AI does not correctly model the clobber case of ArithClz32
[WebKit-https.git] / JSTests / ChangeLog
1 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
2
3         AI does not correctly model the clobber case of ArithClz32
4         https://bugs.webkit.org/show_bug.cgi?id=179188
5
6         Reviewed by Michael Saboff.
7
8         * stress/arith-clz32-effects.js: Added.
9         (foo):
10         (valueOf):
11
12 2017-11-01  Michael Saboff  <msaboff@apple.com>
13
14         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
15         https://bugs.webkit.org/show_bug.cgi?id=179140
16
17         Reviewed by Saam Barati.
18
19         New regression test.
20
21         * stress/regress-179140.js: Added.
22         (testWithoutFTL):
23         (testWithFTL):
24
25 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
26
27         [JSC] Introduce @toObject
28         https://bugs.webkit.org/show_bug.cgi?id=178726
29
30         Reviewed by Saam Barati.
31
32         * stress/array-copywithin.js:
33         (shouldThrow):
34         * stress/object-constructor-boolean-edge.js: Added.
35         (shouldBe):
36         (test):
37         * stress/object-constructor-global.js: Added.
38         (shouldBe):
39         * stress/object-constructor-null-edge.js: Added.
40         (shouldBe):
41         (test):
42         * stress/object-constructor-number-edge.js: Added.
43         (shouldBe):
44         (test):
45         * stress/object-constructor-object-edge.js: Added.
46         (shouldBe):
47         (test):
48         (i.arg):
49         * stress/object-constructor-string-edge.js: Added.
50         (shouldBe):
51         (test):
52         * stress/object-constructor-symbol-edge.js: Added.
53         (shouldBe):
54         (test):
55         * stress/object-constructor-undefined-edge.js: Added.
56         (shouldBe):
57         (test):
58         * stress/symbol-array-from.js: Added.
59         (shouldBe):
60         * stress/to-object-intrinsic-boolean-edge.js: Added.
61         (shouldBe):
62         (builtin.createBuiltin):
63         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
64         (shouldThrow):
65         * stress/to-object-intrinsic-number-edge.js: Added.
66         (shouldBe):
67         (builtin.createBuiltin):
68         * stress/to-object-intrinsic-object-edge.js: Added.
69         (shouldBe):
70         (builtin.createBuiltin):
71         (i.arg):
72         * stress/to-object-intrinsic-string-edge.js: Added.
73         (shouldBe):
74         (builtin.createBuiltin):
75         * stress/to-object-intrinsic-symbol-edge.js: Added.
76         (shouldBe):
77         (builtin.createBuiltin):
78         * stress/to-object-intrinsic.js: Added.
79         (shouldBe):
80         (shouldThrow):
81         (builtin.createBuiltin):
82
83 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
84
85         [DFG][FTL] Introduce StringSlice
86         https://bugs.webkit.org/show_bug.cgi?id=178934
87
88         Reviewed by Saam Barati.
89
90         * microbenchmarks/string-slice-empty.js: Added.
91         (slice):
92         * microbenchmarks/string-slice-one-char.js: Added.
93         (slice):
94         * microbenchmarks/string-slice.js: Added.
95         (slice):
96
97 2017-10-26  Michael Saboff  <msaboff@apple.com>
98
99         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
100         https://bugs.webkit.org/show_bug.cgi?id=178890
101
102         Reviewed by Keith Miller.
103
104         New regression test.
105
106         * stress/regress-178890.js: Added.
107
108 2017-10-26  Mark Lam  <mark.lam@apple.com>
109
110         JSRopeString::RopeBuilder::append() should check for overflows.
111         https://bugs.webkit.org/show_bug.cgi?id=178385
112         <rdar://problem/35027468>
113
114         Reviewed by Saam Barati.
115
116         * stress/regress-178385.js: Added.
117
118 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
119
120         Unreviewed, rolling out r223961.
121
122         The change that required this has been rolled out.
123
124         Reverted changeset:
125
126         "Mark test262.yaml/test262/test/language/statements/try/tco-
127         catch.js as passing."
128         https://bugs.webkit.org/show_bug.cgi?id=178592
129         https://trac.webkit.org/changeset/223961
130
131 2017-10-25  Commit Queue  <commit-queue@webkit.org>
132
133         Unreviewed, rolling out r223691 and r223729.
134         https://bugs.webkit.org/show_bug.cgi?id=178834
135
136         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
137         by rniwa on #webkit).
138
139         Reverted changesets:
140
141         "Turn recursive tail calls into loops"
142         https://bugs.webkit.org/show_bug.cgi?id=176601
143         https://trac.webkit.org/changeset/223691
144
145         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
146         comparison is always false due to limited range of data type
147         [-Wtype-limits]"
148         https://bugs.webkit.org/show_bug.cgi?id=178543
149         https://trac.webkit.org/changeset/223729
150
151 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
152
153         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
154         https://bugs.webkit.org/show_bug.cgi?id=178592
155
156         Unreviewed test gardening.
157
158         * test262.yaml:
159
160 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
161
162         [FTL] Support NewStringObject
163         https://bugs.webkit.org/show_bug.cgi?id=178737
164
165         Reviewed by Saam Barati.
166
167         * stress/new-string-object.js: Added.
168         (shouldBe):
169         (test):
170
171 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
172
173         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
174         https://bugs.webkit.org/show_bug.cgi?id=178308
175
176         Reviewed by Mark Lam.
177
178         * test262.yaml:
179
180 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
181
182         [JSC] Use fastJoin in Array#toString
183         https://bugs.webkit.org/show_bug.cgi?id=178062
184
185         Reviewed by Darin Adler.
186
187         * microbenchmarks/contiguous-array-to-string.js: Added.
188         (target):
189         * microbenchmarks/double-array-to-string.js: Added.
190         (target):
191         * microbenchmarks/int32-array-to-string.js: Added.
192         (target):
193
194 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
195
196         stress/check-string-ident.js is improperly skipped
197         https://bugs.webkit.org/show_bug.cgi?id=178642
198
199         Reviewed by Saam Barati.
200
201         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
202         since it enforces the run-jsc-stress-tests script to still set up the
203         test to run, despite the skip directive that's used before.
204
205 2017-10-20  Mark Lam  <mark.lam@apple.com>
206
207         Add a test case for r214334.
208         https://bugs.webkit.org/show_bug.cgi?id=169941
209         <rdar://problem/31221258>
210
211         Reviewed by JF Bastien.
212
213         * stress/regress-169941.js: Added.
214
215 2017-10-19  JF Bastien  <jfbastien@apple.com>
216
217         WebAssembly: no VM / JS version of everything but Instance
218         https://bugs.webkit.org/show_bug.cgi?id=177473
219
220         Reviewed by Filip Pizlo, Saam Barati.
221
222         - Exceeding max on memory growth now returns a range error as per
223         spec. This is a (very minor) breaking change: it used to throw OOM
224         error. Update the corresponding test.
225
226         * wasm/js-api/memory-grow.js:
227         (assertEq):
228         * wasm/js-api/table.js:
229         (assert.throws):
230
231 2017-10-19  Mark Lam  <mark.lam@apple.com>
232
233         Stringifier::appendStringifiedValue() is missing an exception check.
234         https://bugs.webkit.org/show_bug.cgi?id=178386
235         <rdar://problem/35027610>
236
237         Reviewed by Saam Barati.
238
239         * stress/regress-178386.js: Added.
240
241 2017-10-19  Michael Saboff  <msaboff@apple.com>
242
243         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
244         https://bugs.webkit.org/show_bug.cgi?id=178521
245
246         Reviewed by JF Bastien.
247
248         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
249         now passes with the current version (5.0) of the Emoji spec.
250
251 2017-10-19  Robin Morisset  <rmorisset@apple.com>
252
253         Turn recursive tail calls into loops
254         https://bugs.webkit.org/show_bug.cgi?id=176601
255
256         Reviewed by Saam Barati.
257
258         Add some simple test that computes factorial in several ways, and other trivial computations.
259         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
260         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
261         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
262         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
263
264         * stress/inline-call-to-recursive-tail-call.js: Added.
265         (factorial.aux):
266         (factorial):
267         (factorial2.aux):
268         (factorial2.id):
269         (factorial2):
270         (factorial3.aux):
271         (factorial3):
272         (aux):
273         (factorial4):
274         (test):
275
276 2017-10-18  Mark Lam  <mark.lam@apple.com>
277
278         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
279         https://bugs.webkit.org/show_bug.cgi?id=177600
280         <rdar://problem/34710985>
281
282         Reviewed by Saam Barati.
283
284         * stress/regress-177600.js: Added.
285
286 2017-10-18  Mark Lam  <mark.lam@apple.com>
287
288         The compiler should always register a structure when it adds its transitionWatchPointSet.
289         https://bugs.webkit.org/show_bug.cgi?id=178420
290         <rdar://problem/34814024>
291
292         Reviewed by Saam Barati and Filip Pizlo.
293
294         * stress/regress-178420.js: Added.
295         (new.Array.10000.map):
296
297 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
298
299         [JSC] __proto__ getter should be fast
300         https://bugs.webkit.org/show_bug.cgi?id=178067
301
302         Reviewed by Saam Barati.
303
304         * stress/dfg-object-proto-accessor.js: Added.
305         (shouldBe):
306         (shouldThrow):
307         (target):
308         * stress/dfg-object-proto-getter.js: Added.
309         (shouldBe):
310         (shouldThrow):
311         (target):
312         * stress/dfg-object-prototype-of.js: Added.
313         (shouldBe):
314         (shouldThrow):
315         (target):
316         * stress/dfg-reflect-get-prototype-of.js: Added.
317         (shouldBe):
318         (shouldThrow):
319         (target):
320         * stress/intrinsic-getter-with-poly-proto.js: Added.
321         (shouldBe):
322         (makePolyProtoObject.foo.C):
323         (makePolyProtoObject.foo):
324         (makePolyProtoObject):
325         (target):
326         * stress/object-get-prototype-of-filtered.js: Added.
327         (shouldBe):
328         (shouldThrow):
329         (target):
330         (i.Cocoa):
331         * stress/object-get-prototype-of-mono-proto.js: Added.
332         (shouldBe):
333         (makePolyProtoObject.foo.C):
334         (makePolyProtoObject.foo):
335         (makePolyProtoObject):
336         (target):
337         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
338         (shouldBe):
339         (makePolyProtoObject.foo.C):
340         (makePolyProtoObject.foo):
341         (makePolyProtoObject):
342         (target):
343         * stress/object-get-prototype-of-poly-proto.js: Added.
344         (shouldBe):
345         (makePolyProtoObject.foo.C):
346         (makePolyProtoObject.foo):
347         (makePolyProtoObject):
348         (target):
349         * stress/object-proto-getter-filtered.js: Added.
350         (shouldBe):
351         (shouldThrow):
352         (target):
353         (i.Cocoa):
354         * stress/object-proto-getter-poly-mono-proto.js: Added.
355         (shouldBe):
356         (makePolyProtoObject.foo.C):
357         (makePolyProtoObject.foo):
358         (makePolyProtoObject):
359         (target):
360         * stress/object-proto-getter-poly-proto.js: Added.
361         (shouldBe):
362         (makePolyProtoObject.foo.C):
363         (makePolyProtoObject.foo):
364         (makePolyProtoObject):
365         (target):
366         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
367         * stress/string-proto.js: Added.
368         (shouldBe):
369         (target):
370
371 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
372
373         Unreviewed, rolling out r223523.
374
375         A test for this change is failing on debug JSC bots.
376
377         Reverted changeset:
378
379         "[JSC] __proto__ getter should be fast"
380         https://bugs.webkit.org/show_bug.cgi?id=178067
381         https://trac.webkit.org/changeset/223523
382
383 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
384
385         [JSC] __proto__ getter should be fast
386         https://bugs.webkit.org/show_bug.cgi?id=178067
387
388         Reviewed by Saam Barati.
389
390         * stress/dfg-object-proto-accessor.js: Added.
391         (shouldBe):
392         (shouldThrow):
393         (target):
394         * stress/dfg-object-proto-getter.js: Added.
395         (shouldBe):
396         (shouldThrow):
397         (target):
398         * stress/dfg-object-prototype-of.js: Added.
399         (shouldBe):
400         (shouldThrow):
401         (target):
402         * stress/dfg-reflect-get-prototype-of.js: Added.
403         (shouldBe):
404         (shouldThrow):
405         (target):
406         * stress/object-get-prototype-of-filtered.js: Added.
407         (shouldBe):
408         (shouldThrow):
409         (target):
410         (i.Cocoa):
411         * stress/object-get-prototype-of-mono-proto.js: Added.
412         (shouldBe):
413         (makePolyProtoObject.foo.C):
414         (makePolyProtoObject.foo):
415         (makePolyProtoObject):
416         (target):
417         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
418         (shouldBe):
419         (makePolyProtoObject.foo.C):
420         (makePolyProtoObject.foo):
421         (makePolyProtoObject):
422         (target):
423         * stress/object-get-prototype-of-poly-proto.js: Added.
424         (shouldBe):
425         (makePolyProtoObject.foo.C):
426         (makePolyProtoObject.foo):
427         (makePolyProtoObject):
428         (target):
429         * stress/object-proto-getter-filtered.js: Added.
430         (shouldBe):
431         (shouldThrow):
432         (target):
433         (i.Cocoa):
434         * stress/object-proto-getter-poly-mono-proto.js: Added.
435         (shouldBe):
436         (makePolyProtoObject.foo.C):
437         (makePolyProtoObject.foo):
438         (makePolyProtoObject):
439         (target):
440         * stress/object-proto-getter-poly-proto.js: Added.
441         (shouldBe):
442         (makePolyProtoObject.foo.C):
443         (makePolyProtoObject.foo):
444         (makePolyProtoObject):
445         (target):
446         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
447         * stress/string-proto.js: Added.
448         (shouldBe):
449         (target):
450
451 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
452
453         Reland "Add Above/Below comparisons for UInt32 patterns"
454         https://bugs.webkit.org/show_bug.cgi?id=177281
455
456         Reviewed by Saam Barati.
457
458         * stress/uint32-comparison-jump.js: Added.
459         (shouldBe):
460         (above):
461         (aboveOrEqual):
462         (below):
463         (belowOrEqual):
464         (notAbove):
465         (notAboveOrEqual):
466         (notBelow):
467         (notBelowOrEqual):
468         * stress/uint32-comparison.js: Added.
469         (shouldBe):
470         (above):
471         (aboveOrEqual):
472         (below):
473         (belowOrEqual):
474         (aboveTest):
475         (aboveOrEqualTest):
476         (belowTest):
477         (belowOrEqualTest):
478
479 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
480
481         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
482         https://bugs.webkit.org/show_bug.cgi?id=178210
483
484         Reviewed by Saam Barati.
485
486         * wasm/function-tests/trap-from-start-async.js:
487         (async.StartTrapsAsync):
488         * wasm/function-tests/trap-from-start.js:
489         (StartTraps):
490         * wasm/js-api/web-assembly-function.js:
491         (assert.eq.Object.getPrototypeOf):
492         * wasm/js-api/wrapper-function.js:
493         (return.new.WebAssembly.Module):
494         (assert.throws.makeInstance): Deleted.
495         (assert.throws.Bar): Deleted.
496         (assert.throws): Deleted.
497
498 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
499
500         Enable gigacage on iOS
501         https://bugs.webkit.org/show_bug.cgi?id=177586
502
503         Reviewed by JF Bastien.
504         
505         Add tests for when Gigacage gets runtime disabled.
506
507         * stress/disable-gigacage-arrays.js: Added.
508         (foo):
509         * stress/disable-gigacage-strings.js: Added.
510         (foo):
511         * stress/disable-gigacage-typed-arrays.js: Added.
512         (foo):
513
514 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
515
516         import.meta should not be assignable
517         https://bugs.webkit.org/show_bug.cgi?id=178202
518
519         Reviewed by Saam Barati.
520
521         * modules/import-meta-assignment.js: Added.
522         (shouldThrow):
523         (SyntaxError.import.meta.can.shouldThrow):
524
525 2017-10-11  Saam Barati  <sbarati@apple.com>
526
527         Unreviewed. Actually skip certain type profiler tests in debug.
528
529         * typeProfiler.yaml:
530         * typeProfiler/deltablue-for-of.js:
531         * typeProfiler/getter-richards.js:
532
533 2017-10-11  Commit Queue  <commit-queue@webkit.org>
534
535         Unreviewed, rolling out r223113 and r223121.
536         https://bugs.webkit.org/show_bug.cgi?id=178182
537
538         Reintroduced 20% regression on Kraken (Requested by rniwa on
539         #webkit).
540
541         Reverted changesets:
542
543         "Enable gigacage on iOS"
544         https://bugs.webkit.org/show_bug.cgi?id=177586
545         https://trac.webkit.org/changeset/223113
546
547         "Use one virtual allocation for all gigacages and their
548         runways"
549         https://bugs.webkit.org/show_bug.cgi?id=178050
550         https://trac.webkit.org/changeset/223121
551
552 2017-10-11  Michael Saboff  <msaboff@apple.com>
553
554         Disable test262 named capture group tests with direct unicode names and with references before definitions
555         https://bugs.webkit.org/show_bug.cgi?id=178177
556
557         Reviewed by Keith Miller.
558
559         Bugs to track fixing these test are:
560         https://bugs.webkit.org/show_bug.cgi?id=178174 -
561             "Add support in named capture group identifiers for direct surrogate pairs"
562         https://bugs.webkit.org/show_bug.cgi?id=178175 -
563             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
564
565         * test262.yaml:
566
567 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
568
569         Object properties are undefined in super.call() but not in this.call()
570         https://bugs.webkit.org/show_bug.cgi?id=177230
571
572         Reviewed by Saam Barati.
573
574         * stress/super-call-function-subclass.js: Added.
575         (assert):
576         (A.prototype.t):
577         (A):
578         * stress/super-dot-call-and-apply.js: Added.
579         (assert):
580         (A):
581         (A.prototype.call):
582         (A.prototype.apply):
583         (B.prototype.testSuper):
584         (B):
585         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
586         (D.prototype.testSuper):
587         (D):
588
589 2017-10-10  Saam Barati  <sbarati@apple.com>
590
591         The prototype cache should be aware of the Executable it generates a Structure for
592         https://bugs.webkit.org/show_bug.cgi?id=177907
593
594         Reviewed by Filip Pizlo.
595
596         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
597         (assert):
598         (foo.C):
599         (foo):
600         (bar.C):
601         (bar):
602         (access):
603         (makeLongChain):
604         (accessY):
605
606 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
607
608         `async` should be able to be used as an imported binding name
609         https://bugs.webkit.org/show_bug.cgi?id=176573
610
611         Reviewed by Saam Barati.
612
613         * modules/import-default-async.js: Added.
614         * modules/import-named-async-as.js: Added.
615         * modules/import-named-async.js: Added.
616         * modules/import-named-async/target.js: Added.
617         * modules/import-namespace-async.js: Added.
618         * test262.yaml:
619
620 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
621
622         Enable gigacage on iOS
623         https://bugs.webkit.org/show_bug.cgi?id=177586
624
625         Reviewed by JF Bastien.
626         
627         Add tests for when Gigacage gets runtime disabled.
628
629         * stress/disable-gigacage-arrays.js: Added.
630         (foo):
631         * stress/disable-gigacage-strings.js: Added.
632         (foo):
633         * stress/disable-gigacage-typed-arrays.js: Added.
634         (foo):
635
636 2017-10-09  Michael Saboff  <msaboff@apple.com>
637
638         Implement RegExp Unicode property escapes
639         https://bugs.webkit.org/show_bug.cgi?id=172069
640
641         Reviewed by JF Bastien.
642
643         Enabled Unicode Property tests.
644
645         * test262.yaml:
646
647 2017-10-09  Commit Queue  <commit-queue@webkit.org>
648
649         Unreviewed, rolling out r223015 and r223025.
650         https://bugs.webkit.org/show_bug.cgi?id=178093
651
652         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
653         #webkit).
654
655         Reverted changesets:
656
657         "Enable gigacage on iOS"
658         https://bugs.webkit.org/show_bug.cgi?id=177586
659         http://trac.webkit.org/changeset/223015
660
661         "Unreviewed, disable Gigacage on ARM64 Linux"
662         https://bugs.webkit.org/show_bug.cgi?id=177586
663         http://trac.webkit.org/changeset/223025
664
665 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
666
667         Update expectations for test262 tests that pass after r223043.
668         https://bugs.webkit.org/show_bug.cgi?id=176685
669
670         Unreviewed test gardening.
671
672         * test262.yaml:
673
674 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
675
676         Unreviewed, rolling out r223022.
677
678         This change introduced 18 test262 failures.
679
680         Reverted changeset:
681
682         "`async` should be able to be used as an imported binding
683         name"
684         https://bugs.webkit.org/show_bug.cgi?id=176573
685         http://trac.webkit.org/changeset/223022
686
687 2017-10-09  Saam Barati  <sbarati@apple.com>
688
689         3 poly-proto JSC tests timing out on debug after r222827
690         https://bugs.webkit.org/show_bug.cgi?id=177880
691         <rdar://problem/34817122>
692
693         Unreviewed.
694
695         I'm skipping these type profiler tests on debug since they are long running.
696
697         * typeProfiler/deltablue-for-of.js:
698         * typeProfiler/getter-richards.js:
699
700 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
701
702         Safari 10 /11 problem with if (!await get(something)).
703         https://bugs.webkit.org/show_bug.cgi?id=176685
704
705         Reviewed by Saam Barati.
706
707         * stress/async-await-basic.js:
708         (awaitEpression.async):
709         * stress/async-await-syntax.js:
710         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
711         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
712
713 2017-10-08  Saam Barati  <sbarati@apple.com>
714
715         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
716
717         * typeProfiler/deltablue-for-of.js:
718         * typeProfiler/getter-richards.js:
719
720 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
721
722         `async` should be able to be used as an imported binding name
723         https://bugs.webkit.org/show_bug.cgi?id=176573
724
725         Reviewed by Darin Adler.
726
727         * modules/import-default-async.js: Added.
728         * modules/import-named-async-as.js: Added.
729         * modules/import-named-async.js: Added.
730         * modules/import-named-async/target.js: Added.
731         * modules/import-namespace-async.js: Added.
732
733 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
734
735         Enable gigacage on iOS
736         https://bugs.webkit.org/show_bug.cgi?id=177586
737
738         Reviewed by JF Bastien.
739         
740         Add tests for when Gigacage gets runtime disabled.
741
742         * stress/disable-gigacage-arrays.js: Added.
743         (foo):
744         * stress/disable-gigacage-strings.js: Added.
745         (foo):
746         * stress/disable-gigacage-typed-arrays.js: Added.
747         (foo):
748
749 2017-10-06  Commit Queue  <commit-queue@webkit.org>
750
751         Unreviewed, rolling out r222791 and r222873.
752         https://bugs.webkit.org/show_bug.cgi?id=178031
753
754         Caused crashes with workers/wasm LayoutTests (Requested by
755         ryanhaddad on #webkit).
756
757         Reverted changesets:
758
759         "WebAssembly: no VM / JS version of everything but Instance"
760         https://bugs.webkit.org/show_bug.cgi?id=177473
761         http://trac.webkit.org/changeset/222791
762
763         "WebAssembly: address no VM / JS follow-ups"
764         https://bugs.webkit.org/show_bug.cgi?id=177887
765         http://trac.webkit.org/changeset/222873
766
767 2017-10-05  Saam Barati  <sbarati@apple.com>
768
769         Make sure all prototypes under poly proto get added into the VM's prototype map
770         https://bugs.webkit.org/show_bug.cgi?id=177909
771
772         Reviewed by Keith Miller.
773
774         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
775         (assert):
776         (foo.C):
777         (foo):
778         (set x):
779
780 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
781
782         [JSC] Introduce import.meta
783         https://bugs.webkit.org/show_bug.cgi?id=177703
784
785         Reviewed by Filip Pizlo.
786
787         * modules/import-meta-syntax.js: Added.
788         (shouldThrow):
789         (shouldNotThrow):
790         * modules/import-meta.js: Added.
791         * modules/import-meta/cocoa.js: Added.
792         * modules/resources/assert.js:
793         (export.shouldNotThrow):
794         * stress/import-syntax.js:
795
796 2017-10-04  Saam Barati  <sbarati@apple.com>
797
798         Make pertinent AccessCases watch the poly proto watchpoint
799         https://bugs.webkit.org/show_bug.cgi?id=177765
800
801         Reviewed by Keith Miller.
802
803         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
804         (assert):
805         (foo.C):
806         (foo):
807         (validate):
808         * stress/poly-proto-clear-stub.js: Added.
809         (assert):
810         (foo.C):
811         (foo):
812
813 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
814
815         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
816
817         Unreviewed test gardening.
818
819         * test262.yaml:
820
821 2017-10-04  Saam Barati  <sbarati@apple.com>
822
823         3 poly-proto JSC tests timing out on debug after r222827
824         https://bugs.webkit.org/show_bug.cgi?id=177880
825
826         Rubber stamped by Mark Lam.
827
828         * microbenchmarks/poly-proto-access.js:
829         * typeProfiler/deltablue-for-of.js:
830         * typeProfiler/getter-richards.js:
831
832 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
833
834         Unreviewed, marking tco-catch.js as a failure after test262 update
835         https://bugs.webkit.org/show_bug.cgi?id=177859
836
837         * test262.yaml:
838
839 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
840
841         Unreviewed, marking one async iterator test262 test failed
842         https://bugs.webkit.org/show_bug.cgi?id=177859
843
844         * test262.yaml:
845
846 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
847
848         [Test262] Update Test262 to Oct 4 version
849         https://bugs.webkit.org/show_bug.cgi?id=177859
850
851         Reviewed by Sam Weinig.
852
853         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
854         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
855
856         * test262.yaml:
857         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
858         (checkSequence):
859         * test262/harness/typeCoercion.js:
860         (testCoercibleToIndexZero):
861         (testCoercibleToIndexOne):
862         (testCoercibleToIndexFromIndex):
863         (testNotCoercibleToIndex.testPrimitiveValue):
864         (testNotCoercibleToInteger):
865         (testCoercibleToBigIntZero.testPrimitiveValue):
866         (testCoercibleToBigIntZero):
867         (testCoercibleToBigIntOne.testPrimitiveValue):
868         (testCoercibleToBigIntOne):
869         (testPrimitiveValue):
870         (testCoercibleToBigIntFromBigInt):
871         (testNotCoercibleToBigInt.testPrimitiveValue):
872         (testNotCoercibleToBigInt.testStringValue):
873         (testNotCoercibleToBigInt):
874         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
875         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
876         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
877         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
878         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
879         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
880         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
881         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
882         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
883         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
884         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
885         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
886         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
887         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
888         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
889         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
890         (testCoercibleToBigIntZero):
891         (testCoercibleToBigIntOne):
892         (testNotCoercibleToBigInt):
893         (MyError): Deleted.
894         (valueOf): Deleted.
895         (toString): Deleted.
896         (Symbol.toPrimitive): Deleted.
897         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
898         (testCoercibleToIndexZero):
899         (testCoercibleToIndexOne):
900         (testNotCoercibleToIndex):
901         (MyError): Deleted.
902         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
903         (assert.sameValue.BigInt.asIntN.toString): Deleted.
904         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
905         (BigInt.asIntN.valueOf): Deleted.
906         (BigInt.asIntN.toString): Deleted.
907         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
908         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
909         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
910         (testCoercibleToBigIntZero):
911         (testCoercibleToBigIntOne):
912         (testNotCoercibleToBigInt):
913         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
914         (testCoercibleToIndexZero):
915         (testCoercibleToIndexOne):
916         (testNotCoercibleToIndex):
917         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
918         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
919         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
920         (bits.valueOf):
921         (bigint.valueOf):
922         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
923         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
924         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
925         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
926         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
927         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
928         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
929         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
930         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
931         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
932         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
933         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
934         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
935         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
936         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
937         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
938         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
939         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
940         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
941         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
942         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
943         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
944         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
945         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
946         (replacer):
947         (BigInt.prototype.toJSON):
948         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
949         (replacer):
950         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
951         (BigInt.prototype.toJSON):
952         * test262/test/built-ins/JSON/stringify/bigint.js:
953         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
954         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
955         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
956         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
957         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
958         * test262/test/built-ins/Object/proto-from-ctor.js:
959         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
960         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
961         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
962         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
963         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
964         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
965         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
966         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
967         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
968         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
969         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
970         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
971         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
972         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
973         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
974         * test262/test/built-ins/Proxy/get-fn-realm.js:
975         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
976         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
977         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
978         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
979         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
980         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
981         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
982         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
983         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
984         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
985         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
986         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
987         (i6.replace):
988         (i6b.replace):
989         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
990         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
991         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
992         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
993         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
994         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
995         * test262/test/built-ins/RegExp/u180e.js: Added.
996         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
997         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
998         * test262/test/built-ins/String/proto-from-ctor-realm.js:
999         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1000         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1001         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1002         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1003         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1004         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1005         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1006         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1007         * test262/test/built-ins/String/prototype/endsWith/length.js:
1008         * test262/test/built-ins/String/prototype/endsWith/name.js:
1009         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1010         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1011         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1012         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1013         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1014         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1015         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1016         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1017         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1018         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1019         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1020         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1021         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1022         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1023         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1024         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1025         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1026         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1027         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1028         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1029         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1030         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1031         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1032         * test262/test/built-ins/String/prototype/includes/includes.js:
1033         * test262/test/built-ins/String/prototype/includes/length.js:
1034         * test262/test/built-ins/String/prototype/includes/name.js:
1035         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1036         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1037         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1038         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1039         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1040         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1041         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1042         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1043         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1044         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1045         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1046         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1047         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1048         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1049         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1050         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1051         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1052         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1053         * test262/test/built-ins/String/prototype/trim/u180e.js:
1054         * test262/test/built-ins/Symbol/for/cross-realm.js:
1055         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1056         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1057         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1058         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1059         * test262/test/built-ins/Symbol/match/cross-realm.js:
1060         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1061         * test262/test/built-ins/Symbol/search/cross-realm.js:
1062         * test262/test/built-ins/Symbol/species/cross-realm.js:
1063         * test262/test/built-ins/Symbol/split/cross-realm.js:
1064         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1065         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1066         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1067         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1068         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1069         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1070         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1071         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1072         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1073         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1074         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1075         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1076         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1077         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1078         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1079         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1080         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1081         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1082         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1083         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1084         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1085         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1086         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1087         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1088         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1089         * test262/test/language/eval-code/indirect/realm.js:
1090         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1091         (o.get z):
1092         (o.get a):
1093         * test262/test/language/expressions/call/eval-realm-indirect.js:
1094         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1095         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1096         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1097         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1098         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1099         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1100         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1101         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1102         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1103         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1104         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1105         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1106         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1107         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1108         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1109         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1110         * test262/test/language/expressions/less-than/bigint-and-number.js:
1111         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1112         * test262/test/language/expressions/super/realm.js:
1113         * test262/test/language/expressions/tagged-template/cache-realm.js:
1114         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1115         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1116         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1117         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1118         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1119         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1120         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1121         (o.get z):
1122         (o.get a):
1123         * test262/test/language/statements/for-of/iterator-next-reference.js:
1124         (next):
1125         (iterator.next): Deleted.
1126         (x.of.iterable.): Deleted.
1127         (x.of.iterable.get return): Deleted.
1128         (x.of.iterable.iterator.next): Deleted.
1129         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1130         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1131         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1132         * test262/test/language/white-space/mongolian-vowel-separator.js:
1133         * test262/test262-Revision.txt:
1134
1135 2017-10-03  Saam Barati  <sbarati@apple.com>
1136
1137         Implement polymorphic prototypes
1138         https://bugs.webkit.org/show_bug.cgi?id=176391
1139
1140         Reviewed by Filip Pizlo.
1141
1142         * microbenchmarks/poly-proto-access.js: Added.
1143         (assert):
1144         (foo.C):
1145         (foo.C.prototype.get bar):
1146         (foo):
1147         (bar):
1148         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1149         (assert):
1150         (makePolyProtoObject.foo.C):
1151         (makePolyProtoObject.foo):
1152         (makePolyProtoObject):
1153         (performSet):
1154         * microbenchmarks/poly-proto-setter-speed.js: Added.
1155         (assert):
1156         (makePolyProtoObject.foo.C):
1157         (makePolyProtoObject.foo.C.prototype.set p):
1158         (makePolyProtoObject.foo):
1159         (makePolyProtoObject):
1160         (performSet):
1161         * stress/constructor-with-return.js:
1162         (i.tests.forEach.Constructor):
1163         (i.tests.forEach):
1164         (tests.forEach.Constructor): Deleted.
1165         (tests.forEach): Deleted.
1166         * stress/dom-jit-with-poly-proto.js: Added.
1167         (assert):
1168         (makePolyProtoObject.foo.C):
1169         (makePolyProtoObject.foo):
1170         (makePolyProtoObject):
1171         (validate):
1172         * stress/poly-proto-custom-value-and-accessor.js: Added.
1173         (assert):
1174         (makePolyProtoObject.foo.C):
1175         (makePolyProtoObject.foo):
1176         (makePolyProtoObject):
1177         (items.forEach):
1178         (set get for):
1179         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1180         (assert):
1181         (makePolyProtoObject.foo.C):
1182         (makePolyProtoObject.foo):
1183         (makePolyProtoObject):
1184         (foo):
1185         * stress/poly-proto-miss.js: Added.
1186         (makePolyProtoInstanceWithNullPrototype.foo.C):
1187         (makePolyProtoInstanceWithNullPrototype.foo):
1188         (makePolyProtoInstanceWithNullPrototype):
1189         (assert):
1190         (validate):
1191         * stress/poly-proto-op-in-caching.js: Added.
1192         (assert):
1193         (makePolyProtoObject.foo.C):
1194         (makePolyProtoObject.foo):
1195         (makePolyProtoObject):
1196         (validate):
1197         (validate2):
1198         * stress/poly-proto-put-transition.js: Added.
1199         (assert):
1200         (makePolyProtoObject.foo.C):
1201         (makePolyProtoObject.foo):
1202         (makePolyProtoObject):
1203         (performSet):
1204         (i.obj.__proto__.set p):
1205         * stress/poly-proto-set-prototype.js: Added.
1206         (assert):
1207         (let.alternateProto.get x):
1208         (let.alternateProto2.get y):
1209         (let.alternateProto2.get x):
1210         (foo.C):
1211         (foo):
1212         (validate):
1213         * stress/poly-proto-setter.js: Added.
1214         (assert):
1215         (makePolyProtoObject.foo.C):
1216         (makePolyProtoObject.foo.C.prototype.set p):
1217         (makePolyProtoObject.foo.C.prototype.get p):
1218         (makePolyProtoObject.foo):
1219         (makePolyProtoObject):
1220         (performSet):
1221         * stress/poly-proto-using-inheritance.js: Added.
1222         (assert):
1223         (foo.C):
1224         (foo.C.prototype.get baz):
1225         (foo):
1226         (bar.C):
1227         (bar):
1228         (validate):
1229         * stress/primitive-poly-proto.js: Added.
1230         (makePolyProtoInstance.foo.C):
1231         (makePolyProtoInstance.foo):
1232         (makePolyProtoInstance):
1233         (assert):
1234         (validate):
1235         * stress/prototype-is-not-js-object.js: Added.
1236         (foo.bar):
1237         (foo):
1238         (assert):
1239         (validate):
1240         * stress/try-get-by-id-poly-proto.js: Added.
1241         (assert):
1242         (makePolyProtoObject.foo.C):
1243         (makePolyProtoObject.foo):
1244         (makePolyProtoObject):
1245         (tryGetByIdText):
1246         (x.__proto__.get bar):
1247         (validate):
1248         * typeProfiler/overflow.js:
1249
1250 2017-10-03  JF Bastien  <jfbastien@apple.com>
1251
1252         WebAssembly: no VM / JS version of everything but Instance
1253         https://bugs.webkit.org/show_bug.cgi?id=177473
1254
1255         Reviewed by Filip Pizlo.
1256
1257         - Exceeding max on memory growth now returns a range error as per
1258         spec. This is a (very minor) breaking change: it used to throw OOM
1259         error. Update the corresponding test.
1260
1261         * wasm/js-api/memory-grow.js:
1262         (assertEq):
1263         * wasm/js-api/table.js:
1264         (assert.throws):
1265
1266 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1267
1268         Skip JSC test stress/regress-159779-2.js on debug.
1269         https://bugs.webkit.org/show_bug.cgi?id=177204
1270
1271         Unreviewed test gardening.
1272
1273         * stress/regress-159779-2.js:
1274
1275 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1276
1277         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1278         https://bugs.webkit.org/show_bug.cgi?id=175642
1279
1280         Reviewed by Darin Adler.
1281
1282         * ChakraCore/test/Function/apply3.baseline-jsc:
1283
1284 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1285
1286         Unreviewed, rolling out r222564.
1287         https://bugs.webkit.org/show_bug.cgi?id=177720
1288
1289         "It regressed JetStream by 2% on iOS caused by a 50%
1290         regression on the bigfib subtest" (Requested by saamyjoon on
1291         #webkit).
1292
1293         Reverted changeset:
1294
1295         "Add Above/Below comparisons for UInt32 patterns"
1296         https://bugs.webkit.org/show_bug.cgi?id=177281
1297         http://trac.webkit.org/changeset/222564
1298
1299 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1300
1301         [DFG] Support ArrayPush with multiple args
1302         https://bugs.webkit.org/show_bug.cgi?id=175823
1303
1304         Reviewed by Saam Barati.
1305
1306         * microbenchmarks/array-push-0.js: Added.
1307         (arrayPush0):
1308         * microbenchmarks/array-push-1.js: Added.
1309         (arrayPush1):
1310         * microbenchmarks/array-push-2.js: Added.
1311         (arrayPush2):
1312         * microbenchmarks/array-push-3.js: Added.
1313         (arrayPush3):
1314         * stress/array-push-multiple-contiguous.js: Added.
1315         (shouldBe):
1316         (test):
1317         * stress/array-push-multiple-double-nan.js: Added.
1318         (shouldBe):
1319         (test):
1320         * stress/array-push-multiple-double.js: Added.
1321         (shouldBe):
1322         (test):
1323         * stress/array-push-multiple-int32.js: Added.
1324         (shouldBe):
1325         (test):
1326         * stress/array-push-multiple-many-contiguous.js: Added.
1327         (shouldBe):
1328         (test):
1329         * stress/array-push-multiple-many-double.js: Added.
1330         (shouldBe):
1331         (test):
1332         * stress/array-push-multiple-many-int32.js: Added.
1333         (shouldBe):
1334         (test):
1335         * stress/array-push-multiple-many-storage.js: Added.
1336         (shouldBe):
1337         (test):
1338         * stress/array-push-multiple-storage.js: Added.
1339         (shouldBe):
1340         (test):
1341         * stress/array-push-with-force-exit.js: Added.
1342         (target.createBuiltin):
1343
1344 2017-09-29  Saam Barati  <sbarati@apple.com>
1345
1346         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1347         https://bugs.webkit.org/show_bug.cgi?id=177639
1348
1349         Reviewed by Geoffrey Garen.
1350
1351         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1352         (assert):
1353         (Class):
1354         (items.forEach):
1355         (set get for):
1356
1357 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1358
1359         Unreviewed, rolling out r222563, r222565, and r222581.
1360         https://bugs.webkit.org/show_bug.cgi?id=177675
1361
1362         "It causes a crash when playing youtube videos" (Requested by
1363         saamyjoon on #webkit).
1364
1365         Reverted changesets:
1366
1367         "[DFG] Support ArrayPush with multiple args"
1368         https://bugs.webkit.org/show_bug.cgi?id=175823
1369         http://trac.webkit.org/changeset/222563
1370
1371         "Unreviewed, build fix after r222563"
1372         https://bugs.webkit.org/show_bug.cgi?id=175823
1373         http://trac.webkit.org/changeset/222565
1374
1375         "Unreviewed, fix x86 breaking due to exhausted registers"
1376         https://bugs.webkit.org/show_bug.cgi?id=175823
1377         http://trac.webkit.org/changeset/222581
1378
1379 2017-09-28  Mark Lam  <mark.lam@apple.com>
1380
1381         test262: Unexpected passes after r222617 and r222618.
1382         https://bugs.webkit.org/show_bug.cgi?id=177622
1383         <rdar://problem/34725960>
1384
1385         Reviewed by Saam Barati.
1386
1387         Update test262.yaml for tests that are now passing.
1388
1389         * test262.yaml:
1390
1391 2017-09-27  Michael Saboff  <msaboff@apple.com>
1392
1393         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1394         https://bugs.webkit.org/show_bug.cgi?id=177570
1395
1396         Reviewed by Filip Pizlo.
1397
1398         New regression test.
1399
1400         * stress/regress-177570.js: Added.
1401
1402 2017-09-28  Michael Saboff  <msaboff@apple.com>
1403
1404         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1405         https://bugs.webkit.org/show_bug.cgi?id=177423
1406
1407         Reviewed by Mark Lam.
1408
1409         Updated regression test.
1410
1411         * stress/regress-177423.js:
1412         (catch):
1413
1414 2017-09-27  Mark Lam  <mark.lam@apple.com>
1415
1416         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1417         https://bugs.webkit.org/show_bug.cgi?id=177584
1418         <rdar://problem/34463903>
1419
1420         Reviewed by Saam Barati.
1421
1422         * stress/regress-177584.js: Added.
1423         (assertEqual):
1424         (Array.prototype.Symbol.species):
1425
1426 2017-09-27  Saam Barati  <sbarati@apple.com>
1427
1428         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1429         https://bugs.webkit.org/show_bug.cgi?id=177523
1430
1431         Reviewed by Mark Lam.
1432
1433         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1434         (assert):
1435         (Test):
1436         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1437         (addMethods):
1438         (i.Test.prototype.propName):
1439
1440 2017-09-27  Mark Lam  <mark.lam@apple.com>
1441
1442         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1443         https://bugs.webkit.org/show_bug.cgi?id=177423
1444         <rdar://problem/34621320>
1445
1446         Reviewed by Keith Miller.
1447
1448         * stress/regress-177423.js: Added.
1449
1450 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1451
1452         Add Above/Below comparisons for UInt32 patterns
1453         https://bugs.webkit.org/show_bug.cgi?id=177281
1454
1455         Reviewed by Saam Barati.
1456
1457         * stress/uint32-comparison-jump.js: Added.
1458         (shouldBe):
1459         (above):
1460         (aboveOrEqual):
1461         (below):
1462         (belowOrEqual):
1463         (notAbove):
1464         (notAboveOrEqual):
1465         (notBelow):
1466         (notBelowOrEqual):
1467         * stress/uint32-comparison.js: Added.
1468         (shouldBe):
1469         (above):
1470         (aboveOrEqual):
1471         (below):
1472         (belowOrEqual):
1473         (aboveTest):
1474         (aboveOrEqualTest):
1475         (belowTest):
1476         (belowOrEqualTest):
1477
1478 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1479
1480         [DFG] Support ArrayPush with multiple args
1481         https://bugs.webkit.org/show_bug.cgi?id=175823
1482
1483         Reviewed by Saam Barati.
1484
1485         * microbenchmarks/array-push-0.js: Added.
1486         (arrayPush0):
1487         * microbenchmarks/array-push-1.js: Added.
1488         (arrayPush1):
1489         * microbenchmarks/array-push-2.js: Added.
1490         (arrayPush2):
1491         * microbenchmarks/array-push-3.js: Added.
1492         (arrayPush3):
1493         * stress/array-push-multiple-contiguous.js: Added.
1494         (shouldBe):
1495         (test):
1496         * stress/array-push-multiple-double-nan.js: Added.
1497         (shouldBe):
1498         (test):
1499         * stress/array-push-multiple-double.js: Added.
1500         (shouldBe):
1501         (test):
1502         * stress/array-push-multiple-int32.js: Added.
1503         (shouldBe):
1504         (test):
1505         * stress/array-push-multiple-many-contiguous.js: Added.
1506         (shouldBe):
1507         (test):
1508         * stress/array-push-multiple-many-double.js: Added.
1509         (shouldBe):
1510         (test):
1511         * stress/array-push-multiple-many-int32.js: Added.
1512         (shouldBe):
1513         (test):
1514         * stress/array-push-multiple-many-storage.js: Added.
1515         (shouldBe):
1516         (test):
1517         * stress/array-push-multiple-storage.js: Added.
1518         (shouldBe):
1519         (test):
1520
1521 2017-09-26  Commit Queue  <commit-queue@webkit.org>
1522
1523         Unreviewed, rolling out r222518.
1524         https://bugs.webkit.org/show_bug.cgi?id=177507
1525
1526         Break the High Sierra build (Requested by yusukesuzuki on
1527         #webkit).
1528
1529         Reverted changeset:
1530
1531         "Add Above/Below comparisons for UInt32 patterns"
1532         https://bugs.webkit.org/show_bug.cgi?id=177281
1533         http://trac.webkit.org/changeset/222518
1534
1535 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1536
1537         Add Above/Below comparisons for UInt32 patterns
1538         https://bugs.webkit.org/show_bug.cgi?id=177281
1539
1540         Reviewed by Saam Barati.
1541
1542         * stress/uint32-comparison-jump.js: Added.
1543         (shouldBe):
1544         (above):
1545         (aboveOrEqual):
1546         (below):
1547         (belowOrEqual):
1548         (notAbove):
1549         (notAboveOrEqual):
1550         (notBelow):
1551         (notBelowOrEqual):
1552         * stress/uint32-comparison.js: Added.
1553         (shouldBe):
1554         (above):
1555         (aboveOrEqual):
1556         (below):
1557         (belowOrEqual):
1558         (aboveTest):
1559         (aboveOrEqualTest):
1560         (belowTest):
1561         (belowOrEqualTest):
1562
1563 2017-09-23  Keith Miller  <keith_miller@apple.com>
1564
1565         Fix infinite looping test262 test
1566         https://bugs.webkit.org/show_bug.cgi?id=177412
1567
1568         Reviewed by Yusuke Suzuki.
1569
1570         This test was poorly designed since failing it would cause the vm
1571         to inifinite loop. I've fixed it locally and will fix it on github pending
1572         the results of next weeks tc39 meeting.
1573
1574         * test262.yaml:
1575         * test262/test/language/statements/for-of/iterator-next-reference.js:
1576
1577 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
1578
1579         test262: $.agent became $262.agent in test262 update
1580         https://bugs.webkit.org/show_bug.cgi?id=177407
1581
1582         Reviewed by Yusuke Suzuki.
1583
1584         * test262.yaml:
1585         ~320 tests pass now that we correctly make $262 available.
1586
1587 2017-09-22  Keith Miller  <keith_miller@apple.com>
1588
1589         Speculatively change iteration protocall to use the same next function
1590         https://bugs.webkit.org/show_bug.cgi?id=175653
1591
1592         Reviewed by Saam Barati.
1593
1594         Change test to match the new iteration behavior.
1595
1596         * stress/spread-optimized-properly.js:
1597
1598 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1599
1600         [DFG][FTL] Profile array vector length for array allocation
1601         https://bugs.webkit.org/show_bug.cgi?id=177051
1602
1603         Reviewed by Saam Barati.
1604
1605         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1606         (target):
1607
1608 2017-09-22  Commit Queue  <commit-queue@webkit.org>
1609
1610         Unreviewed, rolling out r222380.
1611         https://bugs.webkit.org/show_bug.cgi?id=177352
1612
1613         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
1614         #webkit).
1615
1616         Reverted changeset:
1617
1618         "[DFG][FTL] Profile array vector length for array allocation"
1619         https://bugs.webkit.org/show_bug.cgi?id=177051
1620         http://trac.webkit.org/changeset/222380
1621
1622 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1623
1624         [DFG][FTL] Profile array vector length for array allocation
1625         https://bugs.webkit.org/show_bug.cgi?id=177051
1626
1627         Reviewed by Saam Barati.
1628
1629         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1630         (target):
1631
1632 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
1633
1634         Skip new hanging test262 tests.
1635         https://bugs.webkit.org/show_bug.cgi?id=177326
1636
1637         Unreviewed test gardening.
1638
1639         * test262.yaml:
1640
1641 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
1642
1643         Mark 6 test262 tests as passing.
1644         https://bugs.webkit.org/show_bug.cgi?id=177307
1645
1646         Unreviewed test gardening.
1647
1648         * test262.yaml:
1649
1650 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1651
1652         Unreviewed follow-up to r222311.
1653
1654         * test262/harness/sta.js:
1655         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
1656         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
1657         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
1658         * test262/test/built-ins/Array/from/elements-added-after.js:
1659         * test262/test/built-ins/Array/from/elements-deleted-after.js:
1660         * test262/test/built-ins/Array/from/elements-updated-after.js:
1661         * test262/test/built-ins/Array/from/from-array.js:
1662         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
1663         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
1664         * test262/test/built-ins/Array/from/source-array-boundary.js:
1665         * test262/test/built-ins/Array/from/source-object-constructor.js:
1666         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
1667         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
1668         * test262/test/built-ins/Array/from/source-object-length.js:
1669         * test262/test/built-ins/Array/from/source-object-missing.js:
1670         * test262/test/built-ins/Array/from/source-object-without.js:
1671         * test262/test/built-ins/Array/from/this-null.js:
1672         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1673         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
1674         * test262/test/language/literals/numeric/7.8.3-1gs.js:
1675         * test262/test/language/literals/numeric/7.8.3-2gs.js:
1676         * test262/test/language/literals/numeric/7.8.3-3gs.js:
1677         * test262/test/language/literals/regexp/7.8.5-1gs.js:
1678         * test262/test/language/literals/string/7.8.4-1gs.js:
1679         Fix some files that I failed to update when I applied my patch.
1680
1681 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1682
1683         Update test262 tests
1684         https://bugs.webkit.org/show_bug.cgi?id=177220
1685
1686         Reviewed by Saam Barati and Yusuke Suzuki.
1687
1688         * test262.yaml:
1689         * test262/test262-Revision.txt:
1690         New rebaselined expectations for all tests.
1691
1692         * test262/*:
1693         Updated.
1694
1695 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1696
1697         [DFG] Remove ToThis more aggressively
1698         https://bugs.webkit.org/show_bug.cgi?id=177056
1699
1700         Reviewed by Saam Barati.
1701
1702         * stress/generator-with-this-strict.js: Added.
1703         (shouldBe):
1704         (generator):
1705         (target):
1706         * stress/generator-with-this.js: Added.
1707         (shouldBe):
1708         (generator):
1709         (target):
1710
1711 2017-09-17  Michael Saboff  <msaboff@apple.com>
1712
1713         https://bugs.webkit.org/show_bug.cgi?id=177038
1714         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
1715
1716         Reviewed by JF Bastien.
1717
1718         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
1719         as it dies using too much memory.
1720
1721 2017-09-15  Saam Barati  <sbarati@apple.com>
1722
1723         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
1724         https://bugs.webkit.org/show_bug.cgi?id=176981
1725
1726         Reviewed by Yusuke Suzuki.
1727
1728         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
1729         (assert):
1730         (verify):
1731         (func):
1732         (const.bar.createBuiltin):
1733
1734 2017-09-14  Saam Barati  <sbarati@apple.com>
1735
1736         It should be valid to exit before each set when doing arity fixup when inlining
1737         https://bugs.webkit.org/show_bug.cgi?id=176948
1738
1739         Reviewed by Keith Miller.
1740
1741         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
1742         (baz):
1743         (bar):
1744         (foo):
1745
1746 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1747
1748         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
1749         https://bugs.webkit.org/show_bug.cgi?id=176867
1750
1751         Reviewed by Sam Weinig.
1752
1753         * microbenchmarks/object-get-own-property-symbols.js: Added.
1754         (test):
1755
1756 2017-09-13  Mark Lam  <mark.lam@apple.com>
1757
1758         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
1759         https://bugs.webkit.org/show_bug.cgi?id=176888
1760         <rdar://problem/34381832>
1761
1762         Not reviewed.
1763
1764         * stress/op_mod-ConstVar.js:
1765         * stress/op_mod-VarConst.js:
1766         * stress/op_mod-VarVar.js:
1767
1768 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
1769
1770         Skip 3 op_mod tests on Debug JSC bots.
1771         https://bugs.webkit.org/show_bug.cgi?id=176630
1772
1773         Unreviewed test gardening.
1774
1775         * stress/op_mod-ConstVar.js:
1776         * stress/op_mod-VarConst.js:
1777         * stress/op_mod-VarVar.js:
1778
1779 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1780
1781         [JSC] Fix Array allocation in Object.keys
1782         https://bugs.webkit.org/show_bug.cgi?id=176826
1783
1784         Reviewed by Saam Barati.
1785
1786         * stress/object-own-property-keys.js: Added.
1787         (shouldBe):
1788
1789 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1790
1791         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1792         https://bugs.webkit.org/show_bug.cgi?id=176010
1793
1794         Reviewed by Filip Pizlo.
1795
1796         * microbenchmarks/weak-map-key.js: Added.
1797         (assert):
1798         (objectKey):
1799         (let.start.Date.now):
1800
1801 2017-09-12  Mark Lam  <mark.lam@apple.com>
1802
1803         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
1804         https://bugs.webkit.org/show_bug.cgi?id=176630
1805
1806         Reviewed by JF Bastien.
1807
1808         Debug builds are just slow, and these tests do a lot.  They pass when I run them
1809         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
1810         a speculative fix for the bots that are seeing these fail.
1811
1812         I also undid the skipping of the op_mod tests for debug builds.
1813
1814         * stress/op_div-ConstVar.js:
1815         * stress/op_div-VarConst.js:
1816         * stress/op_div-VarVar.js:
1817         * stress/op_mod-ConstVar.js:
1818         * stress/op_mod-VarConst.js:
1819         * stress/op_mod-VarVar.js:
1820
1821 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
1822
1823         Skip stress/value-to-boolean.js on Debug bots.
1824         https://bugs.webkit.org/show_bug.cgi?id=176787
1825
1826         Unreviewed test gardening.
1827
1828         * stress/value-to-boolean.js:
1829
1830 2017-09-11  Mark Lam  <mark.lam@apple.com>
1831
1832         Change test expectation for test262/test/language/statements/try/tco-catch.js
1833         https://bugs.webkit.org/show_bug.cgi?id=176749
1834
1835         Rubber stamped by Keith Miller.
1836
1837         It's been failing since at least r221821.  I'm changing the test expectation to
1838         fail to green the bots while I investigate some more.
1839
1840         * test262.yaml:
1841
1842 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
1843
1844         Unreviewed, rolling out r221854.
1845
1846         The test added with this change fails on 32-bit JSC bots.
1847
1848         Reverted changeset:
1849
1850         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
1851         https://bugs.webkit.org/show_bug.cgi?id=176010
1852         http://trac.webkit.org/changeset/221854
1853
1854 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1855
1856         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1857         https://bugs.webkit.org/show_bug.cgi?id=176010
1858
1859         Reviewed by Filip Pizlo.
1860
1861         * microbenchmarks/weak-map-key.js: Added.
1862         (assert):
1863         (objectKey):
1864         (let.start.Date.now):
1865
1866 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1867
1868         [JSC] Optimize Object.keys by using careful array allocation
1869         https://bugs.webkit.org/show_bug.cgi?id=176654
1870
1871         Reviewed by Darin Adler.
1872
1873         * microbenchmarks/object-keys.js: Added.
1874         (test):
1875
1876 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
1877
1878         Error should compute .stack and friends lazily
1879         https://bugs.webkit.org/show_bug.cgi?id=176645
1880
1881         Reviewed by Saam Barati.
1882
1883         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
1884         * microbenchmarks/new-error.js: Added.
1885         * microbenchmarks/throw.js: Added.
1886
1887 2017-09-09  Mark Lam  <mark.lam@apple.com>
1888
1889         [Re-landing] Use JIT probes for DFG OSR exit.
1890         https://bugs.webkit.org/show_bug.cgi?id=175144
1891         <rdar://problem/33437050>
1892
1893         Not reviewed.  Original patch reviewed by Saam Barati.
1894
1895         Disable these tests for debug builds because they run too slow with the new OSR exit.
1896
1897         * stress/op_mod-ConstVar.js:
1898         * stress/op_mod-VarConst.js:
1899         * stress/op_mod-VarVar.js:
1900
1901 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1902
1903         [DFG] NewArrayWithSize(size)'s size does not care negative zero
1904         https://bugs.webkit.org/show_bug.cgi?id=176300
1905
1906         Reviewed by Saam Barati.
1907
1908         * stress/new-array-with-size-div.js: Added.
1909         (shouldBe):
1910         (test):
1911         (i.i):
1912
1913 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1914
1915         [DFG] PutByVal with Array::Generic is too generic
1916         https://bugs.webkit.org/show_bug.cgi?id=176345
1917
1918         Reviewed by Filip Pizlo.
1919
1920         * stress/object-assign-symbols.js: Added.
1921         (shouldBe):
1922         (test):
1923         * stress/object-assign.js: Added.
1924         (shouldBe):
1925         (test):
1926         (i.shouldBe.JSON.stringify.test):
1927
1928 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1929
1930         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
1931         https://bugs.webkit.org/show_bug.cgi?id=176590
1932
1933         Reviewed by Saam Barati.
1934
1935         * microbenchmarks/object-iterate-symbols.js: Added.
1936         (test):
1937         * microbenchmarks/object-iterate.js: Added.
1938         (test):
1939         * stress/object-iterate-symbols.js: Added.
1940         (shouldBe):
1941         (test):
1942         * stress/object-iterate.js: Added.
1943         (shouldBe):
1944         (test):
1945
1946 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
1947
1948         [Win32] 10 JSC stress tests are failing.
1949         https://bugs.webkit.org/show_bug.cgi?id=176538
1950
1951         Reviewed by Mark Lam.
1952
1953         Skip tests on Windows to make the bots green.
1954
1955         * ChakraCore.yaml:
1956         * stress/date-relaxed.js:
1957
1958 2017-09-06  Mark Lam  <mark.lam@apple.com>
1959
1960         constructGenericTypedArrayViewWithArguments() is missing an exception check.
1961         https://bugs.webkit.org/show_bug.cgi?id=176485
1962         <rdar://problem/33898874>
1963
1964         Reviewed by Keith Miller.
1965
1966         * stress/regress-176485.js: Added.
1967
1968 2017-09-05  Saam Barati  <sbarati@apple.com>
1969
1970         isNotCellSpeculation is wrong with respect to SpecEmpty
1971         https://bugs.webkit.org/show_bug.cgi?id=176429
1972
1973         Reviewed by Michael Saboff.
1974
1975         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
1976         (Foo):
1977
1978 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
1979
1980         test262: Completion values for control flow do not match the spec
1981         https://bugs.webkit.org/show_bug.cgi?id=171265
1982
1983         Reviewed by Saam Barati.
1984
1985         * stress/completion-value.js:
1986         Condensed test for completion values in top level statements.
1987
1988         * stress/super-get-by-id.js:
1989         ClassDeclaration when evaled no longer produce values. Convert
1990         these to ClassExpressions so they produce the class value.
1991         
1992         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1993         This is a progression for currect spec behavior.
1994
1995         * mozilla/mozilla-tests.yaml:
1996         This test is now outdated, so mark it as failing for that reason.
1997
1998         * test262.yaml:
1999         Passing all "cptn" completion value tests.
2000
2001 2017-09-04  Saam Barati  <sbarati@apple.com>
2002
2003         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2004         https://bugs.webkit.org/show_bug.cgi?id=176317
2005
2006         Reviewed by Keith Miller.
2007
2008         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2009         (Foo):
2010
2011 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2012
2013         [DFG][FTL] Efficiently execute number#toString()
2014         https://bugs.webkit.org/show_bug.cgi?id=170007
2015
2016         Reviewed by Keith Miller.
2017
2018         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2019         (test):
2020         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2021         (test):
2022         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2023         (test):
2024         * microbenchmarks/number-to-string-with-radix.js: Added.
2025         (test):
2026         * stress/number-to-string-strength-reduction.js: Added.
2027         (shouldBe):
2028         (test):
2029         * stress/number-to-string-with-radix-10.js: Added.
2030         (shouldBe):
2031         (test):
2032         * stress/number-to-string-with-radix-cse.js: Added.
2033         (shouldBe):
2034         (test):
2035         * stress/number-to-string-with-radix-invalid.js: Added.
2036         (shouldThrow):
2037         * stress/number-to-string-with-radix-watchpoint.js: Added.
2038         (shouldBe):
2039         (test):
2040         (i.i.1e3.Number.prototype.toString):
2041         * stress/number-to-string-with-radix.js: Added.
2042         (shouldBe):
2043         (test):
2044
2045 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2046
2047         [DFG] Relax arity requirement
2048         https://bugs.webkit.org/show_bug.cgi?id=175523
2049
2050         Reviewed by Saam Barati.
2051
2052         * stress/arity-mismatch-arguments-length.js: Added.
2053         (shouldBe):
2054         (test1):
2055         (test):
2056         * stress/arity-mismatch-get-argument.js: Added.
2057         (shouldBe):
2058         (builtin.createBuiltin):
2059         (test):
2060         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2061         (shouldBe):
2062         (inlineTarget):
2063         (test):
2064         * stress/arity-mismatch-inlining.js: Added.
2065         (shouldBe):
2066         (inlineTarget):
2067         (test):
2068         * stress/arity-mismatch-rest.js: Added.
2069         (shouldBe):
2070         (test2):
2071         (test1):
2072         (test):
2073
2074 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2075
2076         [JSC] Fix "name" and "length" of Proxy revoke function
2077         https://bugs.webkit.org/show_bug.cgi?id=176155
2078
2079         Reviewed by Mark Lam.
2080
2081         * test262.yaml:
2082
2083 2017-08-31  Saam Barati  <sbarati@apple.com>
2084
2085         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2086         https://bugs.webkit.org/show_bug.cgi?id=176206
2087
2088         Reviewed by Keith Miller.
2089
2090         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2091         (a):
2092         (b):
2093         (foo):
2094
2095 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2096
2097         Skip two slow JSC tests after r221422.
2098
2099         Unreviewed test gardening.
2100
2101         * stress/regexp-prototype-match-on-too-long-rope.js:
2102         * stress/regexp-prototype-test-on-too-long-rope.js:
2103
2104 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2105
2106         Unreviewed, skipping slow tests.
2107         
2108         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2109         work differently now.
2110
2111         * stress/regexp-prototype-exec-on-too-long-rope.js:
2112         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2113
2114 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2115
2116         [JSC] Use reifying system for "name" property of builtin JSFunction
2117         https://bugs.webkit.org/show_bug.cgi?id=175260
2118
2119         Reviewed by Saam Barati.
2120
2121         * stress/accessors-get-set-prefix.js:
2122         * stress/builtin-function-name.js: Added.
2123         (shouldBe):
2124         (shouldThrow):
2125         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2126         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2127         * stress/private-name-as-anonymous-builtin.js: Added.
2128         (shouldBe):
2129         (NotPromise):
2130
2131 2017-08-30  Saam Barati  <sbarati@apple.com>
2132
2133         Unreviewed. Make test stop printing.
2134
2135         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2136
2137 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2138
2139         Unreviewed, rolling out r221327.
2140
2141         This change caused test262 failures.
2142
2143         Reverted changeset:
2144
2145         "[JSC] Use reifying system for "name" property of builtin
2146         JSFunction"
2147         https://bugs.webkit.org/show_bug.cgi?id=175260
2148         http://trac.webkit.org/changeset/221327
2149
2150 2017-08-30  Saam Barati  <sbarati@apple.com>
2151
2152         semicolon is being interpreted as an = in the LiteralParser
2153         https://bugs.webkit.org/show_bug.cgi?id=176114
2154
2155         Reviewed by Oliver Hunt.
2156
2157         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2158         * stress/resources/literal-parser-test-case.js: Added.
2159
2160 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2161
2162         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2163         https://bugs.webkit.org/show_bug.cgi?id=166698
2164
2165         Reviewed by Yusuke Suzuki.
2166
2167         * stress/async-iteration-for-await-of-syntax.js: Added.
2168         (assert):
2169         (checkSyntax):
2170         (checkSyntaxError):
2171         (checkSimpleAsyncGeneratorSloppyMode):
2172         (checkSimpleAsyncGeneratorStrictMode):
2173         (checkNestedAsyncGenerators):
2174         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2175         * stress/async-iteration-for-await-of.js: Added.
2176         (assert):
2177         (async.foo):
2178         (async.boo):
2179         (const.boo.async):
2180
2181 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2182
2183         [JSC] Use reifying system for "name" property of builtin JSFunction
2184         https://bugs.webkit.org/show_bug.cgi?id=175260
2185
2186         Reviewed by Saam Barati.
2187
2188         * stress/accessors-get-set-prefix.js:
2189         * stress/builtin-function-name.js: Added.
2190         (shouldBe):
2191         (shouldThrow):
2192         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2193         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2194
2195 2017-08-25  Saam Barati  <sbarati@apple.com>
2196
2197         Support compiling catch in the DFG
2198         https://bugs.webkit.org/show_bug.cgi?id=174590
2199         <rdar://problem/34047845>
2200
2201         Reviewed by Filip Pizlo.
2202
2203         * microbenchmarks/delta-blue-try-catch.js: Added.
2204         (exception):
2205         (value):
2206         (OrderedCollection):
2207         (OrderedCollection.prototype.add):
2208         (OrderedCollection.prototype.at):
2209         (OrderedCollection.prototype.size):
2210         (OrderedCollection.prototype.removeFirst):
2211         (OrderedCollection.prototype.remove):
2212         (Strength):
2213         (Strength.stronger):
2214         (Strength.weaker):
2215         (Strength.weakestOf):
2216         (Strength.strongest):
2217         (Strength.prototype.nextWeaker):
2218         (Constraint):
2219         (Constraint.prototype.addConstraint):
2220         (Constraint.prototype.satisfy):
2221         (Constraint.prototype.destroyConstraint):
2222         (Constraint.prototype.isInput):
2223         (UnaryConstraint):
2224         (UnaryConstraint.prototype.addToGraph):
2225         (UnaryConstraint.prototype.chooseMethod):
2226         (UnaryConstraint.prototype.isSatisfied):
2227         (UnaryConstraint.prototype.markInputs):
2228         (UnaryConstraint.prototype.output):
2229         (UnaryConstraint.prototype.recalculate):
2230         (UnaryConstraint.prototype.markUnsatisfied):
2231         (UnaryConstraint.prototype.inputsKnown):
2232         (UnaryConstraint.prototype.removeFromGraph):
2233         (StayConstraint):
2234         (StayConstraint.prototype.execute):
2235         (EditConstraint.prototype.isInput):
2236         (EditConstraint.prototype.execute):
2237         (BinaryConstraint):
2238         (BinaryConstraint.prototype.chooseMethod):
2239         (BinaryConstraint.prototype.addToGraph):
2240         (BinaryConstraint.prototype.isSatisfied):
2241         (BinaryConstraint.prototype.markInputs):
2242         (BinaryConstraint.prototype.input):
2243         (BinaryConstraint.prototype.output):
2244         (BinaryConstraint.prototype.recalculate):
2245         (BinaryConstraint.prototype.markUnsatisfied):
2246         (BinaryConstraint.prototype.inputsKnown):
2247         (BinaryConstraint.prototype.removeFromGraph):
2248         (ScaleConstraint):
2249         (ScaleConstraint.prototype.addToGraph):
2250         (ScaleConstraint.prototype.removeFromGraph):
2251         (ScaleConstraint.prototype.markInputs):
2252         (ScaleConstraint.prototype.execute):
2253         (ScaleConstraint.prototype.recalculate):
2254         (EqualityConstraint):
2255         (EqualityConstraint.prototype.execute):
2256         (Variable):
2257         (Variable.prototype.addConstraint):
2258         (Variable.prototype.removeConstraint):
2259         (Planner):
2260         (Planner.prototype.incrementalAdd):
2261         (Planner.prototype.incrementalRemove):
2262         (Planner.prototype.newMark):
2263         (Planner.prototype.makePlan):
2264         (Planner.prototype.extractPlanFromConstraints):
2265         (Planner.prototype.addPropagate):
2266         (Planner.prototype.removePropagateFrom):
2267         (Planner.prototype.addConstraintsConsumingTo):
2268         (Plan):
2269         (Plan.prototype.addConstraint):
2270         (Plan.prototype.size):
2271         (Plan.prototype.constraintAt):
2272         (Plan.prototype.execute):
2273         (chainTest):
2274         (projectionTest):
2275         (change):
2276         (deltaBlue):
2277         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2278         (assert):
2279         (Numbers):
2280         (Numbers.prototype.next):
2281         (return.Transpose):
2282         (return.Transpose.prototype.next):
2283         (transpose):
2284         (verifyEven):
2285         (verifyString):
2286         (foo):
2287         (runIterators):
2288         * microbenchmarks/try-catch-word-count.js: Added.
2289         (let.assert):
2290         (EOF):
2291         (let.texts):
2292         (let.o.apply):
2293         (foo):
2294         (bar):
2295         (f):
2296         (run):
2297         (test1):
2298         (test2):
2299         (test3):
2300         (fn):
2301         (A):
2302         (B):
2303         (A.prototype.getValue):
2304         (B.prototype.getParentValue):
2305         (strlen):
2306         (sum.0):
2307         (test):
2308         (result.test.o):
2309         (set add.set add):
2310         (set forEach):
2311         (stringHash):
2312         (set if):
2313         (testFunction):
2314         (set delete.set has.set add):
2315         * stress/catch-set-argument-speculation-failure.js: Added.
2316         (o):
2317         (e):
2318         (e2):
2319         (escape):
2320         (baz):
2321         (noInline.run):
2322         (noInline):
2323         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2324         (foo):
2325         (e):
2326         (baz):
2327         (bar):
2328
2329 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2330
2331         Unreviewed, rolling out r221119, r221124, and r221143.
2332         https://bugs.webkit.org/show_bug.cgi?id=175973
2333
2334         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2335         on #webkit).
2336
2337         Reverted changesets:
2338
2339         "Support compiling catch in the DFG"
2340         https://bugs.webkit.org/show_bug.cgi?id=174590
2341         http://trac.webkit.org/changeset/221119
2342
2343         "Unreviewed, build fix in GTK port"
2344         https://bugs.webkit.org/show_bug.cgi?id=174590
2345         http://trac.webkit.org/changeset/221124
2346
2347         "DFG::JITCode::osrEntry should get sorted since we perform a
2348         binary search on it"
2349         https://bugs.webkit.org/show_bug.cgi?id=175893
2350         http://trac.webkit.org/changeset/221143
2351
2352 2017-08-24  Michael Saboff  <msaboff@apple.com>
2353
2354         Add support for RegExp "dotAll" flag
2355         https://bugs.webkit.org/show_bug.cgi?id=175924
2356
2357         Reviewed by Keith Miller.
2358
2359         Updated tests for new dotAll ('s' flag) changes.
2360
2361         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2362         * stress/static-getter-in-names.js:
2363
2364 2017-08-24  Mark Lam  <mark.lam@apple.com>
2365
2366         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2367         https://bugs.webkit.org/show_bug.cgi?id=175940
2368         <rdar://problem/29003921>
2369
2370         Reviewed by Saam Barati.
2371
2372         * stress/regress-164081.js: Added.
2373         (shouldEqual):
2374         (testcase):
2375
2376 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2377
2378         Skip flaky JSC test stress/test-finally.js.
2379         https://bugs.webkit.org/show_bug.cgi?id=160283
2380
2381         Unreviewed test gardening.
2382
2383         * stress/test-finally.js:
2384
2385 2017-08-23  Saam Barati  <sbarati@apple.com>
2386
2387         Support compiling catch in the DFG
2388         https://bugs.webkit.org/show_bug.cgi?id=174590
2389
2390         Reviewed by Filip Pizlo.
2391
2392         * microbenchmarks/delta-blue-try-catch.js: Added.
2393         (exception):
2394         (value):
2395         (OrderedCollection):
2396         (OrderedCollection.prototype.add):
2397         (OrderedCollection.prototype.at):
2398         (OrderedCollection.prototype.size):
2399         (OrderedCollection.prototype.removeFirst):
2400         (OrderedCollection.prototype.remove):
2401         (Strength):
2402         (Strength.stronger):
2403         (Strength.weaker):
2404         (Strength.weakestOf):
2405         (Strength.strongest):
2406         (Strength.prototype.nextWeaker):
2407         (Constraint):
2408         (Constraint.prototype.addConstraint):
2409         (Constraint.prototype.satisfy):
2410         (Constraint.prototype.destroyConstraint):
2411         (Constraint.prototype.isInput):
2412         (UnaryConstraint):
2413         (UnaryConstraint.prototype.addToGraph):
2414         (UnaryConstraint.prototype.chooseMethod):
2415         (UnaryConstraint.prototype.isSatisfied):
2416         (UnaryConstraint.prototype.markInputs):
2417         (UnaryConstraint.prototype.output):
2418         (UnaryConstraint.prototype.recalculate):
2419         (UnaryConstraint.prototype.markUnsatisfied):
2420         (UnaryConstraint.prototype.inputsKnown):
2421         (UnaryConstraint.prototype.removeFromGraph):
2422         (StayConstraint):
2423         (StayConstraint.prototype.execute):
2424         (EditConstraint.prototype.isInput):
2425         (EditConstraint.prototype.execute):
2426         (BinaryConstraint):
2427         (BinaryConstraint.prototype.chooseMethod):
2428         (BinaryConstraint.prototype.addToGraph):
2429         (BinaryConstraint.prototype.isSatisfied):
2430         (BinaryConstraint.prototype.markInputs):
2431         (BinaryConstraint.prototype.input):
2432         (BinaryConstraint.prototype.output):
2433         (BinaryConstraint.prototype.recalculate):
2434         (BinaryConstraint.prototype.markUnsatisfied):
2435         (BinaryConstraint.prototype.inputsKnown):
2436         (BinaryConstraint.prototype.removeFromGraph):
2437         (ScaleConstraint):
2438         (ScaleConstraint.prototype.addToGraph):
2439         (ScaleConstraint.prototype.removeFromGraph):
2440         (ScaleConstraint.prototype.markInputs):
2441         (ScaleConstraint.prototype.execute):
2442         (ScaleConstraint.prototype.recalculate):
2443         (EqualityConstraint):
2444         (EqualityConstraint.prototype.execute):
2445         (Variable):
2446         (Variable.prototype.addConstraint):
2447         (Variable.prototype.removeConstraint):
2448         (Planner):
2449         (Planner.prototype.incrementalAdd):
2450         (Planner.prototype.incrementalRemove):
2451         (Planner.prototype.newMark):
2452         (Planner.prototype.makePlan):
2453         (Planner.prototype.extractPlanFromConstraints):
2454         (Planner.prototype.addPropagate):
2455         (Planner.prototype.removePropagateFrom):
2456         (Planner.prototype.addConstraintsConsumingTo):
2457         (Plan):
2458         (Plan.prototype.addConstraint):
2459         (Plan.prototype.size):
2460         (Plan.prototype.constraintAt):
2461         (Plan.prototype.execute):
2462         (chainTest):
2463         (projectionTest):
2464         (change):
2465         (deltaBlue):
2466         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2467         (assert):
2468         (Numbers):
2469         (Numbers.prototype.next):
2470         (return.Transpose):
2471         (return.Transpose.prototype.next):
2472         (transpose):
2473         (verifyEven):
2474         (verifyString):
2475         (foo):
2476         (runIterators):
2477         * microbenchmarks/try-catch-word-count.js: Added.
2478         (let.assert):
2479         (EOF):
2480         (let.texts):
2481         (let.o.apply):
2482         (foo):
2483         (bar):
2484         (f):
2485         (run):
2486         (test1):
2487         (test2):
2488         (test3):
2489         (fn):
2490         (A):
2491         (B):
2492         (A.prototype.getValue):
2493         (B.prototype.getParentValue):
2494         (strlen):
2495         (sum.0):
2496         (test):
2497         (result.test.o):
2498         (set add.set add):
2499         (set forEach):
2500         (stringHash):
2501         (set if):
2502         (testFunction):
2503         (set delete.set has.set add):
2504         * stress/catch-set-argument-speculation-failure.js: Added.
2505         (o):
2506         (e):
2507         (e2):
2508         (escape):
2509         (baz):
2510         (noInline.run):
2511         (noInline):
2512         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2513         (foo):
2514         (e):
2515         (baz):
2516         (bar):
2517
2518 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2519
2520         [JSC] Optimize Map iteration with intrinsic
2521         https://bugs.webkit.org/show_bug.cgi?id=174355
2522
2523         Reviewed by Saam Barati.
2524
2525         * stress/map-iterator-result-should-have-expected-shape.js: Added.
2526         (shouldBe):
2527         (throw.new.Error):
2528         * stress/set-iterator-result-should-have-expected-shape.js: Added.
2529         (shouldBe):
2530         (throw.new.Error.let.iterator.set Symbol):
2531         (throw.new.Error.set add):
2532         (let.iterator.set Symbol):
2533
2534 2017-08-23  Robin Morisset  <rmorisset@apple.com>
2535
2536         Add a micro-benchmark for checking that accessing a variable within a 'with'
2537         block does not automatically prevent type prediction.
2538         https://bugs.webkit.org/show_bug.cgi?id=175738
2539
2540         Reviewed by Saam Barati.
2541
2542         * stress/with_and_arith.js: Added.
2543         (with):
2544
2545 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
2546
2547         [ESNext] Async iteration - Implement Async Generator - runtime
2548         https://bugs.webkit.org/show_bug.cgi?id=175240
2549
2550         Reviewed by Yusuke Suzuki.
2551
2552         * stress/async-iteration-async-from-sync.js: Added.
2553         (assert):
2554         (const.Logger):
2555         (this.fullfilled):
2556         (this.fullfilledDone):
2557         (this.rejected):
2558         (this.catched):
2559         (this.isFinal):
2560         (_assertLogger):
2561         (const.assertLogger):
2562         (const.getPromise.promiseHolder.return.new.Promise):
2563         (foo):
2564         (async.boo):
2565         (bar):
2566         (async.baz):
2567         (async.goo):
2568         * stress/async-iteration-basic.js: Added.
2569         (assert):
2570         (const.Logger):
2571         (this.fullfilled):
2572         (this.fullfilledDone):
2573         (this.rejected):
2574         (this.catched):
2575         (this.isFinal):
2576         (_assertLogger):
2577         (const.assertLogger):
2578         (const.getPromise.promiseHolder.return.new.Promise):
2579         (async.generator):
2580         (iterator.next.then):
2581         (async.baz):
2582         (async.boo):
2583         (async.foo):
2584         (async.goo):
2585         (A.prototype.async.foo):
2586         (A.prototype.async.boo):
2587         (A):
2588         (asyncGenExp.async):
2589         (async.joo):
2590         (j.next.then):
2591         (then):
2592         (async.koo):
2593         (async.loo):
2594         (async.moo):
2595         (async.noo):
2596         (async.ooo):
2597         (async.roo):
2598         (async.poo):
2599         (async.soo):
2600         (async.too):
2601         * stress/async-iteration-evaluation.js: Added.
2602         (assert):
2603         (async.foo):
2604         (catch):
2605         * stress/async-iteration-syntax.js:
2606         * stress/async-iteration-yield-promise.js: Added.
2607         (assert):
2608         (const.Logger):
2609         (this.fullfilled):
2610         (this.fullfilledDone):
2611         (this.rejected):
2612         (this.catched):
2613         (this.isFinal):
2614         (_assertLogger):
2615         (const.assertLogger):
2616         (const.getPromise.promiseHolder.return.new.Promise):
2617         (async.foo):
2618         (async.boo):
2619         (async.bar):
2620         * stress/async-iteration-yield-star-interface.js: Added.
2621         (assert):
2622         (const.getPromise.promiseHolder.return.new.Promise):
2623         (const.Logger):
2624         (this.fullfilled):
2625         (this.fullfilledDone):
2626         (this.rejected):
2627         (this.catched):
2628         (this.custom):
2629         (this.isFinal):
2630         (_assertLogger):
2631         (const.assertLogger):
2632         (let.asyncIter.Symbol.asyncIterator):
2633         (let.asyncIter.next):
2634         (let.asyncIter.throw):
2635         (let.asyncIter.return):
2636         (async.foo):
2637         (asyncIter.Symbol.asyncIterator):
2638         (asyncIter.next):
2639         (async.boo):
2640         (asyncIter.return):
2641         (async.bar):
2642         (async.baz):
2643         (async.foobar):
2644         * stress/async-iteration-yield-star.js: Added.
2645         (assert):
2646         (const.Logger):
2647         (this.fullfilled):
2648         (this.fullfilledDone):
2649         (this.rejected):
2650         (this.catched):
2651         (this.custom):
2652         (this.isFinal):
2653         (_assertLogger):
2654         (const.assertLogger):
2655         (const.getPromise.promiseHolder.return.new.Promise):
2656         (async.foo):
2657         (async.boo):
2658         (async.bar):
2659         (async.baz):
2660         (async.joo):
2661         (async.goo):
2662         (async.koo):
2663         (async.loo):
2664         (let.asyncIter.Symbol.asyncIterator):
2665         (let.asyncIter.next):
2666         (let.asyncIter.throw):
2667         (let.asyncIter.return):
2668         (async.moo):
2669         (async.noo):
2670         * test262.yaml:
2671
2672 2017-08-23  JF Bastien  <jfbastien@apple.com>
2673
2674         Fix printing in test
2675
2676         Unreviewed: fixing verbosity, shouldn't have been there.
2677
2678         * wasm/regress/175693.js:
2679         (else.else):
2680         (catch):
2681
2682 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
2683
2684         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
2685         https://bugs.webkit.org/show_bug.cgi?id=172543
2686
2687         Unreviewed test gardening.
2688
2689         * microbenchmarks/generator-with-several-types.js:
2690
2691 2017-08-17  JF Bastien  <jfbastien@apple.com>
2692
2693         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
2694         https://bugs.webkit.org/show_bug.cgi?id=175693
2695         <rdar://problem/33952443>
2696
2697         Reviewed by Saam Barati.
2698
2699         Add a regression directory for WebAssembly tests.
2700
2701         * wasm.yaml:
2702         * wasm/regress/175693.js: Added.
2703         (else.else):
2704         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
2705         (catch):
2706         * wasm/regress/175693.wasm: Added.
2707
2708 2017-08-15  Robin Morisset  <rmorisset@apple.com>
2709
2710         Support the 'with' keyword in FTL.
2711         https://bugs.webkit.org/show_bug.cgi?id=175585
2712
2713         Reviewed by Saam Barati.
2714
2715         Also improve the JSTest/stress/with.js file to test
2716         what happens when non-objects are passed to with.
2717
2718         * stress/with.js:
2719         (foo):
2720         (i.catch):
2721         (i.with): Deleted.
2722
2723 2017-08-14  Keith Miller  <keith_miller@apple.com>
2724
2725         Add testing tool to lie to the DFG about profiles
2726         https://bugs.webkit.org/show_bug.cgi?id=175487
2727
2728         Reviewed by Saam Barati.
2729
2730         * stress/compare-eq-incomplete-profile.js: Added.
2731         (const.test.createBuiltin):
2732
2733 2017-08-14  Robin Morisset  <rmorisset@apple.com>
2734
2735         Support the with keyword in DFG
2736         https://bugs.webkit.org/show_bug.cgi?id=175470
2737
2738         Reviewed by Saam Barati.
2739
2740         Added a new stress-test for the 'with' keyword, that caught a bug in a
2741         previous version of this code.
2742
2743         * stress/with.js: Added.
2744         (i.with):
2745
2746 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
2747
2748         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
2749         https://bugs.webkit.org/show_bug.cgi?id=175544
2750
2751         Unreviewed test gardening.
2752
2753         * ChakraCore.yaml:
2754
2755 2017-08-09  Caitlin Potter  <caitp@igalia.com>
2756
2757         Early error on ANY operator before new.target
2758         https://bugs.webkit.org/show_bug.cgi?id=157970
2759
2760         Reviewed by Saam Barati.
2761
2762         Instead of throwing if any unary operator precedes new.target, only
2763         throw if the unary operator updates the reference.
2764
2765         The following become legal in JSC:
2766
2767         ```
2768         !new.target
2769         ~new.target
2770         typeof new.target
2771         delete new.target
2772         void new.target
2773         ```
2774
2775         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
2776
2777         * stress/new-target-syntax-errors.js:
2778         * stress/new-target.js:
2779
2780 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
2781
2782         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
2783         https://bugs.webkit.org/show_bug.cgi?id=175255
2784
2785         Unreviewed test gardening.
2786
2787         * stress/regress-169783.js:
2788         * wasm/stress/oom.js:
2789
2790 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2791
2792         REGRESSION: 2 test262/test/language/statements/async-function failures
2793         https://bugs.webkit.org/show_bug.cgi?id=175334
2794
2795         Reviewed by Yusuke Suzuki.
2796
2797         Add @skip parameters to tests, and remove test for async iterator from 
2798         async await syntax test because it is already covered by async-iterator-syntax.js
2799
2800         * stress/async-await-syntax.js:
2801         * stress/async-iteration-syntax.js:
2802
2803 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2804
2805         Unreviewed, gardening test262 for Promise resolve / reject function length
2806         https://bugs.webkit.org/show_bug.cgi?id=175333
2807
2808         * test262.yaml:
2809
2810 2017-08-07  Robin Morisset  <rmorisset@apple.com>
2811
2812         GetOwnProperty of TypedArray indexed fields is wrongly configurable
2813         https://bugs.webkit.org/show_bug.cgi?id=175307
2814
2815         Reviewed by Saam Barati.
2816
2817         * stress/typedarray-getownproperty-not-configurable.js: Added.
2818         (assert):
2819         (foo):
2820
2821 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2822
2823         Promise resolve and reject function should have length = 1
2824         https://bugs.webkit.org/show_bug.cgi?id=175242
2825
2826         Reviewed by Saam Barati.
2827
2828         * stress/builtin-function-length.js: Added.
2829         (shouldBe):
2830         (shouldThrow):
2831         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2832         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2833
2834 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2835
2836         [ESNext] Async iteration - Implement Async Generator - parser
2837         https://bugs.webkit.org/show_bug.cgi?id=175210
2838
2839         Reviewed by Yusuke Suzuki.
2840
2841         * stress/async-await-syntax.js:
2842         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2843         * stress/async-iteration-syntax.js: Added.
2844         (assert):
2845         (checkSyntax):
2846         (checkSyntaxError):
2847         (checkSimpleAsyncGeneratorSloppyMode):
2848         (checkSimpleAsyncGeneratorStrictMode):
2849         (checkNestedAsyncGenerators):
2850         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2851         * stress/generator-class-methods-syntax.js:
2852
2853 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2854
2855         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
2856         https://bugs.webkit.org/show_bug.cgi?id=175150
2857
2858         Unreviewed test gardening.
2859
2860         * wasm/js-api/test_memory_constructor.js:
2861
2862 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2863
2864         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
2865         https://bugs.webkit.org/show_bug.cgi?id=175100
2866
2867         Reviewed by Mark Lam.
2868
2869         The JSC test JSTests/wasm/stress/oom.js tries to use all the
2870         available memory until an out of memory exception happens.
2871
2872         The Linux kernel is more tuned for server workloads than for GUI
2873         responsiveness. When a process tries to use a lot of memory, Linux
2874         will do its best to serve the request. This usually translates to
2875         free physical RAM by writing to disk dirty pages and/or moving out
2876         less recently used pages to swap (disk storage).
2877         Meanwhile it does this, the system will become unresponsive and this
2878         leads to freezes that can last even some minutes on the worst cases.
2879
2880         Therefore, let's skip this test on Linux as it will cause more harm
2881         than good on the Linux bots or on the machines of Linux developers.
2882
2883         * wasm/stress/oom.js:
2884
2885 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2886
2887         [JSC] Remove unnecessary print from stress\promise-finally.js test
2888         https://bugs.webkit.org/show_bug.cgi?id=175015
2889
2890         Reviewed by Yusuke Suzuki.
2891
2892         * stress/promise-finally.js:
2893         (p.finally):
2894         (then):
2895
2896 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2897
2898         Unreviewed, update test262 results for optional catch binding
2899
2900         * test262.yaml:
2901
2902 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2903
2904         [JSC] Support optional catch binding
2905         https://bugs.webkit.org/show_bug.cgi?id=174981
2906
2907         Reviewed by Saam Barati.
2908
2909         * stress/optional-catch-binding-syntax.js: Added.
2910         (testSyntax):
2911         (testSyntaxError):
2912         (catch.catch):
2913         * stress/optional-catch-binding.js: Added.
2914         (shouldBe):
2915         (throwException):
2916
2917 2017-07-28  Mark Lam  <mark.lam@apple.com>
2918
2919         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
2920         https://bugs.webkit.org/show_bug.cgi?id=174948
2921         <rdar://problem/33495680>
2922
2923         Reviewed by Filip Pizlo.
2924
2925         * stress/regress-174948.js: Added.
2926
2927 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2928
2929         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
2930         https://bugs.webkit.org/show_bug.cgi?id=174900
2931
2932         Reviewed by Saam Barati.
2933
2934         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
2935         (sideEffect):
2936         (args):
2937         (test):
2938
2939 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2940
2941         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
2942         https://bugs.webkit.org/show_bug.cgi?id=171637
2943
2944         Reviewed by Darin Adler.
2945
2946         * stress/domjit-getter-complex-with-incorrect-object.js:
2947         (i.shouldThrow):
2948         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
2949         (shouldBe):
2950         (i.shouldThrow):
2951
2952 2017-07-26  JF Bastien  <jfbastien@apple.com>
2953
2954         WebAssembly: test throwing out of the start function
2955         https://bugs.webkit.org/show_bug.cgi?id=165714
2956         <rdar://problem/29760251>
2957
2958         Reviewed by Keith Miller.
2959
2960         * wasm/assert.js:
2961         * wasm/function-tests/trap-from-start.js: Added.
2962         (StartTraps):
2963         * wasm/function-tests/trap-from-start-async.js: Added.
2964         (async.StartTrapsAsync):
2965
2966 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2967
2968         [FTL] Arguments elimination is suppressed by unreachable blocks
2969         https://bugs.webkit.org/show_bug.cgi?id=174352
2970
2971         Reviewed by Filip Pizlo.
2972
2973         * stress/arguments-elimination-force-exit.js: Added.
2974         (shouldBe):
2975         (strict):
2976         (sloppy):
2977         * stress/arguments-elimination-throw.js: Added.
2978         (shouldBe):
2979         (shouldThrow):
2980         (sloppy):
2981         (isArguments):
2982
2983 2017-07-13  Mark Lam  <mark.lam@apple.com>
2984
2985         Add some additional test cases for bug 170896.
2986         https://bugs.webkit.org/show_bug.cgi?id=174491
2987
2988         Reviewed by Filip Pizlo.
2989
2990         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
2991         * stress/regress-170896-with-double-shape-profile.js: Added.
2992         (test):
2993         * stress/regress-170896-with-int32-shape-profile.js: Added.
2994         (test):
2995         * stress/regress-170896.js: Removed.
2996
2997 2017-07-13  Saam Barati  <sbarati@apple.com>
2998
2999         Missing exception check in JSObject::hasInstance
3000         https://bugs.webkit.org/show_bug.cgi?id=174455
3001         <rdar://problem/31384608>
3002
3003         Reviewed by Mark Lam.
3004
3005         * stress/has-instance-exception-check.js: Added.
3006         (assert):
3007         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3008
3009 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3010
3011         [ESnext] Implement Object Spread
3012         https://bugs.webkit.org/show_bug.cgi?id=167963
3013
3014         Reviewed by Saam Barati.
3015
3016         * stress/obj-rest-destructuring-order.js: Added.
3017         (assert):
3018         (o.get z):
3019         (o.get a):
3020         * stress/obj-spread-order.js: Added.
3021         (assert):
3022         (o.get z):
3023         (o.get a):
3024         * stress/object-spread.js: Added.
3025         (let.assert):
3026         (assert.sameValue):
3027         (let.o.get a):
3028         (let.obj.get c):
3029         (cthulhu.get x):
3030         (let.obj.set c):
3031         (calls.o.get z):
3032         (calls.o.get a):
3033         (try.let.obj.get foo):
3034         (get calls):
3035
3036 2017-07-12  Saam Barati  <sbarati@apple.com>
3037
3038         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3039         https://bugs.webkit.org/show_bug.cgi?id=174411
3040         <rdar://problem/31696186>
3041
3042         Reviewed by Mark Lam.
3043
3044         * stress/generic-arguments-correct-delete-behavior.js: Added.
3045         (assert):
3046         (makeTest):
3047
3048 2017-07-07  Mark Lam  <mark.lam@apple.com>
3049
3050         \n\r is not the same as \r\n.
3051         https://bugs.webkit.org/show_bug.cgi?id=173053
3052
3053         Reviewed by Keith Miller.
3054
3055         * stress/regress-173053.js: Added.
3056         * stress/template-literal-line-terminators.js:
3057
3058 2017-07-06  Saam Barati  <sbarati@apple.com>
3059
3060         We are missing places where we invalidate the for-in context
3061         https://bugs.webkit.org/show_bug.cgi?id=174184
3062
3063         Reviewed by Geoffrey Garen.
3064
3065         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3066         (assert):
3067         (test):
3068
3069 2017-07-05  Saam Barati  <sbarati@apple.com>
3070
3071         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3072         https://bugs.webkit.org/show_bug.cgi?id=174188
3073         <rdar://problem/30581423>
3074
3075         Reviewed by Mark Lam.
3076
3077         * stress/new-array-having-a-bad-time-double.js: Added.
3078         (assert):
3079         (foo):
3080
3081 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3082
3083         WTF::StringImpl::copyChars segfaults when built with GCC 7
3084         https://bugs.webkit.org/show_bug.cgi?id=173407
3085
3086         Reviewed by Andreas Kling.
3087
3088         * stress/string-repeat-copy-chars-crash.js: Added.
3089         (shouldBe):
3090
3091 2017-07-03  Saam Barati  <sbarati@apple.com>
3092
3093         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3094
3095         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3096
3097 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3098
3099         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3100
3101         It requires too much memory.
3102
3103         * stress/dont-reserve-huge-capacity-lexer.js:
3104
3105 2017-06-30  Michael Saboff  <msaboff@apple.com>
3106
3107         Skip a test on ARM64 platform since we run out of address space.
3108
3109         Rubber stamped by Saam Barati.
3110
3111         * stress/dont-reserve-huge-capacity-lexer.js:
3112
3113 2017-06-30  Michael Saboff  <msaboff@apple.com>
3114
3115         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3116         https://bugs.webkit.org/show_bug.cgi?id=174044
3117
3118         Reviewed by Oliver Hunt.
3119
3120         New regression test.
3121
3122         * stress/regress-174044.js: Added.
3123         (test1):
3124         (test2):
3125
3126 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3127
3128         RegExpCachedResult::setInput should reify left and right contexts
3129         https://bugs.webkit.org/show_bug.cgi?id=173818
3130
3131         Reviewed by Keith Miller.
3132
3133         * stress/right-left-context-invalidated-by-input.js: Added.
3134         (test.validateContexts):
3135         (test):
3136
3137 2017-06-29  Saam Barati  <sbarati@apple.com>
3138
3139         Calculating postCapacity in unshiftCountSlowCase is wrong
3140         https://bugs.webkit.org/show_bug.cgi?id=173992
3141         <rdar://problem/32283199>
3142
3143         Reviewed by Keith Miller.
3144
3145         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3146         (temp):
3147
3148 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3149
3150         Unreviewed, rolling out r218512.
3151         https://bugs.webkit.org/show_bug.cgi?id=173981
3152
3153         "It changes the behavior of the JS API's JSEvaluateScript
3154         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3155
3156         Reverted changeset:
3157
3158         "test262: Completion values for control flow do not match the
3159         spec"
3160         https://bugs.webkit.org/show_bug.cgi?id=171265
3161         http://trac.webkit.org/changeset/218512
3162
3163 2017-06-27  JF Bastien  <jfbastien@apple.com>
3164
3165         WebAssembly: running out of executable memory should throw OoM
3166         https://bugs.webkit.org/show_bug.cgi?id=171537
3167         <rdar://problem/32963338>
3168
3169         Reviewed by Saam Barati.
3170
3171         * wasm.yaml:
3172         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3173         (const.invoke):
3174         (failCount.0.catch):
3175         (failCount.0.module.undefined.catch):
3176         * wasm/lowExecutableMemory/exports-oom.js: Added.
3177         (const.type):
3178         (const.params):
3179         (const.randomProgram):
3180         (failCount.0.catch):
3181         (failCount.0.module.undefined.catch):
3182         * wasm/lowExecutableMemory/imports-oom.js: Added.
3183         (const.type):
3184         (const.params):
3185         (const.randomProgram):
3186         (f.imports.push):
3187         (failCount.0.catch):
3188         (failCount.0.module.undefined.catch):
3189
3190 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3191
3192         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3193         https://bugs.webkit.org/show_bug.cgi?id=167962
3194
3195         Reviewed by Saam Barati.
3196
3197         * stress/object-rest-deconstruct.js: Added.
3198         (let.assert):
3199         (let.assertPropDescriptor):
3200         (catch):
3201         (get 3):
3202         (foo):
3203         (let.src.get y):
3204         (let.src.set y):
3205         (let.gen):
3206
3207 2017-06-27  Saam Barati  <sbarati@apple.com>
3208
3209         Function constructor needs to follow the spec and validate parameters and body independently
3210         https://bugs.webkit.org/show_bug.cgi?id=173303
3211         <rdar://problem/32732526>
3212
3213         Reviewed by Keith Miller.
3214
3215         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3216         * stress/function-constructor-semantics.js: Added.
3217         (assert):
3218         (hasSyntaxError):
3219         (foo):
3220         (async.foo):
3221         (testError):
3222         (testOK.toString):
3223         (toString):
3224
3225 2017-06-26  Saam Barati  <sbarati@apple.com>
3226
3227         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3228         https://bugs.webkit.org/show_bug.cgi?id=173740
3229
3230         Reviewed by Mark Lam.
3231
3232         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3233         (Array.prototype.Symbol.iterator):
3234
3235 2017-06-26  Saam Barati  <sbarati@apple.com>
3236
3237         Skip a test on 32-bit platforms since we run out of address space.
3238
3239         Rubber stamped by Mark Lam.
3240
3241         * stress/dont-reserve-huge-capacity-lexer.js:
3242
3243 2017-06-26  Saam Barati  <sbarati@apple.com>
3244
3245         Crash in JSC::Lexer<unsigned char>::setCode
3246         https://bugs.webkit.org/show_bug.cgi?id=172754
3247
3248         Reviewed by Mark Lam.
3249
3250         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3251         (catch):
3252
3253 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3254
3255         [JSC] Clean up Object.entries implementation
3256         https://bugs.webkit.org/show_bug.cgi?id=173759
3257
3258         Reviewed by Sam Weinig.
3259
3260         * microbenchmarks/object-entries.js: Added.
3261         (test):
3262
3263 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3264
3265         Remove Reflect.enumerate
3266         https://bugs.webkit.org/show_bug.cgi?id=173806
3267
3268         Reviewed by Yusuke Suzuki.
3269
3270         * ChakraCore.yaml:
3271         * es6.yaml:
3272         These tests now fail because they use Reflect.enumerate.
3273
3274         * test262.yaml:
3275         This test now passes, it checked that Reflect.enumerate is undefined!
3276
3277         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3278         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3279
3280         * stress/reflect-enumerate.js: Removed.
3281         Remove a test solely for Reflect.enumerate.
3282
3283 2017-06-22  Saam Barati  <sbarati@apple.com>
3284
3285         ValueRep(DoubleRep(@v)) can not simply convert to @v
3286         https://bugs.webkit.org/show_bug.cgi?id=173687
3287         <rdar://problem/32855563>
3288
3289         Reviewed by Mark Lam.
3290
3291         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3292         (i.catch):
3293
3294 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3295
3296         [JSC] Object.values should be implemented in C++
3297         https://bugs.webkit.org/show_bug.cgi?id=173703
3298
3299         Reviewed by Sam Weinig.
3300
3301         * microbenchmarks/object-keys-map-values.js: Added.
3302         (test):
3303         * microbenchmarks/object-values.js: Added.
3304         (test):
3305         * stress/object-values-changing-properties.js: Added.
3306         (shouldBe):
3307         (throw.new.Error.let.source.get x):
3308         (throw.new.Error):
3309         (shouldBe.let.handler.get order):
3310         (get let):
3311         (shouldBe.let.handler.get return):
3312         (let.handler.get order):
3313
3314 2017-06-21  Saam Barati  <sbarati@apple.com>
3315
3316         eval virtual call is incorrect in the baseline JIT
3317         https://bugs.webkit.org/show_bug.cgi?id=173587
3318         <rdar://problem/32867897>
3319
3320         Reviewed by Michael Saboff.
3321
3322         * stress/do-eval-virtual-call-correctly.js: Added.
3323         (assert):
3324         (f):
3325         (i.test):
3326         (catch):
3327
3328 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3329
3330         Update test262 test expectations after r218581.
3331
3332         Unreviewed test gardening.
3333
3334         * test262.yaml:
3335
3336 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
3337
3338         Revert changes in bug#160417 about extending `null` not being a derived class
3339         https://bugs.webkit.org/show_bug.cgi?id=169293
3340
3341         Reviewed by Saam Barati.
3342
3343         * stress/class-derived-from-null.js:
3344         (assertThrow):
3345         (test1):
3346         (test2):
3347         (test3):
3348         (test4):
3349         (test5):
3350         (test6):
3351
3352 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3353
3354         [DFG] More ArrayIndexOf fixups for various types
3355         https://bugs.webkit.org/show_bug.cgi?id=173176
3356
3357         Reviewed by Saam Barati.
3358
3359         * stress/array-indexof-arraystorage.js: Added.
3360         (shouldBe):
3361         (indexOfInt32Other):
3362         (indexOfInt32Cell):
3363         (indexOfInt32Boolean):
3364         (indexOfDoubleOther):
3365         (indexOfDoubleCell):
3366         (indexOfDoubleBoolean):
3367         (indexOfInt32):
3368         (indexOfDouble):
3369         * stress/array-indexof-constant-folding.js: Added.
3370         (shouldBe):
3371         (indexOfInt32Other):
3372         (indexOfInt32Cell):
3373         (indexOfInt32Boolean):
3374         (indexOfDoubleOther):
3375         (indexOfDoubleCell):
3376         (indexOfDoubleBoolean):
3377         * stress/array-indexof-hole-and-other.js: Added.
3378         (shouldBe):
3379         (indexOf):
3380         * stress/array-indexof-other.js: Added.
3381         (shouldBe):
3382         (indexOfInt32):
3383         (indexOfDouble):
3384         (indexOfString):
3385         (indexOfObject):
3386         * stress/array-indexof-symbol.js: Added.
3387         (shouldBe):
3388         (indexOfInt32):
3389         (indexOfDouble):
3390         (indexOfString):
3391         (indexOfObject):
3392
3393 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
3394
3395         test262: Completion values for control flow do not match the spec
3396         https://bugs.webkit.org/show_bug.cgi?id=171265
3397
3398         Reviewed by Saam Barati.
3399
3400         * stress/completion-value.js:
3401         Condensed test for completion values in top level statements.
3402
3403         * stress/super-get-by-id.js:
3404         ClassDeclaration when evaled no longer produce values. Convert
3405         these to ClassExpressions so they produce the class value.
3406         
3407         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3408         This is a progression for currect spec behavior.
3409
3410         * mozilla/mozilla-tests.yaml:
3411         This test is now outdated, so mark it as failing for that reason.
3412
3413         * test262.yaml:
3414         Passing all "cptn" completion value tests.
3415
3416 2017-06-17  Keith Miller  <keith_miller@apple.com>
3417
3418         ArrayBuffer constructor needs to create subclass structures before its buffer
3419         https://bugs.webkit.org/show_bug.cgi?id=173510
3420
3421         Reviewed by Yusuke Suzuki.
3422
3423         * test262.yaml:
3424
3425 2017-06-17  Keith Miller  <keith_miller@apple.com>
3426
3427         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
3428         https://bugs.webkit.org/show_bug.cgi?id=173506
3429
3430         Reviewed by Ryosuke Niwa.
3431
3432         Re-baseline tests.
3433
3434         * ChakraCore/test/Function/apply3.baseline-jsc:
3435         * test262.yaml:
3436
3437 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3438
3439         [JSC] Add fast path for Object.assign
3440         https://bugs.webkit.org/show_bug.cgi?id=173416
3441
3442         Reviewed by Mark Lam.
3443
3444         * stress/object-assign-changing-properties.js: Added.
3445         (shouldBe):
3446         (throw.new.Error.let.source.get x):
3447         (throw.new.Error):
3448         (shouldBe.let.source.get x):
3449         (shouldBe.let.target.set x):
3450         (shouldBe.let.target.get x):
3451         * stress/object-assign-proxy.js: Added.
3452         (shouldBe):
3453         (throw.new.Error.let.handler.get order):
3454
3455 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3456
3457         [JSC] Implement Object.assign in C++
3458         https://bugs.webkit.org/show_bug.cgi?id=173414
3459
3460         Reviewed by Saam Barati.
3461
3462         * stress/object-assign-string-first.js: Added.
3463         (shouldBe):
3464         (source.get Symbol):
3465         (source.get 1):
3466         (source.get cocoa):
3467
3468 2017-06-14  JF Bastien  <jfbastien@apple.com>
3469
3470         WebAssembly: remove empty test files
3471         https://bugs.webkit.org/show_bug.cgi?id=173382
3472
3473         Reviewed by Saam Barati.
3474
3475         The following files:
3476                 JSTests/wasm/function-tests/call-indirect-params.js
3477                 JSTests/wasm/function-tests/call-indirect.js
3478                 JSTests/wasm/js-api/call-indirect-results.js
3479         Were changed to empty files in https://trac.webkit.org/changeset/209771
3480
3481         They were testing call_indirect with the wrong semantics, before
3482         we implemented tables. That change implemented tables and
3483         therefore removed the erroneous tests.
3484
3485         We have a few tests for call_indirect which already do the right thing:
3486                 JSTests/wasm/function-tests/context-switch.js
3487                 JSTests/wasm/function-tests/exceptions.js
3488                 JSTests/wasm/function-tests/grow-memory-2.js
3489                 JSTests/wasm/function-tests/stack-overflow.js
3490                 JSTests/wasm/function-tests/table-basic-2.js
3491                 JSTests/wasm/function-tests/table-basic.js
3492                 JSTests/wasm/js-api/call-indirect.js
3493                 JSTests/wasm/js-api/table.js
3494                 JSTests/wasm/js-api/unique-signature.js
3495                 JSTests/wasm/js-api/wrapper-function.js
3496
3497         I also just imported the updated spec tests which, among other
3498         things, test call_indirect:
3499                 core/br.wast
3500                 core/br_table.wast
3501                 core/call_indirect.wast
3502                 core/func.wast
3503                 core/func_ptrs.wast
3504                 core/imports.wast
3505                 core/left-to-right.wast
3506                 core/linking.wast
3507                 core/nop.wast
3508                 core/return.wast
3509                 core/typecheck.wast
3510                 core/unreachable.wast
3511
3512         So I think it's OK to just delete the tests which should just have
3513         been deleted back when tables were added.
3514
3515         * wasm/function-tests/call-indirect-params.js: Removed.
3516         * wasm/function-tests/call-indirect.js: Removed.
3517         * wasm/js-api/call-indirect-results.js: Removed.
3518
3519 2017-06-13  JF Bastien  <jfbastien@apple.com>
3520
3521         WebAssembly: import updated spec tests
3522         https://bugs.webkit.org/show_bug.cgi?id=173287
3523         <rdar://problem/32725975>
3524
3525         Reviewed by Saam Barati.
3526
3527         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
3528         with a few modifications so things work.
3529
3530         Fix a bunch of bugs found through this process, and punt a few tests (which I
3531         marked as blocked by this bug).
3532
3533         Fixes:
3534
3535         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
3536         instead of byte alignment. It was also missing memory-alignment.js despite it
3537         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
3538         pass.
3539
3540         Tables can be imported or in a section. There can be only one, but sections can
3541         be empty. An Elements section can exist if there's no Table, as long as it is
3542         also empty.
3543
3544         Memories can be imported or in a section. There can be only one, but sections
3545         can be empty. A Data section can exist if there's no Memory, as long as it is
3546         also empty.
3547
3548         Prototypes: stringify without .prototype. in the string.
3549
3550         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
3551         not a final size, and throws a RangeError on failure, not a TypeError.
3552
3553         Fix compile / instantiate so the reject the promise if given an argument of the
3554         wrong type (instead of failing instantly).
3555
3556         Fix async on neuter test.
3557
3558         Element section shouldn't affect any Table if any of the elements are out of
3559         bounds. We need to process it in two passes.
3560
3561         Segment section shouldn't affect any Data if any of the segments are out of
3562         bounds. We need to process it in two passes.
3563
3564         Empty data segments are valid, but only when there is no memory. Their index
3565         still gets validated, and has to be zero.
3566
3567         Punts:
3568
3569         Error messages with context, the test seems overly restrictive but this is
3570         minor.
3571
3572         compile/instantiate/validate property descriptors.
3573
3574         UTF-8 bugs.
3575
3576         Temporarily disable NaN tests. We need to go back and implement the following
3577         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
3578         much as getting all the other tests passing.
3579
3580         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
3581         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
3582         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
3583         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
3584         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
3585         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
3586         why they're not allowed.
3587
3588         * wasm.yaml:
3589         * wasm/function-tests/i32-load8-s.js:
3590         * wasm/function-tests/memory-access-past-4gib.js:
3591         (const.op.of.WASM.opcodes):
3592         * wasm/function-tests/memory-alignment.js: Added.
3593         (const.op.of.WASM.opcodes):
3594         * wasm/function-tests/memory-section-and-import.js:
3595         * wasm/js-api/Module-compile.js:
3596         (async.testPromiseAPI):
3597         * wasm/js-api/dont-mmap-zero-byte-memory.js:
3598         (testMems):
3599         * wasm/js-api/element.js:
3600         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3601         * wasm/js-api/neutered-inputs.js:
3602         (const.testFunction): Deleted.
3603         (const.testConstructor): Deleted.
3604         * wasm/js-api/table.js:
3605         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3606         (new.WebAssembly.Module):
3607         (assert.throws):
3608         (assertBadTableImport):
3609         (assert.throws.WebAssembly.Table.prototype.grow):
3610         (assertBadTableInstance): Deleted.
3611         * wasm/js-api/test_Data.js:
3612         (DataSectionWithoutMemory):
3613         * wasm/spec-harness/index.js:
3614         (module):
3615         (uniqueTest): Deleted.
3616         (assert_invalid): Deleted.
3617         (assert_soft_invalid): Deleted.
3618         (register): Deleted.
3619         (call): Deleted.
3620         (get instance): Deleted.
3621         (exports): Deleted.
3622         (run): Deleted.
3623         (assert_unlinkable): Deleted.
3624         (assert_uninstantiable): Deleted.
3625         (assert_trap): Deleted.
3626         (try.f): Deleted.
3627         (catch): Deleted.
3628         (assert_exhaustion): Deleted.
3629         (assert_return): Deleted.
3630         (assert_return_nan): Deleted.
3631         * wasm/spec-harness/testharness.css: Removed.
3632         * wasm/spec-harness/testharness.js: Removed.
3633         * wasm/spec-harness/testharnessreport.js: Removed.
3634         * wasm/spec-harness/wasm-constants.js:
3635         (assertTraps):
3636         (assertWasmThrows):
3637         * wasm/spec-harness/wasm-module-builder.js:
3638         (Binary.prototype.emit_section):
3639         (Binary):
3640         (WasmFunctionBuilder.prototype.addBody):
3641         (WasmFunctionBuilder.prototype.end):
3642         (WasmFunctionBuilder):
3643         (WasmModuleBuilder.prototype.stringToBytes):
3644         (WasmModuleBuilder.prototype.addCustomSection):
3645         (WasmModuleBuilder.prototype.addFunctionTableInit):
3646         (WasmModuleBuilder.prototype.appendToTable):
3647         (WasmModuleBuilder.prototype.toArray):
3648         (WasmModuleBuilder.prototype.toBuffer):
3649         (WasmModuleBuilder.prototype.instantiate):
3650         (WasmModuleBuilder):
3651         * wasm/spec-tests/address.wast.js:
3652         * wasm/spec-tests/align.wast.js: Added.
3653         * wasm/spec-tests/binary.wast.js:
3654         * wasm/spec-tests/block.wast.js:
3655         * wasm/spec-tests/br.wast.js:
3656         * wasm/spec-tests/br_if.wast.js:
3657         * wasm/spec-tests/br_table.wast.js:
3658         * wasm/spec-tests/call.wast.js:
3659         * wasm/spec-tests/call_indirect.wast.js:
3660         * wasm/spec-tests/comments.wast.js:
3661         * wasm/spec-tests/const.wast.js: Added.
3662         * wasm/spec-tests/conversions.wast.js: Added.
3663         * wasm/spec-tests/custom_section.wast.js:
3664         * wasm/spec-tests/exports.wast.js:
3665         * wasm/spec-tests/f32.wast.js: Added.
3666         * wasm/spec-tests/f64.wast.js: Added.
3667         * wasm/spec-tests/fac.wast.js:
3668         * wasm/spec-tests/float_exprs.wast.js: Added.
3669         * wasm/spec-tests/float_misc.wast.js: Added.
3670         * wasm/spec-tests/func.wast.js:
3671         * wasm/spec-tests/globals.wast.js:
3672         * wasm/spec-tests/if.wast.js:
3673         * wasm/spec-tests/imports.wast.js:
3674         * wasm/spec-tests/inline-module.wast.js: Added.
3675         * wasm/spec-tests/jsapi.js:
3676         (testJSAPI.test):
3677         (testJSAPI):
3678         * wasm/spec-tests/labels.wast.js:
3679         * wasm/spec-tests/loop.wast.js:
3680         * wasm/spec-tests/memory.wast.js:
3681         * wasm/spec-tests/memory_trap.wast.js: Added.
3682         * wasm/spec-tests/names.wast.js:
3683         * wasm/spec-tests/nop.wast.js:
3684         * wasm/spec-tests/return.wast.js:
3685         * wasm/spec-tests/stack.wast.js:
3686         * wasm/spec-tests/token.wast.js: Added.
3687         * wasm/spec-tests/type.wast.js: Added.
3688         * wasm/spec-tests/typecheck.wast.js:
3689         * wasm/spec-tests/unreachable.wast.js:
3690         * wasm/spec-tests/unreached-invalid.wast.js:
3691         * wasm/spec-tests/unwind.wast.js:
3692         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
3693         * wasm/spec-tests/utf8-import-field.wast.js: Added.
3694         * wasm/spec-tests/utf8-import-module.wast.js: Added.
3695
3696 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
3697
3698         Unreviewed JSC test gardening.
3699
3700         * stress/check-string-ident.js:
3701         * stress/new-largeish-contiguous-array-with-size.js:
3702
3703 2017-06-13  Michael Saboff  <msaboff@apple.com>
3704
3705         DFG doesn't properly handle a property that is change to read only in a prototype
3706         https://bugs.webkit.org/show_bug.cgi?id=173321
3707
3708         Reviewed by Filip Pizlo.
3709
3710         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
3711         * stress/regress-173321.js: Added new regression test.
3712         (shouldBe):
3713         (SimpleObject):
3714         (test):
3715
3716 2017-06-12  Saam Barati  <sbarati@apple.com>
3717
3718         Update test262 test expectation since r218082 makes new tests pass.
3719
3720         * test262.yaml:
3721
3722 2017-06-12  Saam Barati  <sbarati@apple.com>
3723
3724         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms