RegExpObject's collectMatches should not be using JSArray::push to fill in its match...
[WebKit-https.git] / JSTests / ChangeLog
1 2018-11-15  Mark Lam  <mark.lam@apple.com>
2
3         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
4         https://bugs.webkit.org/show_bug.cgi?id=191730
5         <rdar://problem/46048517>
6
7         Reviewed by Saam Barati.
8
9         * stress/regress-187006.js: Removed.
10           - this test is invalid because its sole purpose is to test for the non-spec
11             compliant behavior that we just fixed.
12
13         * stress/regress-191730.js: Added.
14
15 2018-11-15  Mark Lam  <mark.lam@apple.com>
16
17         RegExp operations should not take fast patch if lastIndex is not numeric.
18         https://bugs.webkit.org/show_bug.cgi?id=191731
19         <rdar://problem/46017305>
20
21         Reviewed by Saam Barati.
22
23         * stress/regress-191731.js: Added.
24
25 2018-11-13  Saam Barati  <sbarati@apple.com>
26
27         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
28         https://bugs.webkit.org/show_bug.cgi?id=191600
29
30         Reviewed by Mark Lam.
31
32         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
33         (foo):
34         (test):
35         (bar):
36
37 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
38
39         Unreviewed, rolling out r238132.
40
41         The test added with this change is timing out on Debug JSC
42         bots.
43
44         Reverted changeset:
45
46         "[BigInt] JSBigInt::createWithLength should throw when length
47         is greater than JSBigInt::maxLength"
48         https://bugs.webkit.org/show_bug.cgi?id=190836
49         https://trac.webkit.org/changeset/238132
50
51 2018-11-13  Mark Lam  <mark.lam@apple.com>
52
53         Add OOM detection to StringPrototype's substituteBackreferences().
54         https://bugs.webkit.org/show_bug.cgi?id=191563
55         <rdar://problem/45720428>
56
57         Reviewed by Saam Barati.
58
59         * stress/regress-191563.js: Added.
60
61 2018-11-13  Mark Lam  <mark.lam@apple.com>
62
63         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
64         https://bugs.webkit.org/show_bug.cgi?id=191579
65         <rdar://problem/45942472>
66
67         Reviewed by Saam Barati.
68
69         * stress/regress-191579.js: Added.
70
71 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
72
73         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
74         https://bugs.webkit.org/show_bug.cgi?id=190836
75
76         Reviewed by Saam Barati.
77
78         * stress/big-int-out-of-memory-tests.js: Added.
79
80 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
81
82         U+180E is no longer a whitespace character
83         https://bugs.webkit.org/show_bug.cgi?id=191415
84
85         Reviewed by Saam Barati.
86
87         * ChakraCore/test/es5/regexSpace.baseline:
88         * ChakraCore/test/es6/unicode_whitespace.js:
89         Update tests to latest version.
90         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
91
92         * test262.yaml:
93         * test262/config.yaml:
94         * test262/expectations.yaml:
95         Update expectations.
96
97 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
98
99         [BigInt] Add support to BigInt into ValueAdd
100         https://bugs.webkit.org/show_bug.cgi?id=186177
101
102         Reviewed by Keith Miller.
103
104         * stress/big-int-negate-jit.js:
105         * stress/value-add-big-int-and-string.js: Added.
106         * stress/value-add-big-int-prediction-propagation.js: Added.
107         * stress/value-add-big-int-untyped.js: Added.
108
109 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
110
111         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
112         https://bugs.webkit.org/show_bug.cgi?id=191184
113
114         Reviewed by Saam Barati.
115
116         Most tests were failing due to timeouts, since they are too slow to
117         run on CLoop. The exceptions are:
118
119         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
120         dont-crash-on-stack-overflow-when-parsing-builtin.js and
121         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
122         to change the stack size since CLoop requires it to be page aligned.
123
124         * microbenchmarks/array-push-1.js:
125         * microbenchmarks/array-push-2.js:
126         * microbenchmarks/elidable-new-object-dag.js:
127         * microbenchmarks/elidable-new-object-roflcopter.js:
128         * microbenchmarks/elidable-new-object-tree.js:
129         * microbenchmarks/getter-richards.js:
130         * microbenchmarks/sinkable-new-object-dag.js:
131         * microbenchmarks/string-concat-long-convert.js:
132         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
133         * slowMicrobenchmarks/array-push-3.js:
134         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
135         * slowMicrobenchmarks/spread-small-array.js:
136         * slowMicrobenchmarks/undefined-property-access.js:
137         * stress/activation-sink-default-value-tdz-error.js:
138         * stress/activation-sink-default-value.js:
139         * stress/activation-sink-osrexit-default-value-tdz-error.js:
140         * stress/activation-sink-osrexit-default-value.js:
141         * stress/activation-sink-osrexit.js:
142         * stress/activation-sink.js:
143         * stress/allow-math-ic-b3-code-duplication.js:
144         * stress/array-push-multiple-int32.js:
145         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
146         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
147         * stress/arrowfunction-lexical-this-activation-sink.js:
148         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
149         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
150         * stress/elide-new-object-dag-then-exit.js:
151         * stress/materialize-regexp-cyclic.js:
152         * stress/new-regex-inline.js:
153         * stress/op_add.js:
154         * stress/op_bitand.js:
155         * stress/op_bitor.js:
156         * stress/op_bitxor.js:
157         * stress/op_div-ConstVar.js:
158         * stress/op_div-VarConst.js:
159         * stress/op_div-VarVar.js:
160         * stress/op_lshift-ConstVar.js:
161         * stress/op_lshift-VarConst.js:
162         * stress/op_lshift-VarVar.js:
163         * stress/op_mod-ConstVar.js:
164         * stress/op_mod-VarConst.js:
165         * stress/op_mod-VarVar.js:
166         * stress/op_mul-ConstVar.js:
167         * stress/op_mul-VarConst.js:
168         * stress/op_mul-VarVar.js:
169         * stress/op_rshift-ConstVar.js:
170         * stress/op_rshift-VarConst.js:
171         * stress/op_rshift-VarVar.js:
172         * stress/op_sub-ConstVar.js:
173         * stress/op_sub-VarConst.js:
174         * stress/op_sub-VarVar.js:
175         * stress/op_urshift-ConstVar.js:
176         * stress/op_urshift-VarConst.js:
177         * stress/op_urshift-VarVar.js:
178         * stress/proxy-get-set-correct-receiver.js:
179         * stress/regress-179562.js:
180         * stress/rest-parameter-many-arguments.js:
181         * stress/sampling-profiler-richards.js:
182         * stress/splay-flash-access-1ms.js:
183         * stress/tailCallForwardArguments.js:
184         * stress/typed-array-get-by-val-profiling.js:
185         * typeProfiler/getter-richards.js:
186
187 2018-11-06  Michael Saboff  <msaboff@apple.com>
188
189         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
190         https://bugs.webkit.org/show_bug.cgi?id=191271
191
192         Reviewed by Saam Barati.
193
194         Added more test cases and made all test cases run with the same deeply recursive stack
195         instead of finding that same point for each test case.
196
197         * stress/regexp-compile-oom.js:
198         (prototype.runTest):
199         (recurseAndTest):
200         (testList.push.new.TestAndExpectedException):
201
202 2018-11-05  Michael Saboff  <msaboff@apple.com>
203
204         Unreviewed build fix for linux.
205
206         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
207
208 2018-11-02  Michael Saboff  <msaboff@apple.com>
209
210         Rolling in r237753 with unreviewed build fix.
211
212         Fixed issues with DECLARE_THROW_SCOPE placement.
213
214 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
215
216         Unreviewed, rolling out r237753.
217
218         Introduced JSC test failures
219
220         Reverted changeset:
221
222         "Running out of stack space not properly handled in
223         RegExp::compile() and its callers"
224         https://bugs.webkit.org/show_bug.cgi?id=191206
225         https://trac.webkit.org/changeset/237753
226
227 2018-11-02  Michael Saboff  <msaboff@apple.com>
228
229         Running out of stack space not properly handled in RegExp::compile() and its callers
230         https://bugs.webkit.org/show_bug.cgi?id=191206
231
232         Reviewed by Filip Pizlo.
233
234         New regression test.
235
236         * stress/regexp-compile-oom.js: Added.
237         (recurseAndTest):
238
239 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
240
241         Skip tests on arm/mips that time out now we're running on CLoop
242
243         Unreviewed gardening.
244
245         Since the JIT is temporarily disabled on 32-bit platforms, these tests
246         time out on the bots and need to be disabled. There's more tests
247         disabled on arm because the timeout is longer on the mips bot (as the
248         device is slower to start with), so many of the tests don't time out
249         there.
250
251         * microbenchmarks/getter-richards.js: disable on arm and mips.
252         * stress/op_add.js: disable on arm.
253         * stress/op_bitand.js: disable on arm.
254         * stress/op_bitor.js: disable on arm.
255         * stress/op_bitxor.js: disable on arm.
256         * stress/op_lshift-ConstVar.js: disable on arm.
257         * stress/op_lshift-VarConst.js: disable on arm.
258         * stress/op_lshift-VarVar.js: disable on arm.
259         * stress/op_mod-ConstVar.js: disable on arm.
260         * stress/op_mod-VarConst.js: disable on arm.
261         * stress/op_mod-VarVar.js: disable on arm.
262         * stress/op_mul-ConstVar.js: disable on arm.
263         * stress/op_mul-VarConst.js: disable on arm.
264         * stress/op_mul-VarVar.js: disable on arm.
265         * stress/op_rshift-ConstVar.js: disable on arm.
266         * stress/op_rshift-VarConst.js: disable on arm.
267         * stress/op_rshift-VarVar.js: disable on arm.
268         * stress/op_sub-ConstVar.js: disable on arm.
269         * stress/op_sub-VarConst.js: disable on arm.
270         * stress/op_sub-VarVar.js: disable on arm.
271         * stress/op_urshift-ConstVar.js: disable on arm.
272         * stress/op_urshift-VarConst.js: disable on arm.
273         * stress/op_urshift-VarVar.js: disable on arm.
274         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
275         * stress/value-to-boolean.js: disable on arm and mips.
276
277 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
278
279         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
280         https://bugs.webkit.org/show_bug.cgi?id=191108
281         <rdar://problem/45690700>
282
283         Reviewed by Saam Barati.
284
285         * stress/wide-op_catch.js: Added.
286         (catch):
287
288 2018-10-29  Mark Lam  <mark.lam@apple.com>
289
290         Correctly detect string overflow when using the 'Function' constructor.
291         https://bugs.webkit.org/show_bug.cgi?id=184883
292         <rdar://problem/36320331>
293
294         Reviewed by Saam Barati.
295
296         I've verified that this passes on 32-bit as well.
297
298         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
299
300 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
301
302         Add support for GetStack FlushedDouble
303         https://bugs.webkit.org/show_bug.cgi?id=191012
304         <rdar://problem/45265141>
305
306         Reviewed by Saam Barati.
307
308         * stress/get-stack-double.js: Added.
309         (bar):
310         (noInline):
311
312 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
313
314         New bytecode format for JSC
315         https://bugs.webkit.org/show_bug.cgi?id=187373
316         <rdar://problem/44186758>
317
318         Reviewed by Filip Pizlo.
319
320         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
321
322         * stress/maximum-inline-capacity.js: Added.
323         (test1):
324         (test3.Foo):
325         (test3):
326
327 2018-10-26  Commit Queue  <commit-queue@webkit.org>
328
329         Unreviewed, rolling out r237479 and r237484.
330         https://bugs.webkit.org/show_bug.cgi?id=190978
331
332         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
333
334         Reverted changesets:
335
336         "New bytecode format for JSC"
337         https://bugs.webkit.org/show_bug.cgi?id=187373
338         https://trac.webkit.org/changeset/237479
339
340         "Gardening: Build fix after r237479."
341         https://bugs.webkit.org/show_bug.cgi?id=187373
342         https://trac.webkit.org/changeset/237484
343
344 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
345
346         New bytecode format for JSC
347         https://bugs.webkit.org/show_bug.cgi?id=187373
348         <rdar://problem/44186758>
349
350         Reviewed by Filip Pizlo.
351
352         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
353
354         * stress/maximum-inline-capacity.js: Added.
355         (test1):
356         (test3.Foo):
357         (test3):
358
359 2018-10-26  Mark Lam  <mark.lam@apple.com>
360
361         Fix missing edge cases with JSGlobalObjects having a bad time.
362         https://bugs.webkit.org/show_bug.cgi?id=189028
363         <rdar://problem/45204939>
364
365         Reviewed by Saam Barati.
366
367         * stress/regress-189028.js: Added.
368
369 2018-10-22  Mark Lam  <mark.lam@apple.com>
370
371         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
372         https://bugs.webkit.org/show_bug.cgi?id=190515
373         <rdar://problem/45222379>
374
375         Rubber-stamped by Saam Barati.
376
377         Adding another test.
378
379         * stress/regress-190515-2.js: Added.
380
381 2018-10-22  Mark Lam  <mark.lam@apple.com>
382
383         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
384         https://bugs.webkit.org/show_bug.cgi?id=190515
385         <rdar://problem/45222379>
386
387         Reviewed by Saam Barati.
388
389         * stress/regress-190515.js: Added.
390
391 2018-10-19  Commit Queue  <commit-queue@webkit.org>
392
393         Unreviewed, rolling out r237254.
394         https://bugs.webkit.org/show_bug.cgi?id=190760
395
396         "It regresses JetStream 2 by 5% on some iOS devices"
397         (Requested by saamyjoon on #webkit).
398
399         Reverted changeset:
400
401         "[JSC] JSC should have "parseFunction" to optimize Function
402         constructor"
403         https://bugs.webkit.org/show_bug.cgi?id=190340
404         https://trac.webkit.org/changeset/237254
405
406 2018-10-19  Saam Barati  <sbarati@apple.com>
407
408         vmCall should check if we exit before emitting an OSR exit due to exceptions
409         https://bugs.webkit.org/show_bug.cgi?id=190740
410         <rdar://problem/45220139>
411
412         Reviewed by Mark Lam.
413
414         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
415         (foo):
416
417 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
418
419         [ESNext][BigInt] Implement support for "^"
420         https://bugs.webkit.org/show_bug.cgi?id=186235
421
422         Reviewed by Yusuke Suzuki.
423
424         * stress/big-int-bitwise-xor-general.js: Added.
425         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
426         * stress/big-int-bitwise-xor-type-error.js: Added.
427         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
428
429 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
430
431         [BigInt] Add ValueSub into DFG
432         https://bugs.webkit.org/show_bug.cgi?id=186176
433
434         Reviewed by Yusuke Suzuki.
435
436         * stress/big-int-subtraction-jit.js:
437         * stress/value-sub-big-int-prediction-propagation.js: Added.
438         * stress/value-sub-big-int-untyped.js: Added.
439         * stress/value-sub-spec-none-case.js: Added.
440
441 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
442
443         [JSC] JSC should have "parseFunction" to optimize Function constructor
444         https://bugs.webkit.org/show_bug.cgi?id=190340
445
446         Reviewed by Mark Lam.
447
448         This patch fixes the line number of syntax errors raised by the Function constructor,
449         since we now parse the final code only once. And we no longer use block statement
450         for Function constructor's parsing.
451
452         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
453         * stress/function-cache-with-parameters-end-position.js: Added.
454         (shouldBe):
455         (shouldThrow):
456         (i.anonymous):
457         * stress/function-constructor-name.js: Added.
458         (shouldBe):
459         (GeneratorFunction):
460         (AsyncFunction.async):
461         (AsyncGeneratorFunction.async):
462         (anonymous):
463         (async.anonymous):
464         * test262/expectations.yaml:
465
466 2018-10-18  Commit Queue  <commit-queue@webkit.org>
467
468         Unreviewed, rolling out r237242.
469         https://bugs.webkit.org/show_bug.cgi?id=190701
470
471         it breaks "stress/sampling-profiler-basic.js" (Requested by
472         caiolima on #webkit).
473
474         Reverted changeset:
475
476         "[BigInt] Add ValueSub into DFG"
477         https://bugs.webkit.org/show_bug.cgi?id=186176
478         https://trac.webkit.org/changeset/237242
479
480 2018-10-17  Keith Miller  <keith_miller@apple.com>
481
482         AI does not clear Phantom allocation nodes.
483         https://bugs.webkit.org/show_bug.cgi?id=190694
484
485         Reviewed by Saam Barati.
486
487         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
488         (Day):
489         (DaysInYear):
490         (TimeInYear):
491         (TimeFromYear):
492         (DayFromYear):
493         (InLeapYear):
494         (YearFromTime):
495         (WeekDay):
496         (DaylightSavingTA):
497         (GetSecondSundayInMarch):
498         (TimeInMonth):
499
500 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
501
502         [BigInt] Add ValueSub into DFG
503         https://bugs.webkit.org/show_bug.cgi?id=186176
504
505         Reviewed by Yusuke Suzuki.
506
507         * stress/big-int-subtraction-jit.js:
508         * stress/value-sub-big-int-prediction-propagation.js: Added.
509         * stress/value-sub-big-int-untyped.js: Added.
510
511 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
512
513         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
514         https://bugs.webkit.org/show_bug.cgi?id=190611
515
516         Reviewed by Saam Barati.
517
518         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
519         to improve test runtime. On ARM/MIPS this test even timed out when running all
520         tests.
521
522         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
523         (test):
524
525 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
526
527         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
528
529         Unreviewed gardening.
530
531         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
532
533 2018-10-15  Saam barati  <sbarati@apple.com>
534
535         Emit fjcvtzs on ARM64E on Darwin
536         https://bugs.webkit.org/show_bug.cgi?id=184023
537
538         Reviewed by Yusuke Suzuki and Filip Pizlo.
539
540         * stress/double-to-int32-NaN.js: Added.
541         (assert):
542         (foo):
543
544 2018-10-15  Saam Barati  <sbarati@apple.com>
545
546         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
547         https://bugs.webkit.org/show_bug.cgi?id=190262
548         <rdar://problem/44986241>
549
550         Reviewed by Mark Lam.
551
552         * stress/array-prototype-concat-of-long-spliced-arrays.js:
553         (test):
554         * stress/slice-array-storage-with-holes.js: Added.
555         (main):
556
557 2018-10-15  Commit Queue  <commit-queue@webkit.org>
558
559         Unreviewed, rolling out r237054.
560         https://bugs.webkit.org/show_bug.cgi?id=190593
561
562         "this regressed JetStream 2 by 6% on iOS" (Requested by
563         saamyjoon on #webkit).
564
565         Reverted changeset:
566
567         "[JSC] JSC should have "parseFunction" to optimize Function
568         constructor"
569         https://bugs.webkit.org/show_bug.cgi?id=190340
570         https://trac.webkit.org/changeset/237054
571
572 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
573
574         [JSC] JSON.stringify can accept call-with-no-arguments
575         https://bugs.webkit.org/show_bug.cgi?id=190343
576
577         Reviewed by Mark Lam.
578
579         * stress/json-stringify-no-arguments.js: Added.
580         (shouldBe):
581
582 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
583
584         [JSC] JSC should have "parseFunction" to optimize Function constructor
585         https://bugs.webkit.org/show_bug.cgi?id=190340
586
587         Reviewed by Mark Lam.
588
589         This patch fixes the line number of syntax errors raised by the Function constructor,
590         since we now parse the final code only once. And we no longer use block statement
591         for Function constructor's parsing.
592
593         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
594         * stress/function-cache-with-parameters-end-position.js: Added.
595         (shouldBe):
596         (shouldThrow):
597         (i.anonymous):
598         * stress/function-constructor-name.js: Added.
599         (shouldBe):
600         (GeneratorFunction):
601         (AsyncFunction.async):
602         (AsyncGeneratorFunction.async):
603         (anonymous):
604         (async.anonymous):
605         * test262/expectations.yaml:
606
607 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
608
609         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
610         https://bugs.webkit.org/show_bug.cgi?id=190426
611
612         Unreviewed gardening.
613
614         * stress/sampling-profiler-richards.js:
615
616 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
617
618         [ESNext][BigInt] Implement support for "|"
619         https://bugs.webkit.org/show_bug.cgi?id=186229
620
621         Reviewed by Yusuke Suzuki.
622
623         * stress/big-int-bitwise-and-jit.js:
624         * stress/big-int-bitwise-or-general.js: Added.
625         * stress/big-int-bitwise-or-jit-untyped.js: Added.
626         * stress/big-int-bitwise-or-jit.js: Added.
627         * stress/big-int-bitwise-or-memory-stress.js: Added.
628         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
629         * stress/big-int-bitwise-or-type-error.js: Added.
630         * stress/big-int-bitwise-or-wrapped-value.js: Added.
631
632 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
633
634         Skip test on systems with limited memory
635         https://bugs.webkit.org/show_bug.cgi?id=190310
636
637         Invoking runDefault adds test to runlist, skipping the test in the next
638         line does not prevent the test from executing. Change order of lines such
639         that runDefault is only executed if test is not executed.
640
641         Reviewed by Mark Lam.
642
643         * stress/regress-190187.js:
644
645 2018-10-03  Saam barati  <sbarati@apple.com>
646
647         lowXYZ in FTLLower should always filter the type of the incoming edge
648         https://bugs.webkit.org/show_bug.cgi?id=189939
649         <rdar://problem/44407030>
650
651         Reviewed by Michael Saboff.
652
653         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
654         (foo):
655         (test):
656
657 2018-10-03  Mark Lam  <mark.lam@apple.com>
658
659         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
660         https://bugs.webkit.org/show_bug.cgi?id=190187
661         <rdar://problem/42512909>
662
663         Reviewed by Michael Saboff.
664
665         * stress/regress-190187.js: Added.
666
667 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
668
669         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
670         https://bugs.webkit.org/show_bug.cgi?id=190033
671
672         Reviewed by Yusuke Suzuki.
673
674         * stress/big-int-to-string.js:
675
676 2018-10-01  Mark Lam  <mark.lam@apple.com>
677
678         Function.toString() should also copy the source code Functions that are class definitions.
679         https://bugs.webkit.org/show_bug.cgi?id=190186
680         <rdar://problem/44733360>
681
682         Reviewed by Saam Barati.
683
684         * stress/regress-190186.js: Added.
685
686 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
687
688         Split NaN-check into separate test
689         https://bugs.webkit.org/show_bug.cgi?id=190010
690
691         Reviewed by Saam Barati.
692
693         DataView exposes NaN-representation, which is not necessarily the same on each
694         architecture. Therefore move the check of the NaN-representation into its own
695         file such that we can disable this test on MIPS where NaN-representation can be
696         different on older CPUs.
697
698         * stress/dataview-jit-set-nan.js: Added.
699         (assert):
700         (test.storeLittleEndian):
701         (test.storeBigEndian):
702         (test.store):
703         (test):
704         * stress/dataview-jit-set.js:
705         (test5):
706
707 2018-10-01  Commit Queue  <commit-queue@webkit.org>
708
709         Unreviewed, rolling out r236647.
710         https://bugs.webkit.org/show_bug.cgi?id=190124
711
712         Breaking test stress/big-int-to-string.js (Requested by
713         caiolima_ on #webkit).
714
715         Reverted changeset:
716
717         "[BigInt] BigInt.proptotype.toString is broken when radix is
718         power of 2"
719         https://bugs.webkit.org/show_bug.cgi?id=190033
720         https://trac.webkit.org/changeset/236647
721
722 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
723
724         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
725         https://bugs.webkit.org/show_bug.cgi?id=190033
726
727         Reviewed by Yusuke Suzuki.
728
729         * stress/big-int-to-string.js:
730
731 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
732
733         [ESNext][BigInt] Implement support for "&"
734         https://bugs.webkit.org/show_bug.cgi?id=186228
735
736         Reviewed by Yusuke Suzuki.
737
738         * stress/big-int-bitwise-and-general.js: Added.
739         (assert):
740         (assert.sameValue):
741         * stress/big-int-bitwise-and-jit.js: Added.
742         (let.assert.sameValue):
743         (bigIntBitAnd):
744         * stress/big-int-bitwise-and-memory-stress.js: Added.
745         (assert):
746         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
747         (assert.sameValue):
748         (let.o.Symbol.toPrimitive):
749         (catch):
750         * stress/big-int-bitwise-and-type-error.js: Added.
751         (assert):
752         (assertThrowTypeError):
753         (let.o.valueOf):
754         (o.valueOf):
755         (o.toString):
756         (o.Symbol.toPrimitive):
757         * stress/big-int-bitwise-and-wrapped-value.js: Added.
758         (assert.sameValue):
759         (testBitAnd):
760         (let.o.Symbol.toPrimitive):
761         (o.valueOf):
762         (o.toString):
763
764 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
765
766         JSC test stress/jsc-read.js doesn't support CRLF
767         https://bugs.webkit.org/show_bug.cgi?id=190063
768
769         Reviewed by Yusuke Suzuki.
770
771         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
772
773         * stress/jsc-read.js:
774         (test):
775
776 2018-09-27  Saam barati  <sbarati@apple.com>
777
778         Verify the contents of AssemblerBuffer on arm64e
779         https://bugs.webkit.org/show_bug.cgi?id=190057
780         <rdar://problem/38916630>
781
782         Reviewed by Mark Lam.
783
784         * stress/regress-189132.js:
785
786 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
787
788         Disable test without LLInt on ARMv7
789         https://bugs.webkit.org/show_bug.cgi?id=190037
790
791         Reviewed by Mark Lam.
792
793         Test runs out of executable memory on ARMv7, do not run
794         this test without LLInt enabled.
795
796         * stress/regress-169445.js:
797
798 2018-09-26  Keith Miller  <keith_miller@apple.com>
799
800         We should zero unused property storage when rebalancing array storage.
801         https://bugs.webkit.org/show_bug.cgi?id=188151
802
803         Reviewed by Michael Saboff.
804
805         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
806
807 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
808
809         [JSC] Optimize Array#lastIndexOf
810         https://bugs.webkit.org/show_bug.cgi?id=189780
811
812         Reviewed by Saam Barati.
813
814         * stress/array-lastindexof-array-prototype-trap.js: Added.
815         (shouldBe):
816         (AncestorArray.prototype.get 2):
817         (AncestorArray):
818         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
819         (shouldBe):
820         * stress/array-lastindexof-hole-nan.js: Added.
821         (shouldBe):
822         (throw.new.Error):
823         * stress/array-lastindexof-infinity.js: Added.
824         (shouldBe):
825         (throw.new.Error):
826         * stress/array-lastindexof-negative-zero.js: Added.
827         (shouldBe):
828         (throw.new.Error):
829         * stress/array-lastindexof-own-getter.js: Added.
830         (shouldBe):
831         (throw.new.Error.get array):
832         (get array):
833         * stress/array-lastindexof-prototype-trap.js: Added.
834         (shouldBe):
835         (DerivedArray.prototype.get 2):
836         (DerivedArray):
837
838 2018-09-25  Saam Barati  <sbarati@apple.com>
839
840         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
841         https://bugs.webkit.org/show_bug.cgi?id=189940
842         <rdar://problem/43640987>
843
844         Reviewed by Mark Lam.
845
846         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
847
848 2018-09-24  Saam Barati  <sbarati@apple.com>
849
850         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
851         https://bugs.webkit.org/show_bug.cgi?id=189922
852         <rdar://problem/44651275>
853
854         Reviewed by Mark Lam.
855
856         * stress/array-indexof-fast-path-effects.js: Added.
857         * stress/array-indexof-cached-length.js: Added.
858
859 2018-09-24  Saam barati  <sbarati@apple.com>
860
861         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
862         https://bugs.webkit.org/show_bug.cgi?id=189682
863         <rdar://problem/43557315>
864
865         Reviewed by Mark Lam.
866
867         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
868         (foo):
869
870 2018-09-22  Saam barati  <sbarati@apple.com>
871
872         The sampling should not use Strong<CodeBlock> in its machineLocation field
873         https://bugs.webkit.org/show_bug.cgi?id=189319
874
875         Reviewed by Filip Pizlo.
876
877         * stress/sampling-profiler-richards.js: Added.
878
879 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
880
881         [JSC] Optimize Array#indexOf in C++ runtime
882         https://bugs.webkit.org/show_bug.cgi?id=189507
883
884         Reviewed by Saam Barati.
885
886         * stress/array-indexof-array-prototype-trap.js: Added.
887         (shouldBe):
888         (AncestorArray.prototype.get 2):
889         (AncestorArray):
890         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
891         (shouldBe):
892         * stress/array-indexof-hole-nan.js: Added.
893         (shouldBe):
894         (throw.new.Error):
895         * stress/array-indexof-infinity.js: Added.
896         (shouldBe):
897         (throw.new.Error):
898         * stress/array-indexof-negative-zero.js: Added.
899         (shouldBe):
900         (throw.new.Error):
901         * stress/array-indexof-own-getter.js: Added.
902         (shouldBe):
903         (throw.new.Error.get array):
904         (get array):
905         * stress/array-indexof-prototype-trap.js: Added.
906         (shouldBe):
907         (DerivedArray.prototype.get 2):
908         (DerivedArray):
909
910 2018-09-19  Saam barati  <sbarati@apple.com>
911
912         AI rule for MultiPutByOffset executes its effects in the wrong order
913         https://bugs.webkit.org/show_bug.cgi?id=189757
914         <rdar://problem/43535257>
915
916         Reviewed by Michael Saboff.
917
918         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
919         (foo):
920         (Foo):
921         (g):
922
923 2018-09-17  Mark Lam  <mark.lam@apple.com>
924
925         Ensure that ForInContexts are invalidated if their loop local is over-written.
926         https://bugs.webkit.org/show_bug.cgi?id=189571
927         <rdar://problem/44402277>
928
929         Reviewed by Saam Barati.
930
931         * stress/regress-189571.js: Added.
932
933 2018-09-17  Saam barati  <sbarati@apple.com>
934
935         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
936         https://bugs.webkit.org/show_bug.cgi?id=189676
937         <rdar://problem/39682897>
938
939         Reviewed by Michael Saboff.
940
941         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
942         (A):
943         (K):
944         (i.catch):
945
946 2018-09-14  Saam barati  <sbarati@apple.com>
947
948         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
949         https://bugs.webkit.org/show_bug.cgi?id=189628
950         <rdar://problem/39481690>
951
952         Reviewed by Mark Lam.
953
954         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
955         (foo):
956
957 2018-09-11  Mark Lam  <mark.lam@apple.com>
958
959         Test for array initialization in arrayProtoFuncSplice.
960         https://bugs.webkit.org/show_bug.cgi?id=170253
961         <rdar://problem/31328773>
962
963         Rubber-stamped by Saam Barati.
964
965         * stress/regress-170253.js: Added.
966
967 2018-09-11  Mark Lam  <mark.lam@apple.com>
968
969         Test for IntlObject initialization.
970         https://bugs.webkit.org/show_bug.cgi?id=170251
971         <rdar://problem/31328419>
972
973         Rubber-stamped by Saam Barati.
974
975         * stress/regress-170251.js: Added.
976
977 2018-09-11  Mark Lam  <mark.lam@apple.com>
978
979         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
980         https://bugs.webkit.org/show_bug.cgi?id=169889
981         <rdar://problem/31155607>
982
983         Reviewed by Saam Barati.
984
985         * stress/regress-169889-array-concat.js: Added.
986         * stress/regress-169889-array-concat1.js: Added.
987         * stress/regress-169889-array-slice.js: Added.
988
989 2018-09-11  Mark Lam  <mark.lam@apple.com>
990
991         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
992         https://bugs.webkit.org/show_bug.cgi?id=169445
993         <rdar://problem/30957435>
994
995         Reviewed by Saam Barati.
996
997         * stress/regress-169445.js: Added.
998         (let.gun.eval.A):
999         (let.gun.eval.B.C):
1000         (let.gun.eval.B.C.prototype.trigger):
1001         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
1002         (let.gun.eval.B):
1003         (let.gun.eval):
1004
1005 == Rolled over to ChangeLog-2018-09-11 ==