JSTests/ChangeLog

   1 2016-12-09  Saam Barati  <sbarati@apple.com>
   2
   3         WebAssembly JS API: implement importing and defining Memory
   4         https://bugs.webkit.org/show_bug.cgi?id=164134
   5
   6         Reviewed by Keith Miller.
   7
   8         * wasm/Builder.js:
   9         (const._importMemoryContinuation.section):
  10         (const._importMemoryContinuation.assert):
  11         (const._importMemoryContinuation):
  12         (const._exportFunctionContinuation.const): Deleted.
  13         (const._exportFunctionContinuation): Deleted.
  14         * wasm/Builder_WebAssemblyBinary.js:
  15         (const.emitters.Import):
  16         * wasm/js-api/test_basic_api.js:
  17         (const.c.in.constructorProperties.switch):
  18         * wasm/js-api/test_memory.js: Added.
  19         (assert):
  20         (binaryShouldNotParse):
  21         (test):
  22         (test.testMemImportError):
  23         * wasm/js-api/test_memory_constructor.js: Added.
  24         (assert):
  25         (throw.new.Error):
  26         (testInvalidSize):
  27         (assert.testInvalidInitial):
  28         (testInvalidInitial.testInvalidMaximum):
  29         (testInvalidInitial):
  30         (testInvalidMaximum):
  31         * wasm/self-test/test_BuilderJSON.js:
  32
  33 2016-12-08  JF Bastien  <jfbastien@apple.com>
  34
  35         WebAssembly: JSC::link* shouldn't need a CodeBlock
  36         https://bugs.webkit.org/show_bug.cgi?id=165591
  37
  38         Reviewed by Keith Miller.
  39
  40         test that wasm -> JS works, including the IC
  41
  42         * wasm/js-api/test_Instance.js:
  43         (const.wasmModuleWhichImportJS):
  44         (MonomorphicImport):
  45         (Polyphic2Import):
  46         (Polyphic3Import):
  47         (VirtualImport):
  48
  49 2016-12-08  Filip Pizlo  <fpizlo@apple.com>
  50
  51         Green the cloop bot by raising this threshold.
  52
  53         * mozilla/js1_5/Array/regress-101964.js:
  54
  55 2016-12-08  JF Bastien  <jfbastien@apple.com>
  56
  57         WebAssembly JS API: wire up Instance imports
  58         https://bugs.webkit.org/show_bug.cgi?id=165118
  59
  60         Reviewed by Saam Barati.
  61
  62         * wasm/js-api/test_Instance.js: add the test, disabled for now
  63
  64 2016-12-07  Keith Miller  <keith_miller@apple.com>
  65
  66         Add more missing trivial wasm ops.
  67         https://bugs.webkit.org/show_bug.cgi?id=165564
  68
  69         Add tests for drop and tee_local.
  70
  71         Reviewed by Geoffrey Garen.
  72
  73         * wasm/function-tests/drop.js: Added.
  74         * wasm/function-tests/nop.js: Added.
  75         * wasm/function-tests/tee-local.js: Added.
  76
  77 2016-12-06  Keith Miller  <keith_miller@apple.com>
  78
  79         Add support for truncation operators
  80         https://bugs.webkit.org/show_bug.cgi?id=165519
  81
  82         Reviewed by Geoffrey Garen.
  83
  84         * wasm/function-tests/i32-trunc-s-f32.js: Added.
  85         * wasm/function-tests/i32-trunc-s-f64.js: Added.
  86         * wasm/function-tests/i32-trunc-u-f32.js: Added.
  87         * wasm/function-tests/i32-trunc-u-f64.js: Added.
  88         * wasm/function-tests/i64-trunc-s-f32.js: Added.
  89         * wasm/function-tests/i64-trunc-s-f64.js: Added.
  90         * wasm/function-tests/i64-trunc-u-f32.js: Added.
  91         * wasm/function-tests/i64-trunc-u-f64.js: Added.
  92
  93 2016-12-06  Mark Lam  <mark.lam@apple.com>
  94
  95         Introduce the concept of Immutable Prototype Exotic Objects to comply with the spec.
  96         https://bugs.webkit.org/show_bug.cgi?id=165227
  97         <rdar://problem/29442665>
  98
  99         Reviewed by Saam Barati.
 100
 101         * stress/get-from-scope-dynamic-onto-proxy.js:
 102         - Updated error message.
 103
 104         * stress/proxy-dont-infinite-loop.js: Removed.
 105         * stress/proxy-json-path.js: Removed.
 106         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Removed.
 107         - Removed these tests because the issue they are testing relies on being able to
 108           set Object.prototype.__proto__ to something else (which is now not possible).
 109
 110 2016-12-05  Caitlin Potter  <caitp@igalia.com>
 111
 112         [JSC] report unexpected token when "async" is followed by identifier
 113         https://bugs.webkit.org/show_bug.cgi?id=165091
 114
 115         Reviewed by Mark Lam.
 116
 117         * stress/bug-165091.js:
 118
 119 2016-12-05  Keith Miller  <keith_miller@apple.com>
 120
 121         Add Wasm i64 to i32 conversion.
 122         https://bugs.webkit.org/show_bug.cgi?id=165378
 123
 124         Reviewed by Filip Pizlo.
 125
 126         It turns out the wrap operation is just B3's Trunc.
 127
 128         * wasm/wasm.json:
 129
 130 2016-12-04  Keith Miller  <keith_miller@apple.com>
 131
 132         Add support for Wasm ctz and popcnt
 133         https://bugs.webkit.org/show_bug.cgi?id=165369
 134
 135         Reviewed by Saam Barati.
 136
 137         * wasm/function-tests/ctz.js: Added.
 138         * wasm/function-tests/popcnt.js: Added.
 139
 140 2016-12-03  JF Bastien  <jfbastien@apple.com>
 141
 142         WebAssembly: update binary format to 0xD version
 143         https://bugs.webkit.org/show_bug.cgi?id=165345
 144
 145         Reviewed by Keith Miller.
 146
 147         As described in the following PR: https://github.com/WebAssembly/design/pull/836
 148         Originally committed in r209175, reverted in r209242, and fixed in r209284.
 149
 150         * wasm/Builder.js:
 151         (const._normalizeFunctionSignature):
 152         * wasm/Builder_WebAssemblyBinary.js:
 153         (const.emitters.Type):
 154         (const.emitters.Code):
 155         * wasm/LowLevelBinary.js:
 156         (export.default.LowLevelBinary.prototype.block_type):
 157         (export.default.LowLevelBinary.prototype.inline_signature_type): Deleted.
 158         * wasm/WASM.js:
 159         * wasm/js-api/test_basic_api.js:
 160         * wasm/self-test/test_BuilderWebAssembly.js:
 161         (EmptyModule):
 162         (CustomSection):
 163         * wasm/self-test/test_WASM.js:
 164         * wasm/wasm.json:
 165
 166 2016-12-02  Keith Miller  <keith_miller@apple.com>
 167
 168         Add Wasm copysign
 169         https://bugs.webkit.org/show_bug.cgi?id=165355
 170
 171         Reviewed by Filip Pizlo.
 172
 173         * wasm/function-tests/copysign.js: Added.
 174
 175 2016-12-03  Commit Queue  <commit-queue@webkit.org>
 176
 177         Unreviewed, rolling out r209298.
 178         https://bugs.webkit.org/show_bug.cgi?id=165359
 179
 180         broke the build (Requested by smfr on #webkit).
 181
 182         Reverted changeset:
 183
 184         "Add Wasm copysign"
 185         https://bugs.webkit.org/show_bug.cgi?id=165355
 186         http://trac.webkit.org/changeset/209298
 187
 188 2016-12-02  Keith Miller  <keith_miller@apple.com>
 189
 190         Add Wasm copysign
 191         https://bugs.webkit.org/show_bug.cgi?id=165355
 192
 193         Reviewed by Filip Pizlo.
 194
 195         * wasm/function-tests/copysign.js: Added.
 196
 197 2016-12-02  Keith Miller  <keith_miller@apple.com>
 198
 199         Unreviewed, fix git having a breakdown over trying to reland a rollout.
 200
 201 2016-12-02  Keith Miller  <keith_miller@apple.com>
 202
 203         Add Wasm floating point nearest and trunc
 204         https://bugs.webkit.org/show_bug.cgi?id=165339
 205
 206         Reviewed by Saam Barati.
 207
 208         * wasm/function-tests/nearest.js: Added.
 209         * wasm/function-tests/trunc.js: Added.
 210
 211 2016-12-02  Caitlin Potter  <caitp@igalia.com>
 212
 213 [JSC] add additional bit to JSTokenType bitfield
 214         https://bugs.webkit.org/show_bug.cgi?id=165091
 215
 216         Reviewed by Geoffrey Garen.
 217
 218         * stress/bug-165091.js: Added.
 219         (shouldThrowSyntaxError):
 220
 221 2016-12-02  Commit Queue  <commit-queue@webkit.org>
 222
 223         Unreviewed, rolling out r209275 and r209276.
 224         https://bugs.webkit.org/show_bug.cgi?id=165348
 225
 226         "broke the arm build" (Requested by keith_miller on #webkit).
 227
 228         Reverted changesets:
 229
 230         "Add Wasm floating point nearest and trunc"
 231         https://bugs.webkit.org/show_bug.cgi?id=165339
 232         http://trac.webkit.org/changeset/209275
 233
 234         "Unreviewed, forgot to change instruction after renaming."
 235         http://trac.webkit.org/changeset/209276
 236
 237 2016-12-02  Keith Miller  <keith_miller@apple.com>
 238
 239         Add Wasm floating point nearest and trunc
 240         https://bugs.webkit.org/show_bug.cgi?id=165339
 241
 242         Reviewed by Filip Pizlo.
 243
 244         * wasm/function-tests/nearest.js: Added.
 245         * wasm/function-tests/trunc.js: Added.
 246
 247 2016-12-02  JF Bastien  <jfbastien@apple.com>
 248
 249         WebAssembly: revert patch causing odd breakage
 250         https://bugs.webkit.org/show_bug.cgi?id=165308
 251
 252         Unreviewed.
 253
 254         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
 255         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
 256
 257         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
 258
 259         * wasm/Builder.js:
 260         (const._normalizeFunctionSignature):
 261         * wasm/Builder_WebAssemblyBinary.js:
 262         (const.emitters.Type):
 263         (const.emitters.Code):
 264         * wasm/LowLevelBinary.js:
 265         (export.default.LowLevelBinary.prototype.inline_signature_type):
 266         (export.default.LowLevelBinary.prototype.block_type): Deleted.
 267         * wasm/WASM.js:
 268         * wasm/js-api/test_basic_api.js:
 269         * wasm/self-test/test_BuilderWebAssembly.js:
 270         (EmptyModule):
 271         (CustomSection):
 272         * wasm/self-test/test_WASM.js:
 273         * wasm/wasm.json:
 274
 275 2016-12-01  Ryan Haddad  <ryanhaddad@apple.com>
 276
 277         Skip flaky test ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js
 278         https://bugs.webkit.org/show_bug.cgi?id=162567
 279
 280         Reviewed by Saam Barati.
 281
 282         * ChakraCore.yaml:
 283
 284 2016-12-01  Keith Miller  <keith_miller@apple.com>
 285
 286         Add wasm int to floating point opcodes
 287         https://bugs.webkit.org/show_bug.cgi?id=165252
 288
 289         Reviewed by Geoffrey Garen.
 290
 291         Add tests for Wasm integral to floating point conversion opcodes.
 292
 293         * wasm/function-tests/int-to-floating-point.js: Added.
 294         * wasm/wasm.json:
 295
 296 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
 297
 298         Land a test case for <rdar://problem/27889416>
 299         https://bugs.webkit.org/show_bug.cgi?id=165272
 300
 301         Reviewed by Saam Barati.
 302
 303         * stress/marked-argument-buffer.js: Added.
 304         (allocate):
 305         (test.o.toString):
 306         (test):
 307
 308 2016-11-29  Per Arne Vollan  <pvollan@apple.com>
 309
 310         [Win] Skip failing JSC tests.
 311         https://bugs.webkit.org/show_bug.cgi?id=165140
 312
 313         Reviewed by Mark Lam.
 314
 315         * ChakraCore.yaml:
 316         * microbenchmarks/tan.js:
 317
 318 2016-11-30  JF Bastien  <jfbastien@apple.com>
 319
 320         WebAssembly builder: don't throw when checker not implemented
 321         https://bugs.webkit.org/show_bug.cgi?id=165219
 322
 323         Reviewed by Mark Lam.
 324
 325         We should perform whichever checks we've implemented, and assume the rest are OK until bug #163421 is fixed.
 326
 327         * wasm/Builder.js:
 328         * wasm/README.md:
 329         * wasm/function-tests/add-12.js:
 330         * wasm/function-tests/br-if-loop-less-than.js:
 331         * wasm/function-tests/brTableAsIf.js:
 332         * wasm/function-tests/brTableManyValues.js:
 333         * wasm/function-tests/brTableWithLoop.js:
 334         * wasm/function-tests/dumb-eq-if-then-else.js:
 335         * wasm/function-tests/dumb-less-than-fallthrough.js:
 336         * wasm/function-tests/dumb-less-than-ite.js:
 337         * wasm/function-tests/eqz.js:
 338         * wasm/function-tests/factorial.js:
 339         * wasm/function-tests/float-sub.js:
 340         * wasm/function-tests/i32-load.js:
 341         * wasm/function-tests/i32-load8-s.js:
 342         * wasm/function-tests/if-then-else-fallthrough.js:
 343         * wasm/function-tests/if-then-fallthrough.js:
 344         * wasm/function-tests/loop-mult.js:
 345         * wasm/function-tests/loop-sum.js:
 346         * wasm/function-tests/max.js:
 347         * wasm/function-tests/min.js:
 348         * wasm/function-tests/ret5.js:
 349         * wasm/function-tests/select.js:
 350         * wasm/self-test/test_BuilderJSON.js:
 351
 352 2016-11-29  JF Bastien  <jfbastien@apple.com>
 353
 354         WebAssembly JS API: improve Instance
 355         https://bugs.webkit.org/show_bug.cgi?id=164757
 356
 357         Reviewed by Keith Miller.
 358
 359         An Instance's `exports` property wasn't populated with exports.
 360
 361         A follow-up patch will do imports.
 362
 363         A few things of note:
 364
 365          - LowLevelBinary: support 3-byte integers.
 366          - LowLevelBinary: support proper UTF-8 2003 code points (instead of UTF-16).
 367
 368         * wasm/Builder.js:
 369         * wasm/Builder_WebAssemblyBinary.js: wire up exports, stub other things out some more
 370         (const.emitters.Export):
 371         * wasm/LowLevelBinary.js:
 372         (export.default.LowLevelBinary.prototype.uint24): add, used for UTF-8
 373         (export.default.LowLevelBinary.prototype.string): support UTF-8
 374         (export.default.LowLevelBinary.prototype.getUint24): add, used for UTF-8
 375         (export.default.LowLevelBinary.prototype.getVaruint1): was missing
 376         (export.default.LowLevelBinary.prototype.getString): support UTF-8
 377         (export.default.LowLevelBinary):
 378         * wasm/js-api/test_Instance.js: instance.exports.answer() // <-- this is where the magic of this entire patch is
 379         (ExportedAnswerI32):
 380         * wasm/js-api/test_basic_api.js: punt test to later
 381         (const.c.in.constructorProperties.switch):
 382         * wasm/self-test/test_BuilderWebAssembly.js: UTF-8
 383         (CustomSection):
 384         * wasm/self-test/test_LowLevelBinary_string.js: UTF-8 now works
 385         * wasm/self-test/test_LowLevelBinary_uint16.js: was missing one value
 386         * wasm/self-test/test_LowLevelBinary_uint24.js: Copied from JSTests/wasm/self-test/test_LowLevelBinary_uint8.js.
 387         * wasm/self-test/test_LowLevelBinary_uint8.js: was missing one value
 388         * wasm/self-test/test_LowLevelBinary_varuint1.js: Added.
 389         * wasm/utilities.js: this `dump` thing was useful
 390         (const._dump):
 391
 392 2016-11-29  Saam Barati  <sbarati@apple.com>
 393
 394         We should be able optimize the pattern where we spread a function's rest parameter to another call
 395         https://bugs.webkit.org/show_bug.cgi?id=163865
 396
 397         Reviewed by Filip Pizlo.
 398
 399         * microbenchmarks/default-derived-constructor.js: Added.
 400         (createClassHierarchy.let.currentClass):
 401         (createClassHierarchy):
 402         * stress/call-varargs-spread.js: Added.
 403         (assert):
 404         (bar):
 405         (foo):
 406         * stress/load-varargs-on-new-array-with-spread-convert-to-static-loads.js: Added.
 407         (assert):
 408         (baz):
 409         (bar):
 410         (foo):
 411         * stress/new-array-with-spread-with-normal-spread-and-phantom-spread.js: Added.
 412         (assert):
 413         (foo):
 414         (escape):
 415         (bar):
 416         * stress/phantom-new-array-with-spread-osr-exit.js: Added.
 417         (assert):
 418         (baz):
 419         (bar):
 420         (effects):
 421         (foo):
 422         * stress/phantom-spread-forward-varargs.js: Added.
 423         (assert):
 424         (test1.bar):
 425         (test1.foo):
 426         (test1):
 427         (test2.bar):
 428         (test2.foo):
 429         (test3.baz):
 430         (test3.bar):
 431         (test3.foo):
 432         (test4.baz):
 433         (test4.bar):
 434         (test4.foo):
 435         (test5.baz):
 436         (test5.bar):
 437         (test5.foo):
 438         * stress/phantom-spread-osr-exit.js: Added.
 439         (assert):
 440         (baz):
 441         (bar):
 442         (effects):
 443         (foo):
 444         * stress/spread-call-convert-to-static-call.js: Added.
 445         (assert):
 446         (baz):
 447         (bar):
 448         (foo):
 449         * stress/spread-forward-call-varargs-stack-overflow.js: Added.
 450         (assert):
 451         (identity):
 452         (bar):
 453         (foo):
 454         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol-2.js: Added.
 455         (assert):
 456         (baz.Array.prototype.Symbol.iterator):
 457         (baz):
 458         (bar):
 459         (foo):
 460         (test):
 461         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol.js: Added.
 462         (assert):
 463         (baz.Array.prototype.Symbol.iterator):
 464         (baz):
 465         (bar):
 466         (foo):
 467         * stress/spread-forward-varargs-stack-overflow.js: Added.
 468         (assert):
 469         (bar):
 470         (foo):
 471
 472 2016-11-29  Caitlin Potter  <caitp@igalia.com>
 473
 474         [JSC] always wrap AwaitExpression operand in a new Promise
 475         https://bugs.webkit.org/show_bug.cgi?id=165181
 476
 477         Reviewed by Yusuke Suzuki.
 478
 479         * stress/async-await-basic.js:
 480         (async.awaitedPromisesAreWrapped):
 481
 482 2016-11-29  Keith Miller  <keith_miller@apple.com>
 483
 484         Add simple way to implement Wasm ops that require more than one B3 opcode
 485         https://bugs.webkit.org/show_bug.cgi?id=165129
 486
 487         Reviewed by Geoffrey Garen.
 488
 489         * wasm/function-tests/eqz.js: Added.
 490         * wasm/function-tests/max.js: Added.
 491         * wasm/function-tests/min.js: Added.
 492         * wasm/wasm.json:
 493
 494 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
 495
 496         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
 497         https://bugs.webkit.org/show_bug.cgi?id=164898
 498
 499         Reviewed by Darin Adler.
 500
 501         * stress/tagged-template-registry-key-collect.js: Added.
 502         (shouldBe):
 503         (tag):
 504         (i.eval):
 505         * stress/tagged-template-registry-key.js: Added.
 506         (shouldBe):
 507         (tag):
 508         (a):
 509         (b):
 510
 511 2016-11-20  Caitlin Potter  <caitp@igalia.com>
 512
 513         [JSC] speed up parsing of async functions
 514         https://bugs.webkit.org/show_bug.cgi?id=164808
 515
 516         Reviewed by Yusuke Suzuki.
 517
 518         Add tests for line terminator following "async" keyword in async
 519         function syntax.
 520
 521         * stress/async-await-syntax.js:
 522         (shouldBe):
 523
 524 2016-11-19  Mark Lam  <mark.lam@apple.com>
 525
 526         op_mod-* JSC tests needs a longer timeout too.
 527         https://bugs.webkit.org/show_bug.cgi?id=164994
 528
 529         Reviewed by Yusuke Suzuki.
 530
 531         * stress/op_mod-ConstVar.js:
 532         * stress/op_mod-VarConst.js:
 533         * stress/op_mod-VarVar.js:
 534
 535 2016-11-19  Mark Lam  <mark.lam@apple.com>
 536
 537         Add --timeoutMultiplier option to allow some tests more time to run.
 538         https://bugs.webkit.org/show_bug.cgi?id=164951
 539
 540         Reviewed by Yusuke Suzuki.
 541
 542         Extended the timeout for these tests by 50% more because they run quite slow on
 543         low-end machines.
 544
 545         * stress/op_div-ConstVar.js:
 546         * stress/op_div-VarConst.js:
 547         * stress/op_div-VarVar.js:
 548
 549 2016-11-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 550
 551         REGRESSION(r208867): JSC test failure: ChakraCore.yaml/ChakraCore/test/strict/05.arguments_sm.js.default
 552         https://bugs.webkit.org/show_bug.cgi?id=164929
 553
 554         Reviewed by Mark Lam.
 555
 556         ES2017 drops arguments.caller and JavaScriptCore is updated to meet the spec.
 557         This patch rebaselines the result of ChakraCore test for JSC.
 558
 559         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
 560
 561 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
 562
 563         Web Inspector: Generator functions should have a displayable name when shown in stack traces
 564         https://bugs.webkit.org/show_bug.cgi?id=164844
 565         <rdar://problem/29300697>
 566
 567         Reviewed by Yusuke Suzuki.
 568
 569         * stress/generator-function-name.js:
 570         Add another test now that we name the inner generator function
 571         that we do not break the lexical resolution of names.
 572
 573 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
 574
 575         [JSC] Drop arguments.caller
 576         https://bugs.webkit.org/show_bug.cgi?id=164859
 577
 578         Reviewed by Saam Barati.
 579
 580         * stress/strict-mode-arguments-caller.js: Added.
 581         (strictArguments):
 582         (shouldBe):
 583
 584 2016-11-17  Keith Miller  <keith_miller@apple.com>
 585
 586         Add rotate to Wasm
 587         https://bugs.webkit.org/show_bug.cgi?id=164871
 588
 589         Reviewed by Filip Pizlo.
 590
 591         * wasm/wasm.json:
 592
 593 2016-11-17  Keith Miller  <keith_miller@apple.com>
 594
 595         Add sqrt to Wasm
 596         https://bugs.webkit.org/show_bug.cgi?id=164877
 597
 598         Reviewed by Mark Lam.
 599
 600         B3 already has a Sqrt opcode we just need to map Wasm to it.
 601
 602         * wasm/wasm.json:
 603
 604 2016-11-17  Saam Barati  <sbarati@apple.com>
 605
 606         Remove async/await compile time flag and enable tests
 607         https://bugs.webkit.org/show_bug.cgi?id=164828
 608         <rdar://problem/28639334>
 609
 610         Reviewed by Yusuke Suzuki.
 611
 612         * stress/async-arrow-functions-lexical-arguments-binding.js:
 613         * stress/async-arrow-functions-lexical-new.target-binding.js:
 614         * stress/async-arrow-functions-lexical-super-binding.js:
 615         * stress/async-arrow-functions-lexical-this-binding.js:
 616         * stress/async-await-basic.js:
 617         * stress/async-await-long-loop.js:
 618         * stress/async-await-module-reserved-word.js:
 619         * stress/async-await-mozilla.js:
 620         (mozSyntaxErrors):
 621         * stress/async-await-reserved-word.js:
 622         * stress/async-await-syntax.js:
 623         * stress/async-await-throw-loop.js:
 624         * stress/async-function-create-nobaseline.js:
 625         * stress/async-function-create-optimized.js:
 626         * stress/async-function-declaration-sinking-no-double-allocate.js:
 627         * stress/async-function-declaration-sinking-osrexit.js:
 628         * stress/async-function-declaration-sinking-put.js:
 629         * stress/async-function-expression-sinking-no-double-allocate.js:
 630         * stress/async-function-expression-sinking-osrexit.js:
 631         * stress/async-function-expression-sinking-put.js:
 632         * test262.yaml:
 633
 634 2016-11-15  Mark Lam  <mark.lam@apple.com>
 635
 636         Make JSC test functions more robust.
 637         https://bugs.webkit.org/show_bug.cgi?id=164807
 638
 639         Reviewed by Keith Miller.
 640
 641         * stress/jsc-test-functions-should-be-more-robust.js: Added.
 642
 643 2016-11-15  Keith Miller  <keith_miller@apple.com>
 644
 645         B3 should support UDiv/UMod
 646         https://bugs.webkit.org/show_bug.cgi?id=164811
 647
 648         Reviewed by Filip Pizlo.
 649
 650         Link new instructions to wasm.
 651
 652         * wasm/wasm.json:
 653
 654 2016-11-15  Saam Barati  <sbarati@apple.com>
 655
 656         Debug JSC test timeout: stress/has-own-property-name-cache-symbols-and-strings.js.ftl-no-cjit-small-pool
 657         https://bugs.webkit.org/show_bug.cgi?id=163012
 658
 659         Unreviewed. This patch makes a test run for less time because it's timing out on the bots.
 660
 661         * stress/has-own-property-name-cache-symbols-and-strings.js:
 662
 663 2016-11-15  Mark Lam  <mark.lam@apple.com>
 664
 665         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
 666         https://bugs.webkit.org/show_bug.cgi?id=164781
 667         <rdar://problem/28418590>
 668
 669         Reviewed by Geoffrey Garen and Michael Saboff.
 670
 671         * stress/jsc-setImpureGetterDelegate-on-bad-type.js: Added.
 672
 673 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 674
 675         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
 676         https://bugs.webkit.org/show_bug.cgi?id=164727
 677
 678         Reviewed by Filip Pizlo.
 679
 680         * stress/check-dom-with-signature.js: Added.
 681         (shouldBe):
 682         (calling):
 683         (i.array.forEach):
 684
 685 2016-11-14  Caitlin Potter  <caitp@igalia.com>
 686
 687         [JSC] do not reference AwaitExpression Promises in async function Promise chain
 688         https://bugs.webkit.org/show_bug.cgi?id=164753
 689
 690         Reviewed by Yusuke Suzuki.
 691
 692         * asyncFunctionTests.yaml:
 693         * stress/async-await-long-loop.js: Added.
 694         (shouldBe):
 695         (async.longLoop):
 696         * stress/async-await-throw-loop.js: Added.
 697         (shouldBe):
 698         (async.thrower):
 699         (async.throwLoop):
 700
 701 2016-11-14  Keith Miller  <keith_miller@apple.com>
 702
 703         Add Wasm select
 704         https://bugs.webkit.org/show_bug.cgi?id=164743
 705
 706         Reviewed by Saam Barati.
 707
 708         * wasm/function-tests/select.js: Added.
 709
 710 2016-11-14  Caitlin Potter  <caitp@igalia.com>
 711
 712         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
 713         https://bugs.webkit.org/show_bug.cgi?id=164037
 714
 715         Reviewed by Yusuke Suzuki.
 716
 717         Add tests based on tests from https://trac.webkit.org/changeset/194216.
 718
 719         * asyncFunctionTests.yaml:
 720         * stress/async-function-create-nobaseline.js: Added.
 721         * stress/async-function-create-optimized.js: Added.
 722         * stress/async-function-declaration-sinking-no-double-allocate.js: Added.
 723         * stress/async-function-declaration-sinking-osrexit.js: Added.
 724         * stress/async-function-declaration-sinking-put.js: Added.
 725         * stress/async-function-expression-sinking-no-double-allocate.js: Added.
 726         * stress/async-function-expression-sinking-osrexit.js: Added.
 727         * stress/async-function-expression-sinking-put.js: Added.
 728
 729 2016-11-14  Mark Lam  <mark.lam@apple.com>
 730
 731         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
 732         https://bugs.webkit.org/show_bug.cgi?id=164701
 733         <rdar://problem/27462104>
 734
 735         Reviewed by Darin Adler.
 736
 737         * stress/string-prototype-charCodeAt-on-too-long-rope.js: Added.
 738
 739 2016-11-14  Mark Lam  <mark.lam@apple.com>
 740
 741         RegExpObject::exec/match should handle errors gracefully.
 742         https://bugs.webkit.org/show_bug.cgi?id=155145
 743         <rdar://problem/27435934>
 744
 745         Reviewed by Keith Miller.
 746
 747         * stress/regexp-prototype-exec-on-too-long-rope.js: Added.
 748         * stress/regexp-prototype-match-on-too-long-rope.js: Added.
 749         * stress/regexp-prototype-test-on-too-long-rope.js: Added.
 750
 751 2016-11-14  Mark Lam  <mark.lam@apple.com>
 752
 753         Enhance run-jsc-stress-test script to allow optional test specific options to be added for all test run configurations.
 754         https://bugs.webkit.org/show_bug.cgi?id=164695
 755
 756         Reviewed by Keith Miller.
 757
 758         Replace use of runMisc* test run configurations with equivalents.
 759
 760         * stress/licm-no-pre-header-nested.js:
 761         * stress/licm-no-pre-header.js:
 762         * stress/licm-pre-header-cannot-exit-nested.js:
 763         * stress/licm-pre-header-cannot-exit.js:
 764         * stress/make-dictionary-repatch.js:
 765         * stress/retry-cache-later.js:
 766         * stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js:
 767         * stress/slow-path-generator-updating-current-node-dfg.js:
 768         * stress/unshift-array-storage.js:
 769
 770 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
 771
 772         test262: DataView with explicit undefined byteLength should be the same as it not being present
 773         https://bugs.webkit.org/show_bug.cgi?id=164453
 774
 775         Reviewed by Darin Adler.
 776
 777         * stress/dataview-construct.js: Added.
 778         (assert):
 779         (shouldThrow):
 780         * test262.yaml:
 781
 782 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
 783
 784         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
 785         https://bugs.webkit.org/show_bug.cgi?id=164451
 786
 787         Reviewed by Darin Adler.
 788
 789         * test262.yaml:
 790
 791 2016-11-11  Saam Barati  <sbarati@apple.com>
 792
 793         We should have a more concise way of determining when we're varargs calling a function using rest parameters
 794         https://bugs.webkit.org/show_bug.cgi?id=164258
 795
 796         Reviewed by Yusuke Suzuki.
 797
 798         * microbenchmarks/call-using-spread.js: Added.
 799         (bar):
 800         (foo):
 801         * microbenchmarks/spread-large-array.js: Added.
 802         (foo):
 803         (arrays.push):
 804         * microbenchmarks/spread-small-array.js: Added.
 805         (foo):
 806         * stress/spread-array-iterator-watchpoint-2.js: Added.
 807         (foo):
 808         (arrayIterator.next):
 809         * stress/spread-array-iterator-watchpoint.js: Added.
 810         (foo):
 811         (Array.prototype.Symbol.iterator):
 812         * stress/spread-non-array.js: Added.
 813         (assert):
 814         (foo):
 815         (let.customIterator.Symbol.iterator):
 816         (bar):
 817
 818 2016-11-11  Keith Miller  <keith_miller@apple.com>
 819
 820         Relocate wasm tests and actually add them to the test runner
 821         https://bugs.webkit.org/show_bug.cgi?id=164668
 822
 823         Reviewed by Yusuke Suzuki.
 824
 825         This moves the Wasm tests from their current location down a level.
 826         Without relocating, the tests cannot properly be run by the wasm test runner.
 827
 828         * wasm.yaml:
 829         * wasm/Builder.js: Fix typos, yay lazy synatx checking!
 830         * wasm/LowLevelBinary.js: Fix typos, yay lazy synatx checking!
 831         (export.default.LowLevelBinary.prototype.get return):
 832         * wasm/function-tests/add-12.js: Renamed from JSTests/wasm/js-api/function-tests/add-12.js.
 833         * wasm/function-tests/br-if-loop-less-than.js: Renamed from JSTests/wasm/js-api/function-tests/br-if-loop-less-than.js.
 834         * wasm/function-tests/brTableAsIf.js: Renamed from JSTests/wasm/js-api/function-tests/brTableAsIf.js.
 835         * wasm/function-tests/brTableManyValues.js: Renamed from JSTests/wasm/js-api/function-tests/brTableManyValues.js.
 836         * wasm/function-tests/brTableWithLoop.js: Renamed from JSTests/wasm/js-api/function-tests/brTableWithLoop.js.
 837         * wasm/function-tests/dumb-eq-if-then-else.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-eq-if-then-else.js.
 838         * wasm/function-tests/dumb-less-than-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-fallthrough.js.
 839         * wasm/function-tests/dumb-less-than-ite.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-ite.js.
 840         * wasm/function-tests/factorial.js: Renamed from JSTests/wasm/js-api/function-tests/factorial.js.
 841         * wasm/function-tests/float-sub.js: Renamed from JSTests/wasm/js-api/function-tests/float-sub.js.
 842         * wasm/function-tests/i32-load.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load.js.
 843         * wasm/function-tests/i32-load8-s.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load8-s.js.
 844         * wasm/function-tests/if-then-else-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-else-fallthrough.js.
 845         * wasm/function-tests/if-then-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-fallthrough.js.
 846         * wasm/function-tests/loop-mult.js: Renamed from JSTests/wasm/js-api/function-tests/loop-mult.js.
 847         * wasm/function-tests/loop-sum.js: Renamed from JSTests/wasm/js-api/function-tests/loop-sum.js.
 848         * wasm/function-tests/ret5.js: Renamed from JSTests/wasm/js-api/function-tests/ret5.js.
 849         * wasm/self-test/test_BuilderJSON.js: Rebasline
 850
 851 2016-11-11  Keith Miller  <keith_miller@apple.com>
 852
 853         Move Wasm tests to JS
 854         https://bugs.webkit.org/show_bug.cgi?id=164611
 855
 856         Reviewed by Geoffrey Garen.
 857
 858         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
 859         ommited tests were earliest tests, which tested trivial things, like adding two
 860         constants. Some tests are ommited for other reasons, however. These are:
 861
 862         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
 863         Tests that would validate the memory of the module once wasm was done with it since that's
 864         not really possible in JS.
 865
 866         In order to make such a translation easier this patch also adds some features to the JS
 867         testing api:
 868
 869         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
 870         opcode. For example one can do:
 871             ...
 872             .Block("i32", b => b.I32Const(1) )
 873
 874         and the nested lambda will automatically have an end attached.
 875
 876         2) The JS testing api can now handle inline signature types.
 877
 878         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
 879
 880         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
 881         wasm.json without being remapped.
 882
 883         5) Add support for Memory and Function sections to the Builder.
 884
 885         6) Add support for local variables.
 886
 887         On the JSC side, we needed to expose a new function to validate the compiled wasm code
 888         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
 889         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
 890         number of functions in the blob and tests for each of those functions.
 891
 892         * wasm/Builder.js:
 893         (const._maybeRegisterType):
 894         (const): Deleted.
 895         (switch.typeof): Deleted.
 896         * wasm/Builder_WebAssemblyBinary.js:
 897         (const.emitters.Type):
 898         (const.emitters.Import):
 899         (const.emitters.Function):
 900         (const.emitters.Memory):
 901         (const.emitters.Code):
 902         (export.const.Binary):
 903         * wasm/LowLevelBinary.js:
 904         (export.default.LowLevelBinary.prototype.get return):
 905         (export.default.LowLevelBinary.prototype.varuint32):
 906         (export.default.LowLevelBinary.prototype.varint32):
 907         (export.default.LowLevelBinary.prototype.varuint1):
 908         (export.default.LowLevelBinary.prototype.varint7):
 909         (export.default.LowLevelBinary.prototype.varuint7):
 910         (export.default.LowLevelBinary.prototype.inline_signature_type):
 911         (export.default.LowLevelBinary.prototype.string):
 912         (export.default.LowLevelBinary.prototype.getVaruint32):
 913         (export.default.LowLevelBinary.prototype.getVarint32):
 914         (export.default.LowLevelBinary.prototype.getVaruint7):
 915         (export.default.LowLevelBinary.prototype.getString):
 916         (export.default.LowLevelBinary):
 917         (export.default.LowLevelBinary.prototype.varuint): Deleted.
 918         (export.default.LowLevelBinary.prototype.varint): Deleted.
 919         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
 920         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
 921         * wasm/js-api/test_old_tests.js: Added.
 922         (ret5):
 923         (brTableWithLoop):
 924         (brTableManyValues):
 925         (run.brTableManyValues.brTableAsIf):
 926         (ifThenFallthrough):
 927         (ifThenElseFallthrough):
 928         (dumbLessThanFallthrough):
 929         (run.dumbLessThanFallthrough.floatSub):
 930         (run.floatSub.add12):
 931         (run.add12.factorial):
 932         (i32load):
 933         (run.i32load.i32load8s):
 934         (run.i32load8s.dumbEqIfThenElse):
 935         (run.dumbEqIfThenElse.dumbEqIfThenElse):
 936         (run.dumbEqIfThenElse.dumbLessThanIfThenElse):
 937         (run.dumbLessThanIfThenElse.loopSum):
 938         (run.loopSum.loopMult):
 939         (brIfLoopLessThan):
 940         (run.brIfLoopLessThan.run):
 941         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
 942         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
 943
 944         * wasm/Builder.js:
 945         (const._maybeRegisterType):
 946         (const): Deleted.
 947         (switch.typeof): Deleted.
 948         * wasm/Builder_WebAssemblyBinary.js:
 949         (const.emitters.Type):
 950         (const.emitters.Import):
 951         (const.emitters.Function):
 952         (const.emitters.Memory):
 953         (const.emitters.Code):
 954         (export.const.Binary):
 955         * wasm/LowLevelBinary.js:
 956         (export.default.LowLevelBinary.prototype.get return):
 957         (export.default.LowLevelBinary.prototype.varuint32):
 958         (export.default.LowLevelBinary.prototype.varint32):
 959         (export.default.LowLevelBinary.prototype.varuint1):
 960         (export.default.LowLevelBinary.prototype.varint7):
 961         (export.default.LowLevelBinary.prototype.varuint7):
 962         (export.default.LowLevelBinary.prototype.inline_signature_type):
 963         (export.default.LowLevelBinary.prototype.string):
 964         (export.default.LowLevelBinary.prototype.getVaruint32):
 965         (export.default.LowLevelBinary.prototype.getVarint32):
 966         (export.default.LowLevelBinary.prototype.getVaruint7):
 967         (export.default.LowLevelBinary.prototype.getString):
 968         (export.default.LowLevelBinary):
 969         (export.default.LowLevelBinary.prototype.varuint): Deleted.
 970         (export.default.LowLevelBinary.prototype.varint): Deleted.
 971         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
 972         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
 973         * wasm/js-api/function-tests/add-12.js: Added.
 974         * wasm/js-api/function-tests/br-if-loop-less-than.js: Added.
 975         * wasm/js-api/function-tests/brTableAsIf.js: Added.
 976         * wasm/js-api/function-tests/brTableManyValues.js: Added.
 977         * wasm/js-api/function-tests/brTableWithLoop.js: Added.
 978         * wasm/js-api/function-tests/dumb-eq-if-then-else.js: Added.
 979         * wasm/js-api/function-tests/dumb-less-than-fallthrough.js: Added.
 980         * wasm/js-api/function-tests/dumb-less-than-ite.js: Added.
 981         * wasm/js-api/function-tests/factorial.js: Added.
 982         * wasm/js-api/function-tests/float-sub.js: Added.
 983         * wasm/js-api/function-tests/i32-load.js: Added.
 984         * wasm/js-api/function-tests/i32-load8-s.js: Added.
 985         * wasm/js-api/function-tests/if-then-else-fallthrough.js: Added.
 986         * wasm/js-api/function-tests/if-then-fallthrough.js: Added.
 987         * wasm/js-api/function-tests/loop-mult.js: Added.
 988         * wasm/js-api/function-tests/loop-sum.js: Added.
 989         * wasm/js-api/function-tests/ret5.js: Added.
 990         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
 991         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
 992
 993 2016-11-11  Saam Barati  <sbarati@apple.com>
 994
 995         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
 996         https://bugs.webkit.org/show_bug.cgi?id=164650
 997
 998         Reviewed by Geoffrey Garen.
 999
1000         * stress/dont-dead-lock-put-by-val-as-put-by-id.js: Added.
1001         (ident):
1002         (let.o.set foo):
1003         (foo):
1004
1005 2016-11-11  Chris Dumez  <cdumez@apple.com>
1006
1007         Unreviewed, rolling out r208584.
1008
1009         Seems to have regressed Speedometer by 1% on Mac
1010
1011         Reverted changeset:
1012
1013         "We should have a more concise way of determining when we're
1014         varargs calling a function using rest parameters"
1015         https://bugs.webkit.org/show_bug.cgi?id=164258
1016         http://trac.webkit.org/changeset/208584
1017
1018 2016-11-11  Chris Dumez  <cdumez@apple.com>
1019
1020         Unreviewed, rolling out r208117 and r208160.
1021
1022         Regressed Speedometer by >1.5%
1023
1024         Reverted changesets:
1025
1026         "We should have a way of profiling when a get_by_id is pure
1027         and to emit a PureGetById in the DFG/FTL"
1028         https://bugs.webkit.org/show_bug.cgi?id=163305
1029         http://trac.webkit.org/changeset/208117
1030
1031         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
1032         out"
1033         https://bugs.webkit.org/show_bug.cgi?id=164227
1034         http://trac.webkit.org/changeset/208160
1035
1036 2016-11-11  Saam Barati  <sbarati@apple.com>
1037
1038         We should have a more concise way of determining when we're varargs calling a function using rest parameters
1039         https://bugs.webkit.org/show_bug.cgi?id=164258
1040
1041         Reviewed by Yusuke Suzuki.
1042
1043         * microbenchmarks/call-using-spread.js: Added.
1044         (bar):
1045         (foo):
1046         * microbenchmarks/spread-large-array.js: Added.
1047         (foo):
1048         (arrays.push):
1049         * microbenchmarks/spread-small-array.js: Added.
1050         (foo):
1051         * stress/spread-array-iterator-watchpoint-2.js: Added.
1052         (foo):
1053         (arrayIterator.next):
1054         * stress/spread-array-iterator-watchpoint.js: Added.
1055         (foo):
1056         (Array.prototype.Symbol.iterator):
1057         * stress/spread-non-array.js: Added.
1058         (assert):
1059         (foo):
1060         (let.customIterator.Symbol.iterator):
1061         (bar):
1062
1063 2016-11-10  Mark Lam  <mark.lam@apple.com>
1064
1065         Fix broken have-a-bad-time-with-arguments.js test.
1066         https://bugs.webkit.org/show_bug.cgi?id=164626
1067
1068         Reviewed by Filip Pizlo.
1069
1070         But also saved a copy of the broken one as broken-have-a-bad-time-with-arguments-for-gc-testing.js
1071         because coincidentally, it stresses the GC in ways that help reveal bugs.
1072
1073         * stress/broken-have-a-bad-time-with-arguments-for-gc-testing.js: Added.
1074         (testFunction):
1075         (warmupFunction):
1076         (let.argsDeclIndex.in.argumentsDecls.let.indexToReturnIndex.in.indicesToReturn.let.insertElementActionIndex.in.insertElementActions.let.tierWarmupCountIndex.in.tierWarmupCounts.let.testArgsIndex.in.testArgsList.catch):
1077         * stress/have-a-bad-time-with-arguments.js:
1078
1079 2016-11-10  JF Bastien  <jfbastien@apple.com>
1080
1081         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
1082         https://bugs.webkit.org/show_bug.cgi?id=164597
1083
1084         Reviewed by Keith Miller.
1085
1086         Trim the array buffer before returning it: it's optimistically
1087         over-allocated to avoid growing all the time, but when parsed it
1088         can't have extra content.
1089
1090         * wasm/Builder_WebAssemblyBinary.js:
1091         (export.const.Binary):
1092         * wasm/LowLevelBinary.js:
1093         (export.default.LowLevelBinary.prototype.get return):
1094
1095 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
1096
1097         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
1098         https://bugs.webkit.org/show_bug.cgi?id=164450
1099
1100         Reviewed by Darin Adler.
1101
1102         * stress/dataview-typedarray-toindex.js: Added.
1103         Tests for all cases where ToIndex should be used.
1104
1105         * test262.yaml:
1106         New passing tests.
1107
1108 2016-11-10  Mark Lam  <mark.lam@apple.com>
1109
1110         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
1111         https://bugs.webkit.org/show_bug.cgi?id=164600
1112         <rdar://problem/28828676>
1113
1114         Reviewed by Filip Pizlo.
1115
1116         * stress/osr-exit-on-op-negate-should-no-fail-assertions.js: Added.
1117
1118 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1119
1120         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
1121         https://bugs.webkit.org/show_bug.cgi?id=164502
1122
1123         Reviewed by Saam Barati.
1124
1125         * stress/argument-intrinsic-basic.js: Added.
1126         (shouldBe):
1127         (builtin.createBuiltin):
1128         * stress/argument-intrinsic-inlining-with-result-escape.js: Added.
1129         (shouldBe):
1130         (builtin.createBuiltin):
1131         (escape):
1132         * stress/argument-intrinsic-nested-inlining.js: Added.
1133         (shouldBe):
1134         (builtin.createBuiltin):
1135         (builtinCaller1):
1136         (builtinCaller2):
1137         (escape):
1138         * stress/argument-intrinsic-not-convert-to-get-argument.js: Added.
1139         (shouldBe):
1140         (builtin.createBuiltin):
1141         * stress/argument-intrinsic-with-stack-write.js: Added.
1142         (shouldBe):
1143         (builtin.createBuiltin):
1144
1145 2016-11-09  Saam Barati  <sbarati@apple.com>
1146
1147         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
1148         https://bugs.webkit.org/show_bug.cgi?id=164464
1149         <rdar://problem/29131452>
1150
1151         Reviewed by Darin Adler.
1152
1153         * stress/math-max-min-no-arguments.js: Added.
1154         (assert):
1155         (min):
1156         (max):
1157         (test):
1158
1159 2016-11-09  Saam Barati  <sbarati@apple.com>
1160
1161         TypeProfiler and running GC collection on another thread don't play nicely with each other
1162         https://bugs.webkit.org/show_bug.cgi?id=164441
1163         <rdar://problem/29132174>
1164
1165         Reviewed by Geoffrey Garen.
1166
1167         * typeProfiler/type-profiler-gc.js: Added.
1168         (bar):
1169         (foo):
1170
1171 2016-11-04  Mark Lam  <mark.lam@apple.com>
1172
1173         Error description code should be able to handle Symbol values.
1174         https://bugs.webkit.org/show_bug.cgi?id=164436
1175         <rdar://problem/29115583>
1176
1177         Reviewed by Filip Pizlo and Saam Barati.
1178
1179         * stress/error-description-on-symbols-should-not-crash.js: Added.
1180
1181 2016-11-03  Geoffrey Garen  <ggaren@apple.com>
1182
1183         EvalCodeCache should not give up in strict mode and other cases
1184         https://bugs.webkit.org/show_bug.cgi?id=164357
1185
1186         Reviewed by Michael Saboff.
1187
1188         * microbenchmarks/eval-cached.js: Added. 45x faster now.
1189         * stress/eval-cached.js: Added. Try running the same eval text in a bunch
1190         of different scopes and verify that we access the right scope.
1191
1192 2016-11-04  JF Bastien  <jfbastien@apple.com>
1193
1194         WebAssembly JS API: implement more sections
1195         https://bugs.webkit.org/show_bug.cgi?id=164023
1196
1197         Reviewed by Keith Miller.
1198
1199         On the JSC side:
1200
1201          - Put in parser stubs for all WebAssembly sections.
1202          - Parse Import, Export sections.
1203          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
1204          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
1205          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
1206          - parseCode: avoid overflow through function size.
1207          - Remove all remainders of polyfill-prototype-1, and update license.
1208          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
1209
1210         On the Builder.js testing side:
1211
1212          - Implement Type, Import (function only), Export (function only) sections.
1213          - Check section order and uniqueness.
1214          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
1215          - Allow re-exporting an import.
1216
1217         * wasm/Builder.js: build type, import, and export sections
1218         (const._normalizeFunctionSignature):
1219         * wasm/Builder_WebAssemblyBinary.js: Added. Forked from Builder.js
1220         (const.emitters.Type):
1221         (const.emitters.Import):
1222         (const.emitters.Function):
1223         (const.emitters.Table):
1224         (const.emitters.Memory):
1225         (const.emitters.Global):
1226         (const.emitters.Export):
1227         (const.emitters.Start):
1228         (const.emitters.Element):
1229         (const.emitters.Code):
1230         (const.emitters.Data):
1231         (export.const.Binary):
1232         * wasm/LowLevelBinary.js: Add a few useful outputs
1233         (export.default.LowLevelBinary.prototype.varuint1):
1234         (export.default.LowLevelBinary.prototype.varint7):
1235         * wasm/WASM.js: value type and external kind helpers
1236         * wasm/assert.js: array element-wise equality comparison
1237         (const._eq):
1238         * wasm/js-api/test_Module.js:
1239         (ModuleWithImports):
1240         * wasm/self-test/test_BuilderJSON.js: many more tests for all the new Builder APIs, and update to some older tests which now require a Type section or rejiggered Function signature
1241         (const.assertOpThrows):
1242         (SectionsWithSameCustomName):
1243         (TwoTypeSections):
1244         (EmptyImportSection):
1245         (ImportBeforeTypeSections):
1246         * wasm/self-test/test_BuilderWebAssembly.js: remove a test which wasn't helpful and is now obsolete
1247         (CustomSection):
1248
1249 2016-11-03  Mark Lam  <mark.lam@apple.com>
1250
1251         ClonedArguments need to also support haveABadTime mode.
1252         https://bugs.webkit.org/show_bug.cgi?id=164200
1253         <rdar://problem/27211336>
1254
1255         Reviewed by Geoffrey Garen.
1256
1257         * stress/have-a-bad-time-with-arguments.js: Added.
1258
1259 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1260
1261         DFG plays fast and loose with the shadow values of a Phi
1262         https://bugs.webkit.org/show_bug.cgi?id=164309
1263
1264         Reviewed by Saam Barati.
1265
1266         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1267
1268         * stress/dfg-ssa-swap.js: Added.
1269         (foo):
1270
1271 2016-11-03  Commit Queue  <commit-queue@webkit.org>
1272
1273         Unreviewed, rolling out r208364.
1274         https://bugs.webkit.org/show_bug.cgi?id=164402
1275
1276         broke the build (Requested by smfr on #webkit).
1277
1278         Reverted changeset:
1279
1280         "DFG plays fast and loose with the shadow values of a Phi"
1281         https://bugs.webkit.org/show_bug.cgi?id=164309
1282         http://trac.webkit.org/changeset/208364
1283
1284 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1285
1286         DFG plays fast and loose with the shadow values of a Phi
1287         https://bugs.webkit.org/show_bug.cgi?id=164309
1288
1289         Reviewed by Saam Barati.
1290
1291         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1292
1293         * stress/dfg-ssa-swap.js: Added.
1294         (foo):
1295
1296 2016-11-03  Saam Barati  <sbarati@apple.com>
1297
1298         Asking for a value profile prediction should be defensive against not finding a value profile
1299         https://bugs.webkit.org/show_bug.cgi?id=164306
1300
1301         Reviewed by Mark Lam.
1302
1303         * stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js: Added.
1304         (let.o.set foo):
1305         (bar):
1306
1307 2016-11-02  Saam Barati  <sbarati@apple.com>
1308
1309         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
1310         https://bugs.webkit.org/show_bug.cgi?id=164301
1311
1312         Reviewed by Geoffrey Garen.
1313
1314         * stress/rest-parameter-allocation-elimination-watchpoints-2.js: Added.
1315         (assert):
1316         (foo):
1317         * stress/rest-parameter-allocation-elimination-watchpoints-3.js: Added.
1318         (assert):
1319         (foo):
1320         * stress/rest-parameter-allocation-elimination-watchpoints-4.js: Added.
1321         (assert):
1322         (foo):
1323         * stress/rest-parameter-allocation-elimination-watchpoints-5.js: Added.
1324         (assert):
1325         (foo):
1326         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Added.
1327         (assert):
1328         (foo):
1329         * stress/rest-parameter-allocation-elimination-watchpoints.js: Added.
1330         (assert):
1331         (foo):
1332
1333 2016-11-01  Saam Barati  <sbarati@apple.com>
1334
1335         We should be able to eliminate rest parameter allocations
1336         https://bugs.webkit.org/show_bug.cgi?id=163925
1337
1338         Reviewed by Filip Pizlo.
1339
1340         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1341         (assert):
1342         (test1.bar):
1343         (test1):
1344         (test2.jaz):
1345         (test2.jaz2.kaz):
1346         (test2.jaz2):
1347         (test2):
1348         (test3.foo):
1349         (test3.baz):
1350         (test3.jaz):
1351         (test3):
1352         (test4.baz):
1353         (test4.jaz):
1354         (test4):
1355         (test5.baz):
1356         (test5.jaz):
1357         (test5):
1358         (test6.baz):
1359         (test6.jaz):
1360         (test6):
1361         (test7.baz):
1362         (test7.jaz):
1363         (test7.check):
1364         (test7):
1365         (test8.baz):
1366         (test8.jaz):
1367         (test8.check):
1368         (test8):
1369         (test9.baz):
1370         (test9.jaz):
1371         (test9.check):
1372         (test9):
1373         (test10.baz):
1374         (test10.jaz):
1375         (test10):
1376         (test11.bar):
1377         (test11.foo):
1378         (test11.makeArguments):
1379         (test11.):
1380         (test12):
1381         (test12.bar):
1382         (test12.foo):
1383         (test12.makeArguments):
1384         (test12.):
1385         (test13.bar):
1386         (test13.top):
1387         (test13.foo):
1388         (test13.makeArguments):
1389         (test13.):
1390         (test13):
1391         (test14.bar):
1392         (test14.top):
1393         (test14.foo):
1394         (test14.makeArguments):
1395         (test14.):
1396         (test14):
1397         (test15.bar):
1398         (test15.top):
1399         (test15.foo):
1400         (test15.makeArguments):
1401         (test15.):
1402         (test15):
1403
1404 2016-11-01  Commit Queue  <commit-queue@webkit.org>
1405
1406         Unreviewed, rolling out r208208 and r208210.
1407         https://bugs.webkit.org/show_bug.cgi?id=164276
1408
1409         This change caused 28 JSC test failures. (Requested by
1410         ryanhaddad on #webkit).
1411
1412         Reverted changesets:
1413
1414         "We should be able to eliminate rest parameter allocations"
1415         https://bugs.webkit.org/show_bug.cgi?id=163925
1416         http://trac.webkit.org/changeset/208208
1417
1418         "Fix the EFL build."
1419         http://trac.webkit.org/changeset/208210
1420
1421 2016-10-31  Filip Pizlo  <fpizlo@apple.com>
1422
1423         JSC should support SharedArrayBuffer
1424         https://bugs.webkit.org/show_bug.cgi?id=163986
1425
1426         Reviewed by Keith Miller.
1427
1428         This adds our own test for the various corner cases of SharedArrayBuffer. This test is meant to
1429         check all of the things that don't require concurrency.
1430
1431         * stress/SharedArrayBuffer.js: Added.
1432         (checkAtomics):
1433         (shouldFail):
1434         (Symbol):
1435         (runAtomic):
1436
1437 2016-10-31  Saam Barati  <sbarati@apple.com>
1438
1439         We should be able to eliminate rest parameter allocations
1440         https://bugs.webkit.org/show_bug.cgi?id=163925
1441
1442         Reviewed by Filip Pizlo.
1443
1444         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1445         (assert):
1446         (test1.bar):
1447         (test1):
1448         (test2.jaz):
1449         (test2.jaz2.kaz):
1450         (test2.jaz2):
1451         (test2):
1452         (test3.foo):
1453         (test3.baz):
1454         (test3.jaz):
1455         (test3):
1456         (test4.baz):
1457         (test4.jaz):
1458         (test4):
1459         (test5.baz):
1460         (test5.jaz):
1461         (test5):
1462         (test6.baz):
1463         (test6.jaz):
1464         (test6):
1465         (test7.baz):
1466         (test7.jaz):
1467         (test7.check):
1468         (test7):
1469         (test8.baz):
1470         (test8.jaz):
1471         (test8.check):
1472         (test8):
1473         (test9.baz):
1474         (test9.jaz):
1475         (test9.check):
1476         (test9):
1477         (test10.baz):
1478         (test10.jaz):
1479         (test10):
1480         (test11.bar):
1481         (test11.foo):
1482         (test11.makeArguments):
1483         (test11.):
1484         (test12):
1485         (test12.bar):
1486         (test12.foo):
1487         (test12.makeArguments):
1488         (test12.):
1489         (test13.bar):
1490         (test13.top):
1491         (test13.foo):
1492         (test13.makeArguments):
1493         (test13.):
1494         (test13):
1495         (test14.bar):
1496         (test14.top):
1497         (test14.foo):
1498         (test14.makeArguments):
1499         (test14.):
1500         (test14):
1501         (test15.bar):
1502         (test15.top):
1503         (test15.foo):
1504         (test15.makeArguments):
1505         (test15.):
1506         (test15):
1507
1508 2016-10-31  Saam Barati  <sbarati@apple.com>
1509
1510         Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing out
1511         https://bugs.webkit.org/show_bug.cgi?id=164227
1512
1513         Unreviewed timeout fix.
1514
1515         * microbenchmarks/pure-get-by-id-cse-2.js:
1516
1517 2016-10-31  Keith Miller  <keith_miller@apple.com>
1518
1519         autogenerated files from wasm.json should be in derived sources.
1520         https://bugs.webkit.org/show_bug.cgi?id=164152
1521
1522         Reviewed by Filip Pizlo.
1523
1524         Delete generation script since it is no longer used.
1525
1526         * wasm/generate-wasmops-header.js: Removed.
1527
1528 2016-10-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1529
1530         [JSC] JSON.stringify should handle Proxy which is non JSArray but isArray is true
1531         https://bugs.webkit.org/show_bug.cgi?id=164123
1532
1533         Reviewed by Mark Lam.
1534
1535         * stress/json-stringify-with-non-jsarray-array.js: Added.
1536         (shouldBe):
1537         (shouldBe.JSON.stringify.new.Proxy):
1538
1539 2016-10-29  Saam Barati  <sbarati@apple.com>
1540
1541         We should have a way of profiling when a get_by_id is pure and to emit a PureGetById in the DFG/FTL
1542         https://bugs.webkit.org/show_bug.cgi?id=163305
1543
1544         Reviewed by Keith Miller.
1545
1546         * microbenchmarks/pure-get-by-id-cse-2.js: Added.
1547         (foo):
1548         * microbenchmarks/pure-get-by-id-cse.js: Added.
1549         (foo):
1550         * stress/pure-get-by-id-cse-correctness.js: Added.
1551         (assert):
1552         (foo):
1553         * stress/pure-get-by-id-on-non-object.js: Added.
1554         (assert):
1555         (foo):
1556
1557 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1558
1559         Skip JSTests/microbenchmarks/dense-set.js on memory limited devices
1560         https://bugs.webkit.org/show_bug.cgi?id=164128
1561
1562         Reviewed by Mark Lam.
1563
1564         * microbenchmarks/dense-set.js:
1565
1566 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1567
1568         [JSC] implement runtime for async functions
1569         https://bugs.webkit.org/show_bug.cgi?id=163760
1570
1571         Reviewed by Yusuke Suzuki.
1572
1573         * stress/async-await-basic.js: Added.
1574         (shouldBe):
1575         (shouldBeAsync):
1576         (shouldThrow):
1577         (shouldThrowAsync):
1578         (shouldThrowSyntaxError):
1579         (let.AsyncFunction.async):
1580         (async.asyncFunctionForProto):
1581         (Object.getPrototypeOf.async):
1582         (Object.getPrototypeOf.async.method):
1583         (async):
1584         (async.method):
1585         (async.asyncNonConstructorDecl):
1586         (shouldThrow.new.async):
1587         (shouldThrow.new.async.nonConstructor):
1588         (async.asyncDecl):
1589         (async.f):
1590         (MyError):
1591         (async.asyncDeclThrower):
1592         (shouldThrowAsync.async):
1593         (resolveLater):
1594         (rejectLater):
1595         (async.resumeAfterNormal):
1596         (O.async.resumeAfterNormal):
1597         (resumeAfterNormalArrow.async):
1598         (async.resumeAfterThrow):
1599         (O.async.resumeAfterThrow):
1600         (resumeAfterThrowArrow.async):
1601         (catch):
1602         * stress/async-await-module-reserved-word.js: Added.
1603         (shouldThrow):
1604         (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
1605         (checkModuleSyntaxError.String.raw.await):
1606         (checkModuleSyntaxError.String.raw.async.await):
1607         (SyntaxError.Cannot.declare.named):
1608         * stress/async-await-mozilla.js: Added.
1609         (shouldBe):
1610         (shouldBeAsync):
1611         (shouldThrow):
1612         (shouldThrowAsync):
1613         (assert):
1614         (shouldThrowSyntaxError):
1615         (mozSemantics.async.empty):
1616         (mozSemantics.async.simpleReturn):
1617         (mozSemantics.async.simpleAwait):
1618         (mozSemantics.async.simpleAwaitAsync):
1619         (mozSemantics.async.returnOtherAsync):
1620         (mozSemantics.async.simpleThrower):
1621         (mozSemantics.async.delegatedThrower):
1622         (mozSemantics.async.tryCatch):
1623         (mozSemantics.async.tryCatchThrow):
1624         (mozSemantics.async.wellFinally):
1625         (mozSemantics.async.finallyMayFail):
1626         (mozSemantics.async.embedded.async.inner):
1627         (mozSemantics.async.embedded):
1628         (mozSemantics.async.fib):
1629         (mozSemantics.async.isOdd.async.isEven):
1630         (mozSemantics.async.isOdd):
1631         (mozSemantics.hardcoreFib.async.fib2):
1632         (mozSemantics.namedAsyncExpr.async.simple):
1633         (mozSemantics.async.executionOrder.async.first):
1634         (mozSemantics.async.executionOrder.async.second):
1635         (mozSemantics.async.executionOrder.async.third):
1636         (mozSemantics.async.executionOrder):
1637         (mozSemantics.async.miscellaneous):
1638         (mozSemantics.thrower):
1639         (mozSemantics.async.defaultArgs):
1640         (mozSemantics.shouldThrow):
1641         (mozSemantics):
1642         (mozMethods.X):
1643         (mozMethods.X.prototype.async.getValue):
1644         (mozMethods.X.prototype.setValue):
1645         (mozMethods.X.prototype.async.increment):
1646         (mozMethods.X.prototype.async.getBaseClassName):
1647         (mozMethods.X.async.getStaticValue):
1648         (mozMethods.Y.prototype.async.getBaseClassName):
1649         (mozMethods.Y):
1650         (mozFunctionNameInferrence.async.test):
1651         (mozSyntaxErrors):
1652         * stress/async-await-reserved-word.js: Added.
1653         (assert):
1654         (shouldThrowSyntaxError):
1655         (AsyncFunction.async):
1656         * stress/async_arrow_functions_lexical_arguments_binding.js: Added.
1657         (shouldBe):
1658         (shouldBeAsync):
1659         (shouldThrowAsync):
1660         (noArgumentsArrow2.async):
1661         * stress/async_arrow_functions_lexical_new.target_binding.js: Added.
1662         (shouldBe):
1663         (shouldBeAsync):
1664         (shouldThrowAsync):
1665         (C1):
1666         (C2):
1667         (shouldThrowAsync.async):
1668         * stress/async_arrow_functions_lexical_super_binding.js: Added.
1669         (shouldBe):
1670         (shouldBeAsync):
1671         (BaseClass.prototype.baseClassValue):
1672         (BaseClass.prototype.get property):
1673         (BaseClass):
1674         (ChildClass.prototype.asyncSuperProp):
1675         (ChildClass.prototype.asyncSuperProp2):
1676         (ChildClass):
1677         (ChildClass2):
1678         * stress/async_arrow_functions_lexical_this_binding.js: Added.
1679         (shouldBe):
1680         (shouldBeAsync):
1681         (d.y):
1682
1683 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1684
1685         Skip 2 JS stress tests on memory limited devices
1686         https://bugs.webkit.org/show_bug.cgi?id=164125
1687
1688         Unreviewed quick fix to unbreak JSCOnly ARM bots as soon as possible.
1689
1690         * stress/joined-strings-should-not-exceed-max-string-length.js:
1691         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1692
1693 2016-10-27  Caitlin Potter  <caitp@igalia.com>
1694
1695         [JSC] forbid lexical redeclaration of generator formal parameters
1696         https://bugs.webkit.org/show_bug.cgi?id=163930
1697
1698         Reviewed by Yusuke Suzuki.
1699
1700         * stress/async-await-syntax.js:
1701         * stress/generator-syntax.js:
1702         (testSyntaxError.gen):
1703         (testSyntaxError.arguments):
1704         (testSyntaxError.eval):
1705         * test262.yaml:
1706
1707 2016-10-26  JF Bastien  <jfbastien@apple.com>
1708
1709         WebAssembly API: implement Instance
1710
1711         As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-objects
1712
1713          - Take ownership of Wasm::Plan's compilation result when successfully creating a JSWebAssemblyModule object.
1714          - Construct a basic Instance with a Module.
1715          - Handle second argument (importObject) of WebAssembly.Instance.
1716          - Add reference text from the spec to WebAssembly.Module's code.
1717          - Expose and test an empty 'exports' ModuleNamespaceObject on WebAssembly.Instance.
1718
1719         The implementation isn't complete yet: it relies on further work for which I've filed bugs.
1720
1721         WebAssembly API: implement Instance
1722         https://bugs.webkit.org/show_bug.cgi?id=163998
1723
1724         Reviewed by Keith Miller.
1725
1726         * wasm/js-api/test_Instance.js: Added.
1727         (EmptyModule): use the Builder, create the simplest Module possible, and create an Instance from it
1728         * wasm/js-api/test_basic_api.js:
1729         (const.c.in.constructorProperties.switch): basic tests of the API
1730
1731 2016-10-26  Mark Lam  <mark.lam@apple.com>
1732
1733         JSGenericTypedArrayView::set() should check for exceptions.
1734         https://bugs.webkit.org/show_bug.cgi?id=164007
1735         <rdar://problem/28853775>
1736
1737         Reviewed by Filip Pizlo.
1738
1739         * stress/typed-array-view-set-should-not-crash-on-exception.js: Added.
1740
1741 2016-10-25  Mark Lam  <mark.lam@apple.com>
1742
1743         String.prototype.replace() should throw an OutOfMemoryError when using too much memory.
1744         https://bugs.webkit.org/show_bug.cgi?id=163996
1745         <rdar://problem/28263117>
1746
1747         Reviewed by Geoffrey Garen.
1748
1749         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: Added.
1750
1751 2016-10-25  Mark Lam  <mark.lam@apple.com>
1752
1753         JSStringJoiner::joinedLength() should limit joined string lengths to INT_MAX.
1754         https://bugs.webkit.org/show_bug.cgi?id=163937
1755         <rdar://problem/28642990>
1756
1757         Reviewed by Geoffrey Garen.
1758
1759         * stress/joined-strings-should-not-exceed-max-string-length.js: Added.
1760
1761 2016-10-25  JF Bastien  <jfbastien@apple.com>
1762
1763         WebAssembly JS API: simple Module test
1764         https://bugs.webkit.org/show_bug.cgi?id=163963
1765
1766         Reviewed by Filip Pizlo.
1767
1768         * wasm/LowLevelBinary.js:
1769         (export.default.LowLevelBinary.prototype.get return): get the ArrayBuffer
1770         (export.default.LowLevelBinary.prototype.hexdump): Deleted.
1771         (export.default.LowLevelBinary.prototype._maybeGrow): Deleted.
1772         * wasm/js-api/test_Module.js: Added.
1773         (EmptyModule): The most basic module possible
1774
1775 2016-10-25  JF Bastien  <jfbastien@apple.com>
1776
1777         WebAssembly JS API: implement Module
1778
1779         This implementation allows us to:
1780          - Syncrhonously create a WebAssembly.Module with a typed array.
1781          - Creates a compilation plan.
1782          - Parse the Module and creates corresponding code.
1783          - Throw WebAssembly.CompileError with mildly helpful [*] error messages on
1784            failure.
1785
1786         Consult the API documentation for expected behavior: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodule-constructor
1787
1788         For now the implementation discards the generated code.
1789
1790         The next steps will be:
1791          - Expose a Module's exports.
1792          - Implement WebAssembly.Instance, which allows instantiating and running a
1793            compiled Module.
1794          - Beef up the testing infrastructure under JSTests/wasm so that more complex
1795            modules can be created and tested (instead of writing the bits by hand).
1796
1797         This patch also:
1798          - Adds assert.instanceof in assert.js.
1799          - Refactors Wasm::Parser and friends to accept const uint8_t* as well as a
1800            Vector, to avoid copying when invoked synchronously.
1801          - Remove useless Structure from some of the wasm constructors: they're already
1802            on the JSGlobalObject, visited properly and all.
1803          - Fix off-by-one error in parsing: Parser::parseUInt32 failed if the integer
1804            was exactly at end of file.
1805
1806          [*] On error messages while parsing: I filed https://bugs.webkit.org/show_bug.cgi?id=163919
1807
1808         WebAssembly JS API: implement Module
1809         https://bugs.webkit.org/show_bug.cgi?id=163903
1810
1811         Reviewed by Keith Miller.
1812
1813         * wasm/assert.js: use underscore in name, and remove when exporting to avoid clasing with builtin names
1814         (const._notUndef):
1815         (const._isUndef):
1816         (const._eq):
1817         (const._ge):
1818         (const._throws):
1819         * wasm/js-api/test_basic_api.js: test the WebAssembly.Module API
1820         (const.c.in.constructorProperties.switch):
1821
1822 2016-10-25  Keith Miller  <keith_miller@apple.com>
1823
1824         Add trivial Wasm conversion opcodes
1825         https://bugs.webkit.org/show_bug.cgi?id=163950
1826
1827         Reviewed by Filip Pizlo.
1828
1829         This patch differentiates between Wasm opcodes that are trivially mapped to a B3 opcode and
1830         those that are not.  Some of the Wasm opcodes that are currently a non-simple opcode will
1831         become simple as we add B3 opcodes for Wasm operations.  The remaining opcodes will need to
1832         be added via patchpoints in a later patch.
1833
1834         * wasm/generate-wasmops-header.js:
1835         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.Wasm.inline.bool.isSimple):
1836         * wasm/wasm.json:
1837
1838 2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1839
1840         Arrow functions with concise bodies cannot return regular expressions
1841         https://bugs.webkit.org/show_bug.cgi?id=163162
1842
1843         Reviewed by Filip Pizlo.
1844
1845         * ChakraCore/test/Operators/instanceof.baseline-jsc:
1846         * ChakraCore/test/Regex/nul_character.baseline-jsc:
1847         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
1848         * stress/parse-regexp-as-token.js: Added.
1849         (shouldBe):
1850
1851 2016-10-24  Keith Miller  <keith_miller@apple.com>
1852
1853         Wasm should support floating point operations.
1854         https://bugs.webkit.org/show_bug.cgi?id=163770
1855
1856         Reviewed by Michael Saboff.
1857
1858         Add appropriate b3op names for floating point wasm bytecodes, where they exist.
1859         Also, fix some WASM => Wasm in WasmOps.h generator script that I missed
1860         the first time I made the change.
1861
1862         * wasm/generate-wasmops-header.js:
1863         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.template.typename.Int.inline.bool.isValidOpType): Deleted.
1864         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.BinaryOpType): Deleted.
1865         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.UnaryOpType): Deleted.
1866         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType): Deleted.
1867         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType): Deleted.
1868         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.undef.CREATE_ENUM_VALUE.inline.bool.isControlOp): Deleted.
1869         * wasm/wasm.json:
1870
1871 2016-10-21  Saam Barati  <sbarati@apple.com>
1872
1873         SpeculativeJIT::compileTryGetById needs to pass in NeedsToSpill along both the cell speculation and untyped speculation path
1874         https://bugs.webkit.org/show_bug.cgi?id=163622
1875
1876         Reviewed by Yusuke Suzuki.
1877
1878         * stress/try-get-by-id-should-spill-registers-dfg.js: Added.
1879         (let.f.createBuiltin):
1880
1881 2016-10-21  Caitlin Potter  <caitp@igalia.com>
1882
1883         [JSC] don't crash when arguments to `new Function()` produce unexpected AST
1884         https://bugs.webkit.org/show_bug.cgi?id=163748
1885
1886         Reviewed by Mark Lam.
1887
1888         * stress/regress-163748.js: Added.
1889         (assert):
1890         (shouldThrowSyntaxError):
1891         (GeneratorFunction):
1892
1893 2016-10-20  Keith Miller  <keith_miller@apple.com>
1894
1895         Add support for WASM calls
1896         https://bugs.webkit.org/show_bug.cgi?id=161727
1897
1898         Reviewed by Filip Pizlo and Michael Saboff.
1899
1900         Add members of the Call category to the WASMOps special group.
1901
1902         * wasm/generate-wasmops-header.js:
1903
1904 2016-10-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1905
1906         [JSC] Drop isEnvironmentRecord type info flag and use JSType information instead
1907         https://bugs.webkit.org/show_bug.cgi?id=163761
1908
1909         Reviewed by Keith Miller.
1910
1911         * modules/string-prototype-module-scope.js: Added.
1912         (shouldBe):
1913         (catch):
1914         (refer):
1915         * stress/string-prototype-scopes-global-lexical-environment-strict.js: Added.
1916         (shouldBe):
1917         (catch):
1918         * stress/string-prototype-scopes-global-lexical-environment.js: Added.
1919         (shouldBe):
1920         (catch):
1921         * stress/string-prototype-scopes-strict.js: Added.
1922         (shouldBe):
1923         (catch):
1924         (try.refer):
1925         (refer):
1926         * stress/string-prototype-scopes.js: Added.
1927         (shouldBe):
1928         (catch):
1929         (try.refer):
1930         (refer):
1931         (object.toString):
1932         (with):
1933
1934 2016-10-20  JF Bastien  <jfbastien@apple.com>
1935
1936         WebAssembly API: implement exception constructors properly
1937
1938          - Rename WebAssemblyObject to JSWebAssembly for consistency.
1939          - WebAssembly object now has its own prototype: add WebAssemblyPrototype, and
1940            use it to register JSWebAssembly's function properties through auto-generated
1941            .lut.h, instead of manually.
1942          - The error constructors used to throw (e.g. `new WebAssembly.CompileError()`).
1943          - Register WebAssembly's constructors from the global object, and hold a
1944            reference to their structure and prototype so that invoking the constructor
1945            can use the structure directly from the global object.
1946          - Add a prototype base field to global object creation. Previous ones all had
1947            Object's prototype as their base, but WebAssembly's error constructors have
1948            Error as their base.
1949          - Test for the error object's correctness.
1950          - Add missing #if ENABLE(WEBASSEMBLY)
1951
1952         WebAssembly API: implement exception constructors properly
1953         https://bugs.webkit.org/show_bug.cgi?id=163699
1954
1955         Reviewed by Keith Miller.
1956
1957         * wasm/js-api/test_basic_api.js:
1958         (const.c.in.constructorProperties): more tests
1959
1960 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1961
1962         [JSC] disallow references to `await` in AsyncFunction formal parameters
1963         https://bugs.webkit.org/show_bug.cgi?id=163694
1964
1965         Reviewed by Saam Barati.
1966
1967         * stress/async-await-syntax.js:
1968
1969 2016-10-20  Keith Miller  <keith_miller@apple.com>
1970
1971         Invalid assertion in arguments elimination
1972         https://bugs.webkit.org/show_bug.cgi?id=163740
1973         <rdar://problem/27911462>
1974
1975         Reviewed by Michael Saboff.
1976
1977         * stress/direct-arguments-osr-entry.js: Added.
1978         (foo.):
1979         (foo):
1980
1981 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1982
1983         [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
1984         https://bugs.webkit.org/show_bug.cgi?id=163714
1985
1986         Reviewed by Mark Lam.
1987
1988         Add missing test coverage that dynamically created
1989         JSGeneratorFunctions can not be constructed.
1990
1991         * stress/generator-function-constructor.js:
1992         (shouldThrow):
1993
1994 2016-10-19  JF Bastien  <jfbastien@apple.com>
1995
1996         JavaScript WebAssembly API: baby steps
1997
1998          - Expand WebAssembly constructors into their own files. This requires a lot of
1999            boilerplate, as well as adding the .lut.h files. All of the
2000            JSWebAssembly*.{h,cpp}, as well as Constructor and Prototype files, are
2001            currently the same between the 4 specified WebAssembly constructors. It'll be
2002            easy to implement individual functions on constructed objects as per the
2003            spec, and have each of these files diverge. The error constructors are also
2004            similar, except that their instance derives from ErrorInstance.
2005          - Use constructor macro when initializing the global object.
2006          - Dramatically improve testing of the WebAssembly API by checking for
2007            properties specified in the spec [*].
2008          - Clean up assert.js' exception testing.
2009          - Fix a copy-paste bug in wasm.json: floating-point const return values were
2010            swapped.
2011
2012         [*] https://github.com/WebAssembly/design/blob/master/JS.md
2013
2014         Implement more of the JavaScript WebAssembly API
2015         https://bugs.webkit.org/show_bug.cgi?id=163571
2016
2017         Reviewed by Keith Miller.
2018
2019         * wasm/assert.js:
2020         (export.const.isUndef): add this useful helper
2021         (export.const.throws): fold other throw checks into this one, and check message as well
2022         * wasm/js-api/test_basic_api.js:
2023         (const.checkOwnPropertyDescriptor): check own property descriptor follows the spec
2024         * wasm/self-test/test_BuilderJSON.js:
2025         (const.assertOpThrows): use new assert API
2026         (CheckedOpcodeArgumentsTooMany): ditto
2027         (CheckedOpcodeArgumentsNotEnough): ditto
2028         (CallInvalid): ditto
2029         (I32ConstInvalid): ditto
2030         (F32ConstInvalid): ditto (and this caugth the JSON copy-paste bug)
2031         (F64ConstInvalid): ditto
2032         * wasm/self-test/test_LowLevelBinary_varint.js: use new assert API
2033         * wasm/self-test/test_LowLevelBinary_varuint.js: use new assert API
2034         * wasm/utilities.js: add "global" object, used in basic API test (to access global.WebAssembly).
2035         * wasm/wasm.json: fix copy-paste
2036
2037 2016-10-19  Caitlin Potter  <caitp@igalia.com>
2038
2039         [JSC] forbid "use strict" directive in generator functions with non-simple parameters
2040         https://bugs.webkit.org/show_bug.cgi?id=163683
2041
2042         Reviewed by Geoffrey Garen.
2043
2044         Update various generator*-non-simple-param.js tests to be passing.
2045
2046         * test262.yaml:
2047
2048 2016-10-18  Mark Lam  <mark.lam@apple.com>
2049
2050         Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
2051         https://bugs.webkit.org/show_bug.cgi?id=154377
2052         <rdar://problem/27330808>
2053
2054         Reviewed by Filip Pizlo and Saam Barati.
2055
2056         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.
2057
2058 2016-10-18  Keith Miller  <keith_miller@apple.com>
2059
2060         GetByVal to GetById conversion in the DFG is incorrect for getters with control flow
2061         https://bugs.webkit.org/show_bug.cgi?id=163629
2062
2063         Reviewed by Yusuke Suzuki.
2064
2065         * stress/get-by-val-to-id-with-getter.js: Added.
2066         (foo):
2067         (o.get hello):
2068
2069 2016-10-15  Filip Pizlo  <fpizlo@apple.com>
2070
2071         DFG and FTL should be able to use DirectCall ICs when they proved the callee or its executable
2072         https://bugs.webkit.org/show_bug.cgi?id=163371
2073
2074         Reviewed by Geoffrey Garen and Saam Barati.
2075
2076         Add microbenchmarks for all of the cases that this patch optimizes.
2077
2078         * microbenchmarks/direct-call-arity-mismatch.js: Added.
2079         (foo):
2080         (bar):
2081         * microbenchmarks/direct-call.js: Added.
2082         (foo):
2083         (bar):
2084         * microbenchmarks/direct-construct-arity-mismatch.js: Added.
2085         (Foo):
2086         (bar):
2087         * microbenchmarks/direct-construct.js: Added.
2088         (Foo):
2089         (bar):
2090         * microbenchmarks/direct-tail-call-arity-mismatch.js: Added.
2091         (foo):
2092         (bar):
2093         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js: Added.
2094         (foo):
2095         (bar):
2096         (baz):
2097         * microbenchmarks/direct-tail-call-inlined-caller.js: Added.
2098         (foo):
2099         (bar):
2100         (baz):
2101         * microbenchmarks/direct-tail-call.js: Added.
2102         (foo):
2103         (bar):
2104
2105 2016-10-18  Caitlin Potter  <caitp@igalia.com>
2106
2107         [JSC] ES6 Method functions should not have prototype
2108         https://bugs.webkit.org/show_bug.cgi?id=162530
2109
2110         Reviewed by Saam Barati.
2111
2112         Fix test262 expectations about MethodDefinitions
2113
2114         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
2115         * stress/reflect-set.js:
2116         * test262.yaml:
2117
2118 2016-10-17  Keith Miller  <keith_miller@apple.com>
2119
2120         Add support for WASM Memory.
2121         https://bugs.webkit.org/show_bug.cgi?id=161710
2122
2123         Reviewed by Geoffrey Garen.
2124
2125         Add store and load opcodes to wasm.json. Additionally, add new
2126         enums for those opcodes in the generator.
2127
2128         * stress/wasm/generate-wasmops-header.js:
2129         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType):
2130         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType):
2131
2132 2016-10-17  Saam Barati  <sbarati@apple.com>
2133
2134         Add more tests for the double->String conversion in ValueAdd constant folding
2135         https://bugs.webkit.org/show_bug.cgi?id=163517
2136
2137         Reviewed by Yusuke Suzuki.
2138
2139         * microbenchmarks/string-add-constant-folding.js:
2140         (test):
2141
2142 2016-10-17  JF Bastien  <jfbastien@apple.com>
2143
2144         WebAssembly JS API: implement basic stub
2145
2146         Implement the global WebAssembly JavaScript object, and its constructor +
2147         function properties as described in:
2148           https://github.com/WebAssembly/design/blob/master/JS.md
2149
2150         These don't do anything at the moment, the parent bug will take care of adding
2151         more functionality and associated tests.
2152
2153         WebAssembly JS API: implement basic stub
2154         https://bugs.webkit.org/show_bug.cgi?id=163404
2155
2156         Reviewed by Keith Miller.
2157
2158         * wasm.yaml:
2159         * wasm/js-api/test_basic_api.js: Added.
2160         (const.f.of.functionProperties.WebAssembly.f.undefined.throw.new.Error.Couldn.const.c.of.constructorProperties.WebAssembly.c.undefined.throw.new.Error.Couldn):
2161         (const.c.of.constructorProperties.catch):
2162
2163 2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2164
2165         [DOMJIT] Use DOMJIT::Patchpoint in IC
2166         https://bugs.webkit.org/show_bug.cgi?id=163223
2167
2168         Reviewed by Saam Barati.
2169
2170         * stress/domjit-exception-ic.js: Added.
2171         (shouldBe):
2172         (access):
2173         * stress/domjit-exception.js: Added.
2174         (shouldBe):
2175         (access):
2176         * stress/domjit-getter-complex-with-incorrect-object.js: Added.
2177         (shouldThrow):
2178         (access):
2179         (i.shouldThrow):
2180         * stress/domjit-getter-complex.js: Added.
2181         (shouldBe):
2182         (access):
2183         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js: Added.
2184         (assert):
2185         (bar):
2186         (foo):
2187
2188 2016-10-15  Saam Barati  <sbarati@apple.com>
2189
2190         Assertion failed under operationToLowerCase with a rope with zero length
2191         https://bugs.webkit.org/show_bug.cgi?id=163314
2192
2193         Reviewed by Mark Lam.
2194
2195         * stress/to-lower-case-intrinsic-on-empty-rope.js: Added.
2196         (assert):
2197         (returnRope.helper):
2198         (returnRope):
2199         (lower):
2200
2201 2016-10-14  Benjamin Poulain  <bpoulain@apple.com>
2202
2203         [JSC] op_negate should with any type
2204         https://bugs.webkit.org/show_bug.cgi?id=162587
2205
2206         Reviewed by Saam Barati.
2207
2208         * stress/arith-abs-to-arith-negate-range-optimizaton.js: Added.
2209         Cover OSR Exits when converting Math.abs() into ArithNegate.
2210
2211         * stress/arith-negate-on-various-types.js: Added.
2212         Cover ArithNegate with all types.
2213
2214 2016-10-14  JF Bastien  <jfbastien@apple.com>
2215
2216         Basic WebAssembly testing
2217
2218         Create a small DSL in JavaScript which can build WebAssembly binary modules based on the JSON description of the format as described in:
2219         https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md
2220
2221         This DSL can then be used to write small text description of valid and invalid WebAssembly binaries, making testing the JSC implementation much easier.
2222
2223         Details and example in README.md.
2224
2225         Basic WebAssembly testing
2226         https://bugs.webkit.org/show_bug.cgi?id=163267
2227
2228         Reviewed by Keith Miller.
2229
2230         * stress/wasm/wasm.json: Removed.
2231         * wasm.yaml: Added.
2232         * wasm/Builder.js: Added.
2233         (const._isValidValue):
2234         (const._BuildWebAssemblyBinary):
2235         (export.default.Builder):
2236         (export.default.Builder.prototype.setChecked):
2237         (export.default.Builder.prototype.setPreamble):
2238         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2239         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
2240         (export.default.Builder.prototype._registerSectionBuilders):
2241         (export.default.Builder.prototype._addSection):
2242         (export.default.Builder.prototype.optimize):
2243         (export.default.Builder.prototype.json):
2244         (export.default.Builder.prototype.AsmJS):
2245         (export.default.Builder.prototype.WebAssembly):
2246         * wasm/LowLevelBinary.js: Added.
2247         (const._getterRangeCheck):
2248         (const._hexdump):
2249         (export.default.LowLevelBinary):
2250         (export.default.LowLevelBinary.prototype.newPatchable):
2251         (export.default.LowLevelBinary.prototype.hexdump):
2252         (export.default.LowLevelBinary.prototype._maybeGrow):
2253         (export.default.LowLevelBinary.prototype._push8):
2254         (export.default.LowLevelBinary.prototype.uint8):
2255         (export.default.LowLevelBinary.prototype.uint16):
2256         (export.default.LowLevelBinary.prototype.uint32):
2257         (export.default.LowLevelBinary.prototype.varuint):
2258         (export.default.LowLevelBinary.prototype.varint):
2259         (export.default.LowLevelBinary.prototype.varuint7):
2260         (export.default.LowLevelBinary.prototype.string):
2261         (export.default.LowLevelBinary.prototype.getSize):
2262         (export.default.LowLevelBinary.prototype.getUint8):
2263         (export.default.LowLevelBinary.prototype.getUint16):
2264         (export.default.LowLevelBinary.prototype.getUint32):
2265         (export.default.LowLevelBinary.prototype.getVaruint):
2266         (export.default.LowLevelBinary.prototype.getVarint):
2267         (export.default.LowLevelBinary.prototype.getVaruint7):
2268         (export.default.LowLevelBinary.prototype.getString):
2269         (PatchableLowLevelBinary):
2270         (PatchableLowLevelBinary.prototype._push8):
2271         (PatchableLowLevelBinary.prototype.apply):
2272         * wasm/README.md: Added.
2273         * wasm/WASM.js: Added.
2274         * wasm/assert.js: Added.
2275         (export.const.notUndef):
2276         (export.const.eq):
2277         (export.const.ge):
2278         (export.const.throwsError):
2279         (export.const.throwsRangeError):
2280         * wasm/generate-wasmops-header.js: Renamed from JSTests/stress/wasm/generate-wasmops-header.js.
2281         * wasm/self-test/test_BuilderJSON.js: Added.
2282         (const.assertOpThrows):
2283         (EmptyModule):
2284         (CustomMagicNumber):
2285         (CustomVersion):
2286         (CustomSection):
2287         (CustomSectionAllBytes):
2288         (CustomSectionInvalidByte):
2289         (TwoCustomSections):
2290         (EmptyCodeSection):
2291         (CodeSectionWithEmptyFunction):
2292         (CodeSectionWithEmptyFunctionWithParameters):
2293         (InvalidFunctionParameters):
2294         (SimpleFunction):
2295         (TwoSimpleFunctions):
2296         (TwoBuildersAtTheSameTime):
2297         (CheckedOpcodeArgumentsTooMany):
2298         (CheckedOpcodeArgumentsNotEnough):
2299         (CallNoArguments):
2300         (CallInvalid):
2301         (I32ConstInvalid):
2302         (F32ConstInvalid):
2303         (F64ConstInvalid):
2304         (CallManyFromStack):
2305         (OpcodeAdd):
2306         (OpcodeUnreachable):
2307         (OpcodeUnreachableCombinations):
2308         (OpcodeSelect):
2309         * wasm/self-test/test_BuilderWebAssembly.js: Added.
2310         (EmptyModule):
2311         (CustomSection):
2312         (Basic):
2313         * wasm/self-test/test_LowLevelBinary_encode.js: Added.
2314         * wasm/self-test/test_LowLevelBinary_string.js: Added.
2315         * wasm/self-test/test_LowLevelBinary_uint16.js: Added.
2316         * wasm/self-test/test_LowLevelBinary_uint32.js: Added.
2317         * wasm/self-test/test_LowLevelBinary_uint8.js: Added.
2318         * wasm/self-test/test_LowLevelBinary_varint.js: Added.
2319         * wasm/self-test/test_LowLevelBinary_varuint.js: Added.
2320         * wasm/self-test/test_LowLevelBinary_varuint7.js: Added.
2321         * wasm/self-test/test_WASM.js: Added.
2322         * wasm/test.sh: Added.
2323         * wasm/utilities.js: Added.
2324         (const._read.filename.switch):
2325         (const._load.filename.switch):
2326         (const._json.filename.switch):
2327         * wasm/wasm.json: Added.
2328
2329 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2330
2331         test262: @isConstructor incorrectly thinks Math.cos is a constructor
2332         https://bugs.webkit.org/show_bug.cgi?id=163437
2333
2334         Reviewed by Saam Barati.
2335
2336         * stress/is-constructor.js: Added.
2337         (assert):
2338         (prototype.assert):
2339         New test to cover the @isConstructor builtin.
2340
2341         * test262.yaml:
2342         Test now passes.
2343
2344 2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
2345
2346         Unreviewed, rolling out r207322.
2347
2348         This change caused JSC test failures
2349
2350         Reverted changeset:
2351
2352         "Fix Array.prototype.splice ES6 compliance."
2353         https://bugs.webkit.org/show_bug.cgi?id=163372
2354         http://trac.webkit.org/changeset/207322
2355
2356 2016-10-14  Mark Lam  <mark.lam@apple.com>
2357
2358         JSON.parse should not modify frozen objects.
2359         https://bugs.webkit.org/show_bug.cgi?id=163430
2360
2361         Reviewed by Saam Barati.
2362
2363         * stress/json-parse-on-frozen-object.js: Added.
2364
2365 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2366
2367         test262: Failure with RegExp.prototype.compile when pattern is undefined
2368         https://bugs.webkit.org/show_bug.cgi?id=163431
2369
2370         Reviewed by Yusuke Suzuki.
2371
2372         * test262.yaml:
2373
2374 2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
2375
2376         Exception message for expressions with multiple bracket accesses is inconsistent / incorrect
2377         https://bugs.webkit.org/show_bug.cgi?id=163426
2378
2379         Reviewed by Geoffrey Garen.
2380
2381         * ChakraCore/test/Error/CallNonFunction_3.baseline-jsc:
2382         * ChakraCore/test/Object/null.baseline-jsc:
2383         * stress/exception-in-to-property-key-should-be-handled-early.js:
2384         Better exception messages.
2385
2386 2016-10-13  Mark Lam  <mark.lam@apple.com>
2387
2388         Fix Array.prototype.splice ES6 compliance.
2389         https://bugs.webkit.org/show_bug.cgi?id=163372
2390
2391         Reviewed by Geoffrey Garen and Yusuke Suzuki.
2392
2393         * stress/array-splice-on-frozen-object.js: Added.
2394
2395 2016-10-12  Keith Miller  <keith_miller@apple.com>
2396
2397         Handle non-function, non-undefined comparator in Array.prototype.sort
2398         https://bugs.webkit.org/show_bug.cgi?id=163085
2399
2400         Reviewed by Yusuke Suzuki.
2401
2402         * ChakraCore/test/Array/array_sort.baseline-jsc:
2403         * stress/array-sort-bad-comparator.js: Added.
2404         (test):
2405
2406 2016-10-12  Mark Lam  <mark.lam@apple.com>
2407
2408         Array.prototype.slice should not modify frozen objects.
2409         https://bugs.webkit.org/show_bug.cgi?id=163338
2410
2411         Reviewed by Filip Pizlo.
2412
2413         * stress/array-slice-on-frozen-object.js: Added.
2414
2415 2016-10-11  Mark Lam  <mark.lam@apple.com>
2416
2417         Array.prototype.concat should not modify frozen objects.
2418         https://bugs.webkit.org/show_bug.cgi?id=163302
2419
2420         Reviewed by Filip Pizlo.
2421
2422         * stress/array-concat-on-frozen-object.js: Added.
2423
2424 2016-10-11  Saam Barati  <sbarati@apple.com>
2425
2426         ValueAdd should be constant folded if the operands are constant String,Primitive or Primitive,String
2427         https://bugs.webkit.org/show_bug.cgi?id=163182
2428
2429         Reviewed by Filip Pizlo.
2430
2431         * microbenchmarks/string-add-constant-folding.js: Added.
2432         (assert):
2433         (runTests):
2434         (add):
2435         (test):
2436
2437 2016-10-07  Mark Lam  <mark.lam@apple.com>
2438
2439         Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
2440         https://bugs.webkit.org/show_bug.cgi?id=163160
2441
2442         Reviewed by Saam Barati.
2443
2444         * stress/object-freeze-with-proxy-preventExtensions.js: Added.
2445         * stress/object-seal-with-proxy-preventExtensions.js: Added.
2446
2447 2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2448
2449         [DOMJIT] Add initial CheckDOM and CallDOM implementations
2450         https://bugs.webkit.org/show_bug.cgi?id=162941
2451
2452         Reviewed by Filip Pizlo.
2453
2454         * stress/domjit-getter-poly.js: Added.
2455         (shouldBe):
2456         (access):
2457         * stress/domjit-getter-proto.js: Added.
2458         (shouldBe):
2459         (access):
2460         * stress/domjit-getter-super-poly.js: Added.
2461         (shouldBe):
2462         (access):
2463         * stress/domjit-getter.js: Added.
2464         (shouldBe):
2465         (access):
2466
2467 2016-10-04  Saam Barati  <sbarati@apple.com>
2468
2469         String.prototype.toLowerCase should be a DFG/FTL intrinsic
2470         https://bugs.webkit.org/show_bug.cgi?id=162887
2471
2472         Reviewed by Filip Pizlo and Yusuke Suzuki.
2473
2474         * microbenchmarks/to-lower-case.js: Added.
2475         (assert):
2476         (foo):
2477         (bar):
2478         * stress/to-lower-case.js: Added.
2479         (assert):
2480         (foo):
2481
2482 2016-10-04  JF Bastien  <jfbastien@apple.com>
2483
2484         WebAssembly: handle a few corner cases
2485         https://bugs.webkit.org/show_bug.cgi?id=162884
2486
2487         Reviewed by Keith Miller.
2488
2489         * stress/wasm/generate-wasmops-header.js:
2490         (const.opcodeIterator): max opcode value
2491
2492 2016-10-03  JF Bastien  <jfbastien@apple.com>
2493
2494         Auto-generate WASMOps.h, share with testing JSON file
2495         https://bugs.webkit.org/show_bug.cgi?id=162870
2496
2497         Reviewed by Keith Miller.
2498
2499         * stress/wasm/to-c++.js: Added. Generates WASMOps.h, siilar to the current one but with more data.
2500         (const.opcode_iterator):
2501         (opcode_macroizer):
2502         * stress/wasm/wasm.json: Added. Data from 0xC binary format version.
2503
2504 2016-10-03  Saam Barati  <sbarati@apple.com>
2505
2506         MapHash should speculate on the type of its child node
2507         https://bugs.webkit.org/show_bug.cgi?id=161922
2508
2509         Reviewed by Filip Pizlo.
2510
2511         * microbenchmarks/map-key-well-typed.js: Added.
2512         (assert):
2513         (intKey):
2514         (doubleKey):
2515         (objectKey):
2516         (stringKey):
2517         (booleanKey):
2518         (symbolKey):
2519         (cellKey):
2520         (assert.doubleKey):
2521         (assert.booleanKey):
2522
2523 2016-10-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2524
2525         [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
2526         https://bugs.webkit.org/show_bug.cgi?id=162849
2527
2528         Reviewed by Geoffrey Garen.
2529
2530         * test262.yaml:
2531
2532 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2533
2534         [ES6] Align attributes of Generator related properties to spec
2535         https://bugs.webkit.org/show_bug.cgi?id=162839
2536
2537         Reviewed by Saam Barati.
2538
2539         * test262.yaml:
2540
2541 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2542
2543         [ES6] GeneratorFunction constructor should instantiate generator function
2544         https://bugs.webkit.org/show_bug.cgi?id=162838
2545
2546         Reviewed by Saam Barati.
2547
2548         * stress/generator-function-constructor-is-subclassible.js: Added.
2549         (shouldBe):
2550         (GeneratorFunction):
2551         (prototype.hello):
2552         * stress/generator-function-constructor.js:
2553         * test262.yaml:
2554
2555 2016-09-30  Saam Barati  <sbarati@apple.com>
2556
2557         Arrow functions should not allow duplicate parameter names
2558         https://bugs.webkit.org/show_bug.cgi?id=162741
2559
2560         Reviewed by Filip Pizlo.
2561
2562         * test262.yaml:
2563
2564 2016-09-30  Saam Barati  <sbarati@apple.com>
2565
2566         Make some microbenchmarks run for less time.
2567
2568         Rubber stamped by Filip Pizlo.
2569
2570         * microbenchmarks/bound-function-construction-performance.js:
2571         (foo):
2572         * microbenchmarks/getter-richards-try-catch.js:
2573
2574 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2575
2576         Arrow functions do not infer name from computed property but normal functions do
2577         https://bugs.webkit.org/show_bug.cgi?id=162720
2578
2579         Reviewed by Saam Barati.
2580
2581         * stress/inferred-names.js:
2582
2583 2016-09-29  Mark Lam  <mark.lam@apple.com>
2584
2585         Break some slow running tests into smaller bits so they don't time out.
2586         https://bugs.webkit.org/show_bug.cgi?id=162743
2587
2588         Reviewed by Keith Miller.
2589
2590         The following tests have shown to be slow running:
2591             op_div.js
2592             op_lshift.js
2593             op_mod.js
2594             op_mul.js
2595             op_rshift.js
2596             op_sub.js
2597             op_urshift
2598
2599         These tests auto-generate permutations of values to apply to binary operations.
2600         They also test the operations with 3 permutations of value types:
2601             1. VarVar - both operands variables
2602             2. VarConst - variable operand 1, constant / literal operand 2
2603             3. ConstVar - constant / literal operand 1, variable operand 2
2604
2605         We can prevent these tests from timing out by breaking each up to only run 1 of
2606         the 3 permutations of value types.
2607
2608         * stress/op_div-ConstVar.js: Added.
2609         * stress/op_div-VarConst.js: Added.
2610         * stress/op_div-VarVar.js: Copied from JSTests/stress/op_div.js.
2611         (o1.valueOf): Deleted.
2612         * stress/op_div.js: Removed.
2613         * stress/op_lshift-ConstVar.js: Added.
2614         * stress/op_lshift-VarConst.js: Added.
2615         * stress/op_lshift-VarVar.js: Copied from JSTests/stress/op_lshift.js.
2616         (o1.valueOf): Deleted.
2617         * stress/op_lshift.js: Removed.
2618         * stress/op_mod-ConstVar.js: Added.
2619         * stress/op_mod-VarConst.js: Added.
2620         * stress/op_mod-VarVar.js: Copied from JSTests/stress/op_mod.js.
2621         (o1.valueOf): Deleted.
2622         * stress/op_mod.js: Removed.
2623         * stress/op_mul-ConstVar.js: Added.
2624         * stress/op_mul-VarConst.js: Added.
2625         * stress/op_mul-VarVar.js: Copied from JSTests/stress/op_mul.js.
2626         (o1.valueOf): Deleted.
2627         * stress/op_mul.js: Removed.
2628         * stress/op_rshift-ConstVar.js: Added.
2629         * stress/op_rshift-VarConst.js: Added.
2630         * stress/op_rshift-VarVar.js: Copied from JSTests/stress/op_rshift.js.
2631         (o1.valueOf): Deleted.
2632         * stress/op_rshift.js: Removed.
2633         * stress/op_sub-ConstVar.js: Added.
2634         * stress/op_sub-VarConst.js: Added.
2635         * stress/op_sub-VarVar.js: Copied from JSTests/stress/op_sub.js.
2636         (o1.valueOf): Deleted.
2637         * stress/op_sub.js: Removed.
2638         * stress/op_urshift-ConstVar.js: Added.
2639         * stress/op_urshift-VarConst.js: Added.
2640         * stress/op_urshift-VarVar.js: Copied from JSTests/stress/op_urshift.js.
2641         (o1.valueOf): Deleted.
2642         * stress/op_urshift.js: Removed.
2643         * stress/resources/binary-op-values.js: Added.
2644         (o1.valueOf):
2645
2646 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2647
2648         test262: class and function names should be inferred in assignment
2649         https://bugs.webkit.org/show_bug.cgi?id=146262
2650
2651         Reviewed by Saam Barati.
2652
2653         * stress/arrowfunction-name.js: Added.
2654         Quick tests for arrow function names.
2655
2656         * stress/inferred-names.js: Added.
2657         General test for inferred function names.
2658
2659         * test262.yaml:
2660         Pass many tests checking inferred function names.
2661
2662 2016-09-29  Saam Barati  <sbarati@apple.com>
2663
2664         We don't properly propagate non-simple-parameter-list when parsing a setter
2665         https://bugs.webkit.org/show_bug.cgi?id=160483
2666
2667         Reviewed by Joseph Pecoraro.
2668
2669         * test262.yaml:
2670
2671 2016-09-28  Saam Barati  <sbarati@apple.com>
2672
2673         stringProtoFuncRepeatCharacter will return `null` when it should not
2674         https://bugs.webkit.org/show_bug.cgi?id=161944
2675
2676         Reviewed by Yusuke Suzuki.
2677
2678         * stress/pad-start-calls-repeat-character-with-double.js: Added.
2679         (logLinesWithContext):
2680
2681 2016-09-27  Filip Pizlo  <fpizlo@apple.com>
2682
2683         B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
2684         https://bugs.webkit.org/show_bug.cgi?id=162644
2685
2686         Reviewed by Keith Miller.
2687
2688         * stress/chill-mod-chill-mod.js: Added.
2689         (foo):
2690
2691 2016-09-26  Csaba Osztrogonác  <oszi@inf.u-szeged.hu>
2692
2693         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2694         https://bugs.webkit.org/show_bug.cgi?id=162386
2695
2696         Unreviewed, relanding r206317 after typo fix.
2697
2698         * stress/string-joining-long-strings-should-not-crash.js:
2699
2700 2016-09-24  Caitlin Potter  <caitp@igalia.com>
2701
2702         [JSTests] fix test262 expectations following r206333
2703         https://bugs.webkit.org/show_bug.cgi?id=162533
2704
2705         Reviewed by Yusuke Suzuki.
2706
2707         * test262.yaml:
2708
2709 2016-09-23  Caitlin Potter  <caitp@igalia.com>
2710
2711         [JSC] Implement parsing of Async Functions
2712         https://bugs.webkit.org/show_bug.cgi?id=161409
2713
2714         Reviewed by Yusuke Suzuki.
2715
2716         * stress/async-await-syntax.js: Added.
2717         (testSyntax):
2718         (testSyntaxError):
2719         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2720         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2721         (testTopLevelAsyncAwaitSyntaxStrictMode):
2722         (testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2723         (testNestedAsyncAwaitSyntax.async):
2724         (testNestedAsyncAwaitSyntax.foo):
2725         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2726
2727 2016-09-23  Ryan Haddad  <ryanhaddad@apple.com>
2728
2729         Unreviewed, rolling out r206317.
2730
2731         This change caused timeouts on El Capitan Release JSC tests
2732
2733         Reverted changeset:
2734
2735         "Skip stress/string-joining-long-strings-should-not-crash.js
2736         on memory limited devices"
2737         https://bugs.webkit.org/show_bug.cgi?id=162386
2738         http://trac.webkit.org/changeset/206317
2739
2740 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2741
2742         Skip mozilla-tests.yaml/js1_5/Array/regress-157652 on memory limited devices
2743         https://bugs.webkit.org/show_bug.cgi?id=162381
2744
2745         Reviewed by Mark Lam.
2746
2747         * mozilla/mozilla-tests.yaml:
2748
2749 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2750
2751         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2752         https://bugs.webkit.org/show_bug.cgi?id=162386
2753
2754         Reviewed by Mark Lam.
2755
2756         * stress/string-joining-long-strings-should-not-crash.js:
2757
2758 2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
2759
2760         [JSC] Use an inline cache to generate op_negate
2761         https://bugs.webkit.org/show_bug.cgi?id=162371
2762
2763         Reviewed by Saam Barati.
2764
2765         * stress/op-negate-inline-cache.js: Added.
2766
2767 2016-09-22  Mark Lam  <mark.lam@apple.com>
2768
2769         Array.prototype.join should do overflow checks on string joins.
2770         https://bugs.webkit.org/show_bug.cgi?id=162459
2771
2772         Reviewed by Saam Barati.
2773
2774         * stress/array-join-on-strings-need-overflow-checks.js: Added.
2775         (assert):
2776         (catch):
2777
2778 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
2779
2780         test262: Function length should be number of parameters before parameters with default values
2781         https://bugs.webkit.org/show_bug.cgi?id=162377
2782
2783         Reviewed by Saam Barati.
2784
2785         * stress/es6-default-parameters.js:
2786         Add our own tests for function lengths with default parameters.
2787
2788         * test262.yaml:
2789         We now pass all dflt-length tests.
2790
2791 2016-09-20  Benjamin Poulain  <bpoulain@apple.com>
2792
2793         [JSC] Do not use EagerRun on tests counting recompilation
2794         https://bugs.webkit.org/show_bug.cgi?id=162248
2795
2796         Reviewed by Geoffrey Garen.
2797
2798         This patch adds defaultNoEagerRun to all the tests
2799         for which recompilation is the symptom of a bug.
2800         The reason is that an OSR Exit can be unrelated to the tested
2801         nodes when we are running in Eager mode.
2802
2803         * stress/arith-abs-on-various-types.js:
2804         * stress/arith-ceil-on-various-types.js:
2805         * stress/arith-clz32-on-various-types.js:
2806         * stress/arith-cos-on-various-types.js:
2807         * stress/arith-floor-on-various-types.js:
2808         * stress/arith-fround-on-various-types.js:
2809         * stress/arith-log-on-various-types.js:
2810         * stress/arith-round-on-various-types.js:
2811         * stress/arith-sin-on-various-types.js:
2812         * stress/arith-sqrt-on-various-types.js:
2813         * stress/arith-tan-on-various-types.js:
2814         * stress/arith-trunc-on-various-types.js:
2815
2816         * stress/compare-strict-eq-on-various-types.js:
2817         (testAllTypesCall):
2818         The value 2 came from the other tests.
2819         CompareStrictEq supports many more cases, the worst case
2820         is bool->int->int52->number->polymorphic.
2821
2822 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
2823
2824         Make MarkedBlock state tracking support overlapped allocation and marking state
2825         https://bugs.webkit.org/show_bug.cgi?id=161581
2826
2827         Reviewed by Geoffrey Garen.
2828
2829         Add a microbenchmark for why we want to reclaim empty blocks from other allocators.
2830
2831         * microbenchmarks/switching-size-classes.js: Added.
2832
2833 2016-09-20  Saam Barati  <sbarati@apple.com>
2834
2835         Unreviewed, added test for x86 32-bit failure for HasOwnProperty node in DFG.
2836
2837         * stress/has-own-property-called-on-non-object.js: Added.
2838         (let.objs):
2839         (new.String):
2840         (foo):
2841
2842 2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2843
2844         [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
2845         https://bugs.webkit.org/show_bug.cgi?id=162253
2846
2847         Reviewed by Sam Weinig.
2848
2849         * microbenchmarks/is-symbol-mixed.js: Added.
2850         (isSymbol):
2851         (i.let.pair.of.list.String):
2852         * microbenchmarks/is-symbol.js: Added.
2853         (isSymbol):
2854
2855 2016-09-19  Saam Barati  <sbarati@apple.com>
2856
2857         Make HasOwnProperty faster
2858         https://bugs.webkit.org/show_bug.cgi?id=161708
2859
2860         Reviewed by Geoffrey Garen.
2861
2862         * microbenchmarks/has-own-property-name-cache.js: Added.
2863         (foo):
2864         * stress/has-own-property-cache-basics.js: Added.
2865         (assert):
2866         (foo):
2867         * stress/has-own-property-name-cache-string-keys.js: Added.
2868         (assert):
2869         (foo):
2870         * stress/has-own-property-name-cache-symbol-keys.js: Added.
2871         (assert):
2872         (foo):
2873         * stress/has-own-property-name-cache-symbols-and-strings.js: Added.
2874         (assert):
2875         (foo):
2876
2877 2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
2878
2879         [JSC] Make the rounding-related nodes support any type
2880         https://bugs.webkit.org/show_bug.cgi?id=161895
2881
2882         Reviewed by Geoffrey Garen.
2883
2884         * stress/arith-ceil-on-various-types.js: Added.
2885         * stress/arith-floor-on-various-types.js: Added.
2886         * stress/arith-round-on-various-types.js: Added.
2887         * stress/arith-trunc-on-various-types.js: Added.
2888
2889 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
2890
2891         [JSC] Do not need to use defineProperty to define methods for object literals
2892         https://bugs.webkit.org/show_bug.cgi?id=162111
2893
2894         Reviewed by Saam Barati.
2895
2896         * stress/object-literal-methods.js: Added.
2897         (shouldBe):
2898         (throw.new.Error.let.object.get name):
2899         (throw.new.Error):
2900         (shouldBe.let.object.get name):
2901         (shouldBe.let.object.get prototype):
2902         (shouldBe.let.object.get 42):
2903
2904 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2905
2906         [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
2907         https://bugs.webkit.org/show_bug.cgi?id=162000
2908
2909         Reviewed by Filip Pizlo.
2910
2911         * microbenchmarks/is-array-for-array.js: Added.
2912         (isArray):
2913         * microbenchmarks/is-array-for-mixed-case.js: Added.
2914         (isArray):
2915         * microbenchmarks/is-array-for-non-array-object.js: Added.
2916         (isArray):
2917         * microbenchmarks/is-array-for-proxy.js: Added.
2918         (isArray):
2919         (isArray.proxy.throw.new.Error.isArray):
2920         (isArray.proxy.throw.new.Error):
2921
2922 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2923
2924         Unreviewed, gardening test262 results
2925
2926         Some tests are now passed with JSC, but marked as failed.
2927
2928         * test262.yaml:
2929
2930 2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
2931
2932         test262: Various Constructors length properties should be configurable
2933         https://bugs.webkit.org/show_bug.cgi?id=161998
2934
2935         Reviewed by Saam Barati.
2936
2937         * test262.yaml:
2938
2939 2016-09-15  Commit Queue  <commit-queue@webkit.org>
2940
2941         Unreviewed, rolling out r205931.
2942         https://bugs.webkit.org/show_bug.cgi?id=162021
2943
2944         Tests for this change fail on 32-bit JSC bots (Requested by
2945         ryanhaddad on #webkit).
2946
2947         Reverted changeset:
2948
2949         "[JSC] Make the rounding-related nodes support any type"
2950         https://bugs.webkit.org/show_bug.cgi?id=161895
2951         http://trac.webkit.org/changeset/205931
2952
2953 2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
2954
2955         test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
2956         https://bugs.webkit.org/show_bug.cgi?id=162013
2957
2958         Reviewed by Saam Barati.
2959
2960         * stress/es6-default-parameters.js:
2961         * test262.yaml:
2962
2963 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2964
2965         ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
2966         https://bugs.webkit.org/show_bug.cgi?id=162003
2967
2968         Reviewed by Saam Barati.
2969
2970         * stress/spread-calling.js:
2971         * test262.yaml:
2972
2973 2016-09-14  Michael Saboff  <msaboff@apple.com>
2974
2975         YARR doesn't check for invalid flags for literal regular expressions
2976         https://bugs.webkit.org/show_bug.cgi?id=161995
2977
2978         Reviewed by Mark Lam.
2979
2980         New test.
2981
2982         * stress/regress-161995.js: Added.
2983         (testStatic):
2984         (catch):
2985
2986 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2987
2988         test262: TypedArray constructors length should be 3 and configurable
2989         https://bugs.webkit.org/show_bug.cgi?id=161955
2990
2991         Reviewed by Mark Lam.
2992
2993         * test262.yaml:
2994
2995 2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
2996
2997         [JSC] Make the rounding-related nodes support any type
2998         https://bugs.webkit.org/show_bug.cgi?id=161895
2999
3000         Reviewed by Geoffrey Garen.
3001
3002         * stress/arith-ceil-on-various-types.js: Added.
3003         * stress/arith-floor-on-various-types.js: Added.
3004         * stress/arith-round-on-various-types.js: Added.
3005         * stress/arith-trunc-on-various-types.js: Added.
3006
3007 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3008
3009         TaggedTemplateString function calls should emit tail position calls
3010         https://bugs.webkit.org/show_bug.cgi?id=161948
3011
3012         Reviewed by Yusuke Suzuki.
3013
3014         * stress/tail-call-recognize.js:
3015         (runTests):
3016         Ensure a tagged template string function call is tail call.
3017
3018         * test262.yaml:
3019         These now pass.
3020
3021 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
3022
3023         test262: Array.prototype.slice should always set length
3024         https://bugs.webkit.org/show_bug.cgi?id=161953
3025
3026         Reviewed by Mark Lam.
3027
3028         * test262.yaml:
3029
3030 2016-09-13  JF Bastien  <jfbastien@apple.com>
3031
3032         Support jsc shell builtin `read`
3033         https://bugs.webkit.org/show_bug.cgi?id=161662
3034
3035         Reviewed by Keith Miller.
3036
3037         * stress/jsc-read.js: Added.
3038         (test): test `read` and `readFile` shell builtins, in string and binary mode.
3039
3040 2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
3041
3042         ES6: Classes: Should be allowed to create a static method with name "arguments"
3043         https://bugs.webkit.org/show_bug.cgi?id=152985
3044
3045         Reviewed by Keith Miller.
3046
3047         * test262.yaml:
3048
3049 2016-09-12  Saam Barati  <sbarati@apple.com>
3050
3051         Speed up Function.prototype.bind a bit by making it a builtin
3052         https://bugs.webkit.org/show_bug.cgi?id=161879
3053
3054         Reviewed by Filip Pizlo.
3055
3056         * microbenchmarks/function-bind-inlining.js: Added.
3057         (assert):
3058         (test):
3059         (test2):
3060         (foo):
3061         * microbenchmarks/function-bind-no-inlining.js: Added.
3062         (assert):
3063         (test):
3064         (test2):
3065         (foo):
3066
3067 2016-09-12  Saam Barati  <sbarati@apple.com>
3068
3069         HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
3070         https://bugs.webkit.org/show_bug.cgi?id=161640
3071
3072         Reviewed by Geoffrey Garen.
3073
3074         * microbenchmarks/map-rehash.js: Added.
3075         * stress/map-delete.js: Added.
3076         (assert):
3077         * stress/map-rehash-2.js: Added.
3078         (assert):
3079         * stress/map-rehash.js: Added.
3080         (assert):
3081
3082 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3083
3084         Unreviewed, fix tests for different libm environments
3085         https://bugs.webkit.org/show_bug.cgi?id=161857
3086
3087         * stress/ftl-arithtan.js:
3088
3089 2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
3090
3091         [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
3092         https://bugs.webkit.org/show_bug.cgi?id=161671
3093
3094         Reviewed by Geoffrey Garen.
3095
3096         * stress/get-array-length-on-undecided.js: Added.
3097
3098 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3099
3100         [DFG][FTL] Add ArithTan
3101         https://bugs.webkit.org/show_bug.cgi?id=161857
3102
3103         Reviewed by Filip Pizlo.
3104
3105         * microbenchmarks/tan.js: Added.
3106         * stress/arith-tan-on-various-types.js: Added.
3107         (let.validInputTypedTestCases.validInputTestCases.map):
3108         (isIdentical):
3109         (opaqueTanNoArgument):
3110         (testNoArgument):
3111         (opaqueAllTypesTan):
3112         (testAllTypesCall):
3113         (testTangleTypeCall):
3114         (testConstant):
3115         (opaqueTanForSideEffects):
3116         (testSideEffect.let.testObject.valueOf):
3117         (testSideEffect):
3118         (opaqueTanForCSE):
3119         (testCSE.let.testObject.valueOf):
3120         (testCSE):
3121         (opaqueTanForDCE):
3122         (testDCE.let.testObject.valueOf):
3123         (testDCE):
3124         (testException.opaqueTanWithException):
3125         (testException):
3126         * stress/ftl-arithtan.js: Added.
3127         (foo):
3128
3129 2016-09-12  Saam Barati  <sbarati@apple.com>
3130
3131         MapHash should do constant folding when it has a constant argument and its legal to hash that value
3132         https://bugs.webkit.org/show_bug.cgi?id=161639
3133
3134         Reviewed by Filip Pizlo.
3135
3136         * microbenchmarks/map-constant-key.js: Added.
3137         (assert):
3138         (test):
3139         (foo):
3140
3141 2016-09-12  Michael Saboff  <msaboff@apple.com>
3142
3143         JSC test timeout: ChakraCore.yaml/ChakraCore/test/Bugs/bug56026_trycatch.js.default
3144         https://bugs.webkit.org/show_bug.cgi?id=161863
3145
3146         Reviewed by Saam Barati.
3147
3148         * ChakraCore.yaml:
3149         Disabled Bugs/bug56026_trycatch.js.
3150
3151 2016-09-09  Michael Saboff  <msaboff@apple.com>
3152
3153         Unreviewed, rolling r205759 back in with a fix.
3154
3155         The expectation file, JSTests/ChakraCore/test/Lib/tostring.baseline-jsc,
3156         should be named "toString.baseline-jsc".
3157
3158         * ChakraCore/test/Lib/toString.baseline-jsc: Copied from JSTests/ChakraCore/test/Lib/tostring.baseline-jsc.
3159         * ChakraCore/test/Lib/tostring.baseline-jsc: Removed.
3160
3161 2016-09-09  Michael Saboff  <msaboff@apple.com>
3162
3163         Disable three flakey Chakra Tests
3164         https://bugs.webkit.org/show_bug.cgi?id=161807
3165
3166         Reviewed by Saam Barati.
3167
3168         * ChakraCore.yaml: Disabled the flakey tests
3169         ChakraCore/test/Array/protoLookup_native.js
3170         ChakraCore/test/LetConst/delete.js
3171         ChakraCore/test/fieldopts/fieldhoist_sideeffect.js
3172
3173 2016-09-08  Saam Barati  <sbarati@apple.com>
3174
3175         We should inline operationConvertJSValueToBoolean into JIT code
3176         https://bugs.webkit.org/show_bug.cgi?id=161729
3177
3178         Reviewed by Filip Pizlo.
3179
3180         * stress/value-to-boolean.js: Added.
3181         (assert):
3182         (test1):
3183         (test2):
3184         (test3):
3185
3186 2016-09-08  Mark Lam  <mark.lam@apple.com>
3187
3188         REGRESSION (r205569?): 32-bit JSC test timeout: stress/rest-parameter-many-arguments.js.dfg-maximal-flush-validate-no-cjit
3189         https://bugs.webkit.org/show_bug.cgi?id=161756
3190
3191         Reviewed by Saam Barati.
3192
3193         It looks like the 32-bit JSC bot is just too slow at running this test with the
3194         dfg-maximal-flush-validate-no-cjit configuration.  We'll try excluding that
3195         configuration.
3196
3197         * stress/rest-parameter-many-arguments.js:
3198
3199 2016-09-08  JF Bastien  <jfbastien@apple.com>
3200
3201         Delete older WebAssembly tests
3202         https://bugs.webkit.org/show_bug.cgi?id=161758
3203
3204         Reviewed by Filip Pizlo.
3205
3206         They're not running, rely on the older polyfill prototype, and the older code was deleted in: https://trac.webkit.org/changeset/204180
3207
3208         * stress/wasm-arithmetic-float32.js: Removed.
3209         * stress/wasm-arithmetic-float64.js: Removed.
3210         * stress/wasm-arithmetic-int32.js: Removed.
3211         * stress/wasm-calls.js: Removed.
3212         * stress/wasm-comma.js: Removed.
3213         * stress/wasm-control-flow.js: Removed.
3214         * stress/wasm-globals.js: Removed.
3215         * stress/wasm-linear-memory.js: Removed.
3216         * stress/wasm-locals.js: Removed.
3217         * stress/wasm-relational.js: Removed.
3218         * stress/wasm-type-conversion.js: Removed.
3219         * stress/wasm/arithmetic-float32.wasm: Removed.
3220         * stress/wasm/arithmetic-float64.wasm: Removed.
3221         * stress/wasm/arithmetic-int32.wasm: Removed.
3222         * stress/wasm/calls.wasm: Removed.
3223         * stress/wasm/comma.wasm: Removed.
3224         * stress/wasm/control-flow.wasm: Removed.
3225         * stress/wasm/globals.wasm: Removed.
3226         * stress/wasm/linear-memory.wasm: Removed.
3227         * stress/wasm/locals.wasm: Removed.
3228         * stress/wasm/relational.wasm: Removed.
3229         * stress/wasm/type-conversion.wasm: Removed.
3230
3231 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
3232
3233         [Win] Exception fuzz tests fail
3234         https://bugs.webkit.org/show_bug.cgi?id=140928
3235
3236         Reviewed by Mark Lam.
3237
3238         Unskip tests.
3239
3240         * exceptionFuzz.yaml:
3241
3242 2016-09-06  Saam Barati  <sbarati@apple.com>
3243
3244         ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
3245         https://bugs.webkit.org/show_bug.cgi?id=161558
3246
3247         Reviewed by Benjamin Poulain.
3248
3249         * stress/proxy-get-prototype-of.js:
3250         * stress/proxy-set-prototype-of.js:
3251         (let.handler.setPrototypeOf): Deleted.
3252         * stress/proxy-underscore-proto.js: Added.
3253         (assert):
3254
3255 2016-09-06  Saam Barati  <sbarati@apple.com>
3256
3257         Make JSMap and JSSet faster
3258         https://bugs.webkit.org/show_bug.cgi?id=160989
3259
3260         Reviewed by Filip Pizlo.
3261
3262         * microbenchmarks/dense-set.js: Added.
3263         (bench):
3264         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3265         (bar):
3266         (foo):
3267         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3268         (bar):
3269         (foo):
3270         * microbenchmarks/large-map-iteration.js: Added.
3271         (bar):
3272         (foo):
3273         * microbenchmarks/map-get-get-cse.js: Added.
3274         (bar):
3275         (foo):
3276         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3277         (bar):
3278         (foo):
3279         * microbenchmarks/sparse-set.js: Added.
3280         (bench):
3281         * stress/map-cse-correctness.js: Added.
3282         (assert):
3283         (testHas):
3284         (testGet):
3285         (foo):
3286         * stress/map-iteration.js: Added.
3287         (assert):
3288         (test1):
3289         (test2):
3290         (test3):
3291         (test4):
3292         (test5):
3293         (test6):
3294         (test7):
3295         (test8):
3296         (test9):
3297         (test10):
3298         (test11):
3299         (test12):
3300         (test13):
3301         (test14):
3302         (test15):
3303         (test16):
3304         (test17):
3305         (test18):
3306
3307 2016-09-06  Benjamin Poulain  <bpoulain@apple.com>
3308
3309         [JSC] Make ArithClz32 work with Cell arguments
3310         https://bugs.webkit.org/show_bug.cgi?id=161369
3311
3312         Reviewed by Geoffrey Garen.
3313
3314         * stress/arith-clz32-on-various-types.js: Added.
3315
3316 2016-09-06  Commit Queue  <commit-queue@webkit.org>
3317
3318         Unreviewed, rolling out r205504.
3319         https://bugs.webkit.org/show_bug.cgi?id=161645
3320
3321         Broke the iOS device build (Requested by ryanhaddad on
3322         #webkit).
3323
3324         Reverted changeset:
3325
3326         "Make JSMap and JSSet faster"
3327         https://bugs.webkit.org/show_bug.cgi?id=160989
3328         http://trac.webkit.org/changeset/205504
3329
3330 2016-09-06  Saam Barati  <sbarati@apple.com>
3331
3332         Make JSMap and JSSet faster
3333         https://bugs.webkit.org/show_bug.cgi?id=160989
3334
3335         Reviewed by Filip Pizlo.
3336
3337         * microbenchmarks/dense-set.js: Added.
3338         (bench):
3339         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3340         (bar):
3341         (foo):
3342         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3343         (bar):
3344         (foo):
3345         * microbenchmarks/large-map-iteration.js: Added.
3346         (bar):
3347         (foo):
3348         * microbenchmarks/map-get-get-cse.js: Added.
3349         (bar):
3350         (foo):
3351         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3352         (bar):
3353         (foo):
3354         * microbenchmarks/sparse-set.js: Added.
3355         (bench):
3356         * stress/map-cse-correctness.js: Added.
3357         (assert):
3358         (testHas):
3359         (testGet):
3360         (foo):
3361         * stress/map-iteration.js: Added.
3362         (assert):
3363         (test1):
3364         (test2):
3365         (test3):
3366         (test4):
3367         (test5):
3368         (test6):
3369         (test7):
3370         (test8):
3371         (test9):
3372         (test10):
3373         (test11):
3374         (test12):
3375         (test13):
3376         (test14):
3377         (test15):
3378         (test16):
3379         (test17):
3380         (test18):
3381
3382 2016-08-31  Filip Pizlo  <fpizlo@apple.com>
3383
3384         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3385         https://bugs.webkit.org/show_bug.cgi?id=160125
3386
3387         Reviewed by Geoffrey Garen and Keith Miller.
3388
3389         Most of the things I did properly covered by existing tests, but I found some simple cases of
3390         unshifting that had sketchy coverage.
3391
3392         * stress/array-storage-array-unshift.js: Added.
3393         * stress/contiguous-array-unshift.js: Added.
3394         * stress/double-array-unshift.js: Added.
3395         * stress/int32-array-unshift.js: Added.
3396
3397 2016-09-02  Michael Saboff  <msaboff@apple.com>
3398
3399         Unreviewed fix after importing Chakra test
3400
3401         * ChakraCore.yaml: Skipped ChakraCore/test/UnifiedRegex/crazy.js because the original
3402         test contained tab characters.  I removed the tabs before landing.  This test depended
3403         on the tab characters and now fails after they were removed.
3404         test.
3405
3406 2016-09-01  Michael Saboff  <msaboff@apple.com>
3407
3408         Import Chakra tests to JSC
3409         https://bugs.webkit.org/show_bug.cgi?id=154697
3410
3411         Reviewed by Saam Barati.
3412
3413         Added Chakra tests.  All these tests are under Chakra/test.  This is the same layout
3414         for tests in the Chakra tree.
3415
3416         Created a ChakraCore.yaml file to be used with run-jsc-stress-tests.  This file contains
3417         the tests that are run when the original Chakra runtests.py script is run.  That script
3418         is the test driver for *nix platforms and does not attempt to run all tests or all
3419         variations of tests.  The runtest.py driver consults rlexe.xml files in each test
3420         subdirectory to determine the test to run, the options to pass to the test and how to
3421         determine pass/fail of the test.  With runtests.py as the start, tests that didn't
3422         pass directly where either skipped, with a message describing why or through
3423         adjustments to the test infrastructure, as described below, where made to pass.
3424
3425         The only modification to the test infrastrucutre are:
3426
3427          1) Added simple mapping of Chakra expected exception text to JSC expected text in
3428             test/UnitTestFramework/UnitTestFramework.js.  It would make sense to also
3429             map some JSC specific exception text to more generic text for the cases where
3430             that text contains indetifier names or other source specific strings and the
3431             Chakra equivolent exception texts are generic.
3432
3433          2) Created JSC specific expected text files where it is clear that the text work
3434             as expected on JSC but the test output is different.  Typically the differences
3435             fall into three categories, different exception output, different output from
3436             toString() of a function, slight numeric differences, and test that rely on
3437             iteration order.
3438
3439          3) Stripped the CR's from the CR-LF line terminations of the files.
3440
3441         No actual test .js files were modified.
3442
3443         * ChakraCore: Added.
3444         * ChakraCore.yaml: Added.
3445         * ChakraCore/CONTRIBUTING.md: Added.
3446         * ChakraCore/LICENSE.txt: Added.
3447         * ChakraCore/README.md: Added.
3448         * ChakraCore/THIRD-PARTY-NOTICES.txt: Added.
3449         * ChakraCore/test: Added this directory and the tests included therein.
3450
3451 2016-09-01  JF Bastien  <jfbastien@apple.com>
3452
3453         GetByIdWithThis/GetByValWithThis should have ValueProfiles so that they can predict their result types
3454         https://bugs.webkit.org/show_bug.cgi?id=160922
3455
3456         Reviewed by Keith Miller.
3457
3458         Benchmark GetBy{Id,Val}WithThis in monomorphic and polymorphic uses.
3459         The value profile is used by the calc functions, which do some mild math with the result.
3460         These benchmarks get ~4% faster with value profiling.
3461
3462         * microbenchmarks/super-get-by-id-with-this-monomorphic.js: Added.
3463         (A):
3464         (A.prototype.set value):
3465         (A.prototype.get value):
3466         (B.prototype.set value):
3467         (B.prototype.get value):
3468         (B):
3469         (const.bench):
3470         * microbenchmarks/super-get-by-id-with-this-polymorphic.js: Added.
3471         (A):
3472         (A.prototype.set value):
3473         (A.prototype.get value):
3474         (B.prototype.set value):
3475         (B.prototype.get value):
3476         (B):
3477         (const.bench):
3478         * microbenchmarks/super-get-by-val-with-this-monomorphic.js: Added.
3479         (value):
3480         (A):
3481         (A.prototype.set v):
3482         (A.prototype.get v):
3483         (B.prototype.set v):
3484         (B.prototype.get v):
3485         (B):
3486         (const.bench):
3487         * microbenchmarks/super-get-by-val-with-this-polymorphic.js: Added.
3488         (value):
3489         (A):
3490         (A.prototype.set v):
3491         (A.prototype.get v):
3492         (B.prototype.set v):
3493         (B.prototype.get v):
3494         (B):
3495         (const.bench):
3496
3497 2016-09-01  Benjamin Poulain  <bpoulain@apple.com>
3498
3499         arith-abs-on-various-types.js is flaky
3500
3501         Unreviewed.
3502
3503         * stress/arith-abs-on-various-types.js:
3504         Two compilation is too small for the worst case.
3505         Math.abs() can be typed integer->number->untyped if we are very unlucky.
3506
3507 2016-09-01  Filip Pizlo  <fpizlo@apple.com>
3508
3509         ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases
3510         https://bugs.webkit.org/show_bug.cgi?id=161492
3511
3512         Reviewed by Mark Lam.
3513
3514         This bug affected function->activation references but not object->object field references,
3515         because object->object field references are !neededForMaterialization(). So, the object
3516         test always passed but the activation/function test used to always fail. It passes now.
3517
3518         * stress/materialize-activation-referenced-from-phantom-function.js: Added.
3519         (bar):
3520         (inc):
3521         (dec):
3522         (foo):
3523         (test):
3524         * stress/materialize-object-referenced-from-phantom-object.js: Added.
3525         (bar):
3526         (foo):
3527         (test):
3528
3529 2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3530
3531         stress/random-53bit.js.ftl-no-cjit-no-inline-validate sometimes fails
3532         https://bugs.webkit.org/show_bug.cgi?id=161436
3533
3534         Reviewed by Filip Pizlo.
3535
3536         The test checks Math.random() correctly produces 53bit random values.
3537         The test can fail by design, but this should be fairly rare.
3538
3539         However, when introducing, we wrap the `test()` with 1e4 to ensure the FTL compilation, and this
3540         increases the failure rate. By increasing the MAX in the test, we make the failures much more rare case.
3541
3542         And we also add getRandomSeed() and setRandomSeed(seed) JSC shell helpers to dump more useful information
3543         and reproduce the situation easily.
3544
3545         * stress/random-53bit.js:
3546         (test):
3547
3548 2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
3549
3550         [JSC] Improve ArithAbs with polymorphic input
3551         https://bugs.webkit.org/show_bug.cgi?id=161286
3552
3553         Reviewed by Saam Barati.
3554
3555         * stress/arith-abs-on-various-types.js: Added.
3556         New tests.
3557
3558         * stress/arith-cos-on-various-types.js:
3559         * stress/arith-fround-on-various-types.js:
3560         * stress/arith-log-on-various-types.js:
3561         * stress/arith-sin-on-various-types.js:
3562         * stress/arith-sqrt-on-various-types.js:
3563         Extend the existing tests to cover the DCE case.
3564
3565 2016-08-26  Benjamin Poulain  <benjamin@webkit.org>
3566
3567         [JSC] Implement CompareStrictEq(String, Untyped) in FTL
3568         https://bugs.webkit.org/show_bug.cgi?id=161229
3569
3570         Reviewed by Geoffrey Garen.
3571
3572         * stress/compare-strict-eq-on-various-types.js: Added.
3573
3574 2016-08-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3575
3576         [ES6] newPromiseCapabilities should check the given argument is constructor
3577         https://bugs.webkit.org/show_bug.cgi?id=161226
3578
3579         Reviewed by Mark Lam.
3580
3581         The arrow function should not be a constructor. So the error should be raised.
3582
3583         * stress/new-promise-capabilities-requires-constructor.js: Added.
3584         (shouldThrow):
3585
3586 2016-08-25  Benjamin Poulain  <bpoulain@apple.com>
3587
3588         [JSC] Clean up the abstract interpreter for cos/sin/sqrt/fround/log
3589         https://bugs.webkit.org/show_bug.cgi?id=161181
3590
3591         Reviewed by Geoffrey Garen.
3592
3593         Extend the tests to constants.
3594         Add no-argument cases where needed.
3595
3596         * stress/arith-cos-on-various-types.js:
3597         * stress/arith-fround-on-various-types.js:
3598         * stress/arith-log-on-various-types.js:
3599         * stress/arith-sin-on-various-types.js:
3600         * stress/arith-sqrt-on-various-types.js:
3601
3602 2016-08-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3603
3604         [DFG][FTL] Implement ES6 Generators in DFG / FTL
3605         https://bugs.webkit.org/show_bug.cgi?id=152723
3606
3607         Reviewed by Filip Pizlo.
3608
3609         * stress/generator-fib-ftl-and-array.js: Added.
3610         (fib):
3611         * stress/generator-fib-ftl-and-object.js: Added.
3612         (fib):
3613         * stress/generator-fib-ftl-and-string.js: Added.
3614         (fib):
3615         * stress/generator-fib-ftl.js: Added.
3616         (fib):
3617         * stress/generator-frame-empty.js: Added.
3618         (shouldThrow):
3619         (shouldThrow.fib):
3620         * stress/generator-reduced-save-point-put-to-scope.js: Added.
3621         (shouldBe):
3622         (gen):
3623         * stress/generator-transfer-register-beyond-mutiple-yields.js: Added.
3624         (shouldBe):
3625         (gen):
3626
3627 2016-08-25  JF Bastien  <jfbastien@apple.com>
3628
3629         TryGetById should have a ValueProfile so that it can predict its output type
3630         https://bugs.webkit.org/show_bug.cgi?id=160921
3631
3632         Reviewed by Saam Barati.
3633
3634         * microbenchmarks/try-get-by-id-basic.js: Added.
3635         (const.check):
3636         (const.bench.f.const.fooPlusBar.createBuiltin):
3637         * microbenchmarks/try-get-by-id-polymorphic.js: Added.
3638         (const.check):
3639         (fooPlusBar.createBuiltin):
3640         (bench):
3641
3642 2016-08-25  Caio Lima  <ticaiolima@gmail.com>
3643
3644         NewRegexp should not prevent inlining
3645         https://bugs.webkit.org/show_bug.cgi?id=154808
3646
3647         Reviewed by Geoffrey Garen.
3648
3649         Added test where functions with NewRegExp can be inlined right now.
3650
3651         * stress/new-regex-inline.js: Added.
3652         (assert):
3653         (testRegexpInline):
3654         (toInlineGlobal):
3655         (withRegexp):
3656         (inlineRegexpNotGlobal):
3657         (toInlineRecursive):
3658         (regexpContainsRecursive):
3659
3660 2016-08-24  Benjamin Poulain  <benjamin@webkit.org>
3661
3662         [JSC] Make FRound work with any type
3663         https://bugs.webkit.org/show_bug.cgi?id=161129
3664
3665         Reviewed by Geoffrey Garen.
3666
3667         * stress/arith-fround-on-various-types.js: Added.
3668
3669 2016-08-24  Filip Pizlo  <fpizlo@apple.com>
3670
3671         Unreviewed, roll out r204901, r204897, r204866, r204856, r204854.
3672
3673         * stress/array-storage-array-unshift.js: Removed.
3674         * stress/contiguous-array-unshift.js: Removed.
3675         * stress/double-array-unshift.js: Removed.
3676         * stress/int32-array-unshift.js: Removed.
3677
3678 2016-08-24  Skachkov Oleksandr  <gskachkov@gmail.com>
3679
3680         [ES2016] Allow assignment in for-in head in not-strict mode
3681         https://bugs.webkit.org/show_bug.cgi?id=160955
3682
3683         Reviewed by Saam Barati.
3684
3685         * stress/for-in-tests.js:
3686         (foo):
3687         (boo):
3688         (catch):
3689
3690 2016-08-23  Benjamin Poulain  <benjamin@webkit.org>
3691
3692         [JSC] Make ArithLog works with any type
3693         https://bugs.webkit.org/show_bug.cgi?id=161110
3694
3695         Reviewed by Geoffrey Garen.
3696
3697         * stress/arith-log-on-various-types.js: Added.
3698
3699 2016-08-23  Saam Barati  <sbarati@apple.com>
3700
3701         JSC should have a "microbenchmarks" directory instead of "regress" directory
3702         https://bugs.webkit.org/show_bug.cgi?id=161096
3703
3704         Rubber stamped by Mark Lam.
3705
3706         * microbenchmarks: Copied from LayoutTests/js/regress/script-tests.
3707
3708 2016-08-23  Keith Miller  <keith_miller@apple.com>
3709
3710         %TypedArray%.prototype.slice needs to check that the source and destination have not been detached.
3711         https://bugs.webkit.org/show_bug.cgi?id=161031
3712         <rdar://problem/27937019>
3713
3714         Reviewed by Geoffrey Garen.
3715
3716         * stress/typedarray-slice.js:
3717         (get let):
3718         (get try):
3719         (testSpeciesWithTransferring):
3720
3721 2016-08-22  Filip Pizlo  <fpizlo@apple.com>
3722
3723         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3724         https://bugs.webkit.org/show_bug.cgi?id=160125
3725
3726         Reviewed by Geoffrey Garen.
3727
3728         Most of the things I did properly covered by existing tests, but I found some simple cases of
3729         unshifting that had sketchy coverage.
3730
3731         * stress/array-storage-array-unshift.js: Added.
3732         * stress/contiguous-array-unshift.js: Added.
3733         * stress/double-array-unshift.js: Added.
3734         * stress/int32-array-unshift.js: Added.
3735
3736 2016-08-23  Keith Miller  <keith_miller@apple.com>
3737
3738         Update/add new test262 tests
3739         https://bugs.webkit.org/show_bug.cgi?id=161098
3740
3741         Reviewed by Saam Barati.
3742
3743         * test262.yaml:
3744         * test262/test/annexB/language/statements/for-in/bare-initializer.js: Added.
3745         * test262/test/annexB/language/statements/for-in/const-initializer.js: Added.
3746         * test262/test/annexB/language/statements/for-in/let-initializer.js: Added.
3747         * test262/test/annexB/language/statements/for-in/nonstrict-initializer.js: Added.
3748         (a):
3749         * test262/test/annenxB/language/statements/for-in/strict-initializer.js: Added.
3750         * test262/test/annexB/language/statements/for-in/var-arraybindingpattern-initializer.js: Added.
3751         * test262/test/annexB/language/statements/for-in/var-objectbindingpattern-initializer.js: Added.
3752         * test262/test/built-ins/AsyncFunction/AsyncFunction-construct.js: Added.
3753         (AsyncFunction.async.foo):
3754         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-extensible.js: Added.
3755         (AsyncFunction.async):
3756         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-subclass.js: Added.
3757         (async.foo):
3758         * test262/test/built-ins/AsyncFunction/AsyncFunction-length.js: Added.
3759         (AsyncFunction.async.foo):
3760         * test262/test/built-ins/AsyncFunction/AsyncFunction-name.js: Added.
3761         (AsyncFunction.async.foo):
3762         * test262/test/built-ins/AsyncFunction/AsyncFunction-prototype.js: Added.
3763         (AsyncFunction.async.foo):
3764         * test262/test/built-ins/AsyncFunction/AsyncFunction.js: Added.
3765         (AsyncFunction.async.foo):
3766         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-is-extensible.js: Added.
3767         (AsyncFunction.async.foo):
3768         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-prototype.js: Added.
3769         (AsyncFunction.async.foo):
3770         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-to-string.js: Added.
3771         (AsyncFunction.async.foo):
3772         * test262/test/built-ins/AsyncFunction/instance-construct.js: Added.
3773         (async.foo):
3774         * test262/test/built-ins/AsyncFunction/instance-has-name.js: Added.
3775         (async.foo):
3776         * test262/test/built-ins/AsyncFunction/instance-length.js: Added.
3777         (async.l0):
3778         (async.l1):
3779         (async.l2):
3780         * test262/test/built-ins/AsyncFunction/instance-prototype-property.js: Added.
3781         (async.foo):
3782         * test262/test/built-ins/AsyncFunction/is-not-a-global.js: Added.
3783         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-integer-byteoffset.js.
3784         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-before-outofrange-byteoffset.js:
3785         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-integer-byteoffset.js.
3786         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-before-outofrange-byteoffset.js:
3787         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-integer-byteoffset.js.
3788         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-before-outofrange-byteoffset.js:
3789         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-integer-byteoffset.js.
3790         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-before-outofrange-byteoffset.js:
3791         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-integer-byteoffset.js.
3792         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-before-outofrange-byteoffset.js:
3793         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-integer-byteoffset.js.
3794         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-before-outofrange-byteoffset.js:
3795         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-integer-byteoffset.js.
3796         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-before-outofrange-byteoffset.js:
3797         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-integer-byteoffset.js.
3798         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-before-outofrange-byteoffset.js:
3799         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-integer-byteoffset.js.
3800         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-before-outofrange-byteoffset.js:
3801         * test262/test/built-ins/DataView/prototype/setFloat32/index-check-before-value-conversion.js:
3802         * test262/test/built-ins/DataView/prototype/setFloat32/range-check-after-value-conversion.js:
3803         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-integer-byteoffset.js.
3804         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-before-outofrange-byteoffset.js:
3805         * test262/test/built-ins/DataView/prototype/setFloat64/index-check-before-value-conversion.js:
3806         * test262/test/built-ins/DataView/prototype/setFloat64/range-check-after-value-conversion.js:
3807         * test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-integer-byteoffset.js.
3808         * test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-before-outofrange-byteoffset.js:
3809         * test262/test/built-ins/DataView/prototype/setInt16/index-check-before-value-conversion.js:
3810         * test262/test/built-ins/DataView/prototype/setInt16/range-check-after-value-conversion.js:
3811         * test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-after-integer-byteoffset.js.
3812         * test262/test/built-ins/DataView/prototype/setInt32/detached-buffer-before-outofrange-byteoffset.js:
3813         * test262/test/built-ins/DataView/prototype/setInt32/index-check-before-value-conversion.js:
3814         * test262/test/built-ins/DataView/prototype/setInt32/range-check-after-value-conversion.js:
3815         * test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-after-integer-byteoffset.js.
3816         * test262/test/built-ins/DataView/prototype/setInt8/detached-buffer-before-outofrange-byteoffset.js:
3817         * test262/test/built-ins/DataView/prototype/setInt8/index-check-before-value-conversion.js:
3818         * test262/test/built-ins/DataView/prototype/setInt8/range-check-after-value-conversion.js:
3819         * test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-after-integer-byteoffset.js.
3820         * test262/test/built-ins/DataView/prototype/setUint16/detached-buffer-before-outofrange-byteoffset.js:
3821         * test262/test/built-ins/DataView/prototype/setUint16/index-check-before-value-conversion.js:
3822         * test262/test/built-ins/DataView/prototype/setUint16/range-check-after-value-conversion.js:
3823         * test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-after-integer-byteoffset.js.
3824         * test262/test/built-ins/DataView/prototype/setUint32/detached-buffer-before-outofrange-byteoffset.js:
3825         * test262/test/built-ins/DataView/prototype/setUint32/index-check-before-value-conversion.js:
3826         * test262/test/built-ins/DataView/prototype/setUint32/range-check-after-value-conversion.js:
3827         * test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-after-integer-byteoffset.js.
3828         * test262/test/built-ins/DataView/prototype/setUint8/detached-buffer-before-outofrange-byteoffset.js:
3829         * test262/test/built-ins/DataView/prototype/setUint8/index-check-before-value-conversion.js:
3830         * test262/test/built-ins/DataView/prototype/setUint8/range-check-after-value-conversion.js:
3831         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-boundtarget-bound.js: Added.
3832         (A):
3833         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-boundtarget.js: Added.
3834         (A):
3835         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-self-new.js: Added.
3836         (A):
3837         * test262/test/built-ins/Function/prototype/bind/instance-construct-newtarget-self-reflect.js: Added.
3838         (A):
3839         * test262/test/built-ins/Function/prototype/toString/AsyncFunction.js: Added.
3840         (async.f):
3841         * test262/test/built-ins/Function/prototype/toString/async-function-declaration.js: Added.
3842         (async.f):
3843         * test262/test/built-ins/Function/prototype/toString/async-function-expression.js: Added.
3844         (let.f.async.f):
3845         * test262/test/built-ins/Function/prototype/toString/async-method.js: Added.
3846         (let.f.async.f):
3847         (let.g.async.string_appeared_here):
3848         * test262/test/built-ins/JSON/parse/reviver-array-define-prop-err.js: Added.
3849         (defineProperty):
3850         * test262/test/built-ins/JSON/parse/reviver-array-delete-err.js: Added.
3851         (deleteProperty):
3852         * test262/test/built-ins/JSON/parse/reviver-array-length-coerce-err.js: Added.
3853         (uncoercible.valueOf):
3854         (get if):
3855         * test262/test/built-ins/JSON/parse/reviver-array-length-get-err.js: Added.
3856         (get if):
3857         * test262/test/built-ins/JSON/parse/reviver-call-err.js: Added.
3858         * test262/test/built-ins/JSON/parse/reviver-get-name-err.js: Added.
3859         (thrower):
3860         * test262/test/built-ins/JSON/parse/reviver-object-define-prop-err.js: Added.
3861         (defineProperty):
3862         * test262/test/built-ins/JSON/parse/reviver-object-delete-err.js: Added.
3863         (deleteProperty):
3864         * test262/test/built-ins/JSON/parse/reviver-object-own-keys-err.js: Added.
3865         (ownKeys):
3866         * test262/test/built-ins/Number/prototype/toExponential/infinity.js: Added.
3867         * test262/test/built-ins/Number/prototype/toExponential/nan.js: Added.
3868         * test262/test/built-ins/Number/prototype/toExponential/prop-desc.js: Added.
3869         * test262/test/built-ins/Number/prototype/toExponential/return-abrupt-tointeger-fractiondigits-symbol.js: Added.
3870         * test262/test/built-ins/Number/prototype/toExponential/return-abrupt-tointeger-fractiondigits.js: Added.
3871         (fd1.valueOf):
3872         (fd2.toString):
3873         * test262/test/built-ins/Number/prototype/toExponential/return-values.js: Added.
3874         * test262/test/built-ins/Number/prototype/toExponential/this-is-0-fractiondigits-is-0.js: Added.
3875         * test262/test/built-ins/Number/prototype/toExponential/this-is-0-fractiondigits-is-not-0.js: Added.
3876         * test262/test/built-ins/Number/prototype/toExponential/this-type-not-number-or-number-object.js: Added.
3877         * test262/test/built-ins/Number/prototype/toExponential/tointeger-fractiondigits.js: Added.
3878         * test262/test/built-ins/Number/prototype/toExponential/undefined-fractiondigits.js: Added.
3879         * test262/test/built-ins/Object/getOwnPropertyDescriptors/duplicate-keys.js:
3880         * test262/test/built-ins/Object/getOwnPropertyDescriptors/proxy-undefined-descriptor.js: Added.
3881         (badProxyHandlers.allowProxyTraps.getOwnPropertyDescriptor):
3882         (badProxyHandlers.allowProxyTraps.ownKeys):
3883         * test262/test/built-ins/Proxy/setPrototypeOf/boolean-trap-result-extensible-target.js: Removed.
3884         (setPrototypeOf): Deleted.
3885         * test262/test/built-ins/Proxy/setPrototypeOf/internals-call-order.js: Added.
3886         (target.new.Proxy.Object.create.isExtensible):
3887         (target.new.Proxy.Object.create.getPrototypeOf):
3888         (target.new.Proxy.Object.create):
3889         (setPrototypeOf):
3890         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-target-not-same-target-prototype.js:
3891         (setPrototypeOf):
3892         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-target-same-target-prototype.js:
3893         (setPrototypeOf):
3894         * test262/test/built-ins/Proxy/setPrototypeOf/not-extensible-trap-is-false-return-false.js: Removed.
3895         (setPrototypeOf): Deleted.
3896         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-get-trap.js: Added.
3897         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-isextensible-target.js: Added.
3898         (isExtensible):
3899         (setPrototypeOf):
3900         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-target-getprototypeof.js: Added.
3901         (getPrototypeOf):
3902         (setPrototypeOf):
3903         * test262/test/built-ins/Proxy/setPrototypeOf/return-abrupt-from-trap.js: Renamed from JSTests/test262/test/built-ins/Proxy/setPrototypeOf/return-is-abrupt.js.
3904         (setPrototypeOf):
3905         * test262/test/built-ins/Proxy/setPrototypeOf/return-is-abrupt.js:
3906         (setPrototypeOf): Deleted.
3907         * test262/test/built-ins/Proxy/setPrototypeOf/toboolean-trap-result-false.js: Added.
3908         (isExtensible):
3909         (setPrototypeOf):
3910         * test262/test/built-ins/Proxy/setPrototypeOf/toboolean-trap-result-true-target-is-extensible.js: Added.
3911         (isExtensible):
3912         (getPrototypeOf):
3913         (setPrototypeOf):
3914         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable.js:
3915         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-undefined-or-null.js: Added.
3916         (setPrototypeOf):
3917         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-undefined.js: Removed.
3918         * test262/test/built-ins/RegExp/lastIndex.js: Added.
3919         * test262/test/built-ins/RegExp/prototype/global/15.10.7.2-1.js: Removed.
3920         * test262/test/built-ins/RegExp/prototype/global/this-val-invalid-obj.js: Added.
3921         (get Object):
3922         * test262/test/built-ins/RegExp/prototype/global/this-val-non-obj.js: Added.
3923         (get Object):
3924         * test262/test/built-ins/RegExp/prototype/global/this-val-regexp-prototype.js: Added.
3925         * test262/test/built-ins/RegExp/prototype/ignoreCase/15.10.7.3-1.js: Removed.
3926         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-invalid-obj.js: Added.
3927         (get Object):
3928         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-non-obj.js: Added.
3929         (get Object):
3930         * test262/test/built-ins/RegExp/prototype/ignoreCase/this-val-regexp-prototype.js: Added.
3931         * test262/test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-1.js: Removed.
3932         * test262/test/built-ins/RegExp/prototype/lastIndex/15.10.7.5-2.js: Removed.
3933         * test262/test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A8.js: Removed.
3934         (__re.hasOwnProperty): Deleted.
3935         (__re.propertyIsEnumerable): Deleted.
3936         (count.0): Deleted.
3937         * test262/test/built-ins/RegExp/prototype/lastIndex/S15.10.7.5_A9.js: Removed.
3938         (__re.hasOwnProperty): Deleted.
3939         (catch): Deleted.
3940         * test262/test/built-ins/RegExp/prototype/multiline/15.10.7.4-1.js: Removed.
3941         * test262/test/built-ins/RegExp/prototype/multiline/this-val-invalid-obj.js: Added.
3942         (get Object):
3943         * test262/test/built-ins/RegExp/prototype/multiline/this-val-non-obj.js: Added.
3944         (get Object):
3945         * test262/test/built-ins/RegExp/prototype/multiline/this-val-regexp-prototype.js: Added.
3946         * test262/test/built-ins/RegExp/prototype/no-regexp-matcher.js: Added.
3947         * test262/test/built-ins/RegExp/prototype/source/15.10.7.1-1.js: Removed.
3948         * test262/test/built-ins/RegExp/prototype/source/this-val-invalid-obj.js: Added.
3949         (get Object):
3950         * test262/test/built-ins/RegExp/prototype/source/this-val-non-obj.js: Added.
3951         (get Object):
3952         * test262/test/built-ins/RegExp/prototype/source/this-val-regexp-prototype.js: Added.
3953         * test262/test/built-ins/RegExp/prototype/source/value-empty.js: Added.
3954         * test262/test/built-ins/RegExp/prototype/source/value-line-terminator.js: Added.
3955         * test262/test/built-ins/RegExp/prototype/source/value-u.js: Added.
3956         * test262/test/built-ins/RegExp/prototype/source/value.js: Added.
3957         * test262/test/built-ins/RegExp/prototype/sticky/this-val-invalid-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-invalid-obj.js.
3958         * test262/test/built-ins/RegExp/prototype/sticky/this-val-non-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-non-obj.js.
3959         * test262/test/built-ins/RegExp/prototype/sticky/this-val-regexp-prototype.js: Added.
3960         * test262/test/built-ins/RegExp/prototype/sticky/this-val-regexp.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/sticky/this-regexp.js.
3961         * test262/test/built-ins/RegExp/prototype/unicode/this-val-invalid-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-invald-obj.js.
3962         * test262/test/built-ins/RegExp/prototype/unicode/this-val-non-obj.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-non-obj.js.
3963         * test262/test/built-ins/RegExp/prototype/unicode/this-val-regexp-prototype.js: Added.
3964         * test262/test/built-ins/RegExp/prototype/unicode/this-val-regexp.js: Renamed from JSTests/test262/test/built-ins/RegExp/prototype/unicode/this-regexp.js.
3965         * test262/test/built-ins/String/numeric-properties.js: Added.
3966         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/date-is-infinity-throws.js: Added.
3967         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/date-is-nan-throws.js: Added.
3968         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/formatToParts.js: Added.
3969         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/length.js: Added.
3970         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/main.js: Added.
3971         (reduce):
3972         (compareFTPtoFormat):
3973         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/name.js: Added.
3974         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/return-abrupt-tonumber-date.js: Added.
3975         (obj1.valueOf):
3976         (obj2.toString):
3977         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/this-has-not-internal-throws.js: Added.
3978         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/this-is-not-object-throws.js: Added.
3979         * test262/test/intl402/NumberFormat/prototype/formatToParts/formatToParts.js: Added.
3980         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js: Added.
3981         * test262/test/intl402/NumberFormat/prototype/formatToParts/main.js: Added.
3982         (reduce):
3983         (compareFTPtoFormat):
3984         * test262/test/intl402/NumberFormat/prototype/formatToParts/name.js: Added.
3985         * test262/test/intl402/NumberFormat/prototype/formatToParts/return-abrupt-tonumber.js: Added.
3986         (obj1.valueOf):
3987         (obj2.toString):
3988         * test262/test/intl402/NumberFormat/prototype/formatToParts/this-has-not-internal-throws.js: Added.
3989         * test262/test/intl402/NumberFormat/prototype/formatToParts/this-is-not-object-throws.js: Added.
3990         * test262/test/language/arguments-object/10.6-10-c-ii-2-s.js:
3991         (foo): Deleted.
3992         * test262/test/language/arguments-object/unmapped/via-params-dflt.js: Added.
3993         (dflt):
3994         * test262/test/language/arguments-object/unmapped/via-params-dstr.js: Added.
3995         (dstr):
3996         * test262/test/language/arguments-object/unmapped/via-params-rest.js: Added.
3997         (rest):
3998         * test262/test/language/arguments-object/unmapped/via-strict.js: Renamed from JSTests/test262/test/language/arguments-object/10.6-10-c-ii-2-s.js.
3999         (foo):
4000         * test262/test/language/block-scope/syntax/redeclaration-global/allowed-to-redeclare-function-declaration-with-function-declaration.js:
4001         (f): Deleted.
4002         * test262/test/language/eval-code/direct/super-call-arrow.js: Added.
4003         (catch):
4004         * test262/test/language/eval-code/direct/super-call-fn.js: Added.
4005         (f):
4006         * test262/test/language/eval-code/direct/super-call.js: Added.
4007         (catch):
4008         * test262/test/language/eval-code/direct/super-prop-arrow.js: Added.
4009         (catch):
4010         * test262/test/language/eval-code/direct/super-prop-method.js: Added.
4011         (o.method):
4012         * test262/test/language/eval-code/direct/super-prop.js: Added.
4013         (catch):
4014         * test262/test/language/eval-code/indirect/super-call.js: Added.
4015         (catch):
4016         (try.m):
4017         * test262/test/language/eval-code/indirect/super-prop.js: Added.
4018         (catch):
4019         (try.m):
4020         * test262/test/language/expressions/arrow-function/params-trailing-comma-length.js: Added.
4021         (assert.sameValue):
4022         * test262/test/language/expressions/arrow-function/params-trailing-comma.js: Added.
4023         * test262/test/language/expressions/async-arrow-function/arrow-returns-promise.js: Added.
4024         (p.then):
4025         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-NSPL-with-USD.js: Added.
4026         (async):
4027         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-arguments-in-formal-parameters.js: Added.
4028         (async):
4029         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-await-in-formals-default.js: Added.
4030         (async):
4031         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-await-in-formals.js: Added.
4032         (async):
4033         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-body-contains-super-call.js: Added.
4034         (async):
4035         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-body-contains-super-property.js: Added.
4036         (async):
4037         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-duplicate-parameters.js: Added.
4038         (async):
4039         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-eval-in-formal-parameters.js: Added.
4040         (async):
4041         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-body-duplicate.js: Added.
4042         (async):
4043         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-contains-super-call.js: Added.
4044         (async.foo.super):
4045         * test262/test/language/expressions/async-arrow-function/early-errors-arrow-formals-contains-super-property.js: Added.
4046         (async):
4047         * test262/test/language/expressions/async-function/early-errors-expression-NSPL-with-USD.js: Added.
4048         (async):
4049         * test262/test/language/expressions/async-function/early-errors-expression-binding-identifier-arguments.js: Added.
4050         (async.arguments):
4051         * test262/test/language/expressions/async-function/early-errors-expression-binding-identifier-eval.js: Added.
4052         (async.eval):
4053         * test262/test/language/expressions/async-function/early-errors-expression-body-contains-super-call.js: Added.
4054         (async.foo):
4055         * test262/test/language/expressions/async-function/early-errors-expression-body-contains-super-property.js: Added.
4056         (async.foo):
4057         * test262/test/language/expressions/async-function/early-errors-expression-eval-in-formal-parameters.js: Added.
4058         (async.foo):
4059         * test262/test/language/expressions/async-function/early-errors-expression-formals-body-duplicate.js: Added.
4060         (async.foo):
4061         * test262/test/language/expressions/async-function/early-errors-expression-formals-contains-super-call.js: Added.
4062         (async.foo):
4063         * test262/test/language/expressions/async-function/early-errors-expression-formals-contains-super-property.js: Added.
4064         (async.foo):
4065         * test262/test/language/expressions/async-function/early-errors-expression-not-simple-assignment-target.js: Added.
4066         (async.foo):
4067         * test262/test/language/expressions/async-function/expression-returns-promise.js: Added.
4068         (p.async):
4069         * test262/test/language/expressions/async-function/syntax-expression-is-PrimaryExpression.js: Added.
4070         (async.foo):
4071         * test262/test/language/expressions/await/await-BindingIdentifier-in-global.js: Added.
4072         (async.await):
4073         * test262/test/language/expressions/await/await-BindingIdentifier-nested.js: Added.
4074         (async.foo.await):
4075         (async.foo):
4076         * test262/test/language/expressions/await/await-awaits-thenable-not-callable.js: Added.
4077         (async.foo):
4078         * test262/test/language/expressions/await/await-awaits-thenables-that-throw.js: Added.
4079         (thenable.then):
4080         (async.foo):
4081         * test262/test/language/expressions/await/await-awaits-thenables.js: Added.
4082         (thenable.then):
4083         (async.foo):
4084         * test262/test/language/expressions/await/await-in-function.js: Added.
4085         (foo):
4086         * test262/test/language/expressions/await/await-in-generator.js: Added.
4087         (foo):
4088         * test262/test/language/expressions/await/await-in-global.js: Added.
4089         * test262/test/language/expressions/await/await-in-nested-function.js: Added.
4090         (async.foo.bar):
4091         (async.foo):
4092         * test262/test/language/expressions/await/await-in-nested-generator.js: Added.
4093         (async.foo.bar):
4094         (async.foo):
4095         * test262/test/language/expressions/await/await-throws-rejections.js: Added.
4096         (async.foo):
4097         * test262/test/language/expressions/await/early-errors-await-not-simple-assignment-target.js: Added.
4098         (async.foo):
4099         * test262/test/language/expressions/await/no-operand.js: Added.
4100         (async.foo):
4101         * test262/test/language/expressions/await/syntax-await-has-UnaryExpression-with-MultiplicativeExpression.js: Added.
4102         (async.foo):
4103         * test262/test/language/expressions/await/syntax-await-has-UnaryExpression.js: Added.
4104         (async.foo):
4105         * test262/test/language/expressions/call/trailing-comma.js: Added.
4106         (foo):
4107         * test262/test/language/expressions/function/arguments-with-arguments-fn.js: Added.
4108         (f):
4109         * test262/test/language/expressions/function/arguments-with-arguments-lex.js: Added.
4110         (f):
4111         * test262/test/language/expressions/function/params-trailing-comma-arguments.js: Added.
4112         (f1):
4113         (f2):
4114         * test262/test/language/expressions/function/params-trailing-comma-length.js: Added.
4115         (assert.sameValue):
4116         * test262/test/language/expressions/function/params-trailing-comma.js: Added.
4117         * test262/test/language/expressions/generators/arguments-with-arguments-fn.js: Added.
4118         (g):
4119         * test262/test/language/expressions/generators/arguments-with-arguments-lex.js: Added.
4120         (g):
4121         * test262/test/language/expressions/generators/params-trailing-comma-arguments.js: Added.
4122         (f1):
4123         (f2):
4124         * test262/test/language/expressions/generators/params-trailing-comma-length.js: Added.
4125         (assert.sameValue):
4126         * test262/test/language/expressions/generators/params-trailing-comma.js: Added.
4127         * test262/test/language/expressions/object/computed-property-evaluation-order.js: Added.
4128         * test262/test/language/expressions/object/method-definition/async-super-call-body.js: Added.
4129         (sup.method):
4130         (child.async.method):
4131         * test262/test/language/expressions/object/method-definition/async-super-call-param.js: Added.
4132         (sup.method):
4133         (child.async.method.x.super.method):
4134         * test262/test/language/expressions/object/method-definition/early-errors-object-method-NSPL-with-USD.js: Added.
4135         (foo):
4136         * test262/test/language/expressions/object/method-definition/early-errors-object-method-arguments-in-formal-parameters.js: Added.
4137         (async.foo):
4138         * test262/test/language/expressions/object/method-definition/early-errors-object-method-await-in-formals-default.js: Added.
4139         (async.foo):
4140         * test262/test/language/expressions/object/method-definition/early-errors-object-method-await-in-formals.js: Added.
4141         (async.foo):
4142         * test262/test/language/expressions/object/method-definition/early-errors-object-method-body-contains-super-call.js: Added.
4143         (async.foo):
4144         * test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js: Added.
4145         (async.foo):
4146         * test262/test/language/expressions/object/method-definition/early-errors-object-method-eval-in-formal-parameters.js: Added.
4147         (async.foo):
4148         * test262/test/language/expressions/object/method-definition/early-errors-object-method-formals-body-duplicate.js: Added.
4149         (async.foo):
4150         * test262/test/language/expressions/object/method-definition/early-errors-object-method-formals-contains-super-call.js: Added.
4151         (async.foo.foo.super):
4152         * test262/test/language/expressions/object/method-definition/object-method-returns-promise.js: Added.
4153         (obj.async.method):
4154         * test262/test/language/expressions/object/method-definition/params-trailing-comma-arguments.js: Added.
4155         (obj.f1):
4156         (obj.f2):
4157         * test262/test/language/expressions/object/method-definition/params-trailing-comma-length.js: Added.
4158         (obj.one):
4159         (obj.two):
4160         * test262/test/language/expressions/object/method-definition/params-trailing-comma-rest.js: Added.
4161         (m):
4162         * test262/test/language/expressions/object/method-definition/params-trailing-comma.js: Added.
4163         (one):
4164         (two):
4165         * test262/test/language/global-code/decl-func-dup.js: Renamed from JSTests/test262/test/language/block-scope/syntax/redeclaration-global/allowed-to-redeclare-function-declaration-with-function-declaration.js.
4166         (f):
4167         * test262/test/language/global-code/decl-func.js: Added.
4168         (brandNew):
4169         * test262/test/language/global-code/decl-lex-configurable-global.js: Added.
4170         * test262/test/language/global-code/decl-lex-deletion.js: Added.
4171         (test262class):
4172         * test262/test/language/global-code/decl-lex-restricted-global.js: Added.
4173         * test262/test/language/global-code/decl-lex.js: Added.
4174         (test262class):
4175         * test262/test/language/global-code/decl-var.js: Added.
4176         * test262/test/language/global-code/return.js: Added.
4177         * test262/test/language/global-code/script-decl-func-dups.js: Added.
4178         * test262/test/language/global-code/script-decl-func-err-non-configurable.js: Added.
4179         * test262/test/language/global-code/script-decl-func-err-non-extensible.js: Added.
4180         * test262/test/language/global-code/script-decl-func.js: Added.
4181         * test262/test/language/global-code/script-decl-lex-deletion.js: Added.
4182         * test262/test/language/global-code/script-decl-lex-lex.js: Added.
4183         (test262Class):
4184         * test262/test/language/global-code/script-decl-lex-restricted-global.js: Added.
4185         * test262/test/language/global-code/script-decl-lex-var.js: Added.
4186         (test262Fn):
4187         * test262/test/language/global-code/script-decl-lex.js: Added.
4188         * test262/test/language/global-code/script-decl-var-collision.js: Added.
4189         (test262Class):
4190         * test262/test/language/global-code/script-decl-var-err.js: Added.
4191         * test262/test/language/global-code/script-decl-var.js: Added.
4192         * test262/test/language/global-code/super-call-arrow.js: Added.
4193         * test262/test/language/global-code/super-call.js: Added.
4194         * test262/test/language/global-code/super-prop-arrow.js: Added.
4195         * test262/test/language/global-code/super-prop.js: Added.
4196         * test262/test/language/global-code/yield-non-strict.js: Added.
4197         (catch):
4198         * test262/test/language/global-code/yield-strict.js: Added.
4199         * test262/test/language/literals/regexp/lastIndex.js: Added.
4200         * test262/test/language/literals/regexp/u-unicode-esc-bounds.js:
4201         * test262/test/language/literals/regexp/y-assertion-start.js: Added.
4202         * test262/test/language/module-code/instn-star-err-not-found-faulty_FIXTURE.js:
4203         * test262/test/language/module-code/instn-star-err-not-found.js:
4204         * test262/test/language/module-code/namespace/internals/get-own-property-str-found-init.js:
4205         * test262/test/language/module-code/parse-err-return.js: Added.
4206         * test262/test/language/module-code/parse-err-yield.js: Added.
4207         * test262/test/language/rest-parameters/params-trailing-comma-rest.js: Added.
4208         * test262/test/language/statements/async-function/declaration-returns-promise.js: Added.
4209         (async.foo):
4210         * test262/test/language/statements/async-function/early-errors-declaration-NSPL-with-USD.js: Added.
4211         (async.foo):
4212         * test262/test/language/statements/async-function/early-errors-declaration-arguments-in-formal-parameters.js: Added.
4213         (async.foo):
4214         * test262/test/language/statements/async-function/early-errors-declaration-await-in-formals-default.js: Added.
4215         (async.foo):
4216         * test262/test/language/statements/async-function/early-errors-declaration-await-in-formals.js: Added.
4217         (async.foo):
4218         * test262/test/language/statements/async-function/early-errors-declaration-binding-identifier-arguments.js: Added.
4219         (async.arguments):
4220         * test262/test/language/statements/async-function/early-errors-declaration-binding-identifier-eval.js: Added.
4221         (async.eval):
4222         * test262/test/language/statements/async-function/early-errors-declaration-body-contains-super-call.js: Added.
4223         (async.foo):
4224         * test262/test/language/statements/async-function/early-errors-declaration-body-contains-super-property.js: Added.
4225         (async.foo):
4226         * test262/test/language/statements/async-function/early-errors-declaration-duplicate-parameters.js: Added.
4227         (async.foo):
4228         * test262/test/language/statements/async-function/early-errors-declaration-eval-in-formal-parameters.js: Added.
4229         (async.foo):
4230         * test262/test/language/statements/async-function/early-errors-declaration-formals-body-duplicate.js: Added.
4231         (async.foo):
4232         * test262/test/language/statements/async-function/early-errors-declaration-formals-contains-super-call.js: Added.
4233         (async.foo):
4234         * test262/test/language/statements/async-function/early-errors-declaration-formals-contains-super-property.js: Added.
4235         (async.foo):
4236         * test262/test/language/statements/async-function/early-errors-no-async-generator.js: Added.
4237         (async.foo):
4238         * test262/test/language/statements/async-function/evaluation-body-that-returns-after-await.js: Added.
4239         (async.foo):
4240         (foo.then):
4241         * test262/test/language/statements/async-function/evaluation-body-that-returns.js: Added.
4242         (async.foo):
4243         (foo.then):
4244         * test262/test/language/statements/async-function/evaluation-body-that-throws-after-await.js: Added.
4245         (async.foo):
4246         (foo.then):
4247         * test262/test/language/statements/async-function/evaluation-body-that-throws.js: Added.
4248         (async.foo):
4249         (foo.then):
4250         * test262/test/language/statements/async-function/evaluation-body.js: Added.
4251         (async.foo):
4252         * test262/test/language/statements/async-function/evaluation-default-that-throws.js: Added.
4253         (async.foo):
4254         (foo.then):
4255         * test262/test/language/statements/async-function/evaluation-mapped-arguments.js: Added.
4256         (async.foo):
4257         * test262/test/language/statements/async-function/evaluation-this-value-global.js: Added.
4258         (async.foo):
4259         * test262/test/language/statements/async-function/evaluation-this-value-passed.js: Added.
4260         (async.foo):
4261         * test262/test/language/statements/async-function/evaluation-unmapped-arguments.js: Added.
4262         (async.foo):
4263         * test262/test/language/statements/async-function/syntax-declaration-line-terminators-allowed.js: Added.
4264         (async.foo):
4265         * test262/test/language/statements/async-function/syntax-declaration-no-line-terminator.js: Added.
4266         (async.foo):
4267         * test262/test/language/statements/async-function/syntax-declaration.js: Added.
4268         (async.foo):
4269         (foo.then):
4270         * test262/test/language/statements/class/definition/class-method-returns-promise.js: Added.
4271         (Foo.prototype.async.method):
4272         (Foo):
4273         * test262/test/language/statements/class/definition/early-errors-class-method-NSPL-with-USD.js: Added.
4274         (Foo.prototype.async.bar):
4275         (Foo):
4276         * test262/test/language/statements/class/definition/early-errors-class-method-arguments-in-formal-parameters.js: Added.
4277         (Foo.prototype.async.foo):
4278         (Foo):
4279         * test262/test/language/statements/class/definition/early-errors-class-method-await-in-formals-default.js: Added.
4280         (Foo.prototype.async.foo):
4281         (Foo):
4282         * test262/test/language/statements/class/definition/early-errors-class-method-await-in-formals.js: Added.
4283         (Foo.prototype.async.foo):
4284         (Foo):
4285         * test262/test/language/statements/class/definition/early-errors-class-method-body-contains-super-call.js: Added.
4286         (Foo.prototype.async.foo):
4287         (Foo):
4288         * test262/test/language/statements/class/definition/early-errors-class-method-duplicate-parameters.js: Added.
4289         (Foo.prototype.async.foo):
4290         (Foo):
4291         * test262/test/language/statements/class/definition/early-errors-class-method-eval-in-formal-parameters.js: Added.
4292         (Foo.prototype.async.foo):
4293         (Foo):
4294         * test262/test/language/statements/class/definition/early-errors-class-method-formals-body-duplicate.js: Added.
4295         (Foo.async.foo):
4296         (Foo):
4297         * test262/test/language/statements/class/definition/early-errors-class-method-formals-contains-super-call.js: Added.
4298         (Foo.prototype.async.foo):
4299         (Foo):
4300         * test262/test/language/statements/class/definition/methods-async-super-call-body.js: Added.
4301         (A.prototype.async.method):
4302         (A):
4303         (B.prototype.async.method):
4304         (B):
4305         * test262/test/language/statements/class/definition/methods-async-super-call-param.js: Added.
4306