9486a3271cfbeb8b519dbade93bf6323e6094836
[WebKit-https.git] / JSTests / ChangeLog
1 2020-03-24  Tadeu Zagallo  <tzagallo@apple.com>
2
3         LLIntGenerator must link switch jumps to otherwise redundant labels
4         https://bugs.webkit.org/show_bug.cgi?id=209333
5         <rdar://problem/60827987>
6
7         Reviewed by Saam Barati.
8
9         * wasm/stress/terminal-jump-switch-target.js: Added.
10
11 2020-03-24  Alexey Shvayka  <shvaikalesh@gmail.com>
12
13         Update test262 to commit dfc7ecc6785e
14         https://bugs.webkit.org/show_bug.cgi?id=209449
15
16         Unreviewed test gardening.
17
18         * test262/expectations.yaml:
19         * test262/harness/propertyHelper.js:
20         * test262/latest-changes-summary.txt:
21         * test262/test/*: Updated.
22         * test262/test262-Revision.txt:
23
24 2020-03-24  Alexey Shvayka  <shvaikalesh@gmail.com>
25
26         Update test262 to commit 79146e5cf48d
27         https://bugs.webkit.org/show_bug.cgi?id=209449
28
29         Reviewed by Keith Miller.
30
31         * test262/config.yaml: Add 3 tests that timeout.
32         * test262/expectations.yaml:
33         * test262/latest-changes-summary.txt:
34         * test262/test/*: Updated.
35         * test262/test262-Revision.txt:
36
37 2020-03-23  Yusuke Suzuki  <ysuzuki@apple.com>
38
39         [JSC] Caller of Delete IC should emit write-barrier onto owner
40         https://bugs.webkit.org/show_bug.cgi?id=209392
41         <rdar://problem/60683173>
42
43         Reviewed by Saam Barati.
44
45         * stress/delete-ic-requires-write-barrier.js: Added.
46         (foo):
47
48 2020-03-23  Yusuke Suzuki  <ysuzuki@apple.com>
49
50         [JSC] DFG OSR exit cannot find StructureStubInfo for put_by_val if CodeBlock is once converved from Baseline to LLInt
51         https://bugs.webkit.org/show_bug.cgi?id=209327
52         <rdar://problem/60631061>
53
54         Reviewed by Saam Barati.
55
56         * stress/osr-exit-attempts-to-find-stubinfo-which-is-cleared-by-previous-baseline-to-llint-conversion.js: Added.
57         (setter):
58         (foo):
59
60 2020-03-23  Ross Kirsling  <ross.kirsling@sony.com>
61
62         Catch parameters must not be lexically redeclared
63         https://bugs.webkit.org/show_bug.cgi?id=208976
64
65         Reviewed by Keith Miller.
66
67         * test262/expectations.yaml:
68         Mark four test cases as passing.
69
70 2020-03-20  Ross Kirsling  <ross.kirsling@sony.com>
71
72         hasObservableSideEffectsForRegExpSplit doesn't check for @@match override
73         https://bugs.webkit.org/show_bug.cgi?id=209363
74
75         Reviewed by Michael Saboff.
76
77         * test262/expectations.yaml:
78         Mark two test cases as passing.
79
80 2020-03-20  Ross Kirsling  <ross.kirsling@sony.com>
81
82         RegExp.prototype[@@replace] doesn't coerce result index to integer
83         https://bugs.webkit.org/show_bug.cgi?id=209323
84
85         Reviewed by Yusuke Suzuki.
86
87         * test262/expectations.yaml:
88         Mark six test cases as passing.
89
90 2020-03-19  Tomas Popela  <tpopela@redhat.com>
91
92         [JSC][BigEndians] Several JSC stress tests failing
93         https://bugs.webkit.org/show_bug.cgi?id=194007
94
95         Reviewed by Michael Catanzaro.
96
97         Adapt the DataView tests to be able to pass on little endian as well
98         as the big endian hardware. Do so by introducing method that determine
99         the endianess and based on its value it saves the expected results in
100         the right format.
101
102         * stress/dataview-get-cse.js:
103         (getIsLittleEndian):
104         (adjustForEndianess):
105         (test3.foo):
106         (test3):
107         * stress/dataview-jit-get.js:
108         (getIsLittleEndian):
109         (test1.adjustForEndianess):
110         (test1):
111         (test2.adjustForEndianess):
112         (test2):
113         (test3.adjustForEndianess):
114         (test3):
115         (adjustForEndianessUint32):
116         (test4):
117         (test5):
118         (test6):
119         (test7):
120         (test8):
121         * stress/dataview-jit-neuter.js:
122         (getIsLittleEndian):
123         (adjustForEndianess):
124         (test):
125         (test2):
126         * stress/dataview-jit-set-nan.js:
127         (getIsLittleEndian):
128         (adjustForEndianessFloat32):
129         (test):
130         * stress/dataview-jit-set.js:
131         (getIsLittleEndian):
132         (readHex):
133         (adjustForEndianessUint16):
134         (test):
135         (test2):
136         (adjustForEndianessUint32):
137         (test3):
138         (test4):
139         (adjustForEndianessFloat32):
140         (test5):
141         (adjustForEndianessFloat64):
142         (test6):
143         (isLittleEndian): Deleted.
144
145 2020-03-18  Yusuke Suzuki  <ysuzuki@apple.com>
146
147         Add a way to mark a rejected promise as handled
148         https://bugs.webkit.org/show_bug.cgi?id=209241
149
150         Reviewed by Michael Saboff.
151
152         * stress/reject-as-handled.js: Added.
153         (shouldBe):
154         (set new):
155
156 2020-03-16  Keith Miller  <keith_miller@apple.com>
157
158         JavaScript identifier grammar supports unescaped astral symbols, but JSC doesn’t
159         https://bugs.webkit.org/show_bug.cgi?id=208998
160
161         Reviewed by Michael Saboff.
162
163         * stress/unicode-identifiers-with-surrogate-pairs.js: Added.
164         (let.c.of.chars.eval.foo):
165         (throwsSyntaxError):
166         (let.c.of.continueChars.throwsSyntaxError.foo):
167
168 2020-03-13  Saam Barati  <sbarati@apple.com>
169
170         skip wasm/function-tests/grow-memory-cause-gc.js on memory limited devices
171         https://bugs.webkit.org/show_bug.cgi?id=209069
172         <rdar://problem/59954558>
173
174         Reviewed by Yusuke Suzuki.
175
176         * wasm/function-tests/grow-memory-cause-gc.js:
177
178 2020-03-13  Alexey Shvayka  <shvaikalesh@gmail.com>
179
180         Bound functions should pass correct NewTarget value
181         https://bugs.webkit.org/show_bug.cgi?id=209057
182
183         Reviewed by Keith Miller.
184
185         * test262/expectations.yaml: Mark 4 test cases as passing.
186
187 2020-03-11  Keith Miller  <keith_miller@apple.com>
188
189         Test262-runner should always consider crashes as new failures
190         https://bugs.webkit.org/show_bug.cgi?id=208943
191
192         Reviewed by Yusuke Suzuki.
193
194         * test262/expectations.yaml:
195
196 2020-03-11  Keith Miller  <keith_miller@apple.com>
197
198         Throws incorrectly a syntax error when declaring a top level catch variable the same as a parameter
199         https://bugs.webkit.org/show_bug.cgi?id=189914
200
201         Reviewed by Saam Barati.
202
203         * ChakraCore/test/es6/globalParamCatchNewTargetSyntaxError.baseline-jsc:
204         * stress/catch-destructuring-shadow-lexical-const-variable-global.js: Added.
205         (catch):
206         * stress/catch-destructuring-shadow-lexical-variable-class.js: Added.
207         (Foo):
208         (Bar):
209         (Baz):
210         * stress/catch-destructuring-shadow-lexical-variable-function.js: Added.
211         (foo):
212         (bar):
213         * stress/catch-destructuring-shadow-lexical-variable-global.js: Added.
214         (catch):
215         * stress/catch-destructuring-shadow-var-global.js: Added.
216         (catch):
217         * test262/expectations.yaml:
218
219 2020-03-10  Ross Kirsling  <ross.kirsling@sony.com>
220
221         Re-import test262 to acquire DST fix
222         https://bugs.webkit.org/show_bug.cgi?id=208901
223
224         Reviewed by Don Olmstead.
225
226         * test262/latest-changes-summary.txt:
227         * test262/test/built-ins/AggregateError/newtarget-proto-fallback.js:
228         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
229         * test262/test/built-ins/Array/prototype/indexOf/15.4.4.14-4-4.js:
230         * test262/test/built-ins/Date/parse/without-utc-offset.js:
231         * test262/test262-Revision.txt:
232
233 2020-03-10  Paulo Matos  <pmatos@igalia.com>
234
235         JSC 32bits is failing on new test stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js
236         https://bugs.webkit.org/show_bug.cgi?id=206864
237
238         Reviewed by Yusuke Suzuki.
239
240         Add new test to memory limited devices - behaviour is the same as 
241         numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js
242         but it creates 25 threads instead of 100.
243
244         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access_memory-limited.js: Added.
245         (let.theCode):
246
247 2020-03-09  Alexey Shvayka  <shvaikalesh@gmail.com>
248
249         @putByValDirect does not perform [[DefineOwnProperty]] correctly
250         https://bugs.webkit.org/show_bug.cgi?id=208708
251
252         Reviewed by Yusuke Suzuki.
253
254         * test262/expectations.yaml: Mark 46 test cases as passing.
255
256 2020-03-09  Caio Lima  <ticaiolima@gmail.com>
257
258         Tail calls are broken on ARM_THUMB2 and MIPS
259         https://bugs.webkit.org/show_bug.cgi?id=197797
260
261         Reviewed by Yusuke Suzuki.
262
263         * stress/tail-call-with-spilled-registers.js: Added.
264
265 2020-03-07  Mark Lam  <mark.lam@apple.com>
266
267         Remove bad assertion in FTLLowerDFGToB3's compileDelBy().
268         https://bugs.webkit.org/show_bug.cgi?id=208764
269         <rdar://problem/59940095>
270
271         Reviewed by Keith Miller.
272
273         * stress/delete-by-val-with-base-and-subscript-using-same-cell.js: Added.
274         * stress/delete-by-val-with-base-and-subscript-using-same-non-cell.js: Added.
275
276 2020-03-06  Yusuke Suzuki  <ysuzuki@apple.com>
277
278         [JSC] Enable public class fields
279         https://bugs.webkit.org/show_bug.cgi?id=208756
280
281         Reviewed by Mark Lam.
282
283         Rename useClassFields to usePublicClassFields to keep separate from usePrivateClassFields once
284         it is implemented.
285
286         * stress/big-int-as-property-name.js:
287         * stress/class-fields-bytecode-cache.js:
288         * stress/class-fields-computed-to-property-key.js:
289         * stress/class-fields-function-name.js:
290         * stress/class-fields-harmony.js:
291         * stress/class-fields-proxy-define-property.js:
292         * stress/class-fields-stress-instance.js:
293         * stress/class-fields-to-property-key-const-string-ftl.js:
294         * stress/class-fields-to-property-key-const-symbol-ftl.js:
295         * stress/class-fields-to-property-key-slow-object-tostring-ftl.js:
296         * stress/class-fields-to-property-key-slow-object-valueof-ftl.js:
297         * stress/class-fields-to-property-key-string-object-ftl.js:
298         * stress/class-fields-to-property-key-string-or-string-object-ftl.js:
299         * stress/generator-syntax.js:
300         * stress/method-name.js:
301         * test262/config.yaml:
302
303 2020-03-06  Alexey Shvayka  <shvaikalesh@gmail.com>
304
305         JSON.stringify should call replacer on deleted properties
306         https://bugs.webkit.org/show_bug.cgi?id=208725
307
308         Reviewed by Ross Kirsling.
309
310         * microbenchmarks/json-stringify-many-objects-to-json.js: Added.
311         * microbenchmarks/json-stringify-many-objects.js: Added.
312         * test262/expectations.yaml: Mark 2 test cases as passing.
313
314 2020-03-04  Mark Lam  <mark.lam@apple.com>
315
316         Handle an out of memory error while constructing the BytecodeGenerator.
317         https://bugs.webkit.org/show_bug.cgi?id=208622
318         <rdar://problem/59341136>
319
320         Reviewed by Saam Barati.
321
322         * stress/out-of-memory-while-constructing-BytecodeGenerator.js: Added.
323
324 2020-03-03  Yusuke Suzuki  <ysuzuki@apple.com>
325
326         [JSC] @hasOwnLengthProperty returns wrong value if "length" is attempted to be modified
327         https://bugs.webkit.org/show_bug.cgi?id=208497
328         <rdar://problem/59913544>
329
330         Reviewed by Mark Lam.
331
332         * stress/function-length-update.js: Added.
333         (shouldBe):
334         (userFunction):
335         (userFunction2):
336
337 2020-03-02  Saam Barati  <sbarati@apple.com>
338
339         Don't skip tests unnecessarily on arm64
340         https://bugs.webkit.org/show_bug.cgi?id=208470
341         <rdar://problem/59968869>
342
343         Reviewed by Tadeu Zagallo.
344
345         * microbenchmarks/bit-test-constant.js:
346         * microbenchmarks/bit-test-nonconstant.js:
347         * microbenchmarks/memcpy-typed-loop-large.js:
348         * microbenchmarks/memcpy-typed-loop-small.js:
349         * microbenchmarks/mul-immediate-sub.js:
350         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
351         * stress/dont-reserve-huge-capacity-lexer.js:
352         * stress/new-largeish-contiguous-array-with-size.js:
353         * stress/sampling-profiler-richards.js:
354         * typeProfiler/deltablue-for-of.js:
355         * typeProfiler/getter-richards.js:
356         * wasm/regress/llint-callee-saves-with-fast-memory.js:
357
358 2020-03-02  Justin Michaud  <justin_michaud@apple.com>
359
360         Delete by val caching does not keep the subscript alive
361         https://bugs.webkit.org/show_bug.cgi?id=208393
362
363         Reviewed by Yusuke Suzuki.
364
365         * stress/delete-property-ic-stress.js: Added.
366
367 2020-02-27  Justin Michaud  <justin_michaud@apple.com>
368
369         Poly proto should work with property delete transitions
370         https://bugs.webkit.org/show_bug.cgi?id=208261
371
372         Reviewed by Saam Barati.
373
374         * stress/delete-property-poly-proto.js: Added.
375         (A.prototype.set x):
376         (A):
377         (B):
378
379 2020-02-27  Ross Kirsling  <ross.kirsling@sony.com>
380
381         Update test262 (2020.02.26)
382         https://bugs.webkit.org/show_bug.cgi?id=208280
383
384         Reviewed by Yusuke Suzuki.
385
386         * test262/config.yaml:
387         * test262/expectations.yaml:
388         * test262/harness/async-gc.js:
389         * test262/latest-changes-summary.txt:
390         * test262/test/:
391         * test262/test262-Revision.txt:
392
393 2020-02-26  Caio Lima  <ticaiolima@gmail.com>
394
395         [JSC][MIPS] Adding support to Checkpoints
396         https://bugs.webkit.org/show_bug.cgi?id=208196
397
398         Reviewed by Yusuke Suzuki.
399
400         * microbenchmarks/memcpy-typed-loop.js:
401
402 2020-02-25  Justin Michaud  <justin_michaud@apple.com>
403
404         Inline Cache delete by id/val
405         https://bugs.webkit.org/show_bug.cgi?id=207522
406
407         Reviewed by Keith Miller and Filip Pizlo. 
408
409         * microbenchmarks/delete-property-from-prototype-chain.js:
410         (delete.C.prototype.z):
411         * microbenchmarks/delete-property-inline-cache-polymorphic.js: Added.
412         (C):
413         (noInline.C.foo):
414         (noInline.foo.F):
415         (noInline.F):
416         * microbenchmarks/delete-property-inline-cache.js: Added.
417         (C):
418         (noInline.C.D):
419         (noInline.D.foo):
420         (noInline.foo.E):
421         (noInline.E.F):
422         (noInline.F):
423         * microbenchmarks/delete-property-keeps-cacheable-structure.js:
424         * stress/delete-property-check-structure-transition.js:
425         (sd): Deleted.
426         (testDeleteIsNotUncacheable): Deleted.
427         (): Deleted.
428         (testCanFlatten): Deleted.
429         (testDeleteWithInlineCache.Object.prototype.globalProperty.42.makeFoo): Deleted.
430         (testDeleteWithInlineCache.noInline.doTest): Deleted.
431         (testDeleteWithInlineCache): Deleted.
432         * stress/delete-property-inline-cache.js: Added.
433         (assert):
434         (assert_eq):
435         (assert_neq):
436         (assert_throws):
437         (noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById.makeFoo):
438         (noInline.assert.noInline.assert_eq.noInline.assert_neq.noInline.assert_throws.testCacheableDeleteById):
439         (noInline.testCacheableDeleteById.testCacheableDeleteByVal.makeFoo2):
440         (noInline.testCacheableDeleteById.testCacheableDeleteByVal):
441         (noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById.makeFoo3):
442         (noInline.testCacheableDeleteByVal.testCacheableEmptyDeleteById):
443         (noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss.makeFoo4):
444         (noInline.testCacheableEmptyDeleteById.testCacheableDeleteByIdMiss):
445         (noInline.testCacheableDeleteByIdMiss.testDeleteIndex.makeFoo5):
446         (noInline.testCacheableDeleteByIdMiss.testDeleteIndex):
447         (noInline.testDeleteIndex.testPolymorphicDelByVal.makeFoo6):
448         (noInline.testDeleteIndex.testPolymorphicDelByVal):
449         (noInline.testPolymorphicDelByVal.testBigintDeleteByVal.makeFoo7):
450         (noInline.testPolymorphicDelByVal.testBigintDeleteByVal):
451         (noInline.testBigintDeleteByVal.testSymbolDeleteByVal.makeFoo8):
452         (noInline.testBigintDeleteByVal.testSymbolDeleteByVal):
453         (noInline.testSymbolDeleteByVal.testObjDeleteByVal.makeFoo9):
454         (noInline.testSymbolDeleteByVal.testObjDeleteByVal):
455         (noInline.testObjDeleteByVal.testStrict.makeFoo10):
456         (noInline.testObjDeleteByVal.testStrict):
457         (noInline.testStrict.testOverride.arr.j):
458         (noInline.testStrict.testOverride):
459         (noInline.testOverride.testNonObject.deleteIt):
460         (noInline.testOverride.testNonObject):
461         (noInline.testNonObject.testNonObjectStrict.deleteIt):
462         (noInline.testNonObject.testNonObjectStrict):
463         (noInline.testNonObjectStrict.testExceptionUnwind.mutateThem):
464         (noInline.testNonObjectStrict.testExceptionUnwind.noInline.deleteIt):
465         (noInline.testNonObjectStrict.testExceptionUnwind):
466         (noInline.testExceptionUnwind.testTDZ):
467         (noInline.testTDZ):
468
469 2020-02-19  Ross Kirsling  <ross.kirsling@sony.com>
470
471         Computed Properties with increment sometimes produces incorrect results
472         https://bugs.webkit.org/show_bug.cgi?id=170934
473
474         Reviewed by Yusuke Suzuki.
475
476         * stress/computed-property-increment.js: Added.
477         * test262/expectations.yaml: Mark two test cases as passing.
478
479 2020-02-19  Keith Miller  <keith_miller@apple.com>
480
481         Disable Wasm reference types by default
482         https://bugs.webkit.org/show_bug.cgi?id=207952
483
484         Reviewed by Mark Lam.
485
486         * wasm/stress/immutable-globals.js:
487         * wasm/stress/local-ref.js:
488         * wasm/stress/mutable-globals.js:
489
490 2020-02-18  Ross Kirsling  <ross.kirsling@sony.com>
491
492         [JSC] Computed function properties compute their keys twice
493         https://bugs.webkit.org/show_bug.cgi?id=207297
494
495         Reviewed by Keith Miller.
496
497         * stress/computed-property-key-side-effects.js: Added.
498         * test262/expectations.yaml: Mark 6 test cases as passing.
499
500 2020-02-17  Yusuke Suzuki  <ysuzuki@apple.com>
501
502         [JSC] JITThunk should be HashSet<Weak<NativeExecutable>> with appropriate GC weakness handling
503         https://bugs.webkit.org/show_bug.cgi?id=207715
504
505         Reviewed by Darin Adler.
506
507         * stress/stress-jitthunks.js: Added.
508         (let.set newGlobal):
509         (set catch):
510
511 2020-02-17  Tadeu Zagallo  <tzagallo@apple.com>
512
513         [Wasm] REGRESSION(r256665): Wasm->JS call IC needs to save memory size register
514         https://bugs.webkit.org/show_bug.cgi?id=207849
515
516         Reviewed by Mark Lam.
517
518         * wasm/regress/regress-256665.js: Added.
519         (f):
520
521 2020-02-14  Tadeu Zagallo  <tzagallo@apple.com>
522
523         Unreviewed: fix broken tests added in r256665
524         https://bugs.webkit.org/show_bug.cgi?id=207727
525
526         Our inline WAT doesn't seem to like named blocks/branch targets.
527
528         * wasm/regress/llint-callee-saves-with-fast-memory.js:
529         * wasm/regress/llint-callee-saves-without-fast-memory.js:
530
531 2020-02-14  Tadeu Zagallo  <tzagallo@apple.com>
532
533         [WASM] Wasm interpreter's calling convention doesn't match Wasm JIT's convention.
534         https://bugs.webkit.org/show_bug.cgi?id=207727
535
536         Reviewed by Mark Lam.
537
538         * wasm/regress/llint-callee-saves-with-fast-memory.js: Added.
539         * wasm/regress/llint-callee-saves-without-fast-memory.js: Added.
540
541 2020-02-13  Caio Lima  <ticaiolima@gmail.com>
542
543         [ESNext][BigInt] We don't support BigInt literal as PropertyName
544         https://bugs.webkit.org/show_bug.cgi?id=206888
545
546         Reviewed by Ross Kirsling.
547
548         * stress/big-int-as-property-name.js: Added.
549
550 2020-02-10  Mark Lam  <mark.lam@apple.com>
551
552         Placate exception check validator in GenericArguments<Type>::put().
553         https://bugs.webkit.org/show_bug.cgi?id=207485
554         <rdar://problem/59302535>
555
556         Reviewed by Robin Morisset.
557
558         * stress/placate-exception-check-validator-in-GenericArguments-put.js: Added.
559
560 2020-02-10  Justin Michaud  <justin_michaud@apple.com>
561
562         arm64_32: microbenchmarks/delete-property-keeps-cacheable-structure.js is timing out
563         https://bugs.webkit.org/show_bug.cgi?id=207484
564
565         Reviewed by Yusuke Suzuki.
566
567         * microbenchmarks/delete-property-keeps-cacheable-structure.js:
568
569 2020-02-10  Mark Lam  <mark.lam@apple.com>
570
571         Missing exception check in GenericArguments<Type>::deletePropertyByIndex().
572         https://bugs.webkit.org/show_bug.cgi?id=207483
573         <rdar://problem/59302616>
574
575         Reviewed by Yusuke Suzuki.
576
577         * stress/missing-exception-check-in-GenericArguments-deletePropertyByIndex.js: Added.
578
579 2020-02-06  Sukolsak Sakshuwong  <sukolsak@gmail.com> and Alexey Shvayka  <shvaikalesh@gmail.com>
580
581         JavaScript string corruption using RegExp with unicode character
582         https://bugs.webkit.org/show_bug.cgi?id=187947
583
584         Reviewed by Yusuke Suzuki.
585
586         This change adds regression test for string corruption that occured after
587         non-BMP character was removed by String.prototype.replace.
588         The issue was fixed in https://trac.webkit.org/changeset/253648/webkit.
589
590         Also, this patch brings back:
591         1. An out-of-order character class range test.
592         2. Dangling and combined surrogates tests (as webkit.org/b/154863 is now resolved).
593
594         * stress/regress-187947.js: Added.
595
596 2020-02-05  Justin Michaud  <justin_michaud@apple.com>
597
598         Deleting a property should not turn structures into uncacheable dictionaries
599         https://bugs.webkit.org/show_bug.cgi?id=206430
600
601         Reviewed by Yusuke Suzuki.
602
603         * microbenchmarks/delete-property-from-prototype-chain.js: Added.
604         (assert):
605         (noInline.assert.getZ):
606         (noInline.getZ.C):
607         (doTest):
608         (delete.C.prototype.z):
609         * microbenchmarks/delete-property-keeps-cacheable-structure.js: Added.
610         (assert):
611         (C):
612         (doTest):
613         * stress/cache-put-by-id-different-attributes.js:
614         (makePrototypeDict):
615         (set x):
616         * stress/cache-put-by-id-different-offset.js:
617         (makePrototypeDict):
618         (set x):
619         * stress/cache-put-by-id-poly-proto.js:
620         (makePrototypeDict):
621         (set _):
622         * stress/delete-property-check-structure-transition.js: Added.
623         (assert):
624         (assert_eq):
625         (assert_neq):
626         (sd):
627         (sid):
628         (testDeleteIsNotUncacheable):
629         (testCanMaterializeDeletes):
630         (testCanFlatten):
631         (testDeleteWithInlineCache.Object.prototype.globalProperty.42.makeFoo):
632         (testDeleteWithInlineCache.noInline.doTest):
633         (testDeleteWithInlineCache):
634         * stress/flatten-object-zero-unused-inline-properties.js:
635
636 2020-02-04  Alexey Shvayka  <shvaikalesh@gmail.com>
637
638         Quantifiers after lookahead assertions should be syntax errors in Unicode patterns only
639         https://bugs.webkit.org/show_bug.cgi?id=206988
640
641         Reviewed by Darin Adler and Ross Kirsling.
642
643         * test262/expectations.yaml: Mark 10 test cases as passing.
644
645 2020-02-03  Alexey Shvayka  <shvaikalesh@gmail.com>
646
647         \0 identity escapes should be syntax errors in Unicode patterns only
648         https://bugs.webkit.org/show_bug.cgi?id=207114
649
650         Reviewed by Darin Adler.
651
652         * test262/expectations.yaml: Mark 2 test cases as passing.
653
654 2020-02-01  Alexey Shvayka  <shvaikalesh@gmail.com>
655
656         Non-alphabetical \c escapes should be syntax errors in Unicode patterns only
657         https://bugs.webkit.org/show_bug.cgi?id=207091
658
659         Reviewed by Darin Adler.
660
661         * test262/expectations.yaml: Mark 4 test cases as passing.
662
663 2020-01-31  Saam Barati  <sbarati@apple.com>
664
665         Unreviewed. Don't dump disassembly in test.
666
667         * stress/get-getter-setter-by-offset-not-always-safe-to-execute.js:
668
669 2020-01-31  Saam Barati  <sbarati@apple.com>
670
671         GetGetterSetterByOffset and GetGetter/GetSetter are not always safe to execute
672         https://bugs.webkit.org/show_bug.cgi?id=206805
673         <rdar://problem/58898161>
674
675         Reviewed by Yusuke Suzuki.
676
677         * stress/get-getter-setter-by-offset-not-always-safe-to-execute.js: Added.
678
679 2020-01-31  Alexey Shvayka  <shvaikalesh@gmail.com>
680
681         Unmatched ] or } brackets should be syntax errors in Unicode patterns only
682         https://bugs.webkit.org/show_bug.cgi?id=207023
683
684         Reviewed by Darin Adler.
685
686         * test262/expectations.yaml: Mark 2 test cases as passing.
687
688 2020-01-30  Alexey Shvayka  <shvaikalesh@gmail.com>
689
690         Incomplete braced quantifiers should be banned in Unicode patterns only
691         https://bugs.webkit.org/show_bug.cgi?id=206776
692
693         Reviewed by Darin Adler.
694
695         Although the change does not affect Unicode property escapes, a few
696         test/built-ins/RegExp/property-escapes/non-existent-property-value*.js files
697         are now passing because they had \\p or \\P instead of CharacterClassEscape.
698
699         * test262/expectations.yaml: Mark 18 test cases as passing.
700
701 2020-01-30  Keith Miller  <keith_miller@apple.com>
702
703         Parser needs to restore unary stack state when backtracking
704         https://bugs.webkit.org/show_bug.cgi?id=206972
705
706         Reviewed by Saam Barati.
707
708         * stress/parser-save-state-remove-stale-entries.js: Added.
709         * stress/parser-syntax-checker-assignments-are-not-resolve-expressions.js: Added.
710         (foo):
711
712 2020-01-29  Mark Lam  <mark.lam@apple.com>
713
714         Fix bad assertion in InternalFunctionAllocationProfile::createAllocationStructureFromBase().
715         https://bugs.webkit.org/show_bug.cgi?id=206981
716         <rdar://problem/58985736>
717
718         Reviewed by Keith Miller.
719
720         * stress/InternalFunctionAllocationProfile-createAllocationStructureFromBase-should-allow-for-same-classInfo-from-different-globals.js: Added.
721
722 2020-01-29  Yusuke Suzuki  <ysuzuki@apple.com>
723
724         Unreviewed, update tests
725         https://bugs.webkit.org/show_bug.cgi?id=206846
726
727         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js.
728         (shouldBe):
729         (putter):
730         (not_string.toString):
731         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js:
732         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten-debug.js: Copied from JSTests/stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js.
733         (shouldBe):
734         (dictionary):
735         (putter):
736         (not_string.toString):
737         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js:
738
739 2020-01-28  Yusuke Suzuki  <ysuzuki@apple.com>
740
741         [JSC] Give up IC when unknown structure transition happens
742         https://bugs.webkit.org/show_bug.cgi?id=206846
743
744         Reviewed by Mark Lam.
745
746         * stress/ensure-crash.js: Added.
747         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition-debug.js: Added.
748         (shouldBe):
749         (putter):
750         (not_string.toString):
751         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior-bad-transition.js: Added.
752         (shouldBe):
753         (putter):
754         (not_string.toString):
755         * stress/incorrect-put-could-generate-invalid-ic-but-still-not-causing-bad-behavior.js: Added.
756         (shouldBe):
757         (putter):
758         (not_string.toString):
759         * stress/incorrect-put-could-generate-invalid-ic-involving-dictionary-flatten.js: Added.
760         (shouldBe):
761         (dictionary):
762         (putter):
763         (not_string.toString):
764
765 2020-01-29  Paulo Matos  <pmatos@igalia.com>
766
767         Skip slow test operand-should-fit-in-abstract-heap-encoded-payload-format.js on mips and arm
768         https://bugs.webkit.org/show_bug.cgi?id=206926
769
770         Unreviewed test gardening.
771
772         This test has quadratic behaviour with the size of a, and on mips and arm it just takes too
773         long to run with such high value of a. Therefore we skip.
774
775         * stress/operand-should-fit-in-abstract-heap-encoded-payload-format.js:
776
777 2020-01-28  Paulo Matos  <pmatos@igalia.com>
778
779         Skip test numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js in arm and mips
780         https://bugs.webkit.org/show_bug.cgi?id=206865
781
782         Reviewed by Žan Doberšek.
783
784         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js:
785
786 2020-01-26  Alexey Shvayka  <shvaikalesh@gmail.com>
787
788         Invalid ranges in character classes should be banned in Unicode patterns only
789         https://bugs.webkit.org/show_bug.cgi?id=206768
790
791         Reviewed by Darin Adler.
792
793         * test262/expectations.yaml: Mark 18 test cases as passing.
794
795 2020-01-24  Mark Lam  <mark.lam@apple.com>
796
797         IntlObject's cached strings should be immortal and safe for concurrent access.
798         https://bugs.webkit.org/show_bug.cgi?id=206779
799         <rdar://problem/58831763>
800
801         Reviewed by Yusuke Suzuki.
802
803         * stress/numberingSystemsForLocale-cached-strings-should-be-immortal-and-safe-for-concurrent-access.js: Added.
804
805 2020-01-24  Yusuke Suzuki  <ysuzuki@apple.com>
806
807         REGRESSION (r254964-r254970?): Catalina Debug JSC bot timing out while running tests
808         https://bugs.webkit.org/show_bug.cgi?id=206785
809
810         Unreviewed, skipping the test if $buildType is "debug".
811
812         * stress/operand-should-fit-in-abstract-heap-encoded-payload-format.js:
813
814 2020-01-23  Yusuke Suzuki  <ysuzuki@apple.com>
815
816         [JSC] DFG OSR exit is not marking CodeBlock::m_hasLinkedOSRExit when the exit target is checkpoint
817         https://bugs.webkit.org/show_bug.cgi?id=206726
818         <rdar://problem/58827849>
819
820         Reviewed by Saam Barati.
821
822         * stress/exit-target-code-block-can-be-changed-between-llint-and-baseline.js: Added.
823         (bar):
824         (foo):
825
826 2020-01-22  Yusuke Suzuki  <ysuzuki@apple.com>
827
828         [JSC] Bits from Operand should fit in bits reserved in AbstractHeap's Payload
829         https://bugs.webkit.org/show_bug.cgi?id=206619
830         <rdar://problem/58270260>
831
832         Reviewed by Keith Miller.
833
834         * stress/operand-should-fit-in-abstract-heap-encoded-payload-format.js: Added.
835
836 2020-01-22  Keith Miller  <keith_miller@apple.com>
837
838         InternalField and CheckNeutered DFG nodes are not always safe to execute
839         https://bugs.webkit.org/show_bug.cgi?id=206632
840
841         Reviewed by Saam Barati.
842
843         * stress/for-of-bad-internal-field-hoist.js: Added.
844         (foo):
845
846 2020-01-22  Yusuke Suzuki  <ysuzuki@apple.com>
847
848         [JSC] DateMath should accept more ISO-8601 timezone designators even if they are not included in ECMA262 to produce expected results in the wild code
849         https://bugs.webkit.org/show_bug.cgi?id=160287
850
851         Reviewed by Ross Kirsling.
852
853         * stress/relaxed-timezone-designators.js: Added.
854         (shouldBe):
855         (parsedDate):
856
857 2020-01-22  Yusuke Suzuki  <ysuzuki@apple.com>
858
859         [JSC] Add CheckArrayOrEmpty to handle the case when hoisting CheckArray for places where input can be empty
860         https://bugs.webkit.org/show_bug.cgi?id=206571
861         <rdar://problem/58757016>
862
863         Reviewed by Saam Barati.
864
865         * stress/check-array-or-empty.js: Added.
866         (C):
867
868 2020-01-21  Tadeu Zagallo  <tzagallo@apple.com>
869
870         Object allocation sinking is missing PutHint for allocations unreachable in the graph
871         https://bugs.webkit.org/show_bug.cgi?id=203799
872         <rdar://problem/56852162>
873
874         Reviewed by Saam Barati.
875
876         * stress/allocation-sinking-puthint-control-flow-2.js: Added.
877         (f.handler.construct):
878         (f):
879
880 2020-01-20  Gus Caplan  <me@gus.host>
881
882         Remove own toString from NativeError prototype
883         https://bugs.webkit.org/show_bug.cgi?id=204629
884
885         Reviewed by Ross Kirsling.
886
887         NativeError prototypes are expected to inherit toString from
888         Error.prototype. See https://github.com/tc39/ecma262/issues/1794
889         for additional details.
890
891         * stress/nativeerror-prototype-tostring.js:
892
893 2020-01-20  Caio Lima  <ticaiolima@gmail.com>
894
895         Skip tests when there is no JIT build on ARMv7 and MIPS
896         https://bugs.webkit.org/show_bug.cgi?id=206496
897
898         Unreviewed gardening.
899
900         * microbenchmarks/bit-test-constant.js:
901         * microbenchmarks/bit-test-nonconstant.js:
902         * microbenchmarks/memcpy-typed-loop-large.js:
903         * microbenchmarks/memcpy-typed-loop-small.js:
904         * microbenchmarks/mul-immediate-sub.js:
905         * stress/dont-range-based-iterate-vector-that-is-mutated.js:
906         * stress/int8-repeat-in-then-out-of-bounds.js:
907         * stress/sampling-profiler-richards.js:
908
909 2020-01-18  Caitlin Potter  <caitp@igalia.com>
910
911         [JSC] add DFG/FTL support for op_to_property_key
912         https://bugs.webkit.org/show_bug.cgi?id=206368
913
914         Reviewed by Saam Barati.
915
916         * stress/class-fields-to-property-key-const-string-ftl.js: Added.
917         * stress/class-fields-to-property-key-const-symbol-ftl.js: Added.
918         * stress/class-fields-to-property-key-slow-object-tostring-ftl.js: Added.
919         * stress/class-fields-to-property-key-slow-object-valueof-ftl.js: Added.
920         * stress/class-fields-to-property-key-string-object-ftl.js: Added.
921         * stress/class-fields-to-property-key-string-or-string-object-ftl.js: Added.
922
923 2020-01-17  Saam Barati  <sbarati@apple.com>
924
925         Air O0 should have better stack allocation
926         https://bugs.webkit.org/show_bug.cgi?id=206436
927
928         Reviewed by Tadeu Zagallo.
929
930         * wasm/stress/dont-stack-overflow-in-air.js: Added.
931
932 2020-01-17  Mark Lam  <mark.lam@apple.com>
933
934         JSModuleLoader's printableModuleKey() should never throw.
935         https://bugs.webkit.org/show_bug.cgi?id=206461
936         <rdar://problem/58696678>
937
938         Reviewed by Michael Saboff.
939
940         * stress/printableModuleKey-should-never-throw.js: Added.
941
942 2020-01-17  Alexey Shvayka  <shvaikalesh@gmail.com>
943
944         JSON.parse should lookup prototype chains during revival
945         https://bugs.webkit.org/show_bug.cgi?id=205769
946
947         Reviewed by Saam Barati.
948
949         * test262/expectations.yaml: Mark 4 test cases as passing.
950
951 2020-01-16  Robin Morisset  <rmorisset@apple.com>
952
953         [ESNext] Enables a way to throw an error on ByteCodeGenerator step
954         https://bugs.webkit.org/show_bug.cgi?id=180139
955
956         Reviewed by Mark Lam.
957
958         * stress/eval-huge-big-int-memory-overflow.js: Added.
959
960 2020-01-16  Keith Miller  <keith_miller@apple.com>
961
962         Reland bytecode checkpoints since bugs have been fixed
963         https://bugs.webkit.org/show_bug.cgi?id=206361
964
965         Unreviewed, reland.
966
967         The watch bugs have been fixed by https://trac.webkit.org/changeset/254674
968
969         * stress/apply-osr-exit-should-get-length-once-exceptions-occasionally.js: Added.
970         (expectedArgCount):
971         (callee):
972         (test):
973         (let.array.get length):
974         * stress/apply-osr-exit-should-get-length-once.js: Added.
975         (expectedArgCount):
976         (callee):
977         (test):
978         (let.array.get length):
979         * stress/load-varargs-then-inlined-call-and-exit-strict.js:
980         (checkEqual):
981         * stress/recursive-tail-call-with-different-argument-count.js:
982         * stress/rest-varargs-osr-exit-to-checkpoint.js: Added.
983         (foo):
984         (bar):
985
986 2020-01-16  Keith Miller  <keith_miller@apple.com>
987
988         Revert 254725 since it breaks tests
989         https://bugs.webkit.org/show_bug.cgi?id=206391
990
991         Unreviewed, revert.
992
993         * stress/allocation-sinking-puthint-control-flow-2.js: Removed.
994
995 2020-01-16  Tadeu Zagallo  <tzagallo@apple.com>
996
997         Object allocation sinking is missing PutHint for allocations unreachable in the graph
998         https://bugs.webkit.org/show_bug.cgi?id=203799
999         <rdar://problem/56852162>
1000
1001         Reviewed by Saam Barati.
1002
1003         * stress/allocation-sinking-puthint-control-flow-2.js: Added.
1004         (f.handler.construct):
1005         (f):
1006
1007 2020-01-16  Robin Morisset  <rmorisset@apple.com>
1008
1009         Teach the bytecode that arithmetic operations can return bigints
1010         https://bugs.webkit.org/show_bug.cgi?id=205416
1011
1012         Reviewed by Yusuke Suzuki.
1013
1014         This file crashes in debug mode without the fix.
1015
1016         * stress/big-int-arithmetic-return-big-int.js: Added.
1017         (fooAdd):
1018         (fooSub):
1019         (fooMul):
1020         (fooDiv):
1021
1022 2020-01-16  Mark Lam  <mark.lam@apple.com>
1023
1024         operationToObject() should check for a null errorMessage.
1025         https://bugs.webkit.org/show_bug.cgi?id=206339
1026         <rdar://problem/58449666>
1027
1028         Reviewed by Yusuke Suzuki.
1029
1030         * stress/operationToObject-should-check-for-null-errorMessage.js: Added.
1031
1032 2020-01-15  Caitlin Potter <caitp@igalia.com>
1033
1034         [JSC] Add support for public class fields
1035         https://bugs.webkit.org/show_bug.cgi?id=174212
1036
1037         Reviewed by Yusuke Suzuki.
1038
1039         New syntax invalidates some test expectations:
1040
1041         "async <linefeed> MethodDefinition" is no longer an unexpected "async"
1042         token. It is now an instance field named "async" with no initializer,
1043         and an automatic semicolon, followed by MethodDefinition.
1044
1045         "get|set GeneratorMethodDefinition"'s error message has changed, due to "get"
1046         being valid class field names.
1047
1048         Many class-syntax tests relating to automatic semicolon insertion are
1049         no longer valid, as a line containing nothing but an identifier is now
1050         a valid class element.
1051
1052         * stress/async-await-syntax.js:
1053         * stress/class-fields-bytecode-cache.js: Added.
1054         * stress/class-fields-computed-to-property-key.js: Added.
1055         * stress/class-fields-function-name.js: Added.
1056         * stress/class-fields-harmony.js: Added.
1057         * stress/class-fields-proxy-define-property.js: Added.
1058         * stress/class-fields-stress-instance.js: Added.
1059         * stress/generator-syntax.js:
1060         * stress/method-name.js:
1061         * test262/config.yaml:
1062
1063 2020-01-15  Keith Miller  <keith_miller@apple.com>
1064
1065         Revert bytecode checkpoints since it breaks watch
1066         https://bugs.webkit.org/show_bug.cgi?id=206301
1067
1068         Unreviewed, revert.
1069
1070 2020-01-15  Alexey Shvayka  <shvaikalesh@gmail.com>
1071
1072         Object.preventExtensions should throw if not successful
1073         https://bugs.webkit.org/show_bug.cgi?id=206131
1074
1075         Reviewed by Ross Kirsling.
1076
1077         * test262/expectations.yaml: Mark 2 test cases as passing.
1078
1079 2020-01-14  Commit Queue  <commit-queue@webkit.org>
1080
1081         Unreviewed, rolling out r254480, r254496, and r254517.
1082         https://bugs.webkit.org/show_bug.cgi?id=206278
1083
1084         "It regressed JetStream2 and Speedometer2" (Requested by
1085         saamyjoon on #webkit).
1086
1087         Reverted changesets:
1088
1089         "Throw away baseline code if there is an optimized
1090         replacement"
1091         https://bugs.webkit.org/show_bug.cgi?id=202503
1092         https://trac.webkit.org/changeset/254480
1093
1094         "Unreviewed. Change useLLInt=0 to forceBaseline=1"
1095         https://trac.webkit.org/changeset/254496
1096
1097         "Add an option that enables/disables throwing away baseline
1098         JIT code"
1099         https://bugs.webkit.org/show_bug.cgi?id=206244
1100         https://trac.webkit.org/changeset/254517
1101
1102 2020-01-13  Saam Barati  <sbarati@apple.com>
1103
1104         Unreviewed. Change useLLInt=0 to forceBaseline=1
1105
1106         * stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js:
1107
1108 2020-01-13  Keith Miller  <keith_miller@apple.com>
1109
1110         scanSideState scans too much side state
1111         https://bugs.webkit.org/show_bug.cgi?id=206166
1112
1113         Reviewed by Tadeu Zagallo.
1114
1115         * stress/checkpoint-side-state-gc-tmps-overflow.js: Added.
1116         (v8):
1117
1118 2020-01-13  Saam Barati  <sbarati@apple.com>
1119
1120         Throw away baseline code if there is an optimized replacement
1121         https://bugs.webkit.org/show_bug.cgi?id=202503
1122
1123         Reviewed by Yusuke Suzuki.
1124
1125         * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js:
1126         * stress/getter-setter-inlining-should-emit-movhint.js:
1127         * stress/make-dictionary-repatch.js:
1128         * stress/merging-ic-variants-should-bail-if-structures-overlap.js:
1129         * stress/proxy-getter-stack-overflow.js:
1130         * stress/regress-192717.js:
1131         * stress/retry-cache-later.js:
1132
1133 2020-01-13  Mark Lam  <mark.lam@apple.com>
1134
1135         Replace uses of Box<Identifier> with a new CacheableIdentifier class.
1136         https://bugs.webkit.org/show_bug.cgi?id=205544
1137         <rdar://problem/58041800>
1138
1139         Reviewed by Saam Barati.
1140
1141         * stress/racy-gc-cleanup-of-identifier-after-mutator-stops-running.js: Added.
1142
1143 2020-01-11  Keith Miller  <keith_miller@apple.com>
1144
1145         CheckNeutered needs to claim it reads JSType in clobberize.
1146         https://bugs.webkit.org/show_bug.cgi?id=206136
1147
1148         Reviewed by Yusuke Suzuki.
1149
1150         * stress/check-neutered-clobberize-reads-jstype.js: Added.
1151         (foo):
1152
1153 2020-01-12  Yusuke Suzuki  <ysuzuki@apple.com>
1154
1155         [JSC] Use internal object field mechanism to implement JSStringIterator
1156         https://bugs.webkit.org/show_bug.cgi?id=206144
1157
1158         Reviewed by Ross Kirsling.
1159
1160         * stress/string-iterators.js:
1161         * stress/tailCallForwardArguments.js:
1162         (putFuncToPrivateName.createBuiltin):
1163         (createTailCallForwardingFuncWith):
1164
1165 2020-01-10  Yusuke Suzuki  <ysuzuki@apple.com>
1166
1167         [JSC] Flush old tables in End phase
1168         https://bugs.webkit.org/show_bug.cgi?id=206120
1169         <rdar://problem/58039989>
1170
1171         Reviewed by Mark Lam.
1172
1173         * stress/create-many-realms.js: Added.
1174         (foo):
1175
1176 2020-01-10  Caitlin Potter  <caitp@igalia.com> and Alexey Shvayka  <shvaikalesh@gmail.com>
1177
1178         Object.keys should throw if called on module namespace object with uninitialized binding
1179         https://bugs.webkit.org/show_bug.cgi?id=205983
1180
1181         Reviewed by Yusuke Suzuki.
1182
1183         * test262/expectations.yaml: Mark 2 test cases as passing.
1184
1185 2020-01-10  Saam Barati  <sbarati@apple.com>
1186
1187         ObjectAllocationSinkingPhase doesn't model pointers to allocations in control flow properly
1188         https://bugs.webkit.org/show_bug.cgi?id=204738
1189         <rdar://problem/57553238>
1190
1191         Reviewed by Yusuke Suzuki.
1192
1193         * stress/allocation-sinking-must-model-allocation-pointers-properly-2.js: Added.
1194         (assert):
1195         (v9):
1196         * stress/allocation-sinking-must-model-allocation-pointers-properly-3.js: Added.
1197         (assert):
1198         (v9):
1199         * stress/allocation-sinking-must-model-allocation-pointers-properly-4.js: Added.
1200         (bool):
1201         (effects):
1202         (escape):
1203         (bar):
1204         * stress/allocation-sinking-must-model-allocation-pointers-properly.js: Added.
1205         (alwaysFalse):
1206         (sometimesZero):
1207         (assert):
1208         (v9):
1209
1210 2020-01-08  Keith Miller  <keith_miller@apple.com>
1211
1212         [JSC] Introduce JSArrayIterator
1213         https://bugs.webkit.org/show_bug.cgi?id=204043
1214
1215         Reviewed by Yusuke Suzuki.
1216
1217         * stress/array-iterator-materialize-at-osr-exit.js: Added.
1218         (shouldBe):
1219         (test):
1220         * stress/array-iterator-materialize-one-path.js: Added.
1221         (shouldBe):
1222         (test):
1223         * stress/array-iterator-materialize.js: Added.
1224         (shouldBe):
1225         (test):
1226         * stress/array-iterator-sinking.js: Added.
1227         (shouldBe):
1228         (test):
1229         * stress/array-iterators-next-error-messages.js:
1230         (catch):
1231         * stress/array-iterators-next-with-call.js:
1232         * stress/for-of-iteration.js: Added.
1233         (shouldBe):
1234         (test1):
1235         (test2):
1236         (test3):
1237         * stress/typedarray-functions-with-neutered.js:
1238         (checkProtoFunc):
1239
1240 2020-01-08  Saam Barati  <sbarati@apple.com>
1241
1242         Unreviewed follow up on r254188. I accidentally included the same test
1243         twice instead of including the two different variants.
1244
1245         * stress/ai-value-mod-should-result-in-constant-int-where-possible.js:
1246
1247 2020-01-08  Alexey Shvayka  <shvaikalesh@gmail.com>
1248
1249         Proxy's [[OwnPropertyKeys]] is correct only in PropertyNameMode::StringsAndSymbols
1250         https://bugs.webkit.org/show_bug.cgi?id=205772
1251
1252         Reviewed by Ross Kirsling.
1253
1254         * test262/expectations.yaml: Mark 12 test cases as passing.
1255
1256 2020-01-08  Alexey Shvayka  <shvaikalesh@gmail.com>
1257
1258         RegExp.prototype[Symbol.replace] does not support named capture groups
1259         https://bugs.webkit.org/show_bug.cgi?id=205783
1260
1261         Reviewed by Ross Kirsling.
1262
1263         * test262/expectations.yaml: Mark 6 test cases as passing.
1264
1265 2020-01-07  Saam Barati  <sbarati@apple.com>
1266
1267         AI rule for ValueMod/ValueDiv produce constants with the wrong format when the result can be an int32
1268         https://bugs.webkit.org/show_bug.cgi?id=205906
1269         <rdar://problem/56108519>
1270
1271         Reviewed by Yusuke Suzuki.
1272
1273         * stress/ai-value-div-should-result-in-constant-int-where-possible.js: Added.
1274         (foo.bar.f):
1275         (foo.):
1276         (foo):
1277         * stress/ai-value-mod-should-result-in-constant-int-where-possible.js: Added.
1278         (foo.bar.f):
1279         (foo.):
1280         (foo):
1281
1282 2020-01-06  Alexey Shvayka  <shvaikalesh@gmail.com>
1283
1284         String.prototype.replace() incorrectly handles named references on RegExp w/o named groups
1285         https://bugs.webkit.org/show_bug.cgi?id=205785
1286
1287         Reviewed by Ross Kirsling.
1288
1289         * test262/expectations.yaml: Mark 2 test cases as passing.
1290
1291 2020-01-06  Alexey Shvayka  <shvaikalesh@gmail.com>
1292
1293         Proxy's [[OwnPropertyKeys]] is incorrect in DontEnumPropertiesMode::Exclude
1294         https://bugs.webkit.org/show_bug.cgi?id=203818
1295
1296         Reviewed by Keith Miller.
1297
1298         Stress test was failing because "ownKeys" trap didn't return non-configurable
1299         "prototype" property of Proxy's target, violating an invariant.
1300
1301         * stress/proxy-get-own-property-names-should-not-clear-previous-results.js:
1302         * test262/expectations.yaml: Mark 8 test cases as passing.
1303
1304 2020-01-04  Alexey Shvayka  <shvaikalesh@gmail.com>
1305
1306         JSON.parse should initialize wrapper object with [[DefineOwnProperty]]
1307         https://bugs.webkit.org/show_bug.cgi?id=205767
1308
1309         Reviewed by Darin Adler.
1310
1311         * test262/expectations.yaml: Mark 2 test cases as passing.
1312
1313 2020-01-03  Keith Miller  <keith_miller@apple.com>
1314
1315         Update test262 tests to commit 157b18d
1316         https://bugs.webkit.org/show_bug.cgi?id=205741
1317
1318         Reviewed by Yusuke Suzuki.
1319
1320         * test262/expectations.yaml:
1321         * test262/harness/deepEqual.js:
1322         (assert.deepEqual):
1323         (assert.deepEqual.format):
1324         (deepEqual):
1325         (compareEquality):
1326         (compareIf):
1327         (tryCompareStrictEquality):
1328         (tryCompareTypeOfEquality):
1329         (tryCompareToStringTagEquality):
1330         (isOptional):
1331         (compareOptionality):
1332         (isPrimitiveEquatable):
1333         (comparePrimitiveEquality):
1334         (isNaNEquatable):
1335         (compareNaNEquality):
1336         (isObjectEquatable):
1337         (compareObjectEquality):
1338         (isBoxed):
1339         (isValueOfEquatable):
1340         (compareValueOfEquality):
1341         (isToStringEquatable):
1342         (compareToStringEquality):
1343         (isArrayLikeEquatable):
1344         (isStructurallyEquatable):
1345         (isIterableEquatable):
1346         (compareIteratorEquality):
1347         (compareIterableEquality):
1348         (cacheComparison):
1349         (fail):
1350         (setCache):
1351         (getCache):
1352         (assert.deepEqual._compare):
1353         * test262/latest-changes-summary.txt:
1354         * test262/test/built-ins/AggregateError: Added.
1355         * test262/test/built-ins/AggregateError/errors-iterabletolist-failures.js: Added.
1356         (case1.get Symbol):
1357         (case2.get Symbol):
1358         (case3.Symbol.iterator):
1359         (case4.Symbol.iterator):
1360         (case5.Symbol.iterator):
1361         (case6.Symbol.iterator.return.get next):
1362         (case6.Symbol.iterator):
1363         (case7.Symbol.iterator.return.get next):
1364         (case7.Symbol.iterator):
1365         (case8.Symbol.iterator):
1366         (case9.Symbol.iterator):
1367         (case10.Symbol.iterator):
1368         (case11.Symbol.iterator.return.next.return.get done):
1369         (case11.Symbol.iterator):
1370         * test262/test/built-ins/AggregateError/errors-iterabletolist.js: Added.
1371         (case1.Symbol.iterator.return.next.return.get value):
1372         (case1.Symbol.iterator):
1373         * test262/test/built-ins/AggregateError/length.js: Added.
1374         * test262/test/built-ins/AggregateError/message-method-prop-cast.js: Added.
1375         (toString):
1376         * test262/test/built-ins/AggregateError/message-method-prop.js: Added.
1377         * test262/test/built-ins/AggregateError/message-tostring-abrupt-symbol.js: Added.
1378         (case2.Symbol.toPrimitive):
1379         (case2.toString):
1380         (case2.valueOf):
1381         * test262/test/built-ins/AggregateError/message-tostring-abrupt.js: Added.
1382         (case1.Symbol.toPrimitive):
1383         (case1.toString):
1384         (case1.valueOf):
1385         (case2.toString):
1386         (case2.valueOf):
1387         (case3.valueOf):
1388         * test262/test/built-ins/AggregateError/message-undefined-no-prop.js: Added.
1389         * test262/test/built-ins/AggregateError/name.js: Added.
1390         * test262/test/built-ins/AggregateError/newtarget-proto-custom.js: Added.
1391         (newt.new.Proxy):
1392         (newt.new.Proxy.get if):
1393         * test262/test/built-ins/AggregateError/newtarget-proto-fallback.js: Added.
1394         (ctor):
1395         (const.value.of.values.get t):
1396         * test262/test/built-ins/AggregateError/newtarget-proto.js: Added.
1397         * test262/test/built-ins/AggregateError/prop-desc.js: Added.
1398         * test262/test/built-ins/AggregateError/proto.js: Added.
1399         * test262/test/built-ins/AggregateError/prototype: Added.
1400         * test262/test/built-ins/AggregateError/prototype/constructor.js: Added.
1401         * test262/test/built-ins/AggregateError/prototype/errors: Added.
1402         * test262/test/built-ins/AggregateError/prototype/errors/invoked-as-accessor.js: Added.
1403         * test262/test/built-ins/AggregateError/prototype/errors/invoked-as-func.js: Added.
1404         * test262/test/built-ins/AggregateError/prototype/errors/length.js: Added.
1405         * test262/test/built-ins/AggregateError/prototype/errors/name.js: Added.
1406         * test262/test/built-ins/AggregateError/prototype/errors/prop-desc.js: Added.
1407         * test262/test/built-ins/AggregateError/prototype/errors/return-from-iterable-errors.js: Added.
1408         (errors.Symbol.iterator.return.next.return.get value):
1409         (errors.Symbol.iterator):
1410         * test262/test/built-ins/AggregateError/prototype/errors/return-new-array-from-list.js: Added.
1411         * test262/test/built-ins/AggregateError/prototype/errors/this-has-no-typedarrayname-internal.js: Added.
1412         * test262/test/built-ins/AggregateError/prototype/errors/this-is-not-object.js: Added.
1413         * test262/test/built-ins/AggregateError/prototype/message.js: Added.
1414         * test262/test/built-ins/AggregateError/prototype/name.js: Added.
1415         * test262/test/built-ins/AggregateError/prototype/prop-desc.js: Added.
1416         * test262/test/built-ins/AggregateError/prototype/proto.js: Added.
1417         * test262/test/built-ins/Array/prototype/copyWithin/coerced-values-start-change-start.js: Added.
1418         (longDenseArray):
1419         (shorten):
1420         * test262/test/built-ins/Array/prototype/copyWithin/coerced-values-start-change-target.js: Added.
1421         (longDenseArray):
1422         (shorten):
1423         * test262/test/built-ins/Array/prototype/flatMap/this-value-ctor-object-species-bad-throws.js:
1424         * test262/test/built-ins/Atomics/add/bigint/nonshared-int-views.js:
1425         (testWithBigIntTypedArrayConstructors):
1426         * test262/test/built-ins/Atomics/and/bigint/nonshared-int-views.js:
1427         (testWithBigIntTypedArrayConstructors):
1428         * test262/test/built-ins/Atomics/compareExchange/bigint/nonshared-int-views.js:
1429         (testWithBigIntTypedArrayConstructors):
1430         * test262/test/built-ins/Atomics/exchange/bigint/nonshared-int-views.js:
1431         (testWithBigIntTypedArrayConstructors):
1432         * test262/test/built-ins/Atomics/or/bigint/nonshared-int-views.js:
1433         (testWithBigIntTypedArrayConstructors):
1434         * test262/test/built-ins/Atomics/store/bigint/nonshared-int-views.js:
1435         (testWithBigIntTypedArrayConstructors):
1436         * test262/test/built-ins/Atomics/sub/bigint/nonshared-int-views.js:
1437         (testWithBigIntTypedArrayConstructors):
1438         * test262/test/built-ins/Error/prototype/toString/invalid-receiver.js: Added.
1439         (Symbol.forEach):
1440         * test262/test/built-ins/Error/prototype/toString/undefined-props.js: Added.
1441         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-unregister.js:
1442         (emptyCells):
1443         (emptyCells.then):
1444         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-throws-in-callback.js: Added.
1445         (fg.new.FinalizationGroup):
1446         (callback):
1447         (emptyCells):
1448         (emptyCells.then):
1449         * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-same-as-target.js:
1450         * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself.js:
1451         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target.js:
1452         * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregister-cleaned-up-cell.js: Added.
1453         (fg.new.FinalizationGroup):
1454         (emptyCells):
1455         (emptyCells.then):
1456         * test262/test/built-ins/FinalizationGroup/target-not-callable-throws.js:
1457         * test262/test/built-ins/JSON/parse/reviver-array-get-prop-from-prototype.js: Added.
1458         * test262/test/built-ins/JSON/parse/reviver-array-non-configurable-prop-create.js: Added.
1459         * test262/test/built-ins/JSON/parse/reviver-array-non-configurable-prop-delete.js: Added.
1460         * test262/test/built-ins/JSON/parse/reviver-call-order.js: Added.
1461         * test262/test/built-ins/JSON/parse/reviver-object-get-prop-from-prototype.js: Added.
1462         * test262/test/built-ins/JSON/parse/reviver-object-non-configurable-prop-create.js: Added.
1463         * test262/test/built-ins/JSON/parse/reviver-object-non-configurable-prop-delete.js: Added.
1464         * test262/test/built-ins/JSON/parse/reviver-wrapper.js: Added.
1465         * test262/test/built-ins/JSON/stringify/property-order.js: Added.
1466         * test262/test/built-ins/Object/entries/return-order.js: Added.
1467         * test262/test/built-ins/Object/freeze/throws-when-false.js: Added.
1468         (preventExtensions):
1469         * test262/test/built-ins/Object/getOwnPropertyNames/proxy-invariant-absent-not-configurable-symbol-key.js: Added.
1470         (ownKeys):
1471         * test262/test/built-ins/Object/getOwnPropertyNames/proxy-invariant-duplicate-symbol-entry.js: Added.
1472         (ownKeys):
1473         * test262/test/built-ins/Object/getOwnPropertyNames/proxy-invariant-not-extensible-absent-symbol-key.js: Added.
1474         (ownKeys):
1475         * test262/test/built-ins/Object/getOwnPropertyNames/proxy-invariant-not-extensible-extra-symbol-key.js: Added.
1476         (ownKeys):
1477         * test262/test/built-ins/Object/getOwnPropertySymbols/length.js:
1478         * test262/test/built-ins/Object/getOwnPropertySymbols/name.js:
1479         * test262/test/built-ins/Object/getOwnPropertySymbols/object-contains-symbol-property-with-description.js:
1480         * test262/test/built-ins/Object/getOwnPropertySymbols/object-contains-symbol-property-without-description.js:
1481         * test262/test/built-ins/Object/getOwnPropertySymbols/proxy-invariant-absent-not-configurable-string-key.js: Added.
1482         (ownKeys):
1483         * test262/test/built-ins/Object/getOwnPropertySymbols/proxy-invariant-duplicate-string-entry.js: Added.
1484         (ownKeys):
1485         * test262/test/built-ins/Object/getOwnPropertySymbols/proxy-invariant-not-extensible-absent-string-key.js: Added.
1486         (ownKeys):
1487         * test262/test/built-ins/Object/getOwnPropertySymbols/proxy-invariant-not-extensible-extra-string-key.js: Added.
1488         (ownKeys):
1489         * test262/test/built-ins/Object/keys/proxy-non-enumerable-prop-invariant-2.js:
1490         * test262/test/built-ins/Object/keys/proxy-non-enumerable-prop-invariant-3.js: Added.
1491         (ownKeys):
1492         * test262/test/built-ins/Object/keys/return-order.js: Added.
1493         * test262/test/built-ins/Object/preventExtensions/throws-when-false.js: Added.
1494         (preventExtensions):
1495         * test262/test/built-ins/Object/prototype/isPrototypeOf/arg-is-proxy.js: Added.
1496         (handler.allowProxyTraps.getPrototypeOf):
1497         * test262/test/built-ins/Object/prototype/isPrototypeOf/builtin.js: Added.
1498         * test262/test/built-ins/Object/prototype/isPrototypeOf/length.js: Added.
1499         * test262/test/built-ins/Object/prototype/isPrototypeOf/name.js:
1500         * test262/test/built-ins/Object/prototype/isPrototypeOf/null-this-and-object-arg-throws.js: Added.
1501         * test262/test/built-ins/Object/prototype/isPrototypeOf/null-this-and-primitive-arg-returns-false.js: Added.
1502         * test262/test/built-ins/Object/prototype/isPrototypeOf/this-value-is-in-prototype-chain-of-arg.js: Added.
1503         (USER_FACTORY.this.getName):
1504         (USER_FACTORY):
1505         (this.getGrade):
1506         (FORCEDUSER_FACTORY):
1507         * test262/test/built-ins/Object/prototype/isPrototypeOf/undefined-this-and-object-arg-throws.js: Added.
1508         * test262/test/built-ins/Object/prototype/isPrototypeOf/undefined-this-and-primitive-arg-returns-false.js: Added.
1509         * test262/test/built-ins/Object/seal/throws-when-false.js: Added.
1510         (preventExtensions):
1511         * test262/test/built-ins/Object/values/return-order.js: Added.
1512         * test262/test/built-ins/Proxy/has/call-in-prototype-index.js: Added.
1513         (handler.allowProxyTraps.has):
1514         * test262/test/built-ins/Proxy/has/call-in-prototype.js:
1515         * test262/test/built-ins/Proxy/ownKeys/call-parameters-object-keys.js:
1516         (handler.ownKeys):
1517         * test262/test/built-ins/Proxy/set/call-parameters-prototype-index.js: Added.
1518         * test262/test/built-ins/Reflect/preventExtensions/target-is-not-object-throws.js:
1519         * test262/test/built-ins/RegExp/match-indices/indices-array-element.js:
1520         * test262/test/built-ins/RegExp/match-indices/indices-array-matched.js:
1521         * test262/test/built-ins/RegExp/match-indices/indices-array-non-unicode-match.js:
1522         * test262/test/built-ins/RegExp/match-indices/indices-array-properties.js:
1523         * test262/test/built-ins/RegExp/match-indices/indices-array-unicode-match.js:
1524         * test262/test/built-ins/RegExp/match-indices/indices-array-unicode-property-names.js:
1525         * test262/test/built-ins/RegExp/match-indices/indices-array-unmatched.js:
1526         * test262/test/built-ins/RegExp/match-indices/indices-array.js:
1527         * test262/test/built-ins/RegExp/match-indices/indices-groups-object-unmatched.js:
1528         * test262/test/built-ins/RegExp/match-indices/indices-groups-object.js:
1529         * test262/test/built-ins/RegExp/match-indices/indices-groups-properties.js:
1530         * test262/test/built-ins/RegExp/match-indices/indices-property.js:
1531         * test262/test/built-ins/String/prototype/replaceAll: Added.
1532         * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x0024.js: Added.
1533         * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x0026.js: Added.
1534         * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x0027.js: Added.
1535         * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x003C.js: Added.
1536         * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024-0x0060.js: Added.
1537         * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024.js: Added.
1538         * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024N.js: Added.
1539         * test262/test/built-ins/String/prototype/replaceAll/getSubstitution-0x0024NN.js: Added.
1540         * test262/test/built-ins/String/prototype/replaceAll/length.js: Added.
1541         * test262/test/built-ins/String/prototype/replaceAll/name.js: Added.
1542         * test262/test/built-ins/String/prototype/replaceAll/replaceAll.js: Added.
1543         * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-abrupt.js: Added.
1544         (custom):
1545         * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-each-match-position.js: Added.
1546         (t):
1547         (replaceValue):
1548         * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-matching-empty.js: Added.
1549         (t):
1550         (replaceValue):
1551         * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-skip-no-match.js: Added.
1552         (replaceValue):
1553         * test262/test/built-ins/String/prototype/replaceAll/replaceValue-call-tostring-abrupt.js: Added.
1554         (custom):
1555         (symbol):
1556         * test262/test/built-ins/String/prototype/replaceAll/replaceValue-fn-skip-toString.js: Added.
1557         (replaceValue):
1558         (value):
1559         * test262/test/built-ins/String/prototype/replaceAll/replaceValue-tostring-abrupt.js: Added.
1560         (thisValue.toString):
1561         (searchValue.toString):
1562         (replaceValue.toString):
1563         * test262/test/built-ins/String/prototype/replaceAll/replaceValue-value-replaces-string.js: Added.
1564         * test262/test/built-ins/String/prototype/replaceAll/replaceValue-value-tostring.js: Added.
1565         (replaceValue.Symbol.toPrimitive):
1566         (replaceValue.toString):
1567         (replaceValue.valueOf):
1568         * test262/test/built-ins/String/prototype/replaceAll/searchValue-empty-string-this-empty-string.js: Added.
1569         * test262/test/built-ins/String/prototype/replaceAll/searchValue-empty-string.js: Added.
1570         * test262/test/built-ins/String/prototype/replaceAll/searchValue-flags-no-g-throws.js: Added.
1571         (poison.toString):
1572         * test262/test/built-ins/String/prototype/replaceAll/searchValue-flags-null-undefined-throws.js: Added.
1573         (poison.toString):
1574         (searchValue.get flags):
1575         * test262/test/built-ins/String/prototype/replaceAll/searchValue-flags-toString-abrupt.js: Added.
1576         (poison.toString):
1577         (searchValue.toString):
1578         (searchValue.flags.toString):
1579         * test262/test/built-ins/String/prototype/replaceAll/searchValue-get-flags-abrupt.js: Added.
1580         (searchValue.get flags):
1581         (poison.toString):
1582         * test262/test/built-ins/String/prototype/replaceAll/searchValue-isRegExp-abrupt.js: Added.
1583         (searchValue.get Symbol):
1584         (searchValue.toString):
1585         (poison.toString):
1586         * test262/test/built-ins/String/prototype/replaceAll/searchValue-replace-method-abrupt.js: Added.
1587         (poison.toString):
1588         (searchValue.get Symbol):
1589         (searchValue.toString):
1590         * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-RegExp-call-fn.js: Added.
1591         (RE.prototype.Symbol.replace):
1592         (RE.prototype.toString):
1593         (RE):
1594         (const.t):
1595         (getFn.return.replaceValueFn):
1596         (getFn):
1597         * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-RegExp-call.js: Added.
1598         (RE.prototype.Symbol.replace):
1599         (RE.prototype.toString):
1600         (RE):
1601         * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-before-tostring.js: Added.
1602         (value):
1603         (poison.toString):
1604         * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-call-abrupt.js: Added.
1605         (poison.toString):
1606         (searchValue.Symbol.replace):
1607         (searchValue.toString):
1608         * test262/test/built-ins/String/prototype/replaceAll/searchValue-replacer-call.js: Added.
1609         (value):
1610         * test262/test/built-ins/String/prototype/replaceAll/searchValue-tostring-abrupt.js: Added.
1611         (poison.toString):
1612         (thisValue.toString):
1613         (searchValue.toString):
1614         * test262/test/built-ins/String/prototype/replaceAll/searchValue-tostring-regexp.js: Added.
1615         * test262/test/built-ins/String/prototype/replaceAll/this-is-null-throws.js: Added.
1616         * test262/test/built-ins/String/prototype/replaceAll/this-is-undefined-throws.js: Added.
1617         * test262/test/built-ins/String/prototype/replaceAll/this-tostring-abrupt.js: Added.
1618         (poison.toString):
1619         (thisValue.toString):
1620         (searchValue.toString):
1621         * test262/test/built-ins/String/prototype/replaceAll/this-tostring.js: Added.
1622         (thisValue.Symbol.toPrimitive):
1623         (thisValue.toString):
1624         (thisValue.valueOf):
1625         * test262/test/built-ins/TypedArray/from/mapfn-is-not-callable.js:
1626         * test262/test/built-ins/TypedArray/prototype/slice/BigInt/speciesctor-get-species-custom-ctor-length-throws.js:
1627         (testWithBigIntTypedArrayConstructors):
1628         * test262/test/built-ins/TypedArray/prototype/slice/BigInt/speciesctor-get-species-custom-ctor-length.js:
1629         (testWithBigIntTypedArrayConstructors):
1630         * test262/test/built-ins/TypedArray/prototype/slice/speciesctor-get-species-custom-ctor-length-throws.js:
1631         (testWithTypedArrayConstructors):
1632         * test262/test/built-ins/TypedArray/prototype/slice/speciesctor-get-species-custom-ctor-length.js:
1633         (testWithTypedArrayConstructors):
1634         * test262/test/built-ins/TypedArrayConstructors/from/nan-conversion.js:
1635         * test262/test/built-ins/TypedArrayConstructors/from/new-instance-from-zero.js:
1636         * test262/test/built-ins/TypedArrayConstructors/of/BigInt/inherited.js:
1637         (testWithBigIntTypedArrayConstructors):
1638         * test262/test/built-ins/TypedArrayConstructors/of/inherited.js:
1639         (testWithTypedArrayConstructors):
1640         * test262/test/built-ins/WeakRef/prototype-from-newtarget-abrupt.js:
1641         * test262/test/harness/deepEqual-array.js:
1642         * test262/test/harness/deepEqual-circular.js:
1643         * test262/test/harness/deepEqual-deep.js:
1644         * test262/test/harness/deepEqual-mapset.js:
1645         * test262/test/harness/deepEqual-object.js:
1646         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle-dateStyle.js: Added.
1647         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle-default.js: Added.
1648         (locales.forEach):
1649         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle-timeStyle.js: Added.
1650         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/hourCycle.js:
1651         * test262/test/intl402/DisplayNames: Added.
1652         * test262/test/intl402/DisplayNames/ctor-custom-get-prototype-poison-throws.js: Added.
1653         (custom.new.Proxy.new.Function.get if):
1654         (custom.new.Proxy.new.Function):
1655         * test262/test/intl402/DisplayNames/ctor-custom-prototype.js: Added.
1656         * test262/test/intl402/DisplayNames/ctor-default-prototype.js: Added.
1657         * test262/test/intl402/DisplayNames/instance-extensible.js: Added.
1658         * test262/test/intl402/DisplayNames/length.js: Added.
1659         * test262/test/intl402/DisplayNames/locales-invalid-throws.js: Added.
1660         * test262/test/intl402/DisplayNames/locales-length-poison-throws.js: Added.
1661         * test262/test/intl402/DisplayNames/locales-length-tolength-throws.js: Added.
1662         (locales.length.valueOf):
1663         (locales.length.Symbol.toPrimitive):
1664         (locales.length.toString):
1665         * test262/test/intl402/DisplayNames/locales-symbol-length.js: Added.
1666         * test262/test/intl402/DisplayNames/name.js: Added.
1667         * test262/test/intl402/DisplayNames/options-fallback-abrupt-throws.js: Added.
1668         * test262/test/intl402/DisplayNames/options-fallback-invalid-throws.js: Added.
1669         * test262/test/intl402/DisplayNames/options-fallback-toString-abrupt-throws.js: Added.
1670         (options.fallback.toString):
1671         (options.fallback.valueOf):
1672         (options.fallback.Symbol.toPrimitive):
1673         * test262/test/intl402/DisplayNames/options-fallback-valid.js: Added.
1674         * test262/test/intl402/DisplayNames/options-localeMatcher-abrupt-throws.js: Added.
1675         * test262/test/intl402/DisplayNames/options-localeMatcher-invalid-throws.js: Added.
1676         * test262/test/intl402/DisplayNames/options-localeMatcher-toString-abrupt-throws.js: Added.
1677         (options.localeMatcher.toString):
1678         (options.localeMatcher.valueOf):
1679         (options.localeMatcher.Symbol.toPrimitive):
1680         * test262/test/intl402/DisplayNames/options-localeMatcher-valid.js: Added.
1681         * test262/test/intl402/DisplayNames/options-null-throws.js: Added.
1682         * test262/test/intl402/DisplayNames/options-random-properties-unchecked.js: Added.
1683         * test262/test/intl402/DisplayNames/options-style-abrupt-throws.js: Added.
1684         * test262/test/intl402/DisplayNames/options-style-invalid-throws.js: Added.
1685         * test262/test/intl402/DisplayNames/options-style-toString-abrupt-throws.js: Added.
1686         (options.style.toString):
1687         (options.style.valueOf):
1688         (options.style.Symbol.toPrimitive):
1689         * test262/test/intl402/DisplayNames/options-style-valid.js: Added.
1690         * test262/test/intl402/DisplayNames/options-type-abrupt-throws.js: Added.
1691         * test262/test/intl402/DisplayNames/options-type-invalid-throws.js: Added.
1692         * test262/test/intl402/DisplayNames/options-type-toString-abrupt-throws.js: Added.
1693         (options.type.toString):
1694         (options.type.valueOf):
1695         (options.type.Symbol.toPrimitive):
1696         * test262/test/intl402/DisplayNames/options-type-valid.js: Added.
1697         * test262/test/intl402/DisplayNames/prop-desc.js: Added.
1698         * test262/test/intl402/DisplayNames/proto-from-ctor-realm.js: Added.
1699         * test262/test/intl402/DisplayNames/proto.js: Added.
1700         * test262/test/intl402/DisplayNames/prototype: Added.
1701         * test262/test/intl402/DisplayNames/prototype/Symbol.toStringTag.js: Added.
1702         * test262/test/intl402/DisplayNames/prototype/prop-desc.js: Added.
1703         * test262/test/intl402/DisplayNames/prototype/resolvedOptions: Added.
1704         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/default-option-values.js: Added.
1705         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/length.js: Added.
1706         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/name.js: Added.
1707         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/option-fallback.js: Added.
1708         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/option-style.js: Added.
1709         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/option-type.js: Added.
1710         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/prop-desc.js: Added.
1711         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/return-object.js: Added.
1712         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/this-not-object-throws.js: Added.
1713         * test262/test/intl402/DisplayNames/prototype/resolvedOptions/this-object-lacks-internal-throws.js: Added.
1714         * test262/test/intl402/DisplayNames/undefined-newtarget-throws.js: Added.
1715         * test262/test/language/destructuring/binding/syntax/property-list-single-name-bindings.js:
1716         * test262/test/language/expressions/addition/bigint-and-number.js:
1717         * test262/test/language/expressions/addition/bigint-arithmetic.js:
1718         * test262/test/language/expressions/addition/bigint-errors.js:
1719         * test262/test/language/expressions/addition/bigint-toprimitive.js:
1720         * test262/test/language/expressions/addition/bigint-wrapped-values.js:
1721         * test262/test/language/expressions/arrow-function/eval-var-scope-syntax-err.js: Added.
1722         (f.a.eval):
1723         * test262/test/language/expressions/arrow-function/scope-param-elem-var-close.js:
1724         * test262/test/language/expressions/arrow-function/scope-param-elem-var-open.js:
1725         * test262/test/language/expressions/arrow-function/scope-param-rest-elem-var-close.js:
1726         * test262/test/language/expressions/arrow-function/scope-param-rest-elem-var-open.js:
1727         * test262/test/language/expressions/async-arrow-function/eval-var-scope-syntax-err.js: Added.
1728         (f.async a):
1729         (SyntaxError.then):
1730         * test262/test/language/expressions/async-function/named-eval-var-scope-syntax-err.js: Added.
1731         (f.async f):
1732         (f):
1733         * test262/test/language/expressions/async-function/nameless-eval-var-scope-syntax-err.js: Added.
1734         * test262/test/language/expressions/async-generator/eval-var-scope-syntax-err.js: Added.
1735         * test262/test/language/expressions/async-generator/named-eval-var-scope-syntax-err.js: Added.
1736         (f.async g):
1737         (f):
1738         * test262/test/language/expressions/bitwise-and/bigint-and-number.js:
1739         * test262/test/language/expressions/bitwise-and/bigint-errors.js:
1740         * test262/test/language/expressions/bitwise-and/bigint-non-primitive.js:
1741         * test262/test/language/expressions/bitwise-and/bigint-toprimitive.js:
1742         * test262/test/language/expressions/bitwise-and/bigint-wrapped-values.js:
1743         * test262/test/language/expressions/bitwise-not/bigint-non-primitive.js:
1744         * test262/test/language/expressions/bitwise-or/bigint-and-number.js:
1745         * test262/test/language/expressions/bitwise-or/bigint-errors.js:
1746         * test262/test/language/expressions/bitwise-or/bigint-non-primitive.js:
1747         * test262/test/language/expressions/bitwise-or/bigint-toprimitive.js:
1748         * test262/test/language/expressions/bitwise-or/bigint-wrapped-values.js:
1749         * test262/test/language/expressions/bitwise-xor/bigint-and-number.js:
1750         * test262/test/language/expressions/bitwise-xor/bigint-errors.js:
1751         * test262/test/language/expressions/bitwise-xor/bigint-non-primitive.js:
1752         * test262/test/language/expressions/bitwise-xor/bigint-toprimitive.js:
1753         * test262/test/language/expressions/bitwise-xor/bigint-wrapped-values.js:
1754         * test262/test/language/expressions/class/async-gen-method-static/eval-var-scope-syntax-err.js: Added.
1755         (C):
1756         * test262/test/language/expressions/class/async-gen-method/eval-var-scope-syntax-err.js: Added.
1757         (C):
1758         * test262/test/language/expressions/class/async-method-static/eval-var-scope-syntax-err.js: Added.
1759         (C):
1760         (then):
1761         * test262/test/language/expressions/class/async-method/eval-var-scope-syntax-err.js: Added.
1762         (C):
1763         (SyntaxError.then):
1764         * test262/test/language/expressions/class/elements/syntax/early-errors/grammar-private-field-optional-chaining.js: Added.
1765         (C.prototype.access):
1766         * test262/test/language/expressions/class/gen-method-static/eval-var-scope-syntax-err.js: Added.
1767         (C):
1768         * test262/test/language/expressions/class/gen-method/eval-var-scope-syntax-err.js: Added.
1769         (C):
1770         * test262/test/language/expressions/class/method-static/eval-var-scope-syntax-err.js: Added.
1771         (C):
1772         * test262/test/language/expressions/class/method/eval-var-scope-syntax-err.js: Added.
1773         (C):
1774         * test262/test/language/expressions/coalesce/cannot-chain-head-with-logical-and.js:
1775         * test262/test/language/expressions/coalesce/cannot-chain-head-with-logical-or.js:
1776         * test262/test/language/expressions/coalesce/cannot-chain-tail-with-logical-and.js:
1777         * test262/test/language/expressions/coalesce/cannot-chain-tail-with-logical-or.js:
1778         * test262/test/language/expressions/delete/super-property.js:
1779         (C):
1780         * test262/test/language/expressions/division/bigint-and-number.js:
1781         * test262/test/language/expressions/division/bigint-arithmetic.js:
1782         * test262/test/language/expressions/division/bigint-complex-infinity.js:
1783         * test262/test/language/expressions/division/bigint-errors.js:
1784         * test262/test/language/expressions/division/bigint-toprimitive.js:
1785         * test262/test/language/expressions/division/bigint-wrapped-values.js:
1786         * test262/test/language/expressions/does-not-equals/bigint-and-bigint.js:
1787         * test262/test/language/expressions/does-not-equals/bigint-and-boolean.js:
1788         * test262/test/language/expressions/does-not-equals/bigint-and-incomparable-primitive.js:
1789         * test262/test/language/expressions/does-not-equals/bigint-and-non-finite.js:
1790         * test262/test/language/expressions/does-not-equals/bigint-and-number-extremes.js:
1791         * test262/test/language/expressions/does-not-equals/bigint-and-number.js:
1792         * test262/test/language/expressions/does-not-equals/bigint-and-object.js:
1793         * test262/test/language/expressions/does-not-equals/bigint-and-string.js:
1794         * test262/test/language/expressions/equals/bigint-and-bigint.js:
1795         * test262/test/language/expressions/equals/bigint-and-boolean.js:
1796         * test262/test/language/expressions/equals/bigint-and-incomparable-primitive.js:
1797         * test262/test/language/expressions/equals/bigint-and-non-finite.js:
1798         * test262/test/language/expressions/equals/bigint-and-number-extremes.js:
1799         * test262/test/language/expressions/equals/bigint-and-number.js:
1800         * test262/test/language/expressions/equals/bigint-and-object.js:
1801         * test262/test/language/expressions/equals/bigint-and-string.js:
1802         * test262/test/language/expressions/exponentiation/bigint-and-number.js:
1803         * test262/test/language/expressions/exponentiation/bigint-arithmetic.js:
1804         * test262/test/language/expressions/exponentiation/bigint-errors.js:
1805         * test262/test/language/expressions/exponentiation/bigint-negative-exponent-throws.js:
1806         * test262/test/language/expressions/exponentiation/bigint-toprimitive.js:
1807         * test262/test/language/expressions/exponentiation/bigint-wrapped-values.js:
1808         * test262/test/language/expressions/exponentiation/bigint-zero-base-zero-exponent.js:
1809         * test262/test/language/expressions/function/eval-var-scope-syntax-err.js: Added.
1810         (f):
1811         * test262/test/language/expressions/function/scope-param-elem-var-close.js:
1812         * test262/test/language/expressions/function/scope-param-elem-var-open.js:
1813         * test262/test/language/expressions/function/scope-param-rest-elem-var-close.js:
1814         * test262/test/language/expressions/function/scope-param-rest-elem-var-open.js:
1815         * test262/test/language/expressions/generators/eval-var-scope-syntax-err.js: Added.
1816         (f):
1817         * test262/test/language/expressions/generators/scope-param-elem-var-close.js:
1818         * test262/test/language/expressions/generators/scope-param-elem-var-open.js:
1819         * test262/test/language/expressions/generators/scope-param-rest-elem-var-close.js:
1820         * test262/test/language/expressions/generators/scope-param-rest-elem-var-open.js:
1821         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js:
1822         * test262/test/language/expressions/greater-than-or-equal/bigint-and-incomparable-string.js:
1823         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js:
1824         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js:
1825         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1826         * test262/test/language/expressions/greater-than-or-equal/bigint-and-string.js:
1827         * test262/test/language/expressions/greater-than/bigint-and-bigint.js:
1828         * test262/test/language/expressions/greater-than/bigint-and-boolean.js:
1829         * test262/test/language/expressions/greater-than/bigint-and-incomparable-string.js:
1830         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js:
1831         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js:
1832         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1833         * test262/test/language/expressions/greater-than/bigint-and-symbol.js:
1834         * test262/test/language/expressions/left-shift/bigint-and-number.js:
1835         * test262/test/language/expressions/left-shift/bigint-errors.js:
1836         * test262/test/language/expressions/left-shift/bigint-non-primitive.js:
1837         * test262/test/language/expressions/left-shift/bigint-toprimitive.js:
1838         * test262/test/language/expressions/left-shift/bigint-wrapped-values.js:
1839         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js:
1840         * test262/test/language/expressions/less-than-or-equal/bigint-and-incomparable-string.js:
1841         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js:
1842         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js:
1843         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1844         * test262/test/language/expressions/less-than-or-equal/bigint-and-string.js:
1845         * test262/test/language/expressions/less-than/bigint-and-bigint.js:
1846         * test262/test/language/expressions/less-than/bigint-and-boolean.js:
1847         * test262/test/language/expressions/less-than/bigint-and-incomparable-string.js:
1848         * test262/test/language/expressions/less-than/bigint-and-non-finite.js:
1849         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js:
1850         * test262/test/language/expressions/less-than/bigint-and-number.js:
1851         * test262/test/language/expressions/modulus/bigint-and-number.js:
1852         * test262/test/language/expressions/modulus/bigint-arithmetic.js:
1853         * test262/test/language/expressions/modulus/bigint-errors.js:
1854         * test262/test/language/expressions/modulus/bigint-modulo-zero.js:
1855         * test262/test/language/expressions/modulus/bigint-toprimitive.js:
1856         * test262/test/language/expressions/modulus/bigint-wrapped-values.js:
1857         * test262/test/language/expressions/multiplication/bigint-and-number.js:
1858         * test262/test/language/expressions/multiplication/bigint-arithmetic.js:
1859         * test262/test/language/expressions/multiplication/bigint-errors.js:
1860         * test262/test/language/expressions/multiplication/bigint-toprimitive.js:
1861         * test262/test/language/expressions/multiplication/bigint-wrapped-values.js:
1862         * test262/test/language/expressions/object/method-definition/async-gen-meth-eval-var-scope-syntax-err.js: Added.
1863         (obj.async method):
1864         * test262/test/language/expressions/object/method-definition/async-meth-eval-var-scope-syntax-err.js: Added.
1865         (obj.async method):
1866         (SyntaxError.then):
1867         * test262/test/language/expressions/object/method-definition/gen-meth-eval-var-scope-syntax-err.js: Added.
1868         (obj.method.a.eval):
1869         * test262/test/language/expressions/object/method-definition/meth-eval-var-scope-syntax-err.js: Added.
1870         (obj.method.a.eval):
1871         * test262/test/language/expressions/object/scope-gen-meth-param-elem-var-close.js:
1872         * test262/test/language/expressions/object/scope-gen-meth-param-elem-var-open.js:
1873         * test262/test/language/expressions/object/scope-gen-meth-param-rest-elem-var-close.js:
1874         * test262/test/language/expressions/object/scope-gen-meth-param-rest-elem-var-open.js:
1875         * test262/test/language/expressions/object/scope-meth-param-elem-var-close.js:
1876         * test262/test/language/expressions/object/scope-meth-param-elem-var-open.js:
1877         * test262/test/language/expressions/object/scope-meth-param-rest-elem-var-close.js:
1878         * test262/test/language/expressions/object/scope-meth-param-rest-elem-var-open.js:
1879         * test262/test/language/expressions/optional-chaining/iteration-statement-do.js: Added.
1880         * test262/test/language/expressions/optional-chaining/iteration-statement-for-await-of.js: Added.
1881         (const.obj.iterable.Symbol.asyncIterator):
1882         (async checkAssertions):
1883         * test262/test/language/expressions/optional-chaining/iteration-statement-for-in.js: Added.
1884         * test262/test/language/expressions/optional-chaining/iteration-statement-for-of-type-error.js: Added.
1885         * test262/test/language/expressions/optional-chaining/iteration-statement-for.js: Added.
1886         (const.obj3.get a):
1887         * test262/test/language/expressions/optional-chaining/iteration-statement-while.js: Added.
1888         * test262/test/language/expressions/optional-chaining/new-target-optional-call.js: Added.
1889         (const.newTargetContext):
1890         (Base):
1891         (Foo):
1892         * test262/test/language/expressions/optional-chaining/optional-call-preserves-this.js: Added.
1893         (const.a.b):
1894         * test262/test/language/expressions/optional-chaining/super-property-optional-call.js: Added.
1895         (Base.prototype.method):
1896         (Base):
1897         (Foo.prototype.method):
1898         (Foo):
1899         * test262/test/language/expressions/right-shift/bigint-and-number.js:
1900         * test262/test/language/expressions/right-shift/bigint-errors.js:
1901         * test262/test/language/expressions/right-shift/bigint-non-primitive.js:
1902         * test262/test/language/expressions/right-shift/bigint-toprimitive.js:
1903         * test262/test/language/expressions/right-shift/bigint-wrapped-values.js:
1904         * test262/test/language/expressions/strict-does-not-equals/bigint-and-bigint.js:
1905         * test262/test/language/expressions/strict-does-not-equals/bigint-and-boolean.js:
1906         * test262/test/language/expressions/strict-does-not-equals/bigint-and-incomparable-primitive.js:
1907         * test262/test/language/expressions/strict-does-not-equals/bigint-and-non-finite.js:
1908         * test262/test/language/expressions/strict-does-not-equals/bigint-and-number-extremes.js:
1909         * test262/test/language/expressions/strict-does-not-equals/bigint-and-number.js:
1910         * test262/test/language/expressions/strict-does-not-equals/bigint-and-object.js:
1911         * test262/test/language/expressions/strict-does-not-equals/bigint-and-string.js:
1912         * test262/test/language/expressions/strict-equals/bigint-and-bigint.js:
1913         * test262/test/language/expressions/strict-equals/bigint-and-boolean.js:
1914         * test262/test/language/expressions/strict-equals/bigint-and-incomparable-primitive.js:
1915         * test262/test/language/expressions/strict-equals/bigint-and-non-finite.js:
1916         * test262/test/language/expressions/strict-equals/bigint-and-number-extremes.js:
1917         * test262/test/language/expressions/strict-equals/bigint-and-number.js:
1918         * test262/test/language/expressions/strict-equals/bigint-and-object.js:
1919         * test262/test/language/expressions/strict-equals/bigint-and-string.js:
1920         * test262/test/language/expressions/subtraction/bigint-and-number.js:
1921         * test262/test/language/expressions/subtraction/bigint-arithmetic.js:
1922         * test262/test/language/expressions/subtraction/bigint-errors.js:
1923         * test262/test/language/expressions/subtraction/bigint-toprimitive.js:
1924         * test262/test/language/expressions/subtraction/bigint-wrapped-values.js:
1925         * test262/test/language/expressions/typeof/proxy.js: Added.
1926         (assert.sameValue.typeof.new.Proxy):
1927         (const.rp2.Proxy.revocable):
1928         * test262/test/language/expressions/unary-minus/bigint-non-primitive.js:
1929         * test262/test/language/expressions/unary-plus/bigint-throws.js:
1930         * test262/test/language/expressions/unsigned-right-shift/bigint-and-number.js:
1931         * test262/test/language/expressions/unsigned-right-shift/bigint-errors.js:
1932         * test262/test/language/expressions/unsigned-right-shift/bigint-non-primitive.js:
1933         * test262/test/language/expressions/unsigned-right-shift/bigint-toprimitive.js:
1934         * test262/test/language/expressions/unsigned-right-shift/bigint-wrapped-values.js:
1935         * test262/test/language/function-code/eval-param-env-with-computed-key.js:
1936         * test262/test/language/function-code/eval-param-env-with-prop-initializer.js:
1937         * test262/test/language/statements/async-function/eval-var-scope-syntax-err.js: Added.
1938         (async f):
1939         (SyntaxError.then):
1940         * test262/test/language/statements/async-generator/eval-var-scope-syntax-err.js: Added.
1941         (async f):
1942         * test262/test/language/statements/class/async-gen-method-static/eval-var-scope-syntax-err.js: Added.
1943         (C.async method):
1944         (C):
1945         * test262/test/language/statements/class/async-gen-method/eval-var-scope-syntax-err.js: Added.
1946         (C.prototype.async method):
1947         (C):
1948         * test262/test/language/statements/class/async-method-static/eval-var-scope-syntax-err.js: Added.
1949         (C.async method):
1950         (C):
1951         (SyntaxError.then):
1952         * test262/test/language/statements/class/async-method/eval-var-scope-syntax-err.js: Added.
1953         (C.prototype.async method):
1954         (C):
1955         (SyntaxError.then):
1956         * test262/test/language/statements/class/definition/constructable-but-no-prototype.js:
1957         * test262/test/language/statements/class/definition/constructor-strict-by-default.js:
1958         * test262/test/language/statements/class/definition/getters-restricted-ids.js:
1959         * test262/test/language/statements/class/definition/implicit-constructor.js:
1960         * test262/test/language/statements/class/definition/invalid-extends.js:
1961         * test262/test/language/statements/class/definition/methods-named-eval-arguments.js:
1962         * test262/test/language/statements/class/definition/prototype-getter.js:
1963         * test262/test/language/statements/class/definition/prototype-property.js:
1964         * test262/test/language/statements/class/definition/setters-restricted-ids.js:
1965         * test262/test/language/statements/class/definition/side-effects-in-extends.js:
1966         * test262/test/language/statements/class/definition/side-effects-in-property-define.js:
1967         * test262/test/language/statements/class/definition/this-access-restriction-2.js:
1968         * test262/test/language/statements/class/definition/this-access-restriction.js:
1969         * test262/test/language/statements/class/definition/this-check-ordering.js:
1970         * test262/test/language/statements/class/elements/syntax/early-errors/grammar-private-field-optional-chaining.js: Added.
1971         (C.prototype.access):
1972         (C):
1973         * test262/test/language/statements/class/gen-method-static/eval-var-scope-syntax-err.js: Added.
1974         (C.method):
1975         (C):
1976         * test262/test/language/statements/class/gen-method/eval-var-scope-syntax-err.js: Added.
1977         (C.prototype.method):
1978         (C):
1979         * test262/test/language/statements/class/method-static/eval-var-scope-syntax-err.js: Added.
1980         (C.method):
1981         (C):
1982         * test262/test/language/statements/class/method/eval-var-scope-syntax-err.js: Added.
1983         (C.prototype.method):
1984         (C):
1985         * test262/test/language/statements/class/name-binding/basic.js:
1986         * test262/test/language/statements/class/subclass/binding.js:
1987         * test262/test/language/statements/class/subclass/builtin-objects/RegExp/lastIndex.js:
1988         * test262/test/language/statements/class/subclass/builtin-objects/String/length.js:
1989         * test262/test/language/statements/class/subclass/builtin-objects/WeakMap/regular-subclassing.js:
1990         * test262/test/language/statements/class/subclass/builtin-objects/WeakMap/super-must-be-called.js:
1991         * test262/test/language/statements/class/subclass/builtin-objects/WeakSet/regular-subclassing.js:
1992         * test262/test/language/statements/class/subclass/builtin-objects/WeakSet/super-must-be-called.js:
1993         * test262/test/language/statements/class/subclass/builtins.js:
1994         * test262/test/language/statements/class/subclass/default-constructor-spread-override.js:
1995         * test262/test/language/statements/for-in/identifier-let-allowed-as-lefthandside-expression-not-strict.js:
1996         * test262/test/language/statements/for-in/order-enumerable-shadowed.js: Added.
1997         * test262/test/language/statements/for-in/order-property-added.js: Added.
1998         * test262/test/language/statements/for-in/order-property-on-prototype.js: Added.
1999         * test262/test/language/statements/for-in/order-simple-object.js: Added.
2000         * test262/test/language/statements/function/eval-var-scope-syntax-err.js: Added.
2001         (f):
2002         * test262/test/language/statements/function/scope-param-elem-var-close.js:
2003         * test262/test/language/statements/function/scope-param-elem-var-open.js:
2004         * test262/test/language/statements/function/scope-param-rest-elem-var-close.js:
2005         * test262/test/language/statements/function/scope-param-rest-elem-var-open.js:
2006         * test262/test/language/statements/generators/eval-var-scope-syntax-err.js: Added.
2007         (f):
2008         * test262/test/language/statements/generators/scope-param-elem-var-close.js:
2009         * test262/test/language/statements/generators/scope-param-elem-var-open.js:
2010         * test262/test/language/statements/generators/scope-param-rest-elem-var-close.js:
2011         * test262/test/language/statements/generators/scope-param-rest-elem-var-open.js:
2012         * test262/test262-Revision.txt:
2013
2014 2020-01-03  Saam Barati  <sbarati@apple.com>
2015
2016         B3::ReduceLoopStrength should not do range based iteration on a vector it's mutating
2017         https://bugs.webkit.org/show_bug.cgi?id=205703
2018         <rdar://problem/56459483>
2019
2020         Reviewed by Mark Lam.
2021
2022         * stress/dont-range-based-iterate-vector-that-is-mutated.js: Added.
2023         (foo):
2024
2025 2020-01-03  Saam Barati  <sbarati@apple.com>
2026
2027         AI rule for PutById can only observe transitions when it watches the condition
2028         https://bugs.webkit.org/show_bug.cgi?id=205697
2029         <rdar://problem/56814254>
2030
2031         Reviewed by Yusuke Suzuki.
2032
2033         * stress/only-transition-structures-for-put-by-id-in-AI-if-watchable.js: Added.
2034
2035 2020-01-02  Yusuke Suzuki  <ysuzuki@apple.com>
2036
2037         REGRESSION (r253867): Six test262 tests broken
2038         https://bugs.webkit.org/show_bug.cgi?id=205583
2039
2040         Reviewed by Mark Lam.
2041
2042         * stress/bound-function-empty-name.js: Added.
2043         (shouldBe):
2044
2045 2019-12-23  Keith Miller  <keith_miller@apple.com>
2046
2047         DFG/FTL should be able to exit to the middle of a bytecode
2048         https://bugs.webkit.org/show_bug.cgi?id=205232
2049
2050         Reviewed by Saam Barati.
2051
2052         * stress/apply-osr-exit-should-get-length-once-exceptions-occasionally.js: Added.
2053         (expectedArgCount):
2054         (callee):
2055         (test):
2056         (let.array.get length):
2057         * stress/apply-osr-exit-should-get-length-once.js: Added.
2058         (expectedArgCount):
2059         (callee):
2060         (test):
2061         (let.array.get length):
2062         * stress/load-varargs-then-inlined-call-and-exit-strict.js:
2063         (checkEqual):
2064         * stress/recursive-tail-call-with-different-argument-count.js:
2065         * stress/rest-varargs-osr-exit-to-checkpoint.js: Added.
2066         (foo):
2067         (bar):
2068
2069 2019-12-23  Yusuke Suzuki  <ysuzuki@apple.com>
2070
2071         [JSC] Wasm OSR entry should capture top-most enclosing-stack
2072         https://bugs.webkit.org/show_bug.cgi?id=205571
2073
2074         Reviewed by Keith Miller.
2075
2076         * wasm/stress/top-most-enclosing-stack.js: Added.
2077
2078 2019-12-21  Yusuke Suzuki  <ysuzuki@apple.com>
2079
2080         [JSC] Improve our bound function implementation
2081         https://bugs.webkit.org/show_bug.cgi?id=205327
2082
2083         Reviewed by Keith Miller.
2084
2085         * microbenchmarks/function-bind-no-inlining-repeat-call.js: Added.
2086         (assert):
2087         (test):
2088         (test2):
2089         (foo):
2090         (let.start.Date.now):
2091         * stress/bind-args.js: Added.
2092         (shouldBe):
2093         (test):
2094         (test2):
2095
2096 2019-12-17  Yusuke Suzuki  <ysuzuki@apple.com>
2097
2098         [JSC] 8Bit JSRopeString can contain 16Bit string in its rope
2099         https://bugs.webkit.org/show_bug.cgi?id=205323
2100
2101         Reviewed by Mark Lam.
2102
2103         * stress/8bit-resolve-can-encounter-16bit-string.js: Added.
2104         (foo):
2105
2106 2019-12-13  Yusuke Suzuki  <ysuzuki@apple.com>
2107
2108         [JSC] Remove JSFixedArray, and use JSImmutableButterfly instead
2109         https://bugs.webkit.org/show_bug.cgi?id=204402
2110
2111         Reviewed by Mark Lam.
2112
2113         * stress/new-array-with-spread-cow-double.js: Added.
2114         (shouldBe):
2115         (shouldBeArray):
2116         (test):
2117         * stress/new-array-with-spread-cow-int.js: Added.
2118         (shouldBe):
2119         (shouldBeArray):
2120         (test):
2121         * stress/new-array-with-spread-cow.js: Added.
2122         (shouldBe):
2123         (shouldBeArray):
2124         (test):
2125
2126 2019-12-13  Mark Lam  <mark.lam@apple.com>
2127
2128         Fix bad exception assertion in ExceptionHelpers.cpp's createError().
2129         https://bugs.webkit.org/show_bug.cgi?id=205230
2130         <rdar://problem/57875688>
2131
2132         Reviewed by Yusuke Suzuki.
2133
2134         * stress/test-exception-assert-in-ExceptionHelpers-createError.js: Added.
2135
2136 2019-12-12  Yusuke Suzuki  <ysuzuki@apple.com>
2137
2138         [JSC] Wasm init-expr should reject mutable globals
2139         https://bugs.webkit.org/show_bug.cgi?id=205191
2140
2141         Reviewed by Mark Lam.
2142
2143         * wasm/js-api/global-error.js:
2144         (assert.throws.new.WebAssembly.Module.bin):
2145         (new.WebAssembly.Module): Deleted.
2146         (assert.throws): Deleted.
2147         (new.Number): Deleted.
2148
2149 2019-12-12  Mark Lam  <mark.lam@apple.com>
2150
2151         Fix missing exception in JSValue::toWTFStringSlowCase().
2152         https://bugs.webkit.org/show_bug.cgi?id=205176
2153         <rdar://problem/57871899>
2154
2155         Reviewed by Yusuke Suzuki.
2156
2157         * stress/missing-exception-check-in-JSValue-toWTFStringSlowCase.js: Added.
2158
2159 2019-12-12  Mark Lam  <mark.lam@apple.com>
2160
2161         Fix missing exception check in JSON Stringifier's gap function.
2162         https://bugs.webkit.org/show_bug.cgi?id=205171
2163         <rdar://problem/57871842>
2164
2165         Reviewed by Yusuke Suzuki.
2166
2167         * stress/missing-exception-check-in-json-stringifier-gap.js: Added.
2168
2169 2019-12-12  Mark Lam  <mark.lam@apple.com>
2170
2171         DFG and FTL expects String.prototype to not qualify for StringObjectUse.
2172         https://bugs.webkit.org/show_bug.cgi?id=205147
2173         <rdar://problem/57748888>
2174
2175         Reviewed by Saam Barati.
2176
2177         * stress/ftl-expects-string-prototype-to-not-be-StringObjectUse.js: Added.
2178
2179 2019-12-11  Keith Miller  <keith_miller@apple.com>
2180
2181         Add test for osr exiting with interpreter on the stack
2182         https://bugs.webkit.org/show_bug.cgi?id=205124
2183
2184         Reviewed by Mark Lam.
2185
2186         I forgot to add this test before.
2187
2188         * stress/osr-exit-with-interpreter-on-stack.js: Added.
2189         (foo):
2190
2191 2019-12-10  Yusuke Suzuki  <ysuzuki@apple.com>
2192
2193         [JSC] Adhocly created CallLinkInfo in GetterSetterAccess should be owned by GCAwareJITStubRoutine
2194         https://bugs.webkit.org/show_bug.cgi?id=204876
2195
2196         Reviewed by Saam Barati.
2197
2198         * stress/code-emitted-by-getter-setter-access-case-should-hold-ownership-of-call-link-info.js: Added.
2199         (func):
2200
2201 2019-12-09  Tadeu Zagallo  <tzagallo@apple.com>
2202
2203         REGRESSION(r253140): WebAssembly validation should check for unmatched else before calling addElse/addElseToUnreachable
2204         https://bugs.webkit.org/show_bug.cgi?id=205022
2205         <rdar://problem/57748159>
2206
2207         Reviewed by Saam Barati.
2208
2209         * wasm/regress/unmatched-else.js: Added.
2210         (catch):
2211
2212 2019-12-08  Tadeu Zagallo  <tzagallo@apple.com>
2213
2214         [WebAssembly] Fix LLIntGenerator's checkConsistency contract
2215         https://bugs.webkit.org/show_bug.cgi?id=204998
2216         <rdar://problem/57733405>
2217
2218         Reviewed by Mark Lam.
2219
2220         * wasm/regress/stack-consistency.js: Added.
2221
2222 2019-12-08  Caio Lima  <ticaiolima@gmail.com>
2223
2224         [ARMv7] Skip flaky stress tests
2225         https://bugs.webkit.org/show_bug.cgi?id=204996
2226
2227         Unreviewed gardening.
2228
2229         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
2230         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js:
2231
2232 2019-12-07  Mark Lam  <mark.lam@apple.com>
2233
2234         Object.prototype.isPrototypeOf() should check if the passed in value is a non-object first.
2235         https://bugs.webkit.org/show_bug.cgi?id=204971
2236         <rdar://problem/57730080>
2237
2238         Reviewed by Saam Barati.
2239
2240         * stress/object-prototype-isPrototypeOf-should-check-for-non-object-first.js: Added.
2241
2242 2019-12-06  Mark Lam  <mark.lam@apple.com>
2243
2244         The compiler thread should not adjust Identifier refCounts.
2245         https://bugs.webkit.org/show_bug.cgi?id=204919
2246         <rdar://problem/57426861>
2247
2248         Reviewed by Saam Barati.
2249
2250         * stress/compiler-thread-should-not-ref-identifiers.js: Added.
2251
2252 2019-12-04  Yusuke Suzuki  <ysuzuki@apple.com>
2253
2254         [JSC] AI should convert IsCellWithType to constant when Structure set is finite
2255         https://bugs.webkit.org/show_bug.cgi?id=204141
2256
2257         Reviewed by Mark Lam.
2258
2259         * stress/generator-cell-with-type.js: Added.
2260         (shouldBe):
2261         (shouldThrow):
2262         (test):
2263         (i.shouldThrow):
2264         * stress/is-cell-with-type-should-check-non-cell-cases.js: Added.
2265         (getter):
2266         (foo):
2267
2268 2019-12-04  Mark Lam  <mark.lam@apple.com>
2269
2270         Fix missing exception check in ArrayPrototype's fastJoin().
2271         https://bugs.webkit.org/show_bug.cgi?id=204868
2272         <rdar://problem/57516684>
2273
2274         Reviewed by Saam Barati.
2275
2276         * stress/missing-exception-check-in-array-prototype-fastJoin.js: Added.
2277
2278 2019-12-04  Yusuke Suzuki  <ysuzuki@apple.com>
2279
2280         Unreviewed, rolling out r252416, vimeo does not work
2281         https://bugs.webkit.org/show_bug.cgi?id=204141
2282
2283         * stress/generator-cell-with-type.js: Removed.
2284
2285 2019-12-04  Yusuke Suzuki  <ysuzuki@apple.com>
2286
2287         [JSC] JSWebAssemblyGlobal creation should have exception check
2288         https://bugs.webkit.org/show_bug.cgi?id=204857
2289         <rdar://problem/57618579>
2290
2291         Reviewed by Mark Lam.
2292
2293         * wasm/regress/wasm-global-creation-can-throw-an-exception.js: Added.
2294
2295 2019-12-04  Yusuke Suzuki  <ysuzuki@apple.com>
2296
2297         [JSC] Update Wasm spec-tests
2298         https://bugs.webkit.org/show_bug.cgi?id=204844
2299
2300         Reviewed by Keith Miller.
2301
2302         To get broader coverage, we update Wasm spec-tests to the latest one[1].
2303
2304         [1]: 3e5fdc6b51ca2cde537bb8ecb1ba25c1ee366833
2305
2306         * wasm.yaml:
2307         * wasm/spec-tests/address.wast.js:
2308         * wasm/spec-tests/align.wast.js:
2309         * wasm/spec-tests/binary-leb128.wast.js: Added.
2310         * wasm/spec-tests/binary.wast.js:
2311         * wasm/spec-tests/block.wast.js:
2312         * wasm/spec-tests/br.wast.js:
2313         * wasm/spec-tests/br_if.wast.js:
2314         * wasm/spec-tests/br_table.wast.js:
2315         * wasm/spec-tests/call_indirect.wast.js:
2316         * wasm/spec-tests/const.wast.js:
2317         * wasm/spec-tests/conversions.wast.js:
2318         * wasm/spec-tests/custom.wast.js: Added.
2319         * wasm/spec-tests/data.wast.js: Added.
2320         * wasm/spec-tests/elem.wast.js: Added.
2321         * wasm/spec-tests/endianness.wast.js:
2322         * wasm/spec-tests/f32.wast.js:
2323         * wasm/spec-tests/f32_bitwise.wast.js:
2324         * wasm/spec-tests/f32_cmp.wast.js:
2325         * wasm/spec-tests/f64.wast.js:
2326         * wasm/spec-tests/f64_bitwise.wast.js:
2327         * wasm/spec-tests/f64_cmp.wast.js:
2328         * wasm/spec-tests/fac.wast.js:
2329         * wasm/spec-tests/float_exprs.wast.js:
2330         * wasm/spec-tests/float_literals.wast.js:
2331         * wasm/spec-tests/float_memory.wast.js:
2332         * wasm/spec-tests/func.wast.js:
2333         * wasm/spec-tests/func_ptrs.wast.js:
2334         * wasm/spec-tests/i32.wast.js:
2335         * wasm/spec-tests/i64.wast.js:
2336         * wasm/spec-tests/imports.wast.js:
2337         * wasm/spec-tests/int_exprs.wast.js:
2338         * wasm/spec-tests/int_literals.wast.js:
2339         * wasm/spec-tests/labels.wast.js:
2340         * wasm/spec-tests/left-to-right.wast.js:
2341         * wasm/spec-tests/load.wast.js: Added.
2342         * wasm/spec-tests/local_get.wast.js: Added.
2343         * wasm/spec-tests/local_set.wast.js: Added.
2344         * wasm/spec-tests/local_tee.wast.js: Added.
2345         * wasm/spec-tests/loop.wast.js:
2346         * wasm/spec-tests/memory_grow.wast.js: Added.
2347         * wasm/spec-tests/memory_size.wast.js: Added.
2348         * wasm/spec-tests/memory_trap.wast.js:
2349         * wasm/spec-tests/names.wast.js:
2350         * wasm/spec-tests/nop.wast.js:
2351         * wasm/spec-tests/return.wast.js:
2352         * wasm/spec-tests/select.wast.js:
2353         * wasm/spec-tests/stack.wast.js:
2354         * wasm/spec-tests/start.wast.js:
2355         * wasm/spec-tests/store.wast.js: Added.
2356         * wasm/spec-tests/switch.wast.js:
2357         * wasm/spec-tests/traps.wast.js:
2358         * wasm/spec-tests/type.wast.js:
2359         * wasm/spec-tests/unreachable.wast.js:
2360         * wasm/spec-tests/unreached-invalid.wast.js:
2361         * wasm/spec-tests/unwind.wast.js:
2362         * wasm/spec-tests/utf8-custom-section-id.wast.js:
2363         * wasm/spec-tests/utf8-import-field.wast.js:
2364         * wasm/spec-tests/utf8-import-module.wast.js:
2365         * wasm/spec-tests/utf8-invalid-encoding.wast.js: Added.
2366
2367 2019-12-03  Yusuke Suzuki  <ysuzuki@apple.com>
2368
2369         Adopt the new WebAssembly.Global system
2370         https://bugs.webkit.org/show_bug.cgi?id=186552
2371
2372         Reviewed by Keith Miller.
2373
2374         1. Update spec-harness to accept newer tests. And we update several tests that does not work with the old harness.
2375         2. Add WebAssembly.Global tests.
2376
2377         * wasm/js-api/global-error.js:
2378         (assert.throws.new.WebAssembly.Module.bin):
2379         (new.WebAssembly.Module):
2380         (assert.throws):
2381         * wasm/js-api/global-external-init-from-import.js:
2382         * wasm/js-api/globals-export.js:
2383         * wasm/modules/js-wasm-global-namespace.js:
2384         (assert.throws):
2385         * wasm/modules/js-wasm-global.js:
2386         (assert.throws):
2387         * wasm/modules/wasm-import-wasm-export-i64-error.js:
2388         * wasm/references/anyref_globals.js:
2389         * wasm/references/func_ref.js:
2390         (assert.eq.instance.exports.fix):
2391         * wasm/spec-harness.js:
2392         (getGlobal):
2393         (let.console.log):
2394         * wasm/spec-harness/sync_index.js: Renamed from JSTests/wasm/spec-harness/index.js.
2395         (reinitializeRegistry.let.handler.get return):
2396         (module):
2397         * wasm/spec-tests/call.wast.js:
2398         * wasm/spec-tests/exports.wast.js:
2399         * wasm/spec-tests/globals.wast.js:
2400         * wasm/spec-tests/if.wast.js:
2401         * wasm/spec-tests/imports.wast.js:
2402         * wasm/spec-tests/linking.wast.js:
2403         * wasm/spec-tests/memory.wast.js:
2404         * wasm/stress/immutable-globals.js: Added.
2405         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.i.assert.eq.instance.exports.getI32):
2406         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.i.assert.eq):
2407         * wasm/stress/mutable-globals-cross.js: Added.
2408         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.instance1):
2409         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.instance2):
2410         * wasm/stress/mutable-globals.js: Added.
2411         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.i.instance.exports.setI32AsI64):
2412
2413 2019-12-03  Christopher Reid  <chris.reid@sony.com>
2414
2415         Regular expression hangs in Safari only
2416         https://bugs.webkit.org/show_bug.cgi?id=202882
2417         <rdar://problem/56236654>
2418
2419         Reviewed by Yusuke Suzuki.
2420
2421         * stress/regress-202882.js: Added.
2422
2423 2019-12-02  Saam Barati  <sbarati@apple.com>
2424
2425         PropertySlot should not have Customs have a PropertyOffset of zero
2426         https://bugs.webkit.org/show_bug.cgi?id=204566
2427         <rdar://problem/57466781>
2428
2429         Reviewed by Keith Miller.
2430
2431         * stress/cacheable-custom-accessor-should-not-have-property-offset.js: Added.
2432
2433 2019-12-02  Mark Lam  <mark.lam@apple.com>
2434
2435         mozilla-tests.yaml/js1_5/Array/regress-101964.js is frequently failing on JSC EWS bots.
2436         https://bugs.webkit.org/show_bug.cgi?id=200789
2437         <rdar://problem/54361916>
2438
2439         Reviewed by Keith Miller.
2440
2441         The prevailing theory is that this test is being pre-empted and not getting the
2442         CPU time it needs to complete.  As a result, the wall clock time period for
2443         running the test exceeds the expected time.  This patch tests this theory by
2444         changing the time measurement to use CPU time instead.
2445
2446         * mozilla/js1_5/Array/regress-101964.js:
2447
2448 2019-12-01  Caio Lima  <ticaiolima@gmail.com>
2449
2450         [JSC][MIPS] CallFrame is being clobbered on InternalFunction execution
2451         https://bugs.webkit.org/show_bug.cgi?id=203739
2452
2453         Reviewed by Saam Barati.
2454
2455         * stress/has-instance-exception-check.js:
2456         * stress/regress-176485.js:
2457
2458 2019-11-30  Ross Kirsling  <ross.kirsling@sony.com>
2459
2460         test262-runner should dump YAML with correct encoding
2461         https://bugs.webkit.org/show_bug.cgi?id=204493
2462
2463         Reviewed by Saam Barati.
2464
2465         * test262/expectations.yaml:
2466         Fix double-encoding of test failure output.
2467
2468 2019-11-23  Ross Kirsling  <ross.kirsling@sony.com>
2469
2470         [JSC] GetSubstitution is performed incorrectly via RegExp.prototype[@@replace]
2471         https://bugs.webkit.org/show_bug.cgi?id=204490
2472
2473         Reviewed by Mark Lam.
2474
2475         * stress/replace-indexed-backreferences.js: Added.
2476         * test262/expectations.yaml: Mark four test cases as passing.
2477
2478 2019-11-22  Tadeu Zagallo  <tzagallo@apple.com>
2479
2480         [WebAssembly] Improve Wasm::LLIntGenerator
2481         https://bugs.webkit.org/show_bug.cgi?id=204092
2482
2483         Reviewed by Saam Barati.
2484
2485         * wasm/stress/set-local-enclosed-stack.js: Added.
2486         (assert.eq.instance.exports.foo):
2487         (assert.eq):
2488
2489 2019-11-22  Yusuke Suzuki  <ysuzuki@apple.com>
2490
2491         [JSC] DFG terminal's liveness should respect caller's opcodeID
2492         https://bugs.webkit.org/show_bug.cgi?id=204317
2493
2494         Reviewed by Saam Barati.
2495
2496         * stress/call-var-args-phantom-arguments-handler-strict.js: Added.
2497         (shouldBe):
2498         (inlined):
2499         (test):
2500         * stress/call-var-args-phantom-arguments-handler.js: Added.
2501         (shouldBe):
2502         (inlined):
2503         (test):
2504         * stress/call-var-args-phantom-arguments-strict.js: Added.
2505         (shouldBe):
2506         (inlined):
2507         (test):
2508         * stress/call-var-args-phantom-arguments.js: Added.
2509         (shouldBe):
2510         (inlined):
2511         (test):
2512         * stress/derived-class-construct-varargs.js: Added.
2513         (shouldThrow):
2514         (B):
2515         * stress/tail-call-var-args-phantom-arguments-handler-strict.js: Added.
2516         (shouldBe):
2517         (inlined):
2518         (test):
2519         * stress/tail-call-var-args-phantom-arguments-handler.js: Added.
2520         (shouldBe):
2521         (inlined):
2522         (test):
2523         * stress/tail-call-var-args-phantom-arguments-strict.js: Added.
2524         (shouldBe):
2525         (inlined):
2526         (test):
2527         * stress/tail-call-var-args-phantom-arguments.js: Added.
2528         (shouldBe):
2529         (inlined):
2530         (test):
2531
2532 2019-11-22  Guillaume Emont  <guijemont@igalia.com>
2533
2534         Skip tests that fail on arm and mips devices
2535         https://bugs.webkit.org/show_bug.cgi?id=204522
2536
2537         Unreviewed gardening.
2538
2539
2540         * stress/generator-cell-with-type.js:
2541         * stress/stack-overflow-in-yarr-byteCompile.js:
2542         * stress/toctou-having-a-bad-time-new-array.js:
2543
2544 2019-11-21  Mark Lam  <mark.lam@apple.com>
2545
2546         replaceUsingStringSearch() should not use CachedCall with host functions.
2547         https://bugs.webkit.org/show_bug.cgi?id=204494
2548         <rdar://problem/57421078>
2549
2550         Reviewed by Ross Kirsling.
2551
2552         * stress/string-replaceAll-2.js:
2553
2554 2019-11-21  Ross Kirsling  <ross.kirsling@sony.com>
2555
2556         Unreviewed test262 gardening following r252680.
2557
2558         * test262/expectations.yaml:
2559         Mark eight test cases as passing.
2560
2561 2019-11-21  Saam Barati  <sbarati@apple.com>
2562
2563         GetByStatus should not say it took the slow path for multiple identifiers and should have a way to indicate if the StructureStubInfo it saw took the slow path
2564         https://bugs.webkit.org/show_bug.cgi?id=204435
2565
2566         Reviewed by Tadeu Zagallo.
2567
2568         * microbenchmarks/get-by-val-polymorphic-ic-1.js: Added.
2569         (assert):
2570         (test1.foo):
2571         (test1):
2572         * microbenchmarks/get-by-val-polymorphic-ic-2.js: Added.
2573         (assert):
2574         (test2.foo):
2575         (test2):
2576         * microbenchmarks/get-by-val-polymorphic-ic-3.js: Added.
2577         (assert):
2578         (test3.foo):
2579         (test3.args):
2580         (test3):
2581         * microbenchmarks/get-by-val-polymorphic-ic-4.js: Added.
2582         (assert):
2583         (test4.foo):
2584         (test4.capture):
2585         (test4.args):
2586         (test4):
2587         * microbenchmarks/get-by-val-polymorphic-ic-5.js: Added.
2588         (assert):
2589         (test5.foo):
2590         (test5.capture):
2591         (test5.args):
2592         (test5):
2593         * microbenchmarks/get-by-val-polymorphic-ic-6.js: Added.
2594         (assert):
2595         (test6.foo):
2596         (test6.capture):
2597         (test6.args):
2598         (test6):
2599         * microbenchmarks/get-by-val-polymorphic-ic-7.js: Added.
2600         (assert):
2601         (test7.foo):
2602         (test7):
2603         * microbenchmarks/get-by-val-polymorphic-ic-8.js: Added.
2604         (assert):
2605         (test7.foo):
2606         (test7):
2607         * microbenchmarks/get-by-val-polymorphic-ic-9.js: Added.
2608         (assert):
2609         (test7.foo):
2610         (test7):
2611
2612 2019-11-21  Mark Lam  <mark.lam@apple.com>
2613
2614         Fix broken String.prototype.replace() and replaceAll().
2615         https://bugs.webkit.org/show_bug.cgi?id=204479
2616         <rdar://problem/57354854>
2617
2618         Reviewed by Ross Kirsling and Yusuke Suzuki.
2619
2620         * ChakraCore.yaml:
2621         * ChakraCore/test/Strings/replace.baseline-jsc: Removed.
2622         - We no longer need this because we've fixed the spec compliance issue in replace().
2623         * stress/string-replaceAll-2.js: Added.
2624
2625 2019-11-21  Yusuke Suzuki  <ysuzuki@apple.com>
2626
2627         Unreviewed, rolling in again, regression is not caused by it
2628         https://bugs.webkit.org/show_bug.cgi?id=202471
2629
2630         * stress/string-replaceall.js: Added.
2631         (shouldBe):
2632         (shouldThrowTypeError):
2633         (shouldBe.string_appeared_here.replaceAll.Symbol.match):
2634
2635 2019-11-21  Commit Queue  <commit-queue@webkit.org>
2636
2637         Unreviewed, rolling out r252683 and r252721.
2638         https://bugs.webkit.org/show_bug.cgi?id=204475
2639
2640         13% regression in JetStream2/prepack-wtb (Requested by
2641         yusukesuzuki on #webkit).
2642
2643         Reverted changesets:
2644
2645         "Implement String.prototype.replaceAll"
2646         https://bugs.webkit.org/show_bug.cgi?id=202471
2647         https://trac.webkit.org/changeset/252683
2648
2649         "Unreviewed, address Darin's feedback on r252683."
2650         https://trac.webkit.org/changeset/252721
2651
2652 2019-11-20  Ross Kirsling  <ross.kirsling@sony.com>
2653
2654         Unreviewed, address Darin's feedback on r252683.
2655
2656         * stress/string-replaceall.js:
2657
2658 2019-11-20  Caio Lima  <ticaiolima@gmail.com>
2659
2660         [JSC] OSR exit to LLInt is broken on MIPS
2661         https://bugs.webkit.org/show_bug.cgi?id=203737
2662
2663         Reviewed by Yusuke Suzuki.
2664
2665         Unskipping broken tests due to OSR to LLInt bug.
2666
2667         * microbenchmarks/call-spread-call.js:
2668         * microbenchmarks/throw.js:
2669         * stress/allocation-sinking-hints-are-valid-ssa-2.js:
2670         * stress/allocation-sinking-hints-are-valid-ssa.js:
2671         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js:
2672         * stress/arrowfunction-lexical-bind-supercall-4.js:
2673         * stress/arrowfunction-tdz-3.js:
2674         * stress/function-constructor-semantics.js:
2675         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js:
2676         * stress/stress-cleared-calllinkinfo.js:
2677         * stress/typedarray-configure-index.js:
2678         * stress/v8-deltablue-strict.js:
2679
2680 2019-11-20  Mark Lam  <mark.lam@apple.com>
2681
2682         Flaky JSC test: stress/stack-overflow-in-yarr-byteCompile.js.dfg-eager.
2683         https://bugs.webkit.org/show_bug.cgi?id=204405
2684
2685         Reviewed by Alexey Proskuryakov.
2686
2687         The test was timing out because it's slow.  We don't really need to run this test
2688         on all configurations.  So, we'll change it to on run with the default
2689         configuration.  Also declare the test as "//@ slow!".
2690
2691         * stress/stack-overflow-in-yarr-byteCompile.js:
2692
2693 2019-11-19  Ross Kirsling  <ross.kirsling@sony.com>
2694
2695         Implement String.prototype.replaceAll
2696         https://bugs.webkit.org/show_bug.cgi?id=202471
2697
2698         Reviewed by Yusuke Suzuki.
2699
2700         * stress/string-replaceall.js: Added.
2701
2702 2019-11-19  Robin Morisset  <rmorisset@apple.com>
2703
2704         [ESNext][BigInt] Add support for op_inc
2705         https://bugs.webkit.org/show_bug.cgi?id=193240
2706
2707         Reviewed by Yusuke Suzuki.
2708
2709         Some parts of these tests are inspired by tests in a WIP patch by Caio Lima.
2710         Thanks to him for allowing their reuse.
2711
2712         * stress/inc-osr-exit-from-big-int.js: Added.
2713         (let.assert.sameValue):
2714         (postInc):
2715         (preInc):
2716         (postDec):
2717         (preDec):
2718         * stress/inc-osr-exit-to-big-int.js: Added.
2719         (let.assert.sameValue):
2720         (postInc):
2721         (preInc):
2722         (postDec):
2723         (preDec):
2724         (o.valueOf):
2725
2726 2019-11-19  Saam Barati  <sbarati@apple.com>
2727
2728         Remove runNullishAwareOperatorsEnabled
2729
2730         Rubber-stamped by Keith Miller.
2731
2732         * stress/nullish-coalescing.js:
2733         * stress/optional-chaining.js:
2734         * stress/tail-call-recognize.js:
2735
2736 2019-11-18  Keith Miller  <keith_miller@apple.com>
2737
2738         Enable Nullish operators by default
2739         https://bugs.webkit.org/show_bug.cgi?id=204308
2740
2741         Reviewed by Yusuke Suzuki.
2742
2743         Remove feature -> option map.
2744
2745         * test262/config.yaml:
2746
2747 2019-11-18  Caio Lima  <ticaiolima@gmail.com>
2748
2749         Skipping wasm-error-message-cross-threads.js on architectures without WASM support
2750         https://bugs.webkit.org/show_bug.cgi?id=204293
2751
2752         Unreviewed gardening.
2753
2754         * stress/ensure-code-block-is-not-precise-allocation.js:
2755
2756         Skipping this test until we fix OSR to LLInt on MIPS.
2757
2758         * stress/wasm-error-message-cross-threads.js:
2759
2760 2019-11-15  Ross Kirsling  <ross.kirsling@sony.com>
2761
2762         [JSC] Anonymous built-in functions should have empty string for a name
2763         https://bugs.webkit.org/show_bug.cgi?id=204214
2764
2765         Reviewed by Yusuke Suzuki.
2766
2767         * test262/expectations.yaml:
2768         Mark 20 test cases as passing.
2769
2770         * stress/builtin-function-name.js:
2771         (shouldThrow):
2772         * stress/private-name-as-anonymous-builtin.js:
2773         Fix tests which are no longer accurate.
2774
2775 2019-11-15  Yusuke Suzuki  <ysuzuki@apple.com>
2776
2777         [JSC] DFG strength reduction should define "groups" for RegExp constant-folded result
2778         https://bugs.webkit.org/show_bug.cgi?id=204264
2779
2780         Reviewed by Michael Saboff.
2781
2782         * stress/dfg-strength-reduction-for-regexp-should-include-groups-property.js: Added.
2783         (shouldBe):
2784         (test):
2785
2786 2019-11-15  Yusuke Suzuki  <ysuzuki@apple.com>
2787
2788         Wasm error message should be cross-thread-copied
2789         https://bugs.webkit.org/show_bug.cgi?id=204143
2790
2791         Reviewed by Mark Lam.
2792
2793         * stress/wasm-error-message-cross-threads.js: Added.
2794         (f):
2795
2796 2019-11-14  Alexey Shvayka  <shvaikalesh@gmail.com>
2797
2798         Use toLength() and getIndexQuickly() in JSON.stringify
2799         https://bugs.webkit.org/show_bug.cgi?id=204122
2800
2801         Reviewed by Yusuke Suzuki.
2802
2803         * microbenchmarks/json-stringify-array-replacer.js: Added.
2804         * microbenchmarks/json-stringify-empty-array.js: Added.
2805
2806 2019-11-14  Caio Lima  <ticaiolima@gmail.com>
2807
2808         Support or16(TrustedImm32, AbsoluteAddress) in the MIPS MacroAssembler
2809         https://bugs.webkit.org/show_bug.cgi?id=204126
2810
2811         Reviewed by Mark Lam.
2812
2813         Decreasing the number of iterations of test to avoid timeout into slow
2814         ports.
2815
2816         * stress/regress-57020338.js:
2817
2818 2019-11-13  Robin Morisset  <rmorisset@apple.com>
2819
2820         Split ArithProfile into a Unary and a Binary version
2821         https://bugs.webkit.org/show_bug.cgi?id=202832
2822         <rdar://problem/56266847>
2823
2824         Reviewed by Keith Miller.
2825
2826         The new test (kindly provided by Mark Lam) catches the metadata corruption that used to happen in the previous version of this patch.
2827
2828         * stress/regress-57020338.js: Added.
2829
2830 2019-11-13  Yusuke Suzuki  <ysuzuki@apple.com>
2831
2832         [JSC] AI should convert IsCellWithType to constant when Structure set is finite
2833         https://bugs.webkit.org/show_bug.cgi?id=204141
2834
2835         Reviewed by Saam Barati.
2836
2837         * stress/generator-cell-with-type.js: Added.
2838         (shouldBe):
2839         (shouldThrow):
2840         (test):
2841         (i.shouldThrow):
2842
2843 2019-11-12  Yusuke Suzuki  <ysuzuki@apple.com>
2844
2845         [JSC] JSC GC relies on CodeBlock is not PreciseAllocation
2846         https://bugs.webkit.org/show_bug.cgi?id=204124
2847
2848         Reviewed by Saam Barati.
2849
2850         * stress/ensure-code-block-is-not-precise-allocation.js: Added.
2851         (foo):
2852         (get for):
2853
2854 2019-11-12  Alexey Shvayka  <shvaikalesh@gmail.com>
2855
2856         RegExpBuiltinExec should create "groups" property unconditionally
2857         https://bugs.webkit.org/show_bug.cgi?id=204067
2858
2859         Reviewed by Ross Kirsling.
2860
2861         * test262/expectations.yaml: Mark 4 test cases as passing.
2862
2863 2019-11-11  Ross Kirsling  <ross.kirsling@sony.com>
2864
2865         UTC offset for Samoa is miscalculated when !HAVE(TIMEGM)
2866         https://bugs.webkit.org/show_bug.cgi?id=204032
2867
2868         Reviewed by Yusuke Suzuki.
2869
2870         * complex.yaml:
2871         * complex/timezone-offset-apia.js: Added.
2872         Add test to verify Date.prototype.getTimezoneOffset for TZ=Pacific/Apia.
2873
2874 2019-11-08  Guillaume Emont  <guijemont@igalia.com>
2875
2876         Temporarily skip another broken test on MIPS due to OSR exit to LLInt
2877         https://bugs.webkit.org/show_bug.cgi?id=204003
2878
2879         Unreviewed gardening.
2880
2881         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js:
2882
2883 2019-11-07  Mark Lam  <mark.lam@apple.com>
2884
2885         Add a stack overflow check in Yarr::ByteCompiler::emitDisjunction().
2886         https://bugs.webkit.org/show_bug.cgi?id=203936
2887         <rdar://problem/56624724>
2888
2889         Reviewed by Saam Barati.
2890
2891         This issue originally manifested as incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js
2892         failing on iOS devices due to its smaller stack.  We adapted the original test
2893         here using $vm.callWithStackSize() to reproduce the issue on x86_64 though it
2894         has a much larger physical stack to work with.  This new test will crash while
2895         stepping on the guard page beyond the end of the stack if the fix is not applied.
2896
2897         * stress/stack-overflow-in-yarr-byteCompile.js: Added.
2898
2899 2019-11-07  Tuomas Karkkainen  <tuomas.webkit@apple.com>
2900
2901         didPassSomeTestsSilenty is misspelled in standalone-pre.js
2902         https://bugs.webkit.org/show_bug.cgi?id=203948
2903
2904         Reviewed by Yusuke Suzuki.
2905
2906         * stress/resources/standalone-pre.js:
2907
2908 2019-11-07  Ross Kirsling  <ross.kirsling@sony.com>
2909
2910         Unskip test262 tests for async-iteration
2911         https://bugs.webkit.org/show_bug.cgi?id=203921
2912
2913         Reviewed by Keith Miller.
2914
2915         This should have been done two years ago, it seems.
2916
2917         * test262/config.yaml:
2918         * test262/expectations.yaml:
2919
2920 2019-11-07  Alexey Shvayka  <shvaikalesh@gmail.com>
2921
2922         [[HasProperty]] result of Proxy in prototype chain is ignored
2923         https://bugs.webkit.org/show_bug.cgi?id=203560
2924
2925         Reviewed by Ross Kirsling.
2926
2927         * stress/proxy-get-prototype-of.js: Correct Proxy "has" trap test.
2928         * test262/expectations.yaml: Mark 6 test cases as passing.
2929
2930 2019-11-06  Mark Lam  <mark.lam@apple.com>
2931
2932         JSGlobalObject::fireWatchpointAndMakeAllArrayStructuresSlowPut() should fire its watchpoint as the last step.
2933         https://bugs.webkit.org/show_bug.cgi?id=203867
2934         <rdar://problem/56813514>
2935
2936         Reviewed by Saam Barati.
2937
2938         * stress/racy-slow-put-cloned-arguments-when-having-a-bad-time.js: Added.
2939
2940 2019-11-06  Commit Queue  <commit-queue@webkit.org>
2941
2942         Unreviewed, rolling out r251940.
2943         https://bugs.webkit.org/show_bug.cgi?id=203920
2944
2945         "it introduced test262 failures" (Requested by rkirsling on
2946         #webkit).
2947
2948         Reverted changeset:
2949
2950         "[[HasProperty]] result of Proxy in prototype chain is
2951         ignored"
2952         https://bugs.webkit.org/show_bug.cgi?id=203560
2953         https://trac.webkit.org/changeset/251940
2954
2955 2019-11-04  Saam Barati  <sbarati@apple.com>
2956
2957         Don't use memmove/memcpy/memset for memory that can be scanned concurrently
2958         https://bugs.webkit.org/show_bug.cgi?id=203228
2959         <rdar://problem/56401852>
2960
2961         Reviewed by Robin Morisset.
2962
2963         * stress/torn-js-value-concurrent-collector.js: Added.
2964         (foo):
2965
2966 2019-11-03  Tadeu Zagallo  <tzagallo@apple.com>
2967
2968         LLIntGenerator should not allocate temporaries in between variables
2969         https://bugs.webkit.org/show_bug.cgi?id=203787
2970
2971         Reviewed by Yusuke Suzuki.
2972
2973         * wasm/stress/local-ref.js: Added.
2974
2975 2019-11-02  Alexey Proskuryakov  <ap@apple.com>
2976
2977         Revert http://trac.webkit.org/r251875
2978         Don't use memmove/memcpy/memset for memory that can be scanned concurrently
2979
2980         This is suspected to have broken performance tests on iOS.
2981
2982         * stress/torn-js-value-concurrent-collector.js: Removed.
2983
2984 2019-11-01  Alexey Shvayka  <shvaikalesh@gmail.com>
2985
2986         [[HasProperty]] result of Proxy in prototype chain is ignored
2987         https://bugs.webkit.org/show_bug.cgi?id=203560
2988
2989         Reviewed by Ross Kirsling.
2990
2991         * stress/proxy-get-prototype-of.js: Correct Proxy "has" trap test.
2992         * test262/expectations.yaml: Mark 6 test cases as passing.
2993
2994 2019-11-01  Caio Lima  <ticaiolima@gmail.com>
2995
2996         [JSC][MIPS] Skip tests failing in RELEASE_ASSERT_NOT_REACHED() at CallFrame.cpp:81
2997         https://bugs.webkit.org/show_bug.cgi?id=203738
2998
2999         Unreviewed gardening.
3000
3001         * stress/allocation-sinking-hints-are-valid-ssa.js:
3002         * stress/has-instance-exception-check.js:
3003         * stress/regress-176485.js:
3004
3005 2019-10-31  Caio Lima  <ticaiolima@gmail.com>
3006
3007         Temporary skip broken tests on MIPS that is broken due to OSR exit to LLInt
3008         https://bugs.webkit.org/show_bug.cgi?id=203710
3009
3010         Unreviewed gardening.
3011
3012         * microbenchmarks/call-spread-call.js:
3013         * microbenchmarks/throw.js:
3014         * stress/allocation-sinking-hints-are-valid-ssa-2.js:
3015         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js:
3016         * stress/arrowfunction-lexical-bind-supercall-4.js:
3017         * stress/arrowfunction-tdz-3.js:
3018         * stress/function-constructor-semantics.js:
3019         * stress/stress-cleared-calllinkinfo.js:
3020         * stress/typedarray-configure-index.js:
3021         * stress/v8-deltablue-strict.js:
3022
3023 2019-10-31  Saam Barati  <sbarati@apple.com>
3024
3025         Don't use memmove/memcpy/memset for memory that can be scanned concurrently
3026         https://bugs.webkit.org/show_bug.cgi?id=203228
3027         <rdar://problem/56401852>
3028
3029         Reviewed by Robin Morisset.
3030
3031         * stress/torn-js-value-concurrent-collector.js: Added.
3032         (foo):
3033
3034 2019-10-30  Yusuke Suzuki  <ysuzuki@apple.com>
3035
3036         [JSC] Date functions should have intrinsic
3037         https://bugs.webkit.org/show_bug.cgi?id=202187
3038
3039         Reviewed by Keith Miller.
3040
3041         * stress/date-cse.js: Added.
3042         (shouldBe):
3043         (test):
3044         (test2):
3045         (test3):
3046         * stress/date-get-date-jit.js: Added.
3047         (shouldBe):
3048         (test):
3049         * stress/date-get-day-jit.js: Added.
3050         (shouldBe):
3051         (test):
3052         * stress/date-get-full-year-jit.js: Added.
3053         (shouldBe):
3054         (test):
3055         * stress/date-get-hours-jit.js: Added.
3056         (shouldBe):
3057         (test):
3058         * stress/date-get-milliseconds-jit.js: Added.
3059         (shouldBe):
3060         (test):
3061         * stress/date-get-minutes-jit.js: Added.
3062         (shouldBe):
3063         (test):
3064         * stress/date-get-month-jit.js: Added.
3065         (shouldBe):
3066         (test):
3067         * stress/date-get-seconds-jit.js: Added.
3068         (shouldBe):
3069         (test):
3070         * stress/date-get-time-jit.js: Added.
3071         (shouldBe):
3072         (test):
3073         * stress/date-get-timezone-offset-jit.js: Added.
3074         (shouldBe):
3075         (test):
3076         * stress/date-get-utc-date-jit.js: Added.
3077         (shouldBe):
3078         (test):
3079         * stress/date-get-utc-day-jit.js: Added.
3080         (shouldBe):
3081         (test):
3082         * stress/date-get-utc-full-year-jit.js: Added.
3083         (shouldBe):
3084         (test):
3085         * stress/date-get-utc-hours-jit.js: Added.
3086         (shouldBe):
3087         (test):
3088         * stress/date-get-utc-milliseconds-jit.js: Added.
3089         (shouldBe):
3090         (test):
3091         * stress/date-get-utc-minutes-jit.js: Added.
3092         (shouldBe):
3093         (test):
3094         * stress/date-get-utc-month-jit.js: Added.
3095         (shouldBe):
3096         (test):
3097         * stress/date-get-utc-seconds-jit.js: Added.
3098         (shouldBe):
3099         (test):
3100         * stress/date-get-year-jit.js: Added.
3101         (shouldBe):
3102         (test):
3103         * stress/date-value-of-jit.js: Added.
3104         (shouldBe):
3105         (test):
3106
3107 2019-10-30  Guillaume Emont  <guijemont@igalia.com>
3108
3109         Temporarily skip ChakraCore/test/Math/max.js on arm and mips
3110
3111         Unreviewed gardening.
3112
3113         * ChakraCore.yaml:
3114
3115 2019-10-30  Ross Kirsling  <ross.kirsling@sony.com>
3116
3117         Intl.DateTimeFormat returns resolvedOptions in the wrong order
3118         https://bugs.webkit.org/show_bug.cgi?id=203297
3119
3120         Reviewed by Yusuke Suzuki.
3121
3122         * test262/expectations.yaml:
3123         Mark two test cases as passing.
3124
3125 2019-10-30  Tadeu Zagallo  <tzagallo@apple.com>
3126
3127         tryCachePutToScopeGlobal should hold the lock to update metadata.m_getPutInfo
3128         https://bugs.webkit.org/show_bug.cgi?id=203628
3129         <rdar://problem/56705353>
3130
3131         Reviewed by Yusuke Suzuki.
3132
3133         * stress/property-move-from-global-object-to-global-lexical-environment.js: Added.
3134         (foo):
3135
3136 2019-10-29  Yusuke Suzuki  <ysuzuki@apple.com>
3137
3138         [JSC] Add fast path for String#localeCompare
3139         https://bugs.webkit.org/show_bug.cgi?id=202676
3140
3141         Reviewed by Mark Lam.
3142
3143         * stress/locale-compare-bits.js: Added.
3144         (shouldBe):
3145
3146 2019-10-28  Yusuke Suzuki  <ysuzuki@apple.com>
3147
3148         [JSC] Optimize Promise runtime functions
3149         https://bugs.webkit.org/show_bug.cgi?id=203454
3150
3151         Reviewed by Keith Miller.
3152
3153         * microbenchmarks/promise-reject.js: Added.
3154         * microbenchmarks/promise-resolve.js: Added.
3155
3156 2019-10-25  Ross Kirsling  <ross.kirsling@sony.com>
3157
3158         test262-runner should be able to pass JSC a feature flag
3159         https://bugs.webkit.org/show_bug.cgi?id=203301
3160
3161         Reviewed by Keith Miller.
3162
3163         * test262/config.yaml:
3164         Add feature flag mapping.
3165         Also skip a few forgotten features as well as BigInt TypedArray tests.
3166
3167         * test262/expectations.yaml:
3168         Regenerate expectations.
3169
3170 2019-10-23  Keith Miller  <keith_miller@apple.com>
3171
3172         Undo incidental change from BytecodeIndex class patch
3173         https://bugs.webkit.org/show_bug.cgi?id=203339
3174
3175         Reviewed by Mark Lam.
3176
3177         * stress/error-source-location-assertion.js: Added.
3178
3179 2019-10-23  Ross Kirsling  <ross.kirsling@sony.com>
3180
3181         String.prototype.matchAll should throw on non-global regex
3182         https://bugs.webkit.org/show_bug.cgi?id=202838
3183
3184         Reviewed by Keith Miller.
3185
3186         * stress/string-matchall.js: Added.
3187
3188         * test262/expectations.yaml:
3189         Mark four test cases as passing.
3190
3191 2019-10-23  Ross Kirsling  <ross.kirsling@sony.com>
3192
3193         Update test262 (2019.10.11)
3194         https://bugs.webkit.org/show_bug.cgi?id=202861
3195
3196         Reviewed by Keith Miller.
3197
3198         * test262/config.yaml:
3199         * test262/expectations.yaml:
3200         * test262/harness/:
3201         * test262/latest-changes-summary.txt:
3202         * test262/test/:
3203         * test262/test262-Revision.txt:
3204
3205 2019-10-22  Zhifei Fang  <zhifei_fang@apple.com>
3206
3207         [JSC tests] Skip slow tests on Watch S3 and Watch S4
3208         https://bugs.webkit.org/show_bug.cgi?id=203268
3209
3210         Reviewed by Saam Barati.
3211
3212         * microbenchmarks/ArrayBuffer-DataView-alloc-large-long-lived.js:
3213         * microbenchmarks/ArrayBuffer-DataView-alloc-long-lived.js:
3214         * microbenchmarks/ArrayBuffer-Int32Array-byteOffset.js:
3215         * microbenchmarks/ArrayBuffer-Int8Array-alloc-large-long-lived.js:
3216         * microbenchmarks/ArrayBuffer-Int8Array-alloc-long-lived-buffer.js:
3217         * microbenchmarks/ArrayBuffer-Int8Array-alloc-long-lived.js:
3218         * microbenchmarks/ArrayBuffer-Int8Array-alloc.js:
3219         * microbenchmarks/DataView-custom-properties.js:
3220         * microbenchmarks/Float32Array-matrix-mult.js:
3221         * microbenchmarks/Float32Array-to-Float64Array-set.js:
3222         * microbenchmarks/Float64Array-alloc-long-lived.js:
3223         * microbenchmarks/Float64Array-to-Int16Array-set.js:
3224         * microbenchmarks/HashMap-put-get-iterate-keys.js:
3225         * microbenchmarks/HashMap-put-get-iterate.js:
3226         * microbenchmarks/HashMap-string-put-get-iterate.js:
3227         * microbenchmarks/Int16Array-alloc-long-lived.js:
3228         * microbenchmarks/Int16Array-bubble-sort-with-byteLength.js:
3229         * microbenchmarks/Int16Array-bubble-sort.js:
3230         * microbenchmarks/Int16Array-load-int-mul.js:
3231         * microbenchmarks/Int16Array-to-Int32Array-set.js:
3232         * microbenchmarks/Int32Array-Int8Array-view-alloc.js:
3233         * microbenchmarks/Int32Array-alloc-large.js:
3234         * microbenchmarks/Int32Array-alloc-long-lived.js:
3235         * microbenchmarks/Int32Array-alloc.js:
3236         * microbenchmarks/Int8Array-alloc-long-lived.js:
3237         * microbenchmarks/Int8Array-load-with-byteLength.js:
3238         * microbenchmarks/Int8Array-load.js:
3239         * microbenchmarks/JSONP-negative-0.js:
3240         * microbenchmarks/Number-isNaN.js:
3241         * microbenchmarks/abc-forward-loop-equal.js:
3242         * microbenchmarks/abc-postfix-backward-loop.js:
3243         * microbenchmarks/abc-simple-backward-loop.js:
3244         * microbenchmarks/abc-simple-forward-loop.js:
3245         * microbenchmarks/abc-skippy-loop.js:
3246         * microbenchmarks/abs-boolean.js:
3247         * microbenchmarks/adapt-to-double-divide.js:
3248         * microbenchmarks/add-tree.js:
3249         * microbenchmarks/aliased-arguments-getbyval.js:
3250         * microbenchmarks/allocate-big-object.js:
3251         * microbenchmarks/apply-not-apply.js:
3252         * microbenchmarks/arguments-named-and-reflective.js:
3253         * microbenchmarks/arguments-out-of-bounds.js:
3254         * microbenchmarks/arguments-strict-mode.js:
3255         * microbenchmarks/arguments.js:
3256         * microbenchmarks/arity-mismatch-inlining.js:
3257         * microbenchmarks/array-access-polymorphic-structure.js:
3258         * microbenchmarks/array-nonarray-polymorhpic-access.js:
3259         * microbenchmarks/array-prototype-every.js:
3260         * microbenchmarks/array-prototype-forEach.js:
3261         * microbenchmarks/array-prototype-join-uninitialized.js:
3262         * microbenchmarks/array-prototype-map.js:
3263         * microbenchmarks/array-prototype-reduce.js:
3264         * microbenchmarks/array-prototype-reduceRight.js:
3265         * microbenchmarks/array-prototype-some.js:
3266         * microbenchmarks/array-push-0.js:
3267         * microbenchmarks/array-push-1.js:
3268         * microbenchmarks/array-push-2.js:
3269         * microbenchmarks/array-splice-contiguous.js:
3270         * microbenchmarks/array-with-double-add.js:
3271         * microbenchmarks/array-with-double-increment.js:
3272         * microbenchmarks/array-with-double-mul-add.js:
3273         * microbenchmarks/array-with-double-sum.js:
3274         * microbenchmarks/array-with-int32-add-sub.js:
3275         * microbenchmarks/array-with-int32-or-double-sum.js:
3276         * microbenchmarks/arrowfunciton-direct-arguments.js:
3277         * microbenchmarks/arrowfunciton-reference-arguments.js:
3278         * microbenchmarks/arrowfunction-call-in-class-constructor.js:
3279         * microbenchmarks/arrowfunction-call-in-class-method.js:
3280         * microbenchmarks/arrowfunction-call-in-function.js:
3281         * microbenchmarks/arrowfunction-call.js:
3282         * microbenchmarks/asmjs_bool_bug.js:
3283         * microbenchmarks/assign-custom-setter-polymorphic.js:
3284         * microbenchmarks/assign-custom-setter.js:
3285         * microbenchmarks/basic-set.js:
3286         * microbenchmarks/big-int-mul.js:
3287         * microbenchmarks/bigswitch-indirect-symbol.js:
3288         * microbenchmarks/bigswitch-indirect.js:
3289         * microbenchmarks/bigswitch.js:
3290         * microbenchmarks/bit-or-tree.js:
3291         * microbenchmarks/bit-test-constant.js:
3292         * microbenchmarks/bit-test-load.js:
3293         * microbenchmarks/bit-test-nonconstant.js:
3294         * microbenchmarks/bit-xor-tree.js:
3295         * microbenchmarks/boolean-test.js:
3296         * microbenchmarks/bound-function-call.js:
3297         * microbenchmarks/bound-function-construction-performance.js:
3298         * microbenchmarks/branch-fold.js:
3299         * microbenchmarks/branch-on-string-as-boolean.js:
3300         * microbenchmarks/bug-153431.js:
3301         * microbenchmarks/build-large-object.js:
3302         * microbenchmarks/by-val-generic.js:
3303         * microbenchmarks/cache-get-variables-under-tdz-in-bytecode-generator.js:
3304         * microbenchmarks/call-or-not-call.js:
3305         * microbenchmarks/call-spread-apply.js:
3306         * microbenchmarks/call-spread-call.js:
3307         * microbenchmarks/call-using-spread.js:
3308         * microbenchmarks/captured-assignments.js:
3309         * microbenchmarks/cast-int-to-double.js:
3310         * microbenchmarks/cell-argument.js:
3311         * microbenchmarks/cfg-simplify.js:
3312         * microbenchmarks/chain-getter-access.js:
3313         * microbenchmarks/check-mul-constant.js:
3314         * microbenchmarks/check-mul-no-constant.js:
3315         * microbenchmarks/check-mul-power-of-two.js:
3316         * microbenchmarks/cmpeq-obj-to-obj-other.js:
3317         * microbenchmarks/concat-append-one.js:
3318         * microbenchmarks/constant-fold-check-type-info-flags.js:
3319         * microbenchmarks/constant-test.js:
3320         * microbenchmarks/construct-poly-proto-object.js:
3321         * microbenchmarks/contiguous-array-to-string.js:
3322         * microbenchmarks/create-lots-of-functions.js:
3323         * microbenchmarks/create-many-weak-map.js:
3324         * microbenchmarks/cse-new-array-buffer.js:
3325         * microbenchmarks/cse-new-array.js:
3326         * microbenchmarks/custom-accessor-materialized.js:
3327         * microbenchmarks/custom-accessor-thin-air.js:
3328         * microbenchmarks/custom-accessor.js:
3329         * microbenchmarks/custom-setter-getter-as-put-get-by-id.js:
3330         * microbenchmarks/custom-value-2.js:
3331         * microbenchmarks/custom-value.js:
3332         * microbenchmarks/data-view-accesses-2.js:
3333         * microbenchmarks/data-view-accesses.js:
3334         * microbenchmarks/dataview-cse.js:
3335         * microbenchmarks/delay-tear-off-arguments-strictmode.js:
3336         * microbenchmarks/delta-blue-try-catch.js:
3337         * microbenchmarks/deltablue-for-of.js:
3338         * microbenchmarks/deltablue-varargs.js:
3339         * microbenchmarks/destructuring-arguments.js:
3340         * microbenchmarks/destructuring-parameters-overridden-by-function.js:
3341         * microbenchmarks/destructuring-swap.js:
3342         * microbenchmarks/dfg-internal-function-call.js:
3343         * microbenchmarks/dfg-internal-function-construct.js:
3344         * microbenchmarks/dfg-internal-function-not-handled-call.js:
3345         * microbenchmarks/dfg-internal-function-not-handled-construct.js:
3346         * microbenchmarks/direct-arguments-getbyval.js:
3347         * microbenchmarks/direct-arguments-length.js:
3348         * microbenchmarks/direct-arguments-overridden-length.js:
3349         * microbenchmarks/direct-arguments-possibly-overridden-length.js:
3350         * microbenchmarks/direct-call-arity-mismatch.js:
3351         * microbenchmarks/direct-call.js:
3352         * microbenchmarks/direct-construct-arity-mismatch.js:
3353         * microbenchmarks/direct-construct.js:
3354         * microbenchmarks/direct-tail-call-arity-mismatch.js:
3355         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js:
3356         * microbenchmarks/direct-tail-call-inlined-caller.js:
3357         * microbenchmarks/direct-tail-call.js:
3358         * microbenchmarks/div-boolean-double.js:
3359         * microbenchmarks/div-boolean.js:
3360         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js:
3361         * microbenchmarks/double-array-to-string.js:
3362         * microbenchmarks/double-get-by-val-out-of-bounds.js:
3363         * microbenchmarks/double-pollution-getbyval.js:
3364         * microbenchmarks/double-pollution-putbyoffset.js:
3365         * microbenchmarks/double-real-use.js:
3366         * microbenchmarks/double-to-int32-typed-array-no-inline.js:
3367         * microbenchmarks/double-to-int32-typed-array.js:
3368         * microbenchmarks/double-to-uint32-typed-array-no-inline.js:
3369         * microbenchmarks/double-to-uint32-typed-array.js:
3370         * microbenchmarks/elidable-new-object-dag.js:
3371         * microbenchmarks/elidable-new-object-roflcopter.js:
3372         * microbenchmarks/elidable-new-object-then-call.js:
3373         * microbenchmarks/elidable-new-object-tree.js:
3374         * microbenchmarks/empty-string-plus-int.js:
3375         * microbenchmarks/emscripten-cube2hash.js:
3376         * microbenchmarks/eval-cached.js:
3377         * microbenchmarks/eval-code-ftl-reentry.js:
3378         * microbenchmarks/eval-code-ftl.js:
3379         * microbenchmarks/eval-compute.js:
3380         * microbenchmarks/eval-not-eval-compute-args.js:
3381         * microbenchmarks/eval-not-eval-compute.js:
3382         * microbenchmarks/exit-length-on-plain-object.js:
3383         * microbenchmarks/external-arguments-getbyval.js:
3384         * microbenchmarks/external-arguments-putbyval.js:
3385         * microbenchmarks/fixed-typed-array-storage-var-index.js:
3386         * microbenchmarks/fixed-typed-array-storage.js:
3387         * microbenchmarks/fold-double-to-int.js:
3388         * microbenchmarks/fold-get-by-id-to-multi-get-by-offset-rare-int.js:
3389         * microbenchmarks/fold-get-by-id-to-multi-get-by-offset.js:
3390         * microbenchmarks/fold-multi-get-by-offset-to-get-by-offset.js:
3391         * microbenchmarks/fold-multi-get-by-offset-to-poly-get-by-offset.js:
3392         * microbenchmarks/fold-multi-put-by-offset-to-poly-put-by-offset.js:
3393         * microbenchmarks/fold-multi-put-by-offset-to-put-by-offset.js:
3394         * microbenchmarks/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js:
3395         * microbenchmarks/fold-put-by-id-to-multi-put-by-offset.js:
3396         * microbenchmarks/fold-put-by-val-with-string-to-multi-put-by-offset.js:
3397         * microbenchmarks/fold-put-by-val-with-symbol-to-multi-put-by-offset.js:
3398         * microbenchmarks/fold-put-structure.js:
3399         * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js:
3400         * microbenchmarks/for-of-array.js:
3401         * microbenchmarks/for-of-iterate-array-entries.js:
3402         * microbenchmarks/for-of-iterate-array-keys.js:
3403         * microbenchmarks/for-of-iterate-array-values.js:
3404         * microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js:
3405         * microbenchmarks/freeze-and-do-work.js:
3406         * microbenchmarks/fround.js:
3407         * microbenchmarks/ftl-library-inlining-dataview.js:
3408         * microbenchmarks/ftl-library-inlining.js:
3409         * microbenchmarks/ftl-polymorphic-StringFromCharCode.js:
3410         * microbenchmarks/function-call.js:
3411         * microbenchmarks/function-dot-apply.js:
3412         * microbenchmarks/function-test.js:
3413         * microbenchmarks/function-with-eval.js:
3414         * microbenchmarks/gcse-poly-get-less-obvious.js:
3415         * microbenchmarks/gcse-poly-get.js:
3416         * microbenchmarks/gcse.js:
3417         * microbenchmarks/generate-multiple-llint-entrypoints.js:
3418         * microbenchmarks/generator-create.js:
3419         * microbenchmarks/generator-fib.js:
3420         * microbenchmarks/generator-function-create.js:
3421         * microbenchmarks/generator-sunspider-access-nsieve.js:
3422         * microbenchmarks/generator-with-several-types.js:
3423         * microbenchmarks/get-by-id-bimorphic-check-structure-elimination-simple.js:
3424         * microbenchmarks/get-by-id-bimorphic-check-structure-elimination.js:
3425         * microbenchmarks/get-by-id-chain-from-try-block.js:
3426         * microbenchmarks/get-by-id-check-structure-elimination.js:
3427         * microbenchmarks/get-by-id-proto-or-self.js:
3428         * microbenchmarks/get-by-id-quadmorphic-check-structure-elimination-simple.js:
3429         * microbenchmarks/get-by-id-self-or-proto.js:
3430         * microbenchmarks/get-by-val-negative-array-index.js:
3431         * microbenchmarks/get-by-val-out-of-bounds.js:
3432         * microbenchmarks/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js:
3433         * microbenchmarks/get-by-val-with-string-bimorphic-check-structure-elimination.js:
3434         * microbenchmarks/get-by-val-with-string-chain-from-try-block.js:
3435         * microbenchmarks/get-by-val-with-string-check-structure-elimination.js:
3436         * microbenchmarks/get-by-val-with-string-proto-or-self.js:
3437         * microbenchmarks/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js:
3438         * microbenchmarks/get-by-val-with-string-self-or-proto.js:
3439         * microbenchmarks/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js:
3440         * microbenchmarks/get-by-val-with-symbol-bimorphic-check-structure-elimination.js:
3441         * microbenchmarks/get-by-val-with-symbol-chain-from-try-block.js:
3442         * microbenchmarks/get-by-val-with-symbol-check-structure-elimination.js:
3443         * microbenchmarks/get-by-val-with-symbol-proto-or-self.js:
3444         * microbenchmarks/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js:
3445         * microbenchmarks/get-by-val-with-symbol-self-or-proto.js:
3446         * microbenchmarks/get-custom-getter.js:
3447         * microbenchmarks/get_by_val-Int32Array.js:
3448         * microbenchmarks/get_callee_monomorphic.js:
3449         * microbenchmarks/get_callee_polymorphic.js:
3450         * microbenchmarks/getter-no-activation.js:
3451         * microbenchmarks/getter-prototype.js:
3452         * microbenchmarks/getter-richards-try-catch.js:
3453         * microbenchmarks/getter-richards.js:
3454         * microbenchmarks/getter.js:
3455         * microbenchmarks/global-code-ftl.js:
3456         * microbenchmarks/global-isNaN.js:
3457         * microbenchmarks/global-object-access-with-mutating-structure.js:
3458         * microbenchmarks/global-var-const-infer-fire-from-opt.js:
3459         * microbenchmarks/global-var-const-infer.js:
3460         * microbenchmarks/hard-overflow-check-equal.js:
3461         * microbenchmarks/hard-overflow-check.js:
3462         * microbenchmarks/has-own-property-name-cache.js:
3463         * microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js:
3464         * microbenchmarks/hoist-make-rope.js:
3465         * microbenchmarks/hoist-poly-check-structure-effectful-loop.js:
3466         * microbenchmarks/hoist-poly-check-structure.js:
3467         * microbenchmarks/implicit-bigswitch-indirect-symbol.js:
3468         * microbenchmarks/imul-double-only.js:
3469         * microbenchmarks/imul-int-only.js:
3470         * microbenchmarks/imul-mixed.js:
3471         * microbenchmarks/in-by-id-match.js:
3472         * microbenchmarks/in-by-id-removed.js:
3473         * microbenchmarks/in-four-cases.js:
3474         * microbenchmarks/in-one-case-false.js:
3475         * microbenchmarks/in-one-case-true.js:
3476         * microbenchmarks/in-two-cases.js:
3477         * microbenchmarks/indexed-properties-in-objects.js:
3478         * microbenchmarks/infer-closure-const-then-mov-no-inline.js:
3479         * microbenchmarks/infer-closure-const-then-mov.js:
3480         * microbenchmarks/infer-closure-const-then-put-to-scope-no-inline.js:
3481         * microbenchmarks/infer-closure-const-then-put-to-scope.js:
3482         * microbenchmarks/infer-closure-const-then-reenter-no-inline.js:
3483         * microbenchmarks/infer-closure-const-then-reenter.js:
3484         * microbenchmarks/infer-constant-global-property.js:
3485         * microbenchmarks/infer-constant-property.js:
3486         * microbenchmarks/infer-one-time-closure-ten-vars.js:
3487         * microbenchmarks/infer-one-time-closure-two-vars.js:
3488         * microbenchmarks/infer-one-time-closure.js:
3489         * microbenchmarks/infer-one-time-deep-closure.js:
3490         * microbenchmarks/inline-arguments-access.js:
3491         * microbenchmarks/inline-arguments-aliased-access.js:
3492         * microbenchmarks/inline-arguments-local-escape.js:
3493         * microbenchmarks/inline-get-scoped-var.js:
3494         * microbenchmarks/inlined-put-by-id-transition.js:
3495         * microbenchmarks/inlined-put-by-val-with-string-transition.js:
3496         * microbenchmarks/inlined-put-by-val-with-symbol-transition.js:
3497         * microbenchmarks/instanceof-always-hit-one.js:
3498         * microbenchmarks/instanceof-always-hit-two.js:
3499         * microbenchmarks/instanceof-bound.js:
3500         * microbenchmarks/instanceof-dynamic.js:
3501         * microbenchmarks/instanceof-sometimes-hit.js:
3502         * microbenchmarks/instanceof-tricky-dynamic.js:
3503         * microbenchmarks/int-or-other-abs-then-get-by-val.js:
3504         * microbenchmarks/int-or-other-abs-zero-then-get-by-val.js:
3505         * microbenchmarks/int-or-other-add-then-get-by-val.js:
3506         * microbenchmarks/int-or-other-add.js:
3507         * microbenchmarks/int-or-other-div-then-get-by-val.js:
3508         * microbenchmarks/int-or-other-max-then-get-by-val.js:
3509         * microbenchmarks/int-or-other-min-then-get-by-val.js:
3510         * microbenchmarks/int-or-other-mod-then-get-by-val.js:
3511         * microbenchmarks/int-or-other-mul-then-get-by-val.js:
3512         * microbenchmarks/int-or-other-neg-then-get-by-val.js:
3513         * microbenchmarks/int-or-other-neg-zero-then-get-by-val.js:
3514         * microbenchmarks/int-or-other-sub-then-get-by-val.js:
3515         * microbenchmarks/int-or-other-sub.js:
3516         * microbenchmarks/int-overflow-local.js:
3517         * microbenchmarks/int32-array-to-string.js:
3518         * microbenchmarks/int52-back-and-forth.js:
3519         * microbenchmarks/int52-rand-function.js:
3520         * microbenchmarks/int52-spill.js:
3521         * microbenchmarks/int8-out-of-bounds.js:
3522         * microbenchmarks/integer-divide.js:
3523         * microbenchmarks/integer-modulo.js:
3524         * microbenchmarks/is-array-for-array.js:
3525         * microbenchmarks/is-array-for-mixed-case.js:
3526         * microbenchmarks/is-array-for-non-array-object.js:
3527         * microbenchmarks/is-array-for-proxy.js:
3528         * microbenchmarks/is-boolean-fold-tricky.js:
3529         * microbenchmarks/is-boolean-fold.js:
3530         * microbenchmarks/is-function-fold-tricky-internal-function.js:
3531         * microbenchmarks/is-function-fold-tricky.js:
3532         * microbenchmarks/is-function-fold.js:
3533         * microbenchmarks/is-not-cell-speculation-for-empty-value.js:
3534         * microbenchmarks/is-number-fold-tricky.js:
3535         * microbenchmarks/is-number-fold.js:
3536         * microbenchmarks/is-object-or-null-fold-functions.js:
3537         * microbenchmarks/is-object-or-null-fold-less-tricky.js:
3538         * microbenchmarks/is-object-or-null-fold-tricky.js:
3539         * microbenchmarks/is-object-or-null-fold.js:
3540         * microbenchmarks/is-object-or-null-trickier-function.js:
3541         * microbenchmarks/is-object-or-null-trickier-internal-function.js:
3542         * microbenchmarks/is-object-or-null-tricky-function.js:
3543         * microbenchmarks/is-object-or-null-tricky-internal-function.js:
3544         * microbenchmarks/is-string-fold-tricky.js:
3545         * microbenchmarks/is-string-fold.js:
3546         * microbenchmarks/is-symbol-mixed.js:
3547         * microbenchmarks/is-symbol.js:
3548         * microbenchmarks/is-undefined-fold-tricky.js:
3549         * microbenchmarks/is-undefined-fold.js:
3550         * microbenchmarks/json-parse-array-reviver-same-value.js:
3551         * microbenchmarks/json-parse-array-reviver.js:
3552         * microbenchmarks/json-parse-object-reviver-same-value.js:
3553         * microbenchmarks/json-parse-object-reviver.js:
3554         * microbenchmarks/large-empty-array-join-resolve-rope.js:
3555         * microbenchmarks/large-empty-array-join.js:
3556         * microbenchmarks/large-int-captured.js:
3557         * microbenchmarks/large-int-neg.js:
3558         * microbenchmarks/large-int.js:
3559         * microbenchmarks/large-map-iteration.js:
3560         * microbenchmarks/lazy-array-species-watchpoints.js:
3561         * microbenchmarks/let-for-in.js:
3562         * microbenchmarks/licm-dragons-out-of-bounds.js:
3563         * microbenchmarks/licm-dragons-overflow.js:
3564         * microbenchmarks/licm-dragons-two-structures.js:
3565         * microbenchmarks/licm-dragons.js:
3566         * microbenchmarks/load-varargs-elimination.js:
3567         * microbenchmarks/locale-compare.js:
3568         * microbenchmarks/logical-not-weird-types.js:
3569         * microbenchmarks/logical-not.js:
3570         * microbenchmarks/loop-osr-with-arity-mismatch.js:
3571         * microbenchmarks/lots-of-fields.js:
3572         * microbenchmarks/make-indexed-storage.js:
3573         * microbenchmarks/make-rope-cse.js:
3574         * microbenchmarks/make-rope.js:
3575         * microbenchmarks/many-foreach-calls.js:
3576         * microbenchmarks/many-repeat-stores.js:
3577         * microbenchmarks/map-for-each.js:
3578         * microbenchmarks/map-for-of.js:
3579         * microbenchmarks/map-has-and-set.js:
3580         * microbenchmarks/map-has-get-cse-opportunity.js:
3581         * microbenchmarks/map-key-well-typed.js:
3582         * microbenchmarks/map-rehash.js:
3583         * microbenchmarks/marsaglia-larger-ints.js:
3584         * microbenchmarks/marsaglia-osr-entry.js:
3585         * microbenchmarks/math-random.js:
3586         * microbenchmarks/math-trunc.js:
3587         * microbenchmarks/math-with-out-of-bounds-array-values.js:
3588         * microbenchmarks/max-boolean.js:
3589         * microbenchmarks/megamorphic-load.js:
3590         * microbenchmarks/memcpy-loop.js:
3591         * microbenchmarks/memcpy-typed-loop-large.js:
3592         * microbenchmarks/memcpy-typed-loop-small.js:
3593         * microbenchmarks/memcpy-typed-loop-speculative.js:
3594         * microbenchmarks/memcpy-typed-loop.js:
3595         * microbenchmarks/memcpy-wasm-large.js:
3596         * microbenchmarks/memcpy-wasm-medium.js:
3597         * microbenchmarks/memcpy-wasm-small.js:
3598         * microbenchmarks/memcpy-wasm.js:
3599         * microbenchmarks/method-on-number.js:
3600         * microbenchmarks/min-boolean.js:
3601         * microbenchmarks/minus-boolean-double.js:
3602         * microbenchmarks/minus-boolean.js:
3603         * microbenchmarks/misc-strict-eq.js:
3604         * microbenchmarks/mod-boolean-double.js:
3605         * microbenchmarks/mod-boolean.js:
3606         * microbenchmarks/mod-untyped.js:
3607         * microbenchmarks/mul-boolean-double.js:
3608         * microbenchmarks/mul-boolean.js:
3609         * microbenchmarks/mul-immediate-sub.js:
3610         * microbenchmarks/neg-boolean.js:
3611         * microbenchmarks/negative-zero-divide.js:
3612         * microbenchmarks/negative-zero-modulo.js:
3613         * microbenchmarks/negative-zero-negate.js:
3614         * microbenchmarks/new-array-buffer-dead.js:
3615         * microbenchmarks/new-array-buffer-push.js:
3616         * microbenchmarks/new-array-buffer-vector-profile.js:
3617         * microbenchmarks/new-array-dead.js:
3618         * microbenchmarks/new-array-push.js:
3619         * microbenchmarks/new-error.js:
3620         * microbenchmarks/no-inline-constructor.js:
3621         * microbenchmarks/number-test.js:
3622         * microbenchmarks/number-to-string-strength-reduction.js:
3623         * microbenchmarks/number-to-string-with-add-empty.js:
3624         * microbenchmarks/number-to-string-with-add-in-loop.js:
3625         * microbenchmarks/number-to-string-with-add.js:
3626         * microbenchmarks/number-to-string-with-radix-10.js:
3627         * microbenchmarks/number-to-string-with-radix-cse.js:
3628         * microbenchmarks/number-to-string-with-radix.js:
3629         * microbenchmarks/object-and.js:
3630         * microbenchmarks/object-closure-call.js:
3631         * microbenchmarks/object-create-constant-prototype.js:
3632         * microbenchmarks/object-create-null.js:
3633         * microbenchmarks/object-create-unknown-object-prototype.js:
3634         * microbenchmarks/object-create-untyped-prototype.js:
3635         * microbenchmarks/object-entries.js:
3636         * microbenchmarks/object-get-own-property-symbols-on-large-array.js:
3637         * microbenchmarks/object-get-own-property-symbols.js:
3638         * microbenchmarks/object-int-add-array.js:
3639         * microbenchmarks/object-int-add.js:
3640         * microbenchmarks/object-int-and-array.js:
3641         * microbenchmarks/object-int-mul-array.js:
3642         * microbenchmarks/object-int-sub-array.js:
3643         * microbenchmarks/object-int-sub.js:
3644         * microbenchmarks/object-is.js:
3645         * microbenchmarks/object-iterate-symbols.js:
3646         * microbenchmarks/object-iterate.js:
3647         * microbenchmarks/object-keys-map-values.js:
3648         * microbenchmarks/object-keys.js:
3649         * microbenchmarks/object-lshift.js:
3650         * microbenchmarks/object-or.js:
3651         * microbenchmarks/object-rshift.js:
3652         * microbenchmarks/object-test.js:
3653         * microbenchmarks/object-urshift.js:
3654         * microbenchmarks/object-values.js:
3655         * microbenchmarks/object-xor.js:
3656         * microbenchmarks/obvious-sink-pathology-taken.js:
3657         * microbenchmarks/obvious-sink-pathology.js:
3658         * microbenchmarks/obviously-elidable-new-object.js:
3659         * microbenchmarks/plus-boolean-arith.js:
3660         * microbenchmarks/plus-boolean-double.js:
3661         * microbenchmarks/plus-boolean.js:
3662         * microbenchmarks/poly-chain-access-different-prototypes-simple.js:
3663         * microbenchmarks/poly-chain-access-different-prototypes.js:
3664         * microbenchmarks/poly-chain-access-simpler.js:
3665         * microbenchmarks/poly-chain-access.js:
3666         * microbenchmarks/poly-proto-access.js:
3667         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js:
3668         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js:
3669         * microbenchmarks/poly-proto-put-transition-speed.js:
3670         * microbenchmarks/poly-proto-setter-speed.js:
3671         * microbenchmarks/poly-stricteq.js:
3672         * microbenchmarks/polymorphic-array-call.js:
3673         * microbenchmarks/polymorphic-get-by-id.js:
3674         * microbenchmarks/polymorphic-put-by-id.js:
3675         * microbenchmarks/polymorphic-put-by-val-with-string.js:
3676         * microbenchmarks/polymorphic-put-by-val-with-symbol.js:
3677         * microbenchmarks/polymorphic-structure.js:
3678         * microbenchmarks/polyvariant-get-by-id-shorter-tower.js:
3679         * microbenchmarks/polyvariant-get-by-id-tower.js:
3680         * microbenchmarks/polyvariant-monomorphic-get-by-id.js:
3681         * microbenchmarks/prevent-extensions-and-do-work.js:
3682         * microbenchmarks/promise-creation-many.js:
3683         * microbenchmarks/proto-getter-access.js:
3684         * microbenchmarks/prototype-access-with-mutating-prototype.js:
3685         * microbenchmarks/put-by-id-replace-and-transition.js:
3686         * microbenchmarks/put-by-id-slightly-polymorphic.js:
3687         * microbenchmarks/put-by-id-transition-with-indexing-header.js:
3688         * microbenchmarks/put-by-id.js:
3689         * microbenchmarks/put-by-val-direct-large-index.js:
3690         * microbenchmarks/put-by-val-direct.js:
3691         * microbenchmarks/put-by-val-large-index-blank-indexing-type.js:
3692         * microbenchmarks/put-by-val-machine-int.js:
3693         * microbenchmarks/put-by-val-negative-array-index.js:
3694         * microbenchmarks/put-by-val-with-string-replace-and-transition.js:
3695         * microbenchmarks/put-by-val-with-string-slightly-polymorphic.js:
3696         * microbenchmarks/put-by-val-with-string.js:
3697         * microbenchmarks/put-by-val-with-symbol-replace-and-transition.js:
3698         * microbenchmarks/put-by-val-with-symbol-slightly-polymorphic.js:
3699         * microbenchmarks/put-by-val-with-symbol.js:
3700         * microbenchmarks/rare-osr-exit-on-local.js:
3701         * microbenchmarks/raytrace-with-empty-try-catch.js:
3702         * microbenchmarks/raytrace-with-try-catch.js:
3703         * microbenchmarks/regexp-exec.js:
3704         * microbenchmarks/regexp-last-index.js:
3705         * microbenchmarks/regexp-nested-nonzero-min-counted-parens.js:
3706         * microbenchmarks/regexp-prototype-is-not-instance.js:
3707         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
3708         * microbenchmarks/regexp-prototype-search-observable-side-effects2.js:
3709         * microbenchmarks/regexp-prototype-split-observable-side-effects.js:
3710         * microbenchmarks/regexp-prototype-split-observable-side-effects2.js:
3711         * microbenchmarks/regexp-prototype-split-observable-side-effects3-flags.js:
3712         * microbenchmarks/regexp-prototype-split-observable-side-effects3-global.js:
3713         * microbenchmarks/regexp-prototype-split-observable-side-effects3-ignoreCase.js:
3714         * microbenchmarks/regexp-prototype-split-observable-side-effects3-multiline.js:
3715         * microbenchmarks/regexp-prototype-split-observable-side-effects3-sticky.js:
3716         * microbenchmarks/regexp-prototype-split-observable-side-effects3-unicode.js:
3717         * microbenchmarks/regexp-prototype-split-observable-side-effects4.js:
3718         * microbenchmarks/regexp-prototype-test-observable-side-effects.js:
3719         * microbenchmarks/regexp-prototype-test-observable-side-effects2.js:
3720         * microbenchmarks/regexp-set-last-index.js:
3721         * microbenchmarks/regexp-u-global-es5.js:
3722         * microbenchmarks/regexp-u-global-es6.js:
3723         * microbenchmarks/register-pressure-from-osr.js:
3724         * microbenchmarks/repeat-multi-get-by-offset.js:
3725         * microbenchmarks/rest-parameter-construction-performance.js:
3726         * microbenchmarks/richards-empty-try-catch.js:
3727         * microbenchmarks/richards-try-catch.js:
3728         * microbenchmarks/scoped-arguments-length.js:
3729         * microbenchmarks/scoped-arguments-overridden-length.js:
3730         * microbenchmarks/scoped-arguments-possibly-overridden-length.js:
3731         * microbenchmarks/seal-and-do-work.js:
3732         * microbenchmarks/set-for-each.js:
3733         * microbenchmarks/set-for-of.js:
3734         * microbenchmarks/setter-prototype.js:
3735         * microbenchmarks/setter.js:
3736         * microbenchmarks/simple-activation-demo.js:
3737         * microbenchmarks/simple-getter-access.js:
3738         * microbenchmarks/simple-poly-call-nested.js:
3739         * microbenchmarks/simple-poly-call.js:
3740         * microbenchmarks/simple-regexp-exec-folding-fail.js:
3741         * microbenchmarks/simple-regexp-exec-folding.js:
3742         * microbenchmarks/simple-regexp-test-folding-fail-with-hoisted-regexp.js:
3743         * microbenchmarks/simple-regexp-test-folding-fail.js:
3744         * microbenchmarks/simple-regexp-test-folding-with-hoisted-regexp.js:
3745         * microbenchmarks/simple-regexp-test-folding.js:
3746         * microbenchmarks/sin-boolean.js:
3747         * microbenchmarks/singleton-scope.js:
3748         * microbenchmarks/sink-function.js:
3749         * microbenchmarks/sink-huge-activation.js:
3750         * microbenchmarks/sinkable-new-object-dag.js:
3751         * microbenchmarks/sinkable-new-object-taken.js:
3752         * microbenchmarks/sinkable-new-object-with-builtin-constructor.js:
3753         * microbenchmarks/sinkable-new-object.js:
3754         * microbenchmarks/slow-array-profile-convergence.js:
3755         * microbenchmarks/slow-convergence.js:
3756         * microbenchmarks/slow-ternaries.js:
3757         * microbenchmarks/sorting-benchmark.js:
3758         * microbenchmarks/sparse-conditional.js:
3759         * microbenchmarks/sparse-set.js:
3760         * microbenchmarks/splice-to-remove.js:
3761         * microbenchmarks/strcat-const.js:
3762         * microbenchmarks/strcat-length-const.js:
3763         * microbenchmarks/strict-osr-entry.js:
3764         * microbenchmarks/string-char-code-at.js:
3765         * microbenchmarks/string-concat-convert.js:
3766         * microbenchmarks/string-concat-long-convert.js:
3767         * microbenchmarks/string-concat-long.js:
3768         * microbenchmarks/string-concat-object.js:
3769         * microbenchmarks/string-concat-pair-object.js:
3770         * microbenchmarks/string-concat-pair-simple.js:
3771         * microbenchmarks/string-concat-simple.js:
3772         * microbenchmarks/string-concat.js:
3773         * microbenchmarks/string-cons-repeat.js:
3774         * microbenchmarks/string-cons-tower.js:
3775         * microbenchmarks/string-equality.js:
3776         * microbenchmarks/string-from-char-code.js:
3777         * microbenchmarks/string-get-by-val-big-char.js:
3778         * microbenchmarks/string-get-by-val-out-of-bounds-insane.js:
3779         * microbenchmarks/string-get-by-val-out-of-bounds.js:
3780         * microbenchmarks/string-get-by-val.js:
3781         * microbenchmarks/string-hash.js:
3782         * microbenchmarks/string-long-ident-equality.js:
3783         * microbenchmarks/string-object-to-string.js:
3784         * microbenchmarks/string-object-value-of.js:
3785         * microbenchmarks/string-out-of-bounds.js:
3786         * microbenchmarks/string-prototype-search-observable-side-effects.js:
3787         * microbenchmarks/string-prototype-search-observable-side-effects2.js:
3788         * microbenchmarks/string-prototype-search-observable-side-effects3.js:
3789         * microbenchmarks/string-prototype-search-observable-side-effects4.js:
3790         * microbenchmarks/string-prototype-split-observable-side-effects.js:
3791         * microbenchmarks/string-prototype-split-observable-side-effects2.js:
3792         * microbenchmarks/string-prototype-split-observable-side-effects3-flags.js:
3793         * microbenchmarks/string-prototype-split-observable-side-effects3-global.js:
3794         * microbenchmarks/string-prototype-split-observable-side-effects3-ignoreCase.js:
3795         * microbenchmarks/string-prototype-split-observable-side-effects3-multiline.js:
3796         * microbenchmarks/string-prototype-split-observable-side-effects3-sticky.js:
3797         * microbenchmarks/string-prototype-split-observable-side-effects3-unicode.js:
3798         * microbenchmarks/string-prototype-split-observable-side-effects4.js:
3799         * microbenchmarks/string-repeat-arith.js:
3800         * microbenchmarks/string-repeat-not-resolving-fixed.js:
3801         * microbenchmarks/string-repeat-not-resolving-no-inline.js:
3802         * microbenchmarks/string-repeat-not-resolving.js:
3803         * microbenchmarks/string-repeat-resolving-fixed.js:
3804         * microbenchmarks/string-repeat-resolving-no-inline.js:
3805         * microbenchmarks/string-repeat-resolving.js:
3806         * microbenchmarks/string-repeat-single-not-resolving.js:
3807         * microbenchmarks/string-repeat-single-resolving.js:
3808         * microbenchmarks/string-repeat-small-not-resolving.js:
3809         * microbenchmarks/string-repeat-small-resolving.js:
3810         * microbenchmarks/string-replace-empty.js:
3811         * microbenchmarks/string-replace-generic.js:
3812         * microbenchmarks/string-replace.js:
3813         * microbenchmarks/string-rope-with-object.js:
3814         * microbenchmarks/string-slice-empty.js:
3815         * microbenchmarks/string-slice-one-char.js:
3816         * microbenchmarks/string-slice.js:
3817         * microbenchmarks/string-sub.js:
3818         * microbenchmarks/string-test.js:
3819         * microbenchmarks/string-transcoding.js:
3820         * microbenchmarks/string-var-equality.js:
3821         * microbenchmarks/stringalloc.js:
3822         * microbenchmarks/structure-hoist-over-transitions.js:
3823         * microbenchmarks/substring-concat-weird.js:
3824         * microbenchmarks/substring-concat.js:
3825         * microbenchmarks/substring.js:
3826         * microbenchmarks/super-get-by-id-with-this-monomorphic.js:
3827         * microbenchmarks/super-get-by-id-with-this-polymorphic.js:
3828         * microbenchmarks/super-get-by-val-with-this-monomorphic.js:
3829         * microbenchmarks/super-get-by-val-with-this-polymorphic.js:
3830         * microbenchmarks/super-getter.js:
3831         * microbenchmarks/switch-char-constant.js:
3832         * microbenchmarks/switch-char.js:
3833         * microbenchmarks/switch-constant.js:
3834         * microbenchmarks/switch-string-basic-big-var.js:
3835         * microbenchmarks/switch-string-basic-big.js:
3836         * microbenchmarks/switch-string-basic-var.js:
3837         * microbenchmarks/switch-string-basic.js:
3838         * microbenchmarks/switch-string-big-length-tower-var.js:
3839         * microbenchmarks/switch-string-length-tower-var.js:
3840         * microbenchmarks/switch-string-length-tower.js:
3841         * microbenchmarks/switch-string-short.js:
3842         * microbenchmarks/switch.js:
3843         * microbenchmarks/switching-size-classes.js:
3844         * microbenchmarks/symbol-creation.js:
3845         * microbenchmarks/symbol-tostringtag.js:
3846         * microbenchmarks/tan.js:
3847         * microbenchmarks/tear-off-arguments-simple.js:
3848         * microbenchmarks/tear-off-arguments.js:
3849         * microbenchmarks/template-string-array.js:
3850         * microbenchmarks/temporal-structure.js:
3851         * microbenchmarks/throw.js:
3852         * microbenchmarks/to-int32-boolean.js:
3853         * microbenchmarks/to-number-boolean.js:
3854         * microbenchmarks/to-number-constructor-number-string-number-string.js:
3855         * microbenchmarks/to-number-constructor-only-number.js:
3856         * microbenchmarks/to-number-constructor-only-string.js:
3857         * microbenchmarks/to-number-constructor-string-number-string-number.js:
3858         * microbenchmarks/to-number-number-string-number-string.js:
3859         * microbenchmarks/to-number-only-number.js:
3860         * microbenchmarks/to-number-only-string.js:
3861         * microbenchmarks/to-number-string-number-string-number.js:
3862         * microbenchmarks/to-string-on-cow-array.js:
3863         * microbenchmarks/try-catch-get-by-val-cloned-arguments.js:
3864         * microbenchmarks/try-catch-get-by-val-direct-arguments.js:
3865         * microbenchmarks/try-catch-get-by-val-scoped-arguments.js:
3866         * microbenchmarks/try-catch-word-count.js:
3867         * microbenchmarks/try-get-by-id-basic.js:
3868         * microbenchmarks/try-get-by-id-polymorphic.js:
3869         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
3870         * microbenchmarks/typed-array-subarray.js:
3871         * microbenchmarks/typed-array-sum.js:
3872         * microbenchmarks/undefined-test.js:
3873         * microbenchmarks/unprofiled-licm.js:
3874         * microbenchmarks/untyped-string-from-char-code.js:
3875         * microbenchmarks/v8-raytrace-with-empty-try-catch.js:
3876         * microbenchmarks/v8-raytrace-with-try-catch.js:
3877         * microbenchmarks/v8-regexp-search.js:
3878         * microbenchmarks/varargs-call.js:
3879         * microbenchmarks/varargs-construct-inline.js:
3880         * microbenchmarks/varargs-construct.js:
3881         * microbenchmarks/varargs-inline.js:
3882         * microbenchmarks/varargs-strict-mode.js:
3883         * microbenchmarks/varargs.js:
3884         * microbenchmarks/vector-length-hint-array-constructor.js:
3885         * microbenchmarks/vector-length-hint-new-array.js:
3886         * microbenchmarks/weak-map-key.js:
3887         * microbenchmarks/weak-set-key.js:
3888         * microbenchmarks/weird-inlining-const-prop.js:
3889
3890 2019-10-22  Mark Lam  <mark.lam@apple.com>
3891
3892         Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky().
3893         https://bugs.webkit.org/show_bug.cgi?id=203230
3894         <rdar://problem/56460749>
3895
3896         Reviewed by Robin Morisset.
3897
3898         * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Added.
3899
3900 2019-10-21  Mark Lam  <mark.lam@apple.com>
3901
3902         Rolling out r251411: Fix is incorrect.
3903         https://bugs.webkit.org/show_bug.cgi?id=203230
3904
3905         Not reviewed.
3906
3907         * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Removed.
3908
3909 2019-10-21  Mark Lam  <mark.lam@apple.com>
3910
3911         Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky().
3912         https://bugs.webkit.org/show_bug.cgi?id=203230
3913         <rdar://problem/56460749>
3914
3915         Reviewed by Robin Morisset.
3916
3917         * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Added.
3918
3919 2019-10-21  Saam Barati  <sbarati@apple.com>
3920
3921         ValuePow's constant folding rule differs from what the runtime does
3922         https://bugs.webkit.org/show_bug.cgi?id=203220
3923         <rdar://problem/56181441>
3924
3925         Reviewed by Yusuke Suzuki.
3926
3927         * value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js: Added.
3928         (foo):
3929
3930 2019-10-21  Mark Lam  <mark.lam@apple.com>
3931
3932         Fix missing exception check in JSON Stringifier.
3933         https://bugs.webkit.org/show_bug.cgi?id=203227
3934         <rdar://problem/56459854>
3935
3936         Reviewed by Keith Miller.
3937
3938         * stress/missing-exception-check-in-josn-stringifier.js: Added.
3939
3940 2019-10-21  Saam Barati  <sbarati@apple.com>
3941
3942         JSON.parse has bad is array assert
3943         https://bugs.webkit.org/show_bug.cgi?id=203207
3944         <rdar://problem/56366913>
3945
3946         Reviewed by Yusuke Suzuki.
3947
3948         * stress/json-parse-array-prototype-is-array-assert.js: Added.
3949         (assert):
3950
3951 2019-10-21  Robin Morisset  <rmorisset@apple.com>
3952
3953         Throw the right exception upon memory exhaustion in Array::slice
3954         https://bugs.webkit.org/show_bug.cgi?id=202650
3955
3956         Reviewed by Saam Barati.
3957
3958         * stress/array-slice-memory-exhaustion.js: Added.
3959         (foo):
3960
3961 2019-10-21  Robin Morisset  <rmorisset@apple.com>
3962
3963         Post increment/decrement should only call ToNumber once
3964         https://bugs.webkit.org/show_bug.cgi?id=202711
3965
3966         Reviewed by Saam Barati.
3967
3968         * stress/postinc-custom-valueOf.js: Added.
3969         (postInc):
3970         (postDec):
3971
3972 2019-10-18  Yusuke Suzuki  <ysuzuki@apple.com>
3973
3974         [JSC] DFG::CommonData modification by DFG reallyAdd should be guarded by CodeBlock's lock
3975         https://bugs.webkit.org/show_bug.cgi?id=203177
3976
3977         Reviewed by Mark Lam.
3978
3979         * stress/dfg-really-add-locking.js: Added.
3980
3981 2019-10-17  Mark Lam  <mark.lam@apple.com>
3982
3983         Add missing checks after calls to the sameValue() JSValue comparator.
3984         https://bugs.webkit.org/show_bug.cgi?id=203126
3985         <rdar://problem/56366561>
3986
3987         Reviewed by Saam Barati.
3988
3989         * stress/validate-exception-check-in-proxy-object-put.js: Added.
3990
3991 2019-10-17  Saam Barati  <sbarati@apple.com>
3992
3993         GetByVal and PutByVal on ArrayStorage need to use the same AbstractHeap
3994         https://bugs.webkit.org/show_bug.cgi?id=203124
3995         <rdar://problem/55988183>
3996
3997         Reviewed by Yusuke Suzuki.
3998
3999         * stress/licm-array-storage-get-and-put-by-val.js: Added.
4000         (assert):
4001         (foo):
4002
4003 2019-10-16  Keith Miller  <keith_miller@apple.com>
4004
4005         Move assert in Wasm::Plan::fail.
4006         https://bugs.webkit.org/show_bug.cgi?id=203052
4007
4008         Reviewed by Mark Lam.
4009
4010         * wasm/regress/wasm-plan-fail-bad-error-message-assert.js: Added.
4011         (Binary):
4012         (Binary.prototype.trunc_buffer):
4013         (Binary.prototype.emit_leb_u):
4014         (Binary.prototype.emit_u32v):
4015         (Binary.prototype.emit_bytes):
4016         (Binary.prototype.emit_header):
4017         (__f_576):
4018         (__f_587):
4019
4020 2019-10-15  Mark Lam  <mark.lam@apple.com>
4021
4022         operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string.
4023         https://bugs.webkit.org/show_bug.cgi?id=202312
4024         <rdar://problem/55782280>
4025
4026         Reviewed by Yusuke Suzuki.
4027
4028         * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js: Added.
4029         * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js: Added.
4030         * stress/switch-on-char-llint-rope.js:
4031         - Changed this test to make a new rope string for each iterations.  Otherwise,
4032           the rope will get resolved, and subsequent tiers will not be testing with a rope.
4033
4034 2019-10-14  Yusuke Suzuki  <ysuzuki@apple.com>
4035
4036         [JSC] GetterSetter should be JSCell, not JSObject
4037         https://bugs.webkit.org/show_bug.cgi?id=202656
4038
4039         Reviewed by Tadeu Zagallo and Saam Barati.
4040
4041         * stress/getter-setter-should-be-cell.js: Added.
4042         (foo.with.):
4043         (foo.with.get for):
4044         (foo.with.bar):
4045         (foo):
4046
4047 2019-10-14  Saam Barati  <sbarati@apple.com>
4048
4049         Canonicalize how we prepare the prototype chain for inline caching
4050         https://bugs.webkit.org/show_bug.cgi?id=202827
4051         <rdar://problem/56193919>
4052
4053         Reviewed by Yusuke Suzuki.
4054
4055         * stress/cache-correct-offset-after-flattening.js: Added.
4056         (assert):
4057
4058 2019-10-14  Paulo Matos  <pmatos@igalia.com>
4059
4060         Skip memcpy-typed-loop timing out on ARMv7 pending investigation
4061         https://bugs.webkit.org/show_bug.cgi?id=202923
4062
4063         Reviewed by Adrian Perez de Castro.
4064
4065         * microbenchmarks/memcpy-typed-loop.js:
4066
4067 2019-10-11  Keith Miller  <keith_miller@apple.com>
4068
4069         Wasm B3IRGenerator should use arguments for control data.
4070         https://bugs.webkit.org/show_bug.cgi?id=202855
4071
4072         Reviewed by Yusuke Suzuki.
4073
4074         * wasm/stress/loop-more-args-than-results.js: Added.
4075
4076 2019-10-10  Mark Lam  <mark.lam@apple.com>
4077
4078         Modify JSTests/stress/string-overflow-createError-*.js tests to allow an OOME result.
4079         https://bugs.webkit.org/show_bug.cgi?id=202828
4080
4081         Reviewed by Yusuke Suzuki.
4082
4083         The tests intentionally allocate a very large string.  Hence, for some memory
4084         limited configurations, it is perfectly reasonable for the test to throw an Out
4085         Of Memory error.
4086
4087         * stress/string-overflow-createError-builder.js:
4088         * stress/string-overflow-createError-fit.js:
4089
4090 2019-10-09  Yusuke Suzuki  <ysuzuki@apple.com>
4091
4092         Unreviewed, roll out r250878
4093         https://bugs.webkit.org/show_bug.cgi?id=202656
4094
4095         Breaking vimeo page.
4096
4097         * stress/getter-setter-should-be-cell.js: Removed.
4098
4099 2019-10-08  Yusuke Suzuki  <ysuzuki@apple.com>
4100
4101         [JSC] GetterSetter should be JSCell, not JSObject
4102         https://bugs.webkit.org/show_bug.cgi?id=202656
4103
4104         Reviewed by Tadeu Zagallo and Saam Barati.
4105
4106         * stress/getter-setter-should-be-cell.js: Added.
4107         (foo.with.):
4108         (foo.with.get for):
4109         (foo.with.bar):
4110         (foo):
4111
4112 2019-10-08  Alexey Shvayka  <shvaikalesh@gmail.com>
4113
4114         JSON.parse incorrectly handles array proxies
4115         https://bugs.webkit.org/show_bug.cgi?id=199292
4116
4117         Reviewed by Saam Barati.
4118
4119         * microbenchmarks/json-parse-array-reviver-same-value.js: Added.
4120         * microbenchmarks/json-parse-array-reviver.js: Added.
4121         * microbenchmarks/json-parse-object-reviver-same-value.js: Added.
4122         * microbenchmarks/json-parse-object-reviver.js: Added.
4123         * stress/json-parse-reviver-array-proxy.js: Added.
4124         * stress/json-parse-reviver-revoked-proxy.js: Added.
4125         * test262/expectations.yaml: Mark 6 test cases as passing.
4126
4127 2019-10-08  Ross Kirsling  <ross.kirsling@sony.com>
4128
4129         Update test262 (2019.10.08).
4130
4131         Rubber-stamped by Keith Miller.
4132
4133         * test262/config.yaml:
4134         * test262/expectations.yaml:
4135         * test262/latest-changes-summary.txt:
4136         * test262/test/:
4137         * test262/test262-Revision.txt:
4138
4139 2019-10-07  Saam Barati  <sbarati@apple.com>
4140
4141         Allow OSR exit to the LLInt
4142         https://bugs.webkit.org/show_bug.cgi?id=197993
4143
4144         Reviewed by Tadeu Zagallo.
4145
4146         * stress/exit-from-getter-by-val.js: Added.
4147         * stress/exit-from-setter-by-val.js: Added.
4148
4149 2019-10-07  Matt Lewis  <jlewis3@apple.com>
4150
4151         Unreviewed, rolling out r250750.
4152
4153         Reverting change as this broke interal test over the weekend.
4154
4155         Reverted changeset:
4156
4157         "Allow OSR exit to the LLInt"
4158         https://bugs.webkit.org/show_bug.cgi?id=197993
4159         https://trac.webkit.org/changeset/250750
4160
4161 2019-10-04  Saam Barati  <sbarati@apple.com>
4162
4163         Allow OSR exit to the LLInt
4164         https://bugs.webkit.org/show_bug.cgi?id=197993
4165
4166         Reviewed by Tadeu Zagallo.
4167
4168         * stress/exit-from-getter-by-val.js: Added.
4169         * stress/exit-from-setter-by-val.js: Added.
4170
4171 2019-10-04  Paulo Matos  <pmatos@igalia.com>
4172
4173         Revert regexp test skip on armv7l and mips
4174         https://bugs.webkit.org/show_bug.cgi?id=202310
4175
4176         Reviewed by Žan Doberšek.
4177
4178         Test was skipped in bug 202113 on armv7l and mips due to bug 202041.
4179         Bug 202041 is fixed and change of bug 202113 can be reverted.
4180
4181         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
4182
4183 2019-10-02  Mark Lam  <mark.lam@apple.com>
4184
4185         DoubleToStringConverter::ToExponential() should null terminate its string.
4186         https://bugs.webkit.org/show_bug.cgi?id=202492
4187         <rdar://problem/55907708>
4188
4189         Reviewed by Filip Pizlo.
4190
4191         * stress/dtoa-AddSubstring-should-uses-strnlen-in-assertion.js: Added.
4192
4193 2019-10-02  Yusuke Suzuki  <ysuzuki@apple.com>
4194
4195         [JSC] AsyncGenerator should have internal fields
4196         https://bugs.webkit.org/show_bug.cgi?id=201498
4197
4198         Reviewed by Saam Barati.
4199
4200         * stress/async-generator-construct-failure.js: Added.
4201         (shouldThrow):
4202         (async.gen):
4203         (TypeError):
4204         * stress/async-generator-prototype-change.js: Added.
4205         (shouldBe):
4206         (async.gen):
4207         * stress/async-generator-prototype-closure.js: Added.
4208         (shouldBe):
4209         (test.async.gen):
4210         (test):
4211         * stress/create-async-generator.js: Added.
4212         (shouldBe):
4213         (test.async.generator):
4214         (test):
4215
4216 2019-10-01  Saam Barati  <sbarati@apple.com>
4217
4218         ObjectAllocationSinkingPhase shouldn't insert hints for allocations which are no longer valid
4219         https://bugs.webkit.org/show_bug.cgi?id=199361
4220         <rdar://problem/52454940>
4221
4222         Reviewed by Yusuke Suzuki.
4223
4224         * stress/allocation-sinking-hints-are-valid-ssa-2.js: Added.
4225         (main.fn):
4226         (main.executor):
4227         (main):
4228         * stress/allocation-sinking-hints-are-valid-ssa.js: Added.
4229         (main.fn):
4230         (main.executor):
4231         (main):
4232
4233 2019-10-01  Keith Miller  <keith_miller@apple.com>
4234
4235         skip test until we figure out why it's timing out
4236         https://bugs.webkit.org/show_bug.cgi?id=202423
4237
4238         Reviewed by Mark Lam.
4239
4240         new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js consistently times out on the bots.
4241         Let's skip it until we figure out what's going on.
4242
4243         * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js:
4244
4245 2019-10-01  Keith Miller  <keith_miller@apple.com>
4246
4247         Mark toctou test as skipped on debug builds
4248         https://bugs.webkit.org/show_bug.cgi?id=202420
4249
4250         Reviewed by Saam Barati.
4251
4252         Keeps timing out... Let's just skip it.
4253
4254         * stress/toctou-having-a-bad-time-new-array.js:
4255
4256 2019-10-01  Keith Miller  <keith_miller@apple.com>
4257
4258         Test262 update
4259
4260         Rubber-stamped by Michael Saboff.
4261
4262         Note, this was too big to effectivetly put on bugzilla as it's a 10MB patch...
4263
4264         * test262/*:
4265
4266 2019-10-01  Michael Saboff  <msaboff@apple.com> and Paulo Matos  <pmatos@igalia.com>
4267
4268         [YARR] Properly handle surrogates when matching back references
4269         https://bugs.webkit.org/show_bug.cgi?id=202041
4270
4271         Reviewed by Keith Miller.
4272
4273         Unchanged from the workin progress patch posted by Paulo Matos <pmatos@igalia.com>.
4274
4275