JSTests/ChangeLog

   1 2017-10-20  Mark Lam  <mark.lam@apple.com>
   2
   3         Add a test case for r214334.
   4         https://bugs.webkit.org/show_bug.cgi?id=169941
   5         <rdar://problem/31221258>
   6
   7         Reviewed by JF Bastien.
   8
   9         * stress/regress-169941.js: Added.
  10
  11 2017-10-19  JF Bastien  <jfbastien@apple.com>
  12
  13         WebAssembly: no VM / JS version of everything but Instance
  14         https://bugs.webkit.org/show_bug.cgi?id=177473
  15
  16         Reviewed by Filip Pizlo, Saam Barati.
  17
  18         - Exceeding max on memory growth now returns a range error as per
  19         spec. This is a (very minor) breaking change: it used to throw OOM
  20         error. Update the corresponding test.
  21
  22         * wasm/js-api/memory-grow.js:
  23         (assertEq):
  24         * wasm/js-api/table.js:
  25         (assert.throws):
  26
  27 2017-10-19  Mark Lam  <mark.lam@apple.com>
  28
  29         Stringifier::appendStringifiedValue() is missing an exception check.
  30         https://bugs.webkit.org/show_bug.cgi?id=178386
  31         <rdar://problem/35027610>
  32
  33         Reviewed by Saam Barati.
  34
  35         * stress/regress-178386.js: Added.
  36
  37 2017-10-19  Michael Saboff  <msaboff@apple.com>
  38
  39         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
  40         https://bugs.webkit.org/show_bug.cgi?id=178521
  41
  42         Reviewed by JF Bastien.
  43
  44         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
  45         now passes with the current version (5.0) of the Emoji spec.
  46
  47 2017-10-19  Robin Morisset  <rmorisset@apple.com>
  48
  49         Turn recursive tail calls into loops
  50         https://bugs.webkit.org/show_bug.cgi?id=176601
  51
  52         Reviewed by Saam Barati.
  53
  54         Add some simple test that computes factorial in several ways, and other trivial computations.
  55         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
  56         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
  57         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
  58         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
  59
  60         * stress/inline-call-to-recursive-tail-call.js: Added.
  61         (factorial.aux):
  62         (factorial):
  63         (factorial2.aux):
  64         (factorial2.id):
  65         (factorial2):
  66         (factorial3.aux):
  67         (factorial3):
  68         (aux):
  69         (factorial4):
  70         (test):
  71
  72 2017-10-18  Mark Lam  <mark.lam@apple.com>
  73
  74         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
  75         https://bugs.webkit.org/show_bug.cgi?id=177600
  76         <rdar://problem/34710985>
  77
  78         Reviewed by Saam Barati.
  79
  80         * stress/regress-177600.js: Added.
  81
  82 2017-10-18  Mark Lam  <mark.lam@apple.com>
  83
  84         The compiler should always register a structure when it adds its transitionWatchPointSet.
  85         https://bugs.webkit.org/show_bug.cgi?id=178420
  86         <rdar://problem/34814024>
  87
  88         Reviewed by Saam Barati and Filip Pizlo.
  89
  90         * stress/regress-178420.js: Added.
  91         (new.Array.10000.map):
  92
  93 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
  94
  95         [JSC] __proto__ getter should be fast
  96         https://bugs.webkit.org/show_bug.cgi?id=178067
  97
  98         Reviewed by Saam Barati.
  99
 100         * stress/dfg-object-proto-accessor.js: Added.
 101         (shouldBe):
 102         (shouldThrow):
 103         (target):
 104         * stress/dfg-object-proto-getter.js: Added.
 105         (shouldBe):
 106         (shouldThrow):
 107         (target):
 108         * stress/dfg-object-prototype-of.js: Added.
 109         (shouldBe):
 110         (shouldThrow):
 111         (target):
 112         * stress/dfg-reflect-get-prototype-of.js: Added.
 113         (shouldBe):
 114         (shouldThrow):
 115         (target):
 116         * stress/intrinsic-getter-with-poly-proto.js: Added.
 117         (shouldBe):
 118         (makePolyProtoObject.foo.C):
 119         (makePolyProtoObject.foo):
 120         (makePolyProtoObject):
 121         (target):
 122         * stress/object-get-prototype-of-filtered.js: Added.
 123         (shouldBe):
 124         (shouldThrow):
 125         (target):
 126         (i.Cocoa):
 127         * stress/object-get-prototype-of-mono-proto.js: Added.
 128         (shouldBe):
 129         (makePolyProtoObject.foo.C):
 130         (makePolyProtoObject.foo):
 131         (makePolyProtoObject):
 132         (target):
 133         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 134         (shouldBe):
 135         (makePolyProtoObject.foo.C):
 136         (makePolyProtoObject.foo):
 137         (makePolyProtoObject):
 138         (target):
 139         * stress/object-get-prototype-of-poly-proto.js: Added.
 140         (shouldBe):
 141         (makePolyProtoObject.foo.C):
 142         (makePolyProtoObject.foo):
 143         (makePolyProtoObject):
 144         (target):
 145         * stress/object-proto-getter-filtered.js: Added.
 146         (shouldBe):
 147         (shouldThrow):
 148         (target):
 149         (i.Cocoa):
 150         * stress/object-proto-getter-poly-mono-proto.js: Added.
 151         (shouldBe):
 152         (makePolyProtoObject.foo.C):
 153         (makePolyProtoObject.foo):
 154         (makePolyProtoObject):
 155         (target):
 156         * stress/object-proto-getter-poly-proto.js: Added.
 157         (shouldBe):
 158         (makePolyProtoObject.foo.C):
 159         (makePolyProtoObject.foo):
 160         (makePolyProtoObject):
 161         (target):
 162         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 163         * stress/string-proto.js: Added.
 164         (shouldBe):
 165         (target):
 166
 167 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
 168
 169         Unreviewed, rolling out r223523.
 170
 171         A test for this change is failing on debug JSC bots.
 172
 173         Reverted changeset:
 174
 175         "[JSC] __proto__ getter should be fast"
 176         https://bugs.webkit.org/show_bug.cgi?id=178067
 177         https://trac.webkit.org/changeset/223523
 178
 179 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
 180
 181         [JSC] __proto__ getter should be fast
 182         https://bugs.webkit.org/show_bug.cgi?id=178067
 183
 184         Reviewed by Saam Barati.
 185
 186         * stress/dfg-object-proto-accessor.js: Added.
 187         (shouldBe):
 188         (shouldThrow):
 189         (target):
 190         * stress/dfg-object-proto-getter.js: Added.
 191         (shouldBe):
 192         (shouldThrow):
 193         (target):
 194         * stress/dfg-object-prototype-of.js: Added.
 195         (shouldBe):
 196         (shouldThrow):
 197         (target):
 198         * stress/dfg-reflect-get-prototype-of.js: Added.
 199         (shouldBe):
 200         (shouldThrow):
 201         (target):
 202         * stress/object-get-prototype-of-filtered.js: Added.
 203         (shouldBe):
 204         (shouldThrow):
 205         (target):
 206         (i.Cocoa):
 207         * stress/object-get-prototype-of-mono-proto.js: Added.
 208         (shouldBe):
 209         (makePolyProtoObject.foo.C):
 210         (makePolyProtoObject.foo):
 211         (makePolyProtoObject):
 212         (target):
 213         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 214         (shouldBe):
 215         (makePolyProtoObject.foo.C):
 216         (makePolyProtoObject.foo):
 217         (makePolyProtoObject):
 218         (target):
 219         * stress/object-get-prototype-of-poly-proto.js: Added.
 220         (shouldBe):
 221         (makePolyProtoObject.foo.C):
 222         (makePolyProtoObject.foo):
 223         (makePolyProtoObject):
 224         (target):
 225         * stress/object-proto-getter-filtered.js: Added.
 226         (shouldBe):
 227         (shouldThrow):
 228         (target):
 229         (i.Cocoa):
 230         * stress/object-proto-getter-poly-mono-proto.js: Added.
 231         (shouldBe):
 232         (makePolyProtoObject.foo.C):
 233         (makePolyProtoObject.foo):
 234         (makePolyProtoObject):
 235         (target):
 236         * stress/object-proto-getter-poly-proto.js: Added.
 237         (shouldBe):
 238         (makePolyProtoObject.foo.C):
 239         (makePolyProtoObject.foo):
 240         (makePolyProtoObject):
 241         (target):
 242         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 243         * stress/string-proto.js: Added.
 244         (shouldBe):
 245         (target):
 246
 247 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 248
 249         Reland "Add Above/Below comparisons for UInt32 patterns"
 250         https://bugs.webkit.org/show_bug.cgi?id=177281
 251
 252         Reviewed by Saam Barati.
 253
 254         * stress/uint32-comparison-jump.js: Added.
 255         (shouldBe):
 256         (above):
 257         (aboveOrEqual):
 258         (below):
 259         (belowOrEqual):
 260         (notAbove):
 261         (notAboveOrEqual):
 262         (notBelow):
 263         (notBelowOrEqual):
 264         * stress/uint32-comparison.js: Added.
 265         (shouldBe):
 266         (above):
 267         (aboveOrEqual):
 268         (below):
 269         (belowOrEqual):
 270         (aboveTest):
 271         (aboveOrEqualTest):
 272         (belowTest):
 273         (belowOrEqualTest):
 274
 275 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
 276
 277         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
 278         https://bugs.webkit.org/show_bug.cgi?id=178210
 279
 280         Reviewed by Saam Barati.
 281
 282         * wasm/function-tests/trap-from-start-async.js:
 283         (async.StartTrapsAsync):
 284         * wasm/function-tests/trap-from-start.js:
 285         (StartTraps):
 286         * wasm/js-api/web-assembly-function.js:
 287         (assert.eq.Object.getPrototypeOf):
 288         * wasm/js-api/wrapper-function.js:
 289         (return.new.WebAssembly.Module):
 290         (assert.throws.makeInstance): Deleted.
 291         (assert.throws.Bar): Deleted.
 292         (assert.throws): Deleted.
 293
 294 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 295
 296         Enable gigacage on iOS
 297         https://bugs.webkit.org/show_bug.cgi?id=177586
 298
 299         Reviewed by JF Bastien.
 300
 301         Add tests for when Gigacage gets runtime disabled.
 302
 303         * stress/disable-gigacage-arrays.js: Added.
 304         (foo):
 305         * stress/disable-gigacage-strings.js: Added.
 306         (foo):
 307         * stress/disable-gigacage-typed-arrays.js: Added.
 308         (foo):
 309
 310 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 311
 312         import.meta should not be assignable
 313         https://bugs.webkit.org/show_bug.cgi?id=178202
 314
 315         Reviewed by Saam Barati.
 316
 317         * modules/import-meta-assignment.js: Added.
 318         (shouldThrow):
 319         (SyntaxError.import.meta.can.shouldThrow):
 320
 321 2017-10-11  Saam Barati  <sbarati@apple.com>
 322
 323         Unreviewed. Actually skip certain type profiler tests in debug.
 324
 325         * typeProfiler.yaml:
 326         * typeProfiler/deltablue-for-of.js:
 327         * typeProfiler/getter-richards.js:
 328
 329 2017-10-11  Commit Queue  <commit-queue@webkit.org>
 330
 331         Unreviewed, rolling out r223113 and r223121.
 332         https://bugs.webkit.org/show_bug.cgi?id=178182
 333
 334         Reintroduced 20% regression on Kraken (Requested by rniwa on
 335         #webkit).
 336
 337         Reverted changesets:
 338
 339         "Enable gigacage on iOS"
 340         https://bugs.webkit.org/show_bug.cgi?id=177586
 341         https://trac.webkit.org/changeset/223113
 342
 343         "Use one virtual allocation for all gigacages and their
 344         runways"
 345         https://bugs.webkit.org/show_bug.cgi?id=178050
 346         https://trac.webkit.org/changeset/223121
 347
 348 2017-10-11  Michael Saboff  <msaboff@apple.com>
 349
 350         Disable test262 named capture group tests with direct unicode names and with references before definitions
 351         https://bugs.webkit.org/show_bug.cgi?id=178177
 352
 353         Reviewed by Keith Miller.
 354
 355         Bugs to track fixing these test are:
 356         https://bugs.webkit.org/show_bug.cgi?id=178174 -
 357             "Add support in named capture group identifiers for direct surrogate pairs"
 358         https://bugs.webkit.org/show_bug.cgi?id=178175 -
 359             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
 360
 361         * test262.yaml:
 362
 363 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
 364
 365         Object properties are undefined in super.call() but not in this.call()
 366         https://bugs.webkit.org/show_bug.cgi?id=177230
 367
 368         Reviewed by Saam Barati.
 369
 370         * stress/super-call-function-subclass.js: Added.
 371         (assert):
 372         (A.prototype.t):
 373         (A):
 374         * stress/super-dot-call-and-apply.js: Added.
 375         (assert):
 376         (A):
 377         (A.prototype.call):
 378         (A.prototype.apply):
 379         (B.prototype.testSuper):
 380         (B):
 381         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
 382         (D.prototype.testSuper):
 383         (D):
 384
 385 2017-10-10  Saam Barati  <sbarati@apple.com>
 386
 387         The prototype cache should be aware of the Executable it generates a Structure for
 388         https://bugs.webkit.org/show_bug.cgi?id=177907
 389
 390         Reviewed by Filip Pizlo.
 391
 392         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
 393         (assert):
 394         (foo.C):
 395         (foo):
 396         (bar.C):
 397         (bar):
 398         (access):
 399         (makeLongChain):
 400         (accessY):
 401
 402 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
 403
 404         `async` should be able to be used as an imported binding name
 405         https://bugs.webkit.org/show_bug.cgi?id=176573
 406
 407         Reviewed by Saam Barati.
 408
 409         * modules/import-default-async.js: Added.
 410         * modules/import-named-async-as.js: Added.
 411         * modules/import-named-async.js: Added.
 412         * modules/import-named-async/target.js: Added.
 413         * modules/import-namespace-async.js: Added.
 414         * test262.yaml:
 415
 416 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 417
 418         Enable gigacage on iOS
 419         https://bugs.webkit.org/show_bug.cgi?id=177586
 420
 421         Reviewed by JF Bastien.
 422
 423         Add tests for when Gigacage gets runtime disabled.
 424
 425         * stress/disable-gigacage-arrays.js: Added.
 426         (foo):
 427         * stress/disable-gigacage-strings.js: Added.
 428         (foo):
 429         * stress/disable-gigacage-typed-arrays.js: Added.
 430         (foo):
 431
 432 2017-10-09  Michael Saboff  <msaboff@apple.com>
 433
 434         Implement RegExp Unicode property escapes
 435         https://bugs.webkit.org/show_bug.cgi?id=172069
 436
 437         Reviewed by JF Bastien.
 438
 439         Enabled Unicode Property tests.
 440
 441         * test262.yaml:
 442
 443 2017-10-09  Commit Queue  <commit-queue@webkit.org>
 444
 445         Unreviewed, rolling out r223015 and r223025.
 446         https://bugs.webkit.org/show_bug.cgi?id=178093
 447
 448         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
 449         #webkit).
 450
 451         Reverted changesets:
 452
 453         "Enable gigacage on iOS"
 454         https://bugs.webkit.org/show_bug.cgi?id=177586
 455         http://trac.webkit.org/changeset/223015
 456
 457         "Unreviewed, disable Gigacage on ARM64 Linux"
 458         https://bugs.webkit.org/show_bug.cgi?id=177586
 459         http://trac.webkit.org/changeset/223025
 460
 461 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 462
 463         Update expectations for test262 tests that pass after r223043.
 464         https://bugs.webkit.org/show_bug.cgi?id=176685
 465
 466         Unreviewed test gardening.
 467
 468         * test262.yaml:
 469
 470 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 471
 472         Unreviewed, rolling out r223022.
 473
 474         This change introduced 18 test262 failures.
 475
 476         Reverted changeset:
 477
 478         "`async` should be able to be used as an imported binding
 479         name"
 480         https://bugs.webkit.org/show_bug.cgi?id=176573
 481         http://trac.webkit.org/changeset/223022
 482
 483 2017-10-09  Saam Barati  <sbarati@apple.com>
 484
 485         3 poly-proto JSC tests timing out on debug after r222827
 486         https://bugs.webkit.org/show_bug.cgi?id=177880
 487         <rdar://problem/34817122>
 488
 489         Unreviewed.
 490
 491         I'm skipping these type profiler tests on debug since they are long running.
 492
 493         * typeProfiler/deltablue-for-of.js:
 494         * typeProfiler/getter-richards.js:
 495
 496 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
 497
 498         Safari 10 /11 problem with if (!await get(something)).
 499         https://bugs.webkit.org/show_bug.cgi?id=176685
 500
 501         Reviewed by Saam Barati.
 502
 503         * stress/async-await-basic.js:
 504         (awaitEpression.async):
 505         * stress/async-await-syntax.js:
 506         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
 507         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
 508
 509 2017-10-08  Saam Barati  <sbarati@apple.com>
 510
 511         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
 512
 513         * typeProfiler/deltablue-for-of.js:
 514         * typeProfiler/getter-richards.js:
 515
 516 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 517
 518         `async` should be able to be used as an imported binding name
 519         https://bugs.webkit.org/show_bug.cgi?id=176573
 520
 521         Reviewed by Darin Adler.
 522
 523         * modules/import-default-async.js: Added.
 524         * modules/import-named-async-as.js: Added.
 525         * modules/import-named-async.js: Added.
 526         * modules/import-named-async/target.js: Added.
 527         * modules/import-namespace-async.js: Added.
 528
 529 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 530
 531         Enable gigacage on iOS
 532         https://bugs.webkit.org/show_bug.cgi?id=177586
 533
 534         Reviewed by JF Bastien.
 535
 536         Add tests for when Gigacage gets runtime disabled.
 537
 538         * stress/disable-gigacage-arrays.js: Added.
 539         (foo):
 540         * stress/disable-gigacage-strings.js: Added.
 541         (foo):
 542         * stress/disable-gigacage-typed-arrays.js: Added.
 543         (foo):
 544
 545 2017-10-06  Commit Queue  <commit-queue@webkit.org>
 546
 547         Unreviewed, rolling out r222791 and r222873.
 548         https://bugs.webkit.org/show_bug.cgi?id=178031
 549
 550         Caused crashes with workers/wasm LayoutTests (Requested by
 551         ryanhaddad on #webkit).
 552
 553         Reverted changesets:
 554
 555         "WebAssembly: no VM / JS version of everything but Instance"
 556         https://bugs.webkit.org/show_bug.cgi?id=177473
 557         http://trac.webkit.org/changeset/222791
 558
 559         "WebAssembly: address no VM / JS follow-ups"
 560         https://bugs.webkit.org/show_bug.cgi?id=177887
 561         http://trac.webkit.org/changeset/222873
 562
 563 2017-10-05  Saam Barati  <sbarati@apple.com>
 564
 565         Make sure all prototypes under poly proto get added into the VM's prototype map
 566         https://bugs.webkit.org/show_bug.cgi?id=177909
 567
 568         Reviewed by Keith Miller.
 569
 570         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
 571         (assert):
 572         (foo.C):
 573         (foo):
 574         (set x):
 575
 576 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
 577
 578         [JSC] Introduce import.meta
 579         https://bugs.webkit.org/show_bug.cgi?id=177703
 580
 581         Reviewed by Filip Pizlo.
 582
 583         * modules/import-meta-syntax.js: Added.
 584         (shouldThrow):
 585         (shouldNotThrow):
 586         * modules/import-meta.js: Added.
 587         * modules/import-meta/cocoa.js: Added.
 588         * modules/resources/assert.js:
 589         (export.shouldNotThrow):
 590         * stress/import-syntax.js:
 591
 592 2017-10-04  Saam Barati  <sbarati@apple.com>
 593
 594         Make pertinent AccessCases watch the poly proto watchpoint
 595         https://bugs.webkit.org/show_bug.cgi?id=177765
 596
 597         Reviewed by Keith Miller.
 598
 599         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
 600         (assert):
 601         (foo.C):
 602         (foo):
 603         (validate):
 604         * stress/poly-proto-clear-stub.js: Added.
 605         (assert):
 606         (foo.C):
 607         (foo):
 608
 609 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
 610
 611         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
 612
 613         Unreviewed test gardening.
 614
 615         * test262.yaml:
 616
 617 2017-10-04  Saam Barati  <sbarati@apple.com>
 618
 619         3 poly-proto JSC tests timing out on debug after r222827
 620         https://bugs.webkit.org/show_bug.cgi?id=177880
 621
 622         Rubber stamped by Mark Lam.
 623
 624         * microbenchmarks/poly-proto-access.js:
 625         * typeProfiler/deltablue-for-of.js:
 626         * typeProfiler/getter-richards.js:
 627
 628 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
 629
 630         Unreviewed, marking tco-catch.js as a failure after test262 update
 631         https://bugs.webkit.org/show_bug.cgi?id=177859
 632
 633         * test262.yaml:
 634
 635 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 636
 637         Unreviewed, marking one async iterator test262 test failed
 638         https://bugs.webkit.org/show_bug.cgi?id=177859
 639
 640         * test262.yaml:
 641
 642 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 643
 644         [Test262] Update Test262 to Oct 4 version
 645         https://bugs.webkit.org/show_bug.cgi?id=177859
 646
 647         Reviewed by Sam Weinig.
 648
 649         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
 650         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
 651
 652         * test262.yaml:
 653         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
 654         (checkSequence):
 655         * test262/harness/typeCoercion.js:
 656         (testCoercibleToIndexZero):
 657         (testCoercibleToIndexOne):
 658         (testCoercibleToIndexFromIndex):
 659         (testNotCoercibleToIndex.testPrimitiveValue):
 660         (testNotCoercibleToInteger):
 661         (testCoercibleToBigIntZero.testPrimitiveValue):
 662         (testCoercibleToBigIntZero):
 663         (testCoercibleToBigIntOne.testPrimitiveValue):
 664         (testCoercibleToBigIntOne):
 665         (testPrimitiveValue):
 666         (testCoercibleToBigIntFromBigInt):
 667         (testNotCoercibleToBigInt.testPrimitiveValue):
 668         (testNotCoercibleToBigInt.testStringValue):
 669         (testNotCoercibleToBigInt):
 670         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
 671         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
 672         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
 673         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
 674         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
 675         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
 676         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
 677         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
 678         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
 679         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
 680         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
 681         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
 682         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
 683         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
 684         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
 685         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
 686         (testCoercibleToBigIntZero):
 687         (testCoercibleToBigIntOne):
 688         (testNotCoercibleToBigInt):
 689         (MyError): Deleted.
 690         (valueOf): Deleted.
 691         (toString): Deleted.
 692         (Symbol.toPrimitive): Deleted.
 693         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
 694         (testCoercibleToIndexZero):
 695         (testCoercibleToIndexOne):
 696         (testNotCoercibleToIndex):
 697         (MyError): Deleted.
 698         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
 699         (assert.sameValue.BigInt.asIntN.toString): Deleted.
 700         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
 701         (BigInt.asIntN.valueOf): Deleted.
 702         (BigInt.asIntN.toString): Deleted.
 703         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
 704         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
 705         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
 706         (testCoercibleToBigIntZero):
 707         (testCoercibleToBigIntOne):
 708         (testNotCoercibleToBigInt):
 709         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
 710         (testCoercibleToIndexZero):
 711         (testCoercibleToIndexOne):
 712         (testNotCoercibleToIndex):
 713         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
 714         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
 715         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
 716         (bits.valueOf):
 717         (bigint.valueOf):
 718         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
 719         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
 720         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
 721         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
 722         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
 723         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
 724         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
 725         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
 726         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
 727         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
 728         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
 729         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
 730         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
 731         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
 732         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
 733         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
 734         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
 735         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
 736         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
 737         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
 738         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
 739         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
 740         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
 741         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
 742         (replacer):
 743         (BigInt.prototype.toJSON):
 744         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
 745         (replacer):
 746         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
 747         (BigInt.prototype.toJSON):
 748         * test262/test/built-ins/JSON/stringify/bigint.js:
 749         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
 750         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
 751         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
 752         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
 753         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
 754         * test262/test/built-ins/Object/proto-from-ctor.js:
 755         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
 756         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
 757         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
 758         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
 759         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
 760         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
 761         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
 762         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
 763         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
 764         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
 765         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
 766         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
 767         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
 768         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
 769         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
 770         * test262/test/built-ins/Proxy/get-fn-realm.js:
 771         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
 772         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
 773         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
 774         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
 775         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
 776         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
 777         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
 778         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
 779         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
 780         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
 781         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
 782         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
 783         (i6.replace):
 784         (i6b.replace):
 785         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
 786         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
 787         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
 788         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
 789         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
 790         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
 791         * test262/test/built-ins/RegExp/u180e.js: Added.
 792         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
 793         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
 794         * test262/test/built-ins/String/proto-from-ctor-realm.js:
 795         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
 796         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
 797         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
 798         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
 799         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
 800         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
 801         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
 802         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
 803         * test262/test/built-ins/String/prototype/endsWith/length.js:
 804         * test262/test/built-ins/String/prototype/endsWith/name.js:
 805         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
 806         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
 807         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
 808         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
 809         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
 810         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
 811         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
 812         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
 813         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
 814         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
 815         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
 816         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
 817         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
 818         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
 819         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
 820         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
 821         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
 822         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
 823         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
 824         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
 825         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
 826         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
 827         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
 828         * test262/test/built-ins/String/prototype/includes/includes.js:
 829         * test262/test/built-ins/String/prototype/includes/length.js:
 830         * test262/test/built-ins/String/prototype/includes/name.js:
 831         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
 832         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
 833         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
 834         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
 835         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
 836         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
 837         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
 838         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
 839         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
 840         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
 841         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
 842         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
 843         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
 844         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
 845         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
 846         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
 847         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
 848         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
 849         * test262/test/built-ins/String/prototype/trim/u180e.js:
 850         * test262/test/built-ins/Symbol/for/cross-realm.js:
 851         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
 852         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
 853         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
 854         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
 855         * test262/test/built-ins/Symbol/match/cross-realm.js:
 856         * test262/test/built-ins/Symbol/replace/cross-realm.js:
 857         * test262/test/built-ins/Symbol/search/cross-realm.js:
 858         * test262/test/built-ins/Symbol/species/cross-realm.js:
 859         * test262/test/built-ins/Symbol/split/cross-realm.js:
 860         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
 861         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
 862         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
 863         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
 864         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
 865         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
 866         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
 867         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
 868         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
 869         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
 870         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
 871         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
 872         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
 873         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
 874         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
 875         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
 876         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
 877         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
 878         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
 879         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
 880         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
 881         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
 882         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
 883         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
 884         * test262/test/language/comments/mongolian-vowel-separator-single.js:
 885         * test262/test/language/eval-code/indirect/realm.js:
 886         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
 887         (o.get z):
 888         (o.get a):
 889         * test262/test/language/expressions/call/eval-realm-indirect.js:
 890         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
 891         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
 892         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
 893         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
 894         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
 895         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
 896         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
 897         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
 898         * test262/test/language/expressions/greater-than/bigint-and-number.js:
 899         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
 900         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
 901         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
 902         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
 903         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
 904         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
 905         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
 906         * test262/test/language/expressions/less-than/bigint-and-number.js:
 907         * test262/test/language/expressions/new/non-ctor-err-realm.js:
 908         * test262/test/language/expressions/super/realm.js:
 909         * test262/test/language/expressions/tagged-template/cache-realm.js:
 910         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
 911         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
 912         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
 913         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
 914         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
 915         * test262/test/language/literals/string/mongolian-vowel-separator.js:
 916         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
 917         (o.get z):
 918         (o.get a):
 919         * test262/test/language/statements/for-of/iterator-next-reference.js:
 920         (next):
 921         (iterator.next): Deleted.
 922         (x.of.iterable.): Deleted.
 923         (x.of.iterable.get return): Deleted.
 924         (x.of.iterable.iterator.next): Deleted.
 925         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
 926         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
 927         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
 928         * test262/test/language/white-space/mongolian-vowel-separator.js:
 929         * test262/test262-Revision.txt:
 930
 931 2017-10-03  Saam Barati  <sbarati@apple.com>
 932
 933         Implement polymorphic prototypes
 934         https://bugs.webkit.org/show_bug.cgi?id=176391
 935
 936         Reviewed by Filip Pizlo.
 937
 938         * microbenchmarks/poly-proto-access.js: Added.
 939         (assert):
 940         (foo.C):
 941         (foo.C.prototype.get bar):
 942         (foo):
 943         (bar):
 944         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
 945         (assert):
 946         (makePolyProtoObject.foo.C):
 947         (makePolyProtoObject.foo):
 948         (makePolyProtoObject):
 949         (performSet):
 950         * microbenchmarks/poly-proto-setter-speed.js: Added.
 951         (assert):
 952         (makePolyProtoObject.foo.C):
 953         (makePolyProtoObject.foo.C.prototype.set p):
 954         (makePolyProtoObject.foo):
 955         (makePolyProtoObject):
 956         (performSet):
 957         * stress/constructor-with-return.js:
 958         (i.tests.forEach.Constructor):
 959         (i.tests.forEach):
 960         (tests.forEach.Constructor): Deleted.
 961         (tests.forEach): Deleted.
 962         * stress/dom-jit-with-poly-proto.js: Added.
 963         (assert):
 964         (makePolyProtoObject.foo.C):
 965         (makePolyProtoObject.foo):
 966         (makePolyProtoObject):
 967         (validate):
 968         * stress/poly-proto-custom-value-and-accessor.js: Added.
 969         (assert):
 970         (makePolyProtoObject.foo.C):
 971         (makePolyProtoObject.foo):
 972         (makePolyProtoObject):
 973         (items.forEach):
 974         (set get for):
 975         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
 976         (assert):
 977         (makePolyProtoObject.foo.C):
 978         (makePolyProtoObject.foo):
 979         (makePolyProtoObject):
 980         (foo):
 981         * stress/poly-proto-miss.js: Added.
 982         (makePolyProtoInstanceWithNullPrototype.foo.C):
 983         (makePolyProtoInstanceWithNullPrototype.foo):
 984         (makePolyProtoInstanceWithNullPrototype):
 985         (assert):
 986         (validate):
 987         * stress/poly-proto-op-in-caching.js: Added.
 988         (assert):
 989         (makePolyProtoObject.foo.C):
 990         (makePolyProtoObject.foo):
 991         (makePolyProtoObject):
 992         (validate):
 993         (validate2):
 994         * stress/poly-proto-put-transition.js: Added.
 995         (assert):
 996         (makePolyProtoObject.foo.C):
 997         (makePolyProtoObject.foo):
 998         (makePolyProtoObject):
 999         (performSet):
1000         (i.obj.__proto__.set p):
1001         * stress/poly-proto-set-prototype.js: Added.
1002         (assert):
1003         (let.alternateProto.get x):
1004         (let.alternateProto2.get y):
1005         (let.alternateProto2.get x):
1006         (foo.C):
1007         (foo):
1008         (validate):
1009         * stress/poly-proto-setter.js: Added.
1010         (assert):
1011         (makePolyProtoObject.foo.C):
1012         (makePolyProtoObject.foo.C.prototype.set p):
1013         (makePolyProtoObject.foo.C.prototype.get p):
1014         (makePolyProtoObject.foo):
1015         (makePolyProtoObject):
1016         (performSet):
1017         * stress/poly-proto-using-inheritance.js: Added.
1018         (assert):
1019         (foo.C):
1020         (foo.C.prototype.get baz):
1021         (foo):
1022         (bar.C):
1023         (bar):
1024         (validate):
1025         * stress/primitive-poly-proto.js: Added.
1026         (makePolyProtoInstance.foo.C):
1027         (makePolyProtoInstance.foo):
1028         (makePolyProtoInstance):
1029         (assert):
1030         (validate):
1031         * stress/prototype-is-not-js-object.js: Added.
1032         (foo.bar):
1033         (foo):
1034         (assert):
1035         (validate):
1036         * stress/try-get-by-id-poly-proto.js: Added.
1037         (assert):
1038         (makePolyProtoObject.foo.C):
1039         (makePolyProtoObject.foo):
1040         (makePolyProtoObject):
1041         (tryGetByIdText):
1042         (x.__proto__.get bar):
1043         (validate):
1044         * typeProfiler/overflow.js:
1045
1046 2017-10-03  JF Bastien  <jfbastien@apple.com>
1047
1048         WebAssembly: no VM / JS version of everything but Instance
1049         https://bugs.webkit.org/show_bug.cgi?id=177473
1050
1051         Reviewed by Filip Pizlo.
1052
1053         - Exceeding max on memory growth now returns a range error as per
1054         spec. This is a (very minor) breaking change: it used to throw OOM
1055         error. Update the corresponding test.
1056
1057         * wasm/js-api/memory-grow.js:
1058         (assertEq):
1059         * wasm/js-api/table.js:
1060         (assert.throws):
1061
1062 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1063
1064         Skip JSC test stress/regress-159779-2.js on debug.
1065         https://bugs.webkit.org/show_bug.cgi?id=177204
1066
1067         Unreviewed test gardening.
1068
1069         * stress/regress-159779-2.js:
1070
1071 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1072
1073         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1074         https://bugs.webkit.org/show_bug.cgi?id=175642
1075
1076         Reviewed by Darin Adler.
1077
1078         * ChakraCore/test/Function/apply3.baseline-jsc:
1079
1080 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1081
1082         Unreviewed, rolling out r222564.
1083         https://bugs.webkit.org/show_bug.cgi?id=177720
1084
1085         "It regressed JetStream by 2% on iOS caused by a 50%
1086         regression on the bigfib subtest" (Requested by saamyjoon on
1087         #webkit).
1088
1089         Reverted changeset:
1090
1091         "Add Above/Below comparisons for UInt32 patterns"
1092         https://bugs.webkit.org/show_bug.cgi?id=177281
1093         http://trac.webkit.org/changeset/222564
1094
1095 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1096
1097         [DFG] Support ArrayPush with multiple args
1098         https://bugs.webkit.org/show_bug.cgi?id=175823
1099
1100         Reviewed by Saam Barati.
1101
1102         * microbenchmarks/array-push-0.js: Added.
1103         (arrayPush0):
1104         * microbenchmarks/array-push-1.js: Added.
1105         (arrayPush1):
1106         * microbenchmarks/array-push-2.js: Added.
1107         (arrayPush2):
1108         * microbenchmarks/array-push-3.js: Added.
1109         (arrayPush3):
1110         * stress/array-push-multiple-contiguous.js: Added.
1111         (shouldBe):
1112         (test):
1113         * stress/array-push-multiple-double-nan.js: Added.
1114         (shouldBe):
1115         (test):
1116         * stress/array-push-multiple-double.js: Added.
1117         (shouldBe):
1118         (test):
1119         * stress/array-push-multiple-int32.js: Added.
1120         (shouldBe):
1121         (test):
1122         * stress/array-push-multiple-many-contiguous.js: Added.
1123         (shouldBe):
1124         (test):
1125         * stress/array-push-multiple-many-double.js: Added.
1126         (shouldBe):
1127         (test):
1128         * stress/array-push-multiple-many-int32.js: Added.
1129         (shouldBe):
1130         (test):
1131         * stress/array-push-multiple-many-storage.js: Added.
1132         (shouldBe):
1133         (test):
1134         * stress/array-push-multiple-storage.js: Added.
1135         (shouldBe):
1136         (test):
1137         * stress/array-push-with-force-exit.js: Added.
1138         (target.createBuiltin):
1139
1140 2017-09-29  Saam Barati  <sbarati@apple.com>
1141
1142         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1143         https://bugs.webkit.org/show_bug.cgi?id=177639
1144
1145         Reviewed by Geoffrey Garen.
1146
1147         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1148         (assert):
1149         (Class):
1150         (items.forEach):
1151         (set get for):
1152
1153 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1154
1155         Unreviewed, rolling out r222563, r222565, and r222581.
1156         https://bugs.webkit.org/show_bug.cgi?id=177675
1157
1158         "It causes a crash when playing youtube videos" (Requested by
1159         saamyjoon on #webkit).
1160
1161         Reverted changesets:
1162
1163         "[DFG] Support ArrayPush with multiple args"
1164         https://bugs.webkit.org/show_bug.cgi?id=175823
1165         http://trac.webkit.org/changeset/222563
1166
1167         "Unreviewed, build fix after r222563"
1168         https://bugs.webkit.org/show_bug.cgi?id=175823
1169         http://trac.webkit.org/changeset/222565
1170
1171         "Unreviewed, fix x86 breaking due to exhausted registers"
1172         https://bugs.webkit.org/show_bug.cgi?id=175823
1173         http://trac.webkit.org/changeset/222581
1174
1175 2017-09-28  Mark Lam  <mark.lam@apple.com>
1176
1177         test262: Unexpected passes after r222617 and r222618.
1178         https://bugs.webkit.org/show_bug.cgi?id=177622
1179         <rdar://problem/34725960>
1180
1181         Reviewed by Saam Barati.
1182
1183         Update test262.yaml for tests that are now passing.
1184
1185         * test262.yaml:
1186
1187 2017-09-27  Michael Saboff  <msaboff@apple.com>
1188
1189         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1190         https://bugs.webkit.org/show_bug.cgi?id=177570
1191
1192         Reviewed by Filip Pizlo.
1193
1194         New regression test.
1195
1196         * stress/regress-177570.js: Added.
1197
1198 2017-09-28  Michael Saboff  <msaboff@apple.com>
1199
1200         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1201         https://bugs.webkit.org/show_bug.cgi?id=177423
1202
1203         Reviewed by Mark Lam.
1204
1205         Updated regression test.
1206
1207         * stress/regress-177423.js:
1208         (catch):
1209
1210 2017-09-27  Mark Lam  <mark.lam@apple.com>
1211
1212         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1213         https://bugs.webkit.org/show_bug.cgi?id=177584
1214         <rdar://problem/34463903>
1215
1216         Reviewed by Saam Barati.
1217
1218         * stress/regress-177584.js: Added.
1219         (assertEqual):
1220         (Array.prototype.Symbol.species):
1221
1222 2017-09-27  Saam Barati  <sbarati@apple.com>
1223
1224         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1225         https://bugs.webkit.org/show_bug.cgi?id=177523
1226
1227         Reviewed by Mark Lam.
1228
1229         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1230         (assert):
1231         (Test):
1232         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1233         (addMethods):
1234         (i.Test.prototype.propName):
1235
1236 2017-09-27  Mark Lam  <mark.lam@apple.com>
1237
1238         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1239         https://bugs.webkit.org/show_bug.cgi?id=177423
1240         <rdar://problem/34621320>
1241
1242         Reviewed by Keith Miller.
1243
1244         * stress/regress-177423.js: Added.
1245
1246 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1247
1248         Add Above/Below comparisons for UInt32 patterns
1249         https://bugs.webkit.org/show_bug.cgi?id=177281
1250
1251         Reviewed by Saam Barati.
1252
1253         * stress/uint32-comparison-jump.js: Added.
1254         (shouldBe):
1255         (above):
1256         (aboveOrEqual):
1257         (below):
1258         (belowOrEqual):
1259         (notAbove):
1260         (notAboveOrEqual):
1261         (notBelow):
1262         (notBelowOrEqual):
1263         * stress/uint32-comparison.js: Added.
1264         (shouldBe):
1265         (above):
1266         (aboveOrEqual):
1267         (below):
1268         (belowOrEqual):
1269         (aboveTest):
1270         (aboveOrEqualTest):
1271         (belowTest):
1272         (belowOrEqualTest):
1273
1274 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1275
1276         [DFG] Support ArrayPush with multiple args
1277         https://bugs.webkit.org/show_bug.cgi?id=175823
1278
1279         Reviewed by Saam Barati.
1280
1281         * microbenchmarks/array-push-0.js: Added.
1282         (arrayPush0):
1283         * microbenchmarks/array-push-1.js: Added.
1284         (arrayPush1):
1285         * microbenchmarks/array-push-2.js: Added.
1286         (arrayPush2):
1287         * microbenchmarks/array-push-3.js: Added.
1288         (arrayPush3):
1289         * stress/array-push-multiple-contiguous.js: Added.
1290         (shouldBe):
1291         (test):
1292         * stress/array-push-multiple-double-nan.js: Added.
1293         (shouldBe):
1294         (test):
1295         * stress/array-push-multiple-double.js: Added.
1296         (shouldBe):
1297         (test):
1298         * stress/array-push-multiple-int32.js: Added.
1299         (shouldBe):
1300         (test):
1301         * stress/array-push-multiple-many-contiguous.js: Added.
1302         (shouldBe):
1303         (test):
1304         * stress/array-push-multiple-many-double.js: Added.
1305         (shouldBe):
1306         (test):
1307         * stress/array-push-multiple-many-int32.js: Added.
1308         (shouldBe):
1309         (test):
1310         * stress/array-push-multiple-many-storage.js: Added.
1311         (shouldBe):
1312         (test):
1313         * stress/array-push-multiple-storage.js: Added.
1314         (shouldBe):
1315         (test):
1316
1317 2017-09-26  Commit Queue  <commit-queue@webkit.org>
1318
1319         Unreviewed, rolling out r222518.
1320         https://bugs.webkit.org/show_bug.cgi?id=177507
1321
1322         Break the High Sierra build (Requested by yusukesuzuki on
1323         #webkit).
1324
1325         Reverted changeset:
1326
1327         "Add Above/Below comparisons for UInt32 patterns"
1328         https://bugs.webkit.org/show_bug.cgi?id=177281
1329         http://trac.webkit.org/changeset/222518
1330
1331 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1332
1333         Add Above/Below comparisons for UInt32 patterns
1334         https://bugs.webkit.org/show_bug.cgi?id=177281
1335
1336         Reviewed by Saam Barati.
1337
1338         * stress/uint32-comparison-jump.js: Added.
1339         (shouldBe):
1340         (above):
1341         (aboveOrEqual):
1342         (below):
1343         (belowOrEqual):
1344         (notAbove):
1345         (notAboveOrEqual):
1346         (notBelow):
1347         (notBelowOrEqual):
1348         * stress/uint32-comparison.js: Added.
1349         (shouldBe):
1350         (above):
1351         (aboveOrEqual):
1352         (below):
1353         (belowOrEqual):
1354         (aboveTest):
1355         (aboveOrEqualTest):
1356         (belowTest):
1357         (belowOrEqualTest):
1358
1359 2017-09-23  Keith Miller  <keith_miller@apple.com>
1360
1361         Fix infinite looping test262 test
1362         https://bugs.webkit.org/show_bug.cgi?id=177412
1363
1364         Reviewed by Yusuke Suzuki.
1365
1366         This test was poorly designed since failing it would cause the vm
1367         to inifinite loop. I've fixed it locally and will fix it on github pending
1368         the results of next weeks tc39 meeting.
1369
1370         * test262.yaml:
1371         * test262/test/language/statements/for-of/iterator-next-reference.js:
1372
1373 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
1374
1375         test262: $.agent became $262.agent in test262 update
1376         https://bugs.webkit.org/show_bug.cgi?id=177407
1377
1378         Reviewed by Yusuke Suzuki.
1379
1380         * test262.yaml:
1381         ~320 tests pass now that we correctly make $262 available.
1382
1383 2017-09-22  Keith Miller  <keith_miller@apple.com>
1384
1385         Speculatively change iteration protocall to use the same next function
1386         https://bugs.webkit.org/show_bug.cgi?id=175653
1387
1388         Reviewed by Saam Barati.
1389
1390         Change test to match the new iteration behavior.
1391
1392         * stress/spread-optimized-properly.js:
1393
1394 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1395
1396         [DFG][FTL] Profile array vector length for array allocation
1397         https://bugs.webkit.org/show_bug.cgi?id=177051
1398
1399         Reviewed by Saam Barati.
1400
1401         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1402         (target):
1403
1404 2017-09-22  Commit Queue  <commit-queue@webkit.org>
1405
1406         Unreviewed, rolling out r222380.
1407         https://bugs.webkit.org/show_bug.cgi?id=177352
1408
1409         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
1410         #webkit).
1411
1412         Reverted changeset:
1413
1414         "[DFG][FTL] Profile array vector length for array allocation"
1415         https://bugs.webkit.org/show_bug.cgi?id=177051
1416         http://trac.webkit.org/changeset/222380
1417
1418 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1419
1420         [DFG][FTL] Profile array vector length for array allocation
1421         https://bugs.webkit.org/show_bug.cgi?id=177051
1422
1423         Reviewed by Saam Barati.
1424
1425         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1426         (target):
1427
1428 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
1429
1430         Skip new hanging test262 tests.
1431         https://bugs.webkit.org/show_bug.cgi?id=177326
1432
1433         Unreviewed test gardening.
1434
1435         * test262.yaml:
1436
1437 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
1438
1439         Mark 6 test262 tests as passing.
1440         https://bugs.webkit.org/show_bug.cgi?id=177307
1441
1442         Unreviewed test gardening.
1443
1444         * test262.yaml:
1445
1446 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1447
1448         Unreviewed follow-up to r222311.
1449
1450         * test262/harness/sta.js:
1451         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
1452         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
1453         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
1454         * test262/test/built-ins/Array/from/elements-added-after.js:
1455         * test262/test/built-ins/Array/from/elements-deleted-after.js:
1456         * test262/test/built-ins/Array/from/elements-updated-after.js:
1457         * test262/test/built-ins/Array/from/from-array.js:
1458         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
1459         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
1460         * test262/test/built-ins/Array/from/source-array-boundary.js:
1461         * test262/test/built-ins/Array/from/source-object-constructor.js:
1462         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
1463         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
1464         * test262/test/built-ins/Array/from/source-object-length.js:
1465         * test262/test/built-ins/Array/from/source-object-missing.js:
1466         * test262/test/built-ins/Array/from/source-object-without.js:
1467         * test262/test/built-ins/Array/from/this-null.js:
1468         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1469         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
1470         * test262/test/language/literals/numeric/7.8.3-1gs.js:
1471         * test262/test/language/literals/numeric/7.8.3-2gs.js:
1472         * test262/test/language/literals/numeric/7.8.3-3gs.js:
1473         * test262/test/language/literals/regexp/7.8.5-1gs.js:
1474         * test262/test/language/literals/string/7.8.4-1gs.js:
1475         Fix some files that I failed to update when I applied my patch.
1476
1477 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1478
1479         Update test262 tests
1480         https://bugs.webkit.org/show_bug.cgi?id=177220
1481
1482         Reviewed by Saam Barati and Yusuke Suzuki.
1483
1484         * test262.yaml:
1485         * test262/test262-Revision.txt:
1486         New rebaselined expectations for all tests.
1487
1488         * test262/*:
1489         Updated.
1490
1491 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1492
1493         [DFG] Remove ToThis more aggressively
1494         https://bugs.webkit.org/show_bug.cgi?id=177056
1495
1496         Reviewed by Saam Barati.
1497
1498         * stress/generator-with-this-strict.js: Added.
1499         (shouldBe):
1500         (generator):
1501         (target):
1502         * stress/generator-with-this.js: Added.
1503         (shouldBe):
1504         (generator):
1505         (target):
1506
1507 2017-09-17  Michael Saboff  <msaboff@apple.com>
1508
1509         https://bugs.webkit.org/show_bug.cgi?id=177038
1510         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
1511
1512         Reviewed by JF Bastien.
1513
1514         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
1515         as it dies using too much memory.
1516
1517 2017-09-15  Saam Barati  <sbarati@apple.com>
1518
1519         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
1520         https://bugs.webkit.org/show_bug.cgi?id=176981
1521
1522         Reviewed by Yusuke Suzuki.
1523
1524         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
1525         (assert):
1526         (verify):
1527         (func):
1528         (const.bar.createBuiltin):
1529
1530 2017-09-14  Saam Barati  <sbarati@apple.com>
1531
1532         It should be valid to exit before each set when doing arity fixup when inlining
1533         https://bugs.webkit.org/show_bug.cgi?id=176948
1534
1535         Reviewed by Keith Miller.
1536
1537         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
1538         (baz):
1539         (bar):
1540         (foo):
1541
1542 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1543
1544         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
1545         https://bugs.webkit.org/show_bug.cgi?id=176867
1546
1547         Reviewed by Sam Weinig.
1548
1549         * microbenchmarks/object-get-own-property-symbols.js: Added.
1550         (test):
1551
1552 2017-09-13  Mark Lam  <mark.lam@apple.com>
1553
1554         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
1555         https://bugs.webkit.org/show_bug.cgi?id=176888
1556         <rdar://problem/34381832>
1557
1558         Not reviewed.
1559
1560         * stress/op_mod-ConstVar.js:
1561         * stress/op_mod-VarConst.js:
1562         * stress/op_mod-VarVar.js:
1563
1564 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
1565
1566         Skip 3 op_mod tests on Debug JSC bots.
1567         https://bugs.webkit.org/show_bug.cgi?id=176630
1568
1569         Unreviewed test gardening.
1570
1571         * stress/op_mod-ConstVar.js:
1572         * stress/op_mod-VarConst.js:
1573         * stress/op_mod-VarVar.js:
1574
1575 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1576
1577         [JSC] Fix Array allocation in Object.keys
1578         https://bugs.webkit.org/show_bug.cgi?id=176826
1579
1580         Reviewed by Saam Barati.
1581
1582         * stress/object-own-property-keys.js: Added.
1583         (shouldBe):
1584
1585 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1586
1587         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1588         https://bugs.webkit.org/show_bug.cgi?id=176010
1589
1590         Reviewed by Filip Pizlo.
1591
1592         * microbenchmarks/weak-map-key.js: Added.
1593         (assert):
1594         (objectKey):
1595         (let.start.Date.now):
1596
1597 2017-09-12  Mark Lam  <mark.lam@apple.com>
1598
1599         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
1600         https://bugs.webkit.org/show_bug.cgi?id=176630
1601
1602         Reviewed by JF Bastien.
1603
1604         Debug builds are just slow, and these tests do a lot.  They pass when I run them
1605         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
1606         a speculative fix for the bots that are seeing these fail.
1607
1608         I also undid the skipping of the op_mod tests for debug builds.
1609
1610         * stress/op_div-ConstVar.js:
1611         * stress/op_div-VarConst.js:
1612         * stress/op_div-VarVar.js:
1613         * stress/op_mod-ConstVar.js:
1614         * stress/op_mod-VarConst.js:
1615         * stress/op_mod-VarVar.js:
1616
1617 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
1618
1619         Skip stress/value-to-boolean.js on Debug bots.
1620         https://bugs.webkit.org/show_bug.cgi?id=176787
1621
1622         Unreviewed test gardening.
1623
1624         * stress/value-to-boolean.js:
1625
1626 2017-09-11  Mark Lam  <mark.lam@apple.com>
1627
1628         Change test expectation for test262/test/language/statements/try/tco-catch.js
1629         https://bugs.webkit.org/show_bug.cgi?id=176749
1630
1631         Rubber stamped by Keith Miller.
1632
1633         It's been failing since at least r221821.  I'm changing the test expectation to
1634         fail to green the bots while I investigate some more.
1635
1636         * test262.yaml:
1637
1638 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
1639
1640         Unreviewed, rolling out r221854.
1641
1642         The test added with this change fails on 32-bit JSC bots.
1643
1644         Reverted changeset:
1645
1646         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
1647         https://bugs.webkit.org/show_bug.cgi?id=176010
1648         http://trac.webkit.org/changeset/221854
1649
1650 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1651
1652         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1653         https://bugs.webkit.org/show_bug.cgi?id=176010
1654
1655         Reviewed by Filip Pizlo.
1656
1657         * microbenchmarks/weak-map-key.js: Added.
1658         (assert):
1659         (objectKey):
1660         (let.start.Date.now):
1661
1662 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1663
1664         [JSC] Optimize Object.keys by using careful array allocation
1665         https://bugs.webkit.org/show_bug.cgi?id=176654
1666
1667         Reviewed by Darin Adler.
1668
1669         * microbenchmarks/object-keys.js: Added.
1670         (test):
1671
1672 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
1673
1674         Error should compute .stack and friends lazily
1675         https://bugs.webkit.org/show_bug.cgi?id=176645
1676
1677         Reviewed by Saam Barati.
1678
1679         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
1680         * microbenchmarks/new-error.js: Added.
1681         * microbenchmarks/throw.js: Added.
1682
1683 2017-09-09  Mark Lam  <mark.lam@apple.com>
1684
1685         [Re-landing] Use JIT probes for DFG OSR exit.
1686         https://bugs.webkit.org/show_bug.cgi?id=175144
1687         <rdar://problem/33437050>
1688
1689         Not reviewed.  Original patch reviewed by Saam Barati.
1690
1691         Disable these tests for debug builds because they run too slow with the new OSR exit.
1692
1693         * stress/op_mod-ConstVar.js:
1694         * stress/op_mod-VarConst.js:
1695         * stress/op_mod-VarVar.js:
1696
1697 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1698
1699         [DFG] NewArrayWithSize(size)'s size does not care negative zero
1700         https://bugs.webkit.org/show_bug.cgi?id=176300
1701
1702         Reviewed by Saam Barati.
1703
1704         * stress/new-array-with-size-div.js: Added.
1705         (shouldBe):
1706         (test):
1707         (i.i):
1708
1709 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1710
1711         [DFG] PutByVal with Array::Generic is too generic
1712         https://bugs.webkit.org/show_bug.cgi?id=176345
1713
1714         Reviewed by Filip Pizlo.
1715
1716         * stress/object-assign-symbols.js: Added.
1717         (shouldBe):
1718         (test):
1719         * stress/object-assign.js: Added.
1720         (shouldBe):
1721         (test):
1722         (i.shouldBe.JSON.stringify.test):
1723
1724 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1725
1726         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
1727         https://bugs.webkit.org/show_bug.cgi?id=176590
1728
1729         Reviewed by Saam Barati.
1730
1731         * microbenchmarks/object-iterate-symbols.js: Added.
1732         (test):
1733         * microbenchmarks/object-iterate.js: Added.
1734         (test):
1735         * stress/object-iterate-symbols.js: Added.
1736         (shouldBe):
1737         (test):
1738         * stress/object-iterate.js: Added.
1739         (shouldBe):
1740         (test):
1741
1742 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
1743
1744         [Win32] 10 JSC stress tests are failing.
1745         https://bugs.webkit.org/show_bug.cgi?id=176538
1746
1747         Reviewed by Mark Lam.
1748
1749         Skip tests on Windows to make the bots green.
1750
1751         * ChakraCore.yaml:
1752         * stress/date-relaxed.js:
1753
1754 2017-09-06  Mark Lam  <mark.lam@apple.com>
1755
1756         constructGenericTypedArrayViewWithArguments() is missing an exception check.
1757         https://bugs.webkit.org/show_bug.cgi?id=176485
1758         <rdar://problem/33898874>
1759
1760         Reviewed by Keith Miller.
1761
1762         * stress/regress-176485.js: Added.
1763
1764 2017-09-05  Saam Barati  <sbarati@apple.com>
1765
1766         isNotCellSpeculation is wrong with respect to SpecEmpty
1767         https://bugs.webkit.org/show_bug.cgi?id=176429
1768
1769         Reviewed by Michael Saboff.
1770
1771         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
1772         (Foo):
1773
1774 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
1775
1776         test262: Completion values for control flow do not match the spec
1777         https://bugs.webkit.org/show_bug.cgi?id=171265
1778
1779         Reviewed by Saam Barati.
1780
1781         * stress/completion-value.js:
1782         Condensed test for completion values in top level statements.
1783
1784         * stress/super-get-by-id.js:
1785         ClassDeclaration when evaled no longer produce values. Convert
1786         these to ClassExpressions so they produce the class value.
1787
1788         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1789         This is a progression for currect spec behavior.
1790
1791         * mozilla/mozilla-tests.yaml:
1792         This test is now outdated, so mark it as failing for that reason.
1793
1794         * test262.yaml:
1795         Passing all "cptn" completion value tests.
1796
1797 2017-09-04  Saam Barati  <sbarati@apple.com>
1798
1799         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
1800         https://bugs.webkit.org/show_bug.cgi?id=176317
1801
1802         Reviewed by Keith Miller.
1803
1804         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
1805         (Foo):
1806
1807 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1808
1809         [DFG][FTL] Efficiently execute number#toString()
1810         https://bugs.webkit.org/show_bug.cgi?id=170007
1811
1812         Reviewed by Keith Miller.
1813
1814         * microbenchmarks/number-to-string-strength-reduction.js: Added.
1815         (test):
1816         * microbenchmarks/number-to-string-with-radix-10.js: Added.
1817         (test):
1818         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
1819         (test):
1820         * microbenchmarks/number-to-string-with-radix.js: Added.
1821         (test):
1822         * stress/number-to-string-strength-reduction.js: Added.
1823         (shouldBe):
1824         (test):
1825         * stress/number-to-string-with-radix-10.js: Added.
1826         (shouldBe):
1827         (test):
1828         * stress/number-to-string-with-radix-cse.js: Added.
1829         (shouldBe):
1830         (test):
1831         * stress/number-to-string-with-radix-invalid.js: Added.
1832         (shouldThrow):
1833         * stress/number-to-string-with-radix-watchpoint.js: Added.
1834         (shouldBe):
1835         (test):
1836         (i.i.1e3.Number.prototype.toString):
1837         * stress/number-to-string-with-radix.js: Added.
1838         (shouldBe):
1839         (test):
1840
1841 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1842
1843         [DFG] Relax arity requirement
1844         https://bugs.webkit.org/show_bug.cgi?id=175523
1845
1846         Reviewed by Saam Barati.
1847
1848         * stress/arity-mismatch-arguments-length.js: Added.
1849         (shouldBe):
1850         (test1):
1851         (test):
1852         * stress/arity-mismatch-get-argument.js: Added.
1853         (shouldBe):
1854         (builtin.createBuiltin):
1855         (test):
1856         * stress/arity-mismatch-inlining-extra-slots.js: Added.
1857         (shouldBe):
1858         (inlineTarget):
1859         (test):
1860         * stress/arity-mismatch-inlining.js: Added.
1861         (shouldBe):
1862         (inlineTarget):
1863         (test):
1864         * stress/arity-mismatch-rest.js: Added.
1865         (shouldBe):
1866         (test2):
1867         (test1):
1868         (test):
1869
1870 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1871
1872         [JSC] Fix "name" and "length" of Proxy revoke function
1873         https://bugs.webkit.org/show_bug.cgi?id=176155
1874
1875         Reviewed by Mark Lam.
1876
1877         * test262.yaml:
1878
1879 2017-08-31  Saam Barati  <sbarati@apple.com>
1880
1881         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
1882         https://bugs.webkit.org/show_bug.cgi?id=176206
1883
1884         Reviewed by Keith Miller.
1885
1886         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
1887         (a):
1888         (b):
1889         (foo):
1890
1891 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
1892
1893         Skip two slow JSC tests after r221422.
1894
1895         Unreviewed test gardening.
1896
1897         * stress/regexp-prototype-match-on-too-long-rope.js:
1898         * stress/regexp-prototype-test-on-too-long-rope.js:
1899
1900 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
1901
1902         Unreviewed, skipping slow tests.
1903
1904         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
1905         work differently now.
1906
1907         * stress/regexp-prototype-exec-on-too-long-rope.js:
1908         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
1909
1910 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1911
1912         [JSC] Use reifying system for "name" property of builtin JSFunction
1913         https://bugs.webkit.org/show_bug.cgi?id=175260
1914
1915         Reviewed by Saam Barati.
1916
1917         * stress/accessors-get-set-prefix.js:
1918         * stress/builtin-function-name.js: Added.
1919         (shouldBe):
1920         (shouldThrow):
1921         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1922         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1923         * stress/private-name-as-anonymous-builtin.js: Added.
1924         (shouldBe):
1925         (NotPromise):
1926
1927 2017-08-30  Saam Barati  <sbarati@apple.com>
1928
1929         Unreviewed. Make test stop printing.
1930
1931         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
1932
1933 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
1934
1935         Unreviewed, rolling out r221327.
1936
1937         This change caused test262 failures.
1938
1939         Reverted changeset:
1940
1941         "[JSC] Use reifying system for "name" property of builtin
1942         JSFunction"
1943         https://bugs.webkit.org/show_bug.cgi?id=175260
1944         http://trac.webkit.org/changeset/221327
1945
1946 2017-08-30  Saam Barati  <sbarati@apple.com>
1947
1948         semicolon is being interpreted as an = in the LiteralParser
1949         https://bugs.webkit.org/show_bug.cgi?id=176114
1950
1951         Reviewed by Oliver Hunt.
1952
1953         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
1954         * stress/resources/literal-parser-test-case.js: Added.
1955
1956 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
1957
1958         [ESNext] Async iteration - Implement async iteration statement: for-await-of
1959         https://bugs.webkit.org/show_bug.cgi?id=166698
1960
1961         Reviewed by Yusuke Suzuki.
1962
1963         * stress/async-iteration-for-await-of-syntax.js: Added.
1964         (assert):
1965         (checkSyntax):
1966         (checkSyntaxError):
1967         (checkSimpleAsyncGeneratorSloppyMode):
1968         (checkSimpleAsyncGeneratorStrictMode):
1969         (checkNestedAsyncGenerators):
1970         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
1971         * stress/async-iteration-for-await-of.js: Added.
1972         (assert):
1973         (async.foo):
1974         (async.boo):
1975         (const.boo.async):
1976
1977 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1978
1979         [JSC] Use reifying system for "name" property of builtin JSFunction
1980         https://bugs.webkit.org/show_bug.cgi?id=175260
1981
1982         Reviewed by Saam Barati.
1983
1984         * stress/accessors-get-set-prefix.js:
1985         * stress/builtin-function-name.js: Added.
1986         (shouldBe):
1987         (shouldThrow):
1988         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1989         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1990
1991 2017-08-25  Saam Barati  <sbarati@apple.com>
1992
1993         Support compiling catch in the DFG
1994         https://bugs.webkit.org/show_bug.cgi?id=174590
1995         <rdar://problem/34047845>
1996
1997         Reviewed by Filip Pizlo.
1998
1999         * microbenchmarks/delta-blue-try-catch.js: Added.
2000         (exception):
2001         (value):
2002         (OrderedCollection):
2003         (OrderedCollection.prototype.add):
2004         (OrderedCollection.prototype.at):
2005         (OrderedCollection.prototype.size):
2006         (OrderedCollection.prototype.removeFirst):
2007         (OrderedCollection.prototype.remove):
2008         (Strength):
2009         (Strength.stronger):
2010         (Strength.weaker):
2011         (Strength.weakestOf):
2012         (Strength.strongest):
2013         (Strength.prototype.nextWeaker):
2014         (Constraint):
2015         (Constraint.prototype.addConstraint):
2016         (Constraint.prototype.satisfy):
2017         (Constraint.prototype.destroyConstraint):
2018         (Constraint.prototype.isInput):
2019         (UnaryConstraint):
2020         (UnaryConstraint.prototype.addToGraph):
2021         (UnaryConstraint.prototype.chooseMethod):
2022         (UnaryConstraint.prototype.isSatisfied):
2023         (UnaryConstraint.prototype.markInputs):
2024         (UnaryConstraint.prototype.output):
2025         (UnaryConstraint.prototype.recalculate):
2026         (UnaryConstraint.prototype.markUnsatisfied):
2027         (UnaryConstraint.prototype.inputsKnown):
2028         (UnaryConstraint.prototype.removeFromGraph):
2029         (StayConstraint):
2030         (StayConstraint.prototype.execute):
2031         (EditConstraint.prototype.isInput):
2032         (EditConstraint.prototype.execute):
2033         (BinaryConstraint):
2034         (BinaryConstraint.prototype.chooseMethod):
2035         (BinaryConstraint.prototype.addToGraph):
2036         (BinaryConstraint.prototype.isSatisfied):
2037         (BinaryConstraint.prototype.markInputs):
2038         (BinaryConstraint.prototype.input):
2039         (BinaryConstraint.prototype.output):
2040         (BinaryConstraint.prototype.recalculate):
2041         (BinaryConstraint.prototype.markUnsatisfied):
2042         (BinaryConstraint.prototype.inputsKnown):
2043         (BinaryConstraint.prototype.removeFromGraph):
2044         (ScaleConstraint):
2045         (ScaleConstraint.prototype.addToGraph):
2046         (ScaleConstraint.prototype.removeFromGraph):
2047         (ScaleConstraint.prototype.markInputs):
2048         (ScaleConstraint.prototype.execute):
2049         (ScaleConstraint.prototype.recalculate):
2050         (EqualityConstraint):
2051         (EqualityConstraint.prototype.execute):
2052         (Variable):
2053         (Variable.prototype.addConstraint):
2054         (Variable.prototype.removeConstraint):
2055         (Planner):
2056         (Planner.prototype.incrementalAdd):
2057         (Planner.prototype.incrementalRemove):
2058         (Planner.prototype.newMark):
2059         (Planner.prototype.makePlan):
2060         (Planner.prototype.extractPlanFromConstraints):
2061         (Planner.prototype.addPropagate):
2062         (Planner.prototype.removePropagateFrom):
2063         (Planner.prototype.addConstraintsConsumingTo):
2064         (Plan):
2065         (Plan.prototype.addConstraint):
2066         (Plan.prototype.size):
2067         (Plan.prototype.constraintAt):
2068         (Plan.prototype.execute):
2069         (chainTest):
2070         (projectionTest):
2071         (change):
2072         (deltaBlue):
2073         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2074         (assert):
2075         (Numbers):
2076         (Numbers.prototype.next):
2077         (return.Transpose):
2078         (return.Transpose.prototype.next):
2079         (transpose):
2080         (verifyEven):
2081         (verifyString):
2082         (foo):
2083         (runIterators):
2084         * microbenchmarks/try-catch-word-count.js: Added.
2085         (let.assert):
2086         (EOF):
2087         (let.texts):
2088         (let.o.apply):
2089         (foo):
2090         (bar):
2091         (f):
2092         (run):
2093         (test1):
2094         (test2):
2095         (test3):
2096         (fn):
2097         (A):
2098         (B):
2099         (A.prototype.getValue):
2100         (B.prototype.getParentValue):
2101         (strlen):
2102         (sum.0):
2103         (test):
2104         (result.test.o):
2105         (set add.set add):
2106         (set forEach):
2107         (stringHash):
2108         (set if):
2109         (testFunction):
2110         (set delete.set has.set add):
2111         * stress/catch-set-argument-speculation-failure.js: Added.
2112         (o):
2113         (e):
2114         (e2):
2115         (escape):
2116         (baz):
2117         (noInline.run):
2118         (noInline):
2119         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2120         (foo):
2121         (e):
2122         (baz):
2123         (bar):
2124
2125 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2126
2127         Unreviewed, rolling out r221119, r221124, and r221143.
2128         https://bugs.webkit.org/show_bug.cgi?id=175973
2129
2130         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2131         on #webkit).
2132
2133         Reverted changesets:
2134
2135         "Support compiling catch in the DFG"
2136         https://bugs.webkit.org/show_bug.cgi?id=174590
2137         http://trac.webkit.org/changeset/221119
2138
2139         "Unreviewed, build fix in GTK port"
2140         https://bugs.webkit.org/show_bug.cgi?id=174590
2141         http://trac.webkit.org/changeset/221124
2142
2143         "DFG::JITCode::osrEntry should get sorted since we perform a
2144         binary search on it"
2145         https://bugs.webkit.org/show_bug.cgi?id=175893
2146         http://trac.webkit.org/changeset/221143
2147
2148 2017-08-24  Michael Saboff  <msaboff@apple.com>
2149
2150         Add support for RegExp "dotAll" flag
2151         https://bugs.webkit.org/show_bug.cgi?id=175924
2152
2153         Reviewed by Keith Miller.
2154
2155         Updated tests for new dotAll ('s' flag) changes.
2156
2157         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2158         * stress/static-getter-in-names.js:
2159
2160 2017-08-24  Mark Lam  <mark.lam@apple.com>
2161
2162         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2163         https://bugs.webkit.org/show_bug.cgi?id=175940
2164         <rdar://problem/29003921>
2165
2166         Reviewed by Saam Barati.
2167
2168         * stress/regress-164081.js: Added.
2169         (shouldEqual):
2170         (testcase):
2171
2172 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2173
2174         Skip flaky JSC test stress/test-finally.js.
2175         https://bugs.webkit.org/show_bug.cgi?id=160283
2176
2177         Unreviewed test gardening.
2178
2179         * stress/test-finally.js:
2180
2181 2017-08-23  Saam Barati  <sbarati@apple.com>
2182
2183         Support compiling catch in the DFG
2184         https://bugs.webkit.org/show_bug.cgi?id=174590
2185
2186         Reviewed by Filip Pizlo.
2187
2188         * microbenchmarks/delta-blue-try-catch.js: Added.
2189         (exception):
2190         (value):
2191         (OrderedCollection):
2192         (OrderedCollection.prototype.add):
2193         (OrderedCollection.prototype.at):
2194         (OrderedCollection.prototype.size):
2195         (OrderedCollection.prototype.removeFirst):
2196         (OrderedCollection.prototype.remove):
2197         (Strength):
2198         (Strength.stronger):
2199         (Strength.weaker):
2200         (Strength.weakestOf):
2201         (Strength.strongest):
2202         (Strength.prototype.nextWeaker):
2203         (Constraint):
2204         (Constraint.prototype.addConstraint):
2205         (Constraint.prototype.satisfy):
2206         (Constraint.prototype.destroyConstraint):
2207         (Constraint.prototype.isInput):
2208         (UnaryConstraint):
2209         (UnaryConstraint.prototype.addToGraph):
2210         (UnaryConstraint.prototype.chooseMethod):
2211         (UnaryConstraint.prototype.isSatisfied):
2212         (UnaryConstraint.prototype.markInputs):
2213         (UnaryConstraint.prototype.output):
2214         (UnaryConstraint.prototype.recalculate):
2215         (UnaryConstraint.prototype.markUnsatisfied):
2216         (UnaryConstraint.prototype.inputsKnown):
2217         (UnaryConstraint.prototype.removeFromGraph):
2218         (StayConstraint):
2219         (StayConstraint.prototype.execute):
2220         (EditConstraint.prototype.isInput):
2221         (EditConstraint.prototype.execute):
2222         (BinaryConstraint):
2223         (BinaryConstraint.prototype.chooseMethod):
2224         (BinaryConstraint.prototype.addToGraph):
2225         (BinaryConstraint.prototype.isSatisfied):
2226         (BinaryConstraint.prototype.markInputs):
2227         (BinaryConstraint.prototype.input):
2228         (BinaryConstraint.prototype.output):
2229         (BinaryConstraint.prototype.recalculate):
2230         (BinaryConstraint.prototype.markUnsatisfied):
2231         (BinaryConstraint.prototype.inputsKnown):
2232         (BinaryConstraint.prototype.removeFromGraph):
2233         (ScaleConstraint):
2234         (ScaleConstraint.prototype.addToGraph):
2235         (ScaleConstraint.prototype.removeFromGraph):
2236         (ScaleConstraint.prototype.markInputs):
2237         (ScaleConstraint.prototype.execute):
2238         (ScaleConstraint.prototype.recalculate):
2239         (EqualityConstraint):
2240         (EqualityConstraint.prototype.execute):
2241         (Variable):
2242         (Variable.prototype.addConstraint):
2243         (Variable.prototype.removeConstraint):
2244         (Planner):
2245         (Planner.prototype.incrementalAdd):
2246         (Planner.prototype.incrementalRemove):
2247         (Planner.prototype.newMark):
2248         (Planner.prototype.makePlan):
2249         (Planner.prototype.extractPlanFromConstraints):
2250         (Planner.prototype.addPropagate):
2251         (Planner.prototype.removePropagateFrom):
2252         (Planner.prototype.addConstraintsConsumingTo):
2253         (Plan):
2254         (Plan.prototype.addConstraint):
2255         (Plan.prototype.size):
2256         (Plan.prototype.constraintAt):
2257         (Plan.prototype.execute):
2258         (chainTest):
2259         (projectionTest):
2260         (change):
2261         (deltaBlue):
2262         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2263         (assert):
2264         (Numbers):
2265         (Numbers.prototype.next):
2266         (return.Transpose):
2267         (return.Transpose.prototype.next):
2268         (transpose):
2269         (verifyEven):
2270         (verifyString):
2271         (foo):
2272         (runIterators):
2273         * microbenchmarks/try-catch-word-count.js: Added.
2274         (let.assert):
2275         (EOF):
2276         (let.texts):
2277         (let.o.apply):
2278         (foo):
2279         (bar):
2280         (f):
2281         (run):
2282         (test1):
2283         (test2):
2284         (test3):
2285         (fn):
2286         (A):
2287         (B):
2288         (A.prototype.getValue):
2289         (B.prototype.getParentValue):
2290         (strlen):
2291         (sum.0):
2292         (test):
2293         (result.test.o):
2294         (set add.set add):
2295         (set forEach):
2296         (stringHash):
2297         (set if):
2298         (testFunction):
2299         (set delete.set has.set add):
2300         * stress/catch-set-argument-speculation-failure.js: Added.
2301         (o):
2302         (e):
2303         (e2):
2304         (escape):
2305         (baz):
2306         (noInline.run):
2307         (noInline):
2308         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2309         (foo):
2310         (e):
2311         (baz):
2312         (bar):
2313
2314 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2315
2316         [JSC] Optimize Map iteration with intrinsic
2317         https://bugs.webkit.org/show_bug.cgi?id=174355
2318
2319         Reviewed by Saam Barati.
2320
2321         * stress/map-iterator-result-should-have-expected-shape.js: Added.
2322         (shouldBe):
2323         (throw.new.Error):
2324         * stress/set-iterator-result-should-have-expected-shape.js: Added.
2325         (shouldBe):
2326         (throw.new.Error.let.iterator.set Symbol):
2327         (throw.new.Error.set add):
2328         (let.iterator.set Symbol):
2329
2330 2017-08-23  Robin Morisset  <rmorisset@apple.com>
2331
2332         Add a micro-benchmark for checking that accessing a variable within a 'with'
2333         block does not automatically prevent type prediction.
2334         https://bugs.webkit.org/show_bug.cgi?id=175738
2335
2336         Reviewed by Saam Barati.
2337
2338         * stress/with_and_arith.js: Added.
2339         (with):
2340
2341 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
2342
2343         [ESNext] Async iteration - Implement Async Generator - runtime
2344         https://bugs.webkit.org/show_bug.cgi?id=175240
2345
2346         Reviewed by Yusuke Suzuki.
2347
2348         * stress/async-iteration-async-from-sync.js: Added.
2349         (assert):
2350         (const.Logger):
2351         (this.fullfilled):
2352         (this.fullfilledDone):
2353         (this.rejected):
2354         (this.catched):
2355         (this.isFinal):
2356         (_assertLogger):
2357         (const.assertLogger):
2358         (const.getPromise.promiseHolder.return.new.Promise):
2359         (foo):
2360         (async.boo):
2361         (bar):
2362         (async.baz):
2363         (async.goo):
2364         * stress/async-iteration-basic.js: Added.
2365         (assert):
2366         (const.Logger):
2367         (this.fullfilled):
2368         (this.fullfilledDone):
2369         (this.rejected):
2370         (this.catched):
2371         (this.isFinal):
2372         (_assertLogger):
2373         (const.assertLogger):
2374         (const.getPromise.promiseHolder.return.new.Promise):
2375         (async.generator):
2376         (iterator.next.then):
2377         (async.baz):
2378         (async.boo):
2379         (async.foo):
2380         (async.goo):
2381         (A.prototype.async.foo):
2382         (A.prototype.async.boo):
2383         (A):
2384         (asyncGenExp.async):
2385         (async.joo):
2386         (j.next.then):
2387         (then):
2388         (async.koo):
2389         (async.loo):
2390         (async.moo):
2391         (async.noo):
2392         (async.ooo):
2393         (async.roo):
2394         (async.poo):
2395         (async.soo):
2396         (async.too):
2397         * stress/async-iteration-evaluation.js: Added.
2398         (assert):
2399         (async.foo):
2400         (catch):
2401         * stress/async-iteration-syntax.js:
2402         * stress/async-iteration-yield-promise.js: Added.
2403         (assert):
2404         (const.Logger):
2405         (this.fullfilled):
2406         (this.fullfilledDone):
2407         (this.rejected):
2408         (this.catched):
2409         (this.isFinal):
2410         (_assertLogger):
2411         (const.assertLogger):
2412         (const.getPromise.promiseHolder.return.new.Promise):
2413         (async.foo):
2414         (async.boo):
2415         (async.bar):
2416         * stress/async-iteration-yield-star-interface.js: Added.
2417         (assert):
2418         (const.getPromise.promiseHolder.return.new.Promise):
2419         (const.Logger):
2420         (this.fullfilled):
2421         (this.fullfilledDone):
2422         (this.rejected):
2423         (this.catched):
2424         (this.custom):
2425         (this.isFinal):
2426         (_assertLogger):
2427         (const.assertLogger):
2428         (let.asyncIter.Symbol.asyncIterator):
2429         (let.asyncIter.next):
2430         (let.asyncIter.throw):
2431         (let.asyncIter.return):
2432         (async.foo):
2433         (asyncIter.Symbol.asyncIterator):
2434         (asyncIter.next):
2435         (async.boo):
2436         (asyncIter.return):
2437         (async.bar):
2438         (async.baz):
2439         (async.foobar):
2440         * stress/async-iteration-yield-star.js: Added.
2441         (assert):
2442         (const.Logger):
2443         (this.fullfilled):
2444         (this.fullfilledDone):
2445         (this.rejected):
2446         (this.catched):
2447         (this.custom):
2448         (this.isFinal):
2449         (_assertLogger):
2450         (const.assertLogger):
2451         (const.getPromise.promiseHolder.return.new.Promise):
2452         (async.foo):
2453         (async.boo):
2454         (async.bar):
2455         (async.baz):
2456         (async.joo):
2457         (async.goo):
2458         (async.koo):
2459         (async.loo):
2460         (let.asyncIter.Symbol.asyncIterator):
2461         (let.asyncIter.next):
2462         (let.asyncIter.throw):
2463         (let.asyncIter.return):
2464         (async.moo):
2465         (async.noo):
2466         * test262.yaml:
2467
2468 2017-08-23  JF Bastien  <jfbastien@apple.com>
2469
2470         Fix printing in test
2471
2472         Unreviewed: fixing verbosity, shouldn't have been there.
2473
2474         * wasm/regress/175693.js:
2475         (else.else):
2476         (catch):
2477
2478 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
2479
2480         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
2481         https://bugs.webkit.org/show_bug.cgi?id=172543
2482
2483         Unreviewed test gardening.
2484
2485         * microbenchmarks/generator-with-several-types.js:
2486
2487 2017-08-17  JF Bastien  <jfbastien@apple.com>
2488
2489         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
2490         https://bugs.webkit.org/show_bug.cgi?id=175693
2491         <rdar://problem/33952443>
2492
2493         Reviewed by Saam Barati.
2494
2495         Add a regression directory for WebAssembly tests.
2496
2497         * wasm.yaml:
2498         * wasm/regress/175693.js: Added.
2499         (else.else):
2500         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
2501         (catch):
2502         * wasm/regress/175693.wasm: Added.
2503
2504 2017-08-15  Robin Morisset  <rmorisset@apple.com>
2505
2506         Support the 'with' keyword in FTL.
2507         https://bugs.webkit.org/show_bug.cgi?id=175585
2508
2509         Reviewed by Saam Barati.
2510
2511         Also improve the JSTest/stress/with.js file to test
2512         what happens when non-objects are passed to with.
2513
2514         * stress/with.js:
2515         (foo):
2516         (i.catch):
2517         (i.with): Deleted.
2518
2519 2017-08-14  Keith Miller  <keith_miller@apple.com>
2520
2521         Add testing tool to lie to the DFG about profiles
2522         https://bugs.webkit.org/show_bug.cgi?id=175487
2523
2524         Reviewed by Saam Barati.
2525
2526         * stress/compare-eq-incomplete-profile.js: Added.
2527         (const.test.createBuiltin):
2528
2529 2017-08-14  Robin Morisset  <rmorisset@apple.com>
2530
2531         Support the with keyword in DFG
2532         https://bugs.webkit.org/show_bug.cgi?id=175470
2533
2534         Reviewed by Saam Barati.
2535
2536         Added a new stress-test for the 'with' keyword, that caught a bug in a
2537         previous version of this code.
2538
2539         * stress/with.js: Added.
2540         (i.with):
2541
2542 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
2543
2544         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
2545         https://bugs.webkit.org/show_bug.cgi?id=175544
2546
2547         Unreviewed test gardening.
2548
2549         * ChakraCore.yaml:
2550
2551 2017-08-09  Caitlin Potter  <caitp@igalia.com>
2552
2553         Early error on ANY operator before new.target
2554         https://bugs.webkit.org/show_bug.cgi?id=157970
2555
2556         Reviewed by Saam Barati.
2557
2558         Instead of throwing if any unary operator precedes new.target, only
2559         throw if the unary operator updates the reference.
2560
2561         The following become legal in JSC:
2562
2563         ```
2564         !new.target
2565         ~new.target
2566         typeof new.target
2567         delete new.target
2568         void new.target
2569         ```
2570
2571         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
2572
2573         * stress/new-target-syntax-errors.js:
2574         * stress/new-target.js:
2575
2576 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
2577
2578         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
2579         https://bugs.webkit.org/show_bug.cgi?id=175255
2580
2581         Unreviewed test gardening.
2582
2583         * stress/regress-169783.js:
2584         * wasm/stress/oom.js:
2585
2586 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2587
2588         REGRESSION: 2 test262/test/language/statements/async-function failures
2589         https://bugs.webkit.org/show_bug.cgi?id=175334
2590
2591         Reviewed by Yusuke Suzuki.
2592
2593         Add @skip parameters to tests, and remove test for async iterator from
2594         async await syntax test because it is already covered by async-iterator-syntax.js
2595
2596         * stress/async-await-syntax.js:
2597         * stress/async-iteration-syntax.js:
2598
2599 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2600
2601         Unreviewed, gardening test262 for Promise resolve / reject function length
2602         https://bugs.webkit.org/show_bug.cgi?id=175333
2603
2604         * test262.yaml:
2605
2606 2017-08-07  Robin Morisset  <rmorisset@apple.com>
2607
2608         GetOwnProperty of TypedArray indexed fields is wrongly configurable
2609         https://bugs.webkit.org/show_bug.cgi?id=175307
2610
2611         Reviewed by Saam Barati.
2612
2613         * stress/typedarray-getownproperty-not-configurable.js: Added.
2614         (assert):
2615         (foo):
2616
2617 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2618
2619         Promise resolve and reject function should have length = 1
2620         https://bugs.webkit.org/show_bug.cgi?id=175242
2621
2622         Reviewed by Saam Barati.
2623
2624         * stress/builtin-function-length.js: Added.
2625         (shouldBe):
2626         (shouldThrow):
2627         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2628         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2629
2630 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2631
2632         [ESNext] Async iteration - Implement Async Generator - parser
2633         https://bugs.webkit.org/show_bug.cgi?id=175210
2634
2635         Reviewed by Yusuke Suzuki.
2636
2637         * stress/async-await-syntax.js:
2638         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2639         * stress/async-iteration-syntax.js: Added.
2640         (assert):
2641         (checkSyntax):
2642         (checkSyntaxError):
2643         (checkSimpleAsyncGeneratorSloppyMode):
2644         (checkSimpleAsyncGeneratorStrictMode):
2645         (checkNestedAsyncGenerators):
2646         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2647         * stress/generator-class-methods-syntax.js:
2648
2649 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2650
2651         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
2652         https://bugs.webkit.org/show_bug.cgi?id=175150
2653
2654         Unreviewed test gardening.
2655
2656         * wasm/js-api/test_memory_constructor.js:
2657
2658 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2659
2660         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
2661         https://bugs.webkit.org/show_bug.cgi?id=175100
2662
2663         Reviewed by Mark Lam.
2664
2665         The JSC test JSTests/wasm/stress/oom.js tries to use all the
2666         available memory until an out of memory exception happens.
2667
2668         The Linux kernel is more tuned for server workloads than for GUI
2669         responsiveness. When a process tries to use a lot of memory, Linux
2670         will do its best to serve the request. This usually translates to
2671         free physical RAM by writing to disk dirty pages and/or moving out
2672         less recently used pages to swap (disk storage).
2673         Meanwhile it does this, the system will become unresponsive and this
2674         leads to freezes that can last even some minutes on the worst cases.
2675
2676         Therefore, let's skip this test on Linux as it will cause more harm
2677         than good on the Linux bots or on the machines of Linux developers.
2678
2679         * wasm/stress/oom.js:
2680
2681 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2682
2683         [JSC] Remove unnecessary print from stress\promise-finally.js test
2684         https://bugs.webkit.org/show_bug.cgi?id=175015
2685
2686         Reviewed by Yusuke Suzuki.
2687
2688         * stress/promise-finally.js:
2689         (p.finally):
2690         (then):
2691
2692 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2693
2694         Unreviewed, update test262 results for optional catch binding
2695
2696         * test262.yaml:
2697
2698 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2699
2700         [JSC] Support optional catch binding
2701         https://bugs.webkit.org/show_bug.cgi?id=174981
2702
2703         Reviewed by Saam Barati.
2704
2705         * stress/optional-catch-binding-syntax.js: Added.
2706         (testSyntax):
2707         (testSyntaxError):
2708         (catch.catch):
2709         * stress/optional-catch-binding.js: Added.
2710         (shouldBe):
2711         (throwException):
2712
2713 2017-07-28  Mark Lam  <mark.lam@apple.com>
2714
2715         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
2716         https://bugs.webkit.org/show_bug.cgi?id=174948
2717         <rdar://problem/33495680>
2718
2719         Reviewed by Filip Pizlo.
2720
2721         * stress/regress-174948.js: Added.
2722
2723 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2724
2725         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
2726         https://bugs.webkit.org/show_bug.cgi?id=174900
2727
2728         Reviewed by Saam Barati.
2729
2730         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
2731         (sideEffect):
2732         (args):
2733         (test):
2734
2735 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2736
2737         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
2738         https://bugs.webkit.org/show_bug.cgi?id=171637
2739
2740         Reviewed by Darin Adler.
2741
2742         * stress/domjit-getter-complex-with-incorrect-object.js:
2743         (i.shouldThrow):
2744         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
2745         (shouldBe):
2746         (i.shouldThrow):
2747
2748 2017-07-26  JF Bastien  <jfbastien@apple.com>
2749
2750         WebAssembly: test throwing out of the start function
2751         https://bugs.webkit.org/show_bug.cgi?id=165714
2752         <rdar://problem/29760251>
2753
2754         Reviewed by Keith Miller.
2755
2756         * wasm/assert.js:
2757         * wasm/function-tests/trap-from-start.js: Added.
2758         (StartTraps):
2759         * wasm/function-tests/trap-from-start-async.js: Added.
2760         (async.StartTrapsAsync):
2761
2762 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2763
2764         [FTL] Arguments elimination is suppressed by unreachable blocks
2765         https://bugs.webkit.org/show_bug.cgi?id=174352
2766
2767         Reviewed by Filip Pizlo.
2768
2769         * stress/arguments-elimination-force-exit.js: Added.
2770         (shouldBe):
2771         (strict):
2772         (sloppy):
2773         * stress/arguments-elimination-throw.js: Added.
2774         (shouldBe):
2775         (shouldThrow):
2776         (sloppy):
2777         (isArguments):
2778
2779 2017-07-13  Mark Lam  <mark.lam@apple.com>
2780
2781         Add some additional test cases for bug 170896.
2782         https://bugs.webkit.org/show_bug.cgi?id=174491
2783
2784         Reviewed by Filip Pizlo.
2785
2786         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
2787         * stress/regress-170896-with-double-shape-profile.js: Added.
2788         (test):
2789         * stress/regress-170896-with-int32-shape-profile.js: Added.
2790         (test):
2791         * stress/regress-170896.js: Removed.
2792
2793 2017-07-13  Saam Barati  <sbarati@apple.com>
2794
2795         Missing exception check in JSObject::hasInstance
2796         https://bugs.webkit.org/show_bug.cgi?id=174455
2797         <rdar://problem/31384608>
2798
2799         Reviewed by Mark Lam.
2800
2801         * stress/has-instance-exception-check.js: Added.
2802         (assert):
2803         (let.getter.Object.getOwnPropertyDescriptor.get foo):
2804
2805 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
2806
2807         [ESnext] Implement Object Spread
2808         https://bugs.webkit.org/show_bug.cgi?id=167963
2809
2810         Reviewed by Saam Barati.
2811
2812         * stress/obj-rest-destructuring-order.js: Added.
2813         (assert):
2814         (o.get z):
2815         (o.get a):
2816         * stress/obj-spread-order.js: Added.
2817         (assert):
2818         (o.get z):
2819         (o.get a):
2820         * stress/object-spread.js: Added.
2821         (let.assert):
2822         (assert.sameValue):
2823         (let.o.get a):
2824         (let.obj.get c):
2825         (cthulhu.get x):
2826         (let.obj.set c):
2827         (calls.o.get z):
2828         (calls.o.get a):
2829         (try.let.obj.get foo):
2830         (get calls):
2831
2832 2017-07-12  Saam Barati  <sbarati@apple.com>
2833
2834         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
2835         https://bugs.webkit.org/show_bug.cgi?id=174411
2836         <rdar://problem/31696186>
2837
2838         Reviewed by Mark Lam.
2839
2840         * stress/generic-arguments-correct-delete-behavior.js: Added.
2841         (assert):
2842         (makeTest):
2843
2844 2017-07-07  Mark Lam  <mark.lam@apple.com>
2845
2846         \n\r is not the same as \r\n.
2847         https://bugs.webkit.org/show_bug.cgi?id=173053
2848
2849         Reviewed by Keith Miller.
2850
2851         * stress/regress-173053.js: Added.
2852         * stress/template-literal-line-terminators.js:
2853
2854 2017-07-06  Saam Barati  <sbarati@apple.com>
2855
2856         We are missing places where we invalidate the for-in context
2857         https://bugs.webkit.org/show_bug.cgi?id=174184
2858
2859         Reviewed by Geoffrey Garen.
2860
2861         * stress/for-in-invalidate-context-weird-assignments.js: Added.
2862         (assert):
2863         (test):
2864
2865 2017-07-05  Saam Barati  <sbarati@apple.com>
2866
2867         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
2868         https://bugs.webkit.org/show_bug.cgi?id=174188
2869         <rdar://problem/30581423>
2870
2871         Reviewed by Mark Lam.
2872
2873         * stress/new-array-having-a-bad-time-double.js: Added.
2874         (assert):
2875         (foo):
2876
2877 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2878
2879         WTF::StringImpl::copyChars segfaults when built with GCC 7
2880         https://bugs.webkit.org/show_bug.cgi?id=173407
2881
2882         Reviewed by Andreas Kling.
2883
2884         * stress/string-repeat-copy-chars-crash.js: Added.
2885         (shouldBe):
2886
2887 2017-07-03  Saam Barati  <sbarati@apple.com>
2888
2889         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
2890
2891         * stress/unshiftCountSlowCase-correct-postCapacity.js:
2892
2893 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2894
2895         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
2896
2897         It requires too much memory.
2898
2899         * stress/dont-reserve-huge-capacity-lexer.js:
2900
2901 2017-06-30  Michael Saboff  <msaboff@apple.com>
2902
2903         Skip a test on ARM64 platform since we run out of address space.
2904
2905         Rubber stamped by Saam Barati.
2906
2907         * stress/dont-reserve-huge-capacity-lexer.js:
2908
2909 2017-06-30  Michael Saboff  <msaboff@apple.com>
2910
2911         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
2912         https://bugs.webkit.org/show_bug.cgi?id=174044
2913
2914         Reviewed by Oliver Hunt.
2915
2916         New regression test.
2917
2918         * stress/regress-174044.js: Added.
2919         (test1):
2920         (test2):
2921
2922 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
2923
2924         RegExpCachedResult::setInput should reify left and right contexts
2925         https://bugs.webkit.org/show_bug.cgi?id=173818
2926
2927         Reviewed by Keith Miller.
2928
2929         * stress/right-left-context-invalidated-by-input.js: Added.
2930         (test.validateContexts):
2931         (test):
2932
2933 2017-06-29  Saam Barati  <sbarati@apple.com>
2934
2935         Calculating postCapacity in unshiftCountSlowCase is wrong
2936         https://bugs.webkit.org/show_bug.cgi?id=173992
2937         <rdar://problem/32283199>
2938
2939         Reviewed by Keith Miller.
2940
2941         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
2942         (temp):
2943
2944 2017-06-29  Commit Queue  <commit-queue@webkit.org>
2945
2946         Unreviewed, rolling out r218512.
2947         https://bugs.webkit.org/show_bug.cgi?id=173981
2948
2949         "It changes the behavior of the JS API's JSEvaluateScript
2950         which breaks TurboTax" (Requested by saamyjoon on #webkit).
2951
2952         Reverted changeset:
2953
2954         "test262: Completion values for control flow do not match the
2955         spec"
2956         https://bugs.webkit.org/show_bug.cgi?id=171265
2957         http://trac.webkit.org/changeset/218512
2958
2959 2017-06-27  JF Bastien  <jfbastien@apple.com>
2960
2961         WebAssembly: running out of executable memory should throw OoM
2962         https://bugs.webkit.org/show_bug.cgi?id=171537
2963         <rdar://problem/32963338>
2964
2965         Reviewed by Saam Barati.
2966
2967         * wasm.yaml:
2968         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
2969         (const.invoke):
2970         (failCount.0.catch):
2971         (failCount.0.module.undefined.catch):
2972         * wasm/lowExecutableMemory/exports-oom.js: Added.
2973         (const.type):
2974         (const.params):
2975         (const.randomProgram):
2976         (failCount.0.catch):
2977         (failCount.0.module.undefined.catch):
2978         * wasm/lowExecutableMemory/imports-oom.js: Added.
2979         (const.type):
2980         (const.params):
2981         (const.randomProgram):
2982         (f.imports.push):
2983         (failCount.0.catch):
2984         (failCount.0.module.undefined.catch):
2985
2986 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
2987
2988         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
2989         https://bugs.webkit.org/show_bug.cgi?id=167962
2990
2991         Reviewed by Saam Barati.
2992
2993         * stress/object-rest-deconstruct.js: Added.
2994         (let.assert):
2995         (let.assertPropDescriptor):
2996         (catch):
2997         (get 3):
2998         (foo):
2999         (let.src.get y):
3000         (let.src.set y):
3001         (let.gen):
3002
3003 2017-06-27  Saam Barati  <sbarati@apple.com>
3004
3005         Function constructor needs to follow the spec and validate parameters and body independently
3006         https://bugs.webkit.org/show_bug.cgi?id=173303
3007         <rdar://problem/32732526>
3008
3009         Reviewed by Keith Miller.
3010
3011         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3012         * stress/function-constructor-semantics.js: Added.
3013         (assert):
3014         (hasSyntaxError):
3015         (foo):
3016         (async.foo):
3017         (testError):
3018         (testOK.toString):
3019         (toString):
3020
3021 2017-06-26  Saam Barati  <sbarati@apple.com>
3022
3023         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3024         https://bugs.webkit.org/show_bug.cgi?id=173740
3025
3026         Reviewed by Mark Lam.
3027
3028         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3029         (Array.prototype.Symbol.iterator):
3030
3031 2017-06-26  Saam Barati  <sbarati@apple.com>
3032
3033         Skip a test on 32-bit platforms since we run out of address space.
3034
3035         Rubber stamped by Mark Lam.
3036
3037         * stress/dont-reserve-huge-capacity-lexer.js:
3038
3039 2017-06-26  Saam Barati  <sbarati@apple.com>
3040
3041         Crash in JSC::Lexer<unsigned char>::setCode
3042         https://bugs.webkit.org/show_bug.cgi?id=172754
3043
3044         Reviewed by Mark Lam.
3045
3046         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3047         (catch):
3048
3049 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3050
3051         [JSC] Clean up Object.entries implementation
3052         https://bugs.webkit.org/show_bug.cgi?id=173759
3053
3054         Reviewed by Sam Weinig.
3055
3056         * microbenchmarks/object-entries.js: Added.
3057         (test):
3058
3059 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3060
3061         Remove Reflect.enumerate
3062         https://bugs.webkit.org/show_bug.cgi?id=173806
3063
3064         Reviewed by Yusuke Suzuki.
3065
3066         * ChakraCore.yaml:
3067         * es6.yaml:
3068         These tests now fail because they use Reflect.enumerate.
3069
3070         * test262.yaml:
3071         This test now passes, it checked that Reflect.enumerate is undefined!
3072
3073         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3074         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3075
3076         * stress/reflect-enumerate.js: Removed.
3077         Remove a test solely for Reflect.enumerate.
3078
3079 2017-06-22  Saam Barati  <sbarati@apple.com>
3080
3081         ValueRep(DoubleRep(@v)) can not simply convert to @v
3082         https://bugs.webkit.org/show_bug.cgi?id=173687
3083         <rdar://problem/32855563>
3084
3085         Reviewed by Mark Lam.
3086
3087         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3088         (i.catch):
3089
3090 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3091
3092         [JSC] Object.values should be implemented in C++
3093         https://bugs.webkit.org/show_bug.cgi?id=173703
3094
3095         Reviewed by Sam Weinig.
3096
3097         * microbenchmarks/object-keys-map-values.js: Added.
3098         (test):
3099         * microbenchmarks/object-values.js: Added.
3100         (test):
3101         * stress/object-values-changing-properties.js: Added.
3102         (shouldBe):
3103         (throw.new.Error.let.source.get x):
3104         (throw.new.Error):
3105         (shouldBe.let.handler.get order):
3106         (get let):
3107         (shouldBe.let.handler.get return):
3108         (let.handler.get order):
3109
3110 2017-06-21  Saam Barati  <sbarati@apple.com>
3111
3112         eval virtual call is incorrect in the baseline JIT
3113         https://bugs.webkit.org/show_bug.cgi?id=173587
3114         <rdar://problem/32867897>
3115
3116         Reviewed by Michael Saboff.
3117
3118         * stress/do-eval-virtual-call-correctly.js: Added.
3119         (assert):
3120         (f):
3121         (i.test):
3122         (catch):
3123
3124 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3125
3126         Update test262 test expectations after r218581.
3127
3128         Unreviewed test gardening.
3129
3130         * test262.yaml:
3131
3132 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
3133
3134         Revert changes in bug#160417 about extending `null` not being a derived class
3135         https://bugs.webkit.org/show_bug.cgi?id=169293
3136
3137         Reviewed by Saam Barati.
3138
3139         * stress/class-derived-from-null.js:
3140         (assertThrow):
3141         (test1):
3142         (test2):
3143         (test3):
3144         (test4):
3145         (test5):
3146         (test6):
3147
3148 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3149
3150         [DFG] More ArrayIndexOf fixups for various types
3151         https://bugs.webkit.org/show_bug.cgi?id=173176
3152
3153         Reviewed by Saam Barati.
3154
3155         * stress/array-indexof-arraystorage.js: Added.
3156         (shouldBe):
3157         (indexOfInt32Other):
3158         (indexOfInt32Cell):
3159         (indexOfInt32Boolean):
3160         (indexOfDoubleOther):
3161         (indexOfDoubleCell):
3162         (indexOfDoubleBoolean):
3163         (indexOfInt32):
3164         (indexOfDouble):
3165         * stress/array-indexof-constant-folding.js: Added.
3166         (shouldBe):
3167         (indexOfInt32Other):
3168         (indexOfInt32Cell):
3169         (indexOfInt32Boolean):
3170         (indexOfDoubleOther):
3171         (indexOfDoubleCell):
3172         (indexOfDoubleBoolean):
3173         * stress/array-indexof-hole-and-other.js: Added.
3174         (shouldBe):
3175         (indexOf):
3176         * stress/array-indexof-other.js: Added.
3177         (shouldBe):
3178         (indexOfInt32):
3179         (indexOfDouble):
3180         (indexOfString):
3181         (indexOfObject):
3182         * stress/array-indexof-symbol.js: Added.
3183         (shouldBe):
3184         (indexOfInt32):
3185         (indexOfDouble):
3186         (indexOfString):
3187         (indexOfObject):
3188
3189 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
3190
3191         test262: Completion values for control flow do not match the spec
3192         https://bugs.webkit.org/show_bug.cgi?id=171265
3193
3194         Reviewed by Saam Barati.
3195
3196         * stress/completion-value.js:
3197         Condensed test for completion values in top level statements.
3198
3199         * stress/super-get-by-id.js:
3200         ClassDeclaration when evaled no longer produce values. Convert
3201         these to ClassExpressions so they produce the class value.
3202
3203         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3204         This is a progression for currect spec behavior.
3205
3206         * mozilla/mozilla-tests.yaml:
3207         This test is now outdated, so mark it as failing for that reason.
3208
3209         * test262.yaml:
3210         Passing all "cptn" completion value tests.
3211
3212 2017-06-17  Keith Miller  <keith_miller@apple.com>
3213
3214         ArrayBuffer constructor needs to create subclass structures before its buffer
3215         https://bugs.webkit.org/show_bug.cgi?id=173510
3216
3217         Reviewed by Yusuke Suzuki.
3218
3219         * test262.yaml:
3220
3221 2017-06-17  Keith Miller  <keith_miller@apple.com>
3222
3223         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
3224         https://bugs.webkit.org/show_bug.cgi?id=173506
3225
3226         Reviewed by Ryosuke Niwa.
3227
3228         Re-baseline tests.
3229
3230         * ChakraCore/test/Function/apply3.baseline-jsc:
3231         * test262.yaml:
3232
3233 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3234
3235         [JSC] Add fast path for Object.assign
3236         https://bugs.webkit.org/show_bug.cgi?id=173416
3237
3238         Reviewed by Mark Lam.
3239
3240         * stress/object-assign-changing-properties.js: Added.
3241         (shouldBe):
3242         (throw.new.Error.let.source.get x):
3243         (throw.new.Error):
3244         (shouldBe.let.source.get x):
3245         (shouldBe.let.target.set x):
3246         (shouldBe.let.target.get x):
3247         * stress/object-assign-proxy.js: Added.
3248         (shouldBe):
3249         (throw.new.Error.let.handler.get order):
3250
3251 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3252
3253         [JSC] Implement Object.assign in C++
3254         https://bugs.webkit.org/show_bug.cgi?id=173414
3255
3256         Reviewed by Saam Barati.
3257
3258         * stress/object-assign-string-first.js: Added.
3259         (shouldBe):
3260         (source.get Symbol):
3261         (source.get 1):
3262         (source.get cocoa):
3263
3264 2017-06-14  JF Bastien  <jfbastien@apple.com>
3265
3266         WebAssembly: remove empty test files
3267         https://bugs.webkit.org/show_bug.cgi?id=173382
3268
3269         Reviewed by Saam Barati.
3270
3271         The following files:
3272                 JSTests/wasm/function-tests/call-indirect-params.js
3273                 JSTests/wasm/function-tests/call-indirect.js
3274                 JSTests/wasm/js-api/call-indirect-results.js
3275         Were changed to empty files in https://trac.webkit.org/changeset/209771
3276
3277         They were testing call_indirect with the wrong semantics, before
3278         we implemented tables. That change implemented tables and
3279         therefore removed the erroneous tests.
3280
3281         We have a few tests for call_indirect which already do the right thing:
3282                 JSTests/wasm/function-tests/context-switch.js
3283                 JSTests/wasm/function-tests/exceptions.js
3284                 JSTests/wasm/function-tests/grow-memory-2.js
3285                 JSTests/wasm/function-tests/stack-overflow.js
3286                 JSTests/wasm/function-tests/table-basic-2.js
3287                 JSTests/wasm/function-tests/table-basic.js
3288                 JSTests/wasm/js-api/call-indirect.js
3289                 JSTests/wasm/js-api/table.js
3290                 JSTests/wasm/js-api/unique-signature.js
3291                 JSTests/wasm/js-api/wrapper-function.js
3292
3293         I also just imported the updated spec tests which, among other
3294         things, test call_indirect:
3295                 core/br.wast
3296                 core/br_table.wast
3297                 core/call_indirect.wast
3298                 core/func.wast
3299                 core/func_ptrs.wast
3300                 core/imports.wast
3301                 core/left-to-right.wast
3302                 core/linking.wast
3303                 core/nop.wast
3304                 core/return.wast
3305                 core/typecheck.wast
3306                 core/unreachable.wast
3307
3308         So I think it's OK to just delete the tests which should just have
3309         been deleted back when tables were added.
3310
3311         * wasm/function-tests/call-indirect-params.js: Removed.
3312         * wasm/function-tests/call-indirect.js: Removed.
3313         * wasm/js-api/call-indirect-results.js: Removed.
3314
3315 2017-06-13  JF Bastien  <jfbastien@apple.com>
3316
3317         WebAssembly: import updated spec tests
3318         https://bugs.webkit.org/show_bug.cgi?id=173287
3319         <rdar://problem/32725975>
3320
3321         Reviewed by Saam Barati.
3322
3323         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
3324         with a few modifications so things work.
3325
3326         Fix a bunch of bugs found through this process, and punt a few tests (which I
3327         marked as blocked by this bug).
3328
3329         Fixes:
3330
3331         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
3332         instead of byte alignment. It was also missing memory-alignment.js despite it
3333         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
3334         pass.
3335
3336         Tables can be imported or in a section. There can be only one, but sections can
3337         be empty. An Elements section can exist if there's no Table, as long as it is
3338         also empty.
3339
3340         Memories can be imported or in a section. There can be only one, but sections
3341         can be empty. A Data section can exist if there's no Memory, as long as it is
3342         also empty.
3343
3344         Prototypes: stringify without .prototype. in the string.
3345
3346         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
3347         not a final size, and throws a RangeError on failure, not a TypeError.
3348
3349         Fix compile / instantiate so the reject the promise if given an argument of the
3350         wrong type (instead of failing instantly).
3351
3352         Fix async on neuter test.
3353
3354         Element section shouldn't affect any Table if any of the elements are out of
3355         bounds. We need to process it in two passes.
3356
3357         Segment section shouldn't affect any Data if any of the segments are out of
3358         bounds. We need to process it in two passes.
3359
3360         Empty data segments are valid, but only when there is no memory. Their index
3361         still gets validated, and has to be zero.
3362
3363         Punts:
3364
3365         Error messages with context, the test seems overly restrictive but this is
3366         minor.
3367
3368         compile/instantiate/validate property descriptors.
3369
3370         UTF-8 bugs.
3371
3372         Temporarily disable NaN tests. We need to go back and implement the following
3373         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
3374         much as getting all the other tests passing.
3375
3376         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
3377         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
3378         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
3379         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
3380         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
3381         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
3382         why they're not allowed.
3383
3384         * wasm.yaml:
3385         * wasm/function-tests/i32-load8-s.js:
3386         * wasm/function-tests/memory-access-past-4gib.js:
3387         (const.op.of.WASM.opcodes):
3388         * wasm/function-tests/memory-alignment.js: Added.
3389         (const.op.of.WASM.opcodes):
3390         * wasm/function-tests/memory-section-and-import.js:
3391         * wasm/js-api/Module-compile.js:
3392         (async.testPromiseAPI):
3393         * wasm/js-api/dont-mmap-zero-byte-memory.js:
3394         (testMems):
3395         * wasm/js-api/element.js:
3396         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3397         * wasm/js-api/neutered-inputs.js:
3398         (const.testFunction): Deleted.
3399         (const.testConstructor): Deleted.
3400         * wasm/js-api/table.js:
3401         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3402         (new.WebAssembly.Module):
3403         (assert.throws):
3404         (assertBadTableImport):
3405         (assert.throws.WebAssembly.Table.prototype.grow):
3406         (assertBadTableInstance): Deleted.
3407         * wasm/js-api/test_Data.js:
3408         (DataSectionWithoutMemory):
3409         * wasm/spec-harness/index.js:
3410         (module):
3411         (uniqueTest): Deleted.
3412         (assert_invalid): Deleted.
3413         (assert_soft_invalid): Deleted.
3414         (register): Deleted.
3415         (call): Deleted.
3416         (get instance): Deleted.
3417         (exports): Deleted.
3418         (run): Deleted.
3419         (assert_unlinkable): Deleted.
3420         (assert_uninstantiable): Deleted.
3421         (assert_trap): Deleted.
3422         (try.f): Deleted.
3423         (catch): Deleted.
3424         (assert_exhaustion): Deleted.
3425         (assert_return): Deleted.
3426         (assert_return_nan): Deleted.
3427         * wasm/spec-harness/testharness.css: Removed.
3428         * wasm/spec-harness/testharness.js: Removed.
3429         * wasm/spec-harness/testharnessreport.js: Removed.
3430         * wasm/spec-harness/wasm-constants.js:
3431         (assertTraps):
3432         (assertWasmThrows):
3433         * wasm/spec-harness/wasm-module-builder.js:
3434         (Binary.prototype.emit_section):
3435         (Binary):
3436         (WasmFunctionBuilder.prototype.addBody):
3437         (WasmFunctionBuilder.prototype.end):
3438         (WasmFunctionBuilder):
3439         (WasmModuleBuilder.prototype.stringToBytes):
3440         (WasmModuleBuilder.prototype.addCustomSection):
3441         (WasmModuleBuilder.prototype.addFunctionTableInit):
3442         (WasmModuleBuilder.prototype.appendToTable):
3443         (WasmModuleBuilder.prototype.toArray):
3444         (WasmModuleBuilder.prototype.toBuffer):
3445         (WasmModuleBuilder.prototype.instantiate):
3446         (WasmModuleBuilder):
3447         * wasm/spec-tests/address.wast.js:
3448         * wasm/spec-tests/align.wast.js: Added.
3449         * wasm/spec-tests/binary.wast.js:
3450         * wasm/spec-tests/block.wast.js:
3451         * wasm/spec-tests/br.wast.js:
3452         * wasm/spec-tests/br_if.wast.js:
3453         * wasm/spec-tests/br_table.wast.js:
3454         * wasm/spec-tests/call.wast.js:
3455         * wasm/spec-tests/call_indirect.wast.js:
3456         * wasm/spec-tests/comments.wast.js:
3457         * wasm/spec-tests/const.wast.js: Added.
3458         * wasm/spec-tests/conversions.wast.js: Added.
3459         * wasm/spec-tests/custom_section.wast.js:
3460         * wasm/spec-tests/exports.wast.js:
3461         * wasm/spec-tests/f32.wast.js: Added.
3462         * wasm/spec-tests/f64.wast.js: Added.
3463         * wasm/spec-tests/fac.wast.js:
3464         * wasm/spec-tests/float_exprs.wast.js: Added.
3465         * wasm/spec-tests/float_misc.wast.js: Added.
3466         * wasm/spec-tests/func.wast.js:
3467         * wasm/spec-tests/globals.wast.js:
3468         * wasm/spec-tests/if.wast.js:
3469         * wasm/spec-tests/imports.wast.js:
3470         * wasm/spec-tests/inline-module.wast.js: Added.
3471         * wasm/spec-tests/jsapi.js:
3472         (testJSAPI.test):
3473         (testJSAPI):
3474         * wasm/spec-tests/labels.wast.js:
3475         * wasm/spec-tests/loop.wast.js:
3476         * wasm/spec-tests/memory.wast.js:
3477         * wasm/spec-tests/memory_trap.wast.js: Added.
3478         * wasm/spec-tests/names.wast.js:
3479         * wasm/spec-tests/nop.wast.js:
3480         * wasm/spec-tests/return.wast.js:
3481         * wasm/spec-tests/stack.wast.js:
3482         * wasm/spec-tests/token.wast.js: Added.
3483         * wasm/spec-tests/type.wast.js: Added.
3484         * wasm/spec-tests/typecheck.wast.js:
3485         * wasm/spec-tests/unreachable.wast.js:
3486         * wasm/spec-tests/unreached-invalid.wast.js:
3487         * wasm/spec-tests/unwind.wast.js:
3488         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
3489         * wasm/spec-tests/utf8-import-field.wast.js: Added.
3490         * wasm/spec-tests/utf8-import-module.wast.js: Added.
3491
3492 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
3493
3494         Unreviewed JSC test gardening.
3495
3496         * stress/check-string-ident.js:
3497         * stress/new-largeish-contiguous-array-with-size.js:
3498
3499 2017-06-13  Michael Saboff  <msaboff@apple.com>
3500
3501         DFG doesn't properly handle a property that is change to read only in a prototype
3502         https://bugs.webkit.org/show_bug.cgi?id=173321
3503
3504         Reviewed by Filip Pizlo.
3505
3506         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
3507         * stress/regress-173321.js: Added new regression test.
3508         (shouldBe):
3509         (SimpleObject):
3510         (test):
3511
3512 2017-06-12  Saam Barati  <sbarati@apple.com>
3513
3514         Update test262 test expectation since r218082 makes new tests pass.
3515
3516         * test262.yaml:
3517
3518 2017-06-12  Saam Barati  <sbarati@apple.com>
3519
3520         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
3521         https://bugs.webkit.org/show_bug.cgi?id=172957
3522         <rdar://problem/32602704>
3523
3524         Reviewed by Filip Pizlo.
3525
3526         * stress/spec-empty-flows-through-cell-checks.js: Added.
3527         (A):
3528         (B):
3529         (i.catch):
3530
3531 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
3532
3533         We incorrectly allow escaped characters in keyword tokens
3534         https://bugs.webkit.org/show_bug.cgi?id=171310
3535
3536         Reviewed by Yusuke Suzuki.
3537
3538         * stress/destructuring-assignment-syntax.js:
3539         * stress/error-messages-for-in-operator-should-not-crash.js:
3540         (catch):
3541         * stress/reserved-word-with-escape.js:
3542         (testSyntaxError.String.raw.v):
3543         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
3544         (testSyntaxError.String.raw.a):
3545         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
3546
3547 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3548
3549         [DFG] Add ArrayIndexOf intrinsic
3550         https://bugs.webkit.org/show_bug.cgi?id=172421
3551
3552         Reviewed by Saam Barati.
3553
3554         * stress/array-indexof-array-prototype-change.js: Added.
3555         (shouldBe):
3556         (indexOfInt32):
3557         * stress/array-indexof-have-a-bad-time-getter.js: Added.
3558         (shouldBe):
3559         (indexOfInt32):
3560         * stress/array-indexof-have-a-bad-time.js: Added.
3561         (shouldBe):
3562         (indexOfInt32):
3563         * stress/array-indexof-hole-with-prototype.js: Added.
3564         (shouldBe):
3565         (indexOf):
3566         * stress/array-indexof-hole.js: Added.
3567         (shouldBe):
3568         (indexOf):
3569         * stress/array-indexof-index.js: Added.
3570         (shouldBe):
3571         (indexOfInt32):
3572         (indexOfDouble):
3573         (indexOfString):
3574         (indexOfObject):
3575         (indexOfValue):
3576         * stress/array-indexof-negative-index.js: Added.
3577         (shouldBe):
3578         (indexOfInt32):
3579         (indexOfDouble):
3580         (indexOfString):
3581         (indexOfObject):
3582         (indexOfValue):
3583         * stress/array-indexof-non-int32-start-index.js: Added.
3584         (shouldBe):
3585         (indexOf):
3586         (object.valueOf):
3587         * stress/array-indexof-object-prototype-change.js: Added.
3588         (shouldBe):
3589         (indexOfInt32):
3590         * stress/array-indexof-object.js: Added.
3591         (shouldBe):
3592         (indexOf):
3593         * stress/array-indexof-original-array.js: Added.
3594         (shouldBe):
3595         (indexOfInt32):
3596         * stress/array-indexof-string.js: Added.
3597         (shouldBe):
3598         (indexOf):
3599         * stress/array-indexof-structure-change-convert.js: Added.
3600         (shouldBe):
3601         (indexOf):
3602         * stress/array-indexof-structure-change.js: Added.
3603         (shouldBe):
3604         (indexOf):
3605         * stress/array-indexof.js: Added.
3606         (shouldBe):
3607         (indexOf):
3608
3609 2017-06-11  Keith Miller  <keith_miller@apple.com>
3610
3611         TypedArray constructor with string shouldn't throw
3612         https://bugs.webkit.org/show_bug.cgi?id=173181
3613
3614         Reviewed by JF Bastien.
3615
3616         We should be coercing primitive arguments to numbers in the various
3617         TypedArray constructors.
3618
3619         * stress/typedarray-constructor.js:
3620
3621 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3622
3623         Unreviewed, update test results part 3
3624         https://bugs.webkit.org/show_bug.cgi?id=173227
3625
3626         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
3627
3628 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3629
3630         Unreviewed, update test results part 2
3631         https://bugs.webkit.org/show_bug.cgi?id=173227
3632
3633         * test262.yaml:
3634
3635 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3636
3637         Unreviewed, update test results
3638         https://bugs.webkit.org/show_bug.cgi?id=173227
3639
3640         * microbenchmarks/string-prototype-search-observable-side-effects.js:
3641         * test262.yaml:
3642
3643 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3644
3645         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
3646         https://bugs.webkit.org/show_bug.cgi?id=173227
3647
3648         Reviewed by Mark Lam.
3649
3650         Update the test.
3651
3652         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
3653
3654 2017-06-08  Keith Miller  <keith_miller@apple.com>
3655
3656         WebAssembly: We should only create wrappers for functions that can be exported
3657         https://bugs.webkit.org/show_bug.cgi?id=173088
3658
3659         Reviewed by Saam Barati.
3660
3661         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
3662         on the old testWasmModuleFunctions api, which has been removed.
3663
3664         * wasm/function-tests/copysign.js: Removed.
3665         * wasm/function-tests/ctz.js: Removed.
3666         * wasm/function-tests/drop.js: Removed.
3667         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
3668         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
3669         * wasm/function-tests/dumb-less-than-ite.js: Removed.
3670         * wasm/function-tests/eqz.js: Removed.
3671         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
3672         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
3673         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
3674         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
3675         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
3676         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
3677         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
3678         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
3679         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
3680         * wasm/function-tests/if-then-fallthrough.js: Removed.
3681         * wasm/function-tests/int-to-floating-point.js: Removed.
3682         * wasm/function-tests/loop-mult.js:
3683         * wasm/function-tests/loop-sum.js:
3684         * wasm/function-tests/max.js: Removed.
3685         * wasm/function-tests/min.js: Removed.
3686         * wasm/function-tests/nearest.js: Removed.
3687         * wasm/function-tests/nop.js: Removed.
3688         * wasm/function-tests/popcnt.js: Removed.
3689         * wasm/function-tests/ret5.js:
3690         * wasm/function-tests/select.js: Removed.
3691         * wasm/function-tests/tee-local.js: Removed.
3692         * wasm/function-tests/trunc.js: Removed.
3693
3694 2017-06-07  JF Bastien  <jfbastien@apple.com>
3695
3696         WebAssembly: test imports and exports with 16-bit characters
3697         https://bugs.webkit.org/show_bug.cgi?id=165977
3698         <rdar://problem/29760130>
3699
3700         Reviewed by Saam Barati.
3701
3702         The output for import failure was improved, so many tests need to
3703         be updated here. Only one has new tests as noted below.
3704
3705         * wasm/function-tests/memory-import-and-grow.js:
3706         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
3707         (idxModule):
3708         * wasm/js-api/global-error.js:
3709         (new.Number):
3710         (assert.throws):
3711         * wasm/js-api/table.js:
3712         (assert.throws):
3713         (new.WebAssembly.Table):
3714         * wasm/js-api/test_memory.js:
3715         (test):
3716         * wasm/js-api/wasm-to-wasm-bad-signature.js:
3717         (BadSignatureDropStartParams.):
3718         (BadSignatureDropStartParams):
3719         (BadSignatureDropEndParams.):
3720         (BadSignatureSwapParam.):
3721         (BadSignatureRet.):
3722         * wasm/js-api/web-assembly-instantiate.js:
3723         (assert.asyncTest.async.test):
3724         (assert.asyncTest):
3725         * wasm/js-api/wrapper-function.js:
3726         (return.new.WebAssembly.Module):
3727
3728 2017-06-07  Mark Lam  <mark.lam@apple.com>
3729
3730         Restrict the regress-173035.js test to only run on Darwin x86-64.
3731         https://bugs.webkit.org/show_bug.cgi?id=173075
3732
3733         Reviewed by Saam Barati.
3734
3735         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
3736         this test will require to succeed.  Here's an example of this failure:
3737         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
3738
3739         Since the issue is due to allocation of a very large amount of memory, the test
3740         will probably fail on iOS and other platforms as well.  Hence, we should just
3741         skip this test for any platforms that is not Darwin x86-64.
3742
3743         * stress/regress-173035.js:
3744
3745 2017-06-07  Mark Lam  <mark.lam@apple.com>
3746
3747         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
3748         https://bugs.webkit.org/show_bug.cgi?id=168587
3749
3750         Not reviewed.
3751
3752         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
3753
3754         * stress/test-finally.js:
3755
3756 2017-06-06  Mark Lam  <mark.lam@apple.com>
3757
3758         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
3759         https://bugs.webkit.org/show_bug.cgi?id=173035
3760         <rdar://problem/32554593>
3761
3762         Reviewed by Geoffrey Garen and Filip Pizlo.
3763
3764         * stress/regress-173035.js: Added.
3765
3766 2017-06-06  Saam Barati  <sbarati@apple.com>
3767
3768         Make sure we restore SP when doing calls that could be to JS
3769         https://bugs.webkit.org/show_bug.cgi?id=172946
3770         <rdar://problem/32579026>
3771
3772         Reviewed by JF Bastien.
3773
3774         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
3775         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
3776         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
3777         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
3778         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
3779
3780 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
3781
3782         Unreviewed rollout r217807. Caused a test to crash.
3783
3784         * heapProfiler/class-names.js: Removed.
3785         * heapProfiler/driver/driver.js:
3786         (CheapHeapSnapshotNode):
3787         (CheapHeapSnapshot):
3788         (createCheapHeapSnapshot):
3789         (HeapSnapshot):
3790         (createHeapSnapshot):
3791         * typeProfiler/inheritance.js:
3792         (wrapper.A):
3793         (wrapper.B):
3794         (wrapper.C):
3795         (wrapper):
3796
3797 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
3798
3799         index out of bound in bytecodebasicblock
3800         https://bugs.webkit.org/show_bug.cgi?id=172963
3801
3802         Reviewed by Saam Barati and Mark Lam.
3803
3804         * stress/dfg-call-class-constructor.js: Added.
3805         (Foo):
3806         (i.catch):
3807
3808 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
3809
3810         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
3811         https://bugs.webkit.org/show_bug.cgi?id=172848
3812         <rdar://problem/25709212>
3813
3814         Reviewed by Saam Barati.
3815
3816         * typeProfiler/inheritance.js:
3817         Rewrite the test slightly for clarity. The hoisting was confusing.
3818
3819         * heapProfiler/class-names.js: Added.
3820         (MyES5Class):
3821         (MyES6Class):
3822         (MyES6Subclass):
3823         Test object types and improved class names.
3824
3825         * heapProfiler/driver/driver.js:
3826         (CheapHeapSnapshotNode):
3827         (CheapHeapSnapshot):
3828         (createCheapHeapSnapshot):
3829         (HeapSnapshot):
3830         (createHeapSnapshot):
3831         Update snapshot parsing from version 1 to version 2.
3832
3833 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3834
3835         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
3836         https://bugs.webkit.org/show_bug.cgi?id=168844
3837
3838         Reviewed by Saam Barati.
3839
3840         * modules/async-function-export.js: Added.
3841         (f):
3842         (export.async.f):
3843
3844 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3845
3846         ES2015 modules - Export default function hoisting
3847         https://bugs.webkit.org/show_bug.cgi?id=170174
3848
3849         Reviewed by Saam Barati.
3850
3851         This issue itself is solved by fixing function declaration hoisting rules.
3852         This patch just adds the specific test to modules tests to ensure the bug
3853         is fixed.
3854
3855         * modules/export-default-function-hoisting.js: Added.
3856         * modules/export-default-function-hoisting/cappuccino.js: Added.
3857         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
3858         * modules/export-default-function-hoisting/cocoa.js: Added.
3859         (export.default.drinkCocoa):
3860
3861 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3862
3863         Class Proxy can't be extended
3864         https://bugs.webkit.org/show_bug.cgi?id=169040
3865
3866         Reviewed by Saam Barati.
3867
3868         Adding tests that check correctness of Proxy to ES6 `class`
3869         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
3870
3871         * stress/proxy-class.js: Added.
3872         (assert):
3873         (throw.new.Error.SuperClass):
3874         (throw.new.Error.A):
3875         (throw.new.Error):
3876
3877 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3878
3879         [JSC] Implement String.prototype.concat in JS builtins
3880         https://bugs.webkit.org/show_bug.cgi?id=172798
3881
3882         Reviewed by Sam Weinig.
3883
3884         * microbenchmarks/string-concat-convert.js: Added.
3885         (test):
3886         * microbenchmarks/string-concat-long-convert.js: Added.
3887         (test):
3888         * microbenchmarks/string-concat-long.js: Added.
3889         (test):
3890         * microbenchmarks/string-concat.js: Added.
3891         (test):
3892
3893 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
3894
3895         Rolling out: Prevent async methods named 'function'
3896         https://bugs.webkit.org/show_bug.cgi?id=172776
3897
3898         Reviewed by Mark Lam.
3899
3900         * stress/async-await-syntax.js:
3901         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3902         (testTopLevelAsyncAwaitSyntaxSloppyMode):
3903         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
3904         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
3905         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
3906
3907 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
3908
3909         Skip flaky JSC test stress/test-finally.js
3910         https://bugs.webkit.org/show_bug.cgi?id=168587
3911
3912         Unreviewed test gardening.
3913
3914         * stress/test-finally.js:
3915
3916 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3917
3918         Prevent async methods named 'function' in Object literal
3919         https://bugs.webkit.org/show_bug.cgi?id=172660
3920
3921         Reviewed by Saam Barati.
3922
3923         * stress/async-await-syntax.js:
3924         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
3925
3926 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3927
3928         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
3929         https://bugs.webkit.org/show_bug.cgi?id=171274
3930
3931         Reviewed by Saam Barati.
3932
3933         * stress/async-arrow-functions-lexical-binding-in-class.js:
3934         (shouldBeAsync):
3935         (shouldBeAsyncAndStoreBind):
3936         (promise.new.Promise):
3937         (ChildClass4):
3938         (ChildClass4.prototype.classValue):
3939         (ChildClass4.prototype.get classProperty):
3940         * stress/async-arrow-functions-lexical-super-binding.js:
3941         (A):
3942         (const.childA1.new.prototype.var.f.async):
3943         (const.childA1.new.var):
3944         (const.childA1.new):
3945         (const.childA2.new.prototype.var.f.async):
3946         (const.childA2.new.var):
3947         (const.childA2.new):
3948         (const.childA3.new.prototype.var.f.async):
3949         (const.childA3.new.var):
3950         (const.childA3.new):
3951         (try.childA4.new.prototype.var.f.async):
3952         (try.childA4.new.var):
3953         (try.childA4.new):
3954         (catch):
3955         (const.childA5.new.prototype.var.f.async):
3956         (const.childA5.new.var):
3957         (const.childA5.new):
3958         (checkClass):
3959         (checkClass.new.prototype.var.f.async):
3960         (checkClass.new.var):
3961         (checkClass.new):
3962         (checkClass.new.prototype.method):
3963         (checkClass.new.prototype.prop):
3964
3965 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3966
3967         [JSC] Map and Set constructors should have fast path for cloning
3968         https://bugs.webkit.org/show_bug.cgi?id=172413
3969
3970         Reviewed by Saam Barati.
3971
3972         * stress/map-clone-instance-iterator-change.js: Added.
3973         (shouldBe):
3974         (map.Symbol.iterator):
3975         * stress/map-clone-iterator-change.js: Added.
3976         (shouldBe):
3977         (Map.prototype.Symbol.iterator):
3978         * stress/map-clone-next-change.js: Added.
3979         (shouldBe):
3980         (map.Symbol.iterator.__proto__.next):
3981         * stress/map-clone.js: Added.
3982         (shouldBe):
3983         (Map.prototype):
3984         * stress/map-inherit-set.js: Added.
3985         (shouldBe):
3986         (DerivedMap):
3987         (set for):
3988         * stress/set-clone-instance-iterator-change.js: Added.
3989         (shouldBe):
3990         (set Symbol.iterator):
3991         * stress/set-clone-iterator-change.js: Added.
3992         (shouldBe):
3993         (set Set.prototype.Symbol.iterator):
3994         * stress/set-clone-next-change.js: Added.
3995         (shouldBe):
3996         (set Symbol.iterator.__proto__.next):
3997         * stress/set-clone.js: Added.
3998         (shouldBe):
3999         (set Set.prototype.add):
4000         * stress/set-inherit-add.js: Added.
4001         (shouldBe):
4002         (DerivedSet.set add):
4003
4004 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
4005
4006         Unreviewed, rolling out r217458.
4007
4008         This change caused 55 JSC test failures.
4009
4010         Reverted changeset:
4011
4012         "Date should use historical data if it's available."
4013         https://bugs.webkit.org/show_bug.cgi?id=172592
4014         http://trac.webkit.org/changeset/217458
4015
4016 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
4017
4018         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
4019         https://bugs.webkit.org/show_bug.cgi?id=167805
4020
4021         Reviewed by Saam Barati.
4022
4023         * modules/module-jit-reachability.js: Added.
4024
4025 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
4026
4027         Prevent async methods named 'function'
4028         https://bugs.webkit.org/show_bug.cgi?id=172598
4029
4030         Reviewed by Mark Lam.
4031
4032         * stress/async-await-syntax.js:
4033         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
4034         (testTopLevelAsyncAwaitSyntaxSloppyMode):
4035         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
4036         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
4037         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
4038
4039 2017-05-25  Keith Miller  <keith_miller@apple.com>
4040
4041         Date should use historical data if it's available.
4042         https://bugs.webkit.org/show_bug.cgi?id=172592
4043
4044         Reviewed by Mark Lam.
4045
4046         Remove parts of the date tests that rely on the absence of
4047         historical data in Date.
4048
4049         * mozilla/ecma/Date/15.9.5.31-1.js:
4050         (getTestCases):
4051         * mozilla/ecma/Date/15.9.5.35-1.js:
4052         (getTestCases):
4053
4054 2017-05-25  Saam Barati  <sbarati@apple.com>
4055
4056         Our for-in optimization in the bytecode generator does its static analysis incorrectly
4057         https://bugs.webkit.org/show_bug.cgi?id=172532
4058         <rdar://problem/32369452>
4059
4060         Reviewed by Mark Lam.
4061
4062         * stress/for-in-invalidation-for-any-write.js: Added.
4063         (assert):
4064         (test):
4065         (test.i):
4066
4067 2017-05-25  Mark Lam  <mark.lam@apple.com>
4068
4069         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
4070         https://bugs.webkit.org/show_bug.cgi?id=172548
4071         <rdar://problem/31458393>
4072
4073         Reviewed by Filip Pizlo.
4074
4075         * stress/regress-172548.patch: Added.
4076
4077 2017-05-23  Saam Barati  <sbarati@apple.com>
4078
4079         We should not mmap zero bytes for a memory in Wasm
4080         https://bugs.webkit.org/show_bug.cgi?id=172528
4081         <rdar://problem/32257076>
4082
4083         Reviewed by Mark Lam.
4084
4085         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
4086         (testMems):
4087
4088 2017-05-23  Saam Barati  <sbarati@apple.com>
4089
4090         CFGSimplificationPhase should not merge a block with itself
4091         https://bugs.webkit.org/show_bug.cgi?id=172508
4092         <rdar://problem/28424006>
4093
4094         Reviewed by Keith Miller.
4095
4096         * stress/dont-crash-in-cfg-simplification.js: Added.
4097         (bar):
4098         (baz):
4099         (foo):
4100
4101 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
4102
4103         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
4104         https://bugs.webkit.org/show_bug.cgi?id=172216
4105
4106         Reviewed by Saam Barati.
4107
4108         * stress/array-storage-get-by-val.js: Added.
4109         (shouldBe):
4110         (testOutOfBound):
4111         (testInBound):
4112         (testSlowPutOutOfBound):
4113         (testSlowPutInBound):
4114
4115 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
4116
4117         Unreviewed, fix commented out tests
4118         https://bugs.webkit.org/show_bug.cgi?id=172225
4119
4120         * stress/get-by-val-string.js:
4121         (object.43):
4122         (Hello):
4123         (Hello.prototype.get 42):
4124         (Hello.prototype.43):
4125         (Derived):
4126         (shouldBe):
4127         (throw.new.Error): Deleted.
4128
4129 2017-05-21  Saam Barati  <sbarati@apple.com>
4130
4131         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
4132         https://bugs.webkit.org/show_bug.cgi?id=171041
4133         <rdar://problem/32082516>
4134
4135         Reviewed by Yusuke Suzuki.
4136
4137         * stress/lexical-scoping-for-loop.js: Added.
4138         (assert):
4139         (test1):
4140         (test2):
4141         (test3):
4142         (test4):
4143         (test5):
4144         (test6):
4145         (let.test7):
4146         (let.test8):
4147         (let.test9):
4148         (let.test10):
4149         (let.test11):
4150         (let.test12):
4151
4152 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
4153
4154         [JSC] Make get_by_val & string "499" to number 499
4155         https://bugs.webkit.org/show_bug.cgi?id=172225
4156
4157         Reviewed by Saam Barati.
4158
4159         * stress/get-by-val-string.js: Added.
4160         (shouldBe):
4161         (shouldThrow):
4162         (object.43):
4163         (Hello):
4164         (Hello.prototype.get 42):
4165         (Hello.prototype.43):
4166         (Derived):
4167
4168 2017-05-19  Mark Lam  <mark.lam@apple.com>
4169
4170         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
4171         https://bugs.webkit.org/show_bug.cgi?id=172383
4172         <rdar://problem/31418651>
4173
4174         Reviewed by Filip Pizlo.
4175
4176         * stress/regress-172383.js: Added.
4177
4178 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
4179
4180         Unreviewed, rolling out r217156.
4181
4182         This change broke the iOS build.
4183
4184         Reverted changeset:
4185
4186         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
4187         result registers."
4188         https://bugs.webkit.org/show_bug.cgi?id=172383
4189         http://trac.webkit.org/changeset/217156
4190
4191 2017-05-19  Mark Lam  <mark.lam@apple.com>
4192
4193         Add missing exception check.
4194         https://bugs.webkit.org/show_bug.cgi?id=172346
4195         <rdar://problem/32289640>
4196
4197         Reviewed by Geoffrey Garen.
4198
4199         * stress/regress-172346.js: Added.
4200
4201 2017-05-19  Mark Lam  <mark.lam@apple.com>
4202
4203         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
4204         https://bugs.webkit.org/show_bug.cgi?id=172383
4205         <rdar://problem/31418651>
4206
4207         Reviewed by Filip Pizlo.
4208
4209         * stress/regress-172383.js: Added.
4210
4211 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
4212
4213         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
4214         https://bugs.webkit.org/show_bug.cgi?id=172369
4215
4216         Reviewed by Mark Lam.
4217
4218         * stress/undecided-concat.js: Added.
4219
4220 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
4221
4222         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
4223         https://bugs.webkit.org/show_bug.cgi?id=172098
4224
4225         Reviewed by Saam Barati.
4226
4227         * stress/check-sub-class.js: Added.
4228         (shouldBe):
4229         (shouldThrow):
4230         (calling):
4231         (array.forEach):
4232         (i.array.forEach):
4233
4234 2017-05-18  JF Bastien  <jfbastien@apple.com>
4235
4236         WebAssembly: exports is a getter
4237         https://bugs.webkit.org/show_bug.cgi?id=172129
4238
4239         Reviewed by Saam Barati.
4240
4241         Update test to reflect new semantics.
4242
4243         * wasm/js-api/test_basic_api.js:
4244         (const.c.in.constructorProperties.switch):
4245
4246 2017-05-18  Saam Barati  <sbarati@apple.com>
4247
4248         Proxy's [[Get]] passes incorrect receiver
4249         https://bugs.webkit.org/show_bug.cgi?id=164849
4250         <rdar://problem/31767058>
4251
4252         Reviewed by Yusuke Suzuki.
4253
4254         * stress/proxy-get-set-correct-receiver.js: Added.
4255         (assert):
4256         (test):
4257         (test.let.target.set prop):
4258         (test.let.target.get prop):
4259         (test.get let):
4260         * stress/proxy-set.js:
4261         (let.target.get x):
4262         * stress/reflect-set-proxy-set.js:
4263         (let.target.get x):
4264         * stress/reflect-set-receiver-proxy-set.js:
4265         (let.target.get x):
4266
4267 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
4268
4269         Constructor calls set this too early
4270         https://bugs.webkit.org/show_bug.cgi?id=172302
4271
4272         Reviewed by Saam Barati.
4273
4274         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
4275         wrong.
4276
4277         * stress/construct-overwritten-variable.js: Added.
4278         (new.x.x):
4279         * stress/construct-spread-overwritten-variable-2.js: Added.
4280         (new.x.x):
4281         * stress/construct-spread-overwritten-variable.js: Added.
4282         (new.x.x):
4283
4284 2017-05-18  Saam Barati  <sbarati@apple.com>
4285
4286         WebAssembly: perform stack checks
4287         https://bugs.webkit.org/show_bug.cgi?id=165546
4288         <rdar://problem/29760307>
4289
4290         Reviewed by Filip Pizlo.
4291
4292         * wasm.yaml:
4293         * wasm/function-tests/factorial.js:
4294         * wasm/function-tests/float-sub.js:
4295         * wasm/function-tests/stack-overflow.js: Added.
4296         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
4297         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
4298         (assertOverflows.makeInstance):
4299         (assertOverflows.makeInstance2):
4300         (assertOverflows.assertThrows):
4301         (assertOverflows):
4302         (assertThrows.test.makeSignature):
4303         (assertThrows.test.makeInstance):
4304         (assertThrows.test):
4305         (assertThrows):
4306
4307 2017-05-18  Keith Miller  <keith_miller@apple.com>
4308
4309         WebAssembly API: test with neutered inputs
4310         https://bugs.webkit.org/show_bug.cgi?id=163899
4311
4312         Reviewed by JF Bastien.
4313
4314         * wasm/js-api/neutered-inputs.js: Added.
4315         (const.testFunction):
4316         (const.testConstructor):
4317         * wasm/js-api/test_basic_api.js:
4318         (const.c.in.constructorProperties.switch):
4319
4320 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
4321
4322         DFG inlining should be hardened for the no-result case
4323         https://bugs.webkit.org/show_bug.cgi?id=172290
4324
4325         Reviewed by Saam Barati.
4326
4327         * stress/array-constructor-no-result.js: Added.
4328         (foo):
4329         * stress/pow-no-result.js: Added.
4330         (foo):
4331
4332 2017-05-18  Commit Queue  <commit-queue@webkit.org>
4333
4334         Unreviewed, rolling out r217031, r217032, and r217037.
4335         https://bugs.webkit.org/show_bug.cgi?id=172293
4336
4337         cause linking errors in Windows (Requested by yusukesuzuki on
4338         #webkit).
4339
4340         Reverted changesets:
4341
4342         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
4343         https://bugs.webkit.org/show_bug.cgi?id=172098
4344         http://trac.webkit.org/changeset/217031
4345
4346         "Unreviewed, rebaseline for newly added ClassInfo"
4347         https://bugs.webkit.org/show_bug.cgi?id=172098
4348         http://trac.webkit.org/changeset/217032
4349
4350         "Unreviewed, fix debug and non-JIT build"
4351         https://bugs.webkit.org/show_bug.cgi?id=172098
4352         http://trac.webkit.org/changeset/217037
4353
4354 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4355
4356         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
4357         https://bugs.webkit.org/show_bug.cgi?id=172098
4358
4359         Reviewed by Saam Barati.
4360
4361         * stress/check-sub-class.js: Added.
4362         (shouldBe):
4363         (shouldThrow):
4364         (calling):
4365         (array.forEach):
4366         (i.array.forEach):
4367
4368 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
4369
4370         Unreviewed, address mlam's review feedback.
4371
4372         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
4373
4374 2017-05-17  Saam Barati  <sbarati@apple.com>
4375
4376         We don't do context switches for Wasm->Wasm call indirect
4377         https://bugs.webkit.org/show_bug.cgi?id=172188
4378         <rdar://problem/32231828>
4379
4380         Reviewed by Keith Miller.
4381
4382         * wasm/function-tests/context-switch.js: Added.
4383         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
4384         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
4385         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
4386         (makeInstance):
4387         (makeInstance2):
4388         (assert.eq.makeInstance):
4389         (assert.eq.makeInstance2):
4390         (assert.eq):
4391
4392 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
4393
4394         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
4395         https://bugs.webkit.org/show_bug.cgi?id=172208
4396
4397         Reviewed by Saam Barati.
4398
4399         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
4400         (foo):
4401         (bar):
4402         (baz):
4403
4404 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4405
4406         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
4407         https://bugs.webkit.org/show_bug.cgi?id=172115
4408
4409         Reviewed by Saam Barati.
4410
4411         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
4412         (shouldBe):
4413         (unknown):
4414         (readWord1):
4415         (readWord2):
4416         (readWord3):
4417         (readWord4):
4418
4419 2017-05-16  JF Bastien  <jfbastien@apple.com>
4420
4421         WebAssembly: add memory fuzzer
4422         https://bugs.webkit.org/show_bug.cgi?id=169976
4423         <rdar://problem/31965328>
4424
4425         Reviewed by Keith Miller.
4426
4427         * wasm/fuzz/memory.js: Added.
4428         (const.insert):
4429         (const.action.string_appeared_here):
4430         (const.performAction):
4431