8bec48098663325af39d67d64ea82e6e05665fa9
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-31  Saam Barati  <sbarati@apple.com>
2
3         JSC incorrectly interpreting script, sets Global Property instead of Global Lexical variable (LiteralParser / JSONP path)
4         https://bugs.webkit.org/show_bug.cgi?id=182074
5         <rdar://problem/36846261>
6
7         Reviewed by Mark Lam.
8
9         * stress/jsonp-program-evaluate-path-must-consider-global-lexical-environment.js: Added.
10         (assert):
11         (let.func):
12         (let.o.foo):
13         (varFunc):
14
15 2018-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
16
17         Unreviewed, update test262 expects
18         https://bugs.webkit.org/show_bug.cgi?id=182232
19
20         * test262.yaml:
21
22 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
23
24         [JSC] Implement trimStart and trimEnd
25         https://bugs.webkit.org/show_bug.cgi?id=182233
26
27         Reviewed by Mark Lam.
28
29         * stress/trim.js: Added.
30         (shouldBe):
31         (startTest):
32         (endTest):
33         (trimTest):
34
35 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
36
37         [JSC] Relax line terminators in String to make JSON subset of JS
38         https://bugs.webkit.org/show_bug.cgi?id=182232
39
40         Reviewed by Keith Miller.
41
42         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
43         * stress/relaxed-line-terminators-in-string.js: Added.
44         (shouldBe):
45
46 2018-01-29  Michael Saboff  <msaboff@apple.com>
47
48         REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
49         https://bugs.webkit.org/show_bug.cgi?id=182249
50
51         Reviewed by Keith Miller.
52
53         New regression test.
54
55         * stress/compare-clobber-untypeduse.js: Added.
56
57 2018-01-29  Matt Lewis  <jlewis3@apple.com>
58
59         Unreviewed, rolling out r227725.
60
61         This caused internal failures.
62
63         Reverted changeset:
64
65         "JSC Sampling Profiler: Detect tester and testee when sampling
66         in RegExp JIT"
67         https://bugs.webkit.org/show_bug.cgi?id=152729
68         https://trac.webkit.org/changeset/227725
69
70 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
71
72         JSC Sampling Profiler: Detect tester and testee when sampling in RegExp JIT
73         https://bugs.webkit.org/show_bug.cgi?id=152729
74
75         Reviewed by Saam Barati.
76
77         * stress/sampling-profiler-regexp.js: Added.
78         (platformSupportsSamplingProfiler.test):
79         (platformSupportsSamplingProfiler.baz):
80         (platformSupportsSamplingProfiler):
81
82 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
83
84         [DFG][FTL] WeakMap#set should have DFG node
85         https://bugs.webkit.org/show_bug.cgi?id=180015
86
87         Reviewed by Saam Barati.
88
89         * stress/weakmap-set-change-get.js: Added.
90         (shouldBe):
91         (test):
92         * stress/weakmap-set-cse.js: Added.
93         (shouldBe):
94         (test):
95         * stress/weakset-add-change-get.js: Added.
96         (shouldBe):
97         * stress/weakset-add-cse.js: Added.
98         (shouldBe):
99
100 2018-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>
101
102         DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
103         https://bugs.webkit.org/show_bug.cgi?id=182213
104
105         Reviewed by Mark Lam.
106
107         * stress/int32-min-to-string.js: Added.
108         (shouldBe):
109         (test2):
110         (test4):
111         (test8):
112         (test16):
113         (test32):
114         * stress/zero-to-string.js: Added.
115         (shouldBe):
116         (test2):
117         (test4):
118         (test8):
119         (test16):
120         (test32):
121
122 2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>
123
124         Add more module scope related tests with code evaluation by string
125         https://bugs.webkit.org/show_bug.cgi?id=181983
126
127         Reviewed by Sam Weinig.
128
129         Add more module scope related tests. When the original tests are landed,
130         we do not have browser integration. This patch adds more module scope tests
131         with dynamically created script evaluation. We add tests with Function
132         constructor, direct eval, indirect eval, setTimeout, setInterval, and event handlers.
133
134         * modules/scopes-eval.js: Added.
135         (shouldBe):
136         * modules/scopes.js:
137         (shouldBe):
138
139 2018-01-23  Filip Pizlo  <fpizlo@apple.com>
140
141         Unreviewed, retire some microbenchmarks that are proportionately very slow. Benchmark running time should be proportional to their value. Microbenchmarks have little value, so they should be very fast.
142
143         * microbenchmarks/array-push-3.js: Removed.
144         * microbenchmarks/bigswitch-indirect-symbol-or-undefined.js: Removed.
145         * microbenchmarks/double-to-int32.js: Removed.
146         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Removed.
147         * microbenchmarks/ftl-polymorphic-bitand.js: Removed.
148         * microbenchmarks/ftl-polymorphic-bitor.js: Removed.
149         * microbenchmarks/ftl-polymorphic-bitxor.js: Removed.
150         * microbenchmarks/ftl-polymorphic-lshift.js: Removed.
151         * microbenchmarks/ftl-polymorphic-rshift.js: Removed.
152         * microbenchmarks/ftl-polymorphic-sub.js: Removed.
153         * microbenchmarks/ftl-polymorphic-urshift.js: Removed.
154         * microbenchmarks/map-constant-key.js: Removed.
155         * microbenchmarks/nested-function-parsing.js: Removed.
156         * microbenchmarks/rest-parameter-allocation-elimination.js: Removed.
157         * microbenchmarks/spread-large-array.js: Removed.
158         * microbenchmarks/string-add-constant-folding.js: Removed.
159         * microbenchmarks/to-lower-case.js: Removed.
160         * microbenchmarks/undefined-property-access.js: Removed.
161         * slowMicrobenchmarks/array-push-3.js: Copied from JSTests/microbenchmarks/array-push-3.js.
162         * slowMicrobenchmarks/bigswitch-indirect-symbol-or-undefined.js: Copied from JSTests/microbenchmarks/bigswitch-indirect-symbol-or-undefined.js.
163         * slowMicrobenchmarks/double-to-int32.js: Copied from JSTests/microbenchmarks/double-to-int32.js.
164         * slowMicrobenchmarks/fake-iterators-that-throw-when-finished.js: Copied from JSTests/microbenchmarks/fake-iterators-that-throw-when-finished.js.
165         * slowMicrobenchmarks/ftl-polymorphic-bitand.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitand.js.
166         * slowMicrobenchmarks/ftl-polymorphic-bitor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitor.js.
167         * slowMicrobenchmarks/ftl-polymorphic-bitxor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitxor.js.
168         * slowMicrobenchmarks/ftl-polymorphic-lshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-lshift.js.
169         * slowMicrobenchmarks/ftl-polymorphic-rshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-rshift.js.
170         * slowMicrobenchmarks/ftl-polymorphic-sub.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-sub.js.
171         * slowMicrobenchmarks/ftl-polymorphic-urshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-urshift.js.
172         * slowMicrobenchmarks/map-constant-key.js: Copied from JSTests/microbenchmarks/map-constant-key.js.
173         * slowMicrobenchmarks/nested-function-parsing.js: Copied from JSTests/microbenchmarks/nested-function-parsing.js.
174         * slowMicrobenchmarks/rest-parameter-allocation-elimination.js: Copied from JSTests/microbenchmarks/rest-parameter-allocation-elimination.js.
175         * slowMicrobenchmarks/spread-large-array.js: Copied from JSTests/microbenchmarks/spread-large-array.js.
176         * slowMicrobenchmarks/string-add-constant-folding.js: Copied from JSTests/microbenchmarks/string-add-constant-folding.js.
177         * slowMicrobenchmarks/to-lower-case.js: Copied from JSTests/microbenchmarks/to-lower-case.js.
178         * slowMicrobenchmarks/undefined-property-access.js: Copied from JSTests/microbenchmarks/undefined-property-access.js.
179
180 2018-01-23  Robin Morisset  <rmorisset@apple.com>
181
182         Update the argument count in DFGByteCodeParser::handleRecursiveCall
183         https://bugs.webkit.org/show_bug.cgi?id=181739
184         <rdar://problem/36627662>
185
186         Reviewed by Saam Barati.
187
188         * stress/recursive-tail-call-with-different-argument-count.js: Added.
189         (foo):
190         (bar):
191
192 2018-01-22  Michael Saboff  <msaboff@apple.com>
193
194         DFG abstract interpreter needs to properly model effects of some Math ops
195         https://bugs.webkit.org/show_bug.cgi?id=181886
196
197         Reviewed by Saam Barati.
198
199         New regression test.
200
201         * stress/arith-nodes-abstract-interpreter-untypeduse.js: Added.
202         (test):
203
204 2018-01-20  Caio Lima  <ticaiolima@gmail.com>
205
206         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
207         https://bugs.webkit.org/show_bug.cgi?id=181182
208
209         Reviewed by Darin Adler.
210
211         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
212         * stress/big-int-prototype-to-string-exception.js: Added.
213         * stress/big-int-prototype-to-string-wrong-values.js: Added.
214         * stress/number-prototype-to-string-cast-overflow.js: Added.
215         * stress/number-prototype-to-string-exception.js: Added.
216         * stress/number-prototype-to-string-wrong-values.js: Added.
217
218 2018-01-19  Ryan Haddad  <ryanhaddad@apple.com>
219
220         Disable Atomics when SharedArrayBuffer isn’t enabled
221         https://bugs.webkit.org/show_bug.cgi?id=181572
222
223         Unreviewed test gardening.
224
225         * test262.yaml: Skip tests that fail after this change.
226
227 2018-01-19  Saam Barati  <sbarati@apple.com>
228
229         Kill ArithNegate's ArithProfile assert inside BytecodeParser
230         https://bugs.webkit.org/show_bug.cgi?id=181877
231         <rdar://problem/36630552>
232
233         Reviewed by Mark Lam.
234
235         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js: Added.
236         (runNearStackLimit):
237         (f1):
238         (f2):
239         (f3):
240         (i.catch):
241         (i.try.runNearStackLimit):
242         (catch):
243
244 2018-01-19  Saam Barati  <sbarati@apple.com>
245
246         Spread's effects are modeled incorrectly both in AI and in Clobberize
247         https://bugs.webkit.org/show_bug.cgi?id=181867
248         <rdar://problem/36290415>
249
250         Reviewed by Michael Saboff.
251
252         * stress/ai-needs-to-model-spreads-effects.js: Added.
253         (try.p.Symbol.iterator):
254         (try.go):
255         (catch):
256         * stress/clobberize-needs-to-model-spread-effects.js: Added.
257         (assert):
258         (foo):
259         (a.Symbol.iterator):
260
261 2018-01-19  Yusuke Suzuki  <utatane.tea@gmail.com>
262
263         Unreviewed, reduce count of iteration to fix timing out debug JSC test
264         https://bugs.webkit.org/show_bug.cgi?id=181535
265
266         * stress/inserted-recovery-with-set-last-index.js:
267
268 2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>
269
270         [DFG][FTL] Introduce PhantomNewRegexp and RegExpExecNonGlobalOrSticky
271         https://bugs.webkit.org/show_bug.cgi?id=181535
272
273         Reviewed by Saam Barati.
274
275         * stress/inserted-recovery-with-set-last-index.js: Added.
276         (shouldBe):
277         (foo):
278         * stress/materialize-regexp-at-osr-exit.js: Added.
279         (shouldBe):
280         (test):
281         * stress/materialize-regexp-cyclic-regexp-at-osr-exit.js: Added.
282         (shouldBe):
283         (test):
284         * stress/materialize-regexp-cyclic-regexp.js: Added.
285         (shouldBe):
286         (test):
287         (i.switch):
288         * stress/materialize-regexp-cyclic.js: Added.
289         (shouldBe):
290         (test):
291         (i.switch):
292         * stress/materialize-regexp-referenced-from-phantom-regexp-cyclic.js: Added.
293         (bar):
294         (foo):
295         (test):
296         * stress/materialize-regexp-referenced-from-phantom-regexp.js: Added.
297         (bar):
298         (foo):
299         (test):
300         * stress/materialize-regexp.js: Added.
301         (shouldBe):
302         (test):
303         * stress/phantom-regexp-regexp-exec.js: Added.
304         (shouldBe):
305         (test):
306         * stress/phantom-regexp-string-match.js: Added.
307         (shouldBe):
308         (test):
309         * stress/regexp-last-index-sinking.js: Added.
310         (shouldBe):
311         (test):
312
313 2018-01-17  Saam Barati  <sbarati@apple.com>
314
315         Disable Atomics when SharedArrayBuffer isn’t enabled
316         https://bugs.webkit.org/show_bug.cgi?id=181572
317         <rdar://problem/36553206>
318
319         Reviewed by Michael Saboff.
320
321         * stress/isLockFree.js:
322
323 2018-01-17  Saam Barati  <sbarati@apple.com>
324
325         DFG::Node::convertToConstant needs to clear the varargs flags
326         https://bugs.webkit.org/show_bug.cgi?id=181697
327         <rdar://problem/36497332>
328
329         Reviewed by Yusuke Suzuki.
330
331         * stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
332         (doIndexOf):
333         (bar):
334         (i.bar):
335
336 2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>
337
338         Unreviewed, rolling out r226937.
339
340         Tests added with this change are failing due to a missing
341         exception check.
342
343         Reverted changeset:
344
345         "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
346         double to int32_t"
347         https://bugs.webkit.org/show_bug.cgi?id=181182
348         https://trac.webkit.org/changeset/226937
349
350 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
351
352         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
353         https://bugs.webkit.org/show_bug.cgi?id=181182
354
355         Reviewed by Darin Adler.
356
357         * bigIntTests.yaml:
358         * stress/big-int-constructor.js:
359         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
360         (assert):
361         (assertThrowRangeError):
362         * stress/number-prototype-to-string-cast-overflow.js: Added.
363         (assert):
364         (assertThrowRangeError):
365
366 2018-01-12  Saam Barati  <sbarati@apple.com>
367
368         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
369         https://bugs.webkit.org/show_bug.cgi?id=181177
370         <rdar://problem/36205704>
371
372         Reviewed by Yusuke Suzuki.
373
374         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
375         (runNearStackLimit.t):
376         (runNearStackLimit):
377         (test.f):
378         (test):
379
380 2018-01-12  Saam Barati  <sbarati@apple.com>
381
382         Each variant of a polymorphic inlined call should be exitOK at the top of the block
383         https://bugs.webkit.org/show_bug.cgi?id=181562
384         <rdar://problem/36445624>
385
386         Reviewed by Yusuke Suzuki.
387
388         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
389         (f):
390         (foo):
391
392 2018-01-11  Saam Barati  <sbarati@apple.com>
393
394         When inserting Unreachable in byte code parser we need to flush all the right things
395         https://bugs.webkit.org/show_bug.cgi?id=181509
396         <rdar://problem/36423110>
397
398         Reviewed by Mark Lam.
399
400         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
401
402 2018-01-11  Saam Barati  <sbarati@apple.com>
403
404         JITMathIC code in the FTL is wrong when code gets duplicated
405         https://bugs.webkit.org/show_bug.cgi?id=181525
406         <rdar://problem/36351993>
407
408         Reviewed by Michael Saboff and Keith Miller.
409
410         * stress/allow-math-ic-b3-code-duplication.js: Added.
411
412 2018-01-11  Saam Barati  <sbarati@apple.com>
413
414         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
415         https://bugs.webkit.org/show_bug.cgi?id=181508
416
417         Reviewed by Yusuke Suzuki.
418
419         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
420         (assert):
421         (test1.foo):
422         (test1):
423         (test2.foo):
424         (test2):
425
426 2018-01-09  Mark Lam  <mark.lam@apple.com>
427
428         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
429         https://bugs.webkit.org/show_bug.cgi?id=181388
430         <rdar://problem/36349351>
431
432         Reviewed by Saam Barati.
433
434         * stress/regress-181388.js: Added.
435
436 2018-01-08  JF Bastien  <jfbastien@apple.com>
437
438         WebAssembly: mask indexed accesses to Table
439         https://bugs.webkit.org/show_bug.cgi?id=181412
440         <rdar://problem/36363236>
441
442         Reviewed by Saam Barati.
443
444         Update error messages.
445
446         * wasm/js-api/table.js:
447         (assert.throws.WebAssembly.Table.prototype.grow):
448
449 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
450
451         Disable SharedArrayBuffer tests missed in r226386.
452         https://bugs.webkit.org/show_bug.cgi?id=181266
453
454         Unreviewed test gardening.
455
456         * test262.yaml:
457
458 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
459
460         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
461         https://bugs.webkit.org/show_bug.cgi?id=181321
462
463         Reviewed by Saam Barati.
464
465         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
466         (shouldBe):
467         (testFunction):
468         * test262.yaml:
469
470 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
471
472         Unreviewed, attempt to fix test262 after r226386.
473
474         * test262.yaml:
475
476 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
477
478         [DFG] Define defs for MapSet/SetAdd to participate in CSE
479         https://bugs.webkit.org/show_bug.cgi?id=179911
480
481         Reviewed by Saam Barati.
482
483         In addition to these tests, map-set-cse.js and set-add-cse.js work.
484
485         * stress/map-set-change-get.js: Added.
486         (shouldBe):
487         (test):
488         * stress/map-set-create-bucket.js: Added.
489         (shouldBe):
490         (test):
491         * stress/set-add-create-bucket.js: Added.
492         (shouldBe):
493
494 2018-01-03  Michael Saboff  <msaboff@apple.com>
495
496         Disable SharedArrayBuffers from Web API
497         https://bugs.webkit.org/show_bug.cgi?id=181266
498
499         Reviewed by Saam Barati.
500
501         Disabled SharedArrayBuffer tests.
502
503         * stress/SharedArrayBuffer-opt.js:
504         * stress/SharedArrayBuffer.js:
505         * stress/array-buffer-byte-length.js:
506         * stress/atomics-add-uint32.js:
507         * stress/atomics-known-int-use.js:
508         * stress/atomics-neg-zero.js:
509         * stress/atomics-store-return.js:
510         * stress/lars-sab-workers.js:
511         * stress/regress-159779-1.js:
512         * stress/regress-159779-2.js:
513         * stress/regress-170473.js:
514         * test262.yaml:
515
516 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
517
518         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
519         https://bugs.webkit.org/show_bug.cgi?id=181258
520
521         Reviewed by Antonio Gomes.
522
523         * stress/big-int-constructor-gc.js:
524         * stress/big-int-constructor-oom.js:
525
526 2018-01-03  Robin Morisset  <rmorisset@apple.com>
527
528         Inlining of a function that ends in op_unreachable crashes
529         https://bugs.webkit.org/show_bug.cgi?id=181027
530
531         Reviewed by Filip Pizlo.
532
533         * stress/inlining-unreachable.js: Added.
534         (bar):
535         (baz):
536         (i.catch):
537
538 2018-01-02  Saam Barati  <sbarati@apple.com>
539
540         Incorrect assertion inside AccessCase
541         https://bugs.webkit.org/show_bug.cgi?id=181200
542         <rdar://problem/35494754>
543
544         Reviewed by Yusuke Suzuki.
545
546         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
547         (ctor):
548         (theFunc):
549         (run):
550
551 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
552
553         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
554         https://bugs.webkit.org/show_bug.cgi?id=175359
555
556         Reviewed by Yusuke Suzuki.
557
558         * bigIntTests.yaml:
559         * stress/big-int-as-key.js: Added.
560         * stress/big-int-constructor-gc.js: Added.
561         * stress/big-int-constructor-oom.js: Added.
562         * stress/big-int-constructor-properties.js: Added.
563         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
564         * stress/big-int-constructor-prototype.js: Added.
565         * stress/big-int-constructor.js: Added.
566         * stress/big-int-function-apply.js:
567         * stress/big-int-length.js: Added.
568         * stress/big-int-prop-descriptor.js: Added.
569         * stress/big-int-proto-constructor.js: Added.
570         * stress/big-int-proto-name.js: Added.
571         * stress/big-int-prototype-properties.js: Added.
572         * stress/big-int-prototype-proto.js: Added.
573         * stress/big-int-prototype-value-of.js: Added.
574         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
575         * stress/big-int-prototype-to-string-apply.js: Added.
576         * stress/big-int-to-object.js: Added.
577         * stress/big-int-to-string.js: Added.
578
579 2017-12-28  Saam Barati  <sbarati@apple.com>
580
581         Assertion used to determine if something is an async generator is wrong
582         https://bugs.webkit.org/show_bug.cgi?id=181168
583         <rdar://problem/35640560>
584
585         Reviewed by Yusuke Suzuki.
586
587         * stress/async-generator-assertion.js: Added.
588
589 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
590
591         Skip stress/splay-flash-access tests on memory limited platforms
592         https://bugs.webkit.org/show_bug.cgi?id=181086
593
594         Reviewed by Carlos Alberto Lopez Perez.
595
596         These tests use about 185M of memory, and occasionally get OOM-killed
597         on memory limited platforms.
598
599         * stress/splay-flash-access-1ms.js:
600         * stress/splay-flash-access.js:
601
602 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
603
604         Skip slow jsc tests on embedded platforms
605         https://bugs.webkit.org/show_bug.cgi?id=180937
606
607         Reviewed by Carlos Alberto Lopez Perez.
608
609         The tests typeProfiler/deltablue-for-of.js and
610         typeProfiler/getter-richards.js take a very long time in the
611         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
612         thus always timeout. They should be skipped on these platforms.
613
614         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
615         * typeProfiler/getter-richards.js: Skip on arm*/mips.
616
617 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
618
619         [JSC] Do not check isValid() in op_new_regexp
620         https://bugs.webkit.org/show_bug.cgi?id=180970
621
622         Reviewed by Saam Barati.
623
624         * stress/regexp-syntax-error-invalid-flags.js: Added.
625         (shouldThrow):
626
627 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
628
629         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
630         https://bugs.webkit.org/show_bug.cgi?id=180712
631
632         Reviewed by Michael Catanzaro.
633
634         stress/call-apply-exponential-bytecode-size.js crashes if the
635         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
636         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
637         should skip the test on other platforms.
638
639         * stress/call-apply-exponential-bytecode-size.js:
640
641 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
642
643         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
644         https://bugs.webkit.org/show_bug.cgi?id=179762
645
646         Reviewed by Saam Barati.
647
648         * stress/call-varargs-double-new-array-buffer.js: Added.
649         (assert):
650         (bar):
651         (foo):
652         * stress/call-varargs-spread-new-array-buffer.js: Added.
653         (assert):
654         (bar):
655         (foo):
656         * stress/call-varargs-spread-new-array-buffer2.js: Added.
657         (assert):
658         (bar):
659         (foo):
660         * stress/forward-varargs-double-new-array-buffer.js: Added.
661         (assert):
662         (test.baz):
663         (test.bar):
664         (test.foo):
665         (test):
666         * stress/new-array-buffer-sinking-osrexit.js: Added.
667         (target):
668         (test):
669         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
670         (shouldBe):
671         (test):
672         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
673         (shouldBe):
674         (target):
675         (test):
676         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
677         (assert):
678         (test1.bar):
679         (test1.foo):
680         (test1):
681         (test2.bar):
682         (test2.foo):
683         (test3.baz):
684         (test3.bar):
685         (test3.foo):
686         (test4.baz):
687         (test4.bar):
688         (test4.foo):
689         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
690         (assert):
691         (test.baz):
692         (test.bar):
693         (test.foo):
694         (test):
695         * stress/phantom-new-array-buffer-osr-exit.js: Added.
696         (assert):
697         (baz):
698         (bar):
699         (effects):
700         (foo):
701
702 2017-12-14  Saam Barati  <sbarati@apple.com>
703
704         The CleanUp after LICM is erroneously removing a Check
705         https://bugs.webkit.org/show_bug.cgi?id=180852
706         <rdar://problem/36063494>
707
708         Reviewed by Filip Pizlo.
709
710         * stress/dont-run-cleanup-after-licm.js: Added.
711
712 2017-12-14  Michael Saboff  <msaboff@apple.com>
713
714         REGRESSION (r225695): Repro crash on yahoo login page
715         https://bugs.webkit.org/show_bug.cgi?id=180761
716
717         Reviewed by JF Bastien.
718
719         New regression test.
720
721         * stress/regress-180761.js: Added.
722
723 2017-12-13  Keith Miller  <keith_miller@apple.com>
724
725         JSObjects should have a mask for loading indexed properties
726         https://bugs.webkit.org/show_bug.cgi?id=180768
727
728         Reviewed by Mark Lam.
729
730         * stress/int16-put-by-val-in-and-out-of-bounds.js:
731         (test):
732
733 2017-12-13  Saam Barati  <sbarati@apple.com>
734
735         Arrow functions need their own structure because they have different properties than sloppy functions
736         https://bugs.webkit.org/show_bug.cgi?id=180779
737         <rdar://problem/35814591>
738
739         Reviewed by Mark Lam.
740
741         * stress/arrow-function-needs-its-own-structure.js: Added.
742         (assert):
743         (readPrototype):
744         (noInline.let.f1):
745         (noInline):
746
747 2017-12-13  Saam Barati  <sbarati@apple.com>
748
749         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
750         https://bugs.webkit.org/show_bug.cgi?id=163579
751         <rdar://problem/35455798>
752
753         Reviewed by Mark Lam.
754
755         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
756         (assert):
757         (test1):
758         (i.test1):
759         (i.test1.C):
760         (i.test1.async.foo):
761         (i.test1.foo):
762         (test2):
763
764 2017-12-13  Saam Barati  <sbarati@apple.com>
765
766         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
767         https://bugs.webkit.org/show_bug.cgi?id=180734
768         <rdar://problem/35640547>
769
770         Reviewed by Yusuke Suzuki.
771
772         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
773         (__isPropertyOfType):
774         (__getProperties):
775         (__getObjects):
776         (__getRandomObject):
777         (theClass.):
778         (theClass):
779         (childClass):
780         (counter.catch):
781
782 2017-12-12  Saam Barati  <sbarati@apple.com>
783
784         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
785         https://bugs.webkit.org/show_bug.cgi?id=180725
786         <rdar://problem/35970511>
787
788         Reviewed by Michael Saboff.
789
790         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
791         (f1):
792         (f2):
793         (let.o2.valueOf):
794
795 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
796
797         [JSC] Implement optimized WeakMap and WeakSet
798         https://bugs.webkit.org/show_bug.cgi?id=179929
799
800         Reviewed by Saam Barati.
801
802         * microbenchmarks/weak-map-key.js:
803         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
804         (assert):
805         (objectKey):
806         (let.start.Date.now):
807         * stress/basic-weakmap.js: Added.
808         (shouldBe):
809         (test):
810         * stress/basic-weakset.js: Added.
811         (shouldBe):
812         (test.set new):
813         * stress/weakmap-cse-set-break.js: Added.
814         (shouldBe):
815         (test):
816         * stress/weakmap-cse.js: Added.
817         (shouldBe):
818         (test):
819         * stress/weakmap-gc.js: Added.
820         (test):
821         * stress/weakset-cse-add-break.js: Added.
822         (shouldBe):
823         (test.set new):
824         * stress/weakset-cse.js: Added.
825         (shouldBe):
826         (test.set new):
827         * stress/weakset-gc.js: Added.
828         (test.set add):
829         (test.set new):
830         (test):
831
832 2017-12-12  Saam Barati  <sbarati@apple.com>
833
834         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
835         https://bugs.webkit.org/show_bug.cgi?id=180723
836         <rdar://problem/35859726>
837
838         Reviewed by JF Bastien.
839
840         * stress/get-my-argument-by-val-constant-folding.js: Added.
841         (test):
842         (catch):
843
844 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
845
846         [ESNext][BigInt] Implement BigInt literals and JSBigInt
847         https://bugs.webkit.org/show_bug.cgi?id=179000
848
849         Reviewed by Darin Adler and Yusuke Suzuki.
850
851         * bigIntTests.yaml: Added.
852         * stress/big-int-literal-line-terminator.js: Added.
853         * stress/big-int-literals.js: Added.
854         * stress/big-int-operations-error.js: Added.
855         * stress/big-int-type-of.js: Added.
856         * stress/big-int-white-space-trailing-leading.js: Added.
857         * stress/big-int-function-apply.js: Added.
858
859 2017-12-11  Saam Barati  <sbarati@apple.com>
860
861         We need to disableCaching() in ErrorInstance when we materialize properties
862         https://bugs.webkit.org/show_bug.cgi?id=180343
863         <rdar://problem/35833002>
864
865         Reviewed by Mark Lam.
866
867         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
868         (assert):
869         (makeError):
870         (storeToStack):
871         (storeToStackAlreadyMaterialized):
872
873 2017-12-05  JF Bastien  <jfbastien@apple.com>
874
875         WebAssembly: don't eagerly checksum
876         https://bugs.webkit.org/show_bug.cgi?id=180441
877         <rdar://problem/35156628>
878
879         Reviewed by Saam Barati.
880
881         Checksum is now disabled, so tests only have <?> as the module
882         name.
883
884         * wasm/function-tests/nameSection.js:
885         * wasm/function-tests/stack-overflow.js:
886         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
887         (assertOverflows.assertThrows):
888         (assertOverflows):
889         * wasm/function-tests/stack-trace.js:
890
891 2017-12-04  JF Bastien  <jfbastien@apple.com>
892
893         Proxy all functions, except the $ objects
894         https://bugs.webkit.org/show_bug.cgi?id=180375
895
896         Reviewed by Saam Barati.
897
898         It looks like this test may have broken some executions because I
899         call some internal objects. Explicitly ignore objects whose name
900         starts with "$" because it's a bad idea anyways.
901
902         * stress/proxy-all-the-parameters.js:
903         (generateObjects):
904         (get throw):
905
906 2017-12-04  Saam Barati  <sbarati@apple.com>
907
908         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
909         https://bugs.webkit.org/show_bug.cgi?id=180366
910         <rdar://problem/35685877>
911
912         Reviewed by Michael Saboff.
913
914         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
915         (theParent):
916         (test1.base.getParentStaticValue):
917         (test1.base):
918         (test1.__v_24888.prototype.set prop):
919         (test1.__v_24888):
920         (test2.base.getParentStaticValue):
921         (test2.base):
922         (test2.__v_24888.prototype.set prop):
923         (test2.__v_24888):
924         (test2):
925
926 2017-12-01  JF Bastien  <jfbastien@apple.com>
927
928         Try proxying all function arguments
929         https://bugs.webkit.org/show_bug.cgi?id=180306
930
931         Reviewed by Saam Barati.
932
933         * stress/proxy-all-the-parameters.js: Added.
934         (isPropertyOfType):
935         (getProperties):
936         (generateObjects):
937         (getObjects):
938         (getFunctions):
939         (get throw):
940         (let.o.of.getObjects.let.f.of.getFunctions.catch):
941
942 2017-12-01  JF Bastien  <jfbastien@apple.com>
943
944         JavaScriptCore: missing exception checks in Math functions that take more than one argument
945         https://bugs.webkit.org/show_bug.cgi?id=180297
946         <rdar://problem/35745556>
947
948         Reviewed by Mark Lam.
949
950         * stress/math-exceptions.js: Added.
951         (get try):
952         (catch):
953
954 2017-12-01  JF Bastien  <jfbastien@apple.com>
955
956         JavaScriptCore: add test for weird class static getters
957         https://bugs.webkit.org/show_bug.cgi?id=180281
958         <rdar://problem/35592139>
959
960         Reviewed by Mark Lam.
961
962         I fixed a bug for it in r224927 and didn't add a test. Do so.
963
964         * stress/class-static-get-weird.js: Added.
965         (c.prototype.get name):
966         (c):
967         (c.prototype.get arguments):
968         (c.prototype.get caller):
969         (c.prototype.get length):
970
971 2017-12-01  Saam Barati  <sbarati@apple.com>
972
973         Having a bad time needs to handle ArrayClass indexing type as well
974         https://bugs.webkit.org/show_bug.cgi?id=180274
975         <rdar://problem/35667869>
976
977         Reviewed by Keith Miller and Mark Lam.
978
979         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
980         (assert):
981         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
982         (assert):
983
984 2017-12-01  JF Bastien  <jfbastien@apple.com>
985
986         WebAssembly: restore cached stack limit after out-call
987         https://bugs.webkit.org/show_bug.cgi?id=179106
988         <rdar://problem/35337525>
989
990         Reviewed by Saam Barati.
991
992         * wasm/function-tests/double-instance.js: Added.
993         (const.imp.boom):
994         (const.imp.get callAnother):
995
996 2017-11-30  JF Bastien  <jfbastien@apple.com>
997
998         WebAssembly: improve stack trace
999         https://bugs.webkit.org/show_bug.cgi?id=179343
1000
1001         Reviewed by Saam Barati.
1002
1003         Update the tests to follow the new format. Notably, SHA1 module
1004         hash is now included in traces, and stubs are properly identified.
1005
1006         * wasm/assert.js: Add an assertion which matches regular expressions.
1007         * wasm/function-tests/nameSection.js:
1008         * wasm/function-tests/stack-overflow.js:
1009         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
1010         (assertOverflows.assertThrows.wasm.1):
1011         (assertOverflows.assertThrows.wasm.0):
1012         (assertOverflows.assertThrows):
1013         (assertOverflows):
1014         * wasm/function-tests/stack-trace.js:
1015         (import.Builder.from.string_appeared_here.assert): Deleted.
1016         * wasm/function-tests/trap-after-cross-instance-call.js:
1017         (wasmFrameCountFromError):
1018         * wasm/function-tests/trap-load-2.js:
1019         (wasmFrameCountFromError):
1020         * wasm/function-tests/trap-load.js:
1021         (wasmFrameCountFromError):
1022
1023 2017-11-30  Mark Lam  <mark.lam@apple.com>
1024
1025         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
1026         https://bugs.webkit.org/show_bug.cgi?id=180219
1027         <rdar://problem/35696536>
1028
1029         Reviewed by Filip Pizlo.
1030
1031         * stress/regress-180219.js: Added.
1032
1033 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1034
1035         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
1036         https://bugs.webkit.org/show_bug.cgi?id=180190
1037
1038         Reviewed by Mark Lam.
1039
1040         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
1041         (shouldBe):
1042         (test1):
1043         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
1044         (shouldBe):
1045         (test1):
1046         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
1047         (shouldBe):
1048         (test1):
1049         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
1050         (shouldBe):
1051         (test1):
1052         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
1053         (shouldBe):
1054         (test1):
1055         * stress/operation-in-may-have-negative-int32.js: Added.
1056         (shouldBe):
1057         (test2):
1058         * stress/operation-in-negative-int32-cast.js: Added.
1059         (shouldBe):
1060         (test1):
1061
1062 2017-11-28  JF Bastien  <jfbastien@apple.com>
1063
1064         Strict and sloppy functions shouldn't share structure
1065         https://bugs.webkit.org/show_bug.cgi?id=180103
1066         <rdar://problem/35667847>
1067
1068         Reviewed by Saam Barati.
1069
1070         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
1071         because the IC was wrong.
1072         (foo):
1073         (bar):
1074         (baz):
1075         (catch):
1076         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
1077         in this patch, but may as well test odd strict mode corner cases.
1078         (bar):
1079         (baz):
1080         (catch):
1081         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
1082         (foo):
1083         (bar):
1084         (baz):
1085         (catch):
1086         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
1087         next file, but with invalidation of the FunctionExecutable's
1088         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
1089         slower path.
1090         (foo):
1091         (bar.const.x):
1092         (bar.const.y):
1093         (bar):
1094         (catch):
1095         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
1096         strict nesting works correctly.
1097         (foo):
1098         (bar.baz):
1099         (bar):
1100         * stress/strict-function-structure.js: Added. The test used to
1101         assert in objectProtoFuncHasOwnProperty.
1102         (foo):
1103         (bar):
1104         (baz):
1105         * stress/strict-nested-function-structure.js: Added. Nesting.
1106         (foo):
1107         (bar):
1108         (baz.boo):
1109         (baz):
1110
1111 2017-11-29  Robin Morisset  <rmorisset@apple.com>
1112
1113         The recursive tail call optimisation is wrong on closures
1114         https://bugs.webkit.org/show_bug.cgi?id=179835
1115
1116         Reviewed by Saam Barati.
1117
1118         * stress/closure-recursive-tail-call.js: Added.
1119         (makeClosure):
1120
1121 2017-11-27  JF Bastien  <jfbastien@apple.com>
1122
1123         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
1124         https://bugs.webkit.org/show_bug.cgi?id=180051
1125         <rdar://problem/35614371>
1126
1127         Reviewed by Saam Barati.
1128
1129         * stress/rest-parameter-negative.js: Added.
1130         (__f_5484):
1131         (catch):
1132         (__f_5485):
1133         (__v_22598.catch):
1134
1135 2017-11-27  Saam Barati  <sbarati@apple.com>
1136
1137         Spread can escape when CreateRest does not
1138         https://bugs.webkit.org/show_bug.cgi?id=180057
1139         <rdar://problem/35676119>
1140
1141         Reviewed by JF Bastien.
1142
1143         * stress/spread-escapes-but-create-rest-does-not.js: Added.
1144         (assert):
1145         (getProperties):
1146         (theFunc):
1147         (let.obj.valueOf):
1148
1149 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1150
1151         [DFG] Add NormalizeMapKey DFG IR
1152         https://bugs.webkit.org/show_bug.cgi?id=179912
1153
1154         Reviewed by Saam Barati.
1155
1156         * stress/map-untyped-normalize-cse.js: Added.
1157         (shouldBe):
1158         (test):
1159         * stress/map-untyped-normalize.js: Added.
1160         (shouldBe):
1161         (test):
1162         * stress/set-untyped-normalize-cse.js: Added.
1163         (shouldBe):
1164         (set return.set has.set has):
1165         * stress/set-untyped-normalize.js: Added.
1166         (shouldBe):
1167         (set return.set has):
1168
1169 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1170
1171         [FTL] Support DeleteById and DeleteByVal
1172         https://bugs.webkit.org/show_bug.cgi?id=180022
1173
1174         Reviewed by Saam Barati.
1175
1176         * stress/delete-by-id.js: Added.
1177         (shouldBe):
1178         (test1):
1179         (test2):
1180         * stress/delete-by-val-ftl.js: Added.
1181         (shouldBe):
1182         (test1):
1183         (test2):
1184
1185 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1186
1187         [DFG] Introduce {Set,Map,WeakMap}Fields
1188         https://bugs.webkit.org/show_bug.cgi?id=179925
1189
1190         Reviewed by Saam Barati.
1191
1192         * stress/map-set-clobber-map-get.js: Added.
1193         (shouldBe):
1194         (test):
1195         * stress/map-set-does-not-clobber-set-has.js: Added.
1196         (shouldBe):
1197         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
1198         (shouldBe):
1199         (test):
1200         * stress/set-add-clobber-set-has.js: Added.
1201         (shouldBe):
1202         * stress/set-add-does-not-clobber-map-get.js: Added.
1203         (shouldBe):
1204
1205 2017-11-24  Mark Lam  <mark.lam@apple.com>
1206
1207         Move unsafe jsc shell test functions to the $vm object.
1208         https://bugs.webkit.org/show_bug.cgi?id=179980
1209
1210         Reviewed by Yusuke Suzuki.
1211
1212         * controlFlowProfiler/driver/driver.js:
1213         * controlFlowProfiler/execution-count.js:
1214         * controlFlowProfiler/if-statement.js:
1215         * controlFlowProfiler/loop-statements.js:
1216         * controlFlowProfiler/switch-statements.js:
1217         * controlFlowProfiler/test-jit.js:
1218         * exceptionFuzz/3d-cube.js:
1219         * exceptionFuzz/date-format-xparb.js:
1220         * exceptionFuzz/earley-boyer.js:
1221         * heapProfiler/basic-edges.js:
1222         * heapProfiler/property-edge-types.js:
1223         * microbenchmarks/try-get-by-id-basic.js:
1224         * microbenchmarks/try-get-by-id-polymorphic.js:
1225         * modules/namespace-object-try-get.js:
1226         * stress/argument-count-bytecode.js:
1227         * stress/argument-intrinsic-basic.js:
1228         * stress/argument-intrinsic-inlining-use-caller-arg.js:
1229         * stress/argument-intrinsic-inlining-with-result-escape.js:
1230         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
1231         * stress/argument-intrinsic-inlining-with-vararg.js:
1232         * stress/argument-intrinsic-nested-inlining.js:
1233         * stress/argument-intrinsic-not-convert-to-get-argument.js:
1234         * stress/argument-intrinsic-with-stack-write.js:
1235         * stress/arity-mismatch-get-argument.js:
1236         * stress/array-message-passing.js:
1237         * stress/array-push-with-force-exit.js:
1238         * stress/check-dom-with-signature.js:
1239         * stress/check-sub-class.js:
1240         * stress/compare-eq-incomplete-profile.js:
1241         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
1242         * stress/do-eval-virtual-call-correctly.js:
1243         * stress/dom-jit-with-poly-proto.js:
1244         * stress/domjit-exception-ic.js:
1245         * stress/domjit-exception.js:
1246         * stress/domjit-getter-complex-with-incorrect-object.js:
1247         * stress/domjit-getter-complex.js:
1248         * stress/domjit-getter-poly.js:
1249         * stress/domjit-getter-proto.js:
1250         * stress/domjit-getter-super-poly.js:
1251         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
1252         * stress/domjit-getter-type-check.js:
1253         * stress/domjit-getter.js:
1254         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
1255         * stress/for-in-proxy-target-changed-structure.js:
1256         * stress/for-in-proxy.js:
1257         * stress/generational-opaque-roots.js:
1258         * stress/global-const-redeclaration-setting-2.js:
1259         * stress/global-const-redeclaration-setting-3.js:
1260         * stress/global-const-redeclaration-setting-4.js:
1261         * stress/global-const-redeclaration-setting-5.js:
1262         * stress/global-const-redeclaration-setting.js:
1263         * stress/import-basic.js:
1264         * stress/import-from-eval.js:
1265         * stress/import-reject-with-exception.js:
1266         * stress/import-syntax.js:
1267         * stress/impure-get-own-property-slot-inline-cache.js:
1268         * stress/is-constructor.js:
1269         * stress/istypedarrayview-intrinsic.js:
1270         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
1271         * stress/jsc-test-functions-should-be-more-robust.js:
1272         * stress/object-toString-with-proxy.js:
1273         * stress/poly-proto-custom-value-and-accessor.js:
1274         * stress/proxy-inline-cache.js:
1275         * stress/re-execute-error-module.js:
1276         * stress/regress-150532.js:
1277         * stress/regress-156992.js:
1278         * stress/regress-179619.js:
1279         * stress/resources/shadow-chicken-support.js:
1280         * stress/runtime-array.js:
1281         * stress/sampling-profiler-microtasks.js:
1282         * stress/shadow-chicken-enabled.js:
1283         * stress/spread-correct-global-object-on-exception.js:
1284         * stress/super-get-by-id.js:
1285         * stress/tailCallForwardArguments.js:
1286         * stress/to-object-intrinsic-boolean-edge.js:
1287         * stress/to-object-intrinsic-null-or-undefined-edge.js:
1288         * stress/to-object-intrinsic-number-edge.js:
1289         * stress/to-object-intrinsic-object-edge.js:
1290         * stress/to-object-intrinsic-string-edge.js:
1291         * stress/to-object-intrinsic-symbol-edge.js:
1292         * stress/to-object-intrinsic.js:
1293         * stress/try-catch-custom-getter-as-get-by-id.js:
1294         * stress/try-get-by-id-poly-proto.js:
1295         * stress/try-get-by-id-should-spill-registers-dfg.js:
1296         * stress/try-get-by-id.js:
1297         * typeProfiler/arrow-functions.js:
1298         * typeProfiler/basic.js:
1299         * typeProfiler/captured.js:
1300         * typeProfiler/classes.js:
1301         * typeProfiler/dfg-jit-optimizations.js:
1302         * typeProfiler/dictionary-mode.js:
1303         * typeProfiler/es6-block-scoping.js:
1304         * typeProfiler/es6-classes.js:
1305         * typeProfiler/inheritance.js:
1306         * typeProfiler/int52-dfg.js:
1307         * typeProfiler/loop.js:
1308         * typeProfiler/optional-fields.js:
1309         * typeProfiler/overflow.js:
1310         * typeProfiler/return.js:
1311         * typeProfiler/symbol.js:
1312         * typeProfiler/weird-prototype-chain.js:
1313
1314 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1315
1316         [DFG][FTL] Support MapSet / SetAdd intrinsics
1317         https://bugs.webkit.org/show_bug.cgi?id=179858
1318
1319         Reviewed by Saam Barati.
1320
1321         * microbenchmarks/map-has-and-set.js: Added.
1322         (test):
1323         * stress/map-set-check-failure.js: Added.
1324         (shouldBe):
1325         (shouldThrow):
1326         (target):
1327         * stress/map-set-cse.js: Added.
1328         (shouldBe):
1329         (test):
1330         * stress/set-add-check-failure.js: Added.
1331         (shouldBe):
1332         (shouldThrow):
1333         (set shouldThrow):
1334         * stress/set-add-cse.js: Added.
1335         (shouldBe):
1336
1337 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1338
1339         [JSC] Allow poly proto for intrinsic getters
1340         https://bugs.webkit.org/show_bug.cgi?id=179550
1341
1342         Reviewed by Saam Barati.
1343
1344         This change is also tested by existing tests.
1345
1346             1. stress/intrinsic-getter-with-poly-proto.js
1347             2. stress/poly-proto-intrinsic-getter-correctness.js
1348
1349         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
1350         (shouldBe):
1351         (makePolyProtoObject.foo.C):
1352         (makePolyProtoObject.foo):
1353         (makePolyProtoObject):
1354         (target):
1355         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
1356         (shouldBe):
1357         (makePolyProtoObject.foo.C):
1358         (makePolyProtoObject.foo):
1359         (makePolyProtoObject):
1360         (target):
1361
1362 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
1363
1364         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
1365         https://bugs.webkit.org/show_bug.cgi?id=179744
1366
1367         Reviewed by Michael Catanzaro.
1368
1369         This test uses too much memory for our buildbots on these platforms
1370         and gets OOM-killed.
1371
1372         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1373         Skip if $memoryLimited and linux.
1374
1375 2017-11-17  JF Bastien  <jfbastien@apple.com>
1376
1377         WebAssembly JS API: throw when a promise can't be created
1378         https://bugs.webkit.org/show_bug.cgi?id=179826
1379         <rdar://problem/35455813>
1380
1381         Reviewed by Mark Lam.
1382
1383         Test WebAssembly.{compile,instantiate} where promise creation
1384         fails because of a stack overflow.
1385
1386         * wasm/js-api/promise-stack-overflow.js: Added.
1387         (const.runNearStackLimit.f.const.t):
1388         (async.testCompile):
1389         (async.testInstantiate):
1390
1391 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1392
1393         Unreviewed, mark regress-178385.js as memory exhausting
1394
1395         * stress/regress-178385.js:
1396
1397 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
1398
1399         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
1400
1401         Unreviewed test gardening.
1402
1403         * test262.yaml:
1404
1405 2017-11-16  Robin Morisset  <rmorisset@apple.com>
1406
1407         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
1408         https://bugs.webkit.org/show_bug.cgi?id=179763
1409         <rdar://problem/35550513>
1410
1411         Reviewed by Keith Miller.
1412
1413         Just adding a slightly cleaned-up version of the original fuzzer-found test.
1414
1415         * stress/tdz-this-in-try-catch.js: Added.
1416         (__v_6388):
1417         (__v_6392):
1418
1419 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1420
1421         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
1422         https://bugs.webkit.org/show_bug.cgi?id=179594
1423
1424         Reviewed by Saam Barati.
1425
1426         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
1427         (shouldBe):
1428         (args):
1429         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
1430         (shouldBe):
1431         (args):
1432
1433 2017-11-14  Saam Barati  <sbarati@apple.com>
1434
1435         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
1436         https://bugs.webkit.org/show_bug.cgi?id=179639
1437         <rdar://problem/35513018>
1438
1439         Reviewed by JF Bastien.
1440
1441         * wasm/function-tests/grow-memory-cause-gc.js: Added.
1442         (escape):
1443         (i.func):
1444
1445 2017-11-13  Mark Lam  <mark.lam@apple.com>
1446
1447         Add more overflow check book-keeping for MarkedArgumentBuffer.
1448         https://bugs.webkit.org/show_bug.cgi?id=179634
1449         <rdar://problem/35492517>
1450
1451         Reviewed by Saam Barati.
1452
1453         * stress/regress-179634.js: Added.
1454
1455 2017-11-13  Mark Lam  <mark.lam@apple.com>
1456
1457         Make the jsc shell loadGetterFromGetterSetter() function more robust.
1458         https://bugs.webkit.org/show_bug.cgi?id=179619
1459         <rdar://problem/35492518>
1460
1461         Reviewed by Saam Barati.
1462
1463         * stress/regress-179619.js: Added.
1464
1465 2017-11-12  Mark Lam  <mark.lam@apple.com>
1466
1467         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
1468         https://bugs.webkit.org/show_bug.cgi?id=179562
1469         <rdar://problem/35467022>
1470
1471         Reviewed by Saam Barati.
1472
1473         * regress-179562.js: Added.
1474
1475 2017-11-08  Saam Barati  <sbarati@apple.com>
1476
1477         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
1478         https://bugs.webkit.org/show_bug.cgi?id=177792
1479
1480         Reviewed by Yusuke Suzuki.
1481
1482         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
1483         (assert):
1484         (foo.Foo.prototype.ensureX):
1485         (foo.Foo):
1486         (foo):
1487         (access):
1488
1489 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
1490
1491         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1492         https://bugs.webkit.org/show_bug.cgi?id=178592
1493
1494         Unreviewed test gardening.
1495
1496         * test262.yaml:
1497
1498 2017-11-08  Robin Morisset  <rmorisset@apple.com>
1499
1500         Turn recursive tail calls into loops
1501         https://bugs.webkit.org/show_bug.cgi?id=176601
1502
1503         Reviewed by Saam Barati.
1504
1505         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
1506
1507         Add some simple test that computes factorial in several ways, and other trivial computations.
1508         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1509         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1510         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1511         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1512
1513         * stress/inline-call-to-recursive-tail-call.js: Added.
1514         (factorial.aux):
1515         (factorial):
1516         (factorial2.aux2):
1517         (factorial2.id):
1518         (factorial2):
1519         (factorial3.aux3):
1520         (factorial3):
1521         (aux4):
1522         (factorial4):
1523         (foo):
1524         (auxBar):
1525         (bar):
1526         (test):
1527
1528 2017-11-07  Mark Lam  <mark.lam@apple.com>
1529
1530         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1531         https://bugs.webkit.org/show_bug.cgi?id=179355
1532         <rdar://problem/35263053>
1533
1534         Reviewed by Saam Barati.
1535
1536         * stress/regress-179355.js: Added.
1537
1538 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1539
1540         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1541         https://bugs.webkit.org/show_bug.cgi?id=144458
1542
1543         Reviewed by Saam Barati.
1544
1545         * microbenchmarks/dfg-internal-function-call.js: Added.
1546         (target):
1547         * microbenchmarks/dfg-internal-function-construct.js: Added.
1548         (target):
1549         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1550         (target):
1551         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1552         (target):
1553         * stress/dfg-internal-function-call.js: Added.
1554         (shouldBe):
1555         (target):
1556         * stress/dfg-internal-function-construct.js: Added.
1557         (shouldBe):
1558         (target):
1559         * stress/internal-function-call.js: Added.
1560         (shouldBe):
1561         * stress/internal-function-construct.js: Added.
1562         (shouldBe):
1563
1564 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1565
1566         [Win] Skip stress/regress-178385.js.
1567         https://bugs.webkit.org/show_bug.cgi?id=179298
1568
1569         Unreviewed test gardening.
1570
1571         * stress/regress-178385.js:
1572
1573 2017-11-03  Keith Miller  <keith_miller@apple.com>
1574
1575         Add test for ic with side effects
1576         https://bugs.webkit.org/show_bug.cgi?id=179268
1577
1578         Reviewed by Saam Barati.
1579
1580         * stress/put-inline-cache-side-effects.js: Added.
1581         (let.i.of.objs.keys):
1582         (f):
1583
1584 2017-11-03  Mark Lam  <mark.lam@apple.com>
1585
1586         CachedCall (and its clients) needs overflow checks.
1587         https://bugs.webkit.org/show_bug.cgi?id=179185
1588
1589         Reviewed by JF Bastien.
1590
1591         * stress/regress-179185.js: Added.
1592
1593 2017-11-02  Michael Saboff  <msaboff@apple.com>
1594
1595         DFG needs to handle code motion of code in for..in loop bodies
1596         https://bugs.webkit.org/show_bug.cgi?id=179212
1597
1598         Reviewed by Keith Miller.
1599
1600         New regression test.
1601
1602         * stress/for-in-side-effects.js: Added.
1603         (getPrototypeOf):
1604         (reset):
1605         (testWithoutFTL.f):
1606         (testWithoutFTL):
1607         (testWithFTL.f):
1608         (testWithFTL):
1609
1610 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1611
1612         AI does not correctly model the clobber case of ArithClz32
1613         https://bugs.webkit.org/show_bug.cgi?id=179188
1614
1615         Reviewed by Michael Saboff.
1616
1617         * stress/arith-clz32-effects.js: Added.
1618         (foo):
1619         (valueOf):
1620
1621 2017-11-01  Michael Saboff  <msaboff@apple.com>
1622
1623         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1624         https://bugs.webkit.org/show_bug.cgi?id=179140
1625
1626         Reviewed by Saam Barati.
1627
1628         New regression test.
1629
1630         * stress/regress-179140.js: Added.
1631         (testWithoutFTL):
1632         (testWithFTL):
1633
1634 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1635
1636         [JSC] Introduce @toObject
1637         https://bugs.webkit.org/show_bug.cgi?id=178726
1638
1639         Reviewed by Saam Barati.
1640
1641         * stress/array-copywithin.js:
1642         (shouldThrow):
1643         * stress/object-constructor-boolean-edge.js: Added.
1644         (shouldBe):
1645         (test):
1646         * stress/object-constructor-global.js: Added.
1647         (shouldBe):
1648         * stress/object-constructor-null-edge.js: Added.
1649         (shouldBe):
1650         (test):
1651         * stress/object-constructor-number-edge.js: Added.
1652         (shouldBe):
1653         (test):
1654         * stress/object-constructor-object-edge.js: Added.
1655         (shouldBe):
1656         (test):
1657         (i.arg):
1658         * stress/object-constructor-string-edge.js: Added.
1659         (shouldBe):
1660         (test):
1661         * stress/object-constructor-symbol-edge.js: Added.
1662         (shouldBe):
1663         (test):
1664         * stress/object-constructor-undefined-edge.js: Added.
1665         (shouldBe):
1666         (test):
1667         * stress/symbol-array-from.js: Added.
1668         (shouldBe):
1669         * stress/to-object-intrinsic-boolean-edge.js: Added.
1670         (shouldBe):
1671         (builtin.createBuiltin):
1672         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1673         (shouldThrow):
1674         * stress/to-object-intrinsic-number-edge.js: Added.
1675         (shouldBe):
1676         (builtin.createBuiltin):
1677         * stress/to-object-intrinsic-object-edge.js: Added.
1678         (shouldBe):
1679         (builtin.createBuiltin):
1680         (i.arg):
1681         * stress/to-object-intrinsic-string-edge.js: Added.
1682         (shouldBe):
1683         (builtin.createBuiltin):
1684         * stress/to-object-intrinsic-symbol-edge.js: Added.
1685         (shouldBe):
1686         (builtin.createBuiltin):
1687         * stress/to-object-intrinsic.js: Added.
1688         (shouldBe):
1689         (shouldThrow):
1690         (builtin.createBuiltin):
1691
1692 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1693
1694         [DFG][FTL] Introduce StringSlice
1695         https://bugs.webkit.org/show_bug.cgi?id=178934
1696
1697         Reviewed by Saam Barati.
1698
1699         * microbenchmarks/string-slice-empty.js: Added.
1700         (slice):
1701         * microbenchmarks/string-slice-one-char.js: Added.
1702         (slice):
1703         * microbenchmarks/string-slice.js: Added.
1704         (slice):
1705
1706 2017-10-26  Michael Saboff  <msaboff@apple.com>
1707
1708         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1709         https://bugs.webkit.org/show_bug.cgi?id=178890
1710
1711         Reviewed by Keith Miller.
1712
1713         New regression test.
1714
1715         * stress/regress-178890.js: Added.
1716
1717 2017-10-26  Mark Lam  <mark.lam@apple.com>
1718
1719         JSRopeString::RopeBuilder::append() should check for overflows.
1720         https://bugs.webkit.org/show_bug.cgi?id=178385
1721         <rdar://problem/35027468>
1722
1723         Reviewed by Saam Barati.
1724
1725         * stress/regress-178385.js: Added.
1726
1727 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1728
1729         Unreviewed, rolling out r223961.
1730
1731         The change that required this has been rolled out.
1732
1733         Reverted changeset:
1734
1735         "Mark test262.yaml/test262/test/language/statements/try/tco-
1736         catch.js as passing."
1737         https://bugs.webkit.org/show_bug.cgi?id=178592
1738         https://trac.webkit.org/changeset/223961
1739
1740 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1741
1742         Unreviewed, rolling out r223691 and r223729.
1743         https://bugs.webkit.org/show_bug.cgi?id=178834
1744
1745         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1746         by rniwa on #webkit).
1747
1748         Reverted changesets:
1749
1750         "Turn recursive tail calls into loops"
1751         https://bugs.webkit.org/show_bug.cgi?id=176601
1752         https://trac.webkit.org/changeset/223691
1753
1754         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1755         comparison is always false due to limited range of data type
1756         [-Wtype-limits]"
1757         https://bugs.webkit.org/show_bug.cgi?id=178543
1758         https://trac.webkit.org/changeset/223729
1759
1760 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1761
1762         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1763         https://bugs.webkit.org/show_bug.cgi?id=178592
1764
1765         Unreviewed test gardening.
1766
1767         * test262.yaml:
1768
1769 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1770
1771         [FTL] Support NewStringObject
1772         https://bugs.webkit.org/show_bug.cgi?id=178737
1773
1774         Reviewed by Saam Barati.
1775
1776         * stress/new-string-object.js: Added.
1777         (shouldBe):
1778         (test):
1779
1780 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1781
1782         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1783         https://bugs.webkit.org/show_bug.cgi?id=178308
1784
1785         Reviewed by Mark Lam.
1786
1787         * test262.yaml:
1788
1789 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1790
1791         [JSC] Use fastJoin in Array#toString
1792         https://bugs.webkit.org/show_bug.cgi?id=178062
1793
1794         Reviewed by Darin Adler.
1795
1796         * microbenchmarks/contiguous-array-to-string.js: Added.
1797         (target):
1798         * microbenchmarks/double-array-to-string.js: Added.
1799         (target):
1800         * microbenchmarks/int32-array-to-string.js: Added.
1801         (target):
1802
1803 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1804
1805         stress/check-string-ident.js is improperly skipped
1806         https://bugs.webkit.org/show_bug.cgi?id=178642
1807
1808         Reviewed by Saam Barati.
1809
1810         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1811         since it enforces the run-jsc-stress-tests script to still set up the
1812         test to run, despite the skip directive that's used before.
1813
1814 2017-10-20  Mark Lam  <mark.lam@apple.com>
1815
1816         Add a test case for r214334.
1817         https://bugs.webkit.org/show_bug.cgi?id=169941
1818         <rdar://problem/31221258>
1819
1820         Reviewed by JF Bastien.
1821
1822         * stress/regress-169941.js: Added.
1823
1824 2017-10-19  JF Bastien  <jfbastien@apple.com>
1825
1826         WebAssembly: no VM / JS version of everything but Instance
1827         https://bugs.webkit.org/show_bug.cgi?id=177473
1828
1829         Reviewed by Filip Pizlo, Saam Barati.
1830
1831         - Exceeding max on memory growth now returns a range error as per
1832         spec. This is a (very minor) breaking change: it used to throw OOM
1833         error. Update the corresponding test.
1834
1835         * wasm/js-api/memory-grow.js:
1836         (assertEq):
1837         * wasm/js-api/table.js:
1838         (assert.throws):
1839
1840 2017-10-19  Mark Lam  <mark.lam@apple.com>
1841
1842         Stringifier::appendStringifiedValue() is missing an exception check.
1843         https://bugs.webkit.org/show_bug.cgi?id=178386
1844         <rdar://problem/35027610>
1845
1846         Reviewed by Saam Barati.
1847
1848         * stress/regress-178386.js: Added.
1849
1850 2017-10-19  Michael Saboff  <msaboff@apple.com>
1851
1852         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1853         https://bugs.webkit.org/show_bug.cgi?id=178521
1854
1855         Reviewed by JF Bastien.
1856
1857         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1858         now passes with the current version (5.0) of the Emoji spec.
1859
1860 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1861
1862         Turn recursive tail calls into loops
1863         https://bugs.webkit.org/show_bug.cgi?id=176601
1864
1865         Reviewed by Saam Barati.
1866
1867         Add some simple test that computes factorial in several ways, and other trivial computations.
1868         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1869         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1870         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1871         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1872
1873         * stress/inline-call-to-recursive-tail-call.js: Added.
1874         (factorial.aux):
1875         (factorial):
1876         (factorial2.aux):
1877         (factorial2.id):
1878         (factorial2):
1879         (factorial3.aux):
1880         (factorial3):
1881         (aux):
1882         (factorial4):
1883         (test):
1884
1885 2017-10-18  Mark Lam  <mark.lam@apple.com>
1886
1887         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1888         https://bugs.webkit.org/show_bug.cgi?id=177600
1889         <rdar://problem/34710985>
1890
1891         Reviewed by Saam Barati.
1892
1893         * stress/regress-177600.js: Added.
1894
1895 2017-10-18  Mark Lam  <mark.lam@apple.com>
1896
1897         The compiler should always register a structure when it adds its transitionWatchPointSet.
1898         https://bugs.webkit.org/show_bug.cgi?id=178420
1899         <rdar://problem/34814024>
1900
1901         Reviewed by Saam Barati and Filip Pizlo.
1902
1903         * stress/regress-178420.js: Added.
1904         (new.Array.10000.map):
1905
1906 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1907
1908         [JSC] __proto__ getter should be fast
1909         https://bugs.webkit.org/show_bug.cgi?id=178067
1910
1911         Reviewed by Saam Barati.
1912
1913         * stress/dfg-object-proto-accessor.js: Added.
1914         (shouldBe):
1915         (shouldThrow):
1916         (target):
1917         * stress/dfg-object-proto-getter.js: Added.
1918         (shouldBe):
1919         (shouldThrow):
1920         (target):
1921         * stress/dfg-object-prototype-of.js: Added.
1922         (shouldBe):
1923         (shouldThrow):
1924         (target):
1925         * stress/dfg-reflect-get-prototype-of.js: Added.
1926         (shouldBe):
1927         (shouldThrow):
1928         (target):
1929         * stress/intrinsic-getter-with-poly-proto.js: Added.
1930         (shouldBe):
1931         (makePolyProtoObject.foo.C):
1932         (makePolyProtoObject.foo):
1933         (makePolyProtoObject):
1934         (target):
1935         * stress/object-get-prototype-of-filtered.js: Added.
1936         (shouldBe):
1937         (shouldThrow):
1938         (target):
1939         (i.Cocoa):
1940         * stress/object-get-prototype-of-mono-proto.js: Added.
1941         (shouldBe):
1942         (makePolyProtoObject.foo.C):
1943         (makePolyProtoObject.foo):
1944         (makePolyProtoObject):
1945         (target):
1946         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1947         (shouldBe):
1948         (makePolyProtoObject.foo.C):
1949         (makePolyProtoObject.foo):
1950         (makePolyProtoObject):
1951         (target):
1952         * stress/object-get-prototype-of-poly-proto.js: Added.
1953         (shouldBe):
1954         (makePolyProtoObject.foo.C):
1955         (makePolyProtoObject.foo):
1956         (makePolyProtoObject):
1957         (target):
1958         * stress/object-proto-getter-filtered.js: Added.
1959         (shouldBe):
1960         (shouldThrow):
1961         (target):
1962         (i.Cocoa):
1963         * stress/object-proto-getter-poly-mono-proto.js: Added.
1964         (shouldBe):
1965         (makePolyProtoObject.foo.C):
1966         (makePolyProtoObject.foo):
1967         (makePolyProtoObject):
1968         (target):
1969         * stress/object-proto-getter-poly-proto.js: Added.
1970         (shouldBe):
1971         (makePolyProtoObject.foo.C):
1972         (makePolyProtoObject.foo):
1973         (makePolyProtoObject):
1974         (target):
1975         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1976         * stress/string-proto.js: Added.
1977         (shouldBe):
1978         (target):
1979
1980 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1981
1982         Unreviewed, rolling out r223523.
1983
1984         A test for this change is failing on debug JSC bots.
1985
1986         Reverted changeset:
1987
1988         "[JSC] __proto__ getter should be fast"
1989         https://bugs.webkit.org/show_bug.cgi?id=178067
1990         https://trac.webkit.org/changeset/223523
1991
1992 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1993
1994         [JSC] __proto__ getter should be fast
1995         https://bugs.webkit.org/show_bug.cgi?id=178067
1996
1997         Reviewed by Saam Barati.
1998
1999         * stress/dfg-object-proto-accessor.js: Added.
2000         (shouldBe):
2001         (shouldThrow):
2002         (target):
2003         * stress/dfg-object-proto-getter.js: Added.
2004         (shouldBe):
2005         (shouldThrow):
2006         (target):
2007         * stress/dfg-object-prototype-of.js: Added.
2008         (shouldBe):
2009         (shouldThrow):
2010         (target):
2011         * stress/dfg-reflect-get-prototype-of.js: Added.
2012         (shouldBe):
2013         (shouldThrow):
2014         (target):
2015         * stress/object-get-prototype-of-filtered.js: Added.
2016         (shouldBe):
2017         (shouldThrow):
2018         (target):
2019         (i.Cocoa):
2020         * stress/object-get-prototype-of-mono-proto.js: Added.
2021         (shouldBe):
2022         (makePolyProtoObject.foo.C):
2023         (makePolyProtoObject.foo):
2024         (makePolyProtoObject):
2025         (target):
2026         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
2027         (shouldBe):
2028         (makePolyProtoObject.foo.C):
2029         (makePolyProtoObject.foo):
2030         (makePolyProtoObject):
2031         (target):
2032         * stress/object-get-prototype-of-poly-proto.js: Added.
2033         (shouldBe):
2034         (makePolyProtoObject.foo.C):
2035         (makePolyProtoObject.foo):
2036         (makePolyProtoObject):
2037         (target):
2038         * stress/object-proto-getter-filtered.js: Added.
2039         (shouldBe):
2040         (shouldThrow):
2041         (target):
2042         (i.Cocoa):
2043         * stress/object-proto-getter-poly-mono-proto.js: Added.
2044         (shouldBe):
2045         (makePolyProtoObject.foo.C):
2046         (makePolyProtoObject.foo):
2047         (makePolyProtoObject):
2048         (target):
2049         * stress/object-proto-getter-poly-proto.js: Added.
2050         (shouldBe):
2051         (makePolyProtoObject.foo.C):
2052         (makePolyProtoObject.foo):
2053         (makePolyProtoObject):
2054         (target):
2055         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
2056         * stress/string-proto.js: Added.
2057         (shouldBe):
2058         (target):
2059
2060 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2061
2062         Reland "Add Above/Below comparisons for UInt32 patterns"
2063         https://bugs.webkit.org/show_bug.cgi?id=177281
2064
2065         Reviewed by Saam Barati.
2066
2067         * stress/uint32-comparison-jump.js: Added.
2068         (shouldBe):
2069         (above):
2070         (aboveOrEqual):
2071         (below):
2072         (belowOrEqual):
2073         (notAbove):
2074         (notAboveOrEqual):
2075         (notBelow):
2076         (notBelowOrEqual):
2077         * stress/uint32-comparison.js: Added.
2078         (shouldBe):
2079         (above):
2080         (aboveOrEqual):
2081         (below):
2082         (belowOrEqual):
2083         (aboveTest):
2084         (aboveOrEqualTest):
2085         (belowTest):
2086         (belowOrEqualTest):
2087
2088 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2089
2090         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
2091         https://bugs.webkit.org/show_bug.cgi?id=178210
2092
2093         Reviewed by Saam Barati.
2094
2095         * wasm/function-tests/trap-from-start-async.js:
2096         (async.StartTrapsAsync):
2097         * wasm/function-tests/trap-from-start.js:
2098         (StartTraps):
2099         * wasm/js-api/web-assembly-function.js:
2100         (assert.eq.Object.getPrototypeOf):
2101         * wasm/js-api/wrapper-function.js:
2102         (return.new.WebAssembly.Module):
2103         (assert.throws.makeInstance): Deleted.
2104         (assert.throws.Bar): Deleted.
2105         (assert.throws): Deleted.
2106
2107 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
2108
2109         Enable gigacage on iOS
2110         https://bugs.webkit.org/show_bug.cgi?id=177586
2111
2112         Reviewed by JF Bastien.
2113         
2114         Add tests for when Gigacage gets runtime disabled.
2115
2116         * stress/disable-gigacage-arrays.js: Added.
2117         (foo):
2118         * stress/disable-gigacage-strings.js: Added.
2119         (foo):
2120         * stress/disable-gigacage-typed-arrays.js: Added.
2121         (foo):
2122
2123 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
2124
2125         import.meta should not be assignable
2126         https://bugs.webkit.org/show_bug.cgi?id=178202
2127
2128         Reviewed by Saam Barati.
2129
2130         * modules/import-meta-assignment.js: Added.
2131         (shouldThrow):
2132         (SyntaxError.import.meta.can.shouldThrow):
2133
2134 2017-10-11  Saam Barati  <sbarati@apple.com>
2135
2136         Unreviewed. Actually skip certain type profiler tests in debug.
2137
2138         * typeProfiler.yaml:
2139         * typeProfiler/deltablue-for-of.js:
2140         * typeProfiler/getter-richards.js:
2141
2142 2017-10-11  Commit Queue  <commit-queue@webkit.org>
2143
2144         Unreviewed, rolling out r223113 and r223121.
2145         https://bugs.webkit.org/show_bug.cgi?id=178182
2146
2147         Reintroduced 20% regression on Kraken (Requested by rniwa on
2148         #webkit).
2149
2150         Reverted changesets:
2151
2152         "Enable gigacage on iOS"
2153         https://bugs.webkit.org/show_bug.cgi?id=177586
2154         https://trac.webkit.org/changeset/223113
2155
2156         "Use one virtual allocation for all gigacages and their
2157         runways"
2158         https://bugs.webkit.org/show_bug.cgi?id=178050
2159         https://trac.webkit.org/changeset/223121
2160
2161 2017-10-11  Michael Saboff  <msaboff@apple.com>
2162
2163         Disable test262 named capture group tests with direct unicode names and with references before definitions
2164         https://bugs.webkit.org/show_bug.cgi?id=178177
2165
2166         Reviewed by Keith Miller.
2167
2168         Bugs to track fixing these test are:
2169         https://bugs.webkit.org/show_bug.cgi?id=178174 -
2170             "Add support in named capture group identifiers for direct surrogate pairs"
2171         https://bugs.webkit.org/show_bug.cgi?id=178175 -
2172             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
2173
2174         * test262.yaml:
2175
2176 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
2177
2178         Object properties are undefined in super.call() but not in this.call()
2179         https://bugs.webkit.org/show_bug.cgi?id=177230
2180
2181         Reviewed by Saam Barati.
2182
2183         * stress/super-call-function-subclass.js: Added.
2184         (assert):
2185         (A.prototype.t):
2186         (A):
2187         * stress/super-dot-call-and-apply.js: Added.
2188         (assert):
2189         (A):
2190         (A.prototype.call):
2191         (A.prototype.apply):
2192         (B.prototype.testSuper):
2193         (B):
2194         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
2195         (D.prototype.testSuper):
2196         (D):
2197
2198 2017-10-10  Saam Barati  <sbarati@apple.com>
2199
2200         The prototype cache should be aware of the Executable it generates a Structure for
2201         https://bugs.webkit.org/show_bug.cgi?id=177907
2202
2203         Reviewed by Filip Pizlo.
2204
2205         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
2206         (assert):
2207         (foo.C):
2208         (foo):
2209         (bar.C):
2210         (bar):
2211         (access):
2212         (makeLongChain):
2213         (accessY):
2214
2215 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2216
2217         `async` should be able to be used as an imported binding name
2218         https://bugs.webkit.org/show_bug.cgi?id=176573
2219
2220         Reviewed by Saam Barati.
2221
2222         * modules/import-default-async.js: Added.
2223         * modules/import-named-async-as.js: Added.
2224         * modules/import-named-async.js: Added.
2225         * modules/import-named-async/target.js: Added.
2226         * modules/import-namespace-async.js: Added.
2227         * test262.yaml:
2228
2229 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
2230
2231         Enable gigacage on iOS
2232         https://bugs.webkit.org/show_bug.cgi?id=177586
2233
2234         Reviewed by JF Bastien.
2235         
2236         Add tests for when Gigacage gets runtime disabled.
2237
2238         * stress/disable-gigacage-arrays.js: Added.
2239         (foo):
2240         * stress/disable-gigacage-strings.js: Added.
2241         (foo):
2242         * stress/disable-gigacage-typed-arrays.js: Added.
2243         (foo):
2244
2245 2017-10-09  Michael Saboff  <msaboff@apple.com>
2246
2247         Implement RegExp Unicode property escapes
2248         https://bugs.webkit.org/show_bug.cgi?id=172069
2249
2250         Reviewed by JF Bastien.
2251
2252         Enabled Unicode Property tests.
2253
2254         * test262.yaml:
2255
2256 2017-10-09  Commit Queue  <commit-queue@webkit.org>
2257
2258         Unreviewed, rolling out r223015 and r223025.
2259         https://bugs.webkit.org/show_bug.cgi?id=178093
2260
2261         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
2262         #webkit).
2263
2264         Reverted changesets:
2265
2266         "Enable gigacage on iOS"
2267         https://bugs.webkit.org/show_bug.cgi?id=177586
2268         http://trac.webkit.org/changeset/223015
2269
2270         "Unreviewed, disable Gigacage on ARM64 Linux"
2271         https://bugs.webkit.org/show_bug.cgi?id=177586
2272         http://trac.webkit.org/changeset/223025
2273
2274 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
2275
2276         Update expectations for test262 tests that pass after r223043.
2277         https://bugs.webkit.org/show_bug.cgi?id=176685
2278
2279         Unreviewed test gardening.
2280
2281         * test262.yaml:
2282
2283 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
2284
2285         Unreviewed, rolling out r223022.
2286
2287         This change introduced 18 test262 failures.
2288
2289         Reverted changeset:
2290
2291         "`async` should be able to be used as an imported binding
2292         name"
2293         https://bugs.webkit.org/show_bug.cgi?id=176573
2294         http://trac.webkit.org/changeset/223022
2295
2296 2017-10-09  Saam Barati  <sbarati@apple.com>
2297
2298         3 poly-proto JSC tests timing out on debug after r222827
2299         https://bugs.webkit.org/show_bug.cgi?id=177880
2300         <rdar://problem/34817122>
2301
2302         Unreviewed.
2303
2304         I'm skipping these type profiler tests on debug since they are long running.
2305
2306         * typeProfiler/deltablue-for-of.js:
2307         * typeProfiler/getter-richards.js:
2308
2309 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2310
2311         Safari 10 /11 problem with if (!await get(something)).
2312         https://bugs.webkit.org/show_bug.cgi?id=176685
2313
2314         Reviewed by Saam Barati.
2315
2316         * stress/async-await-basic.js:
2317         (awaitEpression.async):
2318         * stress/async-await-syntax.js:
2319         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2320         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2321
2322 2017-10-08  Saam Barati  <sbarati@apple.com>
2323
2324         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
2325
2326         * typeProfiler/deltablue-for-of.js:
2327         * typeProfiler/getter-richards.js:
2328
2329 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
2330
2331         `async` should be able to be used as an imported binding name
2332         https://bugs.webkit.org/show_bug.cgi?id=176573
2333
2334         Reviewed by Darin Adler.
2335
2336         * modules/import-default-async.js: Added.
2337         * modules/import-named-async-as.js: Added.
2338         * modules/import-named-async.js: Added.
2339         * modules/import-named-async/target.js: Added.
2340         * modules/import-namespace-async.js: Added.
2341
2342 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
2343
2344         Enable gigacage on iOS
2345         https://bugs.webkit.org/show_bug.cgi?id=177586
2346
2347         Reviewed by JF Bastien.
2348         
2349         Add tests for when Gigacage gets runtime disabled.
2350
2351         * stress/disable-gigacage-arrays.js: Added.
2352         (foo):
2353         * stress/disable-gigacage-strings.js: Added.
2354         (foo):
2355         * stress/disable-gigacage-typed-arrays.js: Added.
2356         (foo):
2357
2358 2017-10-06  Commit Queue  <commit-queue@webkit.org>
2359
2360         Unreviewed, rolling out r222791 and r222873.
2361         https://bugs.webkit.org/show_bug.cgi?id=178031
2362
2363         Caused crashes with workers/wasm LayoutTests (Requested by
2364         ryanhaddad on #webkit).
2365
2366         Reverted changesets:
2367
2368         "WebAssembly: no VM / JS version of everything but Instance"
2369         https://bugs.webkit.org/show_bug.cgi?id=177473
2370         http://trac.webkit.org/changeset/222791
2371
2372         "WebAssembly: address no VM / JS follow-ups"
2373         https://bugs.webkit.org/show_bug.cgi?id=177887
2374         http://trac.webkit.org/changeset/222873
2375
2376 2017-10-05  Saam Barati  <sbarati@apple.com>
2377
2378         Make sure all prototypes under poly proto get added into the VM's prototype map
2379         https://bugs.webkit.org/show_bug.cgi?id=177909
2380
2381         Reviewed by Keith Miller.
2382
2383         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
2384         (assert):
2385         (foo.C):
2386         (foo):
2387         (set x):
2388
2389 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2390
2391         [JSC] Introduce import.meta
2392         https://bugs.webkit.org/show_bug.cgi?id=177703
2393
2394         Reviewed by Filip Pizlo.
2395
2396         * modules/import-meta-syntax.js: Added.
2397         (shouldThrow):
2398         (shouldNotThrow):
2399         * modules/import-meta.js: Added.
2400         * modules/import-meta/cocoa.js: Added.
2401         * modules/resources/assert.js:
2402         (export.shouldNotThrow):
2403         * stress/import-syntax.js:
2404
2405 2017-10-04  Saam Barati  <sbarati@apple.com>
2406
2407         Make pertinent AccessCases watch the poly proto watchpoint
2408         https://bugs.webkit.org/show_bug.cgi?id=177765
2409
2410         Reviewed by Keith Miller.
2411
2412         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
2413         (assert):
2414         (foo.C):
2415         (foo):
2416         (validate):
2417         * stress/poly-proto-clear-stub.js: Added.
2418         (assert):
2419         (foo.C):
2420         (foo):
2421
2422 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
2423
2424         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
2425
2426         Unreviewed test gardening.
2427
2428         * test262.yaml:
2429
2430 2017-10-04  Saam Barati  <sbarati@apple.com>
2431
2432         3 poly-proto JSC tests timing out on debug after r222827
2433         https://bugs.webkit.org/show_bug.cgi?id=177880
2434
2435         Rubber stamped by Mark Lam.
2436
2437         * microbenchmarks/poly-proto-access.js:
2438         * typeProfiler/deltablue-for-of.js:
2439         * typeProfiler/getter-richards.js:
2440
2441 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
2442
2443         Unreviewed, marking tco-catch.js as a failure after test262 update
2444         https://bugs.webkit.org/show_bug.cgi?id=177859
2445
2446         * test262.yaml:
2447
2448 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2449
2450         Unreviewed, marking one async iterator test262 test failed
2451         https://bugs.webkit.org/show_bug.cgi?id=177859
2452
2453         * test262.yaml:
2454
2455 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2456
2457         [Test262] Update Test262 to Oct 4 version
2458         https://bugs.webkit.org/show_bug.cgi?id=177859
2459
2460         Reviewed by Sam Weinig.
2461
2462         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
2463         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
2464
2465         * test262.yaml:
2466         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
2467         (checkSequence):
2468         * test262/harness/typeCoercion.js:
2469         (testCoercibleToIndexZero):
2470         (testCoercibleToIndexOne):
2471         (testCoercibleToIndexFromIndex):
2472         (testNotCoercibleToIndex.testPrimitiveValue):
2473         (testNotCoercibleToInteger):
2474         (testCoercibleToBigIntZero.testPrimitiveValue):
2475         (testCoercibleToBigIntZero):
2476         (testCoercibleToBigIntOne.testPrimitiveValue):
2477         (testCoercibleToBigIntOne):
2478         (testPrimitiveValue):
2479         (testCoercibleToBigIntFromBigInt):
2480         (testNotCoercibleToBigInt.testPrimitiveValue):
2481         (testNotCoercibleToBigInt.testStringValue):
2482         (testNotCoercibleToBigInt):
2483         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
2484         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
2485         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
2486         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
2487         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
2488         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
2489         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
2490         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
2491         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
2492         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
2493         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
2494         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
2495         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
2496         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
2497         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
2498         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
2499         (testCoercibleToBigIntZero):
2500         (testCoercibleToBigIntOne):
2501         (testNotCoercibleToBigInt):
2502         (MyError): Deleted.
2503         (valueOf): Deleted.
2504         (toString): Deleted.
2505         (Symbol.toPrimitive): Deleted.
2506         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
2507         (testCoercibleToIndexZero):
2508         (testCoercibleToIndexOne):
2509         (testNotCoercibleToIndex):
2510         (MyError): Deleted.
2511         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
2512         (assert.sameValue.BigInt.asIntN.toString): Deleted.
2513         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
2514         (BigInt.asIntN.valueOf): Deleted.
2515         (BigInt.asIntN.toString): Deleted.
2516         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
2517         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
2518         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
2519         (testCoercibleToBigIntZero):
2520         (testCoercibleToBigIntOne):
2521         (testNotCoercibleToBigInt):
2522         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
2523         (testCoercibleToIndexZero):
2524         (testCoercibleToIndexOne):
2525         (testNotCoercibleToIndex):
2526         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2527         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2528         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2529         (bits.valueOf):
2530         (bigint.valueOf):
2531         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2532         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2533         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2534         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2535         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2536         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2537         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2538         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2539         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2540         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2541         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2542         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2543         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2544         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2545         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2546         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2547         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2548         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2549         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2550         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2551         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2552         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2553         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2554         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2555         (replacer):
2556         (BigInt.prototype.toJSON):
2557         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2558         (replacer):
2559         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2560         (BigInt.prototype.toJSON):
2561         * test262/test/built-ins/JSON/stringify/bigint.js:
2562         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2563         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2564         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2565         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2566         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2567         * test262/test/built-ins/Object/proto-from-ctor.js:
2568         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2569         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2570         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2571         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2572         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2573         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2574         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2575         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2576         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2577         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2578         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2579         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2580         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2581         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2582         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2583         * test262/test/built-ins/Proxy/get-fn-realm.js:
2584         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2585         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2586         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2587         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2588         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2589         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2590         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2591         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2592         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2593         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2594         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2595         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2596         (i6.replace):
2597         (i6b.replace):
2598         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2599         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2600         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2601         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2602         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2603         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2604         * test262/test/built-ins/RegExp/u180e.js: Added.
2605         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2606         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2607         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2608         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2609         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2610         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2611         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2612         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2613         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2614         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2615         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2616         * test262/test/built-ins/String/prototype/endsWith/length.js:
2617         * test262/test/built-ins/String/prototype/endsWith/name.js:
2618         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2619         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2620         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2621         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2622         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2623         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2624         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2625         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2626         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2627         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2628         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2629         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2630         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2631         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2632         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2633         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2634         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2635         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2636         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2637         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2638         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2639         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2640         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2641         * test262/test/built-ins/String/prototype/includes/includes.js:
2642         * test262/test/built-ins/String/prototype/includes/length.js:
2643         * test262/test/built-ins/String/prototype/includes/name.js:
2644         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2645         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2646         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2647         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2648         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2649         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2650         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2651         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2652         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2653         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2654         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2655         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2656         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2657         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2658         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2659         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2660         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2661         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2662         * test262/test/built-ins/String/prototype/trim/u180e.js:
2663         * test262/test/built-ins/Symbol/for/cross-realm.js:
2664         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2665         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2666         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2667         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2668         * test262/test/built-ins/Symbol/match/cross-realm.js:
2669         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2670         * test262/test/built-ins/Symbol/search/cross-realm.js:
2671         * test262/test/built-ins/Symbol/species/cross-realm.js:
2672         * test262/test/built-ins/Symbol/split/cross-realm.js:
2673         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2674         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2675         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2676         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2677         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2678         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2679         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2680         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2681         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2682         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2683         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2684         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2685         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2686         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2687         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2688         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2689         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2690         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2691         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2692         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2693         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2694         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2695         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2696         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2697         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2698         * test262/test/language/eval-code/indirect/realm.js:
2699         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2700         (o.get z):
2701         (o.get a):
2702         * test262/test/language/expressions/call/eval-realm-indirect.js:
2703         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2704         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2705         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2706         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2707         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2708         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2709         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2710         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2711         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2712         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2713         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2714         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2715         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2716         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2717         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2718         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2719         * test262/test/language/expressions/less-than/bigint-and-number.js:
2720         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2721         * test262/test/language/expressions/super/realm.js:
2722         * test262/test/language/expressions/tagged-template/cache-realm.js:
2723         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2724         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2725         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2726         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2727         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2728         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2729         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2730         (o.get z):
2731         (o.get a):
2732         * test262/test/language/statements/for-of/iterator-next-reference.js:
2733         (next):
2734         (iterator.next): Deleted.
2735         (x.of.iterable.): Deleted.
2736         (x.of.iterable.get return): Deleted.
2737         (x.of.iterable.iterator.next): Deleted.
2738         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2739         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2740         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2741         * test262/test/language/white-space/mongolian-vowel-separator.js:
2742         * test262/test262-Revision.txt:
2743
2744 2017-10-03  Saam Barati  <sbarati@apple.com>
2745
2746         Implement polymorphic prototypes
2747         https://bugs.webkit.org/show_bug.cgi?id=176391
2748
2749         Reviewed by Filip Pizlo.
2750
2751         * microbenchmarks/poly-proto-access.js: Added.
2752         (assert):
2753         (foo.C):
2754         (foo.C.prototype.get bar):
2755         (foo):
2756         (bar):
2757         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2758         (assert):
2759         (makePolyProtoObject.foo.C):
2760         (makePolyProtoObject.foo):
2761         (makePolyProtoObject):
2762         (performSet):
2763         * microbenchmarks/poly-proto-setter-speed.js: Added.
2764         (assert):
2765         (makePolyProtoObject.foo.C):
2766         (makePolyProtoObject.foo.C.prototype.set p):
2767         (makePolyProtoObject.foo):
2768         (makePolyProtoObject):
2769         (performSet):
2770         * stress/constructor-with-return.js:
2771         (i.tests.forEach.Constructor):
2772         (i.tests.forEach):
2773         (tests.forEach.Constructor): Deleted.
2774         (tests.forEach): Deleted.
2775         * stress/dom-jit-with-poly-proto.js: Added.
2776         (assert):
2777         (makePolyProtoObject.foo.C):
2778         (makePolyProtoObject.foo):
2779         (makePolyProtoObject):
2780         (validate):
2781         * stress/poly-proto-custom-value-and-accessor.js: Added.
2782         (assert):
2783         (makePolyProtoObject.foo.C):
2784         (makePolyProtoObject.foo):
2785         (makePolyProtoObject):
2786         (items.forEach):
2787         (set get for):
2788         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2789         (assert):
2790         (makePolyProtoObject.foo.C):
2791         (makePolyProtoObject.foo):
2792         (makePolyProtoObject):
2793         (foo):
2794         * stress/poly-proto-miss.js: Added.
2795         (makePolyProtoInstanceWithNullPrototype.foo.C):
2796         (makePolyProtoInstanceWithNullPrototype.foo):
2797         (makePolyProtoInstanceWithNullPrototype):
2798         (assert):
2799         (validate):
2800         * stress/poly-proto-op-in-caching.js: Added.
2801         (assert):
2802         (makePolyProtoObject.foo.C):
2803         (makePolyProtoObject.foo):
2804         (makePolyProtoObject):
2805         (validate):
2806         (validate2):
2807         * stress/poly-proto-put-transition.js: Added.
2808         (assert):
2809         (makePolyProtoObject.foo.C):
2810         (makePolyProtoObject.foo):
2811         (makePolyProtoObject):
2812         (performSet):
2813         (i.obj.__proto__.set p):
2814         * stress/poly-proto-set-prototype.js: Added.
2815         (assert):
2816         (let.alternateProto.get x):
2817         (let.alternateProto2.get y):
2818         (let.alternateProto2.get x):
2819         (foo.C):
2820         (foo):
2821         (validate):
2822         * stress/poly-proto-setter.js: Added.
2823         (assert):
2824         (makePolyProtoObject.foo.C):
2825         (makePolyProtoObject.foo.C.prototype.set p):
2826         (makePolyProtoObject.foo.C.prototype.get p):
2827         (makePolyProtoObject.foo):
2828         (makePolyProtoObject):
2829         (performSet):
2830         * stress/poly-proto-using-inheritance.js: Added.
2831         (assert):
2832         (foo.C):
2833         (foo.C.prototype.get baz):
2834         (foo):
2835         (bar.C):
2836         (bar):
2837         (validate):
2838         * stress/primitive-poly-proto.js: Added.
2839         (makePolyProtoInstance.foo.C):
2840         (makePolyProtoInstance.foo):
2841         (makePolyProtoInstance):
2842         (assert):
2843         (validate):
2844         * stress/prototype-is-not-js-object.js: Added.
2845         (foo.bar):
2846         (foo):
2847         (assert):
2848         (validate):
2849         * stress/try-get-by-id-poly-proto.js: Added.
2850         (assert):
2851         (makePolyProtoObject.foo.C):
2852         (makePolyProtoObject.foo):
2853         (makePolyProtoObject):
2854         (tryGetByIdText):
2855         (x.__proto__.get bar):
2856         (validate):
2857         * typeProfiler/overflow.js:
2858
2859 2017-10-03  JF Bastien  <jfbastien@apple.com>
2860
2861         WebAssembly: no VM / JS version of everything but Instance
2862         https://bugs.webkit.org/show_bug.cgi?id=177473
2863
2864         Reviewed by Filip Pizlo.
2865
2866         - Exceeding max on memory growth now returns a range error as per
2867         spec. This is a (very minor) breaking change: it used to throw OOM
2868         error. Update the corresponding test.
2869
2870         * wasm/js-api/memory-grow.js:
2871         (assertEq):
2872         * wasm/js-api/table.js:
2873         (assert.throws):
2874
2875 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2876
2877         Skip JSC test stress/regress-159779-2.js on debug.
2878         https://bugs.webkit.org/show_bug.cgi?id=177204
2879
2880         Unreviewed test gardening.
2881
2882         * stress/regress-159779-2.js:
2883
2884 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2885
2886         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2887         https://bugs.webkit.org/show_bug.cgi?id=175642
2888
2889         Reviewed by Darin Adler.
2890
2891         * ChakraCore/test/Function/apply3.baseline-jsc:
2892
2893 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2894
2895         Unreviewed, rolling out r222564.
2896         https://bugs.webkit.org/show_bug.cgi?id=177720
2897
2898         "It regressed JetStream by 2% on iOS caused by a 50%
2899         regression on the bigfib subtest" (Requested by saamyjoon on
2900         #webkit).
2901
2902         Reverted changeset:
2903
2904         "Add Above/Below comparisons for UInt32 patterns"
2905         https://bugs.webkit.org/show_bug.cgi?id=177281
2906         http://trac.webkit.org/changeset/222564
2907
2908 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2909
2910         [DFG] Support ArrayPush with multiple args
2911         https://bugs.webkit.org/show_bug.cgi?id=175823
2912
2913         Reviewed by Saam Barati.
2914
2915         * microbenchmarks/array-push-0.js: Added.
2916         (arrayPush0):
2917         * microbenchmarks/array-push-1.js: Added.
2918         (arrayPush1):
2919         * microbenchmarks/array-push-2.js: Added.
2920         (arrayPush2):
2921         * microbenchmarks/array-push-3.js: Added.
2922         (arrayPush3):
2923         * stress/array-push-multiple-contiguous.js: Added.
2924         (shouldBe):
2925         (test):
2926         * stress/array-push-multiple-double-nan.js: Added.
2927         (shouldBe):
2928         (test):
2929         * stress/array-push-multiple-double.js: Added.
2930         (shouldBe):
2931         (test):
2932         * stress/array-push-multiple-int32.js: Added.
2933         (shouldBe):
2934         (test):
2935         * stress/array-push-multiple-many-contiguous.js: Added.
2936         (shouldBe):
2937         (test):
2938         * stress/array-push-multiple-many-double.js: Added.
2939         (shouldBe):
2940         (test):
2941         * stress/array-push-multiple-many-int32.js: Added.
2942         (shouldBe):
2943         (test):
2944         * stress/array-push-multiple-many-storage.js: Added.
2945         (shouldBe):
2946         (test):
2947         * stress/array-push-multiple-storage.js: Added.
2948         (shouldBe):
2949         (test):
2950         * stress/array-push-with-force-exit.js: Added.
2951         (target.createBuiltin):
2952
2953 2017-09-29  Saam Barati  <sbarati@apple.com>
2954
2955         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2956         https://bugs.webkit.org/show_bug.cgi?id=177639
2957
2958         Reviewed by Geoffrey Garen.
2959
2960         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2961         (assert):
2962         (Class):
2963         (items.forEach):
2964         (set get for):
2965
2966 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2967
2968         Unreviewed, rolling out r222563, r222565, and r222581.
2969         https://bugs.webkit.org/show_bug.cgi?id=177675
2970
2971         "It causes a crash when playing youtube videos" (Requested by
2972         saamyjoon on #webkit).
2973
2974         Reverted changesets:
2975
2976         "[DFG] Support ArrayPush with multiple args"
2977         https://bugs.webkit.org/show_bug.cgi?id=175823
2978         http://trac.webkit.org/changeset/222563
2979
2980         "Unreviewed, build fix after r222563"
2981         https://bugs.webkit.org/show_bug.cgi?id=175823
2982         http://trac.webkit.org/changeset/222565
2983
2984         "Unreviewed, fix x86 breaking due to exhausted registers"
2985         https://bugs.webkit.org/show_bug.cgi?id=175823
2986         http://trac.webkit.org/changeset/222581
2987
2988 2017-09-28  Mark Lam  <mark.lam@apple.com>
2989
2990         test262: Unexpected passes after r222617 and r222618.
2991         https://bugs.webkit.org/show_bug.cgi?id=177622
2992         <rdar://problem/34725960>
2993
2994         Reviewed by Saam Barati.
2995
2996         Update test262.yaml for tests that are now passing.
2997
2998         * test262.yaml:
2999
3000 2017-09-27  Michael Saboff  <msaboff@apple.com>
3001
3002         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
3003         https://bugs.webkit.org/show_bug.cgi?id=177570
3004
3005         Reviewed by Filip Pizlo.
3006
3007         New regression test.
3008
3009         * stress/regress-177570.js: Added.
3010
3011 2017-09-28  Michael Saboff  <msaboff@apple.com>
3012
3013         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
3014         https://bugs.webkit.org/show_bug.cgi?id=177423
3015
3016         Reviewed by Mark Lam.
3017
3018         Updated regression test.
3019
3020         * stress/regress-177423.js:
3021         (catch):
3022
3023 2017-09-27  Mark Lam  <mark.lam@apple.com>
3024
3025         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
3026         https://bugs.webkit.org/show_bug.cgi?id=177584
3027         <rdar://problem/34463903>
3028
3029         Reviewed by Saam Barati.
3030
3031         * stress/regress-177584.js: Added.
3032         (assertEqual):
3033         (Array.prototype.Symbol.species):
3034
3035 2017-09-27  Saam Barati  <sbarati@apple.com>
3036
3037         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
3038         https://bugs.webkit.org/show_bug.cgi?id=177523
3039
3040         Reviewed by Mark Lam.
3041
3042         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
3043         (assert):
3044         (Test):
3045         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
3046         (addMethods):
3047         (i.Test.prototype.propName):
3048
3049 2017-09-27  Mark Lam  <mark.lam@apple.com>
3050
3051         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
3052         https://bugs.webkit.org/show_bug.cgi?id=177423
3053         <rdar://problem/34621320>
3054
3055         Reviewed by Keith Miller.
3056
3057         * stress/regress-177423.js: Added.
3058
3059 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3060
3061         Add Above/Below comparisons for UInt32 patterns
3062         https://bugs.webkit.org/show_bug.cgi?id=177281
3063
3064         Reviewed by Saam Barati.
3065
3066         * stress/uint32-comparison-jump.js: Added.
3067         (shouldBe):
3068         (above):
3069         (aboveOrEqual):
3070         (below):
3071         (belowOrEqual):
3072         (notAbove):
3073         (notAboveOrEqual):
3074         (notBelow):
3075         (notBelowOrEqual):
3076         * stress/uint32-comparison.js: Added.
3077         (shouldBe):
3078         (above):
3079         (aboveOrEqual):
3080         (below):
3081         (belowOrEqual):
3082         (aboveTest):
3083         (aboveOrEqualTest):
3084         (belowTest):
3085         (belowOrEqualTest):
3086
3087 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3088
3089         [DFG] Support ArrayPush with multiple args
3090         https://bugs.webkit.org/show_bug.cgi?id=175823
3091
3092         Reviewed by Saam Barati.
3093
3094         * microbenchmarks/array-push-0.js: Added.
3095         (arrayPush0):
3096         * microbenchmarks/array-push-1.js: Added.
3097         (arrayPush1):
3098         * microbenchmarks/array-push-2.js: Added.
3099         (arrayPush2):
3100         * microbenchmarks/array-push-3.js: Added.
3101         (arrayPush3):
3102         * stress/array-push-multiple-contiguous.js: Added.
3103         (shouldBe):
3104         (test):
3105         * stress/array-push-multiple-double-nan.js: Added.
3106         (shouldBe):
3107         (test):
3108         * stress/array-push-multiple-double.js: Added.
3109         (shouldBe):
3110         (test):
3111         * stress/array-push-multiple-int32.js: Added.
3112         (shouldBe):
3113         (test):
3114         * stress/array-push-multiple-many-contiguous.js: Added.
3115         (shouldBe):
3116         (test):
3117         * stress/array-push-multiple-many-double.js: Added.
3118         (shouldBe):
3119         (test):
3120         * stress/array-push-multiple-many-int32.js: Added.
3121         (shouldBe):
3122         (test):
3123         * stress/array-push-multiple-many-storage.js: Added.
3124         (shouldBe):
3125         (test):
3126         * stress/array-push-multiple-storage.js: Added.
3127         (shouldBe):
3128         (test):
3129
3130 2017-09-26  Commit Queue  <commit-queue@webkit.org>
3131
3132         Unreviewed, rolling out r222518.
3133         https://bugs.webkit.org/show_bug.cgi?id=177507
3134
3135         Break the High Sierra build (Requested by yusukesuzuki on
3136         #webkit).
3137
3138         Reverted changeset:
3139
3140         "Add Above/Below comparisons for UInt32 patterns"
3141         https://bugs.webkit.org/show_bug.cgi?id=177281
3142         http://trac.webkit.org/changeset/222518
3143
3144 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3145
3146         Add Above/Below comparisons for UInt32 patterns
3147         https://bugs.webkit.org/show_bug.cgi?id=177281
3148
3149         Reviewed by Saam Barati.
3150
3151         * stress/uint32-comparison-jump.js: Added.
3152         (shouldBe):
3153         (above):
3154         (aboveOrEqual):
3155         (below):
3156         (belowOrEqual):
3157         (notAbove):
3158         (notAboveOrEqual):
3159         (notBelow):
3160         (notBelowOrEqual):
3161         * stress/uint32-comparison.js: Added.
3162         (shouldBe):
3163         (above):
3164         (aboveOrEqual):
3165         (below):
3166         (belowOrEqual):
3167         (aboveTest):
3168         (aboveOrEqualTest):
3169         (belowTest):
3170         (belowOrEqualTest):
3171
3172 2017-09-23  Keith Miller  <keith_miller@apple.com>
3173
3174         Fix infinite looping test262 test
3175         https://bugs.webkit.org/show_bug.cgi?id=177412
3176
3177         Reviewed by Yusuke Suzuki.
3178
3179         This test was poorly designed since failing it would cause the vm
3180         to inifinite loop. I've fixed it locally and will fix it on github pending
3181         the results of next weeks tc39 meeting.
3182
3183         * test262.yaml:
3184         * test262/test/language/statements/for-of/iterator-next-reference.js:
3185
3186 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
3187
3188         test262: $.agent became $262.agent in test262 update
3189         https://bugs.webkit.org/show_bug.cgi?id=177407
3190
3191         Reviewed by Yusuke Suzuki.
3192
3193         * test262.yaml:
3194         ~320 tests pass now that we correctly make $262 available.
3195
3196 2017-09-22  Keith Miller  <keith_miller@apple.com>
3197
3198         Speculatively change iteration protocall to use the same next function
3199         https://bugs.webkit.org/show_bug.cgi?id=175653
3200
3201         Reviewed by Saam Barati.
3202
3203         Change test to match the new iteration behavior.
3204
3205         * stress/spread-optimized-properly.js:
3206
3207 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3208
3209         [DFG][FTL] Profile array vector length for array allocation
3210         https://bugs.webkit.org/show_bug.cgi?id=177051
3211
3212         Reviewed by Saam Barati.
3213
3214         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
3215         (target):
3216
3217 2017-09-22  Commit Queue  <commit-queue@webkit.org>
3218
3219         Unreviewed, rolling out r222380.
3220         https://bugs.webkit.org/show_bug.cgi?id=177352
3221
3222         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
3223         #webkit).
3224
3225         Reverted changeset:
3226
3227         "[DFG][FTL] Profile array vector length for array allocation"
3228         https://bugs.webkit.org/show_bug.cgi?id=177051
3229         http://trac.webkit.org/changeset/222380
3230
3231 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3232
3233         [DFG][FTL] Profile array vector length for array allocation
3234         https://bugs.webkit.org/show_bug.cgi?id=177051
3235
3236         Reviewed by Saam Barati.
3237
3238         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
3239         (target):
3240
3241 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
3242
3243         Skip new hanging test262 tests.
3244         https://bugs.webkit.org/show_bug.cgi?id=177326
3245
3246         Unreviewed test gardening.
3247
3248         * test262.yaml:
3249
3250 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
3251
3252         Mark 6 test262 tests as passing.
3253         https://bugs.webkit.org/show_bug.cgi?id=177307
3254
3255         Unreviewed test gardening.
3256
3257         * test262.yaml:
3258
3259 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
3260
3261         Unreviewed follow-up to r222311.
3262
3263         * test262/harness/sta.js:
3264         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
3265         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
3266         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
3267         * test262/test/built-ins/Array/from/elements-added-after.js:
3268         * test262/test/built-ins/Array/from/elements-deleted-after.js:
3269         * test262/test/built-ins/Array/from/elements-updated-after.js:
3270         * test262/test/built-ins/Array/from/from-array.js:
3271         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
3272         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
3273         * test262/test/built-ins/Array/from/source-array-boundary.js:
3274         * test262/test/built-ins/Array/from/source-object-constructor.js:
3275         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
3276         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
3277         * test262/test/built-ins/Array/from/source-object-length.js:
3278         * test262/test/built-ins/Array/from/source-object-missing.js:
3279         * test262/test/built-ins/Array/from/source-object-without.js:
3280         * test262/test/built-ins/Array/from/this-null.js:
3281         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
3282         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
3283         * test262/test/language/literals/numeric/7.8.3-1gs.js:
3284         * test262/test/language/literals/numeric/7.8.3-2gs.js:
3285         * test262/test/language/literals/numeric/7.8.3-3gs.js:
3286         * test262/test/language/literals/regexp/7.8.5-1gs.js:
3287         * test262/test/language/literals/string/7.8.4-1gs.js:
3288         Fix some files that I failed to update when I applied my patch.
3289
3290 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
3291
3292         Update test262 tests
3293         https://bugs.webkit.org/show_bug.cgi?id=177220
3294
3295         Reviewed by Saam Barati and Yusuke Suzuki.
3296
3297         * test262.yaml:
3298         * test262/test262-Revision.txt:
3299         New rebaselined expectations for all tests.
3300
3301         * test262/*:
3302         Updated.
3303
3304 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
3305
3306         [DFG] Remove ToThis more aggressively
3307         https://bugs.webkit.org/show_bug.cgi?id=177056
3308
3309         Reviewed by Saam Barati.
3310
3311         * stress/generator-with-this-strict.js: Added.
3312         (shouldBe):
3313         (generator):
3314         (target):
3315         * stress/generator-with-this.js: Added.
3316         (shouldBe):
3317         (generator):
3318         (target):
3319
3320 2017-09-17  Michael Saboff  <msaboff@apple.com>
3321
3322         https://bugs.webkit.org/show_bug.cgi?id=177038
3323         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
3324
3325         Reviewed by JF Bastien.
3326
3327         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
3328         as it dies using too much memory.
3329
3330 2017-09-15  Saam Barati  <sbarati@apple.com>
3331
3332         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
3333         https://bugs.webkit.org/show_bug.cgi?id=176981
3334
3335         Reviewed by Yusuke Suzuki.
3336
3337         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
3338         (assert):
3339         (verify):
3340         (func):
3341         (const.bar.createBuiltin):
3342
3343 2017-09-14  Saam Barati  <sbarati@apple.com>
3344
3345         It should be valid to exit before each set when doing arity fixup when inlining
3346         https://bugs.webkit.org/show_bug.cgi?id=176948
3347
3348         Reviewed by Keith Miller.
3349
3350         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
3351         (baz):
3352         (bar):
3353         (foo):
3354
3355 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
3356
3357         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
3358         https://bugs.webkit.org/show_bug.cgi?id=176867
3359
3360         Reviewed by Sam Weinig.
3361
3362         * microbenchmarks/object-get-own-property-symbols.js: Added.
3363         (test):
3364
3365 2017-09-13  Mark Lam  <mark.lam@apple.com>
3366
3367         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
3368         https://bugs.webkit.org/show_bug.cgi?id=176888
3369         <rdar://problem/34381832>
3370
3371         Not reviewed.
3372
3373         * stress/op_mod-ConstVar.js:
3374         * stress/op_mod-VarConst.js:
3375         * stress/op_mod-VarVar.js:
3376
3377 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
3378
3379         Skip 3 op_mod tests on Debug JSC bots.
3380         https://bugs.webkit.org/show_bug.cgi?id=176630
3381
3382         Unreviewed test gardening.
3383
3384         * stress/op_mod-ConstVar.js:
3385         * stress/op_mod-VarConst.js:
3386         * stress/op_mod-VarVar.js:
3387
3388 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3389
3390         [JSC] Fix Array allocation in Object.keys
3391         https://bugs.webkit.org/show_bug.cgi?id=176826
3392
3393         Reviewed by Saam Barati.
3394
3395         * stress/object-own-property-keys.js: Added.
3396         (shouldBe):
3397
3398 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3399
3400         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3401         https://bugs.webkit.org/show_bug.cgi?id=176010
3402
3403         Reviewed by Filip Pizlo.
3404
3405         * microbenchmarks/weak-map-key.js: Added.
3406         (assert):
3407         (objectKey):
3408         (let.start.Date.now):
3409
3410 2017-09-12  Mark Lam  <mark.lam@apple.com>
3411
3412         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
3413         https://bugs.webkit.org/show_bug.cgi?id=176630
3414
3415         Reviewed by JF Bastien.
3416
3417         Debug builds are just slow, and these tests do a lot.  They pass when I run them
3418         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
3419         a speculative fix for the bots that are seeing these fail.
3420
3421         I also undid the skipping of the op_mod tests for debug builds.
3422
3423         * stress/op_div-ConstVar.js:
3424         * stress/op_div-VarConst.js:
3425         * stress/op_div-VarVar.js:
3426         * stress/op_mod-ConstVar.js:
3427         * stress/op_mod-VarConst.js:
3428         * stress/op_mod-VarVar.js:
3429
3430 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
3431
3432         Skip stress/value-to-boolean.js on Debug bots.
3433         https://bugs.webkit.org/show_bug.cgi?id=176787
3434
3435         Unreviewed test gardening.
3436
3437         * stress/value-to-boolean.js:
3438
3439 2017-09-11  Mark Lam  <mark.lam@apple.com>
3440
3441         Change test expectation for test262/test/language/statements/try/tco-catch.js
3442         https://bugs.webkit.org/show_bug.cgi?id=176749
3443
3444         Rubber stamped by Keith Miller.
3445
3446         It's been failing since at least r221821.  I'm changing the test expectation to
3447         fail to green the bots while I investigate some more.
3448
3449         * test262.yaml:
3450
3451 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
3452
3453         Unreviewed, rolling out r221854.
3454
3455         The test added with this change fails on 32-bit JSC bots.
3456
3457         Reverted changeset:
3458
3459         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
3460         https://bugs.webkit.org/show_bug.cgi?id=176010
3461         http://trac.webkit.org/changeset/221854
3462
3463 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3464
3465         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
3466         https://bugs.webkit.org/show_bug.cgi?id=176010
3467
3468         Reviewed by Filip Pizlo.
3469
3470         * microbenchmarks/weak-map-key.js: Added.
3471         (assert):
3472         (objectKey):
3473         (let.start.Date.now):
3474
3475 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3476
3477         [JSC] Optimize Object.keys by using careful array allocation
3478         https://bugs.webkit.org/show_bug.cgi?id=176654
3479
3480         Reviewed by Darin Adler.
3481
3482         * microbenchmarks/object-keys.js: Added.
3483         (test):
3484
3485 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
3486
3487         Error should compute .stack and friends lazily
3488         https://bugs.webkit.org/show_bug.cgi?id=176645
3489
3490         Reviewed by Saam Barati.
3491
3492         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
3493         * microbenchmarks/new-error.js: Added.
3494         * microbenchmarks/throw.js: Added.
3495
3496 2017-09-09  Mark Lam  <mark.lam@apple.com>
3497
3498         [Re-landing] Use JIT probes for DFG OSR exit.
3499         https://bugs.webkit.org/show_bug.cgi?id=175144
3500         <rdar://problem/33437050>
3501
3502         Not reviewed.  Original patch reviewed by Saam Barati.
3503
3504         Disable these tests for debug builds because they run too slow with the new OSR exit.
3505
3506         * stress/op_mod-ConstVar.js:
3507         * stress/op_mod-VarConst.js:
3508         * stress/op_mod-VarVar.js:
3509
3510 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3511
3512         [DFG] NewArrayWithSize(size)'s size does not care negative zero
3513         https://bugs.webkit.org/show_bug.cgi?id=176300
3514
3515         Reviewed by Saam Barati.
3516
3517         * stress/new-array-with-size-div.js: Added.
3518         (shouldBe):
3519         (test):
3520         (i.i):
3521
3522 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3523
3524         [DFG] PutByVal with Array::Generic is too generic
3525         https://bugs.webkit.org/show_bug.cgi?id=176345
3526
3527         Reviewed by Filip Pizlo.
3528
3529         * stress/object-assign-symbols.js: Added.
3530         (shouldBe):
3531         (test):
3532         * stress/object-assign.js: Added.
3533         (shouldBe):
3534         (test):
3535         (i.shouldBe.JSON.stringify.test):
3536
3537 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3538
3539         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3540         https://bugs.webkit.org/show_bug.cgi?id=176590
3541
3542         Reviewed by Saam Barati.
3543
3544         * microbenchmarks/object-iterate-symbols.js: Added.
3545         (test):
3546         * microbenchmarks/object-iterate.js: Added.
3547         (test):
3548         * stress/object-iterate-symbols.js: Added.
3549         (shouldBe):
3550         (test):
3551         * stress/object-iterate.js: Added.
3552         (shouldBe):
3553         (test):
3554
3555 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3556
3557         [Win32] 10 JSC stress tests are failing.
3558         https://bugs.webkit.org/show_bug.cgi?id=176538
3559
3560         Reviewed by Mark Lam.
3561
3562         Skip tests on Windows to make the bots green.
3563
3564         * ChakraCore.yaml:
3565         * stress/date-relaxed.js:
3566
3567 2017-09-06  Mark Lam  <mark.lam@apple.com>
3568
3569         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3570         https://bugs.webkit.org/show_bug.cgi?id=176485
3571         <rdar://problem/33898874>
3572
3573         Reviewed by Keith Miller.
3574
3575         * stress/regress-176485.js: Added.
3576
3577 2017-09-05  Saam Barati  <sbarati@apple.com>
3578
3579         isNotCellSpeculation is wrong with respect to SpecEmpty
3580         https://bugs.webkit.org/show_bug.cgi?id=176429
3581
3582         Reviewed by Michael Saboff.
3583
3584         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3585         (Foo):
3586
3587 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3588
3589         test262: Completion values for control flow do not match the spec
3590         https://bugs.webkit.org/show_bug.cgi?id=171265
3591
3592         Reviewed by Saam Barati.
3593
3594         * stress/completion-value.js:
3595         Condensed test for completion values in top level statements.
3596
3597         * stress/super-get-by-id.js:
3598         ClassDeclaration when evaled no longer produce values. Convert
3599         these to ClassExpressions so they produce the class value.
3600         
3601         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3602         This is a progression for currect spec behavior.
3603
3604         * mozilla/mozilla-tests.yaml:
3605         This test is now outdated, so mark it as failing for that reason.
3606
3607         * test262.yaml:
3608         Passing all "cptn" completion value tests.
3609
3610 2017-09-04  Saam Barati  <sbarati@apple.com>
3611
3612         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3613         https://bugs.webkit.org/show_bug.cgi?id=176317
3614
3615         Reviewed by Keith Miller.
3616
3617         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3618         (Foo):
3619
3620 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3621
3622         [DFG][FTL] Efficiently execute number#toString()
3623         https://bugs.webkit.org/show_bug.cgi?id=170007
3624
3625         Reviewed by Keith Miller.
3626
3627         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3628         (test):
3629         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3630         (test):
3631         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3632         (test):
3633         * microbenchmarks/number-to-string-with-radix.js: Added.
3634         (test):
3635         * stress/number-to-string-strength-reduction.js: Added.
3636         (shouldBe):
3637         (test):
3638         * stress/number-to-string-with-radix-10.js: Added.
3639         (shouldBe):
3640         (test):
3641         * stress/number-to-string-with-radix-cse.js: Added.
3642         (shouldBe):
3643         (test):
3644         * stress/number-to-string-with-radix-invalid.js: Added.
3645         (shouldThrow):
3646         * stress/number-to-string-with-radix-watchpoint.js: Added.
3647         (shouldBe):
3648         (test):
3649         (i.i.1e3.Number.prototype.toString):
3650         * stress/number-to-string-with-radix.js: Added.
3651         (shouldBe):
3652         (test):
3653
3654 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3655
3656         [DFG] Relax arity requirement
3657         https://bugs.webkit.org/show_bug.cgi?id=175523
3658
3659         Reviewed by Saam Barati.
3660
3661         * stress/arity-mismatch-arguments-length.js: Added.
3662         (shouldBe):
3663         (test1):
3664         (test):
3665         * stress/arity-mismatch-get-argument.js: Added.
3666         (shouldBe):
3667         (builtin.createBuiltin):
3668         (test):
3669         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3670         (shouldBe):
3671         (inlineTarget):
3672         (test):
3673         * stress/arity-mismatch-inlining.js: Added.
3674         (shouldBe):
3675         (inlineTarget):
3676         (test):
3677         * stress/arity-mismatch-rest.js: Added.
3678         (shouldBe):
3679         (test2):
3680         (test1):
3681         (test):
3682
3683 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3684
3685         [JSC] Fix "name" and "length" of Proxy revoke function
3686         https://bugs.webkit.org/show_bug.cgi?id=176155
3687
3688         Reviewed by Mark Lam.
3689
3690         * test262.yaml:
3691
3692 2017-08-31  Saam Barati  <sbarati@apple.com>
3693
3694         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3695         https://bugs.webkit.org/show_bug.cgi?id=176206
3696
3697         Reviewed by Keith Miller.
3698
3699         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3700         (a):
3701         (b):
3702         (foo):
3703
3704 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3705
3706         Skip two slow JSC tests after r221422.
3707
3708         Unreviewed test gardening.
3709
3710         * stress/regexp-prototype-match-on-too-long-rope.js:
3711         * stress/regexp-prototype-test-on-too-long-rope.js:
3712
3713 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3714
3715         Unreviewed, skipping slow tests.
3716         
3717         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3718         work differently now.
3719
3720         * stress/regexp-prototype-exec-on-too-long-rope.js:
3721         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3722
3723 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3724
3725         [JSC] Use reifying system for "name" property of builtin JSFunction
3726         https://bugs.webkit.org/show_bug.cgi?id=175260
3727
3728         Reviewed by Saam Barati.
3729
3730         * stress/accessors-get-set-prefix.js:
3731         * stress/builtin-function-name.js: Added.
3732         (shouldBe):
3733         (shouldThrow):
3734         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3735         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3736         * stress/private-name-as-anonymous-builtin.js: Added.
3737         (shouldBe):
3738         (NotPromise):
3739
3740 2017-08-30  Saam Barati  <sbarati@apple.com>
3741
3742         Unreviewed. Make test stop printing.
3743
3744         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3745
3746 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3747
3748         Unreviewed, rolling out r221327.
3749
3750         This change caused test262 failures.
3751
3752         Reverted changeset:
3753
3754         "[JSC] Use reifying system for "name" property of builtin
3755         JSFunction"
3756         https://bugs.webkit.org/show_bug.cgi?id=175260
3757         http://trac.webkit.org/changeset/221327
3758
3759 2017-08-30  Saam Barati  <sbarati@apple.com>
3760
3761         semicolon is being interpreted as an = in the LiteralParser
3762         https://bugs.webkit.org/show_bug.cgi?id=176114
3763
3764         Reviewed by Oliver Hunt.
3765
3766         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3767         * stress/resources/literal-parser-test-case.js: Added.
3768
3769 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3770
3771         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3772         https://bugs.webkit.org/show_bug.cgi?id=166698
3773
3774         Reviewed by Yusuke Suzuki.
3775
3776         * stress/async-iteration-for-await-of-syntax.js: Added.
3777         (assert):
3778         (checkSyntax):
3779         (checkSyntaxError):
3780         (checkSimpleAsyncGeneratorSloppyMode):
3781         (checkSimpleAsyncGeneratorStrictMode):
3782         (checkNestedAsyncGenerators):
3783         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3784         * stress/async-iteration-for-await-of.js: Added.
3785         (assert):
3786         (async.foo):
3787         (async.boo):
3788         (const.boo.async):
3789
3790 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3791
3792         [JSC] Use reifying system for "name" property of builtin JSFunction
3793         https://bugs.webkit.org/show_bug.cgi?id=175260
3794
3795         Reviewed by Saam Barati.
3796
3797         * stress/accessors-get-set-prefix.js:
3798         * stress/builtin-function-name.js: Added.
3799         (shouldBe):
3800         (shouldThrow):
3801         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3802         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3803
3804 2017-08-25  Saam Barati  <sbarati@apple.com>
3805
3806         Support compiling catch in the DFG
3807         https://bugs.webkit.org/show_bug.cgi?id=174590
3808         <rdar://problem/34047845>
3809
3810         Reviewed by Filip Pizlo.
3811
3812         * microbenchmarks/delta-blue-try-catch.js: Added.
3813         (exception):
3814         (value):
3815         (OrderedCollection):
3816         (OrderedCollection.prototype.add):
3817         (OrderedCollection.prototype.at):
3818         (OrderedCollection.prototype.size):
3819         (OrderedCollection.prototype.removeFirst):
3820         (OrderedCollection.prototype.remove):
3821         (Strength):
3822         (Strength.stronger):
3823         (Strength.weaker):
3824         (Strength.weakestOf):
3825         (Strength.strongest):
3826         (Strength.prototype.nextWeaker):
3827         (Constraint):
3828         (Constraint.prototype.addConstraint):
3829         (Constraint.prototype.satisfy):
3830         (Constraint.prototype.destroyConstraint):
3831         (Constraint.prototype.isInput):
3832         (UnaryConstraint):
3833         (UnaryConstraint.prototype.addToGraph):
3834         (UnaryConstraint.prototype.chooseMethod):
3835         (UnaryConstraint.prototype.isSatisfied):
3836         (UnaryConstraint.prototype.markInputs):
3837         (UnaryConstraint.prototype.output):
3838         (UnaryConstraint.prototype.recalculate):
3839         (UnaryConstraint.prototype.markUnsatisfied):
3840         (UnaryConstraint.prototype.inputsKnown):
3841         (UnaryConstraint.prototype.removeFromGraph):
3842         (StayConstraint):
3843         (StayConstraint.prototype.execute):
3844         (EditConstraint.prototype.isInput):
3845         (EditConstraint.prototype.execute):
3846         (BinaryConstraint):
3847         (BinaryConstraint.prototype.chooseMethod):
3848         (BinaryConstraint.prototype.addToGraph):
3849         (BinaryConstraint.prototype.isSatisfied):
3850         (BinaryConstraint.prototype.markInputs):
3851         (BinaryConstraint.prototype.input):
3852         (BinaryConstraint.prototype.output):
3853         (BinaryConstraint.prototype.recalculate):
3854         (BinaryConstraint.prototype.markUnsatisfied):
3855         (BinaryConstraint.prototype.inputsKnown):
3856         (BinaryConstraint.prototype.removeFromGraph):
3857         (ScaleConstraint):
3858         (ScaleConstraint.prototype.addToGraph):
3859         (ScaleConstraint.prototype.removeFromGraph):
3860         (ScaleConstraint.prototype.markInputs):
3861         (ScaleConstraint.prototype.execute):
3862         (ScaleConstraint.prototype.recalculate):
3863         (EqualityConstraint):
3864         (EqualityConstraint.prototype.execute):
3865         (Variable):
3866         (Variable.prototype.addConstraint):
3867         (Variable.prototype.removeConstraint):
3868         (Planner):
3869         (Planner.prototype.incrementalAdd):
3870         (Planner.prototype.incrementalRemove):
3871         (Planner.prototype.newMark):
3872         (Planner.prototype.makePlan):
3873         (Planner.prototype.extractPlanFromConstraints):
3874         (Planner.prototype.addPropagate):
3875         (Planner.prototype.removePropagateFrom):
3876         (Planner.prototype.addConstraintsConsumingTo):
3877         (Plan):
3878         (Plan.prototype.addConstraint):
3879         (Plan.prototype.size):
3880         (Plan.prototype.constraintAt):
3881         (Plan.prototype.execute):
3882         (chainTest):
3883         (projectionTest):
3884         (change):
3885         (deltaBlue):
3886         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3887         (assert):
3888         (Numbers):
3889         (Numbers.prototype.next):
3890         (return.Transpose):
3891         (return.Transpose.prototype.next):
3892         (transpose):
3893         (verifyEven):
3894         (verifyString):
3895         (foo):
3896         (runIterators):
3897         * microbenchmarks/try-catch-word-count.js: Added.
3898         (let.assert):
3899         (EOF):
3900         (let.texts):
3901         (let.o.apply):
3902         (foo):
3903         (bar):
3904         (f):
3905         (run):
3906         (test1):
3907         (test2):
3908         (test3):
3909         (fn):
3910         (A):
3911         (B):
3912         (A.prototype.getValue):
3913         (B.prototype.getParentValue):
3914         (strlen):
3915         (sum.0):
3916         (test):
3917         (result.test.o):
3918         (set add.set add):
3919         (set forEach):
3920         (stringHash):
3921         (set if):
3922         (testFunction):
3923         (set delete.set has.set add):
3924         * stress/catch-set-argument-speculation-failure.js: Added.
3925         (o):
3926         (e):
3927         (e2):
3928         (escape):
3929         (baz):
3930         (noInline.run):
3931         (noInline):
3932         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3933         (foo):
3934         (e):
3935         (baz):
3936         (bar):
3937
3938 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3939
3940         Unreviewed, rolling out r221119, r221124, and r221143.
3941         https://bugs.webkit.org/show_bug.cgi?id=175973
3942
3943         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3944         on #webkit).
3945
3946         Reverted changesets:
3947
3948         "Support compiling catch in the DFG"
3949         https://bugs.webkit.org/show_bug.cgi?id=174590
3950         http://trac.webkit.org/changeset/221119
3951
3952         "Unreviewed, build fix in GTK port"
3953         https://bugs.webkit.org/show_bug.cgi?id=174590
3954         http://trac.webkit.org/changeset/221124
3955
3956         "DFG::JITCode::osrEntry should get sorted since we perform a
3957         binary search on it"
3958         https://bugs.webkit.org/show_bug.cgi?id=175893
3959         http://trac.webkit.org/changeset/221143
3960
3961 2017-08-24  Michael Saboff  <msaboff@apple.com>
3962
3963         Add support for RegExp "dotAll" flag
3964         https://bugs.webkit.org/show_bug.cgi?id=175924
3965
3966         Reviewed by Keith Miller.
3967
3968         Updated tests for new dotAll ('s' flag) changes.
3969
3970         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3971         * stress/static-getter-in-names.js:
3972
3973 2017-08-24  Mark Lam  <mark.lam@apple.com>
3974
3975         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3976         https://bugs.webkit.org/show_bug.cgi?id=175940
3977         <rdar://problem/29003921>
3978
3979         Reviewed by Saam Barati.
3980
3981         * stress/regress-164081.js: Added.
3982         (shouldEqual):
3983         (testcase):
3984
3985 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3986
3987         Skip flaky JSC test stress/test-finally.js.
3988         https://bugs.webkit.org/show_bug.cgi?id=160283
3989
3990         Unreviewed test gardening.
3991
3992         * stress/test-finally.js:
3993
3994 2017-08-23  Saam Barati  <sbarati@apple.com>
3995
3996         Support compiling catch in the DFG
3997         https://bugs.webkit.org/show_bug.cgi?id=174590
3998
3999         Reviewed by Filip Pizlo.
4000
4001         * microbenchmarks/delta-blue-try-catch.js: Added.
4002         (exception):
4003         (value):
4004         (OrderedCollection):
4005         (OrderedCollection.prototype.add):
4006         (OrderedCollection.prototype.at):
4007         (OrderedCollection.prototype.size):
4008         (OrderedCollection.prototype.removeFirst):
4009         (OrderedCollection.prototype.remove):
4010         (Strength):
4011         (Strength.stronger):
4012         (Strength.weaker):
4013         (Strength.weakestOf):
4014         (Strength.strongest):
4015         (Strength.prototype.nextWeaker):
4016         (Constraint):
4017         (Constraint.prototype.addConstraint):
4018         (Constraint.prototype.satisfy):
4019         (Constraint.prototype.destroyConstraint):
4020         (Constraint.prototype.isInput):
4021         (UnaryConstraint):
4022         (UnaryConstraint.prototype.addToGraph):
4023         (UnaryConstraint.prototype.chooseMethod):
4024         (UnaryConstraint.prototype.isSatisfied):
4025         (UnaryConstraint.prototype.markInputs):
4026         (UnaryConstraint.prototype.output):
4027         (UnaryConstraint.prototype.recalculate):
4028         (UnaryConstraint.prototype.markUnsatisfied):
4029         (UnaryConstraint.prototype.inputsKnown):
4030         (UnaryConstraint.prototype.removeFromGraph):
4031         (StayConstraint):
4032         (StayConstraint.prototype.execute):
4033         (EditConstraint.prototype.isInput):
4034         (EditConstraint.prototype.execute):
4035         (BinaryConstraint):
4036         (BinaryConstraint.prototype.chooseMethod):
4037         (BinaryConstraint.prototype.addToGraph):
4038         (BinaryConstraint.prototype.isSatisfied):
4039         (BinaryConstraint.prototype.markInputs):
4040         (BinaryConstraint.prototype.input):
4041         (BinaryConstraint.prototype.output):
4042         (BinaryConstraint.prototype.recalculate):
4043         (BinaryConstraint.prototype.markUnsatisfied):
4044         (BinaryConstraint.prototype.inputsKnown):
4045         (BinaryConstraint.prototype.removeFromGraph):
4046         (ScaleConstraint):
4047         (ScaleConstraint.prototype.addToGraph):
4048         (ScaleConstraint.prototype.removeFromGraph):
4049         (ScaleConstraint.prototype.markInputs):
4050         (ScaleConstraint.prototype.execute):
4051         (ScaleConstraint.prototype.recalculate):
4052         (EqualityConstraint):
4053         (EqualityConstraint.prototype.execute):
4054         (Variable):
4055         (Variable.prototype.addConstraint):
4056         (Variable.prototype.removeConstraint):
4057         (Planner):
4058         (Planner.prototype.incrementalAdd):
4059         (Planner.prototype.incrementalRemove):
4060         (Planner.prototype.newMark):
4061         (Planner.prototype.makePlan):
4062         (Planner.prototype.extractPlanFromConstraints):
4063         (Planner.prototype.addPropagate):
4064         (Planner.prototype.removePropagateFrom):
4065         (Planner.prototype.addConstraintsConsumingTo):
4066         (Plan):
4067         (Plan.prototype.addConstraint):
4068         (Plan.prototype.size):
4069         (Plan.prototype.constraintAt):
4070         (Plan.prototype.execute):
4071         (chainTest):
4072         (projectionTest):
4073         (change):
4074         (deltaBlue):
4075         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
4076         (assert):
4077         (Numbers):
4078         (Numbers.prototype.next):
4079         (return.Transpose):
4080         (return.Transpose.prototype.next):
4081         (transpose):
4082         (verifyEven):
4083         (verifyString):
4084         (foo):
4085         (runIterators):
4086         * microbenchmarks/try-catch-word-count.js: Added.
4087         (let.assert):
4088         (EOF):
4089         (let.texts):
4090         (let.o.apply):
4091         (foo):
4092         (bar):
4093         (f):
4094         (run):
4095         (test1):
4096         (test2):
4097         (test3):
4098         (fn):
4099         (A):
4100         (B):
4101         (A.prototype.getValue):
4102         (B.prototype.getParentValue):
4103         (strlen):
4104         (sum.0):
4105         (test):
4106         (result.test.o):
4107         (set add.set add):
4108         (set forEach):
4109         (stringHash):
4110         (set if):
4111         (testFunction):
4112         (set delete.set has.set add):
4113         * stress/catch-set-argument-speculation-failure.js: Added.
4114         (o):
4115         (e):
4116         (e2):
4117         (escape):
4118         (baz):
4119         (noInline.run):
4120         (noInline):
4121         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
4122         (foo):
4123         (e):
4124         (baz):
4125         (bar):
4126
4127 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
4128
4129         [JSC] Optimize Map iteration with intrinsic
4130         https://bugs.webkit.org/show_bug.cgi?id=174355
4131
4132         Reviewed by Saam Barati.
4133
4134         * stress/map-iterator-result-should-have-expected-shape.js: Added.
4135         (shouldBe):
4136         (throw.new.Error):
4137         * stress/set-iterator-result-should-have-expected-shape.js: Added.
4138         (shouldBe):
4139         (throw.new.Error.let.iterator.set Symbol):
4140         (throw.new.Error.set add):
4141         (let.iterator.set Symbol):
4142
4143 2017-08-23  Robin Morisset  <rmorisset@apple.com>
4144
4145         Add a micro-benchmark for checking that accessing a variable within a 'with'
4146         block does not automatically prevent type prediction.
4147         https://bugs.webkit.org/show_bug.cgi?id=175738
4148
4149         Reviewed by Saam Barati.
4150
4151         * stress/with_and_arith.js: Added.
4152         (with):
4153
4154 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
4155
4156         [ESNext] Async iteration - Implement Async Generator - runtime
4157         https://bugs.webkit.org/show_bug.cgi?id=175240
4158
4159         Reviewed by Yusuke Suzuki.
4160
4161         * stress/async-iteration-async-from-sync.js: Added.
4162         (assert):
4163         (const.Logger):
4164         (this.fullfilled):
4165         (this.fullfilledDone):
4166         (this.rejected):
4167         (this.catched):
4168         (this.isFinal):
4169         (_assertLogger):
4170         (const.assertLogger):
4171         (const.getPromise.promiseHolder.return.new.Promise):
4172         (foo):
4173         (async.boo):
4174         (bar):
4175         (async.baz):
4176         (async.goo):
4177         * stress/async-iteration-basic.js: Added.
4178         (assert):
4179         (const.Logger):
4180         (this.fullfilled):
4181         (this.fullfilledDone):
4182         (this.rejected):
4183         (this.catched):
4184         (this.isFinal):
4185         (_assertLogger):
4186         (const.assertLogger):
4187         (const.getPromise.promiseHolder.return.new.Promise):
4188         (async.generator):
4189         (iterator.next.then):
4190         (async.baz):
4191         (async.boo):
4192         (async.foo):
4193         (async.goo):
4194         (A.prototype.async.foo):
4195         (A.prototype.async.boo):
4196         (A):
4197         (asyncGenExp.async):
4198         (async.joo):
4199         (j.next.then):
4200         (then):
4201         (async.koo):
4202         (async.loo):
4203         (async.moo):
4204         (async.noo):
4205         (async.ooo):
4206         (async.roo):
4207         (async.poo):
4208         (async.soo):
4209         (async.too):
4210         * stress/async-iteration-evaluation.js: Added.
4211         (assert):
4212         (async.foo):
4213         (catch):
4214         * stress/async-iteration-syntax.js:
4215         * stress/async-iteration-yield-promise.js: Added.
4216         (assert):
4217         (const.Logger):
4218         (this.fullfilled):
4219         (this.fullfilledDone):
4220         (this.rejected):
4221         (this.catched):
4222         (this.isFinal):
4223         (_assertLogger):
4224         (const.assertLogger):
4225         (const.getPromise.promiseHolder.return.new.Promise):
4226         (async.foo):
4227         (async.boo):
4228         (async.bar):
4229         * stress/async-iteration-yield-star-interface.js: Added.
4230         (assert):
4231         (const.getPromise.promiseHolder.return.new.Promise):
4232         (const.Logger):
4233         (this.fullfilled):
4234         (this.fullfilledDone):
4235         (this.rejected):
4236         (this.catched):
4237         (this.custom):
4238         (this.isFinal):
4239         (_assertLogger):
4240         (const.assertLogger):
4241         (let.asyncIter.Symbol.asyncIterator):
4242         (let.asyncIter.next):
4243         (let.asyncIter.throw):
4244         (let.asyncIter.return):
4245         (async.foo):
4246         (asyncIter.Symbol.asyncIterator):
4247         (asyncIter.next):
4248         (async.boo):
4249         (asyncIter.return):
4250         (async.bar):
4251         (async.baz):
4252         (async.foobar):
4253         * stress/async-iteration-yield-star.js: Added.
4254         (assert):
4255         (const.Logger):
4256         (this.fullfilled):
4257         (this.fullfilledDone):
4258         (this.rejected):
4259         (this.catched):
4260         (this.custom):
4261         (this.isFinal):
4262         (_assertLogger):
4263         (const.assertLogger):
4264         (const.getPromise.promiseHolder.return.new.Promise):
4265         (async.foo):
4266         (async.boo):
4267         (async.bar):
4268         (async.baz):
4269         (async.joo):
4270         (async.goo):
4271         (async.koo):
4272         (async.loo):
4273         (let.asyncIter.Symbol.asyncIterator):
4274         (let.asyncIter.next):
4275         (let.asyncIter.throw):
4276         (let.asyncIter.return):
4277         (async.moo):
4278         (async.noo):
4279         * test262.yaml:
4280
4281 2017-08-23  JF Bastien  <jfbastien@apple.com>
4282
4283         Fix printing in test
4284
4285         Unreviewed: fixing verbosity, shouldn't have been there.
4286
4287         * wasm/regress/175693.js:
4288         (else.else):
4289         (catch):
4290
4291 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
4292
4293         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
4294         https://bugs.webkit.org/show_bug.cgi?id=172543
4295
4296         Unreviewed test gardening.
4297
4298         * microbenchmarks/generator-with-several-types.js:
4299
4300 2017-08-17  JF Bastien  <jfbastien@apple.com>
4301
4302         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
4303         https://bugs.webkit.org/show_bug.cgi?id=175693
4304         <rdar://problem/33952443>
4305
4306         Reviewed by Saam Barati.
4307
4308         Add a regression directory for WebAssembly tests.
4309
4310         * wasm.yaml:
4311         * wasm/regress/175693.js: Added.
4312         (else.else):
4313         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
4314         (catch):
4315         * wasm/regress/175693.wasm: Added.
4316
4317 2017-08-15  Robin Morisset  <rmorisset@apple.com>
4318
4319         Support the 'with' keyword in FTL.
4320         https://bugs.webkit.org/show_bug.cgi?id=175585
4321
4322         Reviewed by Saam Barati.
4323
4324         Also improve the JSTest/stress/with.js file to test
4325         what happens when non-objects are passed to with.
4326
4327         * stress/with.js:
4328         (foo):
4329         (i.catch):
4330         (i.with): Deleted.
4331
4332 2017-08-14  Keith Miller  <keith_miller@apple.com>
4333
4334         Add testing tool to lie to the DFG about profiles
4335         https://bugs.webkit.org/show_bug.cgi?id=175487
4336
4337         Reviewed by Saam Barati.
4338
4339         * stress/compare-eq-incomplete-profile.js: Added.
4340         (const.test.createBuiltin):
4341
4342 2017-08-14  Robin Morisset  <rmorisset@apple.com>
4343
4344         Support the with keyword in DFG
4345         https://bugs.webkit.org/show_bug.cgi?id=175470
4346
4347         Reviewed by Saam Barati.
4348
4349         Added a new stress-test for the 'with' keyword, that caught a bug in a
4350         previous version of this code.
4351
4352         * stress/with.js: Added.
4353         (i.with):
4354
4355 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
4356
4357         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
4358         https://bugs.webkit.org/show_bug.cgi?id=175544
4359
4360         Unreviewed test gardening.
4361
4362         * ChakraCore.yaml:
4363
4364 2017-08-09  Caitlin Potter  <caitp@igalia.com>
4365
4366         Early error on ANY operator before new.target
4367         https://bugs.webkit.org/show_bug.cgi?id=157970
4368
4369         Reviewed by Saam Barati.
4370
4371         Instead of throwing if any unary operator precedes new.target, only
4372         throw if the unary operator updates the reference.
4373
4374         The following become legal in JSC:
4375
4376         ```
4377         !new.target
4378         ~new.target
4379         typeof new.target
4380         delete new.target
4381         void new.target
4382         ```
4383
4384         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
4385
4386         * stress/new-target-syntax-errors.js:
4387         * stress/new-target.js:
4388
4389 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
4390
4391         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
4392         https://bugs.webkit.org/show_bug.cgi?id=175255
4393
4394         Unreviewed test gardening.
4395
4396         * stress/regress-169783.js:
4397         * wasm/stress/oom.js:
4398
4399 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
4400
4401         REGRESSION: 2 test262/test/language/statements/async-function failures
4402         https://bugs.webkit.org/show_bug.cgi?id=175334
4403
4404         Reviewed by Yusuke Suzuki.
4405
4406         Add @skip parameters to tests, and remove test for async iterator from 
4407         async await syntax test because it is already covered by async-iterator-syntax.js
4408
4409         * stress/async-await-syntax.js:
4410         * stress/async-iteration-syntax.js:
4411
4412 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
4413
4414         Unreviewed, gardening test262 for Promise resolve / reject function length
4415         https://bugs.webkit.org/show_bug.cgi?id=175333
4416
4417         * test262.yaml:
4418
4419 2017-08-07  Robin Morisset  <rmorisset@apple.com>
4420
4421         GetOwnProperty of TypedArray indexed fields is wrongly configurable
4422         https://bugs.webkit.org/show_bug.cgi?id=175307
4423
4424         Reviewed by Saam Barati.
4425
4426         * stress/typedarray-getownproperty-not-configurable.js: Added.
4427         (assert):
4428         (foo):
4429
4430 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
4431
4432         Promise resolve and reject function should have length = 1
4433         https://bugs.webkit.org/show_bug.cgi?id=175242
4434
4435         Reviewed by Saam Barati.
4436