9edda199ac953f1f30ce061472b33a5ec2016cfd
[WebKit-https.git] / JSTests / ChangeLog
1 2017-11-01  Michael Saboff  <msaboff@apple.com>
2
3         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
4         https://bugs.webkit.org/show_bug.cgi?id=179140
5
6         Reviewed by Saam Barati.
7
8         New regression test.
9
10         * stress/regress-179140.js: Added.
11         (testWithoutFTL):
12         (testWithFTL):
13
14 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
15
16         [JSC] Introduce @toObject
17         https://bugs.webkit.org/show_bug.cgi?id=178726
18
19         Reviewed by Saam Barati.
20
21         * stress/array-copywithin.js:
22         (shouldThrow):
23         * stress/object-constructor-boolean-edge.js: Added.
24         (shouldBe):
25         (test):
26         * stress/object-constructor-global.js: Added.
27         (shouldBe):
28         * stress/object-constructor-null-edge.js: Added.
29         (shouldBe):
30         (test):
31         * stress/object-constructor-number-edge.js: Added.
32         (shouldBe):
33         (test):
34         * stress/object-constructor-object-edge.js: Added.
35         (shouldBe):
36         (test):
37         (i.arg):
38         * stress/object-constructor-string-edge.js: Added.
39         (shouldBe):
40         (test):
41         * stress/object-constructor-symbol-edge.js: Added.
42         (shouldBe):
43         (test):
44         * stress/object-constructor-undefined-edge.js: Added.
45         (shouldBe):
46         (test):
47         * stress/symbol-array-from.js: Added.
48         (shouldBe):
49         * stress/to-object-intrinsic-boolean-edge.js: Added.
50         (shouldBe):
51         (builtin.createBuiltin):
52         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
53         (shouldThrow):
54         * stress/to-object-intrinsic-number-edge.js: Added.
55         (shouldBe):
56         (builtin.createBuiltin):
57         * stress/to-object-intrinsic-object-edge.js: Added.
58         (shouldBe):
59         (builtin.createBuiltin):
60         (i.arg):
61         * stress/to-object-intrinsic-string-edge.js: Added.
62         (shouldBe):
63         (builtin.createBuiltin):
64         * stress/to-object-intrinsic-symbol-edge.js: Added.
65         (shouldBe):
66         (builtin.createBuiltin):
67         * stress/to-object-intrinsic.js: Added.
68         (shouldBe):
69         (shouldThrow):
70         (builtin.createBuiltin):
71
72 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
73
74         [DFG][FTL] Introduce StringSlice
75         https://bugs.webkit.org/show_bug.cgi?id=178934
76
77         Reviewed by Saam Barati.
78
79         * microbenchmarks/string-slice-empty.js: Added.
80         (slice):
81         * microbenchmarks/string-slice-one-char.js: Added.
82         (slice):
83         * microbenchmarks/string-slice.js: Added.
84         (slice):
85
86 2017-10-26  Michael Saboff  <msaboff@apple.com>
87
88         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
89         https://bugs.webkit.org/show_bug.cgi?id=178890
90
91         Reviewed by Keith Miller.
92
93         New regression test.
94
95         * stress/regress-178890.js: Added.
96
97 2017-10-26  Mark Lam  <mark.lam@apple.com>
98
99         JSRopeString::RopeBuilder::append() should check for overflows.
100         https://bugs.webkit.org/show_bug.cgi?id=178385
101         <rdar://problem/35027468>
102
103         Reviewed by Saam Barati.
104
105         * stress/regress-178385.js: Added.
106
107 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
108
109         Unreviewed, rolling out r223961.
110
111         The change that required this has been rolled out.
112
113         Reverted changeset:
114
115         "Mark test262.yaml/test262/test/language/statements/try/tco-
116         catch.js as passing."
117         https://bugs.webkit.org/show_bug.cgi?id=178592
118         https://trac.webkit.org/changeset/223961
119
120 2017-10-25  Commit Queue  <commit-queue@webkit.org>
121
122         Unreviewed, rolling out r223691 and r223729.
123         https://bugs.webkit.org/show_bug.cgi?id=178834
124
125         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
126         by rniwa on #webkit).
127
128         Reverted changesets:
129
130         "Turn recursive tail calls into loops"
131         https://bugs.webkit.org/show_bug.cgi?id=176601
132         https://trac.webkit.org/changeset/223691
133
134         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
135         comparison is always false due to limited range of data type
136         [-Wtype-limits]"
137         https://bugs.webkit.org/show_bug.cgi?id=178543
138         https://trac.webkit.org/changeset/223729
139
140 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
141
142         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
143         https://bugs.webkit.org/show_bug.cgi?id=178592
144
145         Unreviewed test gardening.
146
147         * test262.yaml:
148
149 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
150
151         [FTL] Support NewStringObject
152         https://bugs.webkit.org/show_bug.cgi?id=178737
153
154         Reviewed by Saam Barati.
155
156         * stress/new-string-object.js: Added.
157         (shouldBe):
158         (test):
159
160 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
161
162         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
163         https://bugs.webkit.org/show_bug.cgi?id=178308
164
165         Reviewed by Mark Lam.
166
167         * test262.yaml:
168
169 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
170
171         [JSC] Use fastJoin in Array#toString
172         https://bugs.webkit.org/show_bug.cgi?id=178062
173
174         Reviewed by Darin Adler.
175
176         * microbenchmarks/contiguous-array-to-string.js: Added.
177         (target):
178         * microbenchmarks/double-array-to-string.js: Added.
179         (target):
180         * microbenchmarks/int32-array-to-string.js: Added.
181         (target):
182
183 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
184
185         stress/check-string-ident.js is improperly skipped
186         https://bugs.webkit.org/show_bug.cgi?id=178642
187
188         Reviewed by Saam Barati.
189
190         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
191         since it enforces the run-jsc-stress-tests script to still set up the
192         test to run, despite the skip directive that's used before.
193
194 2017-10-20  Mark Lam  <mark.lam@apple.com>
195
196         Add a test case for r214334.
197         https://bugs.webkit.org/show_bug.cgi?id=169941
198         <rdar://problem/31221258>
199
200         Reviewed by JF Bastien.
201
202         * stress/regress-169941.js: Added.
203
204 2017-10-19  JF Bastien  <jfbastien@apple.com>
205
206         WebAssembly: no VM / JS version of everything but Instance
207         https://bugs.webkit.org/show_bug.cgi?id=177473
208
209         Reviewed by Filip Pizlo, Saam Barati.
210
211         - Exceeding max on memory growth now returns a range error as per
212         spec. This is a (very minor) breaking change: it used to throw OOM
213         error. Update the corresponding test.
214
215         * wasm/js-api/memory-grow.js:
216         (assertEq):
217         * wasm/js-api/table.js:
218         (assert.throws):
219
220 2017-10-19  Mark Lam  <mark.lam@apple.com>
221
222         Stringifier::appendStringifiedValue() is missing an exception check.
223         https://bugs.webkit.org/show_bug.cgi?id=178386
224         <rdar://problem/35027610>
225
226         Reviewed by Saam Barati.
227
228         * stress/regress-178386.js: Added.
229
230 2017-10-19  Michael Saboff  <msaboff@apple.com>
231
232         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
233         https://bugs.webkit.org/show_bug.cgi?id=178521
234
235         Reviewed by JF Bastien.
236
237         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
238         now passes with the current version (5.0) of the Emoji spec.
239
240 2017-10-19  Robin Morisset  <rmorisset@apple.com>
241
242         Turn recursive tail calls into loops
243         https://bugs.webkit.org/show_bug.cgi?id=176601
244
245         Reviewed by Saam Barati.
246
247         Add some simple test that computes factorial in several ways, and other trivial computations.
248         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
249         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
250         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
251         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
252
253         * stress/inline-call-to-recursive-tail-call.js: Added.
254         (factorial.aux):
255         (factorial):
256         (factorial2.aux):
257         (factorial2.id):
258         (factorial2):
259         (factorial3.aux):
260         (factorial3):
261         (aux):
262         (factorial4):
263         (test):
264
265 2017-10-18  Mark Lam  <mark.lam@apple.com>
266
267         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
268         https://bugs.webkit.org/show_bug.cgi?id=177600
269         <rdar://problem/34710985>
270
271         Reviewed by Saam Barati.
272
273         * stress/regress-177600.js: Added.
274
275 2017-10-18  Mark Lam  <mark.lam@apple.com>
276
277         The compiler should always register a structure when it adds its transitionWatchPointSet.
278         https://bugs.webkit.org/show_bug.cgi?id=178420
279         <rdar://problem/34814024>
280
281         Reviewed by Saam Barati and Filip Pizlo.
282
283         * stress/regress-178420.js: Added.
284         (new.Array.10000.map):
285
286 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
287
288         [JSC] __proto__ getter should be fast
289         https://bugs.webkit.org/show_bug.cgi?id=178067
290
291         Reviewed by Saam Barati.
292
293         * stress/dfg-object-proto-accessor.js: Added.
294         (shouldBe):
295         (shouldThrow):
296         (target):
297         * stress/dfg-object-proto-getter.js: Added.
298         (shouldBe):
299         (shouldThrow):
300         (target):
301         * stress/dfg-object-prototype-of.js: Added.
302         (shouldBe):
303         (shouldThrow):
304         (target):
305         * stress/dfg-reflect-get-prototype-of.js: Added.
306         (shouldBe):
307         (shouldThrow):
308         (target):
309         * stress/intrinsic-getter-with-poly-proto.js: Added.
310         (shouldBe):
311         (makePolyProtoObject.foo.C):
312         (makePolyProtoObject.foo):
313         (makePolyProtoObject):
314         (target):
315         * stress/object-get-prototype-of-filtered.js: Added.
316         (shouldBe):
317         (shouldThrow):
318         (target):
319         (i.Cocoa):
320         * stress/object-get-prototype-of-mono-proto.js: Added.
321         (shouldBe):
322         (makePolyProtoObject.foo.C):
323         (makePolyProtoObject.foo):
324         (makePolyProtoObject):
325         (target):
326         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
327         (shouldBe):
328         (makePolyProtoObject.foo.C):
329         (makePolyProtoObject.foo):
330         (makePolyProtoObject):
331         (target):
332         * stress/object-get-prototype-of-poly-proto.js: Added.
333         (shouldBe):
334         (makePolyProtoObject.foo.C):
335         (makePolyProtoObject.foo):
336         (makePolyProtoObject):
337         (target):
338         * stress/object-proto-getter-filtered.js: Added.
339         (shouldBe):
340         (shouldThrow):
341         (target):
342         (i.Cocoa):
343         * stress/object-proto-getter-poly-mono-proto.js: Added.
344         (shouldBe):
345         (makePolyProtoObject.foo.C):
346         (makePolyProtoObject.foo):
347         (makePolyProtoObject):
348         (target):
349         * stress/object-proto-getter-poly-proto.js: Added.
350         (shouldBe):
351         (makePolyProtoObject.foo.C):
352         (makePolyProtoObject.foo):
353         (makePolyProtoObject):
354         (target):
355         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
356         * stress/string-proto.js: Added.
357         (shouldBe):
358         (target):
359
360 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
361
362         Unreviewed, rolling out r223523.
363
364         A test for this change is failing on debug JSC bots.
365
366         Reverted changeset:
367
368         "[JSC] __proto__ getter should be fast"
369         https://bugs.webkit.org/show_bug.cgi?id=178067
370         https://trac.webkit.org/changeset/223523
371
372 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
373
374         [JSC] __proto__ getter should be fast
375         https://bugs.webkit.org/show_bug.cgi?id=178067
376
377         Reviewed by Saam Barati.
378
379         * stress/dfg-object-proto-accessor.js: Added.
380         (shouldBe):
381         (shouldThrow):
382         (target):
383         * stress/dfg-object-proto-getter.js: Added.
384         (shouldBe):
385         (shouldThrow):
386         (target):
387         * stress/dfg-object-prototype-of.js: Added.
388         (shouldBe):
389         (shouldThrow):
390         (target):
391         * stress/dfg-reflect-get-prototype-of.js: Added.
392         (shouldBe):
393         (shouldThrow):
394         (target):
395         * stress/object-get-prototype-of-filtered.js: Added.
396         (shouldBe):
397         (shouldThrow):
398         (target):
399         (i.Cocoa):
400         * stress/object-get-prototype-of-mono-proto.js: Added.
401         (shouldBe):
402         (makePolyProtoObject.foo.C):
403         (makePolyProtoObject.foo):
404         (makePolyProtoObject):
405         (target):
406         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
407         (shouldBe):
408         (makePolyProtoObject.foo.C):
409         (makePolyProtoObject.foo):
410         (makePolyProtoObject):
411         (target):
412         * stress/object-get-prototype-of-poly-proto.js: Added.
413         (shouldBe):
414         (makePolyProtoObject.foo.C):
415         (makePolyProtoObject.foo):
416         (makePolyProtoObject):
417         (target):
418         * stress/object-proto-getter-filtered.js: Added.
419         (shouldBe):
420         (shouldThrow):
421         (target):
422         (i.Cocoa):
423         * stress/object-proto-getter-poly-mono-proto.js: Added.
424         (shouldBe):
425         (makePolyProtoObject.foo.C):
426         (makePolyProtoObject.foo):
427         (makePolyProtoObject):
428         (target):
429         * stress/object-proto-getter-poly-proto.js: Added.
430         (shouldBe):
431         (makePolyProtoObject.foo.C):
432         (makePolyProtoObject.foo):
433         (makePolyProtoObject):
434         (target):
435         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
436         * stress/string-proto.js: Added.
437         (shouldBe):
438         (target):
439
440 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
441
442         Reland "Add Above/Below comparisons for UInt32 patterns"
443         https://bugs.webkit.org/show_bug.cgi?id=177281
444
445         Reviewed by Saam Barati.
446
447         * stress/uint32-comparison-jump.js: Added.
448         (shouldBe):
449         (above):
450         (aboveOrEqual):
451         (below):
452         (belowOrEqual):
453         (notAbove):
454         (notAboveOrEqual):
455         (notBelow):
456         (notBelowOrEqual):
457         * stress/uint32-comparison.js: Added.
458         (shouldBe):
459         (above):
460         (aboveOrEqual):
461         (below):
462         (belowOrEqual):
463         (aboveTest):
464         (aboveOrEqualTest):
465         (belowTest):
466         (belowOrEqualTest):
467
468 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
469
470         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
471         https://bugs.webkit.org/show_bug.cgi?id=178210
472
473         Reviewed by Saam Barati.
474
475         * wasm/function-tests/trap-from-start-async.js:
476         (async.StartTrapsAsync):
477         * wasm/function-tests/trap-from-start.js:
478         (StartTraps):
479         * wasm/js-api/web-assembly-function.js:
480         (assert.eq.Object.getPrototypeOf):
481         * wasm/js-api/wrapper-function.js:
482         (return.new.WebAssembly.Module):
483         (assert.throws.makeInstance): Deleted.
484         (assert.throws.Bar): Deleted.
485         (assert.throws): Deleted.
486
487 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
488
489         Enable gigacage on iOS
490         https://bugs.webkit.org/show_bug.cgi?id=177586
491
492         Reviewed by JF Bastien.
493         
494         Add tests for when Gigacage gets runtime disabled.
495
496         * stress/disable-gigacage-arrays.js: Added.
497         (foo):
498         * stress/disable-gigacage-strings.js: Added.
499         (foo):
500         * stress/disable-gigacage-typed-arrays.js: Added.
501         (foo):
502
503 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
504
505         import.meta should not be assignable
506         https://bugs.webkit.org/show_bug.cgi?id=178202
507
508         Reviewed by Saam Barati.
509
510         * modules/import-meta-assignment.js: Added.
511         (shouldThrow):
512         (SyntaxError.import.meta.can.shouldThrow):
513
514 2017-10-11  Saam Barati  <sbarati@apple.com>
515
516         Unreviewed. Actually skip certain type profiler tests in debug.
517
518         * typeProfiler.yaml:
519         * typeProfiler/deltablue-for-of.js:
520         * typeProfiler/getter-richards.js:
521
522 2017-10-11  Commit Queue  <commit-queue@webkit.org>
523
524         Unreviewed, rolling out r223113 and r223121.
525         https://bugs.webkit.org/show_bug.cgi?id=178182
526
527         Reintroduced 20% regression on Kraken (Requested by rniwa on
528         #webkit).
529
530         Reverted changesets:
531
532         "Enable gigacage on iOS"
533         https://bugs.webkit.org/show_bug.cgi?id=177586
534         https://trac.webkit.org/changeset/223113
535
536         "Use one virtual allocation for all gigacages and their
537         runways"
538         https://bugs.webkit.org/show_bug.cgi?id=178050
539         https://trac.webkit.org/changeset/223121
540
541 2017-10-11  Michael Saboff  <msaboff@apple.com>
542
543         Disable test262 named capture group tests with direct unicode names and with references before definitions
544         https://bugs.webkit.org/show_bug.cgi?id=178177
545
546         Reviewed by Keith Miller.
547
548         Bugs to track fixing these test are:
549         https://bugs.webkit.org/show_bug.cgi?id=178174 -
550             "Add support in named capture group identifiers for direct surrogate pairs"
551         https://bugs.webkit.org/show_bug.cgi?id=178175 -
552             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
553
554         * test262.yaml:
555
556 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
557
558         Object properties are undefined in super.call() but not in this.call()
559         https://bugs.webkit.org/show_bug.cgi?id=177230
560
561         Reviewed by Saam Barati.
562
563         * stress/super-call-function-subclass.js: Added.
564         (assert):
565         (A.prototype.t):
566         (A):
567         * stress/super-dot-call-and-apply.js: Added.
568         (assert):
569         (A):
570         (A.prototype.call):
571         (A.prototype.apply):
572         (B.prototype.testSuper):
573         (B):
574         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
575         (D.prototype.testSuper):
576         (D):
577
578 2017-10-10  Saam Barati  <sbarati@apple.com>
579
580         The prototype cache should be aware of the Executable it generates a Structure for
581         https://bugs.webkit.org/show_bug.cgi?id=177907
582
583         Reviewed by Filip Pizlo.
584
585         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
586         (assert):
587         (foo.C):
588         (foo):
589         (bar.C):
590         (bar):
591         (access):
592         (makeLongChain):
593         (accessY):
594
595 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
596
597         `async` should be able to be used as an imported binding name
598         https://bugs.webkit.org/show_bug.cgi?id=176573
599
600         Reviewed by Saam Barati.
601
602         * modules/import-default-async.js: Added.
603         * modules/import-named-async-as.js: Added.
604         * modules/import-named-async.js: Added.
605         * modules/import-named-async/target.js: Added.
606         * modules/import-namespace-async.js: Added.
607         * test262.yaml:
608
609 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
610
611         Enable gigacage on iOS
612         https://bugs.webkit.org/show_bug.cgi?id=177586
613
614         Reviewed by JF Bastien.
615         
616         Add tests for when Gigacage gets runtime disabled.
617
618         * stress/disable-gigacage-arrays.js: Added.
619         (foo):
620         * stress/disable-gigacage-strings.js: Added.
621         (foo):
622         * stress/disable-gigacage-typed-arrays.js: Added.
623         (foo):
624
625 2017-10-09  Michael Saboff  <msaboff@apple.com>
626
627         Implement RegExp Unicode property escapes
628         https://bugs.webkit.org/show_bug.cgi?id=172069
629
630         Reviewed by JF Bastien.
631
632         Enabled Unicode Property tests.
633
634         * test262.yaml:
635
636 2017-10-09  Commit Queue  <commit-queue@webkit.org>
637
638         Unreviewed, rolling out r223015 and r223025.
639         https://bugs.webkit.org/show_bug.cgi?id=178093
640
641         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
642         #webkit).
643
644         Reverted changesets:
645
646         "Enable gigacage on iOS"
647         https://bugs.webkit.org/show_bug.cgi?id=177586
648         http://trac.webkit.org/changeset/223015
649
650         "Unreviewed, disable Gigacage on ARM64 Linux"
651         https://bugs.webkit.org/show_bug.cgi?id=177586
652         http://trac.webkit.org/changeset/223025
653
654 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
655
656         Update expectations for test262 tests that pass after r223043.
657         https://bugs.webkit.org/show_bug.cgi?id=176685
658
659         Unreviewed test gardening.
660
661         * test262.yaml:
662
663 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
664
665         Unreviewed, rolling out r223022.
666
667         This change introduced 18 test262 failures.
668
669         Reverted changeset:
670
671         "`async` should be able to be used as an imported binding
672         name"
673         https://bugs.webkit.org/show_bug.cgi?id=176573
674         http://trac.webkit.org/changeset/223022
675
676 2017-10-09  Saam Barati  <sbarati@apple.com>
677
678         3 poly-proto JSC tests timing out on debug after r222827
679         https://bugs.webkit.org/show_bug.cgi?id=177880
680         <rdar://problem/34817122>
681
682         Unreviewed.
683
684         I'm skipping these type profiler tests on debug since they are long running.
685
686         * typeProfiler/deltablue-for-of.js:
687         * typeProfiler/getter-richards.js:
688
689 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
690
691         Safari 10 /11 problem with if (!await get(something)).
692         https://bugs.webkit.org/show_bug.cgi?id=176685
693
694         Reviewed by Saam Barati.
695
696         * stress/async-await-basic.js:
697         (awaitEpression.async):
698         * stress/async-await-syntax.js:
699         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
700         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
701
702 2017-10-08  Saam Barati  <sbarati@apple.com>
703
704         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
705
706         * typeProfiler/deltablue-for-of.js:
707         * typeProfiler/getter-richards.js:
708
709 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
710
711         `async` should be able to be used as an imported binding name
712         https://bugs.webkit.org/show_bug.cgi?id=176573
713
714         Reviewed by Darin Adler.
715
716         * modules/import-default-async.js: Added.
717         * modules/import-named-async-as.js: Added.
718         * modules/import-named-async.js: Added.
719         * modules/import-named-async/target.js: Added.
720         * modules/import-namespace-async.js: Added.
721
722 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
723
724         Enable gigacage on iOS
725         https://bugs.webkit.org/show_bug.cgi?id=177586
726
727         Reviewed by JF Bastien.
728         
729         Add tests for when Gigacage gets runtime disabled.
730
731         * stress/disable-gigacage-arrays.js: Added.
732         (foo):
733         * stress/disable-gigacage-strings.js: Added.
734         (foo):
735         * stress/disable-gigacage-typed-arrays.js: Added.
736         (foo):
737
738 2017-10-06  Commit Queue  <commit-queue@webkit.org>
739
740         Unreviewed, rolling out r222791 and r222873.
741         https://bugs.webkit.org/show_bug.cgi?id=178031
742
743         Caused crashes with workers/wasm LayoutTests (Requested by
744         ryanhaddad on #webkit).
745
746         Reverted changesets:
747
748         "WebAssembly: no VM / JS version of everything but Instance"
749         https://bugs.webkit.org/show_bug.cgi?id=177473
750         http://trac.webkit.org/changeset/222791
751
752         "WebAssembly: address no VM / JS follow-ups"
753         https://bugs.webkit.org/show_bug.cgi?id=177887
754         http://trac.webkit.org/changeset/222873
755
756 2017-10-05  Saam Barati  <sbarati@apple.com>
757
758         Make sure all prototypes under poly proto get added into the VM's prototype map
759         https://bugs.webkit.org/show_bug.cgi?id=177909
760
761         Reviewed by Keith Miller.
762
763         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
764         (assert):
765         (foo.C):
766         (foo):
767         (set x):
768
769 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
770
771         [JSC] Introduce import.meta
772         https://bugs.webkit.org/show_bug.cgi?id=177703
773
774         Reviewed by Filip Pizlo.
775
776         * modules/import-meta-syntax.js: Added.
777         (shouldThrow):
778         (shouldNotThrow):
779         * modules/import-meta.js: Added.
780         * modules/import-meta/cocoa.js: Added.
781         * modules/resources/assert.js:
782         (export.shouldNotThrow):
783         * stress/import-syntax.js:
784
785 2017-10-04  Saam Barati  <sbarati@apple.com>
786
787         Make pertinent AccessCases watch the poly proto watchpoint
788         https://bugs.webkit.org/show_bug.cgi?id=177765
789
790         Reviewed by Keith Miller.
791
792         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
793         (assert):
794         (foo.C):
795         (foo):
796         (validate):
797         * stress/poly-proto-clear-stub.js: Added.
798         (assert):
799         (foo.C):
800         (foo):
801
802 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
803
804         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
805
806         Unreviewed test gardening.
807
808         * test262.yaml:
809
810 2017-10-04  Saam Barati  <sbarati@apple.com>
811
812         3 poly-proto JSC tests timing out on debug after r222827
813         https://bugs.webkit.org/show_bug.cgi?id=177880
814
815         Rubber stamped by Mark Lam.
816
817         * microbenchmarks/poly-proto-access.js:
818         * typeProfiler/deltablue-for-of.js:
819         * typeProfiler/getter-richards.js:
820
821 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
822
823         Unreviewed, marking tco-catch.js as a failure after test262 update
824         https://bugs.webkit.org/show_bug.cgi?id=177859
825
826         * test262.yaml:
827
828 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
829
830         Unreviewed, marking one async iterator test262 test failed
831         https://bugs.webkit.org/show_bug.cgi?id=177859
832
833         * test262.yaml:
834
835 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
836
837         [Test262] Update Test262 to Oct 4 version
838         https://bugs.webkit.org/show_bug.cgi?id=177859
839
840         Reviewed by Sam Weinig.
841
842         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
843         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
844
845         * test262.yaml:
846         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
847         (checkSequence):
848         * test262/harness/typeCoercion.js:
849         (testCoercibleToIndexZero):
850         (testCoercibleToIndexOne):
851         (testCoercibleToIndexFromIndex):
852         (testNotCoercibleToIndex.testPrimitiveValue):
853         (testNotCoercibleToInteger):
854         (testCoercibleToBigIntZero.testPrimitiveValue):
855         (testCoercibleToBigIntZero):
856         (testCoercibleToBigIntOne.testPrimitiveValue):
857         (testCoercibleToBigIntOne):
858         (testPrimitiveValue):
859         (testCoercibleToBigIntFromBigInt):
860         (testNotCoercibleToBigInt.testPrimitiveValue):
861         (testNotCoercibleToBigInt.testStringValue):
862         (testNotCoercibleToBigInt):
863         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
864         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
865         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
866         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
867         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
868         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
869         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
870         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
871         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
872         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
873         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
874         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
875         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
876         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
877         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
878         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
879         (testCoercibleToBigIntZero):
880         (testCoercibleToBigIntOne):
881         (testNotCoercibleToBigInt):
882         (MyError): Deleted.
883         (valueOf): Deleted.
884         (toString): Deleted.
885         (Symbol.toPrimitive): Deleted.
886         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
887         (testCoercibleToIndexZero):
888         (testCoercibleToIndexOne):
889         (testNotCoercibleToIndex):
890         (MyError): Deleted.
891         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
892         (assert.sameValue.BigInt.asIntN.toString): Deleted.
893         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
894         (BigInt.asIntN.valueOf): Deleted.
895         (BigInt.asIntN.toString): Deleted.
896         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
897         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
898         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
899         (testCoercibleToBigIntZero):
900         (testCoercibleToBigIntOne):
901         (testNotCoercibleToBigInt):
902         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
903         (testCoercibleToIndexZero):
904         (testCoercibleToIndexOne):
905         (testNotCoercibleToIndex):
906         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
907         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
908         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
909         (bits.valueOf):
910         (bigint.valueOf):
911         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
912         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
913         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
914         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
915         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
916         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
917         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
918         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
919         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
920         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
921         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
922         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
923         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
924         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
925         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
926         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
927         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
928         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
929         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
930         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
931         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
932         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
933         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
934         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
935         (replacer):
936         (BigInt.prototype.toJSON):
937         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
938         (replacer):
939         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
940         (BigInt.prototype.toJSON):
941         * test262/test/built-ins/JSON/stringify/bigint.js:
942         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
943         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
944         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
945         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
946         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
947         * test262/test/built-ins/Object/proto-from-ctor.js:
948         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
949         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
950         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
951         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
952         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
953         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
954         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
955         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
956         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
957         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
958         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
959         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
960         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
961         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
962         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
963         * test262/test/built-ins/Proxy/get-fn-realm.js:
964         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
965         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
966         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
967         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
968         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
969         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
970         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
971         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
972         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
973         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
974         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
975         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
976         (i6.replace):
977         (i6b.replace):
978         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
979         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
980         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
981         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
982         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
983         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
984         * test262/test/built-ins/RegExp/u180e.js: Added.
985         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
986         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
987         * test262/test/built-ins/String/proto-from-ctor-realm.js:
988         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
989         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
990         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
991         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
992         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
993         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
994         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
995         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
996         * test262/test/built-ins/String/prototype/endsWith/length.js:
997         * test262/test/built-ins/String/prototype/endsWith/name.js:
998         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
999         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1000         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1001         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1002         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1003         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1004         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1005         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1006         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1007         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1008         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1009         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1010         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1011         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1012         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1013         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1014         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1015         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1016         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1017         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1018         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1019         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1020         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1021         * test262/test/built-ins/String/prototype/includes/includes.js:
1022         * test262/test/built-ins/String/prototype/includes/length.js:
1023         * test262/test/built-ins/String/prototype/includes/name.js:
1024         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1025         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1026         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1027         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1028         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1029         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1030         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1031         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1032         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1033         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1034         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1035         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1036         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1037         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1038         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1039         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1040         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1041         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1042         * test262/test/built-ins/String/prototype/trim/u180e.js:
1043         * test262/test/built-ins/Symbol/for/cross-realm.js:
1044         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1045         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1046         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1047         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1048         * test262/test/built-ins/Symbol/match/cross-realm.js:
1049         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1050         * test262/test/built-ins/Symbol/search/cross-realm.js:
1051         * test262/test/built-ins/Symbol/species/cross-realm.js:
1052         * test262/test/built-ins/Symbol/split/cross-realm.js:
1053         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1054         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1055         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1056         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1057         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1058         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1059         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1060         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1061         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1062         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1063         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1064         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1065         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1066         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1067         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1068         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1069         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1070         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1071         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1072         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1073         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1074         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1075         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1076         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1077         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1078         * test262/test/language/eval-code/indirect/realm.js:
1079         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1080         (o.get z):
1081         (o.get a):
1082         * test262/test/language/expressions/call/eval-realm-indirect.js:
1083         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1084         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1085         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1086         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1087         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1088         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1089         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1090         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1091         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1092         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1093         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1094         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1095         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1096         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1097         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1098         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1099         * test262/test/language/expressions/less-than/bigint-and-number.js:
1100         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1101         * test262/test/language/expressions/super/realm.js:
1102         * test262/test/language/expressions/tagged-template/cache-realm.js:
1103         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1104         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1105         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1106         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1107         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1108         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1109         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1110         (o.get z):
1111         (o.get a):
1112         * test262/test/language/statements/for-of/iterator-next-reference.js:
1113         (next):
1114         (iterator.next): Deleted.
1115         (x.of.iterable.): Deleted.
1116         (x.of.iterable.get return): Deleted.
1117         (x.of.iterable.iterator.next): Deleted.
1118         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1119         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1120         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1121         * test262/test/language/white-space/mongolian-vowel-separator.js:
1122         * test262/test262-Revision.txt:
1123
1124 2017-10-03  Saam Barati  <sbarati@apple.com>
1125
1126         Implement polymorphic prototypes
1127         https://bugs.webkit.org/show_bug.cgi?id=176391
1128
1129         Reviewed by Filip Pizlo.
1130
1131         * microbenchmarks/poly-proto-access.js: Added.
1132         (assert):
1133         (foo.C):
1134         (foo.C.prototype.get bar):
1135         (foo):
1136         (bar):
1137         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1138         (assert):
1139         (makePolyProtoObject.foo.C):
1140         (makePolyProtoObject.foo):
1141         (makePolyProtoObject):
1142         (performSet):
1143         * microbenchmarks/poly-proto-setter-speed.js: Added.
1144         (assert):
1145         (makePolyProtoObject.foo.C):
1146         (makePolyProtoObject.foo.C.prototype.set p):
1147         (makePolyProtoObject.foo):
1148         (makePolyProtoObject):
1149         (performSet):
1150         * stress/constructor-with-return.js:
1151         (i.tests.forEach.Constructor):
1152         (i.tests.forEach):
1153         (tests.forEach.Constructor): Deleted.
1154         (tests.forEach): Deleted.
1155         * stress/dom-jit-with-poly-proto.js: Added.
1156         (assert):
1157         (makePolyProtoObject.foo.C):
1158         (makePolyProtoObject.foo):
1159         (makePolyProtoObject):
1160         (validate):
1161         * stress/poly-proto-custom-value-and-accessor.js: Added.
1162         (assert):
1163         (makePolyProtoObject.foo.C):
1164         (makePolyProtoObject.foo):
1165         (makePolyProtoObject):
1166         (items.forEach):
1167         (set get for):
1168         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1169         (assert):
1170         (makePolyProtoObject.foo.C):
1171         (makePolyProtoObject.foo):
1172         (makePolyProtoObject):
1173         (foo):
1174         * stress/poly-proto-miss.js: Added.
1175         (makePolyProtoInstanceWithNullPrototype.foo.C):
1176         (makePolyProtoInstanceWithNullPrototype.foo):
1177         (makePolyProtoInstanceWithNullPrototype):
1178         (assert):
1179         (validate):
1180         * stress/poly-proto-op-in-caching.js: Added.
1181         (assert):
1182         (makePolyProtoObject.foo.C):
1183         (makePolyProtoObject.foo):
1184         (makePolyProtoObject):
1185         (validate):
1186         (validate2):
1187         * stress/poly-proto-put-transition.js: Added.
1188         (assert):
1189         (makePolyProtoObject.foo.C):
1190         (makePolyProtoObject.foo):
1191         (makePolyProtoObject):
1192         (performSet):
1193         (i.obj.__proto__.set p):
1194         * stress/poly-proto-set-prototype.js: Added.
1195         (assert):
1196         (let.alternateProto.get x):
1197         (let.alternateProto2.get y):
1198         (let.alternateProto2.get x):
1199         (foo.C):
1200         (foo):
1201         (validate):
1202         * stress/poly-proto-setter.js: Added.
1203         (assert):
1204         (makePolyProtoObject.foo.C):
1205         (makePolyProtoObject.foo.C.prototype.set p):
1206         (makePolyProtoObject.foo.C.prototype.get p):
1207         (makePolyProtoObject.foo):
1208         (makePolyProtoObject):
1209         (performSet):
1210         * stress/poly-proto-using-inheritance.js: Added.
1211         (assert):
1212         (foo.C):
1213         (foo.C.prototype.get baz):
1214         (foo):
1215         (bar.C):
1216         (bar):
1217         (validate):
1218         * stress/primitive-poly-proto.js: Added.
1219         (makePolyProtoInstance.foo.C):
1220         (makePolyProtoInstance.foo):
1221         (makePolyProtoInstance):
1222         (assert):
1223         (validate):
1224         * stress/prototype-is-not-js-object.js: Added.
1225         (foo.bar):
1226         (foo):
1227         (assert):
1228         (validate):
1229         * stress/try-get-by-id-poly-proto.js: Added.
1230         (assert):
1231         (makePolyProtoObject.foo.C):
1232         (makePolyProtoObject.foo):
1233         (makePolyProtoObject):
1234         (tryGetByIdText):
1235         (x.__proto__.get bar):
1236         (validate):
1237         * typeProfiler/overflow.js:
1238
1239 2017-10-03  JF Bastien  <jfbastien@apple.com>
1240
1241         WebAssembly: no VM / JS version of everything but Instance
1242         https://bugs.webkit.org/show_bug.cgi?id=177473
1243
1244         Reviewed by Filip Pizlo.
1245
1246         - Exceeding max on memory growth now returns a range error as per
1247         spec. This is a (very minor) breaking change: it used to throw OOM
1248         error. Update the corresponding test.
1249
1250         * wasm/js-api/memory-grow.js:
1251         (assertEq):
1252         * wasm/js-api/table.js:
1253         (assert.throws):
1254
1255 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1256
1257         Skip JSC test stress/regress-159779-2.js on debug.
1258         https://bugs.webkit.org/show_bug.cgi?id=177204
1259
1260         Unreviewed test gardening.
1261
1262         * stress/regress-159779-2.js:
1263
1264 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1265
1266         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1267         https://bugs.webkit.org/show_bug.cgi?id=175642
1268
1269         Reviewed by Darin Adler.
1270
1271         * ChakraCore/test/Function/apply3.baseline-jsc:
1272
1273 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1274
1275         Unreviewed, rolling out r222564.
1276         https://bugs.webkit.org/show_bug.cgi?id=177720
1277
1278         "It regressed JetStream by 2% on iOS caused by a 50%
1279         regression on the bigfib subtest" (Requested by saamyjoon on
1280         #webkit).
1281
1282         Reverted changeset:
1283
1284         "Add Above/Below comparisons for UInt32 patterns"
1285         https://bugs.webkit.org/show_bug.cgi?id=177281
1286         http://trac.webkit.org/changeset/222564
1287
1288 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1289
1290         [DFG] Support ArrayPush with multiple args
1291         https://bugs.webkit.org/show_bug.cgi?id=175823
1292
1293         Reviewed by Saam Barati.
1294
1295         * microbenchmarks/array-push-0.js: Added.
1296         (arrayPush0):
1297         * microbenchmarks/array-push-1.js: Added.
1298         (arrayPush1):
1299         * microbenchmarks/array-push-2.js: Added.
1300         (arrayPush2):
1301         * microbenchmarks/array-push-3.js: Added.
1302         (arrayPush3):
1303         * stress/array-push-multiple-contiguous.js: Added.
1304         (shouldBe):
1305         (test):
1306         * stress/array-push-multiple-double-nan.js: Added.
1307         (shouldBe):
1308         (test):
1309         * stress/array-push-multiple-double.js: Added.
1310         (shouldBe):
1311         (test):
1312         * stress/array-push-multiple-int32.js: Added.
1313         (shouldBe):
1314         (test):
1315         * stress/array-push-multiple-many-contiguous.js: Added.
1316         (shouldBe):
1317         (test):
1318         * stress/array-push-multiple-many-double.js: Added.
1319         (shouldBe):
1320         (test):
1321         * stress/array-push-multiple-many-int32.js: Added.
1322         (shouldBe):
1323         (test):
1324         * stress/array-push-multiple-many-storage.js: Added.
1325         (shouldBe):
1326         (test):
1327         * stress/array-push-multiple-storage.js: Added.
1328         (shouldBe):
1329         (test):
1330         * stress/array-push-with-force-exit.js: Added.
1331         (target.createBuiltin):
1332
1333 2017-09-29  Saam Barati  <sbarati@apple.com>
1334
1335         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1336         https://bugs.webkit.org/show_bug.cgi?id=177639
1337
1338         Reviewed by Geoffrey Garen.
1339
1340         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1341         (assert):
1342         (Class):
1343         (items.forEach):
1344         (set get for):
1345
1346 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1347
1348         Unreviewed, rolling out r222563, r222565, and r222581.
1349         https://bugs.webkit.org/show_bug.cgi?id=177675
1350
1351         "It causes a crash when playing youtube videos" (Requested by
1352         saamyjoon on #webkit).
1353
1354         Reverted changesets:
1355
1356         "[DFG] Support ArrayPush with multiple args"
1357         https://bugs.webkit.org/show_bug.cgi?id=175823
1358         http://trac.webkit.org/changeset/222563
1359
1360         "Unreviewed, build fix after r222563"
1361         https://bugs.webkit.org/show_bug.cgi?id=175823
1362         http://trac.webkit.org/changeset/222565
1363
1364         "Unreviewed, fix x86 breaking due to exhausted registers"
1365         https://bugs.webkit.org/show_bug.cgi?id=175823
1366         http://trac.webkit.org/changeset/222581
1367
1368 2017-09-28  Mark Lam  <mark.lam@apple.com>
1369
1370         test262: Unexpected passes after r222617 and r222618.
1371         https://bugs.webkit.org/show_bug.cgi?id=177622
1372         <rdar://problem/34725960>
1373
1374         Reviewed by Saam Barati.
1375
1376         Update test262.yaml for tests that are now passing.
1377
1378         * test262.yaml:
1379
1380 2017-09-27  Michael Saboff  <msaboff@apple.com>
1381
1382         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1383         https://bugs.webkit.org/show_bug.cgi?id=177570
1384
1385         Reviewed by Filip Pizlo.
1386
1387         New regression test.
1388
1389         * stress/regress-177570.js: Added.
1390
1391 2017-09-28  Michael Saboff  <msaboff@apple.com>
1392
1393         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1394         https://bugs.webkit.org/show_bug.cgi?id=177423
1395
1396         Reviewed by Mark Lam.
1397
1398         Updated regression test.
1399
1400         * stress/regress-177423.js:
1401         (catch):
1402
1403 2017-09-27  Mark Lam  <mark.lam@apple.com>
1404
1405         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1406         https://bugs.webkit.org/show_bug.cgi?id=177584
1407         <rdar://problem/34463903>
1408
1409         Reviewed by Saam Barati.
1410
1411         * stress/regress-177584.js: Added.
1412         (assertEqual):
1413         (Array.prototype.Symbol.species):
1414
1415 2017-09-27  Saam Barati  <sbarati@apple.com>
1416
1417         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1418         https://bugs.webkit.org/show_bug.cgi?id=177523
1419
1420         Reviewed by Mark Lam.
1421
1422         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1423         (assert):
1424         (Test):
1425         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1426         (addMethods):
1427         (i.Test.prototype.propName):
1428
1429 2017-09-27  Mark Lam  <mark.lam@apple.com>
1430
1431         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1432         https://bugs.webkit.org/show_bug.cgi?id=177423
1433         <rdar://problem/34621320>
1434
1435         Reviewed by Keith Miller.
1436
1437         * stress/regress-177423.js: Added.
1438
1439 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1440
1441         Add Above/Below comparisons for UInt32 patterns
1442         https://bugs.webkit.org/show_bug.cgi?id=177281
1443
1444         Reviewed by Saam Barati.
1445
1446         * stress/uint32-comparison-jump.js: Added.
1447         (shouldBe):
1448         (above):
1449         (aboveOrEqual):
1450         (below):
1451         (belowOrEqual):
1452         (notAbove):
1453         (notAboveOrEqual):
1454         (notBelow):
1455         (notBelowOrEqual):
1456         * stress/uint32-comparison.js: Added.
1457         (shouldBe):
1458         (above):
1459         (aboveOrEqual):
1460         (below):
1461         (belowOrEqual):
1462         (aboveTest):
1463         (aboveOrEqualTest):
1464         (belowTest):
1465         (belowOrEqualTest):
1466
1467 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1468
1469         [DFG] Support ArrayPush with multiple args
1470         https://bugs.webkit.org/show_bug.cgi?id=175823
1471
1472         Reviewed by Saam Barati.
1473
1474         * microbenchmarks/array-push-0.js: Added.
1475         (arrayPush0):
1476         * microbenchmarks/array-push-1.js: Added.
1477         (arrayPush1):
1478         * microbenchmarks/array-push-2.js: Added.
1479         (arrayPush2):
1480         * microbenchmarks/array-push-3.js: Added.
1481         (arrayPush3):
1482         * stress/array-push-multiple-contiguous.js: Added.
1483         (shouldBe):
1484         (test):
1485         * stress/array-push-multiple-double-nan.js: Added.
1486         (shouldBe):
1487         (test):
1488         * stress/array-push-multiple-double.js: Added.
1489         (shouldBe):
1490         (test):
1491         * stress/array-push-multiple-int32.js: Added.
1492         (shouldBe):
1493         (test):
1494         * stress/array-push-multiple-many-contiguous.js: Added.
1495         (shouldBe):
1496         (test):
1497         * stress/array-push-multiple-many-double.js: Added.
1498         (shouldBe):
1499         (test):
1500         * stress/array-push-multiple-many-int32.js: Added.
1501         (shouldBe):
1502         (test):
1503         * stress/array-push-multiple-many-storage.js: Added.
1504         (shouldBe):
1505         (test):
1506         * stress/array-push-multiple-storage.js: Added.
1507         (shouldBe):
1508         (test):
1509
1510 2017-09-26  Commit Queue  <commit-queue@webkit.org>
1511
1512         Unreviewed, rolling out r222518.
1513         https://bugs.webkit.org/show_bug.cgi?id=177507
1514
1515         Break the High Sierra build (Requested by yusukesuzuki on
1516         #webkit).
1517
1518         Reverted changeset:
1519
1520         "Add Above/Below comparisons for UInt32 patterns"
1521         https://bugs.webkit.org/show_bug.cgi?id=177281
1522         http://trac.webkit.org/changeset/222518
1523
1524 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1525
1526         Add Above/Below comparisons for UInt32 patterns
1527         https://bugs.webkit.org/show_bug.cgi?id=177281
1528
1529         Reviewed by Saam Barati.
1530
1531         * stress/uint32-comparison-jump.js: Added.
1532         (shouldBe):
1533         (above):
1534         (aboveOrEqual):
1535         (below):
1536         (belowOrEqual):
1537         (notAbove):
1538         (notAboveOrEqual):
1539         (notBelow):
1540         (notBelowOrEqual):
1541         * stress/uint32-comparison.js: Added.
1542         (shouldBe):
1543         (above):
1544         (aboveOrEqual):
1545         (below):
1546         (belowOrEqual):
1547         (aboveTest):
1548         (aboveOrEqualTest):
1549         (belowTest):
1550         (belowOrEqualTest):
1551
1552 2017-09-23  Keith Miller  <keith_miller@apple.com>
1553
1554         Fix infinite looping test262 test
1555         https://bugs.webkit.org/show_bug.cgi?id=177412
1556
1557         Reviewed by Yusuke Suzuki.
1558
1559         This test was poorly designed since failing it would cause the vm
1560         to inifinite loop. I've fixed it locally and will fix it on github pending
1561         the results of next weeks tc39 meeting.
1562
1563         * test262.yaml:
1564         * test262/test/language/statements/for-of/iterator-next-reference.js:
1565
1566 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
1567
1568         test262: $.agent became $262.agent in test262 update
1569         https://bugs.webkit.org/show_bug.cgi?id=177407
1570
1571         Reviewed by Yusuke Suzuki.
1572
1573         * test262.yaml:
1574         ~320 tests pass now that we correctly make $262 available.
1575
1576 2017-09-22  Keith Miller  <keith_miller@apple.com>
1577
1578         Speculatively change iteration protocall to use the same next function
1579         https://bugs.webkit.org/show_bug.cgi?id=175653
1580
1581         Reviewed by Saam Barati.
1582
1583         Change test to match the new iteration behavior.
1584
1585         * stress/spread-optimized-properly.js:
1586
1587 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1588
1589         [DFG][FTL] Profile array vector length for array allocation
1590         https://bugs.webkit.org/show_bug.cgi?id=177051
1591
1592         Reviewed by Saam Barati.
1593
1594         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1595         (target):
1596
1597 2017-09-22  Commit Queue  <commit-queue@webkit.org>
1598
1599         Unreviewed, rolling out r222380.
1600         https://bugs.webkit.org/show_bug.cgi?id=177352
1601
1602         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
1603         #webkit).
1604
1605         Reverted changeset:
1606
1607         "[DFG][FTL] Profile array vector length for array allocation"
1608         https://bugs.webkit.org/show_bug.cgi?id=177051
1609         http://trac.webkit.org/changeset/222380
1610
1611 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1612
1613         [DFG][FTL] Profile array vector length for array allocation
1614         https://bugs.webkit.org/show_bug.cgi?id=177051
1615
1616         Reviewed by Saam Barati.
1617
1618         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1619         (target):
1620
1621 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
1622
1623         Skip new hanging test262 tests.
1624         https://bugs.webkit.org/show_bug.cgi?id=177326
1625
1626         Unreviewed test gardening.
1627
1628         * test262.yaml:
1629
1630 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
1631
1632         Mark 6 test262 tests as passing.
1633         https://bugs.webkit.org/show_bug.cgi?id=177307
1634
1635         Unreviewed test gardening.
1636
1637         * test262.yaml:
1638
1639 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1640
1641         Unreviewed follow-up to r222311.
1642
1643         * test262/harness/sta.js:
1644         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
1645         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
1646         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
1647         * test262/test/built-ins/Array/from/elements-added-after.js:
1648         * test262/test/built-ins/Array/from/elements-deleted-after.js:
1649         * test262/test/built-ins/Array/from/elements-updated-after.js:
1650         * test262/test/built-ins/Array/from/from-array.js:
1651         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
1652         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
1653         * test262/test/built-ins/Array/from/source-array-boundary.js:
1654         * test262/test/built-ins/Array/from/source-object-constructor.js:
1655         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
1656         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
1657         * test262/test/built-ins/Array/from/source-object-length.js:
1658         * test262/test/built-ins/Array/from/source-object-missing.js:
1659         * test262/test/built-ins/Array/from/source-object-without.js:
1660         * test262/test/built-ins/Array/from/this-null.js:
1661         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1662         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
1663         * test262/test/language/literals/numeric/7.8.3-1gs.js:
1664         * test262/test/language/literals/numeric/7.8.3-2gs.js:
1665         * test262/test/language/literals/numeric/7.8.3-3gs.js:
1666         * test262/test/language/literals/regexp/7.8.5-1gs.js:
1667         * test262/test/language/literals/string/7.8.4-1gs.js:
1668         Fix some files that I failed to update when I applied my patch.
1669
1670 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1671
1672         Update test262 tests
1673         https://bugs.webkit.org/show_bug.cgi?id=177220
1674
1675         Reviewed by Saam Barati and Yusuke Suzuki.
1676
1677         * test262.yaml:
1678         * test262/test262-Revision.txt:
1679         New rebaselined expectations for all tests.
1680
1681         * test262/*:
1682         Updated.
1683
1684 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1685
1686         [DFG] Remove ToThis more aggressively
1687         https://bugs.webkit.org/show_bug.cgi?id=177056
1688
1689         Reviewed by Saam Barati.
1690
1691         * stress/generator-with-this-strict.js: Added.
1692         (shouldBe):
1693         (generator):
1694         (target):
1695         * stress/generator-with-this.js: Added.
1696         (shouldBe):
1697         (generator):
1698         (target):
1699
1700 2017-09-17  Michael Saboff  <msaboff@apple.com>
1701
1702         https://bugs.webkit.org/show_bug.cgi?id=177038
1703         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
1704
1705         Reviewed by JF Bastien.
1706
1707         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
1708         as it dies using too much memory.
1709
1710 2017-09-15  Saam Barati  <sbarati@apple.com>
1711
1712         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
1713         https://bugs.webkit.org/show_bug.cgi?id=176981
1714
1715         Reviewed by Yusuke Suzuki.
1716
1717         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
1718         (assert):
1719         (verify):
1720         (func):
1721         (const.bar.createBuiltin):
1722
1723 2017-09-14  Saam Barati  <sbarati@apple.com>
1724
1725         It should be valid to exit before each set when doing arity fixup when inlining
1726         https://bugs.webkit.org/show_bug.cgi?id=176948
1727
1728         Reviewed by Keith Miller.
1729
1730         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
1731         (baz):
1732         (bar):
1733         (foo):
1734
1735 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1736
1737         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
1738         https://bugs.webkit.org/show_bug.cgi?id=176867
1739
1740         Reviewed by Sam Weinig.
1741
1742         * microbenchmarks/object-get-own-property-symbols.js: Added.
1743         (test):
1744
1745 2017-09-13  Mark Lam  <mark.lam@apple.com>
1746
1747         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
1748         https://bugs.webkit.org/show_bug.cgi?id=176888
1749         <rdar://problem/34381832>
1750
1751         Not reviewed.
1752
1753         * stress/op_mod-ConstVar.js:
1754         * stress/op_mod-VarConst.js:
1755         * stress/op_mod-VarVar.js:
1756
1757 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
1758
1759         Skip 3 op_mod tests on Debug JSC bots.
1760         https://bugs.webkit.org/show_bug.cgi?id=176630
1761
1762         Unreviewed test gardening.
1763
1764         * stress/op_mod-ConstVar.js:
1765         * stress/op_mod-VarConst.js:
1766         * stress/op_mod-VarVar.js:
1767
1768 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1769
1770         [JSC] Fix Array allocation in Object.keys
1771         https://bugs.webkit.org/show_bug.cgi?id=176826
1772
1773         Reviewed by Saam Barati.
1774
1775         * stress/object-own-property-keys.js: Added.
1776         (shouldBe):
1777
1778 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1779
1780         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1781         https://bugs.webkit.org/show_bug.cgi?id=176010
1782
1783         Reviewed by Filip Pizlo.
1784
1785         * microbenchmarks/weak-map-key.js: Added.
1786         (assert):
1787         (objectKey):
1788         (let.start.Date.now):
1789
1790 2017-09-12  Mark Lam  <mark.lam@apple.com>
1791
1792         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
1793         https://bugs.webkit.org/show_bug.cgi?id=176630
1794
1795         Reviewed by JF Bastien.
1796
1797         Debug builds are just slow, and these tests do a lot.  They pass when I run them
1798         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
1799         a speculative fix for the bots that are seeing these fail.
1800
1801         I also undid the skipping of the op_mod tests for debug builds.
1802
1803         * stress/op_div-ConstVar.js:
1804         * stress/op_div-VarConst.js:
1805         * stress/op_div-VarVar.js:
1806         * stress/op_mod-ConstVar.js:
1807         * stress/op_mod-VarConst.js:
1808         * stress/op_mod-VarVar.js:
1809
1810 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
1811
1812         Skip stress/value-to-boolean.js on Debug bots.
1813         https://bugs.webkit.org/show_bug.cgi?id=176787
1814
1815         Unreviewed test gardening.
1816
1817         * stress/value-to-boolean.js:
1818
1819 2017-09-11  Mark Lam  <mark.lam@apple.com>
1820
1821         Change test expectation for test262/test/language/statements/try/tco-catch.js
1822         https://bugs.webkit.org/show_bug.cgi?id=176749
1823
1824         Rubber stamped by Keith Miller.
1825
1826         It's been failing since at least r221821.  I'm changing the test expectation to
1827         fail to green the bots while I investigate some more.
1828
1829         * test262.yaml:
1830
1831 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
1832
1833         Unreviewed, rolling out r221854.
1834
1835         The test added with this change fails on 32-bit JSC bots.
1836
1837         Reverted changeset:
1838
1839         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
1840         https://bugs.webkit.org/show_bug.cgi?id=176010
1841         http://trac.webkit.org/changeset/221854
1842
1843 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1844
1845         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1846         https://bugs.webkit.org/show_bug.cgi?id=176010
1847
1848         Reviewed by Filip Pizlo.
1849
1850         * microbenchmarks/weak-map-key.js: Added.
1851         (assert):
1852         (objectKey):
1853         (let.start.Date.now):
1854
1855 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1856
1857         [JSC] Optimize Object.keys by using careful array allocation
1858         https://bugs.webkit.org/show_bug.cgi?id=176654
1859
1860         Reviewed by Darin Adler.
1861
1862         * microbenchmarks/object-keys.js: Added.
1863         (test):
1864
1865 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
1866
1867         Error should compute .stack and friends lazily
1868         https://bugs.webkit.org/show_bug.cgi?id=176645
1869
1870         Reviewed by Saam Barati.
1871
1872         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
1873         * microbenchmarks/new-error.js: Added.
1874         * microbenchmarks/throw.js: Added.
1875
1876 2017-09-09  Mark Lam  <mark.lam@apple.com>
1877
1878         [Re-landing] Use JIT probes for DFG OSR exit.
1879         https://bugs.webkit.org/show_bug.cgi?id=175144
1880         <rdar://problem/33437050>
1881
1882         Not reviewed.  Original patch reviewed by Saam Barati.
1883
1884         Disable these tests for debug builds because they run too slow with the new OSR exit.
1885
1886         * stress/op_mod-ConstVar.js:
1887         * stress/op_mod-VarConst.js:
1888         * stress/op_mod-VarVar.js:
1889
1890 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1891
1892         [DFG] NewArrayWithSize(size)'s size does not care negative zero
1893         https://bugs.webkit.org/show_bug.cgi?id=176300
1894
1895         Reviewed by Saam Barati.
1896
1897         * stress/new-array-with-size-div.js: Added.
1898         (shouldBe):
1899         (test):
1900         (i.i):
1901
1902 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1903
1904         [DFG] PutByVal with Array::Generic is too generic
1905         https://bugs.webkit.org/show_bug.cgi?id=176345
1906
1907         Reviewed by Filip Pizlo.
1908
1909         * stress/object-assign-symbols.js: Added.
1910         (shouldBe):
1911         (test):
1912         * stress/object-assign.js: Added.
1913         (shouldBe):
1914         (test):
1915         (i.shouldBe.JSON.stringify.test):
1916
1917 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1918
1919         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
1920         https://bugs.webkit.org/show_bug.cgi?id=176590
1921
1922         Reviewed by Saam Barati.
1923
1924         * microbenchmarks/object-iterate-symbols.js: Added.
1925         (test):
1926         * microbenchmarks/object-iterate.js: Added.
1927         (test):
1928         * stress/object-iterate-symbols.js: Added.
1929         (shouldBe):
1930         (test):
1931         * stress/object-iterate.js: Added.
1932         (shouldBe):
1933         (test):
1934
1935 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
1936
1937         [Win32] 10 JSC stress tests are failing.
1938         https://bugs.webkit.org/show_bug.cgi?id=176538
1939
1940         Reviewed by Mark Lam.
1941
1942         Skip tests on Windows to make the bots green.
1943
1944         * ChakraCore.yaml:
1945         * stress/date-relaxed.js:
1946
1947 2017-09-06  Mark Lam  <mark.lam@apple.com>
1948
1949         constructGenericTypedArrayViewWithArguments() is missing an exception check.
1950         https://bugs.webkit.org/show_bug.cgi?id=176485
1951         <rdar://problem/33898874>
1952
1953         Reviewed by Keith Miller.
1954
1955         * stress/regress-176485.js: Added.
1956
1957 2017-09-05  Saam Barati  <sbarati@apple.com>
1958
1959         isNotCellSpeculation is wrong with respect to SpecEmpty
1960         https://bugs.webkit.org/show_bug.cgi?id=176429
1961
1962         Reviewed by Michael Saboff.
1963
1964         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
1965         (Foo):
1966
1967 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
1968
1969         test262: Completion values for control flow do not match the spec
1970         https://bugs.webkit.org/show_bug.cgi?id=171265
1971
1972         Reviewed by Saam Barati.
1973
1974         * stress/completion-value.js:
1975         Condensed test for completion values in top level statements.
1976
1977         * stress/super-get-by-id.js:
1978         ClassDeclaration when evaled no longer produce values. Convert
1979         these to ClassExpressions so they produce the class value.
1980         
1981         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1982         This is a progression for currect spec behavior.
1983
1984         * mozilla/mozilla-tests.yaml:
1985         This test is now outdated, so mark it as failing for that reason.
1986
1987         * test262.yaml:
1988         Passing all "cptn" completion value tests.
1989
1990 2017-09-04  Saam Barati  <sbarati@apple.com>
1991
1992         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
1993         https://bugs.webkit.org/show_bug.cgi?id=176317
1994
1995         Reviewed by Keith Miller.
1996
1997         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
1998         (Foo):
1999
2000 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2001
2002         [DFG][FTL] Efficiently execute number#toString()
2003         https://bugs.webkit.org/show_bug.cgi?id=170007
2004
2005         Reviewed by Keith Miller.
2006
2007         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2008         (test):
2009         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2010         (test):
2011         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2012         (test):
2013         * microbenchmarks/number-to-string-with-radix.js: Added.
2014         (test):
2015         * stress/number-to-string-strength-reduction.js: Added.
2016         (shouldBe):
2017         (test):
2018         * stress/number-to-string-with-radix-10.js: Added.
2019         (shouldBe):
2020         (test):
2021         * stress/number-to-string-with-radix-cse.js: Added.
2022         (shouldBe):
2023         (test):
2024         * stress/number-to-string-with-radix-invalid.js: Added.
2025         (shouldThrow):
2026         * stress/number-to-string-with-radix-watchpoint.js: Added.
2027         (shouldBe):
2028         (test):
2029         (i.i.1e3.Number.prototype.toString):
2030         * stress/number-to-string-with-radix.js: Added.
2031         (shouldBe):
2032         (test):
2033
2034 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2035
2036         [DFG] Relax arity requirement
2037         https://bugs.webkit.org/show_bug.cgi?id=175523
2038
2039         Reviewed by Saam Barati.
2040
2041         * stress/arity-mismatch-arguments-length.js: Added.
2042         (shouldBe):
2043         (test1):
2044         (test):
2045         * stress/arity-mismatch-get-argument.js: Added.
2046         (shouldBe):
2047         (builtin.createBuiltin):
2048         (test):
2049         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2050         (shouldBe):
2051         (inlineTarget):
2052         (test):
2053         * stress/arity-mismatch-inlining.js: Added.
2054         (shouldBe):
2055         (inlineTarget):
2056         (test):
2057         * stress/arity-mismatch-rest.js: Added.
2058         (shouldBe):
2059         (test2):
2060         (test1):
2061         (test):
2062
2063 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2064
2065         [JSC] Fix "name" and "length" of Proxy revoke function
2066         https://bugs.webkit.org/show_bug.cgi?id=176155
2067
2068         Reviewed by Mark Lam.
2069
2070         * test262.yaml:
2071
2072 2017-08-31  Saam Barati  <sbarati@apple.com>
2073
2074         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2075         https://bugs.webkit.org/show_bug.cgi?id=176206
2076
2077         Reviewed by Keith Miller.
2078
2079         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2080         (a):
2081         (b):
2082         (foo):
2083
2084 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2085
2086         Skip two slow JSC tests after r221422.
2087
2088         Unreviewed test gardening.
2089
2090         * stress/regexp-prototype-match-on-too-long-rope.js:
2091         * stress/regexp-prototype-test-on-too-long-rope.js:
2092
2093 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2094
2095         Unreviewed, skipping slow tests.
2096         
2097         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2098         work differently now.
2099
2100         * stress/regexp-prototype-exec-on-too-long-rope.js:
2101         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2102
2103 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2104
2105         [JSC] Use reifying system for "name" property of builtin JSFunction
2106         https://bugs.webkit.org/show_bug.cgi?id=175260
2107
2108         Reviewed by Saam Barati.
2109
2110         * stress/accessors-get-set-prefix.js:
2111         * stress/builtin-function-name.js: Added.
2112         (shouldBe):
2113         (shouldThrow):
2114         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2115         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2116         * stress/private-name-as-anonymous-builtin.js: Added.
2117         (shouldBe):
2118         (NotPromise):
2119
2120 2017-08-30  Saam Barati  <sbarati@apple.com>
2121
2122         Unreviewed. Make test stop printing.
2123
2124         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2125
2126 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2127
2128         Unreviewed, rolling out r221327.
2129
2130         This change caused test262 failures.
2131
2132         Reverted changeset:
2133
2134         "[JSC] Use reifying system for "name" property of builtin
2135         JSFunction"
2136         https://bugs.webkit.org/show_bug.cgi?id=175260
2137         http://trac.webkit.org/changeset/221327
2138
2139 2017-08-30  Saam Barati  <sbarati@apple.com>
2140
2141         semicolon is being interpreted as an = in the LiteralParser
2142         https://bugs.webkit.org/show_bug.cgi?id=176114
2143
2144         Reviewed by Oliver Hunt.
2145
2146         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2147         * stress/resources/literal-parser-test-case.js: Added.
2148
2149 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2150
2151         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2152         https://bugs.webkit.org/show_bug.cgi?id=166698
2153
2154         Reviewed by Yusuke Suzuki.
2155
2156         * stress/async-iteration-for-await-of-syntax.js: Added.
2157         (assert):
2158         (checkSyntax):
2159         (checkSyntaxError):
2160         (checkSimpleAsyncGeneratorSloppyMode):
2161         (checkSimpleAsyncGeneratorStrictMode):
2162         (checkNestedAsyncGenerators):
2163         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2164         * stress/async-iteration-for-await-of.js: Added.
2165         (assert):
2166         (async.foo):
2167         (async.boo):
2168         (const.boo.async):
2169
2170 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2171
2172         [JSC] Use reifying system for "name" property of builtin JSFunction
2173         https://bugs.webkit.org/show_bug.cgi?id=175260
2174
2175         Reviewed by Saam Barati.
2176
2177         * stress/accessors-get-set-prefix.js:
2178         * stress/builtin-function-name.js: Added.
2179         (shouldBe):
2180         (shouldThrow):
2181         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2182         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2183
2184 2017-08-25  Saam Barati  <sbarati@apple.com>
2185
2186         Support compiling catch in the DFG
2187         https://bugs.webkit.org/show_bug.cgi?id=174590
2188         <rdar://problem/34047845>
2189
2190         Reviewed by Filip Pizlo.
2191
2192         * microbenchmarks/delta-blue-try-catch.js: Added.
2193         (exception):
2194         (value):
2195         (OrderedCollection):
2196         (OrderedCollection.prototype.add):
2197         (OrderedCollection.prototype.at):
2198         (OrderedCollection.prototype.size):
2199         (OrderedCollection.prototype.removeFirst):
2200         (OrderedCollection.prototype.remove):
2201         (Strength):
2202         (Strength.stronger):
2203         (Strength.weaker):
2204         (Strength.weakestOf):
2205         (Strength.strongest):
2206         (Strength.prototype.nextWeaker):
2207         (Constraint):
2208         (Constraint.prototype.addConstraint):
2209         (Constraint.prototype.satisfy):
2210         (Constraint.prototype.destroyConstraint):
2211         (Constraint.prototype.isInput):
2212         (UnaryConstraint):
2213         (UnaryConstraint.prototype.addToGraph):
2214         (UnaryConstraint.prototype.chooseMethod):
2215         (UnaryConstraint.prototype.isSatisfied):
2216         (UnaryConstraint.prototype.markInputs):
2217         (UnaryConstraint.prototype.output):
2218         (UnaryConstraint.prototype.recalculate):
2219         (UnaryConstraint.prototype.markUnsatisfied):
2220         (UnaryConstraint.prototype.inputsKnown):
2221         (UnaryConstraint.prototype.removeFromGraph):
2222         (StayConstraint):
2223         (StayConstraint.prototype.execute):
2224         (EditConstraint.prototype.isInput):
2225         (EditConstraint.prototype.execute):
2226         (BinaryConstraint):
2227         (BinaryConstraint.prototype.chooseMethod):
2228         (BinaryConstraint.prototype.addToGraph):
2229         (BinaryConstraint.prototype.isSatisfied):
2230         (BinaryConstraint.prototype.markInputs):
2231         (BinaryConstraint.prototype.input):
2232         (BinaryConstraint.prototype.output):
2233         (BinaryConstraint.prototype.recalculate):
2234         (BinaryConstraint.prototype.markUnsatisfied):
2235         (BinaryConstraint.prototype.inputsKnown):
2236         (BinaryConstraint.prototype.removeFromGraph):
2237         (ScaleConstraint):
2238         (ScaleConstraint.prototype.addToGraph):
2239         (ScaleConstraint.prototype.removeFromGraph):
2240         (ScaleConstraint.prototype.markInputs):
2241         (ScaleConstraint.prototype.execute):
2242         (ScaleConstraint.prototype.recalculate):
2243         (EqualityConstraint):
2244         (EqualityConstraint.prototype.execute):
2245         (Variable):
2246         (Variable.prototype.addConstraint):
2247         (Variable.prototype.removeConstraint):
2248         (Planner):
2249         (Planner.prototype.incrementalAdd):
2250         (Planner.prototype.incrementalRemove):
2251         (Planner.prototype.newMark):
2252         (Planner.prototype.makePlan):
2253         (Planner.prototype.extractPlanFromConstraints):
2254         (Planner.prototype.addPropagate):
2255         (Planner.prototype.removePropagateFrom):
2256         (Planner.prototype.addConstraintsConsumingTo):
2257         (Plan):
2258         (Plan.prototype.addConstraint):
2259         (Plan.prototype.size):
2260         (Plan.prototype.constraintAt):
2261         (Plan.prototype.execute):
2262         (chainTest):
2263         (projectionTest):
2264         (change):
2265         (deltaBlue):
2266         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2267         (assert):
2268         (Numbers):
2269         (Numbers.prototype.next):
2270         (return.Transpose):
2271         (return.Transpose.prototype.next):
2272         (transpose):
2273         (verifyEven):
2274         (verifyString):
2275         (foo):
2276         (runIterators):
2277         * microbenchmarks/try-catch-word-count.js: Added.
2278         (let.assert):
2279         (EOF):
2280         (let.texts):
2281         (let.o.apply):
2282         (foo):
2283         (bar):
2284         (f):
2285         (run):
2286         (test1):
2287         (test2):
2288         (test3):
2289         (fn):
2290         (A):
2291         (B):
2292         (A.prototype.getValue):
2293         (B.prototype.getParentValue):
2294         (strlen):
2295         (sum.0):
2296         (test):
2297         (result.test.o):
2298         (set add.set add):
2299         (set forEach):
2300         (stringHash):
2301         (set if):
2302         (testFunction):
2303         (set delete.set has.set add):
2304         * stress/catch-set-argument-speculation-failure.js: Added.
2305         (o):
2306         (e):
2307         (e2):
2308         (escape):
2309         (baz):
2310         (noInline.run):
2311         (noInline):
2312         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2313         (foo):
2314         (e):
2315         (baz):
2316         (bar):
2317
2318 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2319
2320         Unreviewed, rolling out r221119, r221124, and r221143.
2321         https://bugs.webkit.org/show_bug.cgi?id=175973
2322
2323         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2324         on #webkit).
2325
2326         Reverted changesets:
2327
2328         "Support compiling catch in the DFG"
2329         https://bugs.webkit.org/show_bug.cgi?id=174590
2330         http://trac.webkit.org/changeset/221119
2331
2332         "Unreviewed, build fix in GTK port"
2333         https://bugs.webkit.org/show_bug.cgi?id=174590
2334         http://trac.webkit.org/changeset/221124
2335
2336         "DFG::JITCode::osrEntry should get sorted since we perform a
2337         binary search on it"
2338         https://bugs.webkit.org/show_bug.cgi?id=175893
2339         http://trac.webkit.org/changeset/221143
2340
2341 2017-08-24  Michael Saboff  <msaboff@apple.com>
2342
2343         Add support for RegExp "dotAll" flag
2344         https://bugs.webkit.org/show_bug.cgi?id=175924
2345
2346         Reviewed by Keith Miller.
2347
2348         Updated tests for new dotAll ('s' flag) changes.
2349
2350         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2351         * stress/static-getter-in-names.js:
2352
2353 2017-08-24  Mark Lam  <mark.lam@apple.com>
2354
2355         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2356         https://bugs.webkit.org/show_bug.cgi?id=175940
2357         <rdar://problem/29003921>
2358
2359         Reviewed by Saam Barati.
2360
2361         * stress/regress-164081.js: Added.
2362         (shouldEqual):
2363         (testcase):
2364
2365 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2366
2367         Skip flaky JSC test stress/test-finally.js.
2368         https://bugs.webkit.org/show_bug.cgi?id=160283
2369
2370         Unreviewed test gardening.
2371
2372         * stress/test-finally.js:
2373
2374 2017-08-23  Saam Barati  <sbarati@apple.com>
2375
2376         Support compiling catch in the DFG
2377         https://bugs.webkit.org/show_bug.cgi?id=174590
2378
2379         Reviewed by Filip Pizlo.
2380
2381         * microbenchmarks/delta-blue-try-catch.js: Added.
2382         (exception):
2383         (value):
2384         (OrderedCollection):
2385         (OrderedCollection.prototype.add):
2386         (OrderedCollection.prototype.at):
2387         (OrderedCollection.prototype.size):
2388         (OrderedCollection.prototype.removeFirst):
2389         (OrderedCollection.prototype.remove):
2390         (Strength):
2391         (Strength.stronger):
2392         (Strength.weaker):
2393         (Strength.weakestOf):
2394         (Strength.strongest):
2395         (Strength.prototype.nextWeaker):
2396         (Constraint):
2397         (Constraint.prototype.addConstraint):
2398         (Constraint.prototype.satisfy):
2399         (Constraint.prototype.destroyConstraint):
2400         (Constraint.prototype.isInput):
2401         (UnaryConstraint):
2402         (UnaryConstraint.prototype.addToGraph):
2403         (UnaryConstraint.prototype.chooseMethod):
2404         (UnaryConstraint.prototype.isSatisfied):
2405         (UnaryConstraint.prototype.markInputs):
2406         (UnaryConstraint.prototype.output):
2407         (UnaryConstraint.prototype.recalculate):
2408         (UnaryConstraint.prototype.markUnsatisfied):
2409         (UnaryConstraint.prototype.inputsKnown):
2410         (UnaryConstraint.prototype.removeFromGraph):
2411         (StayConstraint):
2412         (StayConstraint.prototype.execute):
2413         (EditConstraint.prototype.isInput):
2414         (EditConstraint.prototype.execute):
2415         (BinaryConstraint):
2416         (BinaryConstraint.prototype.chooseMethod):
2417         (BinaryConstraint.prototype.addToGraph):
2418         (BinaryConstraint.prototype.isSatisfied):
2419         (BinaryConstraint.prototype.markInputs):
2420         (BinaryConstraint.prototype.input):
2421         (BinaryConstraint.prototype.output):
2422         (BinaryConstraint.prototype.recalculate):
2423         (BinaryConstraint.prototype.markUnsatisfied):
2424         (BinaryConstraint.prototype.inputsKnown):
2425         (BinaryConstraint.prototype.removeFromGraph):
2426         (ScaleConstraint):
2427         (ScaleConstraint.prototype.addToGraph):
2428         (ScaleConstraint.prototype.removeFromGraph):
2429         (ScaleConstraint.prototype.markInputs):
2430         (ScaleConstraint.prototype.execute):
2431         (ScaleConstraint.prototype.recalculate):
2432         (EqualityConstraint):
2433         (EqualityConstraint.prototype.execute):
2434         (Variable):
2435         (Variable.prototype.addConstraint):
2436         (Variable.prototype.removeConstraint):
2437         (Planner):
2438         (Planner.prototype.incrementalAdd):
2439         (Planner.prototype.incrementalRemove):
2440         (Planner.prototype.newMark):
2441         (Planner.prototype.makePlan):
2442         (Planner.prototype.extractPlanFromConstraints):
2443         (Planner.prototype.addPropagate):
2444         (Planner.prototype.removePropagateFrom):
2445         (Planner.prototype.addConstraintsConsumingTo):
2446         (Plan):
2447         (Plan.prototype.addConstraint):
2448         (Plan.prototype.size):
2449         (Plan.prototype.constraintAt):
2450         (Plan.prototype.execute):
2451         (chainTest):
2452         (projectionTest):
2453         (change):
2454         (deltaBlue):
2455         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2456         (assert):
2457         (Numbers):
2458         (Numbers.prototype.next):
2459         (return.Transpose):
2460         (return.Transpose.prototype.next):
2461         (transpose):
2462         (verifyEven):
2463         (verifyString):
2464         (foo):
2465         (runIterators):
2466         * microbenchmarks/try-catch-word-count.js: Added.
2467         (let.assert):
2468         (EOF):
2469         (let.texts):
2470         (let.o.apply):
2471         (foo):
2472         (bar):
2473         (f):
2474         (run):
2475         (test1):
2476         (test2):
2477         (test3):
2478         (fn):
2479         (A):
2480         (B):
2481         (A.prototype.getValue):
2482         (B.prototype.getParentValue):
2483         (strlen):
2484         (sum.0):
2485         (test):
2486         (result.test.o):
2487         (set add.set add):
2488         (set forEach):
2489         (stringHash):
2490         (set if):
2491         (testFunction):
2492         (set delete.set has.set add):
2493         * stress/catch-set-argument-speculation-failure.js: Added.
2494         (o):
2495         (e):
2496         (e2):
2497         (escape):
2498         (baz):
2499         (noInline.run):
2500         (noInline):
2501         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2502         (foo):
2503         (e):
2504         (baz):
2505         (bar):
2506
2507 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2508
2509         [JSC] Optimize Map iteration with intrinsic
2510         https://bugs.webkit.org/show_bug.cgi?id=174355
2511
2512         Reviewed by Saam Barati.
2513
2514         * stress/map-iterator-result-should-have-expected-shape.js: Added.
2515         (shouldBe):
2516         (throw.new.Error):
2517         * stress/set-iterator-result-should-have-expected-shape.js: Added.
2518         (shouldBe):
2519         (throw.new.Error.let.iterator.set Symbol):
2520         (throw.new.Error.set add):
2521         (let.iterator.set Symbol):
2522
2523 2017-08-23  Robin Morisset  <rmorisset@apple.com>
2524
2525         Add a micro-benchmark for checking that accessing a variable within a 'with'
2526         block does not automatically prevent type prediction.
2527         https://bugs.webkit.org/show_bug.cgi?id=175738
2528
2529         Reviewed by Saam Barati.
2530
2531         * stress/with_and_arith.js: Added.
2532         (with):
2533
2534 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
2535
2536         [ESNext] Async iteration - Implement Async Generator - runtime
2537         https://bugs.webkit.org/show_bug.cgi?id=175240
2538
2539         Reviewed by Yusuke Suzuki.
2540
2541         * stress/async-iteration-async-from-sync.js: Added.
2542         (assert):
2543         (const.Logger):
2544         (this.fullfilled):
2545         (this.fullfilledDone):
2546         (this.rejected):
2547         (this.catched):
2548         (this.isFinal):
2549         (_assertLogger):
2550         (const.assertLogger):
2551         (const.getPromise.promiseHolder.return.new.Promise):
2552         (foo):
2553         (async.boo):
2554         (bar):
2555         (async.baz):
2556         (async.goo):
2557         * stress/async-iteration-basic.js: Added.
2558         (assert):
2559         (const.Logger):
2560         (this.fullfilled):
2561         (this.fullfilledDone):
2562         (this.rejected):
2563         (this.catched):
2564         (this.isFinal):
2565         (_assertLogger):
2566         (const.assertLogger):
2567         (const.getPromise.promiseHolder.return.new.Promise):
2568         (async.generator):
2569         (iterator.next.then):
2570         (async.baz):
2571         (async.boo):
2572         (async.foo):
2573         (async.goo):
2574         (A.prototype.async.foo):
2575         (A.prototype.async.boo):
2576         (A):
2577         (asyncGenExp.async):
2578         (async.joo):
2579         (j.next.then):
2580         (then):
2581         (async.koo):
2582         (async.loo):
2583         (async.moo):
2584         (async.noo):
2585         (async.ooo):
2586         (async.roo):
2587         (async.poo):
2588         (async.soo):
2589         (async.too):
2590         * stress/async-iteration-evaluation.js: Added.
2591         (assert):
2592         (async.foo):
2593         (catch):
2594         * stress/async-iteration-syntax.js:
2595         * stress/async-iteration-yield-promise.js: Added.
2596         (assert):
2597         (const.Logger):
2598         (this.fullfilled):
2599         (this.fullfilledDone):
2600         (this.rejected):
2601         (this.catched):
2602         (this.isFinal):
2603         (_assertLogger):
2604         (const.assertLogger):
2605         (const.getPromise.promiseHolder.return.new.Promise):
2606         (async.foo):
2607         (async.boo):
2608         (async.bar):
2609         * stress/async-iteration-yield-star-interface.js: Added.
2610         (assert):
2611         (const.getPromise.promiseHolder.return.new.Promise):
2612         (const.Logger):
2613         (this.fullfilled):
2614         (this.fullfilledDone):
2615         (this.rejected):
2616         (this.catched):
2617         (this.custom):
2618         (this.isFinal):
2619         (_assertLogger):
2620         (const.assertLogger):
2621         (let.asyncIter.Symbol.asyncIterator):
2622         (let.asyncIter.next):
2623         (let.asyncIter.throw):
2624         (let.asyncIter.return):
2625         (async.foo):
2626         (asyncIter.Symbol.asyncIterator):
2627         (asyncIter.next):
2628         (async.boo):
2629         (asyncIter.return):
2630         (async.bar):
2631         (async.baz):
2632         (async.foobar):
2633         * stress/async-iteration-yield-star.js: Added.
2634         (assert):
2635         (const.Logger):
2636         (this.fullfilled):
2637         (this.fullfilledDone):
2638         (this.rejected):
2639         (this.catched):
2640         (this.custom):
2641         (this.isFinal):
2642         (_assertLogger):
2643         (const.assertLogger):
2644         (const.getPromise.promiseHolder.return.new.Promise):
2645         (async.foo):
2646         (async.boo):
2647         (async.bar):
2648         (async.baz):
2649         (async.joo):
2650         (async.goo):
2651         (async.koo):
2652         (async.loo):
2653         (let.asyncIter.Symbol.asyncIterator):
2654         (let.asyncIter.next):
2655         (let.asyncIter.throw):
2656         (let.asyncIter.return):
2657         (async.moo):
2658         (async.noo):
2659         * test262.yaml:
2660
2661 2017-08-23  JF Bastien  <jfbastien@apple.com>
2662
2663         Fix printing in test
2664
2665         Unreviewed: fixing verbosity, shouldn't have been there.
2666
2667         * wasm/regress/175693.js:
2668         (else.else):
2669         (catch):
2670
2671 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
2672
2673         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
2674         https://bugs.webkit.org/show_bug.cgi?id=172543
2675
2676         Unreviewed test gardening.
2677
2678         * microbenchmarks/generator-with-several-types.js:
2679
2680 2017-08-17  JF Bastien  <jfbastien@apple.com>
2681
2682         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
2683         https://bugs.webkit.org/show_bug.cgi?id=175693
2684         <rdar://problem/33952443>
2685
2686         Reviewed by Saam Barati.
2687
2688         Add a regression directory for WebAssembly tests.
2689
2690         * wasm.yaml:
2691         * wasm/regress/175693.js: Added.
2692         (else.else):
2693         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
2694         (catch):
2695         * wasm/regress/175693.wasm: Added.
2696
2697 2017-08-15  Robin Morisset  <rmorisset@apple.com>
2698
2699         Support the 'with' keyword in FTL.
2700         https://bugs.webkit.org/show_bug.cgi?id=175585
2701
2702         Reviewed by Saam Barati.
2703
2704         Also improve the JSTest/stress/with.js file to test
2705         what happens when non-objects are passed to with.
2706
2707         * stress/with.js:
2708         (foo):
2709         (i.catch):
2710         (i.with): Deleted.
2711
2712 2017-08-14  Keith Miller  <keith_miller@apple.com>
2713
2714         Add testing tool to lie to the DFG about profiles
2715         https://bugs.webkit.org/show_bug.cgi?id=175487
2716
2717         Reviewed by Saam Barati.
2718
2719         * stress/compare-eq-incomplete-profile.js: Added.
2720         (const.test.createBuiltin):
2721
2722 2017-08-14  Robin Morisset  <rmorisset@apple.com>
2723
2724         Support the with keyword in DFG
2725         https://bugs.webkit.org/show_bug.cgi?id=175470
2726
2727         Reviewed by Saam Barati.
2728
2729         Added a new stress-test for the 'with' keyword, that caught a bug in a
2730         previous version of this code.
2731
2732         * stress/with.js: Added.
2733         (i.with):
2734
2735 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
2736
2737         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
2738         https://bugs.webkit.org/show_bug.cgi?id=175544
2739
2740         Unreviewed test gardening.
2741
2742         * ChakraCore.yaml:
2743
2744 2017-08-09  Caitlin Potter  <caitp@igalia.com>
2745
2746         Early error on ANY operator before new.target
2747         https://bugs.webkit.org/show_bug.cgi?id=157970
2748
2749         Reviewed by Saam Barati.
2750
2751         Instead of throwing if any unary operator precedes new.target, only
2752         throw if the unary operator updates the reference.
2753
2754         The following become legal in JSC:
2755
2756         ```
2757         !new.target
2758         ~new.target
2759         typeof new.target
2760         delete new.target
2761         void new.target
2762         ```
2763
2764         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
2765
2766         * stress/new-target-syntax-errors.js:
2767         * stress/new-target.js:
2768
2769 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
2770
2771         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
2772         https://bugs.webkit.org/show_bug.cgi?id=175255
2773
2774         Unreviewed test gardening.
2775
2776         * stress/regress-169783.js:
2777         * wasm/stress/oom.js:
2778
2779 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2780
2781         REGRESSION: 2 test262/test/language/statements/async-function failures
2782         https://bugs.webkit.org/show_bug.cgi?id=175334
2783
2784         Reviewed by Yusuke Suzuki.
2785
2786         Add @skip parameters to tests, and remove test for async iterator from 
2787         async await syntax test because it is already covered by async-iterator-syntax.js
2788
2789         * stress/async-await-syntax.js:
2790         * stress/async-iteration-syntax.js:
2791
2792 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2793
2794         Unreviewed, gardening test262 for Promise resolve / reject function length
2795         https://bugs.webkit.org/show_bug.cgi?id=175333
2796
2797         * test262.yaml:
2798
2799 2017-08-07  Robin Morisset  <rmorisset@apple.com>
2800
2801         GetOwnProperty of TypedArray indexed fields is wrongly configurable
2802         https://bugs.webkit.org/show_bug.cgi?id=175307
2803
2804         Reviewed by Saam Barati.
2805
2806         * stress/typedarray-getownproperty-not-configurable.js: Added.
2807         (assert):
2808         (foo):
2809
2810 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2811
2812         Promise resolve and reject function should have length = 1
2813         https://bugs.webkit.org/show_bug.cgi?id=175242
2814
2815         Reviewed by Saam Barati.
2816
2817         * stress/builtin-function-length.js: Added.
2818         (shouldBe):
2819         (shouldThrow):
2820         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2821         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2822
2823 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2824
2825         [ESNext] Async iteration - Implement Async Generator - parser
2826         https://bugs.webkit.org/show_bug.cgi?id=175210
2827
2828         Reviewed by Yusuke Suzuki.
2829
2830         * stress/async-await-syntax.js:
2831         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2832         * stress/async-iteration-syntax.js: Added.
2833         (assert):
2834         (checkSyntax):
2835         (checkSyntaxError):
2836         (checkSimpleAsyncGeneratorSloppyMode):
2837         (checkSimpleAsyncGeneratorStrictMode):
2838         (checkNestedAsyncGenerators):
2839         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2840         * stress/generator-class-methods-syntax.js:
2841
2842 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2843
2844         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
2845         https://bugs.webkit.org/show_bug.cgi?id=175150
2846
2847         Unreviewed test gardening.
2848
2849         * wasm/js-api/test_memory_constructor.js:
2850
2851 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2852
2853         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
2854         https://bugs.webkit.org/show_bug.cgi?id=175100
2855
2856         Reviewed by Mark Lam.
2857
2858         The JSC test JSTests/wasm/stress/oom.js tries to use all the
2859         available memory until an out of memory exception happens.
2860
2861         The Linux kernel is more tuned for server workloads than for GUI
2862         responsiveness. When a process tries to use a lot of memory, Linux
2863         will do its best to serve the request. This usually translates to
2864         free physical RAM by writing to disk dirty pages and/or moving out
2865         less recently used pages to swap (disk storage).
2866         Meanwhile it does this, the system will become unresponsive and this
2867         leads to freezes that can last even some minutes on the worst cases.
2868
2869         Therefore, let's skip this test on Linux as it will cause more harm
2870         than good on the Linux bots or on the machines of Linux developers.
2871
2872         * wasm/stress/oom.js:
2873
2874 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2875
2876         [JSC] Remove unnecessary print from stress\promise-finally.js test
2877         https://bugs.webkit.org/show_bug.cgi?id=175015
2878
2879         Reviewed by Yusuke Suzuki.
2880
2881         * stress/promise-finally.js:
2882         (p.finally):
2883         (then):
2884
2885 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2886
2887         Unreviewed, update test262 results for optional catch binding
2888
2889         * test262.yaml:
2890
2891 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2892
2893         [JSC] Support optional catch binding
2894         https://bugs.webkit.org/show_bug.cgi?id=174981
2895
2896         Reviewed by Saam Barati.
2897
2898         * stress/optional-catch-binding-syntax.js: Added.
2899         (testSyntax):
2900         (testSyntaxError):
2901         (catch.catch):
2902         * stress/optional-catch-binding.js: Added.
2903         (shouldBe):
2904         (throwException):
2905
2906 2017-07-28  Mark Lam  <mark.lam@apple.com>
2907
2908         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
2909         https://bugs.webkit.org/show_bug.cgi?id=174948
2910         <rdar://problem/33495680>
2911
2912         Reviewed by Filip Pizlo.
2913
2914         * stress/regress-174948.js: Added.
2915
2916 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2917
2918         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
2919         https://bugs.webkit.org/show_bug.cgi?id=174900
2920
2921         Reviewed by Saam Barati.
2922
2923         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
2924         (sideEffect):
2925         (args):
2926         (test):
2927
2928 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2929
2930         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
2931         https://bugs.webkit.org/show_bug.cgi?id=171637
2932
2933         Reviewed by Darin Adler.
2934
2935         * stress/domjit-getter-complex-with-incorrect-object.js:
2936         (i.shouldThrow):
2937         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
2938         (shouldBe):
2939         (i.shouldThrow):
2940
2941 2017-07-26  JF Bastien  <jfbastien@apple.com>
2942
2943         WebAssembly: test throwing out of the start function
2944         https://bugs.webkit.org/show_bug.cgi?id=165714
2945         <rdar://problem/29760251>
2946
2947         Reviewed by Keith Miller.
2948
2949         * wasm/assert.js:
2950         * wasm/function-tests/trap-from-start.js: Added.
2951         (StartTraps):
2952         * wasm/function-tests/trap-from-start-async.js: Added.
2953         (async.StartTrapsAsync):
2954
2955 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2956
2957         [FTL] Arguments elimination is suppressed by unreachable blocks
2958         https://bugs.webkit.org/show_bug.cgi?id=174352
2959
2960         Reviewed by Filip Pizlo.
2961
2962         * stress/arguments-elimination-force-exit.js: Added.
2963         (shouldBe):
2964         (strict):
2965         (sloppy):
2966         * stress/arguments-elimination-throw.js: Added.
2967         (shouldBe):
2968         (shouldThrow):
2969         (sloppy):
2970         (isArguments):
2971
2972 2017-07-13  Mark Lam  <mark.lam@apple.com>
2973
2974         Add some additional test cases for bug 170896.
2975         https://bugs.webkit.org/show_bug.cgi?id=174491
2976
2977         Reviewed by Filip Pizlo.
2978
2979         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
2980         * stress/regress-170896-with-double-shape-profile.js: Added.
2981         (test):
2982         * stress/regress-170896-with-int32-shape-profile.js: Added.
2983         (test):
2984         * stress/regress-170896.js: Removed.
2985
2986 2017-07-13  Saam Barati  <sbarati@apple.com>
2987
2988         Missing exception check in JSObject::hasInstance
2989         https://bugs.webkit.org/show_bug.cgi?id=174455
2990         <rdar://problem/31384608>
2991
2992         Reviewed by Mark Lam.
2993
2994         * stress/has-instance-exception-check.js: Added.
2995         (assert):
2996         (let.getter.Object.getOwnPropertyDescriptor.get foo):
2997
2998 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
2999
3000         [ESnext] Implement Object Spread
3001         https://bugs.webkit.org/show_bug.cgi?id=167963
3002
3003         Reviewed by Saam Barati.
3004
3005         * stress/obj-rest-destructuring-order.js: Added.
3006         (assert):
3007         (o.get z):
3008         (o.get a):
3009         * stress/obj-spread-order.js: Added.
3010         (assert):
3011         (o.get z):
3012         (o.get a):
3013         * stress/object-spread.js: Added.
3014         (let.assert):
3015         (assert.sameValue):
3016         (let.o.get a):
3017         (let.obj.get c):
3018         (cthulhu.get x):
3019         (let.obj.set c):
3020         (calls.o.get z):
3021         (calls.o.get a):
3022         (try.let.obj.get foo):
3023         (get calls):
3024
3025 2017-07-12  Saam Barati  <sbarati@apple.com>
3026
3027         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3028         https://bugs.webkit.org/show_bug.cgi?id=174411
3029         <rdar://problem/31696186>
3030
3031         Reviewed by Mark Lam.
3032
3033         * stress/generic-arguments-correct-delete-behavior.js: Added.
3034         (assert):
3035         (makeTest):
3036
3037 2017-07-07  Mark Lam  <mark.lam@apple.com>
3038
3039         \n\r is not the same as \r\n.
3040         https://bugs.webkit.org/show_bug.cgi?id=173053
3041
3042         Reviewed by Keith Miller.
3043
3044         * stress/regress-173053.js: Added.
3045         * stress/template-literal-line-terminators.js:
3046
3047 2017-07-06  Saam Barati  <sbarati@apple.com>
3048
3049         We are missing places where we invalidate the for-in context
3050         https://bugs.webkit.org/show_bug.cgi?id=174184
3051
3052         Reviewed by Geoffrey Garen.
3053
3054         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3055         (assert):
3056         (test):
3057
3058 2017-07-05  Saam Barati  <sbarati@apple.com>
3059
3060         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3061         https://bugs.webkit.org/show_bug.cgi?id=174188
3062         <rdar://problem/30581423>
3063
3064         Reviewed by Mark Lam.
3065
3066         * stress/new-array-having-a-bad-time-double.js: Added.
3067         (assert):
3068         (foo):
3069
3070 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3071
3072         WTF::StringImpl::copyChars segfaults when built with GCC 7
3073         https://bugs.webkit.org/show_bug.cgi?id=173407
3074
3075         Reviewed by Andreas Kling.
3076
3077         * stress/string-repeat-copy-chars-crash.js: Added.
3078         (shouldBe):
3079
3080 2017-07-03  Saam Barati  <sbarati@apple.com>
3081
3082         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3083
3084         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3085
3086 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3087
3088         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3089
3090         It requires too much memory.
3091
3092         * stress/dont-reserve-huge-capacity-lexer.js:
3093
3094 2017-06-30  Michael Saboff  <msaboff@apple.com>
3095
3096         Skip a test on ARM64 platform since we run out of address space.
3097
3098         Rubber stamped by Saam Barati.
3099
3100         * stress/dont-reserve-huge-capacity-lexer.js:
3101
3102 2017-06-30  Michael Saboff  <msaboff@apple.com>
3103
3104         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3105         https://bugs.webkit.org/show_bug.cgi?id=174044
3106
3107         Reviewed by Oliver Hunt.
3108
3109         New regression test.
3110
3111         * stress/regress-174044.js: Added.
3112         (test1):
3113         (test2):
3114
3115 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3116
3117         RegExpCachedResult::setInput should reify left and right contexts
3118         https://bugs.webkit.org/show_bug.cgi?id=173818
3119
3120         Reviewed by Keith Miller.
3121
3122         * stress/right-left-context-invalidated-by-input.js: Added.
3123         (test.validateContexts):
3124         (test):
3125
3126 2017-06-29  Saam Barati  <sbarati@apple.com>
3127
3128         Calculating postCapacity in unshiftCountSlowCase is wrong
3129         https://bugs.webkit.org/show_bug.cgi?id=173992
3130         <rdar://problem/32283199>
3131
3132         Reviewed by Keith Miller.
3133
3134         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3135         (temp):
3136
3137 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3138
3139         Unreviewed, rolling out r218512.
3140         https://bugs.webkit.org/show_bug.cgi?id=173981
3141
3142         "It changes the behavior of the JS API's JSEvaluateScript
3143         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3144
3145         Reverted changeset:
3146
3147         "test262: Completion values for control flow do not match the
3148         spec"
3149         https://bugs.webkit.org/show_bug.cgi?id=171265
3150         http://trac.webkit.org/changeset/218512
3151
3152 2017-06-27  JF Bastien  <jfbastien@apple.com>
3153
3154         WebAssembly: running out of executable memory should throw OoM
3155         https://bugs.webkit.org/show_bug.cgi?id=171537
3156         <rdar://problem/32963338>
3157
3158         Reviewed by Saam Barati.
3159
3160         * wasm.yaml:
3161         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3162         (const.invoke):
3163         (failCount.0.catch):
3164         (failCount.0.module.undefined.catch):
3165         * wasm/lowExecutableMemory/exports-oom.js: Added.
3166         (const.type):
3167         (const.params):
3168         (const.randomProgram):
3169         (failCount.0.catch):
3170         (failCount.0.module.undefined.catch):
3171         * wasm/lowExecutableMemory/imports-oom.js: Added.
3172         (const.type):
3173         (const.params):
3174         (const.randomProgram):
3175         (f.imports.push):
3176         (failCount.0.catch):
3177         (failCount.0.module.undefined.catch):
3178
3179 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3180
3181         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3182         https://bugs.webkit.org/show_bug.cgi?id=167962
3183
3184         Reviewed by Saam Barati.
3185
3186         * stress/object-rest-deconstruct.js: Added.
3187         (let.assert):
3188         (let.assertPropDescriptor):
3189         (catch):
3190         (get 3):
3191         (foo):
3192         (let.src.get y):
3193         (let.src.set y):
3194         (let.gen):
3195
3196 2017-06-27  Saam Barati  <sbarati@apple.com>
3197
3198         Function constructor needs to follow the spec and validate parameters and body independently
3199         https://bugs.webkit.org/show_bug.cgi?id=173303
3200         <rdar://problem/32732526>
3201
3202         Reviewed by Keith Miller.
3203
3204         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3205         * stress/function-constructor-semantics.js: Added.
3206         (assert):
3207         (hasSyntaxError):
3208         (foo):
3209         (async.foo):
3210         (testError):
3211         (testOK.toString):
3212         (toString):
3213
3214 2017-06-26  Saam Barati  <sbarati@apple.com>
3215
3216         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3217         https://bugs.webkit.org/show_bug.cgi?id=173740
3218
3219         Reviewed by Mark Lam.
3220
3221         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3222         (Array.prototype.Symbol.iterator):
3223
3224 2017-06-26  Saam Barati  <sbarati@apple.com>
3225
3226         Skip a test on 32-bit platforms since we run out of address space.
3227
3228         Rubber stamped by Mark Lam.
3229
3230         * stress/dont-reserve-huge-capacity-lexer.js:
3231
3232 2017-06-26  Saam Barati  <sbarati@apple.com>
3233
3234         Crash in JSC::Lexer<unsigned char>::setCode
3235         https://bugs.webkit.org/show_bug.cgi?id=172754
3236
3237         Reviewed by Mark Lam.
3238
3239         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3240         (catch):
3241
3242 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3243
3244         [JSC] Clean up Object.entries implementation
3245         https://bugs.webkit.org/show_bug.cgi?id=173759
3246
3247         Reviewed by Sam Weinig.
3248
3249         * microbenchmarks/object-entries.js: Added.
3250         (test):
3251
3252 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3253
3254         Remove Reflect.enumerate
3255         https://bugs.webkit.org/show_bug.cgi?id=173806
3256
3257         Reviewed by Yusuke Suzuki.
3258
3259         * ChakraCore.yaml:
3260         * es6.yaml:
3261         These tests now fail because they use Reflect.enumerate.
3262
3263         * test262.yaml:
3264         This test now passes, it checked that Reflect.enumerate is undefined!
3265
3266         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3267         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3268
3269         * stress/reflect-enumerate.js: Removed.
3270         Remove a test solely for Reflect.enumerate.
3271
3272 2017-06-22  Saam Barati  <sbarati@apple.com>
3273
3274         ValueRep(DoubleRep(@v)) can not simply convert to @v
3275         https://bugs.webkit.org/show_bug.cgi?id=173687
3276         <rdar://problem/32855563>
3277
3278         Reviewed by Mark Lam.
3279
3280         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3281         (i.catch):
3282
3283 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3284
3285         [JSC] Object.values should be implemented in C++
3286         https://bugs.webkit.org/show_bug.cgi?id=173703
3287
3288         Reviewed by Sam Weinig.
3289
3290         * microbenchmarks/object-keys-map-values.js: Added.
3291         (test):
3292         * microbenchmarks/object-values.js: Added.
3293         (test):
3294         * stress/object-values-changing-properties.js: Added.
3295         (shouldBe):
3296         (throw.new.Error.let.source.get x):
3297         (throw.new.Error):
3298         (shouldBe.let.handler.get order):
3299         (get let):
3300         (shouldBe.let.handler.get return):
3301         (let.handler.get order):
3302
3303 2017-06-21  Saam Barati  <sbarati@apple.com>
3304
3305         eval virtual call is incorrect in the baseline JIT
3306         https://bugs.webkit.org/show_bug.cgi?id=173587
3307         <rdar://problem/32867897>
3308
3309         Reviewed by Michael Saboff.
3310
3311         * stress/do-eval-virtual-call-correctly.js: Added.
3312         (assert):
3313         (f):
3314         (i.test):
3315         (catch):
3316
3317 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3318
3319         Update test262 test expectations after r218581.
3320
3321         Unreviewed test gardening.
3322
3323         * test262.yaml:
3324
3325 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
3326
3327         Revert changes in bug#160417 about extending `null` not being a derived class
3328         https://bugs.webkit.org/show_bug.cgi?id=169293
3329
3330         Reviewed by Saam Barati.
3331
3332         * stress/class-derived-from-null.js:
3333         (assertThrow):
3334         (test1):
3335         (test2):
3336         (test3):
3337         (test4):
3338         (test5):
3339         (test6):
3340
3341 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3342
3343         [DFG] More ArrayIndexOf fixups for various types
3344         https://bugs.webkit.org/show_bug.cgi?id=173176
3345
3346         Reviewed by Saam Barati.
3347
3348         * stress/array-indexof-arraystorage.js: Added.
3349         (shouldBe):
3350         (indexOfInt32Other):
3351         (indexOfInt32Cell):
3352         (indexOfInt32Boolean):
3353         (indexOfDoubleOther):
3354         (indexOfDoubleCell):
3355         (indexOfDoubleBoolean):
3356         (indexOfInt32):
3357         (indexOfDouble):
3358         * stress/array-indexof-constant-folding.js: Added.
3359         (shouldBe):
3360         (indexOfInt32Other):
3361         (indexOfInt32Cell):
3362         (indexOfInt32Boolean):
3363         (indexOfDoubleOther):
3364         (indexOfDoubleCell):
3365         (indexOfDoubleBoolean):
3366         * stress/array-indexof-hole-and-other.js: Added.
3367         (shouldBe):
3368         (indexOf):
3369         * stress/array-indexof-other.js: Added.
3370         (shouldBe):
3371         (indexOfInt32):
3372         (indexOfDouble):
3373         (indexOfString):
3374         (indexOfObject):
3375         * stress/array-indexof-symbol.js: Added.
3376         (shouldBe):
3377         (indexOfInt32):
3378         (indexOfDouble):
3379         (indexOfString):
3380         (indexOfObject):
3381
3382 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
3383
3384         test262: Completion values for control flow do not match the spec
3385         https://bugs.webkit.org/show_bug.cgi?id=171265
3386
3387         Reviewed by Saam Barati.
3388
3389         * stress/completion-value.js:
3390         Condensed test for completion values in top level statements.
3391
3392         * stress/super-get-by-id.js:
3393         ClassDeclaration when evaled no longer produce values. Convert
3394         these to ClassExpressions so they produce the class value.
3395         
3396         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3397         This is a progression for currect spec behavior.
3398
3399         * mozilla/mozilla-tests.yaml:
3400         This test is now outdated, so mark it as failing for that reason.
3401
3402         * test262.yaml:
3403         Passing all "cptn" completion value tests.
3404
3405 2017-06-17  Keith Miller  <keith_miller@apple.com>
3406
3407         ArrayBuffer constructor needs to create subclass structures before its buffer
3408         https://bugs.webkit.org/show_bug.cgi?id=173510
3409
3410         Reviewed by Yusuke Suzuki.
3411
3412         * test262.yaml:
3413
3414 2017-06-17  Keith Miller  <keith_miller@apple.com>
3415
3416         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
3417         https://bugs.webkit.org/show_bug.cgi?id=173506
3418
3419         Reviewed by Ryosuke Niwa.
3420
3421         Re-baseline tests.
3422
3423         * ChakraCore/test/Function/apply3.baseline-jsc:
3424         * test262.yaml:
3425
3426 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3427
3428         [JSC] Add fast path for Object.assign
3429         https://bugs.webkit.org/show_bug.cgi?id=173416
3430
3431         Reviewed by Mark Lam.
3432
3433         * stress/object-assign-changing-properties.js: Added.
3434         (shouldBe):
3435         (throw.new.Error.let.source.get x):
3436         (throw.new.Error):
3437         (shouldBe.let.source.get x):
3438         (shouldBe.let.target.set x):
3439         (shouldBe.let.target.get x):
3440         * stress/object-assign-proxy.js: Added.
3441         (shouldBe):
3442         (throw.new.Error.let.handler.get order):
3443
3444 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3445
3446         [JSC] Implement Object.assign in C++
3447         https://bugs.webkit.org/show_bug.cgi?id=173414
3448
3449         Reviewed by Saam Barati.
3450
3451         * stress/object-assign-string-first.js: Added.
3452         (shouldBe):
3453         (source.get Symbol):
3454         (source.get 1):
3455         (source.get cocoa):
3456
3457 2017-06-14  JF Bastien  <jfbastien@apple.com>
3458
3459         WebAssembly: remove empty test files
3460         https://bugs.webkit.org/show_bug.cgi?id=173382
3461
3462         Reviewed by Saam Barati.
3463
3464         The following files:
3465                 JSTests/wasm/function-tests/call-indirect-params.js
3466                 JSTests/wasm/function-tests/call-indirect.js
3467                 JSTests/wasm/js-api/call-indirect-results.js
3468         Were changed to empty files in https://trac.webkit.org/changeset/209771
3469
3470         They were testing call_indirect with the wrong semantics, before
3471         we implemented tables. That change implemented tables and
3472         therefore removed the erroneous tests.
3473
3474         We have a few tests for call_indirect which already do the right thing:
3475                 JSTests/wasm/function-tests/context-switch.js
3476                 JSTests/wasm/function-tests/exceptions.js
3477                 JSTests/wasm/function-tests/grow-memory-2.js
3478                 JSTests/wasm/function-tests/stack-overflow.js
3479                 JSTests/wasm/function-tests/table-basic-2.js
3480                 JSTests/wasm/function-tests/table-basic.js
3481                 JSTests/wasm/js-api/call-indirect.js
3482                 JSTests/wasm/js-api/table.js
3483                 JSTests/wasm/js-api/unique-signature.js
3484                 JSTests/wasm/js-api/wrapper-function.js
3485
3486         I also just imported the updated spec tests which, among other
3487         things, test call_indirect:
3488                 core/br.wast
3489                 core/br_table.wast
3490                 core/call_indirect.wast
3491                 core/func.wast
3492                 core/func_ptrs.wast
3493                 core/imports.wast
3494                 core/left-to-right.wast
3495                 core/linking.wast
3496                 core/nop.wast
3497                 core/return.wast
3498                 core/typecheck.wast
3499                 core/unreachable.wast
3500
3501         So I think it's OK to just delete the tests which should just have
3502         been deleted back when tables were added.
3503
3504         * wasm/function-tests/call-indirect-params.js: Removed.
3505         * wasm/function-tests/call-indirect.js: Removed.
3506         * wasm/js-api/call-indirect-results.js: Removed.
3507
3508 2017-06-13  JF Bastien  <jfbastien@apple.com>
3509
3510         WebAssembly: import updated spec tests
3511         https://bugs.webkit.org/show_bug.cgi?id=173287
3512         <rdar://problem/32725975>
3513
3514         Reviewed by Saam Barati.
3515
3516         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
3517         with a few modifications so things work.
3518
3519         Fix a bunch of bugs found through this process, and punt a few tests (which I
3520         marked as blocked by this bug).
3521
3522         Fixes:
3523
3524         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
3525         instead of byte alignment. It was also missing memory-alignment.js despite it
3526         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
3527         pass.
3528
3529         Tables can be imported or in a section. There can be only one, but sections can
3530         be empty. An Elements section can exist if there's no Table, as long as it is
3531         also empty.
3532
3533         Memories can be imported or in a section. There can be only one, but sections
3534         can be empty. A Data section can exist if there's no Memory, as long as it is
3535         also empty.
3536
3537         Prototypes: stringify without .prototype. in the string.
3538
3539         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
3540         not a final size, and throws a RangeError on failure, not a TypeError.
3541
3542         Fix compile / instantiate so the reject the promise if given an argument of the
3543         wrong type (instead of failing instantly).
3544
3545         Fix async on neuter test.
3546
3547         Element section shouldn't affect any Table if any of the elements are out of
3548         bounds. We need to process it in two passes.
3549
3550         Segment section shouldn't affect any Data if any of the segments are out of
3551         bounds. We need to process it in two passes.
3552
3553         Empty data segments are valid, but only when there is no memory. Their index
3554         still gets validated, and has to be zero.
3555
3556         Punts:
3557
3558         Error messages with context, the test seems overly restrictive but this is
3559         minor.
3560
3561         compile/instantiate/validate property descriptors.
3562
3563         UTF-8 bugs.
3564
3565         Temporarily disable NaN tests. We need to go back and implement the following
3566         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
3567         much as getting all the other tests passing.
3568
3569         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
3570         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
3571         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
3572         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
3573         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
3574         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
3575         why they're not allowed.
3576
3577         * wasm.yaml:
3578         * wasm/function-tests/i32-load8-s.js:
3579         * wasm/function-tests/memory-access-past-4gib.js:
3580         (const.op.of.WASM.opcodes):
3581         * wasm/function-tests/memory-alignment.js: Added.
3582         (const.op.of.WASM.opcodes):
3583         * wasm/function-tests/memory-section-and-import.js:
3584         * wasm/js-api/Module-compile.js:
3585         (async.testPromiseAPI):
3586         * wasm/js-api/dont-mmap-zero-byte-memory.js:
3587         (testMems):
3588         * wasm/js-api/element.js:
3589         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3590         * wasm/js-api/neutered-inputs.js:
3591         (const.testFunction): Deleted.
3592         (const.testConstructor): Deleted.
3593         * wasm/js-api/table.js:
3594         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3595         (new.WebAssembly.Module):
3596         (assert.throws):
3597         (assertBadTableImport):
3598         (assert.throws.WebAssembly.Table.prototype.grow):
3599         (assertBadTableInstance): Deleted.
3600         * wasm/js-api/test_Data.js:
3601         (DataSectionWithoutMemory):
3602         * wasm/spec-harness/index.js:
3603         (module):
3604         (uniqueTest): Deleted.
3605         (assert_invalid): Deleted.
3606         (assert_soft_invalid): Deleted.
3607         (register): Deleted.
3608         (call): Deleted.
3609         (get instance): Deleted.
3610         (exports): Deleted.
3611         (run): Deleted.
3612         (assert_unlinkable): Deleted.
3613         (assert_uninstantiable): Deleted.
3614         (assert_trap): Deleted.
3615         (try.f): Deleted.
3616         (catch): Deleted.
3617         (assert_exhaustion): Deleted.
3618         (assert_return): Deleted.
3619         (assert_return_nan): Deleted.
3620         * wasm/spec-harness/testharness.css: Removed.
3621         * wasm/spec-harness/testharness.js: Removed.
3622         * wasm/spec-harness/testharnessreport.js: Removed.
3623         * wasm/spec-harness/wasm-constants.js:
3624         (assertTraps):
3625         (assertWasmThrows):
3626         * wasm/spec-harness/wasm-module-builder.js:
3627         (Binary.prototype.emit_section):
3628         (Binary):
3629         (WasmFunctionBuilder.prototype.addBody):
3630         (WasmFunctionBuilder.prototype.end):
3631         (WasmFunctionBuilder):
3632         (WasmModuleBuilder.prototype.stringToBytes):
3633         (WasmModuleBuilder.prototype.addCustomSection):
3634         (WasmModuleBuilder.prototype.addFunctionTableInit):
3635         (WasmModuleBuilder.prototype.appendToTable):
3636         (WasmModuleBuilder.prototype.toArray):
3637         (WasmModuleBuilder.prototype.toBuffer):
3638         (WasmModuleBuilder.prototype.instantiate):
3639         (WasmModuleBuilder):
3640         * wasm/spec-tests/address.wast.js:
3641         * wasm/spec-tests/align.wast.js: Added.
3642         * wasm/spec-tests/binary.wast.js:
3643         * wasm/spec-tests/block.wast.js:
3644         * wasm/spec-tests/br.wast.js:
3645         * wasm/spec-tests/br_if.wast.js:
3646         * wasm/spec-tests/br_table.wast.js:
3647         * wasm/spec-tests/call.wast.js:
3648         * wasm/spec-tests/call_indirect.wast.js:
3649         * wasm/spec-tests/comments.wast.js:
3650         * wasm/spec-tests/const.wast.js: Added.
3651         * wasm/spec-tests/conversions.wast.js: Added.
3652         * wasm/spec-tests/custom_section.wast.js:
3653         * wasm/spec-tests/exports.wast.js:
3654         * wasm/spec-tests/f32.wast.js: Added.
3655         * wasm/spec-tests/f64.wast.js: Added.
3656         * wasm/spec-tests/fac.wast.js:
3657         * wasm/spec-tests/float_exprs.wast.js: Added.
3658         * wasm/spec-tests/float_misc.wast.js: Added.
3659         * wasm/spec-tests/func.wast.js:
3660         * wasm/spec-tests/globals.wast.js:
3661         * wasm/spec-tests/if.wast.js:
3662         * wasm/spec-tests/imports.wast.js:
3663         * wasm/spec-tests/inline-module.wast.js: Added.
3664         * wasm/spec-tests/jsapi.js:
3665         (testJSAPI.test):
3666         (testJSAPI):
3667         * wasm/spec-tests/labels.wast.js:
3668         * wasm/spec-tests/loop.wast.js:
3669         * wasm/spec-tests/memory.wast.js:
3670         * wasm/spec-tests/memory_trap.wast.js: Added.
3671         * wasm/spec-tests/names.wast.js:
3672         * wasm/spec-tests/nop.wast.js:
3673         * wasm/spec-tests/return.wast.js:
3674         * wasm/spec-tests/stack.wast.js:
3675         * wasm/spec-tests/token.wast.js: Added.
3676         * wasm/spec-tests/type.wast.js: Added.
3677         * wasm/spec-tests/typecheck.wast.js:
3678         * wasm/spec-tests/unreachable.wast.js:
3679         * wasm/spec-tests/unreached-invalid.wast.js:
3680         * wasm/spec-tests/unwind.wast.js:
3681         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
3682         * wasm/spec-tests/utf8-import-field.wast.js: Added.
3683         * wasm/spec-tests/utf8-import-module.wast.js: Added.
3684
3685 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
3686
3687         Unreviewed JSC test gardening.
3688
3689         * stress/check-string-ident.js:
3690         * stress/new-largeish-contiguous-array-with-size.js:
3691
3692 2017-06-13  Michael Saboff  <msaboff@apple.com>
3693
3694         DFG doesn't properly handle a property that is change to read only in a prototype
3695         https://bugs.webkit.org/show_bug.cgi?id=173321
3696
3697         Reviewed by Filip Pizlo.
3698
3699         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
3700         * stress/regress-173321.js: Added new regression test.
3701         (shouldBe):
3702         (SimpleObject):
3703         (test):
3704
3705 2017-06-12  Saam Barati  <sbarati@apple.com>
3706
3707         Update test262 test expectation since r218082 makes new tests pass.
3708
3709         * test262.yaml:
3710
3711 2017-06-12  Saam Barati  <sbarati@apple.com>
3712
3713         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
3714         https://bugs.webkit.org/show_bug.cgi?id=172957
3715         <rdar://problem/32602704>
3716
3717         Reviewed by Filip Pizlo.
3718
3719         * stress/spec-empty-flows-through-cell-checks.js: Added.
3720         (A):
3721         (B):
3722         (i.catch):
3723
3724 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
3725
3726         We incorrectly allow escaped characters in keyword tokens
3727         https://bugs.webkit.org/show_bug.cgi?id=171310
3728
3729         Reviewed by Yusuke Suzuki.
3730
3731         * stress/destructuring-assignment-syntax.js:
3732         * stress/error-messages-for-in-operator-should-not-crash.js:
3733         (catch):
3734         * stress/reserved-word-with-escape.js:
3735         (testSyntaxError.String.raw.v):
3736         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
3737         (testSyntaxError.String.raw.a):
3738         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
3739
3740 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3741
3742         [DFG] Add ArrayIndexOf intrinsic
3743         https://bugs.webkit.org/show_bug.cgi?id=172421
3744
3745         Reviewed by Saam Barati.
3746
3747         * stress/array-indexof-array-prototype-change.js: Added.
3748         (shouldBe):
3749         (indexOfInt32):
3750         * stress/array-indexof-have-a-bad-time-getter.js: Added.
3751         (shouldBe):
3752         (indexOfInt32):
3753         * stress/array-indexof-have-a-bad-time.js: Added.
3754         (shouldBe):
3755         (indexOfInt32):
3756         * stress/array-indexof-hole-with-prototype.js: Added.
3757         (shouldBe):
3758         (indexOf):
3759         * stress/array-indexof-hole.js: Added.
3760         (shouldBe):
3761         (indexOf):
3762         * stress/array-indexof-index.js: Added.
3763         (shouldBe):
3764         (indexOfInt32):
3765         (indexOfDouble):
3766         (indexOfString):
3767         (indexOfObject):
3768         (indexOfValue):
3769         * stress/array-indexof-negative-index.js: Added.
3770         (shouldBe):
3771         (indexOfInt32):
3772         (indexOfDouble):
3773         (indexOfString):
3774         (indexOfObject):
3775         (indexOfValue):
3776         * stress/array-indexof-non-int32-start-index.js: Added.
3777         (shouldBe):
3778         (indexOf):
3779         (object.valueOf):
3780         * stress/array-indexof-object-prototype-change.js: Added.
3781         (shouldBe):
3782         (indexOfInt32):
3783         * stress/array-indexof-object.js: Added.
3784         (shouldBe):
3785         (indexOf):
3786         * stress/array-indexof-original-array.js: Added.
3787         (shouldBe):
3788         (indexOfInt32):
3789         * stress/array-indexof-string.js: Added.
3790         (shouldBe):
3791         (indexOf):
3792         * stress/array-indexof-structure-change-convert.js: Added.
3793         (shouldBe):
3794         (indexOf):
3795         * stress/array-indexof-structure-change.js: Added.
3796         (shouldBe):
3797         (indexOf):
3798         * stress/array-indexof.js: Added.
3799         (shouldBe):
3800         (indexOf):
3801
3802 2017-06-11  Keith Miller  <keith_miller@apple.com>
3803
3804         TypedArray constructor with string shouldn't throw
3805         https://bugs.webkit.org/show_bug.cgi?id=173181
3806
3807         Reviewed by JF Bastien.
3808
3809         We should be coercing primitive arguments to numbers in the various
3810         TypedArray constructors.
3811
3812         * stress/typedarray-constructor.js:
3813
3814 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3815
3816         Unreviewed, update test results part 3
3817         https://bugs.webkit.org/show_bug.cgi?id=173227
3818
3819         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
3820
3821 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3822
3823         Unreviewed, update test results part 2
3824         https://bugs.webkit.org/show_bug.cgi?id=173227
3825
3826         * test262.yaml:
3827
3828 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3829
3830         Unreviewed, update test results
3831         https://bugs.webkit.org/show_bug.cgi?id=173227
3832
3833         * microbenchmarks/string-prototype-search-observable-side-effects.js:
3834         * test262.yaml:
3835
3836 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3837
3838         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
3839         https://bugs.webkit.org/show_bug.cgi?id=173227
3840
3841         Reviewed by Mark Lam.
3842
3843         Update the test.
3844
3845         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
3846
3847 2017-06-08  Keith Miller  <keith_miller@apple.com>
3848
3849         WebAssembly: We should only create wrappers for functions that can be exported
3850         https://bugs.webkit.org/show_bug.cgi?id=173088
3851
3852         Reviewed by Saam Barati.
3853
3854         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
3855         on the old testWasmModuleFunctions api, which has been removed.
3856
3857         * wasm/function-tests/copysign.js: Removed.
3858         * wasm/function-tests/ctz.js: Removed.
3859         * wasm/function-tests/drop.js: Removed.
3860         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
3861         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
3862         * wasm/function-tests/dumb-less-than-ite.js: Removed.
3863         * wasm/function-tests/eqz.js: Removed.
3864         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
3865         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
3866         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
3867         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
3868         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
3869         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
3870         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
3871         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
3872         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
3873         * wasm/function-tests/if-then-fallthrough.js: Removed.
3874         * wasm/function-tests/int-to-floating-point.js: Removed.
3875         * wasm/function-tests/loop-mult.js:
3876         * wasm/function-tests/loop-sum.js:
3877         * wasm/function-tests/max.js: Removed.
3878         * wasm/function-tests/min.js: Removed.
3879         * wasm/function-tests/nearest.js: Removed.
3880         * wasm/function-tests/nop.js: Removed.
3881         * wasm/function-tests/popcnt.js: Removed.
3882         * wasm/function-tests/ret5.js:
3883         * wasm/function-tests/select.js: Removed.
3884         * wasm/function-tests/tee-local.js: Removed.
3885         * wasm/function-tests/trunc.js: Removed.
3886
3887 2017-06-07  JF Bastien  <jfbastien@apple.com>
3888
3889         WebAssembly: test imports and exports with 16-bit characters
3890         https://bugs.webkit.org/show_bug.cgi?id=165977
3891         <rdar://problem/29760130>
3892
3893         Reviewed by Saam Barati.
3894
3895         The output for import failure was improved, so many tests need to
3896         be updated here. Only one has new tests as noted below.
3897
3898         * wasm/function-tests/memory-import-and-grow.js:
3899         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
3900         (idxModule):
3901         * wasm/js-api/global-error.js:
3902         (new.Number):
3903         (assert.throws):
3904         * wasm/js-api/table.js:
3905         (assert.throws):
3906         (new.WebAssembly.Table):
3907         * wasm/js-api/test_memory.js:
3908         (test):
3909         * wasm/js-api/wasm-to-wasm-bad-signature.js:
3910         (BadSignatureDropStartParams.):
3911         (BadSignatureDropStartParams):
3912         (BadSignatureDropEndParams.):
3913         (BadSignatureSwapParam.):
3914         (BadSignatureRet.):
3915         * wasm/js-api/web-assembly-instantiate.js:
3916         (assert.asyncTest.async.test):
3917         (assert.asyncTest):
3918         * wasm/js-api/wrapper-function.js:
3919         (return.new.WebAssembly.Module):
3920
3921 2017-06-07  Mark Lam  <mark.lam@apple.com>
3922
3923         Restrict the regress-173035.js test to only run on Darwin x86-64.
3924         https://bugs.webkit.org/show_bug.cgi?id=173075
3925
3926         Reviewed by Saam Barati.
3927
3928         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
3929         this test will require to succeed.  Here's an example of this failure:
3930         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
3931
3932         Since the issue is due to allocation of a very large amount of memory, the test
3933         will probably fail on iOS and other platforms as well.  Hence, we should just
3934         skip this test for any platforms that is not Darwin x86-64.
3935
3936         * stress/regress-173035.js:
3937
3938 2017-06-07  Mark Lam  <mark.lam@apple.com>
3939
3940         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
3941         https://bugs.webkit.org/show_bug.cgi?id=168587
3942
3943         Not reviewed.
3944
3945         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
3946
3947         * stress/test-finally.js:
3948
3949 2017-06-06  Mark Lam  <mark.lam@apple.com>
3950
3951         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
3952         https://bugs.webkit.org/show_bug.cgi?id=173035
3953         <rdar://problem/32554593>
3954
3955         Reviewed by Geoffrey Garen and Filip Pizlo.
3956
3957         * stress/regress-173035.js: Added.
3958
3959 2017-06-06  Saam Barati  <sbarati@apple.com>
3960
3961         Make sure we restore SP when doing calls that could be to JS
3962         https://bugs.webkit.org/show_bug.cgi?id=172946
3963         <rdar://problem/32579026>
3964
3965         Reviewed by JF Bastien.
3966
3967         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
3968         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
3969         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
3970         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
3971         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
3972
3973 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
3974
3975         Unreviewed rollout r217807. Caused a test to crash.
3976
3977         * heapProfiler/class-names.js: Removed.
3978         * heapProfiler/driver/driver.js:
3979         (CheapHeapSnapshotNode):
3980         (CheapHeapSnapshot):
3981         (createCheapHeapSnapshot):
3982         (HeapSnapshot):
3983         (createHeapSnapshot):
3984         * typeProfiler/inheritance.js:
3985         (wrapper.A):
3986         (wrapper.B):
3987         (wrapper.C):
3988         (wrapper):
3989
3990 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
3991
3992         index out of bound in bytecodebasicblock
3993         https://bugs.webkit.org/show_bug.cgi?id=172963
3994
3995         Reviewed by Saam Barati and Mark Lam.
3996
3997         * stress/dfg-call-class-constructor.js: Added.
3998         (Foo):
3999         (i.catch):
4000
4001 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
4002
4003         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
4004         https://bugs.webkit.org/show_bug.cgi?id=172848
4005         <rdar://problem/25709212>
4006
4007         Reviewed by Saam Barati.
4008
4009         * typeProfiler/inheritance.js:
4010         Rewrite the test slightly for clarity. The hoisting was confusing.
4011
4012         * heapProfiler/class-names.js: Added.
4013         (MyES5Class):
4014         (MyES6Class):
4015         (MyES6Subclass):
4016         Test object types and improved class names.
4017
4018         * heapProfiler/driver/driver.js:
4019         (CheapHeapSnapshotNode):
4020         (CheapHeapSnapshot):
4021         (createCheapHeapSnapshot):
4022         (HeapSnapshot):
4023         (createHeapSnapshot):
4024         Update snapshot parsing from version 1 to version 2.
4025
4026 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
4027
4028         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
4029         https://bugs.webkit.org/show_bug.cgi?id=168844
4030
4031         Reviewed by Saam Barati.
4032
4033         * modules/async-function-export.js: Added.
4034         (f):
4035         (export.async.f):
4036
4037 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
4038
4039         ES2015 modules - Export default function hoisting
4040         https://bugs.webkit.org/show_bug.cgi?id=170174
4041
4042         Reviewed by Saam Barati.
4043
4044         This issue itself is solved by fixing function declaration hoisting rules.
4045         This patch just adds the specific test to modules tests to ensure the bug
4046         is fixed.
4047
4048         * modules/export-default-function-hoisting.js: Added.
4049         * modules/export-default-function-hoisting/cappuccino.js: Added.
4050         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
4051         * modules/export-default-function-hoisting/cocoa.js: Added.
4052         (export.default.drinkCocoa):
4053
4054 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
4055
4056         Class Proxy can't be extended
4057         https://bugs.webkit.org/show_bug.cgi?id=169040
4058
4059         Reviewed by Saam Barati.
4060
4061         Adding tests that check correctness of Proxy to ES6 `class`
4062         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
4063
4064         * stress/proxy-class.js: Added.
4065         (assert):
4066         (throw.new.Error.SuperClass):
4067         (throw.new.Error.A):
4068         (throw.new.Error):
4069
4070 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
4071
4072         [JSC] Implement String.prototype.concat in JS builtins
4073         https://bugs.webkit.org/show_bug.cgi?id=172798
4074
4075         Reviewed by Sam Weinig.
4076
4077         * microbenchmarks/string-concat-convert.js: Added.
4078         (test):
4079         * microbenchmarks/string-concat-long-convert.js: Added.
4080         (test):
4081         * microbenchmarks/string-concat-long.js: Added.
4082         (test):
4083         * microbenchmarks/string-concat.js: Added.
4084         (test):
4085
4086 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
4087
4088         Rolling out: Prevent async methods named 'function'
4089         https://bugs.webkit.org/show_bug.cgi?id=172776
4090
4091         Reviewed by Mark Lam.
4092
4093         * stress/async-await-syntax.js:
4094         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
4095         (testTopLevelAsyncAwaitSyntaxSloppyMode):
4096         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
4097         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
4098         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
4099
4100 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
4101
4102         Skip flaky JSC test stress/test-finally.js
4103         https://bugs.webkit.org/show_bug.cgi?id=168587
4104
4105         Unreviewed test gardening.
4106
4107         * stress/test-finally.js:
4108
4109 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
4110
4111         Prevent async methods named 'function' in Object literal
4112         https://bugs.webkit.org/show_bug.cgi?id=172660
4113
4114         Reviewed by Saam Barati.
4115
4116         * stress/async-await-syntax.js:
4117         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
4118
4119 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
4120
4121         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
4122         https://bugs.webkit.org/show_bug.cgi?id=171274
4123
4124         Reviewed by Saam Barati.
4125
4126         * stress/async-arrow-functions-lexical-binding-in-class.js:
4127         (shouldBeAsync):
4128         (shouldBeAsyncAndStoreBind):
4129         (promise.new.Promise):
4130         (ChildClass4):
4131         (ChildClass4.prototype.classValue):
4132         (ChildClass4.prototype.get classProperty):
4133         * stress/async-arrow-functions-lexical-super-binding.js:
4134         (A):
4135         (const.childA1.new.prototype.var.f.async):
4136         (const.childA1.new.var):
4137         (const.childA1.new):
4138         (const.childA2.new.prototype.var.f.async):
4139         (const.childA2.new.var):
4140         (const.childA2.new):
4141         (const.childA3.new.prototype.var.f.async):
4142         (const.childA3.new.var):
4143         (const.childA3.new):
4144         (try.childA4.new.prototype.var.f.async):
4145         (try.childA4.new.var):
4146         (try.childA4.new):
4147         (catch):
4148         (const.childA5.new.prototype.var.f.async):
4149         (const.childA5.new.var):
4150         (const.childA5.new):
4151         (checkClass):
4152         (checkClass.new.prototype.var.f.async):
4153         (checkClass.new.var):
4154         (checkClass.new):
4155         (checkClass.new.prototype.method):
4156         (checkClass.new.prototype.prop):
4157
4158 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
4159
4160         [JSC] Map and Set constructors should have fast path for cloning
4161         https://bugs.webkit.org/show_bug.cgi?id=172413
4162
4163         Reviewed by Saam Barati.
4164
4165         * stress/map-clone-instance-iterator-change.js: Added.
4166         (shouldBe):
4167         (map.Symbol.iterator):
4168         * stress/map-clone-iterator-change.js: Added.
4169         (shouldBe):
4170         (Map.prototype.Symbol.iterator):
4171         * stress/map-clone-next-change.js: Added.
4172         (shouldBe):
4173         (map.Symbol.iterator.__proto__.next):
4174         * stress/map-clone.js: Added.
4175         (shouldBe):
4176         (Map.prototype):
4177         * stress/map-inherit-set.js: Added.
4178         (shouldBe):
4179         (DerivedMap):
4180         (set for):
4181         * stress/set-clone-instance-iterator-change.js: Added.
4182         (shouldBe):
4183         (set Symbol.iterator):
4184         * stress/set-clone-iterator-change.js: Added.
4185         (shouldBe):
4186         (set Set.prototype.Symbol.iterator):
4187         * stress/set-clone-next-change.js: Added.
4188         (shouldBe):
4189         (set Symbol.iterator.__proto__.next):
4190         * stress/set-clone.js: Added.
4191         (shouldBe):
4192         (set Set.prototype.add):
4193         * stress/set-inherit-add.js: Added.
4194         (shouldBe):
4195         (DerivedSet.set add):
4196
4197 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
4198
4199         Unreviewed, rolling out r217458.
4200
4201         This change caused 55 JSC test failures.
4202
4203         Reverted changeset:
4204
4205         "Date should use historical data if it's available."
4206         https://bugs.webkit.org/show_bug.cgi?id=172592
4207         http://trac.webkit.org/changeset/217458
4208
4209 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
4210
4211         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
4212         https://bugs.webkit.org/show_bug.cgi?id=167805
4213
4214         Reviewed by Saam Barati.
4215
4216         * modules/module-jit-reachability.js: Added.
4217
4218 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
4219
4220         Prevent async methods named 'function'
4221         https://bugs.webkit.org/show_bug.cgi?id=172598
4222
4223         Reviewed by Mark Lam.
4224
4225         * stress/async-await-syntax.js:
4226         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
4227         (testTopLevelAsyncAwaitSyntaxSloppyMode):
4228         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
4229         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
4230         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
4231
4232 2017-05-25  Keith Miller  <keith_miller@apple.com>
4233
4234         Date should use historical data if it's available.
4235         https://bugs.webkit.org/show_bug.cgi?id=172592
4236
4237         Reviewed by Mark Lam.
4238
4239         Remove parts of the date tests that rely on the absence of
4240         historical data in Date.
4241
4242         * mozilla/ecma/Date/15.9.5.31-1.js:
4243         (getTestCases):
4244         * mozilla/ecma/Date/15.9.5.35-1.js:
4245         (getTestCases):
4246
4247 2017-05-25  Saam Barati  <sbarati@apple.com>
4248
4249         Our for-in optimization in the bytecode generator does its static analysis incorrectly
4250         https://bugs.webkit.org/show_bug.cgi?id=172532
4251         <rdar://problem/32369452>
4252
4253         Reviewed by Mark Lam.
4254
4255         * stress/for-in-invalidation-for-any-write.js: Added.
4256         (assert):
4257         (test):
4258         (test.i):
4259
4260 2017-05-25  Mark Lam  <mark.lam@apple.com>
4261
4262         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
4263         https://bugs.webkit.org/show_bug.cgi?id=172548
4264         <rdar://problem/31458393>
4265
4266         Reviewed by Filip Pizlo.
4267
4268         * stress/regress-172548.patch: Added.
4269
4270 2017-05-23  Saam Barati  <sbarati@apple.com>
4271
4272         We should not mmap zero bytes for a memory in Wasm
4273         https://bugs.webkit.org/show_bug.cgi?id=172528
4274         <rdar://problem/32257076>
4275
4276         Reviewed by Mark Lam.
4277
4278         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
4279         (testMems):
4280
4281 2017-05-23  Saam Barati  <sbarati@apple.com>
4282
4283         CFGSimplificationPhase should not merge a block with itself
4284         https://bugs.webkit.org/show_bug.cgi?id=172508
4285         <rdar://problem/28424006>
4286
4287         Reviewed by Keith Miller.
4288
4289         * stress/dont-crash-in-cfg-simplification.js: Added.
4290         (bar):
4291         (baz):
4292         (foo):
4293
4294 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
4295
4296         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
4297         https://bugs.webkit.org/show_bug.cgi?id=172216
4298
4299         Reviewed by Saam Barati.
4300
4301         * stress/array-storage-get-by-val.js: Added.
4302         (shouldBe):
4303         (testOutOfBound):
4304         (testInBound):
4305         (testSlowPutOutOfBound):
4306         (testSlowPutInBound):
4307
4308 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
4309
4310         Unreviewed, fix commented out tests
4311         https://bugs.webkit.org/show_bug.cgi?id=172225
4312
4313         * stress/get-by-val-string.js:
4314         (object.43):
4315         (Hello):
4316         (Hello.prototype.get 42):
4317         (Hello.prototype.43):
4318         (Derived):
4319         (shouldBe):
4320         (throw.new.Error): Deleted.
4321
4322 2017-05-21  Saam Barati  <sbarati@apple.com>
4323
4324         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
4325         https://bugs.webkit.org/show_bug.cgi?id=171041
4326         <rdar://problem/32082516>
4327
4328         Reviewed by Yusuke Suzuki.
4329
4330         * stress/lexical-scoping-for-loop.js: Added.
4331         (assert):
4332         (test1):
4333         (test2):
4334         (test3):
4335         (test4):
4336         (test5):
4337         (test6):
4338         (let.test7):
4339         (let.test8):
4340         (let.test9):
4341         (let.test10):
4342         (let.test11):
4343         (let.test12):
4344
4345 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
4346
4347         [JSC] Make get_by_val & string "499" to number 499
4348         https://bugs.webkit.org/show_bug.cgi?id=172225
4349
4350         Reviewed by Saam Barati.
4351
4352         * stress/get-by-val-string.js: Added.
4353         (shouldBe):
4354         (shouldThrow):
4355         (object.43):
4356         (Hello):
4357         (Hello.prototype.get 42):
4358         (Hello.prototype.43):
4359         (Derived):
4360
4361 2017-05-19  Mark Lam  <mark.lam@apple.com>
4362
4363         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
4364         https://bugs.webkit.org/show_bug.cgi?id=172383
4365         <rdar://problem/31418651>
4366
4367         Reviewed by Filip Pizlo.
4368
4369         * stress/regress-172383.js: Added.
4370
4371 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
4372
4373         Unreviewed, rolling out r217156.
4374
4375         This change broke the iOS build.
4376
4377         Reverted changeset:
4378
4379         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
4380         result registers."
4381         https://bugs.webkit.org/show_bug.cgi?id=172383
4382         http://trac.webkit.org/changeset/217156
4383
4384 2017-05-19  Mark Lam  <mark.lam@apple.com>
4385
4386         Add missing exception check.
4387         https://bugs.webkit.org/show_bug.cgi?id=172346
4388         <rdar://problem/32289640>
4389
4390         Reviewed by Geoffrey Garen.
4391
4392         * stress/regress-172346.js: Added.
4393
4394 2017-05-19  Mark Lam  <mark.lam@apple.com>
4395
4396         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
4397         https://bugs.webkit.org/show_bug.cgi?id=172383
4398         <rdar://problem/31418651>
4399
4400         Reviewed by Filip Pizlo.
4401
4402         * stress/regress-172383.js: Added.
4403
4404 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
4405
4406         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
4407         https://bugs.webkit.org/show_bug.cgi?id=172369
4408
4409         Reviewed by Mark Lam.
4410
4411         * stress/undecided-concat.js: Added.
4412
4413 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
4414
4415         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
4416         https://bugs.webkit.org/show_bug.cgi?id=172098
4417
4418         Reviewed by Saam Barati.
4419
4420         * stress/check-sub-class.js: Added.
4421         (shouldBe):
4422         (shouldThrow):
4423         (calling):
4424         (array.forEach):
4425         (i.array.forEach):
4426
4427 2017-05-18  JF Bastien  <jfbastien@apple.com>
4428
4429         WebAssembly: exports is a getter
4430         https://bugs.webkit.org/show_bug.cgi?id=172129
4431 </