaml:
106
107 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
108
109         Unreviewed, marking one async iterator test262 test failed
110         https://bugs.webkit.org/show_bug.cgi?id=177859
111
112         * test262.yaml:
113
114 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
115
116         [Test262] Update Test262 to Oct 4 version
117         https://bugs.webkit.org/show_bug.cgi?id=177859
118
119         Reviewed by Sam Weinig.
120
121         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
122         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
123
124         * test262.yaml:
125         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
126         (checkSequence):
127         * test262/harness/typeCoercion.js:
128         (testCoercibleToIndexZero):
129         (testCoercibleToIndexOne):
130         (testCoercibleToIndexFromIndex):
131         (testNotCoercibleToIndex.testPrimitiveValue):
132         (testNotCoercibleToInteger):
133         (testCoercibleToBigIntZero.testPrimitiveValue):
134         (testCoercibleToBigIntZero):
135         (testCoercibleToBigIntOne.testPrimitiveValue):
136         (testCoercibleToBigIntOne):
137         (testPrimitiveValue):
138         (testCoercibleToBigIntFromBigInt):
139         (testNotCoercibleToBigInt.testPrimitiveValue):
140         (testNotCoercibleToBigInt.testStringValue):
141         (testNotCoercibleToBigInt):
142         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
143         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
144         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
145         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
146         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
147         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
148         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
149         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
150         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
151         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
152         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
153         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
154         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
155         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
156         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
157         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
158         (testCoercibleToBigIntZero):
159         (testCoercibleToBigIntOne):
160         (testNotCoercibleToBigInt):
161         (MyError): Deleted.
162         (valueOf): Deleted.
163         (toString): Deleted.
164         (Symbol.toPrimitive): Deleted.
165         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
166         (testCoercibleToIndexZero):
167         (testCoercibleToIndexOne):
168         (testNotCoercibleToIndex):
169         (MyError): Deleted.
170         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
171         (assert.sameValue.BigInt.asIntN.toString): Deleted.
172         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
173         (BigInt.asIntN.valueOf): Deleted.
174         (BigInt.asIntN.toString): Deleted.
175         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
176         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
177         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
178         (testCoercibleToBigIntZero):
179         (testCoercibleToBigIntOne):
180         (testNotCoercibleToBigInt):
181         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
182         (testCoercibleToIndexZero):
183         (testCoercibleToIndexOne):
184         (testNotCoercibleToIndex):
185         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
186         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
187         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
188         (bits.valueOf):
189         (bigint.valueOf):
190         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
191         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
192         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
193         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
194         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
195         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
196         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
197         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
198         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
199         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
200         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
201         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
202         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
203         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
204         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
205         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
206         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
207         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
208         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
209         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
210         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
211         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
212         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
213         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
214         (replacer):
215         (BigInt.prototype.toJSON):
216         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
217         (replacer):
218         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
219         (BigInt.prototype.toJSON):
220         * test262/test/built-ins/JSON/stringify/bigint.js:
221         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
222         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
223         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
224         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
225         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
226         * test262/test/built-ins/Object/proto-from-ctor.js:
227         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
228         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
229         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
230         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
231         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
232         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
233         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
234         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
235         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
236         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
237         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
238         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
239         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
240         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
241         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
242         * test262/test/built-ins/Proxy/get-fn-realm.js:
243         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
244         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
245         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
246         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
247         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
248         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
249         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
250         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
251         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
252         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
253         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
254         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
255         (i6.replace):
256         (i6b.replace):
257         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
258         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
259         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
260         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
261         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
262         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
263         * test262/test/built-ins/RegExp/u180e.js: Added.
264         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
265         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
266         * test262/test/built-ins/String/proto-from-ctor-realm.js:
267         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
268         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
269         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
270         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
271         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
272         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
273         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
274         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
275         * test262/test/built-ins/String/prototype/endsWith/length.js:
276         * test262/test/built-ins/String/prototype/endsWith/name.js:
277         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
278         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
279         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
280         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
281         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
282         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
283         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
284         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
285         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
286         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
287         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
288         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
289         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
290         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
291         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
292         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
293         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
294         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
295         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
296         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
297         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
298         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
299         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
300         * test262/test/built-ins/String/prototype/includes/includes.js:
301         * test262/test/built-ins/String/prototype/includes/length.js:
302         * test262/test/built-ins/String/prototype/includes/name.js:
303         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
304         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
305         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
306         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
307         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
308         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
309         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
310         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
311         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
312         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
313         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
314         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
315         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
316         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
317         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
318         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
319         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
320         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
321         * test262/test/built-ins/String/prototype/trim/u180e.js:
322         * test262/test/built-ins/Symbol/for/cross-realm.js:
323         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
324         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
325         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
326         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
327         * test262/test/built-ins/Symbol/match/cross-realm.js:
328         * test262/test/built-ins/Symbol/replace/cross-realm.js:
329         * test262/test/built-ins/Symbol/search/cross-realm.js:
330         * test262/test/built-ins/Symbol/species/cross-realm.js:
331         * test262/test/built-ins/Symbol/split/cross-realm.js:
332         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
333         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
334         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
335         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
336         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
337         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
338         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
339         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
340         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
341         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
342         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
343         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
344         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
345         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
346         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
347         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
348         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
349         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
350         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
351         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
352         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
353         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
354         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
355         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
356         * test262/test/language/comments/mongolian-vowel-separator-single.js:
357         * test262/test/language/eval-code/indirect/realm.js:
358         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
359         (o.get z):
360         (o.get a):
361         * test262/test/language/expressions/call/eval-realm-indirect.js:
362         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
363         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
364         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
365         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
366         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
367         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
368         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
369         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
370         * test262/test/language/expressions/greater-than/bigint-and-number.js:
371         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
372         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
373         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
374         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
375         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
376         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
377         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
378         * test262/test/language/expressions/less-than/bigint-and-number.js:
379         * test262/test/language/expressions/new/non-ctor-err-realm.js:
380         * test262/test/language/expressions/super/realm.js:
381         * test262/test/language/expressions/tagged-template/cache-realm.js:
382         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
383         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
384         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
385         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
386         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
387         * test262/test/language/literals/string/mongolian-vowel-separator.js:
388         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
389         (o.get z):
390         (o.get a):
391         * test262/test/language/statements/for-of/iterator-next-reference.js:
392         (next):
393         (iterator.next): Deleted.
394         (x.of.iterable.): Deleted.
395         (x.of.iterable.get return): Deleted.
396         (x.of.iterable.iterator.next): Deleted.
397         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
398         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
399         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
400         * test262/test/language/white-space/mongolian-vowel-separator.js:
401         * test262/test262-Revision.txt:
402
403 2017-10-03  Saam Barati  <sbarati@apple.com>
404
405         Implement polymorphic prototypes
406         https://bugs.webkit.org/show_bug.cgi?id=176391
407
408         Reviewed by Filip Pizlo.
409
410         * microbenchmarks/poly-proto-access.js: Added.
411         (assert):
412         (foo.C):
413         (foo.C.prototype.get bar):
414         (foo):
415         (bar):
416         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
417         (assert):
418         (makePolyProtoObject.foo.C):
419         (makePolyProtoObject.foo):
420         (makePolyProtoObject):
421         (performSet):
422         * microbenchmarks/poly-proto-setter-speed.js: Added.
423         (assert):
424         (makePolyProtoObject.foo.C):
425         (makePolyProtoObject.foo.C.prototype.set p):
426         (makePolyProtoObject.foo):
427         (makePolyProtoObject):
428         (performSet):
429         * stress/constructor-with-return.js:
430         (i.tests.forEach.Constructor):
431         (i.tests.forEach):
432         (tests.forEach.Constructor): Deleted.
433         (tests.forEach): Deleted.
434         * stress/dom-jit-with-poly-proto.js: Added.
435         (assert):
436         (makePolyProtoObject.foo.C):
437         (makePolyProtoObject.foo):
438         (makePolyProtoObject):
439         (validate):
440         * stress/poly-proto-custom-value-and-accessor.js: Added.
441         (assert):
442         (makePolyProtoObject.foo.C):
443         (makePolyProtoObject.foo):
444         (makePolyProtoObject):
445         (items.forEach):
446         (set get for):
447         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
448         (assert):
449         (makePolyProtoObject.foo.C):
450         (makePolyProtoObject.foo):
451         (makePolyProtoObject):
452         (foo):
453         * stress/poly-proto-miss.js: Added.
454         (makePolyProtoInstanceWithNullPrototype.foo.C):
455         (makePolyProtoInstanceWithNullPrototype.foo):
456         (makePolyProtoInstanceWithNullPrototype):
457         (assert):
458         (validate):
459         * stress/poly-proto-op-in-caching.js: Added.
460         (assert):
461         (makePolyProtoObject.foo.C):
462         (makePolyProtoObject.foo):
463         (makePolyProtoObject):
464         (validate):
465         (validate2):
466         * stress/poly-proto-put-transition.js: Added.
467         (assert):
468         (makePolyProtoObject.foo.C):
469         (makePolyProtoObject.foo):
470         (makePolyProtoObject):
471         (performSet):
472         (i.obj.__proto__.set p):
473         * stress/poly-proto-set-prototype.js: Added.
474         (assert):
475         (let.alternateProto.get x):
476         (let.alternateProto2.get y):
477         (let.alternateProto2.get x):
478         (foo.C):
479         (foo):
480         (validate):
481         * stress/poly-proto-setter.js: Added.
482         (assert):
483         (makePolyProtoObject.foo.C):
484         (makePolyProtoObject.foo.C.prototype.set p):
485         (makePolyProtoObject.foo.C.prototype.get p):
486         (makePolyProtoObject.foo):
487         (makePolyProtoObject):
488         (performSet):
489         * stress/poly-proto-using-inheritance.js: Added.
490         (assert):
491         (foo.C):
492         (foo.C.prototype.get baz):
493         (foo):
494         (bar.C):
495         (bar):
496         (validate):
497         * stress/primitive-poly-proto.js: Added.
498         (makePolyProtoInstance.foo.C):
499         (makePolyProtoInstance.foo):
500         (makePolyProtoInstance):
501         (assert):
502         (validate):
503         * stress/prototype-is-not-js-object.js: Added.
504         (foo.bar):
505         (foo):
506         (assert):
507         (validate):
508         * stress/try-get-by-id-poly-proto.js: Added.
509         (assert):
510         (makePolyProtoObject.foo.C):
511         (makePolyProtoObject.foo):
512         (makePolyProtoObject):
513         (tryGetByIdText):
514         (x.__proto__.get bar):
515         (validate):
516         * typeProfiler/overflow.js:
517
518 2017-10-03  JF Bastien  <jfbastien@apple.com>
519
520         WebAssembly: no VM / JS version of everything but Instance
521         https://bugs.webkit.org/show_bug.cgi?id=177473
522
523         Reviewed by Filip Pizlo.
524
525         - Exceeding max on memory growth now returns a range error as per
526         spec. This is a (very minor) breaking change: it used to throw OOM
527         error. Update the corresponding test.
528
529         * wasm/js-api/memory-grow.js:
530         (assertEq):
531         * wasm/js-api/table.js:
532         (assert.throws):
533
534 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
535
536         Skip JSC test stress/regress-159779-2.js on debug.
537         https://bugs.webkit.org/show_bug.cgi?id=177204
538
539         Unreviewed test gardening.
540
541         * stress/regress-159779-2.js:
542
543 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
544
545         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
546         https://bugs.webkit.org/show_bug.cgi?id=175642
547
548         Reviewed by Darin Adler.
549
550         * ChakraCore/test/Function/apply3.baseline-jsc:
551
552 2017-10-01  Commit Queue  <commit-queue@webkit.org>
553
554         Unreviewed, rolling out r222564.
555         https://bugs.webkit.org/show_bug.cgi?id=177720
556
557         "It regressed JetStream by 2% on iOS caused by a 50%
558         regression on the bigfib subtest" (Requested by saamyjoon on
559         #webkit).
560
561         Reverted changeset:
562
563         "Add Above/Below comparisons for UInt32 patterns"
564         https://bugs.webkit.org/show_bug.cgi?id=177281
565         http://trac.webkit.org/changeset/222564
566
567 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
568
569         [DFG] Support ArrayPush with multiple args
570         https://bugs.webkit.org/show_bug.cgi?id=175823
571
572         Reviewed by Saam Barati.
573
574         * microbenchmarks/array-push-0.js: Added.
575         (arrayPush0):
576         * microbenchmarks/array-push-1.js: Added.
577         (arrayPush1):
578         * microbenchmarks/array-push-2.js: Added.
579         (arrayPush2):
580         * microbenchmarks/array-push-3.js: Added.
581         (arrayPush3):
582         * stress/array-push-multiple-contiguous.js: Added.
583         (shouldBe):
584         (test):
585         * stress/array-push-multiple-double-nan.js: Added.
586         (shouldBe):
587         (test):
588         * stress/array-push-multiple-double.js: Added.
589         (shouldBe):
590         (test):
591         * stress/array-push-multiple-int32.js: Added.
592         (shouldBe):
593         (test):
594         * stress/array-push-multiple-many-contiguous.js: Added.
595         (shouldBe):
596         (test):
597         * stress/array-push-multiple-many-double.js: Added.
598         (shouldBe):
599         (test):
600         * stress/array-push-multiple-many-int32.js: Added.
601         (shouldBe):
602         (test):
603         * stress/array-push-multiple-many-storage.js: Added.
604         (shouldBe):
605         (test):
606         * stress/array-push-multiple-storage.js: Added.
607         (shouldBe):
608         (test):
609         * stress/array-push-with-force-exit.js: Added.
610         (target.createBuiltin):
611
612 2017-09-29  Saam Barati  <sbarati@apple.com>
613
614         Custom GetterSetterAccessCase does not use the correct slotBase when making call
615         https://bugs.webkit.org/show_bug.cgi?id=177639
616
617         Reviewed by Geoffrey Garen.
618
619         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
620         (assert):
621         (Class):
622         (items.forEach):
623         (set get for):
624
625 2017-09-29  Commit Queue  <commit-queue@webkit.org>
626
627         Unreviewed, rolling out r222563, r222565, and r222581.
628         https://bugs.webkit.org/show_bug.cgi?id=177675
629
630         "It causes a crash when playing youtube videos" (Requested by
631         saamyjoon on #webkit).
632
633         Reverted changesets:
634
635         "[DFG] Support ArrayPush with multiple args"
636         https://bugs.webkit.org/show_bug.cgi?id=175823
637         http://trac.webkit.org/changeset/222563
638
639         "Unreviewed, build fix after r222563"
640         https://bugs.webkit.org/show_bug.cgi?id=175823
641         http://trac.webkit.org/changeset/222565
642
643         "Unreviewed, fix x86 breaking due to exhausted registers"
644         https://bugs.webkit.org/show_bug.cgi?id=175823
645         http://trac.webkit.org/changeset/222581
646
647 2017-09-28  Mark Lam  <mark.lam@apple.com>
648
649         test262: Unexpected passes after r222617 and r222618.
650         https://bugs.webkit.org/show_bug.cgi?id=177622
651         <rdar://problem/34725960>
652
653         Reviewed by Saam Barati.
654
655         Update test262.yaml for tests that are now passing.
656
657         * test262.yaml:
658
659 2017-09-27  Michael Saboff  <msaboff@apple.com>
660
661         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
662         https://bugs.webkit.org/show_bug.cgi?id=177570
663
664         Reviewed by Filip Pizlo.
665
666         New regression test.
667
668         * stress/regress-177570.js: Added.
669
670 2017-09-28  Michael Saboff  <msaboff@apple.com>
671
672         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
673         https://bugs.webkit.org/show_bug.cgi?id=177423
674
675         Reviewed by Mark Lam.
676
677         Updated regression test.
678
679         * stress/regress-177423.js:
680         (catch):
681
682 2017-09-27  Mark Lam  <mark.lam@apple.com>
683
684         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
685         https://bugs.webkit.org/show_bug.cgi?id=177584
686         <rdar://problem/34463903>
687
688         Reviewed by Saam Barati.
689
690         * stress/regress-177584.js: Added.
691         (assertEqual):
692         (Array.prototype.Symbol.species):
693
694 2017-09-27  Saam Barati  <sbarati@apple.com>
695
696         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
697         https://bugs.webkit.org/show_bug.cgi?id=177523
698
699         Reviewed by Mark Lam.
700
701         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
702         (assert):
703         (Test):
704         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
705         (addMethods):
706         (i.Test.prototype.propName):
707
708 2017-09-27  Mark Lam  <mark.lam@apple.com>
709
710         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
711         https://bugs.webkit.org/show_bug.cgi?id=177423
712         <rdar://problem/34621320>
713
714         Reviewed by Keith Miller.
715
716         * stress/regress-177423.js: Added.
717
718 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
719
720         Add Above/Below comparisons for UInt32 patterns
721         https://bugs.webkit.org/show_bug.cgi?id=177281
722
723         Reviewed by Saam Barati.
724
725         * stress/uint32-comparison-jump.js: Added.
726         (shouldBe):
727         (above):
728         (aboveOrEqual):
729         (below):
730         (belowOrEqual):
731         (notAbove):
732         (notAboveOrEqual):
733         (notBelow):
734         (notBelowOrEqual):
735         * stress/uint32-comparison.js: Added.
736         (shouldBe):
737         (above):
738         (aboveOrEqual):
739         (below):
740         (belowOrEqual):
741         (aboveTest):
742         (aboveOrEqualTest):
743         (belowTest):
744         (belowOrEqualTest):
745
746 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
747
748         [DFG] Support ArrayPush with multiple args
749         https://bugs.webkit.org/show_bug.cgi?id=175823
750
751         Reviewed by Saam Barati.
752
753         * microbenchmarks/array-push-0.js: Added.
754         (arrayPush0):
755         * microbenchmarks/array-push-1.js: Added.
756         (arrayPush1):
757         * microbenchmarks/array-push-2.js: Added.
758         (arrayPush2):
759         * microbenchmarks/array-push-3.js: Added.
760         (arrayPush3):
761         * stress/array-push-multiple-contiguous.js: Added.
762         (shouldBe):
763         (test):
764         * stress/array-push-multiple-double-nan.js: Added.
765         (shouldBe):
766         (test):
767         * stress/array-push-multiple-double.js: Added.
768         (shouldBe):
769         (test):
770         * stress/array-push-multiple-int32.js: Added.
771         (shouldBe):
772         (test):
773         * stress/array-push-multiple-many-contiguous.js: Added.
774         (shouldBe):
775         (test):
776         * stress/array-push-multiple-many-double.js: Added.
777         (shouldBe):
778         (test):
779         * stress/array-push-multiple-many-int32.js: Added.
780         (shouldBe):
781         (test):
782         * stress/array-push-multiple-many-storage.js: Added.
783         (shouldBe):
784         (test):
785         * stress/array-push-multiple-storage.js: Added.
786         (shouldBe):
787         (test):
788
789 2017-09-26  Commit Queue  <commit-queue@webkit.org>
790
791         Unreviewed, rolling out r222518.
792         https://bugs.webkit.org/show_bug.cgi?id=177507
793
794         Break the High Sierra build (Requested by yusukesuzuki on
795         #webkit).
796
797         Reverted changeset:
798
799         "Add Above/Below comparisons for UInt32 patterns"
800         https://bugs.webkit.org/show_bug.cgi?id=177281
801         http://trac.webkit.org/changeset/222518
802
803 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
804
805         Add Above/Below comparisons for UInt32 patterns
806         https://bugs.webkit.org/show_bug.cgi?id=177281
807
808         Reviewed by Saam Barati.
809
810         * stress/uint32-comparison-jump.js: Added.
811         (shouldBe):
812         (above):
813         (aboveOrEqual):
814         (below):
815         (belowOrEqual):
816         (notAbove):
817         (notAboveOrEqual):
818         (notBelow):
819         (notBelowOrEqual):
820         * stress/uint32-comparison.js: Added.
821         (shouldBe):
822         (above):
823         (aboveOrEqual):
824         (below):
825         (belowOrEqual):
826         (aboveTest):
827         (aboveOrEqualTest):
828         (belowTest):
829         (belowOrEqualTest):
830
831 2017-09-23  Keith Miller  <keith_miller@apple.com>
832
833         Fix infinite looping test262 test
834         https://bugs.webkit.org/show_bug.cgi?id=177412
835
836         Reviewed by Yusuke Suzuki.
837
838         This test was poorly designed since failing it would cause the vm
839         to inifinite loop. I've fixed it locally and will fix it on github pending
840         the results of next weeks tc39 meeting.
841
842         * test262.yaml:
843         * test262/test/language/statements/for-of/iterator-next-reference.js:
844
845 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
846
847         test262: $.agent became $262.agent in test262 update
848         https://bugs.webkit.org/show_bug.cgi?id=177407
849
850         Reviewed by Yusuke Suzuki.
851
852         * test262.yaml:
853         ~320 tests pass now that we correctly make $262 available.
854
855 2017-09-22  Keith Miller  <keith_miller@apple.com>
856
857         Speculatively change iteration protocall to use the same next function
858         https://bugs.webkit.org/show_bug.cgi?id=175653
859
860         Reviewed by Saam Barati.
861
862         Change test to match the new iteration behavior.
863
864         * stress/spread-optimized-properly.js:
865
866 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
867
868         [DFG][FTL] Profile array vector length for array allocation
869         https://bugs.webkit.org/show_bug.cgi?id=177051
870
871         Reviewed by Saam Barati.
872
873         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
874         (target):
875
876 2017-09-22  Commit Queue  <commit-queue@webkit.org>
877
878         Unreviewed, rolling out r222380.
879         https://bugs.webkit.org/show_bug.cgi?id=177352
880
881         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
882         #webkit).
883
884         Reverted changeset:
885
886         "[DFG][FTL] Profile array vector length for array allocation"
887         https://bugs.webkit.org/show_bug.cgi?id=177051
888         http://trac.webkit.org/changeset/222380
889
890 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
891
892         [DFG][FTL] Profile array vector length for array allocation
893         https://bugs.webkit.org/show_bug.cgi?id=177051
894
895         Reviewed by Saam Barati.
896
897         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
898         (target):
899
900 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
901
902         Skip new hanging test262 tests.
903         https://bugs.webkit.org/show_bug.cgi?id=177326
904
905         Unreviewed test gardening.
906
907         * test262.yaml:
908
909 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
910
911         Mark 6 test262 tests as passing.
912         https://bugs.webkit.org/show_bug.cgi?id=177307
913
914         Unreviewed test gardening.
915
916         * test262.yaml:
917
918 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
919
920         Unreviewed follow-up to r222311.
921
922         * test262/harness/sta.js:
923         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
924         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
925         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
926         * test262/test/built-ins/Array/from/elements-added-after.js:
927         * test262/test/built-ins/Array/from/elements-deleted-after.js:
928         * test262/test/built-ins/Array/from/elements-updated-after.js:
929         * test262/test/built-ins/Array/from/from-array.js:
930         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
931         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
932         * test262/test/built-ins/Array/from/source-array-boundary.js:
933         * test262/test/built-ins/Array/from/source-object-constructor.js:
934         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
935         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
936         * test262/test/built-ins/Array/from/source-object-length.js:
937         * test262/test/built-ins/Array/from/source-object-missing.js:
938         * test262/test/built-ins/Array/from/source-object-without.js:
939         * test262/test/built-ins/Array/from/this-null.js:
940         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
941         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
942         * test262/test/language/literals/numeric/7.8.3-1gs.js:
943         * test262/test/language/literals/numeric/7.8.3-2gs.js:
944         * test262/test/language/literals/numeric/7.8.3-3gs.js:
945         * test262/test/language/literals/regexp/7.8.5-1gs.js:
946         * test262/test/language/literals/string/7.8.4-1gs.js:
947         Fix some files that I failed to update when I applied my patch.
948
949 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
950
951         Update test262 tests
952         https://bugs.webkit.org/show_bug.cgi?id=177220
953
954         Reviewed by Saam Barati and Yusuke Suzuki.
955
956         * test262.yaml:
957         * test262/test262-Revision.txt:
958         New rebaselined expectations for all tests.
959
960         * test262/*:
961         Updated.
962
963 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
964
965         [DFG] Remove ToThis more aggressively
966         https://bugs.webkit.org/show_bug.cgi?id=177056
967
968         Reviewed by Saam Barati.
969
970         * stress/generator-with-this-strict.js: Added.
971         (shouldBe):
972         (generator):
973         (target):
974         * stress/generator-with-this.js: Added.
975         (shouldBe):
976         (generator):
977         (target):
978
979 2017-09-17  Michael Saboff  <msaboff@apple.com>
980
981         https://bugs.webkit.org/show_bug.cgi?id=177038
982         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
983
984         Reviewed by JF Bastien.
985
986         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
987         as it dies using too much memory.
988
989 2017-09-15  Saam Barati  <sbarati@apple.com>
990
991         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
992         https://bugs.webkit.org/show_bug.cgi?id=176981
993
994         Reviewed by Yusuke Suzuki.
995
996         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
997         (assert):
998         (verify):
999         (func):
1000         (const.bar.createBuiltin):
1001
1002 2017-09-14  Saam Barati  <sbarati@apple.com>
1003
1004         It should be valid to exit before each set when doing arity fixup when inlining
1005         https://bugs.webkit.org/show_bug.cgi?id=176948
1006
1007         Reviewed by Keith Miller.
1008
1009         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
1010         (baz):
1011         (bar):
1012         (foo):
1013
1014 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1015
1016         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
1017         https://bugs.webkit.org/show_bug.cgi?id=176867
1018
1019         Reviewed by Sam Weinig.
1020
1021         * microbenchmarks/object-get-own-property-symbols.js: Added.
1022         (test):
1023
1024 2017-09-13  Mark Lam  <mark.lam@apple.com>
1025
1026         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
1027         https://bugs.webkit.org/show_bug.cgi?id=176888
1028         <rdar://problem/34381832>
1029
1030         Not reviewed.
1031
1032         * stress/op_mod-ConstVar.js:
1033         * stress/op_mod-VarConst.js:
1034         * stress/op_mod-VarVar.js:
1035
1036 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
1037
1038         Skip 3 op_mod tests on Debug JSC bots.
1039         https://bugs.webkit.org/show_bug.cgi?id=176630
1040
1041         Unreviewed test gardening.
1042
1043         * stress/op_mod-ConstVar.js:
1044         * stress/op_mod-VarConst.js:
1045         * stress/op_mod-VarVar.js:
1046
1047 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1048
1049         [JSC] Fix Array allocation in Object.keys
1050         https://bugs.webkit.org/show_bug.cgi?id=176826
1051
1052         Reviewed by Saam Barati.
1053
1054         * stress/object-own-property-keys.js: Added.
1055         (shouldBe):
1056
1057 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1058
1059         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1060         https://bugs.webkit.org/show_bug.cgi?id=176010
1061
1062         Reviewed by Filip Pizlo.
1063
1064         * microbenchmarks/weak-map-key.js: Added.
1065         (assert):
1066         (objectKey):
1067         (let.start.Date.now):
1068
1069 2017-09-12  Mark Lam  <mark.lam@apple.com>
1070
1071         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
1072         https://bugs.webkit.org/show_bug.cgi?id=176630
1073
1074         Reviewed by JF Bastien.
1075
1076         Debug builds are just slow, and these tests do a lot.  They pass when I run them
1077         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
1078         a speculative fix for the bots that are seeing these fail.
1079
1080         I also undid the skipping of the op_mod tests for debug builds.
1081
1082         * stress/op_div-ConstVar.js:
1083         * stress/op_div-VarConst.js:
1084         * stress/op_div-VarVar.js:
1085         * stress/op_mod-ConstVar.js:
1086         * stress/op_mod-VarConst.js:
1087         * stress/op_mod-VarVar.js:
1088
1089 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
1090
1091         Skip stress/value-to-boolean.js on Debug bots.
1092         https://bugs.webkit.org/show_bug.cgi?id=176787
1093
1094         Unreviewed test gardening.
1095
1096         * stress/value-to-boolean.js:
1097
1098 2017-09-11  Mark Lam  <mark.lam@apple.com>
1099
1100         Change test expectation for test262/test/language/statements/try/tco-catch.js
1101         https://bugs.webkit.org/show_bug.cgi?id=176749
1102
1103         Rubber stamped by Keith Miller.
1104
1105         It's been failing since at least r221821.  I'm changing the test expectation to
1106         fail to green the bots while I investigate some more.
1107
1108         * test262.yaml:
1109
1110 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
1111
1112         Unreviewed, rolling out r221854.
1113
1114         The test added with this change fails on 32-bit JSC bots.
1115
1116         Reverted changeset:
1117
1118         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
1119         https://bugs.webkit.org/show_bug.cgi?id=176010
1120         http://trac.webkit.org/changeset/221854
1121
1122 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1123
1124         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1125         https://bugs.webkit.org/show_bug.cgi?id=176010
1126
1127         Reviewed by Filip Pizlo.
1128
1129         * microbenchmarks/weak-map-key.js: Added.
1130         (assert):
1131         (objectKey):
1132         (let.start.Date.now):
1133
1134 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1135
1136         [JSC] Optimize Object.keys by using careful array allocation
1137         https://bugs.webkit.org/show_bug.cgi?id=176654
1138
1139         Reviewed by Darin Adler.
1140
1141         * microbenchmarks/object-keys.js: Added.
1142         (test):
1143
1144 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
1145
1146         Error should compute .stack and friends lazily
1147         https://bugs.webkit.org/show_bug.cgi?id=176645
1148
1149         Reviewed by Saam Barati.
1150
1151         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
1152         * microbenchmarks/new-error.js: Added.
1153         * microbenchmarks/throw.js: Added.
1154
1155 2017-09-09  Mark Lam  <mark.lam@apple.com>
1156
1157         [Re-landing] Use JIT probes for DFG OSR exit.
1158         https://bugs.webkit.org/show_bug.cgi?id=175144
1159         <rdar://problem/33437050>
1160
1161         Not reviewed.  Original patch reviewed by Saam Barati.
1162
1163         Disable these tests for debug builds because they run too slow with the new OSR exit.
1164
1165         * stress/op_mod-ConstVar.js:
1166         * stress/op_mod-VarConst.js:
1167         * stress/op_mod-VarVar.js:
1168
1169 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1170
1171         [DFG] NewArrayWithSize(size)'s size does not care negative zero
1172         https://bugs.webkit.org/show_bug.cgi?id=176300
1173
1174         Reviewed by Saam Barati.
1175
1176         * stress/new-array-with-size-div.js: Added.
1177         (shouldBe):
1178         (test):
1179         (i.i):
1180
1181 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1182
1183         [DFG] PutByVal with Array::Generic is too generic
1184         https://bugs.webkit.org/show_bug.cgi?id=176345
1185
1186         Reviewed by Filip Pizlo.
1187
1188         * stress/object-assign-symbols.js: Added.
1189         (shouldBe):
1190         (test):
1191         * stress/object-assign.js: Added.
1192         (shouldBe):
1193         (test):
1194         (i.shouldBe.JSON.stringify.test):
1195
1196 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1197
1198         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
1199         https://bugs.webkit.org/show_bug.cgi?id=176590
1200
1201         Reviewed by Saam Barati.
1202
1203         * microbenchmarks/object-iterate-symbols.js: Added.
1204         (test):
1205         * microbenchmarks/object-iterate.js: Added.
1206         (test):
1207         * stress/object-iterate-symbols.js: Added.
1208         (shouldBe):
1209         (test):
1210         * stress/object-iterate.js: Added.
1211         (shouldBe):
1212         (test):
1213
1214 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
1215
1216         [Win32] 10 JSC stress tests are failing.
1217         https://bugs.webkit.org/show_bug.cgi?id=176538
1218
1219         Reviewed by Mark Lam.
1220
1221         Skip tests on Windows to make the bots green.
1222
1223         * ChakraCore.yaml:
1224         * stress/date-relaxed.js:
1225
1226 2017-09-06  Mark Lam  <mark.lam@apple.com>
1227
1228         constructGenericTypedArrayViewWithArguments() is missing an exception check.
1229         https://bugs.webkit.org/show_bug.cgi?id=176485
1230         <rdar://problem/33898874>
1231
1232         Reviewed by Keith Miller.
1233
1234         * stress/regress-176485.js: Added.
1235
1236 2017-09-05  Saam Barati  <sbarati@apple.com>
1237
1238         isNotCellSpeculation is wrong with respect to SpecEmpty
1239         https://bugs.webkit.org/show_bug.cgi?id=176429
1240
1241         Reviewed by Michael Saboff.
1242
1243         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
1244         (Foo):
1245
1246 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
1247
1248         test262: Completion values for control flow do not match the spec
1249         https://bugs.webkit.org/show_bug.cgi?id=171265
1250
1251         Reviewed by Saam Barati.
1252
1253         * stress/completion-value.js:
1254         Condensed test for completion values in top level statements.
1255
1256         * stress/super-get-by-id.js:
1257         ClassDeclaration when evaled no longer produce values. Convert
1258         these to ClassExpressions so they produce the class value.
1259         
1260         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1261         This is a progression for currect spec behavior.
1262
1263         * mozilla/mozilla-tests.yaml:
1264         This test is now outdated, so mark it as failing for that reason.
1265
1266         * test262.yaml:
1267         Passing all "cptn" completion value tests.
1268
1269 2017-09-04  Saam Barati  <sbarati@apple.com>
1270
1271         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
1272         https://bugs.webkit.org/show_bug.cgi?id=176317
1273
1274         Reviewed by Keith Miller.
1275
1276         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
1277         (Foo):
1278
1279 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1280
1281         [DFG][FTL] Efficiently execute number#toString()
1282         https://bugs.webkit.org/show_bug.cgi?id=170007
1283
1284         Reviewed by Keith Miller.
1285
1286         * microbenchmarks/number-to-string-strength-reduction.js: Added.
1287         (test):
1288         * microbenchmarks/number-to-string-with-radix-10.js: Added.
1289         (test):
1290         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
1291         (test):
1292         * microbenchmarks/number-to-string-with-radix.js: Added.
1293         (test):
1294         * stress/number-to-string-strength-reduction.js: Added.
1295         (shouldBe):
1296         (test):
1297         * stress/number-to-string-with-radix-10.js: Added.
1298         (shouldBe):
1299         (test):
1300         * stress/number-to-string-with-radix-cse.js: Added.
1301         (shouldBe):
1302         (test):
1303         * stress/number-to-string-with-radix-invalid.js: Added.
1304         (shouldThrow):
1305         * stress/number-to-string-with-radix-watchpoint.js: Added.
1306         (shouldBe):
1307         (test):
1308         (i.i.1e3.Number.prototype.toString):
1309         * stress/number-to-string-with-radix.js: Added.
1310         (shouldBe):
1311         (test):
1312
1313 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1314
1315         [DFG] Relax arity requirement
1316         https://bugs.webkit.org/show_bug.cgi?id=175523
1317
1318         Reviewed by Saam Barati.
1319
1320         * stress/arity-mismatch-arguments-length.js: Added.
1321         (shouldBe):
1322         (test1):
1323         (test):
1324         * stress/arity-mismatch-get-argument.js: Added.
1325         (shouldBe):
1326         (builtin.createBuiltin):
1327         (test):
1328         * stress/arity-mismatch-inlining-extra-slots.js: Added.
1329         (shouldBe):
1330         (inlineTarget):
1331         (test):
1332         * stress/arity-mismatch-inlining.js: Added.
1333         (shouldBe):
1334         (inlineTarget):
1335         (test):
1336         * stress/arity-mismatch-rest.js: Added.
1337         (shouldBe):
1338         (test2):
1339         (test1):
1340         (test):
1341
1342 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1343
1344         [JSC] Fix "name" and "length" of Proxy revoke function
1345         https://bugs.webkit.org/show_bug.cgi?id=176155
1346
1347         Reviewed by Mark Lam.
1348
1349         * test262.yaml:
1350
1351 2017-08-31  Saam Barati  <sbarati@apple.com>
1352
1353         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
1354         https://bugs.webkit.org/show_bug.cgi?id=176206
1355
1356         Reviewed by Keith Miller.
1357
1358         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
1359         (a):
1360         (b):
1361         (foo):
1362
1363 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
1364
1365         Skip two slow JSC tests after r221422.
1366
1367         Unreviewed test gardening.
1368
1369         * stress/regexp-prototype-match-on-too-long-rope.js:
1370         * stress/regexp-prototype-test-on-too-long-rope.js:
1371
1372 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
1373
1374         Unreviewed, skipping slow tests.
1375         
1376         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
1377         work differently now.
1378
1379         * stress/regexp-prototype-exec-on-too-long-rope.js:
1380         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
1381
1382 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1383
1384         [JSC] Use reifying system for "name" property of builtin JSFunction
1385         https://bugs.webkit.org/show_bug.cgi?id=175260
1386
1387         Reviewed by Saam Barati.
1388
1389         * stress/accessors-get-set-prefix.js:
1390         * stress/builtin-function-name.js: Added.
1391         (shouldBe):
1392         (shouldThrow):
1393         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1394         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1395         * stress/private-name-as-anonymous-builtin.js: Added.
1396         (shouldBe):
1397         (NotPromise):
1398
1399 2017-08-30  Saam Barati  <sbarati@apple.com>
1400
1401         Unreviewed. Make test stop printing.
1402
1403         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
1404
1405 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
1406
1407         Unreviewed, rolling out r221327.
1408
1409         This change caused test262 failures.
1410
1411         Reverted changeset:
1412
1413         "[JSC] Use reifying system for "name" property of builtin
1414         JSFunction"
1415         https://bugs.webkit.org/show_bug.cgi?id=175260
1416         http://trac.webkit.org/changeset/221327
1417
1418 2017-08-30  Saam Barati  <sbarati@apple.com>
1419
1420         semicolon is being interpreted as an = in the LiteralParser
1421         https://bugs.webkit.org/show_bug.cgi?id=176114
1422
1423         Reviewed by Oliver Hunt.
1424
1425         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
1426         * stress/resources/literal-parser-test-case.js: Added.
1427
1428 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
1429
1430         [ESNext] Async iteration - Implement async iteration statement: for-await-of
1431         https://bugs.webkit.org/show_bug.cgi?id=166698
1432
1433         Reviewed by Yusuke Suzuki.
1434
1435         * stress/async-iteration-for-await-of-syntax.js: Added.
1436         (assert):
1437         (checkSyntax):
1438         (checkSyntaxError):
1439         (checkSimpleAsyncGeneratorSloppyMode):
1440         (checkSimpleAsyncGeneratorStrictMode):
1441         (checkNestedAsyncGenerators):
1442         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
1443         * stress/async-iteration-for-await-of.js: Added.
1444         (assert):
1445         (async.foo):
1446         (async.boo):
1447         (const.boo.async):
1448
1449 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1450
1451         [JSC] Use reifying system for "name" property of builtin JSFunction
1452         https://bugs.webkit.org/show_bug.cgi?id=175260
1453
1454         Reviewed by Saam Barati.
1455
1456         * stress/accessors-get-set-prefix.js:
1457         * stress/builtin-function-name.js: Added.
1458         (shouldBe):
1459         (shouldThrow):
1460         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1461         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1462
1463 2017-08-25  Saam Barati  <sbarati@apple.com>
1464
1465         Support compiling catch in the DFG
1466         https://bugs.webkit.org/show_bug.cgi?id=174590
1467         <rdar://problem/34047845>
1468
1469         Reviewed by Filip Pizlo.
1470
1471         * microbenchmarks/delta-blue-try-catch.js: Added.
1472         (exception):
1473         (value):
1474         (OrderedCollection):
1475         (OrderedCollection.prototype.add):
1476         (OrderedCollection.prototype.at):
1477         (OrderedCollection.prototype.size):
1478         (OrderedCollection.prototype.removeFirst):
1479         (OrderedCollection.prototype.remove):
1480         (Strength):
1481         (Strength.stronger):
1482         (Strength.weaker):
1483         (Strength.weakestOf):
1484         (Strength.strongest):
1485         (Strength.prototype.nextWeaker):
1486         (Constraint):
1487         (Constraint.prototype.addConstraint):
1488         (Constraint.prototype.satisfy):
1489         (Constraint.prototype.destroyConstraint):
1490         (Constraint.prototype.isInput):
1491         (UnaryConstraint):
1492         (UnaryConstraint.prototype.addToGraph):
1493         (UnaryConstraint.prototype.chooseMethod):
1494         (UnaryConstraint.prototype.isSatisfied):
1495         (UnaryConstraint.prototype.markInputs):
1496         (UnaryConstraint.prototype.output):
1497         (UnaryConstraint.prototype.recalculate):
1498         (UnaryConstraint.prototype.markUnsatisfied):
1499         (UnaryConstraint.prototype.inputsKnown):
1500         (UnaryConstraint.prototype.removeFromGraph):
1501         (StayConstraint):
1502         (StayConstraint.prototype.execute):
1503         (EditConstraint.prototype.isInput):
1504         (EditConstraint.prototype.execute):
1505         (BinaryConstraint):
1506         (BinaryConstraint.prototype.chooseMethod):
1507         (BinaryConstraint.prototype.addToGraph):
1508         (BinaryConstraint.prototype.isSatisfied):
1509         (BinaryConstraint.prototype.markInputs):
1510         (BinaryConstraint.prototype.input):
1511         (BinaryConstraint.prototype.output):
1512         (BinaryConstraint.prototype.recalculate):
1513         (BinaryConstraint.prototype.markUnsatisfied):
1514         (BinaryConstraint.prototype.inputsKnown):
1515         (BinaryConstraint.prototype.removeFromGraph):
1516         (ScaleConstraint):
1517         (ScaleConstraint.prototype.addToGraph):
1518         (ScaleConstraint.prototype.removeFromGraph):
1519         (ScaleConstraint.prototype.markInputs):
1520         (ScaleConstraint.prototype.execute):
1521         (ScaleConstraint.prototype.recalculate):
1522         (EqualityConstraint):
1523         (EqualityConstraint.prototype.execute):
1524         (Variable):
1525         (Variable.prototype.addConstraint):
1526         (Variable.prototype.removeConstraint):
1527         (Planner):
1528         (Planner.prototype.incrementalAdd):
1529         (Planner.prototype.incrementalRemove):
1530         (Planner.prototype.newMark):
1531         (Planner.prototype.makePlan):
1532         (Planner.prototype.extractPlanFromConstraints):
1533         (Planner.prototype.addPropagate):
1534         (Planner.prototype.removePropagateFrom):
1535         (Planner.prototype.addConstraintsConsumingTo):
1536         (Plan):
1537         (Plan.prototype.addConstraint):
1538         (Plan.prototype.size):
1539         (Plan.prototype.constraintAt):
1540         (Plan.prototype.execute):
1541         (chainTest):
1542         (projectionTest):
1543         (change):
1544         (deltaBlue):
1545         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
1546         (assert):
1547         (Numbers):
1548         (Numbers.prototype.next):
1549         (return.Transpose):
1550         (return.Transpose.prototype.next):
1551         (transpose):
1552         (verifyEven):
1553         (verifyString):
1554         (foo):
1555         (runIterators):
1556         * microbenchmarks/try-catch-word-count.js: Added.
1557         (let.assert):
1558         (EOF):
1559         (let.texts):
1560         (let.o.apply):
1561         (foo):
1562         (bar):
1563         (f):
1564         (run):
1565         (test1):
1566         (test2):
1567         (test3):
1568         (fn):
1569         (A):
1570         (B):
1571         (A.prototype.getValue):
1572         (B.prototype.getParentValue):
1573         (strlen):
1574         (sum.0):
1575         (test):
1576         (result.test.o):
1577         (set add.set add):
1578         (set forEach):
1579         (stringHash):
1580         (set if):
1581         (testFunction):
1582         (set delete.set has.set add):
1583         * stress/catch-set-argument-speculation-failure.js: Added.
1584         (o):
1585         (e):
1586         (e2):
1587         (escape):
1588         (baz):
1589         (noInline.run):
1590         (noInline):
1591         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
1592         (foo):
1593         (e):
1594         (baz):
1595         (bar):
1596
1597 2017-08-24  Commit Queue  <commit-queue@webkit.org>
1598
1599         Unreviewed, rolling out r221119, r221124, and r221143.
1600         https://bugs.webkit.org/show_bug.cgi?id=175973
1601
1602         "I think it regressed JSBench by 20%" (Requested by saamyjoon
1603         on #webkit).
1604
1605         Reverted changesets:
1606
1607         "Support compiling catch in the DFG"
1608         https://bugs.webkit.org/show_bug.cgi?id=174590
1609         http://trac.webkit.org/changeset/221119
1610
1611         "Unreviewed, build fix in GTK port"
1612         https://bugs.webkit.org/show_bug.cgi?id=174590
1613         http://trac.webkit.org/changeset/221124
1614
1615         "DFG::JITCode::osrEntry should get sorted since we perform a
1616         binary search on it"
1617         https://bugs.webkit.org/show_bug.cgi?id=175893
1618         http://trac.webkit.org/changeset/221143
1619
1620 2017-08-24  Michael Saboff  <msaboff@apple.com>
1621
1622         Add support for RegExp "dotAll" flag
1623         https://bugs.webkit.org/show_bug.cgi?id=175924
1624
1625         Reviewed by Keith Miller.
1626
1627         Updated tests for new dotAll ('s' flag) changes.
1628
1629         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
1630         * stress/static-getter-in-names.js:
1631
1632 2017-08-24  Mark Lam  <mark.lam@apple.com>
1633
1634         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
1635         https://bugs.webkit.org/show_bug.cgi?id=175940
1636         <rdar://problem/29003921>
1637
1638         Reviewed by Saam Barati.
1639
1640         * stress/regress-164081.js: Added.
1641         (shouldEqual):
1642         (testcase):
1643
1644 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
1645
1646         Skip flaky JSC test stress/test-finally.js.
1647         https://bugs.webkit.org/show_bug.cgi?id=160283
1648
1649         Unreviewed test gardening.
1650
1651         * stress/test-finally.js:
1652
1653 2017-08-23  Saam Barati  <sbarati@apple.com>
1654
1655         Support compiling catch in the DFG
1656         https://bugs.webkit.org/show_bug.cgi?id=174590
1657
1658         Reviewed by Filip Pizlo.
1659
1660         * microbenchmarks/delta-blue-try-catch.js: Added.
1661         (exception):
1662         (value):
1663         (OrderedCollection):
1664         (OrderedCollection.prototype.add):
1665         (OrderedCollection.prototype.at):
1666         (OrderedCollection.prototype.size):
1667         (OrderedCollection.prototype.removeFirst):
1668         (OrderedCollection.prototype.remove):
1669         (Strength):
1670         (Strength.stronger):
1671         (Strength.weaker):
1672         (Strength.weakestOf):
1673         (Strength.strongest):
1674         (Strength.prototype.nextWeaker):
1675         (Constraint):
1676         (Constraint.prototype.addConstraint):
1677         (Constraint.prototype.satisfy):
1678         (Constraint.prototype.destroyConstraint):
1679         (Constraint.prototype.isInput):
1680         (UnaryConstraint):
1681         (UnaryConstraint.prototype.addToGraph):
1682         (UnaryConstraint.prototype.chooseMethod):
1683         (UnaryConstraint.prototype.isSatisfied):
1684         (UnaryConstraint.prototype.markInputs):
1685         (UnaryConstraint.prototype.output):
1686         (UnaryConstraint.prototype.recalculate):
1687         (UnaryConstraint.prototype.markUnsatisfied):
1688         (UnaryConstraint.prototype.inputsKnown):
1689         (UnaryConstraint.prototype.removeFromGraph):
1690         (StayConstraint):
1691         (StayConstraint.prototype.execute):
1692         (EditConstraint.prototype.isInput):
1693         (EditConstraint.prototype.execute):
1694         (BinaryConstraint):
1695         (BinaryConstraint.prototype.chooseMethod):
1696         (BinaryConstraint.prototype.addToGraph):
1697         (BinaryConstraint.prototype.isSatisfied):
1698         (BinaryConstraint.prototype.markInputs):
1699         (BinaryConstraint.prototype.input):
1700         (BinaryConstraint.prototype.output):
1701         (BinaryConstraint.prototype.recalculate):
1702         (BinaryConstraint.prototype.markUnsatisfied):
1703         (BinaryConstraint.prototype.inputsKnown):
1704         (BinaryConstraint.prototype.removeFromGraph):
1705         (ScaleConstraint):
1706         (ScaleConstraint.prototype.addToGraph):
1707         (ScaleConstraint.prototype.removeFromGraph):
1708         (ScaleConstraint.prototype.markInputs):
1709         (ScaleConstraint.prototype.execute):
1710         (ScaleConstraint.prototype.recalculate):
1711         (EqualityConstraint):
1712         (EqualityConstraint.prototype.execute):
1713         (Variable):
1714         (Variable.prototype.addConstraint):
1715         (Variable.prototype.removeConstraint):
1716         (Planner):
1717         (Planner.prototype.incrementalAdd):
1718         (Planner.prototype.incrementalRemove):
1719         (Planner.prototype.newMark):
1720         (Planner.prototype.makePlan):
1721         (Planner.prototype.extractPlanFromConstraints):
1722         (Planner.prototype.addPropagate):
1723         (Planner.prototype.removePropagateFrom):
1724         (Planner.prototype.addConstraintsConsumingTo):
1725         (Plan):
1726         (Plan.prototype.addConstraint):
1727         (Plan.prototype.size):
1728         (Plan.prototype.constraintAt):
1729         (Plan.prototype.execute):
1730         (chainTest):
1731         (projectionTest):
1732         (change):
1733         (deltaBlue):
1734         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
1735         (assert):
1736         (Numbers):
1737         (Numbers.prototype.next):
1738         (return.Transpose):
1739         (return.Transpose.prototype.next):
1740         (transpose):
1741         (verifyEven):
1742         (verifyString):
1743         (foo):
1744         (runIterators):
1745         * microbenchmarks/try-catch-word-count.js: Added.
1746         (let.assert):
1747         (EOF):
1748         (let.texts):
1749         (let.o.apply):
1750         (foo):
1751         (bar):
1752         (f):
1753         (run):
1754         (test1):
1755         (test2):
1756         (test3):
1757         (fn):
1758         (A):
1759         (B):
1760         (A.prototype.getValue):
1761         (B.prototype.getParentValue):
1762         (strlen):
1763         (sum.0):
1764         (test):
1765         (result.test.o):
1766         (set add.set add):
1767         (set forEach):
1768         (stringHash):
1769         (set if):
1770         (testFunction):
1771         (set delete.set has.set add):
1772         * stress/catch-set-argument-speculation-failure.js: Added.
1773         (o):
1774         (e):
1775         (e2):
1776         (escape):
1777         (baz):
1778         (noInline.run):
1779         (noInline):
1780         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
1781         (foo):
1782         (e):
1783         (baz):
1784         (bar):
1785
1786 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1787
1788         [JSC] Optimize Map iteration with intrinsic
1789         https://bugs.webkit.org/show_bug.cgi?id=174355
1790
1791         Reviewed by Saam Barati.
1792
1793         * stress/map-iterator-result-should-have-expected-shape.js: Added.
1794         (shouldBe):
1795         (throw.new.Error):
1796         * stress/set-iterator-result-should-have-expected-shape.js: Added.
1797         (shouldBe):
1798         (throw.new.Error.let.iterator.set Symbol):
1799         (throw.new.Error.set add):
1800         (let.iterator.set Symbol):
1801
1802 2017-08-23  Robin Morisset  <rmorisset@apple.com>
1803
1804         Add a micro-benchmark for checking that accessing a variable within a 'with'
1805         block does not automatically prevent type prediction.
1806         https://bugs.webkit.org/show_bug.cgi?id=175738
1807
1808         Reviewed by Saam Barati.
1809
1810         * stress/with_and_arith.js: Added.
1811         (with):
1812
1813 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
1814
1815         [ESNext] Async iteration - Implement Async Generator - runtime
1816         https://bugs.webkit.org/show_bug.cgi?id=175240
1817
1818         Reviewed by Yusuke Suzuki.
1819
1820         * stress/async-iteration-async-from-sync.js: Added.
1821         (assert):
1822         (const.Logger):
1823         (this.fullfilled):
1824         (this.fullfilledDone):
1825         (this.rejected):
1826         (this.catched):
1827         (this.isFinal):
1828         (_assertLogger):
1829         (const.assertLogger):
1830         (const.getPromise.promiseHolder.return.new.Promise):
1831         (foo):
1832         (async.boo):
1833         (bar):
1834         (async.baz):
1835         (async.goo):
1836         * stress/async-iteration-basic.js: Added.
1837         (assert):
1838         (const.Logger):
1839         (this.fullfilled):
1840         (this.fullfilledDone):
1841         (this.rejected):
1842         (this.catched):
1843         (this.isFinal):
1844         (_assertLogger):
1845         (const.assertLogger):
1846         (const.getPromise.promiseHolder.return.new.Promise):
1847         (async.generator):
1848         (iterator.next.then):
1849         (async.baz):
1850         (async.boo):
1851         (async.foo):
1852         (async.goo):
1853         (A.prototype.async.foo):
1854         (A.prototype.async.boo):
1855         (A):
1856         (asyncGenExp.async):
1857         (async.joo):
1858         (j.next.then):
1859         (then):
1860         (async.koo):
1861         (async.loo):
1862         (async.moo):
1863         (async.noo):
1864         (async.ooo):
1865         (async.roo):
1866         (async.poo):
1867         (async.soo):
1868         (async.too):
1869         * stress/async-iteration-evaluation.js: Added.
1870         (assert):
1871         (async.foo):
1872         (catch):
1873         * stress/async-iteration-syntax.js:
1874         * stress/async-iteration-yield-promise.js: Added.
1875         (assert):
1876         (const.Logger):
1877         (this.fullfilled):
1878         (this.fullfilledDone):
1879         (this.rejected):
1880         (this.catched):
1881         (this.isFinal):
1882         (_assertLogger):
1883         (const.assertLogger):
1884         (const.getPromise.promiseHolder.return.new.Promise):
1885         (async.foo):
1886         (async.boo):
1887         (async.bar):
1888         * stress/async-iteration-yield-star-interface.js: Added.
1889         (assert):
1890         (const.getPromise.promiseHolder.return.new.Promise):
1891         (const.Logger):
1892         (this.fullfilled):
1893         (this.fullfilledDone):
1894         (this.rejected):
1895         (this.catched):
1896         (this.custom):
1897         (this.isFinal):
1898         (_assertLogger):
1899         (const.assertLogger):
1900         (let.asyncIter.Symbol.asyncIterator):
1901         (let.asyncIter.next):
1902         (let.asyncIter.throw):
1903         (let.asyncIter.return):
1904         (async.foo):
1905         (asyncIter.Symbol.asyncIterator):
1906         (asyncIter.next):
1907         (async.boo):
1908         (asyncIter.return):
1909         (async.bar):
1910         (async.baz):
1911         (async.foobar):
1912         * stress/async-iteration-yield-star.js: Added.
1913         (assert):
1914         (const.Logger):
1915         (this.fullfilled):
1916         (this.fullfilledDone):
1917         (this.rejected):
1918         (this.catched):
1919         (this.custom):
1920         (this.isFinal):
1921         (_assertLogger):
1922         (const.assertLogger):
1923         (const.getPromise.promiseHolder.return.new.Promise):
1924         (async.foo):
1925         (async.boo):
1926         (async.bar):
1927         (async.baz):
1928         (async.joo):
1929         (async.goo):
1930         (async.koo):
1931         (async.loo):
1932         (let.asyncIter.Symbol.asyncIterator):
1933         (let.asyncIter.next):
1934         (let.asyncIter.throw):
1935         (let.asyncIter.return):
1936         (async.moo):
1937         (async.noo):
1938         * test262.yaml:
1939
1940 2017-08-23  JF Bastien  <jfbastien@apple.com>
1941
1942         Fix printing in test
1943
1944         Unreviewed: fixing verbosity, shouldn't have been there.
1945
1946         * wasm/regress/175693.js:
1947         (else.else):
1948         (catch):
1949
1950 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
1951
1952         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
1953         https://bugs.webkit.org/show_bug.cgi?id=172543
1954
1955         Unreviewed test gardening.
1956
1957         * microbenchmarks/generator-with-several-types.js:
1958
1959 2017-08-17  JF Bastien  <jfbastien@apple.com>
1960
1961         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
1962         https://bugs.webkit.org/show_bug.cgi?id=175693
1963         <rdar://problem/33952443>
1964
1965         Reviewed by Saam Barati.
1966
1967         Add a regression directory for WebAssembly tests.
1968
1969         * wasm.yaml:
1970         * wasm/regress/175693.js: Added.
1971         (else.else):
1972         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
1973         (catch):
1974         * wasm/regress/175693.wasm: Added.
1975
1976 2017-08-15  Robin Morisset  <rmorisset@apple.com>
1977
1978         Support the 'with' keyword in FTL.
1979         https://bugs.webkit.org/show_bug.cgi?id=175585
1980
1981         Reviewed by Saam Barati.
1982
1983         Also improve the JSTest/stress/with.js file to test
1984         what happens when non-objects are passed to with.
1985
1986         * stress/with.js:
1987         (foo):
1988         (i.catch):
1989         (i.with): Deleted.
1990
1991 2017-08-14  Keith Miller  <keith_miller@apple.com>
1992
1993         Add testing tool to lie to the DFG about profiles
1994         https://bugs.webkit.org/show_bug.cgi?id=175487
1995
1996         Reviewed by Saam Barati.
1997
1998         * stress/compare-eq-incomplete-profile.js: Added.
1999         (const.test.createBuiltin):
2000
2001 2017-08-14  Robin Morisset  <rmorisset@apple.com>
2002
2003         Support the with keyword in DFG
2004         https://bugs.webkit.org/show_bug.cgi?id=175470
2005
2006         Reviewed by Saam Barati.
2007
2008         Added a new stress-test for the 'with' keyword, that caught a bug in a
2009         previous version of this code.
2010
2011         * stress/with.js: Added.
2012         (i.with):
2013
2014 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
2015
2016         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
2017         https://bugs.webkit.org/show_bug.cgi?id=175544
2018
2019         Unreviewed test gardening.
2020
2021         * ChakraCore.yaml:
2022
2023 2017-08-09  Caitlin Potter  <caitp@igalia.com>
2024
2025         Early error on ANY operator before new.target
2026         https://bugs.webkit.org/show_bug.cgi?id=157970
2027
2028         Reviewed by Saam Barati.
2029
2030         Instead of throwing if any unary operator precedes new.target, only
2031         throw if the unary operator updates the reference.
2032
2033         The following become legal in JSC:
2034
2035         ```
2036         !new.target
2037         ~new.target
2038         typeof new.target
2039         delete new.target
2040         void new.target
2041         ```
2042
2043         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
2044
2045         * stress/new-target-syntax-errors.js:
2046         * stress/new-target.js:
2047
2048 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
2049
2050         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
2051         https://bugs.webkit.org/show_bug.cgi?id=175255
2052
2053         Unreviewed test gardening.
2054
2055         * stress/regress-169783.js:
2056         * wasm/stress/oom.js:
2057
2058 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2059
2060         REGRESSION: 2 test262/test/language/statements/async-function failures
2061         https://bugs.webkit.org/show_bug.cgi?id=175334
2062
2063         Reviewed by Yusuke Suzuki.
2064
2065         Add @skip parameters to tests, and remove test for async iterator from 
2066         async await syntax test because it is already covered by async-iterator-syntax.js
2067
2068         * stress/async-await-syntax.js:
2069         * stress/async-iteration-syntax.js:
2070
2071 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2072
2073         Unreviewed, gardening test262 for Promise resolve / reject function length
2074         https://bugs.webkit.org/show_bug.cgi?id=175333
2075
2076         * test262.yaml:
2077
2078 2017-08-07  Robin Morisset  <rmorisset@apple.com>
2079
2080         GetOwnProperty of TypedArray indexed fields is wrongly configurable
2081         https://bugs.webkit.org/show_bug.cgi?id=175307
2082
2083         Reviewed by Saam Barati.
2084
2085         * stress/typedarray-getownproperty-not-configurable.js: Added.
2086         (assert):
2087         (foo):
2088
2089 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2090
2091         Promise resolve and reject function should have length = 1
2092         https://bugs.webkit.org/show_bug.cgi?id=175242
2093
2094         Reviewed by Saam Barati.
2095
2096         * stress/builtin-function-length.js: Added.
2097         (shouldBe):
2098         (shouldThrow):
2099         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2100         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2101
2102 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2103
2104         [ESNext] Async iteration - Implement Async Generator - parser
2105         https://bugs.webkit.org/show_bug.cgi?id=175210
2106
2107         Reviewed by Yusuke Suzuki.
2108
2109         * stress/async-await-syntax.js:
2110         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2111         * stress/async-iteration-syntax.js: Added.
2112         (assert):
2113         (checkSyntax):
2114         (checkSyntaxError):
2115         (checkSimpleAsyncGeneratorSloppyMode):
2116         (checkSimpleAsyncGeneratorStrictMode):
2117         (checkNestedAsyncGenerators):
2118         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2119         * stress/generator-class-methods-syntax.js:
2120
2121 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2122
2123         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
2124         https://bugs.webkit.org/show_bug.cgi?id=175150
2125
2126         Unreviewed test gardening.
2127
2128         * wasm/js-api/test_memory_constructor.js:
2129
2130 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2131
2132         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
2133         https://bugs.webkit.org/show_bug.cgi?id=175100
2134
2135         Reviewed by Mark Lam.
2136
2137         The JSC test JSTests/wasm/stress/oom.js tries to use all the
2138         available memory until an out of memory exception happens.
2139
2140         The Linux kernel is more tuned for server workloads than for GUI
2141         responsiveness. When a process tries to use a lot of memory, Linux
2142         will do its best to serve the request. This usually translates to
2143         free physical RAM by writing to disk dirty pages and/or moving out
2144         less recently used pages to swap (disk storage).
2145         Meanwhile it does this, the system will become unresponsive and this
2146         leads to freezes that can last even some minutes on the worst cases.
2147
2148         Therefore, let's skip this test on Linux as it will cause more harm
2149         than good on the Linux bots or on the machines of Linux developers.
2150
2151         * wasm/stress/oom.js:
2152
2153 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2154
2155         [JSC] Remove unnecessary print from stress\promise-finally.js test
2156         https://bugs.webkit.org/show_bug.cgi?id=175015
2157
2158         Reviewed by Yusuke Suzuki.
2159
2160         * stress/promise-finally.js:
2161         (p.finally):
2162         (then):
2163
2164 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2165
2166         Unreviewed, update test262 results for optional catch binding
2167
2168         * test262.yaml:
2169
2170 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2171
2172         [JSC] Support optional catch binding
2173         https://bugs.webkit.org/show_bug.cgi?id=174981
2174
2175         Reviewed by Saam Barati.
2176
2177         * stress/optional-catch-binding-syntax.js: Added.
2178         (testSyntax):
2179         (testSyntaxError):
2180         (catch.catch):
2181         * stress/optional-catch-binding.js: Added.
2182         (shouldBe):
2183         (throwException):
2184
2185 2017-07-28  Mark Lam  <mark.lam@apple.com>
2186
2187         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
2188         https://bugs.webkit.org/show_bug.cgi?id=174948
2189         <rdar://problem/33495680>
2190
2191         Reviewed by Filip Pizlo.
2192
2193         * stress/regress-174948.js: Added.
2194
2195 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2196
2197         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
2198         https://bugs.webkit.org/show_bug.cgi?id=174900
2199
2200         Reviewed by Saam Barati.
2201
2202         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
2203         (sideEffect):
2204         (args):
2205         (test):
2206
2207 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2208
2209         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
2210         https://bugs.webkit.org/show_bug.cgi?id=171637
2211
2212         Reviewed by Darin Adler.
2213
2214         * stress/domjit-getter-complex-with-incorrect-object.js:
2215         (i.shouldThrow):
2216         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
2217         (shouldBe):
2218         (i.shouldThrow):
2219
2220 2017-07-26  JF Bastien  <jfbastien@apple.com>
2221
2222         WebAssembly: test throwing out of the start function
2223         https://bugs.webkit.org/show_bug.cgi?id=165714
2224         <rdar://problem/29760251>
2225
2226         Reviewed by Keith Miller.
2227
2228         * wasm/assert.js:
2229         * wasm/function-tests/trap-from-start.js: Added.
2230         (StartTraps):
2231         * wasm/function-tests/trap-from-start-async.js: Added.
2232         (async.StartTrapsAsync):
2233
2234 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2235
2236         [FTL] Arguments elimination is suppressed by unreachable blocks
2237         https://bugs.webkit.org/show_bug.cgi?id=174352
2238
2239         Reviewed by Filip Pizlo.
2240
2241         * stress/arguments-elimination-force-exit.js: Added.
2242         (shouldBe):
2243         (strict):
2244         (sloppy):
2245         * stress/arguments-elimination-throw.js: Added.
2246         (shouldBe):
2247         (shouldThrow):
2248         (sloppy):
2249         (isArguments):
2250
2251 2017-07-13  Mark Lam  <mark.lam@apple.com>
2252
2253         Add some additional test cases for bug 170896.
2254         https://bugs.webkit.org/show_bug.cgi?id=174491
2255
2256         Reviewed by Filip Pizlo.
2257
2258         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
2259         * stress/regress-170896-with-double-shape-profile.js: Added.
2260         (test):
2261         * stress/regress-170896-with-int32-shape-profile.js: Added.
2262         (test):
2263         * stress/regress-170896.js: Removed.
2264
2265 2017-07-13  Saam Barati  <sbarati@apple.com>
2266
2267         Missing exception check in JSObject::hasInstance
2268         https://bugs.webkit.org/show_bug.cgi?id=174455
2269         <rdar://problem/31384608>
2270
2271         Reviewed by Mark Lam.
2272
2273         * stress/has-instance-exception-check.js: Added.
2274         (assert):
2275         (let.getter.Object.getOwnPropertyDescriptor.get foo):
2276
2277 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
2278
2279         [ESnext] Implement Object Spread
2280         https://bugs.webkit.org/show_bug.cgi?id=167963
2281
2282         Reviewed by Saam Barati.
2283
2284         * stress/obj-rest-destructuring-order.js: Added.
2285         (assert):
2286         (o.get z):
2287         (o.get a):
2288         * stress/obj-spread-order.js: Added.
2289         (assert):
2290         (o.get z):
2291         (o.get a):
2292         * stress/object-spread.js: Added.
2293         (let.assert):
2294         (assert.sameValue):
2295         (let.o.get a):
2296         (let.obj.get c):
2297         (cthulhu.get x):
2298         (let.obj.set c):
2299         (calls.o.get z):
2300         (calls.o.get a):
2301         (try.let.obj.get foo):
2302         (get calls):
2303
2304 2017-07-12  Saam Barati  <sbarati@apple.com>
2305
2306         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
2307         https://bugs.webkit.org/show_bug.cgi?id=174411
2308         <rdar://problem/31696186>
2309
2310         Reviewed by Mark Lam.
2311
2312         * stress/generic-arguments-correct-delete-behavior.js: Added.
2313         (assert):
2314         (makeTest):
2315
2316 2017-07-07  Mark Lam  <mark.lam@apple.com>
2317
2318         \n\r is not the same as \r\n.
2319         https://bugs.webkit.org/show_bug.cgi?id=173053
2320
2321         Reviewed by Keith Miller.
2322
2323         * stress/regress-173053.js: Added.
2324         * stress/template-literal-line-terminators.js:
2325
2326 2017-07-06  Saam Barati  <sbarati@apple.com>
2327
2328         We are missing places where we invalidate the for-in context
2329         https://bugs.webkit.org/show_bug.cgi?id=174184
2330
2331         Reviewed by Geoffrey Garen.
2332
2333         * stress/for-in-invalidate-context-weird-assignments.js: Added.
2334         (assert):
2335         (test):
2336
2337 2017-07-05  Saam Barati  <sbarati@apple.com>
2338
2339         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
2340         https://bugs.webkit.org/show_bug.cgi?id=174188
2341         <rdar://problem/30581423>
2342
2343         Reviewed by Mark Lam.
2344
2345         * stress/new-array-having-a-bad-time-double.js: Added.
2346         (assert):
2347         (foo):
2348
2349 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2350
2351         WTF::StringImpl::copyChars segfaults when built with GCC 7
2352         https://bugs.webkit.org/show_bug.cgi?id=173407
2353
2354         Reviewed by Andreas Kling.
2355
2356         * stress/string-repeat-copy-chars-crash.js: Added.
2357         (shouldBe):
2358
2359 2017-07-03  Saam Barati  <sbarati@apple.com>
2360
2361         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
2362
2363         * stress/unshiftCountSlowCase-correct-postCapacity.js:
2364
2365 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2366
2367         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
2368
2369         It requires too much memory.
2370
2371         * stress/dont-reserve-huge-capacity-lexer.js:
2372
2373 2017-06-30  Michael Saboff  <msaboff@apple.com>
2374
2375         Skip a test on ARM64 platform since we run out of address space.
2376
2377         Rubber stamped by Saam Barati.
2378
2379         * stress/dont-reserve-huge-capacity-lexer.js:
2380
2381 2017-06-30  Michael Saboff  <msaboff@apple.com>
2382
2383         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
2384         https://bugs.webkit.org/show_bug.cgi?id=174044
2385
2386         Reviewed by Oliver Hunt.
2387
2388         New regression test.
2389
2390         * stress/regress-174044.js: Added.
2391         (test1):
2392         (test2):
2393
2394 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
2395
2396         RegExpCachedResult::setInput should reify left and right contexts
2397         https://bugs.webkit.org/show_bug.cgi?id=173818
2398
2399         Reviewed by Keith Miller.
2400
2401         * stress/right-left-context-invalidated-by-input.js: Added.
2402         (test.validateContexts):
2403         (test):
2404
2405 2017-06-29  Saam Barati  <sbarati@apple.com>
2406
2407         Calculating postCapacity in unshiftCountSlowCase is wrong
2408         https://bugs.webkit.org/show_bug.cgi?id=173992
2409         <rdar://problem/32283199>
2410
2411         Reviewed by Keith Miller.
2412
2413         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
2414         (temp):
2415
2416 2017-06-29  Commit Queue  <commit-queue@webkit.org>
2417
2418         Unreviewed, rolling out r218512.
2419         https://bugs.webkit.org/show_bug.cgi?id=173981
2420
2421         "It changes the behavior of the JS API's JSEvaluateScript
2422         which breaks TurboTax" (Requested by saamyjoon on #webkit).
2423
2424         Reverted changeset:
2425
2426         "test262: Completion values for control flow do not match the
2427         spec"
2428         https://bugs.webkit.org/show_bug.cgi?id=171265
2429         http://trac.webkit.org/changeset/218512
2430
2431 2017-06-27  JF Bastien  <jfbastien@apple.com>
2432
2433         WebAssembly: running out of executable memory should throw OoM
2434         https://bugs.webkit.org/show_bug.cgi?id=171537
2435         <rdar://problem/32963338>
2436
2437         Reviewed by Saam Barati.
2438
2439         * wasm.yaml:
2440         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
2441         (const.invoke):
2442         (failCount.0.catch):
2443         (failCount.0.module.undefined.catch):
2444         * wasm/lowExecutableMemory/exports-oom.js: Added.
2445         (const.type):
2446         (const.params):
2447         (const.randomProgram):
2448         (failCount.0.catch):
2449         (failCount.0.module.undefined.catch):
2450         * wasm/lowExecutableMemory/imports-oom.js: Added.
2451         (const.type):
2452         (const.params):
2453         (const.randomProgram):
2454         (f.imports.push):
2455         (failCount.0.catch):
2456         (failCount.0.module.undefined.catch):
2457
2458 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
2459
2460         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
2461         https://bugs.webkit.org/show_bug.cgi?id=167962
2462
2463         Reviewed by Saam Barati.
2464
2465         * stress/object-rest-deconstruct.js: Added.
2466         (let.assert):
2467         (let.assertPropDescriptor):
2468         (catch):
2469         (get 3):
2470         (foo):
2471         (let.src.get y):
2472         (let.src.set y):
2473         (let.gen):
2474
2475 2017-06-27  Saam Barati  <sbarati@apple.com>
2476
2477         Function constructor needs to follow the spec and validate parameters and body independently
2478         https://bugs.webkit.org/show_bug.cgi?id=173303
2479         <rdar://problem/32732526>
2480
2481         Reviewed by Keith Miller.
2482
2483         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
2484         * stress/function-constructor-semantics.js: Added.
2485         (assert):
2486         (hasSyntaxError):
2487         (foo):
2488         (async.foo):
2489         (testError):
2490         (testOK.toString):
2491         (toString):
2492
2493 2017-06-26  Saam Barati  <sbarati@apple.com>
2494
2495         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
2496         https://bugs.webkit.org/show_bug.cgi?id=173740
2497
2498         Reviewed by Mark Lam.
2499
2500         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
2501         (Array.prototype.Symbol.iterator):
2502
2503 2017-06-26  Saam Barati  <sbarati@apple.com>
2504
2505         Skip a test on 32-bit platforms since we run out of address space.
2506
2507         Rubber stamped by Mark Lam.
2508
2509         * stress/dont-reserve-huge-capacity-lexer.js:
2510
2511 2017-06-26  Saam Barati  <sbarati@apple.com>
2512
2513         Crash in JSC::Lexer<unsigned char>::setCode
2514         https://bugs.webkit.org/show_bug.cgi?id=172754
2515
2516         Reviewed by Mark Lam.
2517
2518         * stress/dont-reserve-huge-capacity-lexer.js: Added.
2519         (catch):
2520
2521 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
2522
2523         [JSC] Clean up Object.entries implementation
2524         https://bugs.webkit.org/show_bug.cgi?id=173759
2525
2526         Reviewed by Sam Weinig.
2527
2528         * microbenchmarks/object-entries.js: Added.
2529         (test):
2530
2531 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
2532
2533         Remove Reflect.enumerate
2534         https://bugs.webkit.org/show_bug.cgi?id=173806
2535
2536         Reviewed by Yusuke Suzuki.
2537
2538         * ChakraCore.yaml:
2539         * es6.yaml:
2540         These tests now fail because they use Reflect.enumerate.
2541
2542         * test262.yaml:
2543         This test now passes, it checked that Reflect.enumerate is undefined!
2544
2545         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
2546         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
2547
2548         * stress/reflect-enumerate.js: Removed.
2549         Remove a test solely for Reflect.enumerate.
2550
2551 2017-06-22  Saam Barati  <sbarati@apple.com>
2552
2553         ValueRep(DoubleRep(@v)) can not simply convert to @v
2554         https://bugs.webkit.org/show_bug.cgi?id=173687
2555         <rdar://problem/32855563>
2556
2557         Reviewed by Mark Lam.
2558
2559         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
2560         (i.catch):
2561
2562 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2563
2564         [JSC] Object.values should be implemented in C++
2565         https://bugs.webkit.org/show_bug.cgi?id=173703
2566
2567         Reviewed by Sam Weinig.
2568
2569         * microbenchmarks/object-keys-map-values.js: Added.
2570         (test):
2571         * microbenchmarks/object-values.js: Added.
2572         (test):
2573         * stress/object-values-changing-properties.js: Added.
2574         (shouldBe):
2575         (throw.new.Error.let.source.get x):
2576         (throw.new.Error):
2577         (shouldBe.let.handler.get order):
2578         (get let):
2579         (shouldBe.let.handler.get return):
2580         (let.handler.get order):
2581
2582 2017-06-21  Saam Barati  <sbarati@apple.com>
2583
2584         eval virtual call is incorrect in the baseline JIT
2585         https://bugs.webkit.org/show_bug.cgi?id=173587
2586         <rdar://problem/32867897>
2587
2588         Reviewed by Michael Saboff.
2589
2590         * stress/do-eval-virtual-call-correctly.js: Added.
2591         (assert):
2592         (f):
2593         (i.test):
2594         (catch):
2595
2596 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
2597
2598         Update test262 test expectations after r218581.
2599
2600         Unreviewed test gardening.
2601
2602         * test262.yaml:
2603
2604 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
2605
2606         Revert changes in bug#160417 about extending `null` not being a derived class
2607         https://bugs.webkit.org/show_bug.cgi?id=169293
2608
2609         Reviewed by Saam Barati.
2610
2611         * stress/class-derived-from-null.js:
2612         (assertThrow):
2613         (test1):
2614         (test2):
2615         (test3):
2616         (test4):
2617         (test5):
2618         (test6):
2619
2620 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2621
2622         [DFG] More ArrayIndexOf fixups for various types
2623         https://bugs.webkit.org/show_bug.cgi?id=173176
2624
2625         Reviewed by Saam Barati.
2626
2627         * stress/array-indexof-arraystorage.js: Added.
2628         (shouldBe):
2629         (indexOfInt32Other):
2630         (indexOfInt32Cell):
2631         (indexOfInt32Boolean):
2632         (indexOfDoubleOther):
2633         (indexOfDoubleCell):
2634         (indexOfDoubleBoolean):
2635         (indexOfInt32):
2636         (indexOfDouble):
2637         * stress/array-indexof-constant-folding.js: Added.
2638         (shouldBe):
2639         (indexOfInt32Other):
2640         (indexOfInt32Cell):
2641         (indexOfInt32Boolean):
2642         (indexOfDoubleOther):
2643         (indexOfDoubleCell):
2644         (indexOfDoubleBoolean):
2645         * stress/array-indexof-hole-and-other.js: Added.
2646         (shouldBe):
2647         (indexOf):
2648         * stress/array-indexof-other.js: Added.
2649         (shouldBe):
2650         (indexOfInt32):
2651         (indexOfDouble):
2652         (indexOfString):
2653         (indexOfObject):
2654         * stress/array-indexof-symbol.js: Added.
2655         (shouldBe):
2656         (indexOfInt32):
2657         (indexOfDouble):
2658         (indexOfString):
2659         (indexOfObject):
2660
2661 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
2662
2663         test262: Completion values for control flow do not match the spec
2664         https://bugs.webkit.org/show_bug.cgi?id=171265
2665
2666         Reviewed by Saam Barati.
2667
2668         * stress/completion-value.js:
2669         Condensed test for completion values in top level statements.
2670
2671         * stress/super-get-by-id.js:
2672         ClassDeclaration when evaled no longer produce values. Convert
2673         these to ClassExpressions so they produce the class value.
2674         
2675         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2676         This is a progression for currect spec behavior.
2677
2678         * mozilla/mozilla-tests.yaml:
2679         This test is now outdated, so mark it as failing for that reason.
2680
2681         * test262.yaml:
2682         Passing all "cptn" completion value tests.
2683
2684 2017-06-17  Keith Miller  <keith_miller@apple.com>
2685
2686         ArrayBuffer constructor needs to create subclass structures before its buffer
2687         https://bugs.webkit.org/show_bug.cgi?id=173510
2688
2689         Reviewed by Yusuke Suzuki.
2690
2691         * test262.yaml:
2692
2693 2017-06-17  Keith Miller  <keith_miller@apple.com>
2694
2695         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
2696         https://bugs.webkit.org/show_bug.cgi?id=173506
2697
2698         Reviewed by Ryosuke Niwa.
2699
2700         Re-baseline tests.
2701
2702         * ChakraCore/test/Function/apply3.baseline-jsc:
2703         * test262.yaml:
2704
2705 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2706
2707         [JSC] Add fast path for Object.assign
2708         https://bugs.webkit.org/show_bug.cgi?id=173416
2709
2710         Reviewed by Mark Lam.
2711
2712         * stress/object-assign-changing-properties.js: Added.
2713         (shouldBe):
2714         (throw.new.Error.let.source.get x):
2715         (throw.new.Error):
2716         (shouldBe.let.source.get x):
2717         (shouldBe.let.target.set x):
2718         (shouldBe.let.target.get x):
2719         * stress/object-assign-proxy.js: Added.
2720         (shouldBe):
2721         (throw.new.Error.let.handler.get order):
2722
2723 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
2724
2725         [JSC] Implement Object.assign in C++
2726         https://bugs.webkit.org/show_bug.cgi?id=173414
2727
2728         Reviewed by Saam Barati.
2729
2730         * stress/object-assign-string-first.js: Added.
2731         (shouldBe):
2732         (source.get Symbol):
2733         (source.get 1):
2734         (source.get cocoa):
2735
2736 2017-06-14  JF Bastien  <jfbastien@apple.com>
2737
2738         WebAssembly: remove empty test files
2739         https://bugs.webkit.org/show_bug.cgi?id=173382
2740
2741         Reviewed by Saam Barati.
2742
2743         The following files:
2744                 JSTests/wasm/function-tests/call-indirect-params.js
2745                 JSTests/wasm/function-tests/call-indirect.js
2746                 JSTests/wasm/js-api/call-indirect-results.js
2747         Were changed to empty files in https://trac.webkit.org/changeset/209771
2748
2749         They were testing call_indirect with the wrong semantics, before
2750         we implemented tables. That change implemented tables and
2751         therefore removed the erroneous tests.
2752
2753         We have a few tests for call_indirect which already do the right thing:
2754                 JSTests/wasm/function-tests/context-switch.js
2755                 JSTests/wasm/function-tests/exceptions.js
2756                 JSTests/wasm/function-tests/grow-memory-2.js
2757                 JSTests/wasm/function-tests/stack-overflow.js
2758                 JSTests/wasm/function-tests/table-basic-2.js
2759                 JSTests/wasm/function-tests/table-basic.js
2760                 JSTests/wasm/js-api/call-indirect.js
2761                 JSTests/wasm/js-api/table.js
2762                 JSTests/wasm/js-api/unique-signature.js
2763                 JSTests/wasm/js-api/wrapper-function.js
2764
2765         I also just imported the updated spec tests which, among other
2766         things, test call_indirect:
2767                 core/br.wast
2768                 core/br_table.wast
2769                 core/call_indirect.wast
2770                 core/func.wast
2771                 core/func_ptrs.wast
2772                 core/imports.wast
2773                 core/left-to-right.wast
2774                 core/linking.wast
2775                 core/nop.wast
2776                 core/return.wast
2777                 core/typecheck.wast
2778                 core/unreachable.wast
2779
2780         So I think it's OK to just delete the tests which should just have
2781         been deleted back when tables were added.
2782
2783         * wasm/function-tests/call-indirect-params.js: Removed.
2784         * wasm/function-tests/call-indirect.js: Removed.
2785         * wasm/js-api/call-indirect-results.js: Removed.
2786
2787 2017-06-13  JF Bastien  <jfbastien@apple.com>
2788
2789         WebAssembly: import updated spec tests
2790         https://bugs.webkit.org/show_bug.cgi?id=173287
2791         <rdar://problem/32725975>
2792
2793         Reviewed by Saam Barati.
2794
2795         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
2796         with a few modifications so things work.
2797
2798         Fix a bunch of bugs found through this process, and punt a few tests (which I
2799         marked as blocked by this bug).
2800
2801         Fixes:
2802
2803         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
2804         instead of byte alignment. It was also missing memory-alignment.js despite it
2805         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
2806         pass.
2807
2808         Tables can be imported or in a section. There can be only one, but sections can
2809         be empty. An Elements section can exist if there's no Table, as long as it is
2810         also empty.
2811
2812         Memories can be imported or in a section. There can be only one, but sections
2813         can be empty. A Data section can exist if there's no Memory, as long as it is
2814         also empty.
2815
2816         Prototypes: stringify without .prototype. in the string.
2817
2818         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
2819         not a final size, and throws a RangeError on failure, not a TypeError.
2820
2821         Fix compile / instantiate so the reject the promise if given an argument of the
2822         wrong type (instead of failing instantly).
2823
2824         Fix async on neuter test.
2825
2826         Element section shouldn't affect any Table if any of the elements are out of
2827         bounds. We need to process it in two passes.
2828
2829         Segment section shouldn't affect any Data if any of the segments are out of
2830         bounds. We need to process it in two passes.
2831
2832         Empty data segments are valid, but only when there is no memory. Their index
2833         still gets validated, and has to be zero.
2834
2835         Punts:
2836
2837         Error messages with context, the test seems overly restrictive but this is
2838         minor.
2839
2840         compile/instantiate/validate property descriptors.
2841
2842         UTF-8 bugs.
2843
2844         Temporarily disable NaN tests. We need to go back and implement the following
2845         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
2846         much as getting all the other tests passing.
2847
2848         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
2849         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
2850         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
2851         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
2852         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
2853         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
2854         why they're not allowed.
2855
2856         * wasm.yaml:
2857         * wasm/function-tests/i32-load8-s.js:
2858         * wasm/function-tests/memory-access-past-4gib.js:
2859         (const.op.of.WASM.opcodes):
2860         * wasm/function-tests/memory-alignment.js: Added.
2861         (const.op.of.WASM.opcodes):
2862         * wasm/function-tests/memory-section-and-import.js:
2863         * wasm/js-api/Module-compile.js:
2864         (async.testPromiseAPI):
2865         * wasm/js-api/dont-mmap-zero-byte-memory.js:
2866         (testMems):
2867         * wasm/js-api/element.js:
2868         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2869         * wasm/js-api/neutered-inputs.js:
2870         (const.testFunction): Deleted.
2871         (const.testConstructor): Deleted.
2872         * wasm/js-api/table.js:
2873         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2874         (new.WebAssembly.Module):
2875         (assert.throws):
2876         (assertBadTableImport):
2877         (assert.throws.WebAssembly.Table.prototype.grow):
2878         (assertBadTableInstance): Deleted.
2879         * wasm/js-api/test_Data.js:
2880         (DataSectionWithoutMemory):
2881         * wasm/spec-harness/index.js:
2882         (module):
2883         (uniqueTest): Deleted.
2884         (assert_invalid): Deleted.
2885         (assert_soft_invalid): Deleted.
2886         (register): Deleted.
2887         (call): Deleted.
2888         (get instance): Deleted.
2889         (exports): Deleted.
2890         (run): Deleted.
2891         (assert_unlinkable): Deleted.
2892         (assert_uninstantiable): Deleted.
2893         (assert_trap): Deleted.
2894         (try.f): Deleted.
2895         (catch): Deleted.
2896         (assert_exhaustion): Deleted.
2897         (assert_return): Deleted.
2898         (assert_return_nan): Deleted.
2899         * wasm/spec-harness/testharness.css: Removed.
2900         * wasm/spec-harness/testharness.js: Removed.
2901         * wasm/spec-harness/testharnessreport.js: Removed.
2902         * wasm/spec-harness/wasm-constants.js:
2903         (assertTraps):
2904         (assertWasmThrows):
2905         * wasm/spec-harness/wasm-module-builder.js:
2906         (Binary.prototype.emit_section):
2907         (Binary):
2908         (WasmFunctionBuilder.prototype.addBody):
2909         (WasmFunctionBuilder.prototype.end):
2910         (WasmFunctionBuilder):
2911         (WasmModuleBuilder.prototype.stringToBytes):
2912         (WasmModuleBuilder.prototype.addCustomSection):
2913         (WasmModuleBuilder.prototype.addFunctionTableInit):
2914         (WasmModuleBuilder.prototype.appendToTable):
2915         (WasmModuleBuilder.prototype.toArray):
2916         (WasmModuleBuilder.prototype.toBuffer):
2917         (WasmModuleBuilder.prototype.instantiate):
2918         (WasmModuleBuilder):
2919         * wasm/spec-tests/address.wast.js:
2920         * wasm/spec-tests/align.wast.js: Added.
2921         * wasm/spec-tests/binary.wast.js:
2922         * wasm/spec-tests/block.wast.js:
2923         * wasm/spec-tests/br.wast.js:
2924         * wasm/spec-tests/br_if.wast.js:
2925         * wasm/spec-tests/br_table.wast.js:
2926         * wasm/spec-tests/call.wast.js:
2927         * wasm/spec-tests/call_indirect.wast.js:
2928         * wasm/spec-tests/comments.wast.js:
2929         * wasm/spec-tests/const.wast.js: Added.
2930         * wasm/spec-tests/conversions.wast.js: Added.
2931         * wasm/spec-tests/custom_section.wast.js:
2932         * wasm/spec-tests/exports.wast.js:
2933         * wasm/spec-tests/f32.wast.js: Added.
2934         * wasm/spec-tests/f64.wast.js: Added.
2935         * wasm/spec-tests/fac.wast.js:
2936         * wasm/spec-tests/float_exprs.wast.js: Added.
2937         * wasm/spec-tests/float_misc.wast.js: Added.
2938         * wasm/spec-tests/func.wast.js:
2939         * wasm/spec-tests/globals.wast.js:
2940         * wasm/spec-tests/if.wast.js:
2941         * wasm/spec-tests/imports.wast.js:
2942         * wasm/spec-tests/inline-module.wast.js: Added.
2943         * wasm/spec-tests/jsapi.js:
2944         (testJSAPI.test):
2945         (testJSAPI):
2946         * wasm/spec-tests/labels.wast.js:
2947         * wasm/spec-tests/loop.wast.js:
2948         * wasm/spec-tests/memory.wast.js:
2949         * wasm/spec-tests/memory_trap.wast.js: Added.
2950         * wasm/spec-tests/names.wast.js:
2951         * wasm/spec-tests/nop.wast.js:
2952         * wasm/spec-tests/return.wast.js:
2953         * wasm/spec-tests/stack.wast.js:
2954         * wasm/spec-tests/token.wast.js: Added.
2955         * wasm/spec-tests/type.wast.js: Added.
2956         * wasm/spec-tests/typecheck.wast.js:
2957         * wasm/spec-tests/unreachable.wast.js:
2958         * wasm/spec-tests/unreached-invalid.wast.js:
2959         * wasm/spec-tests/unwind.wast.js:
2960         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
2961         * wasm/spec-tests/utf8-import-field.wast.js: Added.
2962         * wasm/spec-tests/utf8-import-module.wast.js: Added.
2963
2964 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
2965
2966         Unreviewed JSC test gardening.
2967
2968         * stress/check-string-ident.js:
2969         * stress/new-largeish-contiguous-array-with-size.js:
2970
2971 2017-06-13  Michael Saboff  <msaboff@apple.com>
2972
2973         DFG doesn't properly handle a property that is change to read only in a prototype
2974         https://bugs.webkit.org/show_bug.cgi?id=173321
2975
2976         Reviewed by Filip Pizlo.
2977
2978         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
2979         * stress/regress-173321.js: Added new regression test.
2980         (shouldBe):
2981         (SimpleObject):
2982         (test):
2983
2984 2017-06-12  Saam Barati  <sbarati@apple.com>
2985
2986         Update test262 test expectation since r218082 makes new tests pass.
2987
2988         * test262.yaml:
2989
2990 2017-06-12  Saam Barati  <sbarati@apple.com>
2991
2992         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
2993         https://bugs.webkit.org/show_bug.cgi?id=172957
2994         <rdar://problem/32602704>
2995
2996         Reviewed by Filip Pizlo.
2997
2998         * stress/spec-empty-flows-through-cell-checks.js: Added.
2999         (A):
3000         (B):
3001         (i.catch):
3002
3003 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
3004
3005         We incorrectly allow escaped characters in keyword tokens
3006         https://bugs.webkit.org/show_bug.cgi?id=171310
3007
3008         Reviewed by Yusuke Suzuki.
3009
3010         * stress/destructuring-assignment-syntax.js:
3011         * stress/error-messages-for-in-operator-should-not-crash.js:
3012         (catch):
3013         * stress/reserved-word-with-escape.js:
3014         (testSyntaxError.String.raw.v):
3015         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
3016         (testSyntaxError.String.raw.a):
3017         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
3018
3019 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3020
3021         [DFG] Add ArrayIndexOf intrinsic
3022         https://bugs.webkit.org/show_bug.cgi?id=172421
3023
3024         Reviewed by Saam Barati.
3025
3026         * stress/array-indexof-array-prototype-change.js: Added.
3027         (shouldBe):
3028         (indexOfInt32):
3029         * stress/array-indexof-have-a-bad-time-getter.js: Added.
3030         (shouldBe):
3031         (indexOfInt32):
3032         * stress/array-indexof-have-a-bad-time.js: Added.
3033         (shouldBe):
3034         (indexOfInt32):
3035         * stress/array-indexof-hole-with-prototype.js: Added.
3036         (shouldBe):
3037         (indexOf):
3038         * stress/array-indexof-hole.js: Added.
3039         (shouldBe):
3040         (indexOf):
3041         * stress/array-indexof-index.js: Added.
3042         (shouldBe):
3043         (indexOfInt32):
3044         (indexOfDouble):
3045         (indexOfString):
3046         (indexOfObject):
3047         (indexOfValue):
3048         * stress/array-indexof-negative-index.js: Added.
3049         (shouldBe):
3050         (indexOfInt32):
3051         (indexOfDouble):
3052         (indexOfString):
3053         (indexOfObject):
3054         (indexOfValue):
3055         * stress/array-indexof-non-int32-start-index.js: Added.
3056         (shouldBe):
3057         (indexOf):
3058         (object.valueOf):
3059         * stress/array-indexof-object-prototype-change.js: Added.
3060         (shouldBe):
3061         (indexOfInt32):
3062         * stress/array-indexof-object.js: Added.
3063         (shouldBe):
3064         (indexOf):
3065         * stress/array-indexof-original-array.js: Added.
3066         (shouldBe):
3067         (indexOfInt32):
3068         * stress/array-indexof-string.js: Added.
3069         (shouldBe):
3070         (indexOf):
3071         * stress/array-indexof-structure-change-convert.js: Added.
3072         (shouldBe):
3073         (indexOf):
3074         * stress/array-indexof-structure-change.js: Added.
3075         (shouldBe):
3076         (indexOf):
3077         * stress/array-indexof.js: Added.
3078         (shouldBe):
3079         (indexOf):
3080
3081 2017-06-11  Keith Miller  <keith_miller@apple.com>
3082
3083         TypedArray constructor with string shouldn't throw
3084         https://bugs.webkit.org/show_bug.cgi?id=173181
3085
3086         Reviewed by JF Bastien.
3087
3088         We should be coercing primitive arguments to numbers in the various
3089         TypedArray constructors.
3090
3091         * stress/typedarray-constructor.js:
3092
3093 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3094
3095         Unreviewed, update test results part 3
3096         https://bugs.webkit.org/show_bug.cgi?id=173227
3097
3098         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
3099
3100 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3101
3102         Unreviewed, update test results part 2
3103         https://bugs.webkit.org/show_bug.cgi?id=173227
3104
3105         * test262.yaml:
3106
3107 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3108
3109         Unreviewed, update test results
3110         https://bugs.webkit.org/show_bug.cgi?id=173227
3111
3112         * microbenchmarks/string-prototype-search-observable-side-effects.js:
3113         * test262.yaml:
3114
3115 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3116
3117         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
3118         https://bugs.webkit.org/show_bug.cgi?id=173227
3119
3120         Reviewed by Mark Lam.
3121
3122         Update the test.
3123
3124         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
3125
3126 2017-06-08  Keith Miller  <keith_miller@apple.com>
3127
3128         WebAssembly: We should only create wrappers for functions that can be exported
3129         https://bugs.webkit.org/show_bug.cgi?id=173088
3130
3131         Reviewed by Saam Barati.
3132
3133         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
3134         on the old testWasmModuleFunctions api, which has been removed.
3135
3136         * wasm/function-tests/copysign.js: Removed.
3137         * wasm/function-tests/ctz.js: Removed.
3138         * wasm/function-tests/drop.js: Removed.
3139         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
3140         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
3141         * wasm/function-tests/dumb-less-than-ite.js: Removed.
3142         * wasm/function-tests/eqz.js: Removed.
3143         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
3144         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
3145         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
3146         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
3147         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
3148         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
3149         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
3150         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
3151         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
3152         * wasm/function-tests/if-then-fallthrough.js: Removed.
3153         * wasm/function-tests/int-to-floating-point.js: Removed.
3154         * wasm/function-tests/loop-mult.js:
3155         * wasm/function-tests/loop-sum.js:
3156         * wasm/function-tests/max.js: Removed.
3157         * wasm/function-tests/min.js: Removed.
3158         * wasm/function-tests/nearest.js: Removed.
3159         * wasm/function-tests/nop.js: Removed.
3160         * wasm/function-tests/popcnt.js: Removed.
3161         * wasm/function-tests/ret5.js:
3162         * wasm/function-tests/select.js: Removed.
3163         * wasm/function-tests/tee-local.js: Removed.
3164         * wasm/function-tests/trunc.js: Removed.
3165
3166 2017-06-07  JF Bastien  <jfbastien@apple.com>
3167
3168         WebAssembly: test imports and exports with 16-bit characters
3169         https://bugs.webkit.org/show_bug.cgi?id=165977
3170         <rdar://problem/29760130>
3171
3172         Reviewed by Saam Barati.
3173
3174         The output for import failure was improved, so many tests need to
3175         be updated here. Only one has new tests as noted below.
3176
3177         * wasm/function-tests/memory-import-and-grow.js:
3178         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
3179         (idxModule):
3180         * wasm/js-api/global-error.js:
3181         (new.Number):
3182         (assert.throws):
3183         * wasm/js-api/table.js:
3184         (assert.throws):
3185         (new.WebAssembly.Table):
3186         * wasm/js-api/test_memory.js:
3187         (test):
3188         * wasm/js-api/wasm-to-wasm-bad-signature.js:
3189         (BadSignatureDropStartParams.):
3190         (BadSignatureDropStartParams):
3191         (BadSignatureDropEndParams.):
3192         (BadSignatureSwapParam.):
3193         (BadSignatureRet.):
3194         * wasm/js-api/web-assembly-instantiate.js:
3195         (assert.asyncTest.async.test):
3196         (assert.asyncTest):
3197         * wasm/js-api/wrapper-function.js:
3198         (return.new.WebAssembly.Module):
3199
3200 2017-06-07  Mark Lam  <mark.lam@apple.com>
3201
3202         Restrict the regress-173035.js test to only run on Darwin x86-64.
3203         https://bugs.webkit.org/show_bug.cgi?id=173075
3204
3205         Reviewed by Saam Barati.
3206
3207         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
3208         this test will require to succeed.  Here's an example of this failure:
3209         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
3210
3211         Since the issue is due to allocation of a very large amount of memory, the test
3212         will probably fail on iOS and other platforms as well.  Hence, we should just
3213         skip this test for any platforms that is not Darwin x86-64.
3214
3215         * stress/regress-173035.js:
3216
3217 2017-06-07  Mark Lam  <mark.lam@apple.com>
3218
3219         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
3220         https://bugs.webkit.org/show_bug.cgi?id=168587
3221
3222         Not reviewed.
3223
3224         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
3225
3226         * stress/test-finally.js:
3227
3228 2017-06-06  Mark Lam  <mark.lam@apple.com>
3229
3230         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
3231         https://bugs.webkit.org/show_bug.cgi?id=173035
3232         <rdar://problem/32554593>
3233
3234         Reviewed by Geoffrey Garen and Filip Pizlo.
3235
3236         * stress/regress-173035.js: Added.
3237
3238 2017-06-06  Saam Barati  <sbarati@apple.com>
3239
3240         Make sure we restore SP when doing calls that could be to JS
3241         https://bugs.webkit.org/show_bug.cgi?id=172946
3242         <rdar://problem/32579026>
3243
3244         Reviewed by JF Bastien.
3245
3246         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
3247         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
3248         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
3249         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
3250         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
3251
3252 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
3253
3254         Unreviewed rollout r217807. Caused a test to crash.
3255
3256         * heapProfiler/class-names.js: Removed.
3257         * heapProfiler/driver/driver.js:
3258         (CheapHeapSnapshotNode):
3259         (CheapHeapSnapshot):
3260         (createCheapHeapSnapshot):
3261         (HeapSnapshot):
3262         (createHeapSnapshot):
3263         * typeProfiler/inheritance.js:
3264         (wrapper.A):
3265         (wrapper.B):
3266         (wrapper.C):
3267         (wrapper):
3268
3269 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
3270
3271         index out of bound in bytecodebasicblock
3272         https://bugs.webkit.org/show_bug.cgi?id=172963
3273
3274         Reviewed by Saam Barati and Mark Lam.
3275
3276         * stress/dfg-call-class-constructor.js: Added.
3277         (Foo):
3278         (i.catch):
3279
3280 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
3281
3282         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
3283         https://bugs.webkit.org/show_bug.cgi?id=172848
3284         <rdar://problem/25709212>
3285
3286         Reviewed by Saam Barati.
3287
3288         * typeProfiler/inheritance.js:
3289         Rewrite the test slightly for clarity. The hoisting was confusing.
3290
3291         * heapProfiler/class-names.js: Added.
3292         (MyES5Class):
3293         (MyES6Class):
3294         (MyES6Subclass):
3295         Test object types and improved class names.
3296
3297         * heapProfiler/driver/driver.js:
3298         (CheapHeapSnapshotNode):
3299         (CheapHeapSnapshot):
3300         (createCheapHeapSnapshot):
3301         (HeapSnapshot):
3302         (createHeapSnapshot):
3303         Update snapshot parsing from version 1 to version 2.
3304
3305 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3306
3307         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
3308         https://bugs.webkit.org/show_bug.cgi?id=168844
3309
3310         Reviewed by Saam Barati.
3311
3312         * modules/async-function-export.js: Added.
3313         (f):
3314         (export.async.f):
3315
3316 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3317
3318         ES2015 modules - Export default function hoisting
3319         https://bugs.webkit.org/show_bug.cgi?id=170174
3320
3321         Reviewed by Saam Barati.
3322
3323         This issue itself is solved by fixing function declaration hoisting rules.
3324         This patch just adds the specific test to modules tests to ensure the bug
3325         is fixed.
3326
3327         * modules/export-default-function-hoisting.js: Added.
3328         * modules/export-default-function-hoisting/cappuccino.js: Added.
3329         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
3330         * modules/export-default-function-hoisting/cocoa.js: Added.
3331         (export.default.drinkCocoa):
3332
3333 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3334
3335         Class Proxy can't be extended
3336         https://bugs.webkit.org/show_bug.cgi?id=169040
3337
3338         Reviewed by Saam Barati.
3339
3340         Adding tests that check correctness of Proxy to ES6 `class`
3341         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
3342
3343         * stress/proxy-class.js: Added.
3344         (assert):
3345         (throw.new.Error.SuperClass):
3346         (throw.new.Error.A):
3347         (throw.new.Error):
3348
3349 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3350
3351         [JSC] Implement String.prototype.concat in JS builtins
3352         https://bugs.webkit.org/show_bug.cgi?id=172798
3353
3354         Reviewed by Sam Weinig.
3355
3356         * microbenchmarks/string-concat-convert.js: Added.
3357         (test):
3358         * microbenchmarks/string-concat-long-convert.js: Added.
3359         (test):
3360         * microbenchmarks/string-concat-long.js: Added.
3361         (test):
3362         * microbenchmarks/string-concat.js: Added.
3363         (test):
3364
3365 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
3366
3367         Rolling out: Prevent async methods named 'function'
3368         https://bugs.webkit.org/show_bug.cgi?id=172776
3369
3370         Reviewed by Mark Lam.
3371
3372         * stress/async-await-syntax.js:
3373         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3374         (testTopLevelAsyncAwaitSyntaxSloppyMode):
3375         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
3376         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
3377         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
3378
3379 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
3380
3381         Skip flaky JSC test stress/test-finally.js
3382         https://bugs.webkit.org/show_bug.cgi?id=168587
3383
3384         Unreviewed test gardening.
3385
3386         * stress/test-finally.js:
3387
3388 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3389
3390         Prevent async methods named 'function' in Object literal
3391         https://bugs.webkit.org/show_bug.cgi?id=172660
3392
3393         Reviewed by Saam Barati.
3394
3395         * stress/async-await-syntax.js:
3396         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
3397
3398 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3399
3400         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
3401         https://bugs.webkit.org/show_bug.cgi?id=171274
3402
3403         Reviewed by Saam Barati.
3404
3405         * stress/async-arrow-functions-lexical-binding-in-class.js:
3406         (shouldBeAsync):
3407         (shouldBeAsyncAndStoreBind):
3408         (promise.new.Promise):
3409         (ChildClass4):
3410         (ChildClass4.prototype.classValue):
3411         (ChildClass4.prototype.get classProperty):
3412         * stress/async-arrow-functions-lexical-super-binding.js:
3413         (A):
3414         (const.childA1.new.prototype.var.f.async):
3415         (const.childA1.new.var):
3416         (const.childA1.new):
3417         (const.childA2.new.prototype.var.f.async):
3418         (const.childA2.new.var):
3419         (const.childA2.new):
3420         (const.childA3.new.prototype.var.f.async):
3421         (const.childA3.new.var):
3422         (const.childA3.new):
3423         (try.childA4.new.prototype.var.f.async):
3424         (try.childA4.new.var):
3425         (try.childA4.new):
3426         (catch):
3427         (const.childA5.new.prototype.var.f.async):
3428         (const.childA5.new.var):
3429         (const.childA5.new):
3430         (checkClass):
3431         (checkClass.new.prototype.var.f.async):
3432         (checkClass.new.var):
3433         (checkClass.new):
3434         (checkClass.new.prototype.method):
3435         (checkClass.new.prototype.prop):
3436
3437 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3438
3439         [JSC] Map and Set constructors should have fast path for cloning
3440         https://bugs.webkit.org/show_bug.cgi?id=172413
3441
3442         Reviewed by Saam Barati.
3443
3444         * stress/map-clone-instance-iterator-change.js: Added.
3445         (shouldBe):
3446         (map.Symbol.iterator):
3447         * stress/map-clone-iterator-change.js: Added.
3448         (shouldBe):
3449         (Map.prototype.Symbol.iterator):
3450         * stress/map-clone-next-change.js: Added.
3451         (shouldBe):
3452         (map.Symbol.iterator.__proto__.next):
3453         * stress/map-clone.js: Added.
3454         (shouldBe):
3455         (Map.prototype):
3456         * stress/map-inherit-set.js: Added.
3457         (shouldBe):
3458         (DerivedMap):
3459         (set for):
3460         * stress/set-clone-instance-iterator-change.js: Added.
3461         (shouldBe):
3462         (set Symbol.iterator):
3463         * stress/set-clone-iterator-change.js: Added.
3464         (shouldBe):
3465         (set Set.prototype.Symbol.iterator):
3466         * stress/set-clone-next-change.js: Added.
3467         (shouldBe):
3468         (set Symbol.iterator.__proto__.next):
3469         * stress/set-clone.js: Added.
3470         (shouldBe):
3471         (set Set.prototype.add):
3472         * stress/set-inherit-add.js: Added.
3473         (shouldBe):
3474         (DerivedSet.set add):
3475
3476 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
3477
3478         Unreviewed, rolling out r217458.
3479
3480         This change caused 55 JSC test failures.
3481
3482         Reverted changeset:
3483
3484         "Date should use historical data if it's available."
3485         https://bugs.webkit.org/show_bug.cgi?id=172592
3486         http://trac.webkit.org/changeset/217458
3487
3488 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3489
3490         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
3491         https://bugs.webkit.org/show_bug.cgi?id=167805
3492
3493         Reviewed by Saam Barati.
3494
3495         * modules/module-jit-reachability.js: Added.
3496
3497 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
3498
3499         Prevent async methods named 'function'
3500         https://bugs.webkit.org/show_bug.cgi?id=172598
3501
3502         Reviewed by Mark Lam.
3503
3504         * stress/async-await-syntax.js:
3505         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3506         (testTopLevelAsyncAwaitSyntaxSloppyMode):
3507         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
3508         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
3509         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
3510
3511 2017-05-25  Keith Miller  <keith_miller@apple.com>
3512
3513         Date should use historical data if it's available.
3514         https://bugs.webkit.org/show_bug.cgi?id=172592
3515
3516         Reviewed by Mark Lam.
3517
3518         Remove parts of the date tests that rely on the absence of
3519         historical data in Date.
3520
3521         * mozilla/ecma/Date/15.9.5.31-1.js:
3522         (getTestCases):
3523         * mozilla/ecma/Date/15.9.5.35-1.js:
3524         (getTestCases):
3525
3526 2017-05-25  Saam Barati  <sbarati@apple.com>
3527
3528         Our for-in optimization in the bytecode generator does its static analysis incorrectly
3529         https://bugs.webkit.org/show_bug.cgi?id=172532
3530         <rdar://problem/32369452>
3531
3532         Reviewed by Mark Lam.
3533
3534         * stress/for-in-invalidation-for-any-write.js: Added.
3535         (assert):
3536         (test):
3537         (test.i):
3538
3539 2017-05-25  Mark Lam  <mark.lam@apple.com>
3540
3541         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
3542         https://bugs.webkit.org/show_bug.cgi?id=172548
3543         <rdar://problem/31458393>
3544
3545         Reviewed by Filip Pizlo.
3546
3547         * stress/regress-172548.patch: Added.
3548
3549 2017-05-23  Saam Barati  <sbarati@apple.com>
3550
3551         We should not mmap zero bytes for a memory in Wasm
3552         https://bugs.webkit.org/show_bug.cgi?id=172528
3553         <rdar://problem/32257076>
3554
3555         Reviewed by Mark Lam.
3556
3557         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
3558         (testMems):
3559
3560 2017-05-23  Saam Barati  <sbarati@apple.com>
3561
3562         CFGSimplificationPhase should not merge a block with itself
3563         https://bugs.webkit.org/show_bug.cgi?id=172508
3564         <rdar://problem/28424006>
3565
3566         Reviewed by Keith Miller.
3567
3568         * stress/dont-crash-in-cfg-simplification.js: Added.
3569         (bar):
3570         (baz):
3571         (foo):
3572
3573 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
3574
3575         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
3576         https://bugs.webkit.org/show_bug.cgi?id=172216
3577
3578         Reviewed by Saam Barati.
3579
3580         * stress/array-storage-get-by-val.js: Added.
3581         (shouldBe):
3582         (testOutOfBound):
3583         (testInBound):
3584         (testSlowPutOutOfBound):
3585         (testSlowPutInBound):
3586
3587 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3588
3589         Unreviewed, fix commented out tests
3590         https://bugs.webkit.org/show_bug.cgi?id=172225
3591
3592         * stress/get-by-val-string.js:
3593         (object.43):
3594         (Hello):
3595         (Hello.prototype.get 42):
3596         (Hello.prototype.43):
3597         (Derived):
3598         (shouldBe):
3599         (throw.new.Error): Deleted.
3600
3601 2017-05-21  Saam Barati  <sbarati@apple.com>
3602
3603         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
3604         https://bugs.webkit.org/show_bug.cgi?id=171041
3605         <rdar://problem/32082516>
3606
3607         Reviewed by Yusuke Suzuki.
3608
3609         * stress/lexical-scoping-for-loop.js: Added.
3610         (assert):
3611         (test1):
3612         (test2):
3613         (test3):
3614         (test4):
3615         (test5):
3616         (test6):
3617         (let.test7):
3618         (let.test8):
3619         (let.test9):
3620         (let.test10):
3621         (let.test11):
3622         (let.test12):
3623
3624 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
3625
3626         [JSC] Make get_by_val & string "499" to number 499
3627         https://bugs.webkit.org/show_bug.cgi?id=172225
3628
3629         Reviewed by Saam Barati.
3630
3631         * stress/get-by-val-string.js: Added.
3632         (shouldBe):
3633         (shouldThrow):
3634         (object.43):
3635         (Hello):
3636         (Hello.prototype.get 42):
3637         (Hello.prototype.43):
3638         (Derived):
3639
3640 2017-05-19  Mark Lam  <mark.lam@apple.com>
3641
3642         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
3643         https://bugs.webkit.org/show_bug.cgi?id=172383
3644         <rdar://problem/31418651>
3645
3646         Reviewed by Filip Pizlo.
3647
3648         * stress/regress-172383.js: Added.
3649
3650 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
3651
3652         Unreviewed, rolling out r217156.
3653
3654         This change broke the iOS build.
3655
3656         Reverted changeset:
3657
3658         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
3659         result registers."
3660         https://bugs.webkit.org/show_bug.cgi?id=172383
3661         http://trac.webkit.org/changeset/217156
3662
3663 2017-05-19  Mark Lam  <mark.lam@apple.com>
3664
3665         Add missing exception check.
3666         https://bugs.webkit.org/show_bug.cgi?id=172346
3667         <rdar://problem/32289640>
3668
3669         Reviewed by Geoffrey Garen.
3670
3671         * stress/regress-172346.js: Added.
3672
3673 2017-05-19  Mark Lam  <mark.lam@apple.com>
3674
3675         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
3676         https://bugs.webkit.org/show_bug.cgi?id=172383
3677         <rdar://problem/31418651>
3678
3679         Reviewed by Filip Pizlo.
3680
3681         * stress/regress-172383.js: Added.
3682
3683 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
3684
3685         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
3686         https://bugs.webkit.org/show_bug.cgi?id=172369
3687
3688         Reviewed by Mark Lam.
3689
3690         * stress/undecided-concat.js: Added.
3691
3692 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
3693
3694         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
3695         https://bugs.webkit.org/show_bug.cgi?id=172098
3696
3697         Reviewed by Saam Barati.
3698
3699         * stress/check-sub-class.js: Added.
3700         (shouldBe):
3701         (shouldThrow):
3702         (calling):
3703         (array.forEach):
3704         (i.array.forEach):
3705
3706 2017-05-18  JF Bastien  <jfbastien@apple.com>
3707
3708         WebAssembly: exports is a getter
3709         https://bugs.webkit.org/show_bug.cgi?id=172129
3710
3711         Reviewed by Saam Barati.
3712
3713         Update test to reflect new semantics.
3714
3715         * wasm/js-api/test_basic_api.js:
3716         (const.c.in.constructorProperties.switch):
3717
3718 2017-05-18  Saam Barati  <sbarati@apple.com>
3719
3720         Proxy's [[Get]] passes incorrect receiver
3721         https://bugs.webkit.org/show_bug.cgi?id=164849
3722         <rdar://problem/31767058>