JSTests/ChangeLog

   1 2017-09-15  Saam Barati  <sbarati@apple.com>
   2
   3         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
   4         https://bugs.webkit.org/show_bug.cgi?id=176981
   5
   6         Reviewed by Yusuke Suzuki.
   7
   8         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
   9         (assert):
  10         (verify):
  11         (func):
  12         (const.bar.createBuiltin):
  13
  14 2017-09-14  Saam Barati  <sbarati@apple.com>
  15
  16         It should be valid to exit before each set when doing arity fixup when inlining
  17         https://bugs.webkit.org/show_bug.cgi?id=176948
  18
  19         Reviewed by Keith Miller.
  20
  21         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
  22         (baz):
  23         (bar):
  24         (foo):
  25
  26 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
  27
  28         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
  29         https://bugs.webkit.org/show_bug.cgi?id=176867
  30
  31         Reviewed by Sam Weinig.
  32
  33         * microbenchmarks/object-get-own-property-symbols.js: Added.
  34         (test):
  35
  36 2017-09-13  Mark Lam  <mark.lam@apple.com>
  37
  38         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
  39         https://bugs.webkit.org/show_bug.cgi?id=176888
  40         <rdar://problem/34381832>
  41
  42         Not reviewed.
  43
  44         * stress/op_mod-ConstVar.js:
  45         * stress/op_mod-VarConst.js:
  46         * stress/op_mod-VarVar.js:
  47
  48 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
  49
  50         Skip 3 op_mod tests on Debug JSC bots.
  51         https://bugs.webkit.org/show_bug.cgi?id=176630
  52
  53         Unreviewed test gardening.
  54
  55         * stress/op_mod-ConstVar.js:
  56         * stress/op_mod-VarConst.js:
  57         * stress/op_mod-VarVar.js:
  58
  59 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
  60
  61         [JSC] Fix Array allocation in Object.keys
  62         https://bugs.webkit.org/show_bug.cgi?id=176826
  63
  64         Reviewed by Saam Barati.
  65
  66         * stress/object-own-property-keys.js: Added.
  67         (shouldBe):
  68
  69 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
  70
  71         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
  72         https://bugs.webkit.org/show_bug.cgi?id=176010
  73
  74         Reviewed by Filip Pizlo.
  75
  76         * microbenchmarks/weak-map-key.js: Added.
  77         (assert):
  78         (objectKey):
  79         (let.start.Date.now):
  80
  81 2017-09-12  Mark Lam  <mark.lam@apple.com>
  82
  83         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
  84         https://bugs.webkit.org/show_bug.cgi?id=176630
  85
  86         Reviewed by JF Bastien.
  87
  88         Debug builds are just slow, and these tests do a lot.  They pass when I run them
  89         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
  90         a speculative fix for the bots that are seeing these fail.
  91
  92         I also undid the skipping of the op_mod tests for debug builds.
  93
  94         * stress/op_div-ConstVar.js:
  95         * stress/op_div-VarConst.js:
  96         * stress/op_div-VarVar.js:
  97         * stress/op_mod-ConstVar.js:
  98         * stress/op_mod-VarConst.js:
  99         * stress/op_mod-VarVar.js:
 100
 101 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
 102
 103         Skip stress/value-to-boolean.js on Debug bots.
 104         https://bugs.webkit.org/show_bug.cgi?id=176787
 105
 106         Unreviewed test gardening.
 107
 108         * stress/value-to-boolean.js:
 109
 110 2017-09-11  Mark Lam  <mark.lam@apple.com>
 111
 112         Change test expectation for test262/test/language/statements/try/tco-catch.js
 113         https://bugs.webkit.org/show_bug.cgi?id=176749
 114
 115         Rubber stamped by Keith Miller.
 116
 117         It's been failing since at least r221821.  I'm changing the test expectation to
 118         fail to green the bots while I investigate some more.
 119
 120         * test262.yaml:
 121
 122 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
 123
 124         Unreviewed, rolling out r221854.
 125
 126         The test added with this change fails on 32-bit JSC bots.
 127
 128         Reverted changeset:
 129
 130         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
 131         https://bugs.webkit.org/show_bug.cgi?id=176010
 132         http://trac.webkit.org/changeset/221854
 133
 134 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
 135
 136         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
 137         https://bugs.webkit.org/show_bug.cgi?id=176010
 138
 139         Reviewed by Filip Pizlo.
 140
 141         * microbenchmarks/weak-map-key.js: Added.
 142         (assert):
 143         (objectKey):
 144         (let.start.Date.now):
 145
 146 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
 147
 148         [JSC] Optimize Object.keys by using careful array allocation
 149         https://bugs.webkit.org/show_bug.cgi?id=176654
 150
 151         Reviewed by Darin Adler.
 152
 153         * microbenchmarks/object-keys.js: Added.
 154         (test):
 155
 156 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
 157
 158         Error should compute .stack and friends lazily
 159         https://bugs.webkit.org/show_bug.cgi?id=176645
 160
 161         Reviewed by Saam Barati.
 162
 163         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
 164         * microbenchmarks/new-error.js: Added.
 165         * microbenchmarks/throw.js: Added.
 166
 167 2017-09-09  Mark Lam  <mark.lam@apple.com>
 168
 169         [Re-landing] Use JIT probes for DFG OSR exit.
 170         https://bugs.webkit.org/show_bug.cgi?id=175144
 171         <rdar://problem/33437050>
 172
 173         Not reviewed.  Original patch reviewed by Saam Barati.
 174
 175         Disable these tests for debug builds because they run too slow with the new OSR exit.
 176
 177         * stress/op_mod-ConstVar.js:
 178         * stress/op_mod-VarConst.js:
 179         * stress/op_mod-VarVar.js:
 180
 181 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 182
 183         [DFG] NewArrayWithSize(size)'s size does not care negative zero
 184         https://bugs.webkit.org/show_bug.cgi?id=176300
 185
 186         Reviewed by Saam Barati.
 187
 188         * stress/new-array-with-size-div.js: Added.
 189         (shouldBe):
 190         (test):
 191         (i.i):
 192
 193 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 194
 195         [DFG] PutByVal with Array::Generic is too generic
 196         https://bugs.webkit.org/show_bug.cgi?id=176345
 197
 198         Reviewed by Filip Pizlo.
 199
 200         * stress/object-assign-symbols.js: Added.
 201         (shouldBe):
 202         (test):
 203         * stress/object-assign.js: Added.
 204         (shouldBe):
 205         (test):
 206         (i.shouldBe.JSON.stringify.test):
 207
 208 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 209
 210         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
 211         https://bugs.webkit.org/show_bug.cgi?id=176590
 212
 213         Reviewed by Saam Barati.
 214
 215         * microbenchmarks/object-iterate-symbols.js: Added.
 216         (test):
 217         * microbenchmarks/object-iterate.js: Added.
 218         (test):
 219         * stress/object-iterate-symbols.js: Added.
 220         (shouldBe):
 221         (test):
 222         * stress/object-iterate.js: Added.
 223         (shouldBe):
 224         (test):
 225
 226 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
 227
 228         [Win32] 10 JSC stress tests are failing.
 229         https://bugs.webkit.org/show_bug.cgi?id=176538
 230
 231         Reviewed by Mark Lam.
 232
 233         Skip tests on Windows to make the bots green.
 234
 235         * ChakraCore.yaml:
 236         * stress/date-relaxed.js:
 237
 238 2017-09-06  Mark Lam  <mark.lam@apple.com>
 239
 240         constructGenericTypedArrayViewWithArguments() is missing an exception check.
 241         https://bugs.webkit.org/show_bug.cgi?id=176485
 242         <rdar://problem/33898874>
 243
 244         Reviewed by Keith Miller.
 245
 246         * stress/regress-176485.js: Added.
 247
 248 2017-09-05  Saam Barati  <sbarati@apple.com>
 249
 250         isNotCellSpeculation is wrong with respect to SpecEmpty
 251         https://bugs.webkit.org/show_bug.cgi?id=176429
 252
 253         Reviewed by Michael Saboff.
 254
 255         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
 256         (Foo):
 257
 258 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
 259
 260         test262: Completion values for control flow do not match the spec
 261         https://bugs.webkit.org/show_bug.cgi?id=171265
 262
 263         Reviewed by Saam Barati.
 264
 265         * stress/completion-value.js:
 266         Condensed test for completion values in top level statements.
 267
 268         * stress/super-get-by-id.js:
 269         ClassDeclaration when evaled no longer produce values. Convert
 270         these to ClassExpressions so they produce the class value.
 271
 272         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
 273         This is a progression for currect spec behavior.
 274
 275         * mozilla/mozilla-tests.yaml:
 276         This test is now outdated, so mark it as failing for that reason.
 277
 278         * test262.yaml:
 279         Passing all "cptn" completion value tests.
 280
 281 2017-09-04  Saam Barati  <sbarati@apple.com>
 282
 283         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
 284         https://bugs.webkit.org/show_bug.cgi?id=176317
 285
 286         Reviewed by Keith Miller.
 287
 288         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
 289         (Foo):
 290
 291 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
 292
 293         [DFG][FTL] Efficiently execute number#toString()
 294         https://bugs.webkit.org/show_bug.cgi?id=170007
 295
 296         Reviewed by Keith Miller.
 297
 298         * microbenchmarks/number-to-string-strength-reduction.js: Added.
 299         (test):
 300         * microbenchmarks/number-to-string-with-radix-10.js: Added.
 301         (test):
 302         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
 303         (test):
 304         * microbenchmarks/number-to-string-with-radix.js: Added.
 305         (test):
 306         * stress/number-to-string-strength-reduction.js: Added.
 307         (shouldBe):
 308         (test):
 309         * stress/number-to-string-with-radix-10.js: Added.
 310         (shouldBe):
 311         (test):
 312         * stress/number-to-string-with-radix-cse.js: Added.
 313         (shouldBe):
 314         (test):
 315         * stress/number-to-string-with-radix-invalid.js: Added.
 316         (shouldThrow):
 317         * stress/number-to-string-with-radix-watchpoint.js: Added.
 318         (shouldBe):
 319         (test):
 320         (i.i.1e3.Number.prototype.toString):
 321         * stress/number-to-string-with-radix.js: Added.
 322         (shouldBe):
 323         (test):
 324
 325 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
 326
 327         [DFG] Relax arity requirement
 328         https://bugs.webkit.org/show_bug.cgi?id=175523
 329
 330         Reviewed by Saam Barati.
 331
 332         * stress/arity-mismatch-arguments-length.js: Added.
 333         (shouldBe):
 334         (test1):
 335         (test):
 336         * stress/arity-mismatch-get-argument.js: Added.
 337         (shouldBe):
 338         (builtin.createBuiltin):
 339         (test):
 340         * stress/arity-mismatch-inlining-extra-slots.js: Added.
 341         (shouldBe):
 342         (inlineTarget):
 343         (test):
 344         * stress/arity-mismatch-inlining.js: Added.
 345         (shouldBe):
 346         (inlineTarget):
 347         (test):
 348         * stress/arity-mismatch-rest.js: Added.
 349         (shouldBe):
 350         (test2):
 351         (test1):
 352         (test):
 353
 354 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
 355
 356         [JSC] Fix "name" and "length" of Proxy revoke function
 357         https://bugs.webkit.org/show_bug.cgi?id=176155
 358
 359         Reviewed by Mark Lam.
 360
 361         * test262.yaml:
 362
 363 2017-08-31  Saam Barati  <sbarati@apple.com>
 364
 365         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
 366         https://bugs.webkit.org/show_bug.cgi?id=176206
 367
 368         Reviewed by Keith Miller.
 369
 370         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
 371         (a):
 372         (b):
 373         (foo):
 374
 375 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
 376
 377         Skip two slow JSC tests after r221422.
 378
 379         Unreviewed test gardening.
 380
 381         * stress/regexp-prototype-match-on-too-long-rope.js:
 382         * stress/regexp-prototype-test-on-too-long-rope.js:
 383
 384 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
 385
 386         Unreviewed, skipping slow tests.
 387
 388         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
 389         work differently now.
 390
 391         * stress/regexp-prototype-exec-on-too-long-rope.js:
 392         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
 393
 394 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
 395
 396         [JSC] Use reifying system for "name" property of builtin JSFunction
 397         https://bugs.webkit.org/show_bug.cgi?id=175260
 398
 399         Reviewed by Saam Barati.
 400
 401         * stress/accessors-get-set-prefix.js:
 402         * stress/builtin-function-name.js: Added.
 403         (shouldBe):
 404         (shouldThrow):
 405         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
 406         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
 407         * stress/private-name-as-anonymous-builtin.js: Added.
 408         (shouldBe):
 409         (NotPromise):
 410
 411 2017-08-30  Saam Barati  <sbarati@apple.com>
 412
 413         Unreviewed. Make test stop printing.
 414
 415         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
 416
 417 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
 418
 419         Unreviewed, rolling out r221327.
 420
 421         This change caused test262 failures.
 422
 423         Reverted changeset:
 424
 425         "[JSC] Use reifying system for "name" property of builtin
 426         JSFunction"
 427         https://bugs.webkit.org/show_bug.cgi?id=175260
 428         http://trac.webkit.org/changeset/221327
 429
 430 2017-08-30  Saam Barati  <sbarati@apple.com>
 431
 432         semicolon is being interpreted as an = in the LiteralParser
 433         https://bugs.webkit.org/show_bug.cgi?id=176114
 434
 435         Reviewed by Oliver Hunt.
 436
 437         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
 438         * stress/resources/literal-parser-test-case.js: Added.
 439
 440 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
 441
 442         [ESNext] Async iteration - Implement async iteration statement: for-await-of
 443         https://bugs.webkit.org/show_bug.cgi?id=166698
 444
 445         Reviewed by Yusuke Suzuki.
 446
 447         * stress/async-iteration-for-await-of-syntax.js: Added.
 448         (assert):
 449         (checkSyntax):
 450         (checkSyntaxError):
 451         (checkSimpleAsyncGeneratorSloppyMode):
 452         (checkSimpleAsyncGeneratorStrictMode):
 453         (checkNestedAsyncGenerators):
 454         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
 455         * stress/async-iteration-for-await-of.js: Added.
 456         (assert):
 457         (async.foo):
 458         (async.boo):
 459         (const.boo.async):
 460
 461 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
 462
 463         [JSC] Use reifying system for "name" property of builtin JSFunction
 464         https://bugs.webkit.org/show_bug.cgi?id=175260
 465
 466         Reviewed by Saam Barati.
 467
 468         * stress/accessors-get-set-prefix.js:
 469         * stress/builtin-function-name.js: Added.
 470         (shouldBe):
 471         (shouldThrow):
 472         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
 473         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
 474
 475 2017-08-25  Saam Barati  <sbarati@apple.com>
 476
 477         Support compiling catch in the DFG
 478         https://bugs.webkit.org/show_bug.cgi?id=174590
 479         <rdar://problem/34047845>
 480
 481         Reviewed by Filip Pizlo.
 482
 483         * microbenchmarks/delta-blue-try-catch.js: Added.
 484         (exception):
 485         (value):
 486         (OrderedCollection):
 487         (OrderedCollection.prototype.add):
 488         (OrderedCollection.prototype.at):
 489         (OrderedCollection.prototype.size):
 490         (OrderedCollection.prototype.removeFirst):
 491         (OrderedCollection.prototype.remove):
 492         (Strength):
 493         (Strength.stronger):
 494         (Strength.weaker):
 495         (Strength.weakestOf):
 496         (Strength.strongest):
 497         (Strength.prototype.nextWeaker):
 498         (Constraint):
 499         (Constraint.prototype.addConstraint):
 500         (Constraint.prototype.satisfy):
 501         (Constraint.prototype.destroyConstraint):
 502         (Constraint.prototype.isInput):
 503         (UnaryConstraint):
 504         (UnaryConstraint.prototype.addToGraph):
 505         (UnaryConstraint.prototype.chooseMethod):
 506         (UnaryConstraint.prototype.isSatisfied):
 507         (UnaryConstraint.prototype.markInputs):
 508         (UnaryConstraint.prototype.output):
 509         (UnaryConstraint.prototype.recalculate):
 510         (UnaryConstraint.prototype.markUnsatisfied):
 511         (UnaryConstraint.prototype.inputsKnown):
 512         (UnaryConstraint.prototype.removeFromGraph):
 513         (StayConstraint):
 514         (StayConstraint.prototype.execute):
 515         (EditConstraint.prototype.isInput):
 516         (EditConstraint.prototype.execute):
 517         (BinaryConstraint):
 518         (BinaryConstraint.prototype.chooseMethod):
 519         (BinaryConstraint.prototype.addToGraph):
 520         (BinaryConstraint.prototype.isSatisfied):
 521         (BinaryConstraint.prototype.markInputs):
 522         (BinaryConstraint.prototype.input):
 523         (BinaryConstraint.prototype.output):
 524         (BinaryConstraint.prototype.recalculate):
 525         (BinaryConstraint.prototype.markUnsatisfied):
 526         (BinaryConstraint.prototype.inputsKnown):
 527         (BinaryConstraint.prototype.removeFromGraph):
 528         (ScaleConstraint):
 529         (ScaleConstraint.prototype.addToGraph):
 530         (ScaleConstraint.prototype.removeFromGraph):
 531         (ScaleConstraint.prototype.markInputs):
 532         (ScaleConstraint.prototype.execute):
 533         (ScaleConstraint.prototype.recalculate):
 534         (EqualityConstraint):
 535         (EqualityConstraint.prototype.execute):
 536         (Variable):
 537         (Variable.prototype.addConstraint):
 538         (Variable.prototype.removeConstraint):
 539         (Planner):
 540         (Planner.prototype.incrementalAdd):
 541         (Planner.prototype.incrementalRemove):
 542         (Planner.prototype.newMark):
 543         (Planner.prototype.makePlan):
 544         (Planner.prototype.extractPlanFromConstraints):
 545         (Planner.prototype.addPropagate):
 546         (Planner.prototype.removePropagateFrom):
 547         (Planner.prototype.addConstraintsConsumingTo):
 548         (Plan):
 549         (Plan.prototype.addConstraint):
 550         (Plan.prototype.size):
 551         (Plan.prototype.constraintAt):
 552         (Plan.prototype.execute):
 553         (chainTest):
 554         (projectionTest):
 555         (change):
 556         (deltaBlue):
 557         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
 558         (assert):
 559         (Numbers):
 560         (Numbers.prototype.next):
 561         (return.Transpose):
 562         (return.Transpose.prototype.next):
 563         (transpose):
 564         (verifyEven):
 565         (verifyString):
 566         (foo):
 567         (runIterators):
 568         * microbenchmarks/try-catch-word-count.js: Added.
 569         (let.assert):
 570         (EOF):
 571         (let.texts):
 572         (let.o.apply):
 573         (foo):
 574         (bar):
 575         (f):
 576         (run):
 577         (test1):
 578         (test2):
 579         (test3):
 580         (fn):
 581         (A):
 582         (B):
 583         (A.prototype.getValue):
 584         (B.prototype.getParentValue):
 585         (strlen):
 586         (sum.0):
 587         (test):
 588         (result.test.o):
 589         (set add.set add):
 590         (set forEach):
 591         (stringHash):
 592         (set if):
 593         (testFunction):
 594         (set delete.set has.set add):
 595         * stress/catch-set-argument-speculation-failure.js: Added.
 596         (o):
 597         (e):
 598         (e2):
 599         (escape):
 600         (baz):
 601         (noInline.run):
 602         (noInline):
 603         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
 604         (foo):
 605         (e):
 606         (baz):
 607         (bar):
 608
 609 2017-08-24  Commit Queue  <commit-queue@webkit.org>
 610
 611         Unreviewed, rolling out r221119, r221124, and r221143.
 612         https://bugs.webkit.org/show_bug.cgi?id=175973
 613
 614         "I think it regressed JSBench by 20%" (Requested by saamyjoon
 615         on #webkit).
 616
 617         Reverted changesets:
 618
 619         "Support compiling catch in the DFG"
 620         https://bugs.webkit.org/show_bug.cgi?id=174590
 621         http://trac.webkit.org/changeset/221119
 622
 623         "Unreviewed, build fix in GTK port"
 624         https://bugs.webkit.org/show_bug.cgi?id=174590
 625         http://trac.webkit.org/changeset/221124
 626
 627         "DFG::JITCode::osrEntry should get sorted since we perform a
 628         binary search on it"
 629         https://bugs.webkit.org/show_bug.cgi?id=175893
 630         http://trac.webkit.org/changeset/221143
 631
 632 2017-08-24  Michael Saboff  <msaboff@apple.com>
 633
 634         Add support for RegExp "dotAll" flag
 635         https://bugs.webkit.org/show_bug.cgi?id=175924
 636
 637         Reviewed by Keith Miller.
 638
 639         Updated tests for new dotAll ('s' flag) changes.
 640
 641         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
 642         * stress/static-getter-in-names.js:
 643
 644 2017-08-24  Mark Lam  <mark.lam@apple.com>
 645
 646         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
 647         https://bugs.webkit.org/show_bug.cgi?id=175940
 648         <rdar://problem/29003921>
 649
 650         Reviewed by Saam Barati.
 651
 652         * stress/regress-164081.js: Added.
 653         (shouldEqual):
 654         (testcase):
 655
 656 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
 657
 658         Skip flaky JSC test stress/test-finally.js.
 659         https://bugs.webkit.org/show_bug.cgi?id=160283
 660
 661         Unreviewed test gardening.
 662
 663         * stress/test-finally.js:
 664
 665 2017-08-23  Saam Barati  <sbarati@apple.com>
 666
 667         Support compiling catch in the DFG
 668         https://bugs.webkit.org/show_bug.cgi?id=174590
 669
 670         Reviewed by Filip Pizlo.
 671
 672         * microbenchmarks/delta-blue-try-catch.js: Added.
 673         (exception):
 674         (value):
 675         (OrderedCollection):
 676         (OrderedCollection.prototype.add):
 677         (OrderedCollection.prototype.at):
 678         (OrderedCollection.prototype.size):
 679         (OrderedCollection.prototype.removeFirst):
 680         (OrderedCollection.prototype.remove):
 681         (Strength):
 682         (Strength.stronger):
 683         (Strength.weaker):
 684         (Strength.weakestOf):
 685         (Strength.strongest):
 686         (Strength.prototype.nextWeaker):
 687         (Constraint):
 688         (Constraint.prototype.addConstraint):
 689         (Constraint.prototype.satisfy):
 690         (Constraint.prototype.destroyConstraint):
 691         (Constraint.prototype.isInput):
 692         (UnaryConstraint):
 693         (UnaryConstraint.prototype.addToGraph):
 694         (UnaryConstraint.prototype.chooseMethod):
 695         (UnaryConstraint.prototype.isSatisfied):
 696         (UnaryConstraint.prototype.markInputs):
 697         (UnaryConstraint.prototype.output):
 698         (UnaryConstraint.prototype.recalculate):
 699         (UnaryConstraint.prototype.markUnsatisfied):
 700         (UnaryConstraint.prototype.inputsKnown):
 701         (UnaryConstraint.prototype.removeFromGraph):
 702         (StayConstraint):
 703         (StayConstraint.prototype.execute):
 704         (EditConstraint.prototype.isInput):
 705         (EditConstraint.prototype.execute):
 706         (BinaryConstraint):
 707         (BinaryConstraint.prototype.chooseMethod):
 708         (BinaryConstraint.prototype.addToGraph):
 709         (BinaryConstraint.prototype.isSatisfied):
 710         (BinaryConstraint.prototype.markInputs):
 711         (BinaryConstraint.prototype.input):
 712         (BinaryConstraint.prototype.output):
 713         (BinaryConstraint.prototype.recalculate):
 714         (BinaryConstraint.prototype.markUnsatisfied):
 715         (BinaryConstraint.prototype.inputsKnown):
 716         (BinaryConstraint.prototype.removeFromGraph):
 717         (ScaleConstraint):
 718         (ScaleConstraint.prototype.addToGraph):
 719         (ScaleConstraint.prototype.removeFromGraph):
 720         (ScaleConstraint.prototype.markInputs):
 721         (ScaleConstraint.prototype.execute):
 722         (ScaleConstraint.prototype.recalculate):
 723         (EqualityConstraint):
 724         (EqualityConstraint.prototype.execute):
 725         (Variable):
 726         (Variable.prototype.addConstraint):
 727         (Variable.prototype.removeConstraint):
 728         (Planner):
 729         (Planner.prototype.incrementalAdd):
 730         (Planner.prototype.incrementalRemove):
 731         (Planner.prototype.newMark):
 732         (Planner.prototype.makePlan):
 733         (Planner.prototype.extractPlanFromConstraints):
 734         (Planner.prototype.addPropagate):
 735         (Planner.prototype.removePropagateFrom):
 736         (Planner.prototype.addConstraintsConsumingTo):
 737         (Plan):
 738         (Plan.prototype.addConstraint):
 739         (Plan.prototype.size):
 740         (Plan.prototype.constraintAt):
 741         (Plan.prototype.execute):
 742         (chainTest):
 743         (projectionTest):
 744         (change):
 745         (deltaBlue):
 746         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
 747         (assert):
 748         (Numbers):
 749         (Numbers.prototype.next):
 750         (return.Transpose):
 751         (return.Transpose.prototype.next):
 752         (transpose):
 753         (verifyEven):
 754         (verifyString):
 755         (foo):
 756         (runIterators):
 757         * microbenchmarks/try-catch-word-count.js: Added.
 758         (let.assert):
 759         (EOF):
 760         (let.texts):
 761         (let.o.apply):
 762         (foo):
 763         (bar):
 764         (f):
 765         (run):
 766         (test1):
 767         (test2):
 768         (test3):
 769         (fn):
 770         (A):
 771         (B):
 772         (A.prototype.getValue):
 773         (B.prototype.getParentValue):
 774         (strlen):
 775         (sum.0):
 776         (test):
 777         (result.test.o):
 778         (set add.set add):
 779         (set forEach):
 780         (stringHash):
 781         (set if):
 782         (testFunction):
 783         (set delete.set has.set add):
 784         * stress/catch-set-argument-speculation-failure.js: Added.
 785         (o):
 786         (e):
 787         (e2):
 788         (escape):
 789         (baz):
 790         (noInline.run):
 791         (noInline):
 792         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
 793         (foo):
 794         (e):
 795         (baz):
 796         (bar):
 797
 798 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 799
 800         [JSC] Optimize Map iteration with intrinsic
 801         https://bugs.webkit.org/show_bug.cgi?id=174355
 802
 803         Reviewed by Saam Barati.
 804
 805         * stress/map-iterator-result-should-have-expected-shape.js: Added.
 806         (shouldBe):
 807         (throw.new.Error):
 808         * stress/set-iterator-result-should-have-expected-shape.js: Added.
 809         (shouldBe):
 810         (throw.new.Error.let.iterator.set Symbol):
 811         (throw.new.Error.set add):
 812         (let.iterator.set Symbol):
 813
 814 2017-08-23  Robin Morisset  <rmorisset@apple.com>
 815
 816         Add a micro-benchmark for checking that accessing a variable within a 'with'
 817         block does not automatically prevent type prediction.
 818         https://bugs.webkit.org/show_bug.cgi?id=175738
 819
 820         Reviewed by Saam Barati.
 821
 822         * stress/with_and_arith.js: Added.
 823         (with):
 824
 825 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
 826
 827         [ESNext] Async iteration - Implement Async Generator - runtime
 828         https://bugs.webkit.org/show_bug.cgi?id=175240
 829
 830         Reviewed by Yusuke Suzuki.
 831
 832         * stress/async-iteration-async-from-sync.js: Added.
 833         (assert):
 834         (const.Logger):
 835         (this.fullfilled):
 836         (this.fullfilledDone):
 837         (this.rejected):
 838         (this.catched):
 839         (this.isFinal):
 840         (_assertLogger):
 841         (const.assertLogger):
 842         (const.getPromise.promiseHolder.return.new.Promise):
 843         (foo):
 844         (async.boo):
 845         (bar):
 846         (async.baz):
 847         (async.goo):
 848         * stress/async-iteration-basic.js: Added.
 849         (assert):
 850         (const.Logger):
 851         (this.fullfilled):
 852         (this.fullfilledDone):
 853         (this.rejected):
 854         (this.catched):
 855         (this.isFinal):
 856         (_assertLogger):
 857         (const.assertLogger):
 858         (const.getPromise.promiseHolder.return.new.Promise):
 859         (async.generator):
 860         (iterator.next.then):
 861         (async.baz):
 862         (async.boo):
 863         (async.foo):
 864         (async.goo):
 865         (A.prototype.async.foo):
 866         (A.prototype.async.boo):
 867         (A):
 868         (asyncGenExp.async):
 869         (async.joo):
 870         (j.next.then):
 871         (then):
 872         (async.koo):
 873         (async.loo):
 874         (async.moo):
 875         (async.noo):
 876         (async.ooo):
 877         (async.roo):
 878         (async.poo):
 879         (async.soo):
 880         (async.too):
 881         * stress/async-iteration-evaluation.js: Added.
 882         (assert):
 883         (async.foo):
 884         (catch):
 885         * stress/async-iteration-syntax.js:
 886         * stress/async-iteration-yield-promise.js: Added.
 887         (assert):
 888         (const.Logger):
 889         (this.fullfilled):
 890         (this.fullfilledDone):
 891         (this.rejected):
 892         (this.catched):
 893         (this.isFinal):
 894         (_assertLogger):
 895         (const.assertLogger):
 896         (const.getPromise.promiseHolder.return.new.Promise):
 897         (async.foo):
 898         (async.boo):
 899         (async.bar):
 900         * stress/async-iteration-yield-star-interface.js: Added.
 901         (assert):
 902         (const.getPromise.promiseHolder.return.new.Promise):
 903         (const.Logger):
 904         (this.fullfilled):
 905         (this.fullfilledDone):
 906         (this.rejected):
 907         (this.catched):
 908         (this.custom):
 909         (this.isFinal):
 910         (_assertLogger):
 911         (const.assertLogger):
 912         (let.asyncIter.Symbol.asyncIterator):
 913         (let.asyncIter.next):
 914         (let.asyncIter.throw):
 915         (let.asyncIter.return):
 916         (async.foo):
 917         (asyncIter.Symbol.asyncIterator):
 918         (asyncIter.next):
 919         (async.boo):
 920         (asyncIter.return):
 921         (async.bar):
 922         (async.baz):
 923         (async.foobar):
 924         * stress/async-iteration-yield-star.js: Added.
 925         (assert):
 926         (const.Logger):
 927         (this.fullfilled):
 928         (this.fullfilledDone):
 929         (this.rejected):
 930         (this.catched):
 931         (this.custom):
 932         (this.isFinal):
 933         (_assertLogger):
 934         (const.assertLogger):
 935         (const.getPromise.promiseHolder.return.new.Promise):
 936         (async.foo):
 937         (async.boo):
 938         (async.bar):
 939         (async.baz):
 940         (async.joo):
 941         (async.goo):
 942         (async.koo):
 943         (async.loo):
 944         (let.asyncIter.Symbol.asyncIterator):
 945         (let.asyncIter.next):
 946         (let.asyncIter.throw):
 947         (let.asyncIter.return):
 948         (async.moo):
 949         (async.noo):
 950         * test262.yaml:
 951
 952 2017-08-23  JF Bastien  <jfbastien@apple.com>
 953
 954         Fix printing in test
 955
 956         Unreviewed: fixing verbosity, shouldn't have been there.
 957
 958         * wasm/regress/175693.js:
 959         (else.else):
 960         (catch):
 961
 962 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
 963
 964         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
 965         https://bugs.webkit.org/show_bug.cgi?id=172543
 966
 967         Unreviewed test gardening.
 968
 969         * microbenchmarks/generator-with-several-types.js:
 970
 971 2017-08-17  JF Bastien  <jfbastien@apple.com>
 972
 973         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
 974         https://bugs.webkit.org/show_bug.cgi?id=175693
 975         <rdar://problem/33952443>
 976
 977         Reviewed by Saam Barati.
 978
 979         Add a regression directory for WebAssembly tests.
 980
 981         * wasm.yaml:
 982         * wasm/regress/175693.js: Added.
 983         (else.else):
 984         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
 985         (catch):
 986         * wasm/regress/175693.wasm: Added.
 987
 988 2017-08-15  Robin Morisset  <rmorisset@apple.com>
 989
 990         Support the 'with' keyword in FTL.
 991         https://bugs.webkit.org/show_bug.cgi?id=175585
 992
 993         Reviewed by Saam Barati.
 994
 995         Also improve the JSTest/stress/with.js file to test
 996         what happens when non-objects are passed to with.
 997
 998         * stress/with.js:
 999         (foo):
1000         (i.catch):
1001         (i.with): Deleted.
1002
1003 2017-08-14  Keith Miller  <keith_miller@apple.com>
1004
1005         Add testing tool to lie to the DFG about profiles
1006         https://bugs.webkit.org/show_bug.cgi?id=175487
1007
1008         Reviewed by Saam Barati.
1009
1010         * stress/compare-eq-incomplete-profile.js: Added.
1011         (const.test.createBuiltin):
1012
1013 2017-08-14  Robin Morisset  <rmorisset@apple.com>
1014
1015         Support the with keyword in DFG
1016         https://bugs.webkit.org/show_bug.cgi?id=175470
1017
1018         Reviewed by Saam Barati.
1019
1020         Added a new stress-test for the 'with' keyword, that caught a bug in a
1021         previous version of this code.
1022
1023         * stress/with.js: Added.
1024         (i.with):
1025
1026 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
1027
1028         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
1029         https://bugs.webkit.org/show_bug.cgi?id=175544
1030
1031         Unreviewed test gardening.
1032
1033         * ChakraCore.yaml:
1034
1035 2017-08-09  Caitlin Potter  <caitp@igalia.com>
1036
1037         Early error on ANY operator before new.target
1038         https://bugs.webkit.org/show_bug.cgi?id=157970
1039
1040         Reviewed by Saam Barati.
1041
1042         Instead of throwing if any unary operator precedes new.target, only
1043         throw if the unary operator updates the reference.
1044
1045         The following become legal in JSC:
1046
1047         ```
1048         !new.target
1049         ~new.target
1050         typeof new.target
1051         delete new.target
1052         void new.target
1053         ```
1054
1055         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
1056
1057         * stress/new-target-syntax-errors.js:
1058         * stress/new-target.js:
1059
1060 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
1061
1062         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
1063         https://bugs.webkit.org/show_bug.cgi?id=175255
1064
1065         Unreviewed test gardening.
1066
1067         * stress/regress-169783.js:
1068         * wasm/stress/oom.js:
1069
1070 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1071
1072         REGRESSION: 2 test262/test/language/statements/async-function failures
1073         https://bugs.webkit.org/show_bug.cgi?id=175334
1074
1075         Reviewed by Yusuke Suzuki.
1076
1077         Add @skip parameters to tests, and remove test for async iterator from
1078         async await syntax test because it is already covered by async-iterator-syntax.js
1079
1080         * stress/async-await-syntax.js:
1081         * stress/async-iteration-syntax.js:
1082
1083 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1084
1085         Unreviewed, gardening test262 for Promise resolve / reject function length
1086         https://bugs.webkit.org/show_bug.cgi?id=175333
1087
1088         * test262.yaml:
1089
1090 2017-08-07  Robin Morisset  <rmorisset@apple.com>
1091
1092         GetOwnProperty of TypedArray indexed fields is wrongly configurable
1093         https://bugs.webkit.org/show_bug.cgi?id=175307
1094
1095         Reviewed by Saam Barati.
1096
1097         * stress/typedarray-getownproperty-not-configurable.js: Added.
1098         (assert):
1099         (foo):
1100
1101 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1102
1103         Promise resolve and reject function should have length = 1
1104         https://bugs.webkit.org/show_bug.cgi?id=175242
1105
1106         Reviewed by Saam Barati.
1107
1108         * stress/builtin-function-length.js: Added.
1109         (shouldBe):
1110         (shouldThrow):
1111         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1112         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1113
1114 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
1115
1116         [ESNext] Async iteration - Implement Async Generator - parser
1117         https://bugs.webkit.org/show_bug.cgi?id=175210
1118
1119         Reviewed by Yusuke Suzuki.
1120
1121         * stress/async-await-syntax.js:
1122         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1123         * stress/async-iteration-syntax.js: Added.
1124         (assert):
1125         (checkSyntax):
1126         (checkSyntaxError):
1127         (checkSimpleAsyncGeneratorSloppyMode):
1128         (checkSimpleAsyncGeneratorStrictMode):
1129         (checkNestedAsyncGenerators):
1130         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
1131         * stress/generator-class-methods-syntax.js:
1132
1133 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1134
1135         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
1136         https://bugs.webkit.org/show_bug.cgi?id=175150
1137
1138         Unreviewed test gardening.
1139
1140         * wasm/js-api/test_memory_constructor.js:
1141
1142 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1143
1144         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
1145         https://bugs.webkit.org/show_bug.cgi?id=175100
1146
1147         Reviewed by Mark Lam.
1148
1149         The JSC test JSTests/wasm/stress/oom.js tries to use all the
1150         available memory until an out of memory exception happens.
1151
1152         The Linux kernel is more tuned for server workloads than for GUI
1153         responsiveness. When a process tries to use a lot of memory, Linux
1154         will do its best to serve the request. This usually translates to
1155         free physical RAM by writing to disk dirty pages and/or moving out
1156         less recently used pages to swap (disk storage).
1157         Meanwhile it does this, the system will become unresponsive and this
1158         leads to freezes that can last even some minutes on the worst cases.
1159
1160         Therefore, let's skip this test on Linux as it will cause more harm
1161         than good on the Linux bots or on the machines of Linux developers.
1162
1163         * wasm/stress/oom.js:
1164
1165 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1166
1167         [JSC] Remove unnecessary print from stress\promise-finally.js test
1168         https://bugs.webkit.org/show_bug.cgi?id=175015
1169
1170         Reviewed by Yusuke Suzuki.
1171
1172         * stress/promise-finally.js:
1173         (p.finally):
1174         (then):
1175
1176 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1177
1178         Unreviewed, update test262 results for optional catch binding
1179
1180         * test262.yaml:
1181
1182 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1183
1184         [JSC] Support optional catch binding
1185         https://bugs.webkit.org/show_bug.cgi?id=174981
1186
1187         Reviewed by Saam Barati.
1188
1189         * stress/optional-catch-binding-syntax.js: Added.
1190         (testSyntax):
1191         (testSyntaxError):
1192         (catch.catch):
1193         * stress/optional-catch-binding.js: Added.
1194         (shouldBe):
1195         (throwException):
1196
1197 2017-07-28  Mark Lam  <mark.lam@apple.com>
1198
1199         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
1200         https://bugs.webkit.org/show_bug.cgi?id=174948
1201         <rdar://problem/33495680>
1202
1203         Reviewed by Filip Pizlo.
1204
1205         * stress/regress-174948.js: Added.
1206
1207 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
1208
1209         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
1210         https://bugs.webkit.org/show_bug.cgi?id=174900
1211
1212         Reviewed by Saam Barati.
1213
1214         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
1215         (sideEffect):
1216         (args):
1217         (test):
1218
1219 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1220
1221         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
1222         https://bugs.webkit.org/show_bug.cgi?id=171637
1223
1224         Reviewed by Darin Adler.
1225
1226         * stress/domjit-getter-complex-with-incorrect-object.js:
1227         (i.shouldThrow):
1228         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
1229         (shouldBe):
1230         (i.shouldThrow):
1231
1232 2017-07-26  JF Bastien  <jfbastien@apple.com>
1233
1234         WebAssembly: test throwing out of the start function
1235         https://bugs.webkit.org/show_bug.cgi?id=165714
1236         <rdar://problem/29760251>
1237
1238         Reviewed by Keith Miller.
1239
1240         * wasm/assert.js:
1241         * wasm/function-tests/trap-from-start.js: Added.
1242         (StartTraps):
1243         * wasm/function-tests/trap-from-start-async.js: Added.
1244         (async.StartTrapsAsync):
1245
1246 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1247
1248         [FTL] Arguments elimination is suppressed by unreachable blocks
1249         https://bugs.webkit.org/show_bug.cgi?id=174352
1250
1251         Reviewed by Filip Pizlo.
1252
1253         * stress/arguments-elimination-force-exit.js: Added.
1254         (shouldBe):
1255         (strict):
1256         (sloppy):
1257         * stress/arguments-elimination-throw.js: Added.
1258         (shouldBe):
1259         (shouldThrow):
1260         (sloppy):
1261         (isArguments):
1262
1263 2017-07-13  Mark Lam  <mark.lam@apple.com>
1264
1265         Add some additional test cases for bug 170896.
1266         https://bugs.webkit.org/show_bug.cgi?id=174491
1267
1268         Reviewed by Filip Pizlo.
1269
1270         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
1271         * stress/regress-170896-with-double-shape-profile.js: Added.
1272         (test):
1273         * stress/regress-170896-with-int32-shape-profile.js: Added.
1274         (test):
1275         * stress/regress-170896.js: Removed.
1276
1277 2017-07-13  Saam Barati  <sbarati@apple.com>
1278
1279         Missing exception check in JSObject::hasInstance
1280         https://bugs.webkit.org/show_bug.cgi?id=174455
1281         <rdar://problem/31384608>
1282
1283         Reviewed by Mark Lam.
1284
1285         * stress/has-instance-exception-check.js: Added.
1286         (assert):
1287         (let.getter.Object.getOwnPropertyDescriptor.get foo):
1288
1289 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
1290
1291         [ESnext] Implement Object Spread
1292         https://bugs.webkit.org/show_bug.cgi?id=167963
1293
1294         Reviewed by Saam Barati.
1295
1296         * stress/obj-rest-destructuring-order.js: Added.
1297         (assert):
1298         (o.get z):
1299         (o.get a):
1300         * stress/obj-spread-order.js: Added.
1301         (assert):
1302         (o.get z):
1303         (o.get a):
1304         * stress/object-spread.js: Added.
1305         (let.assert):
1306         (assert.sameValue):
1307         (let.o.get a):
1308         (let.obj.get c):
1309         (cthulhu.get x):
1310         (let.obj.set c):
1311         (calls.o.get z):
1312         (calls.o.get a):
1313         (try.let.obj.get foo):
1314         (get calls):
1315
1316 2017-07-12  Saam Barati  <sbarati@apple.com>
1317
1318         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
1319         https://bugs.webkit.org/show_bug.cgi?id=174411
1320         <rdar://problem/31696186>
1321
1322         Reviewed by Mark Lam.
1323
1324         * stress/generic-arguments-correct-delete-behavior.js: Added.
1325         (assert):
1326         (makeTest):
1327
1328 2017-07-07  Mark Lam  <mark.lam@apple.com>
1329
1330         \n\r is not the same as \r\n.
1331         https://bugs.webkit.org/show_bug.cgi?id=173053
1332
1333         Reviewed by Keith Miller.
1334
1335         * stress/regress-173053.js: Added.
1336         * stress/template-literal-line-terminators.js:
1337
1338 2017-07-06  Saam Barati  <sbarati@apple.com>
1339
1340         We are missing places where we invalidate the for-in context
1341         https://bugs.webkit.org/show_bug.cgi?id=174184
1342
1343         Reviewed by Geoffrey Garen.
1344
1345         * stress/for-in-invalidate-context-weird-assignments.js: Added.
1346         (assert):
1347         (test):
1348
1349 2017-07-05  Saam Barati  <sbarati@apple.com>
1350
1351         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
1352         https://bugs.webkit.org/show_bug.cgi?id=174188
1353         <rdar://problem/30581423>
1354
1355         Reviewed by Mark Lam.
1356
1357         * stress/new-array-having-a-bad-time-double.js: Added.
1358         (assert):
1359         (foo):
1360
1361 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1362
1363         WTF::StringImpl::copyChars segfaults when built with GCC 7
1364         https://bugs.webkit.org/show_bug.cgi?id=173407
1365
1366         Reviewed by Andreas Kling.
1367
1368         * stress/string-repeat-copy-chars-crash.js: Added.
1369         (shouldBe):
1370
1371 2017-07-03  Saam Barati  <sbarati@apple.com>
1372
1373         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
1374
1375         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1376
1377 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1378
1379         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
1380
1381         It requires too much memory.
1382
1383         * stress/dont-reserve-huge-capacity-lexer.js:
1384
1385 2017-06-30  Michael Saboff  <msaboff@apple.com>
1386
1387         Skip a test on ARM64 platform since we run out of address space.
1388
1389         Rubber stamped by Saam Barati.
1390
1391         * stress/dont-reserve-huge-capacity-lexer.js:
1392
1393 2017-06-30  Michael Saboff  <msaboff@apple.com>
1394
1395         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
1396         https://bugs.webkit.org/show_bug.cgi?id=174044
1397
1398         Reviewed by Oliver Hunt.
1399
1400         New regression test.
1401
1402         * stress/regress-174044.js: Added.
1403         (test1):
1404         (test2):
1405
1406 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
1407
1408         RegExpCachedResult::setInput should reify left and right contexts
1409         https://bugs.webkit.org/show_bug.cgi?id=173818
1410
1411         Reviewed by Keith Miller.
1412
1413         * stress/right-left-context-invalidated-by-input.js: Added.
1414         (test.validateContexts):
1415         (test):
1416
1417 2017-06-29  Saam Barati  <sbarati@apple.com>
1418
1419         Calculating postCapacity in unshiftCountSlowCase is wrong
1420         https://bugs.webkit.org/show_bug.cgi?id=173992
1421         <rdar://problem/32283199>
1422
1423         Reviewed by Keith Miller.
1424
1425         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
1426         (temp):
1427
1428 2017-06-29  Commit Queue  <commit-queue@webkit.org>
1429
1430         Unreviewed, rolling out r218512.
1431         https://bugs.webkit.org/show_bug.cgi?id=173981
1432
1433         "It changes the behavior of the JS API's JSEvaluateScript
1434         which breaks TurboTax" (Requested by saamyjoon on #webkit).
1435
1436         Reverted changeset:
1437
1438         "test262: Completion values for control flow do not match the
1439         spec"
1440         https://bugs.webkit.org/show_bug.cgi?id=171265
1441         http://trac.webkit.org/changeset/218512
1442
1443 2017-06-27  JF Bastien  <jfbastien@apple.com>
1444
1445         WebAssembly: running out of executable memory should throw OoM
1446         https://bugs.webkit.org/show_bug.cgi?id=171537
1447         <rdar://problem/32963338>
1448
1449         Reviewed by Saam Barati.
1450
1451         * wasm.yaml:
1452         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
1453         (const.invoke):
1454         (failCount.0.catch):
1455         (failCount.0.module.undefined.catch):
1456         * wasm/lowExecutableMemory/exports-oom.js: Added.
1457         (const.type):
1458         (const.params):
1459         (const.randomProgram):
1460         (failCount.0.catch):
1461         (failCount.0.module.undefined.catch):
1462         * wasm/lowExecutableMemory/imports-oom.js: Added.
1463         (const.type):
1464         (const.params):
1465         (const.randomProgram):
1466         (f.imports.push):
1467         (failCount.0.catch):
1468         (failCount.0.module.undefined.catch):
1469
1470 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
1471
1472         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
1473         https://bugs.webkit.org/show_bug.cgi?id=167962
1474
1475         Reviewed by Saam Barati.
1476
1477         * stress/object-rest-deconstruct.js: Added.
1478         (let.assert):
1479         (let.assertPropDescriptor):
1480         (catch):
1481         (get 3):
1482         (foo):
1483         (let.src.get y):
1484         (let.src.set y):
1485         (let.gen):
1486
1487 2017-06-27  Saam Barati  <sbarati@apple.com>
1488
1489         Function constructor needs to follow the spec and validate parameters and body independently
1490         https://bugs.webkit.org/show_bug.cgi?id=173303
1491         <rdar://problem/32732526>
1492
1493         Reviewed by Keith Miller.
1494
1495         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1496         * stress/function-constructor-semantics.js: Added.
1497         (assert):
1498         (hasSyntaxError):
1499         (foo):
1500         (async.foo):
1501         (testError):
1502         (testOK.toString):
1503         (toString):
1504
1505 2017-06-26  Saam Barati  <sbarati@apple.com>
1506
1507         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
1508         https://bugs.webkit.org/show_bug.cgi?id=173740
1509
1510         Reviewed by Mark Lam.
1511
1512         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
1513         (Array.prototype.Symbol.iterator):
1514
1515 2017-06-26  Saam Barati  <sbarati@apple.com>
1516
1517         Skip a test on 32-bit platforms since we run out of address space.
1518
1519         Rubber stamped by Mark Lam.
1520
1521         * stress/dont-reserve-huge-capacity-lexer.js:
1522
1523 2017-06-26  Saam Barati  <sbarati@apple.com>
1524
1525         Crash in JSC::Lexer<unsigned char>::setCode
1526         https://bugs.webkit.org/show_bug.cgi?id=172754
1527
1528         Reviewed by Mark Lam.
1529
1530         * stress/dont-reserve-huge-capacity-lexer.js: Added.
1531         (catch):
1532
1533 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1534
1535         [JSC] Clean up Object.entries implementation
1536         https://bugs.webkit.org/show_bug.cgi?id=173759
1537
1538         Reviewed by Sam Weinig.
1539
1540         * microbenchmarks/object-entries.js: Added.
1541         (test):
1542
1543 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
1544
1545         Remove Reflect.enumerate
1546         https://bugs.webkit.org/show_bug.cgi?id=173806
1547
1548         Reviewed by Yusuke Suzuki.
1549
1550         * ChakraCore.yaml:
1551         * es6.yaml:
1552         These tests now fail because they use Reflect.enumerate.
1553
1554         * test262.yaml:
1555         This test now passes, it checked that Reflect.enumerate is undefined!
1556
1557         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
1558         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
1559
1560         * stress/reflect-enumerate.js: Removed.
1561         Remove a test solely for Reflect.enumerate.
1562
1563 2017-06-22  Saam Barati  <sbarati@apple.com>
1564
1565         ValueRep(DoubleRep(@v)) can not simply convert to @v
1566         https://bugs.webkit.org/show_bug.cgi?id=173687
1567         <rdar://problem/32855563>
1568
1569         Reviewed by Mark Lam.
1570
1571         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
1572         (i.catch):
1573
1574 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1575
1576         [JSC] Object.values should be implemented in C++
1577         https://bugs.webkit.org/show_bug.cgi?id=173703
1578
1579         Reviewed by Sam Weinig.
1580
1581         * microbenchmarks/object-keys-map-values.js: Added.
1582         (test):
1583         * microbenchmarks/object-values.js: Added.
1584         (test):
1585         * stress/object-values-changing-properties.js: Added.
1586         (shouldBe):
1587         (throw.new.Error.let.source.get x):
1588         (throw.new.Error):
1589         (shouldBe.let.handler.get order):
1590         (get let):
1591         (shouldBe.let.handler.get return):
1592         (let.handler.get order):
1593
1594 2017-06-21  Saam Barati  <sbarati@apple.com>
1595
1596         eval virtual call is incorrect in the baseline JIT
1597         https://bugs.webkit.org/show_bug.cgi?id=173587
1598         <rdar://problem/32867897>
1599
1600         Reviewed by Michael Saboff.
1601
1602         * stress/do-eval-virtual-call-correctly.js: Added.
1603         (assert):
1604         (f):
1605         (i.test):
1606         (catch):
1607
1608 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
1609
1610         Update test262 test expectations after r218581.
1611
1612         Unreviewed test gardening.
1613
1614         * test262.yaml:
1615
1616 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
1617
1618         Revert changes in bug#160417 about extending `null` not being a derived class
1619         https://bugs.webkit.org/show_bug.cgi?id=169293
1620
1621         Reviewed by Saam Barati.
1622
1623         * stress/class-derived-from-null.js:
1624         (assertThrow):
1625         (test1):
1626         (test2):
1627         (test3):
1628         (test4):
1629         (test5):
1630         (test6):
1631
1632 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1633
1634         [DFG] More ArrayIndexOf fixups for various types
1635         https://bugs.webkit.org/show_bug.cgi?id=173176
1636
1637         Reviewed by Saam Barati.
1638
1639         * stress/array-indexof-arraystorage.js: Added.
1640         (shouldBe):
1641         (indexOfInt32Other):
1642         (indexOfInt32Cell):
1643         (indexOfInt32Boolean):
1644         (indexOfDoubleOther):
1645         (indexOfDoubleCell):
1646         (indexOfDoubleBoolean):
1647         (indexOfInt32):
1648         (indexOfDouble):
1649         * stress/array-indexof-constant-folding.js: Added.
1650         (shouldBe):
1651         (indexOfInt32Other):
1652         (indexOfInt32Cell):
1653         (indexOfInt32Boolean):
1654         (indexOfDoubleOther):
1655         (indexOfDoubleCell):
1656         (indexOfDoubleBoolean):
1657         * stress/array-indexof-hole-and-other.js: Added.
1658         (shouldBe):
1659         (indexOf):
1660         * stress/array-indexof-other.js: Added.
1661         (shouldBe):
1662         (indexOfInt32):
1663         (indexOfDouble):
1664         (indexOfString):
1665         (indexOfObject):
1666         * stress/array-indexof-symbol.js: Added.
1667         (shouldBe):
1668         (indexOfInt32):
1669         (indexOfDouble):
1670         (indexOfString):
1671         (indexOfObject):
1672
1673 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
1674
1675         test262: Completion values for control flow do not match the spec
1676         https://bugs.webkit.org/show_bug.cgi?id=171265
1677
1678         Reviewed by Saam Barati.
1679
1680         * stress/completion-value.js:
1681         Condensed test for completion values in top level statements.
1682
1683         * stress/super-get-by-id.js:
1684         ClassDeclaration when evaled no longer produce values. Convert
1685         these to ClassExpressions so they produce the class value.
1686
1687         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1688         This is a progression for currect spec behavior.
1689
1690         * mozilla/mozilla-tests.yaml:
1691         This test is now outdated, so mark it as failing for that reason.
1692
1693         * test262.yaml:
1694         Passing all "cptn" completion value tests.
1695
1696 2017-06-17  Keith Miller  <keith_miller@apple.com>
1697
1698         ArrayBuffer constructor needs to create subclass structures before its buffer
1699         https://bugs.webkit.org/show_bug.cgi?id=173510
1700
1701         Reviewed by Yusuke Suzuki.
1702
1703         * test262.yaml:
1704
1705 2017-06-17  Keith Miller  <keith_miller@apple.com>
1706
1707         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
1708         https://bugs.webkit.org/show_bug.cgi?id=173506
1709
1710         Reviewed by Ryosuke Niwa.
1711
1712         Re-baseline tests.
1713
1714         * ChakraCore/test/Function/apply3.baseline-jsc:
1715         * test262.yaml:
1716
1717 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1718
1719         [JSC] Add fast path for Object.assign
1720         https://bugs.webkit.org/show_bug.cgi?id=173416
1721
1722         Reviewed by Mark Lam.
1723
1724         * stress/object-assign-changing-properties.js: Added.
1725         (shouldBe):
1726         (throw.new.Error.let.source.get x):
1727         (throw.new.Error):
1728         (shouldBe.let.source.get x):
1729         (shouldBe.let.target.set x):
1730         (shouldBe.let.target.get x):
1731         * stress/object-assign-proxy.js: Added.
1732         (shouldBe):
1733         (throw.new.Error.let.handler.get order):
1734
1735 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1736
1737         [JSC] Implement Object.assign in C++
1738         https://bugs.webkit.org/show_bug.cgi?id=173414
1739
1740         Reviewed by Saam Barati.
1741
1742         * stress/object-assign-string-first.js: Added.
1743         (shouldBe):
1744         (source.get Symbol):
1745         (source.get 1):
1746         (source.get cocoa):
1747
1748 2017-06-14  JF Bastien  <jfbastien@apple.com>
1749
1750         WebAssembly: remove empty test files
1751         https://bugs.webkit.org/show_bug.cgi?id=173382
1752
1753         Reviewed by Saam Barati.
1754
1755         The following files:
1756                 JSTests/wasm/function-tests/call-indirect-params.js
1757                 JSTests/wasm/function-tests/call-indirect.js
1758                 JSTests/wasm/js-api/call-indirect-results.js
1759         Were changed to empty files in https://trac.webkit.org/changeset/209771
1760
1761         They were testing call_indirect with the wrong semantics, before
1762         we implemented tables. That change implemented tables and
1763         therefore removed the erroneous tests.
1764
1765         We have a few tests for call_indirect which already do the right thing:
1766                 JSTests/wasm/function-tests/context-switch.js
1767                 JSTests/wasm/function-tests/exceptions.js
1768                 JSTests/wasm/function-tests/grow-memory-2.js
1769                 JSTests/wasm/function-tests/stack-overflow.js
1770                 JSTests/wasm/function-tests/table-basic-2.js
1771                 JSTests/wasm/function-tests/table-basic.js
1772                 JSTests/wasm/js-api/call-indirect.js
1773                 JSTests/wasm/js-api/table.js
1774                 JSTests/wasm/js-api/unique-signature.js
1775                 JSTests/wasm/js-api/wrapper-function.js
1776
1777         I also just imported the updated spec tests which, among other
1778         things, test call_indirect:
1779                 core/br.wast
1780                 core/br_table.wast
1781                 core/call_indirect.wast
1782                 core/func.wast
1783                 core/func_ptrs.wast
1784                 core/imports.wast
1785                 core/left-to-right.wast
1786                 core/linking.wast
1787                 core/nop.wast
1788                 core/return.wast
1789                 core/typecheck.wast
1790                 core/unreachable.wast
1791
1792         So I think it's OK to just delete the tests which should just have
1793         been deleted back when tables were added.
1794
1795         * wasm/function-tests/call-indirect-params.js: Removed.
1796         * wasm/function-tests/call-indirect.js: Removed.
1797         * wasm/js-api/call-indirect-results.js: Removed.
1798
1799 2017-06-13  JF Bastien  <jfbastien@apple.com>
1800
1801         WebAssembly: import updated spec tests
1802         https://bugs.webkit.org/show_bug.cgi?id=173287
1803         <rdar://problem/32725975>
1804
1805         Reviewed by Saam Barati.
1806
1807         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
1808         with a few modifications so things work.
1809
1810         Fix a bunch of bugs found through this process, and punt a few tests (which I
1811         marked as blocked by this bug).
1812
1813         Fixes:
1814
1815         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
1816         instead of byte alignment. It was also missing memory-alignment.js despite it
1817         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
1818         pass.
1819
1820         Tables can be imported or in a section. There can be only one, but sections can
1821         be empty. An Elements section can exist if there's no Table, as long as it is
1822         also empty.
1823
1824         Memories can be imported or in a section. There can be only one, but sections
1825         can be empty. A Data section can exist if there's no Memory, as long as it is
1826         also empty.
1827
1828         Prototypes: stringify without .prototype. in the string.
1829
1830         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
1831         not a final size, and throws a RangeError on failure, not a TypeError.
1832
1833         Fix compile / instantiate so the reject the promise if given an argument of the
1834         wrong type (instead of failing instantly).
1835
1836         Fix async on neuter test.
1837
1838         Element section shouldn't affect any Table if any of the elements are out of
1839         bounds. We need to process it in two passes.
1840
1841         Segment section shouldn't affect any Data if any of the segments are out of
1842         bounds. We need to process it in two passes.
1843
1844         Empty data segments are valid, but only when there is no memory. Their index
1845         still gets validated, and has to be zero.
1846
1847         Punts:
1848
1849         Error messages with context, the test seems overly restrictive but this is
1850         minor.
1851
1852         compile/instantiate/validate property descriptors.
1853
1854         UTF-8 bugs.
1855
1856         Temporarily disable NaN tests. We need to go back and implement the following
1857         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
1858         much as getting all the other tests passing.
1859
1860         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
1861         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
1862         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
1863         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
1864         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
1865         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
1866         why they're not allowed.
1867
1868         * wasm.yaml:
1869         * wasm/function-tests/i32-load8-s.js:
1870         * wasm/function-tests/memory-access-past-4gib.js:
1871         (const.op.of.WASM.opcodes):
1872         * wasm/function-tests/memory-alignment.js: Added.
1873         (const.op.of.WASM.opcodes):
1874         * wasm/function-tests/memory-section-and-import.js:
1875         * wasm/js-api/Module-compile.js:
1876         (async.testPromiseAPI):
1877         * wasm/js-api/dont-mmap-zero-byte-memory.js:
1878         (testMems):
1879         * wasm/js-api/element.js:
1880         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1881         * wasm/js-api/neutered-inputs.js:
1882         (const.testFunction): Deleted.
1883         (const.testConstructor): Deleted.
1884         * wasm/js-api/table.js:
1885         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1886         (new.WebAssembly.Module):
1887         (assert.throws):
1888         (assertBadTableImport):
1889         (assert.throws.WebAssembly.Table.prototype.grow):
1890         (assertBadTableInstance): Deleted.
1891         * wasm/js-api/test_Data.js:
1892         (DataSectionWithoutMemory):
1893         * wasm/spec-harness/index.js:
1894         (module):
1895         (uniqueTest): Deleted.
1896         (assert_invalid): Deleted.
1897         (assert_soft_invalid): Deleted.
1898         (register): Deleted.
1899         (call): Deleted.
1900         (get instance): Deleted.
1901         (exports): Deleted.
1902         (run): Deleted.
1903         (assert_unlinkable): Deleted.
1904         (assert_uninstantiable): Deleted.
1905         (assert_trap): Deleted.
1906         (try.f): Deleted.
1907         (catch): Deleted.
1908         (assert_exhaustion): Deleted.
1909         (assert_return): Deleted.
1910         (assert_return_nan): Deleted.
1911         * wasm/spec-harness/testharness.css: Removed.
1912         * wasm/spec-harness/testharness.js: Removed.
1913         * wasm/spec-harness/testharnessreport.js: Removed.
1914         * wasm/spec-harness/wasm-constants.js:
1915         (assertTraps):
1916         (assertWasmThrows):
1917         * wasm/spec-harness/wasm-module-builder.js:
1918         (Binary.prototype.emit_section):
1919         (Binary):
1920         (WasmFunctionBuilder.prototype.addBody):
1921         (WasmFunctionBuilder.prototype.end):
1922         (WasmFunctionBuilder):
1923         (WasmModuleBuilder.prototype.stringToBytes):
1924         (WasmModuleBuilder.prototype.addCustomSection):
1925         (WasmModuleBuilder.prototype.addFunctionTableInit):
1926         (WasmModuleBuilder.prototype.appendToTable):
1927         (WasmModuleBuilder.prototype.toArray):
1928         (WasmModuleBuilder.prototype.toBuffer):
1929         (WasmModuleBuilder.prototype.instantiate):
1930         (WasmModuleBuilder):
1931         * wasm/spec-tests/address.wast.js:
1932         * wasm/spec-tests/align.wast.js: Added.
1933         * wasm/spec-tests/binary.wast.js:
1934         * wasm/spec-tests/block.wast.js:
1935         * wasm/spec-tests/br.wast.js:
1936         * wasm/spec-tests/br_if.wast.js:
1937         * wasm/spec-tests/br_table.wast.js:
1938         * wasm/spec-tests/call.wast.js:
1939         * wasm/spec-tests/call_indirect.wast.js:
1940         * wasm/spec-tests/comments.wast.js:
1941         * wasm/spec-tests/const.wast.js: Added.
1942         * wasm/spec-tests/conversions.wast.js: Added.
1943         * wasm/spec-tests/custom_section.wast.js:
1944         * wasm/spec-tests/exports.wast.js:
1945         * wasm/spec-tests/f32.wast.js: Added.
1946         * wasm/spec-tests/f64.wast.js: Added.
1947         * wasm/spec-tests/fac.wast.js:
1948         * wasm/spec-tests/float_exprs.wast.js: Added.
1949         * wasm/spec-tests/float_misc.wast.js: Added.
1950         * wasm/spec-tests/func.wast.js:
1951         * wasm/spec-tests/globals.wast.js:
1952         * wasm/spec-tests/if.wast.js:
1953         * wasm/spec-tests/imports.wast.js:
1954         * wasm/spec-tests/inline-module.wast.js: Added.
1955         * wasm/spec-tests/jsapi.js:
1956         (testJSAPI.test):
1957         (testJSAPI):
1958         * wasm/spec-tests/labels.wast.js:
1959         * wasm/spec-tests/loop.wast.js:
1960         * wasm/spec-tests/memory.wast.js:
1961         * wasm/spec-tests/memory_trap.wast.js: Added.
1962         * wasm/spec-tests/names.wast.js:
1963         * wasm/spec-tests/nop.wast.js:
1964         * wasm/spec-tests/return.wast.js:
1965         * wasm/spec-tests/stack.wast.js:
1966         * wasm/spec-tests/token.wast.js: Added.
1967         * wasm/spec-tests/type.wast.js: Added.
1968         * wasm/spec-tests/typecheck.wast.js:
1969         * wasm/spec-tests/unreachable.wast.js:
1970         * wasm/spec-tests/unreached-invalid.wast.js:
1971         * wasm/spec-tests/unwind.wast.js:
1972         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
1973         * wasm/spec-tests/utf8-import-field.wast.js: Added.
1974         * wasm/spec-tests/utf8-import-module.wast.js: Added.
1975
1976 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
1977
1978         Unreviewed JSC test gardening.
1979
1980         * stress/check-string-ident.js:
1981         * stress/new-largeish-contiguous-array-with-size.js:
1982
1983 2017-06-13  Michael Saboff  <msaboff@apple.com>
1984
1985         DFG doesn't properly handle a property that is change to read only in a prototype
1986         https://bugs.webkit.org/show_bug.cgi?id=173321
1987
1988         Reviewed by Filip Pizlo.
1989
1990         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
1991         * stress/regress-173321.js: Added new regression test.
1992         (shouldBe):
1993         (SimpleObject):
1994         (test):
1995
1996 2017-06-12  Saam Barati  <sbarati@apple.com>
1997
1998         Update test262 test expectation since r218082 makes new tests pass.
1999
2000         * test262.yaml:
2001
2002 2017-06-12  Saam Barati  <sbarati@apple.com>
2003
2004         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
2005         https://bugs.webkit.org/show_bug.cgi?id=172957
2006         <rdar://problem/32602704>
2007
2008         Reviewed by Filip Pizlo.
2009
2010         * stress/spec-empty-flows-through-cell-checks.js: Added.
2011         (A):
2012         (B):
2013         (i.catch):
2014
2015 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
2016
2017         We incorrectly allow escaped characters in keyword tokens
2018         https://bugs.webkit.org/show_bug.cgi?id=171310
2019
2020         Reviewed by Yusuke Suzuki.
2021
2022         * stress/destructuring-assignment-syntax.js:
2023         * stress/error-messages-for-in-operator-should-not-crash.js:
2024         (catch):
2025         * stress/reserved-word-with-escape.js:
2026         (testSyntaxError.String.raw.v):
2027         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
2028         (testSyntaxError.String.raw.a):
2029         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
2030
2031 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2032
2033         [DFG] Add ArrayIndexOf intrinsic
2034         https://bugs.webkit.org/show_bug.cgi?id=172421
2035
2036         Reviewed by Saam Barati.
2037
2038         * stress/array-indexof-array-prototype-change.js: Added.
2039         (shouldBe):
2040         (indexOfInt32):
2041         * stress/array-indexof-have-a-bad-time-getter.js: Added.
2042         (shouldBe):
2043         (indexOfInt32):
2044         * stress/array-indexof-have-a-bad-time.js: Added.
2045         (shouldBe):
2046         (indexOfInt32):
2047         * stress/array-indexof-hole-with-prototype.js: Added.
2048         (shouldBe):
2049         (indexOf):
2050         * stress/array-indexof-hole.js: Added.
2051         (shouldBe):
2052         (indexOf):
2053         * stress/array-indexof-index.js: Added.
2054         (shouldBe):
2055         (indexOfInt32):
2056         (indexOfDouble):
2057         (indexOfString):
2058         (indexOfObject):
2059         (indexOfValue):
2060         * stress/array-indexof-negative-index.js: Added.
2061         (shouldBe):
2062         (indexOfInt32):
2063         (indexOfDouble):
2064         (indexOfString):
2065         (indexOfObject):
2066         (indexOfValue):
2067         * stress/array-indexof-non-int32-start-index.js: Added.
2068         (shouldBe):
2069         (indexOf):
2070         (object.valueOf):
2071         * stress/array-indexof-object-prototype-change.js: Added.
2072         (shouldBe):
2073         (indexOfInt32):
2074         * stress/array-indexof-object.js: Added.
2075         (shouldBe):
2076         (indexOf):
2077         * stress/array-indexof-original-array.js: Added.
2078         (shouldBe):
2079         (indexOfInt32):
2080         * stress/array-indexof-string.js: Added.
2081         (shouldBe):
2082         (indexOf):
2083         * stress/array-indexof-structure-change-convert.js: Added.
2084         (shouldBe):
2085         (indexOf):
2086         * stress/array-indexof-structure-change.js: Added.
2087         (shouldBe):
2088         (indexOf):
2089         * stress/array-indexof.js: Added.
2090         (shouldBe):
2091         (indexOf):
2092
2093 2017-06-11  Keith Miller  <keith_miller@apple.com>
2094
2095         TypedArray constructor with string shouldn't throw
2096         https://bugs.webkit.org/show_bug.cgi?id=173181
2097
2098         Reviewed by JF Bastien.
2099
2100         We should be coercing primitive arguments to numbers in the various
2101         TypedArray constructors.
2102
2103         * stress/typedarray-constructor.js:
2104
2105 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
2106
2107         Unreviewed, update test results part 3
2108         https://bugs.webkit.org/show_bug.cgi?id=173227
2109
2110         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
2111
2112 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2113
2114         Unreviewed, update test results part 2
2115         https://bugs.webkit.org/show_bug.cgi?id=173227
2116
2117         * test262.yaml:
2118
2119 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2120
2121         Unreviewed, update test results
2122         https://bugs.webkit.org/show_bug.cgi?id=173227
2123
2124         * microbenchmarks/string-prototype-search-observable-side-effects.js:
2125         * test262.yaml:
2126
2127 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2128
2129         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
2130         https://bugs.webkit.org/show_bug.cgi?id=173227
2131
2132         Reviewed by Mark Lam.
2133
2134         Update the test.
2135
2136         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
2137
2138 2017-06-08  Keith Miller  <keith_miller@apple.com>
2139
2140         WebAssembly: We should only create wrappers for functions that can be exported
2141         https://bugs.webkit.org/show_bug.cgi?id=173088
2142
2143         Reviewed by Saam Barati.
2144
2145         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
2146         on the old testWasmModuleFunctions api, which has been removed.
2147
2148         * wasm/function-tests/copysign.js: Removed.
2149         * wasm/function-tests/ctz.js: Removed.
2150         * wasm/function-tests/drop.js: Removed.
2151         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
2152         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
2153         * wasm/function-tests/dumb-less-than-ite.js: Removed.
2154         * wasm/function-tests/eqz.js: Removed.
2155         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
2156         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
2157         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
2158         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
2159         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
2160         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
2161         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
2162         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
2163         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
2164         * wasm/function-tests/if-then-fallthrough.js: Removed.
2165         * wasm/function-tests/int-to-floating-point.js: Removed.
2166         * wasm/function-tests/loop-mult.js:
2167         * wasm/function-tests/loop-sum.js:
2168         * wasm/function-tests/max.js: Removed.
2169         * wasm/function-tests/min.js: Removed.
2170         * wasm/function-tests/nearest.js: Removed.
2171         * wasm/function-tests/nop.js: Removed.
2172         * wasm/function-tests/popcnt.js: Removed.
2173         * wasm/function-tests/ret5.js:
2174         * wasm/function-tests/select.js: Removed.
2175         * wasm/function-tests/tee-local.js: Removed.
2176         * wasm/function-tests/trunc.js: Removed.
2177
2178 2017-06-07  JF Bastien  <jfbastien@apple.com>
2179
2180         WebAssembly: test imports and exports with 16-bit characters
2181         https://bugs.webkit.org/show_bug.cgi?id=165977
2182         <rdar://problem/29760130>
2183
2184         Reviewed by Saam Barati.
2185
2186         The output for import failure was improved, so many tests need to
2187         be updated here. Only one has new tests as noted below.
2188
2189         * wasm/function-tests/memory-import-and-grow.js:
2190         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
2191         (idxModule):
2192         * wasm/js-api/global-error.js:
2193         (new.Number):
2194         (assert.throws):
2195         * wasm/js-api/table.js:
2196         (assert.throws):
2197         (new.WebAssembly.Table):
2198         * wasm/js-api/test_memory.js:
2199         (test):
2200         * wasm/js-api/wasm-to-wasm-bad-signature.js:
2201         (BadSignatureDropStartParams.):
2202         (BadSignatureDropStartParams):
2203         (BadSignatureDropEndParams.):
2204         (BadSignatureSwapParam.):
2205         (BadSignatureRet.):
2206         * wasm/js-api/web-assembly-instantiate.js:
2207         (assert.asyncTest.async.test):
2208         (assert.asyncTest):
2209         * wasm/js-api/wrapper-function.js:
2210         (return.new.WebAssembly.Module):
2211
2212 2017-06-07  Mark Lam  <mark.lam@apple.com>
2213
2214         Restrict the regress-173035.js test to only run on Darwin x86-64.
2215         https://bugs.webkit.org/show_bug.cgi?id=173075
2216
2217         Reviewed by Saam Barati.
2218
2219         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
2220         this test will require to succeed.  Here's an example of this failure:
2221         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
2222
2223         Since the issue is due to allocation of a very large amount of memory, the test
2224         will probably fail on iOS and other platforms as well.  Hence, we should just
2225         skip this test for any platforms that is not Darwin x86-64.
2226
2227         * stress/regress-173035.js:
2228
2229 2017-06-07  Mark Lam  <mark.lam@apple.com>
2230
2231         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
2232         https://bugs.webkit.org/show_bug.cgi?id=168587
2233
2234         Not reviewed.
2235
2236         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
2237
2238         * stress/test-finally.js:
2239
2240 2017-06-06  Mark Lam  <mark.lam@apple.com>
2241
2242         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
2243         https://bugs.webkit.org/show_bug.cgi?id=173035
2244         <rdar://problem/32554593>
2245
2246         Reviewed by Geoffrey Garen and Filip Pizlo.
2247
2248         * stress/regress-173035.js: Added.
2249
2250 2017-06-06  Saam Barati  <sbarati@apple.com>
2251
2252         Make sure we restore SP when doing calls that could be to JS
2253         https://bugs.webkit.org/show_bug.cgi?id=172946
2254         <rdar://problem/32579026>
2255
2256         Reviewed by JF Bastien.
2257
2258         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
2259         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
2260         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
2261         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
2262         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
2263
2264 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
2265
2266         Unreviewed rollout r217807. Caused a test to crash.
2267
2268         * heapProfiler/class-names.js: Removed.
2269         * heapProfiler/driver/driver.js:
2270         (CheapHeapSnapshotNode):
2271         (CheapHeapSnapshot):
2272         (createCheapHeapSnapshot):
2273         (HeapSnapshot):
2274         (createHeapSnapshot):
2275         * typeProfiler/inheritance.js:
2276         (wrapper.A):
2277         (wrapper.B):
2278         (wrapper.C):
2279         (wrapper):
2280
2281 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
2282
2283         index out of bound in bytecodebasicblock
2284         https://bugs.webkit.org/show_bug.cgi?id=172963
2285
2286         Reviewed by Saam Barati and Mark Lam.
2287
2288         * stress/dfg-call-class-constructor.js: Added.
2289         (Foo):
2290         (i.catch):
2291
2292 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
2293
2294         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
2295         https://bugs.webkit.org/show_bug.cgi?id=172848
2296         <rdar://problem/25709212>
2297
2298         Reviewed by Saam Barati.
2299
2300         * typeProfiler/inheritance.js:
2301         Rewrite the test slightly for clarity. The hoisting was confusing.
2302
2303         * heapProfiler/class-names.js: Added.
2304         (MyES5Class):
2305         (MyES6Class):
2306         (MyES6Subclass):
2307         Test object types and improved class names.
2308
2309         * heapProfiler/driver/driver.js:
2310         (CheapHeapSnapshotNode):
2311         (CheapHeapSnapshot):
2312         (createCheapHeapSnapshot):
2313         (HeapSnapshot):
2314         (createHeapSnapshot):
2315         Update snapshot parsing from version 1 to version 2.
2316
2317 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2318
2319         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
2320         https://bugs.webkit.org/show_bug.cgi?id=168844
2321
2322         Reviewed by Saam Barati.
2323
2324         * modules/async-function-export.js: Added.
2325         (f):
2326         (export.async.f):
2327
2328 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2329
2330         ES2015 modules - Export default function hoisting
2331         https://bugs.webkit.org/show_bug.cgi?id=170174
2332
2333         Reviewed by Saam Barati.
2334
2335         This issue itself is solved by fixing function declaration hoisting rules.
2336         This patch just adds the specific test to modules tests to ensure the bug
2337         is fixed.
2338
2339         * modules/export-default-function-hoisting.js: Added.
2340         * modules/export-default-function-hoisting/cappuccino.js: Added.
2341         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
2342         * modules/export-default-function-hoisting/cocoa.js: Added.
2343         (export.default.drinkCocoa):
2344
2345 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2346
2347         Class Proxy can't be extended
2348         https://bugs.webkit.org/show_bug.cgi?id=169040
2349
2350         Reviewed by Saam Barati.
2351
2352         Adding tests that check correctness of Proxy to ES6 `class`
2353         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
2354
2355         * stress/proxy-class.js: Added.
2356         (assert):
2357         (throw.new.Error.SuperClass):
2358         (throw.new.Error.A):
2359         (throw.new.Error):
2360
2361 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2362
2363         [JSC] Implement String.prototype.concat in JS builtins
2364         https://bugs.webkit.org/show_bug.cgi?id=172798
2365
2366         Reviewed by Sam Weinig.
2367
2368         * microbenchmarks/string-concat-convert.js: Added.
2369         (test):
2370         * microbenchmarks/string-concat-long-convert.js: Added.
2371         (test):
2372         * microbenchmarks/string-concat-long.js: Added.
2373         (test):
2374         * microbenchmarks/string-concat.js: Added.
2375         (test):
2376
2377 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
2378
2379         Rolling out: Prevent async methods named 'function'
2380         https://bugs.webkit.org/show_bug.cgi?id=172776
2381
2382         Reviewed by Mark Lam.
2383
2384         * stress/async-await-syntax.js:
2385         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2386         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2387         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2388         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2389         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2390
2391 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
2392
2393         Skip flaky JSC test stress/test-finally.js
2394         https://bugs.webkit.org/show_bug.cgi?id=168587
2395
2396         Unreviewed test gardening.
2397
2398         * stress/test-finally.js:
2399
2400 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2401
2402         Prevent async methods named 'function' in Object literal
2403         https://bugs.webkit.org/show_bug.cgi?id=172660
2404
2405         Reviewed by Saam Barati.
2406
2407         * stress/async-await-syntax.js:
2408         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2409
2410 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2411
2412         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
2413         https://bugs.webkit.org/show_bug.cgi?id=171274
2414
2415         Reviewed by Saam Barati.
2416
2417         * stress/async-arrow-functions-lexical-binding-in-class.js:
2418         (shouldBeAsync):
2419         (shouldBeAsyncAndStoreBind):
2420         (promise.new.Promise):
2421         (ChildClass4):
2422         (ChildClass4.prototype.classValue):
2423         (ChildClass4.prototype.get classProperty):
2424         * stress/async-arrow-functions-lexical-super-binding.js:
2425         (A):
2426         (const.childA1.new.prototype.var.f.async):
2427         (const.childA1.new.var):
2428         (const.childA1.new):
2429         (const.childA2.new.prototype.var.f.async):
2430         (const.childA2.new.var):
2431         (const.childA2.new):
2432         (const.childA3.new.prototype.var.f.async):
2433         (const.childA3.new.var):
2434         (const.childA3.new):
2435         (try.childA4.new.prototype.var.f.async):
2436         (try.childA4.new.var):
2437         (try.childA4.new):
2438         (catch):
2439         (const.childA5.new.prototype.var.f.async):
2440         (const.childA5.new.var):
2441         (const.childA5.new):
2442         (checkClass):
2443         (checkClass.new.prototype.var.f.async):
2444         (checkClass.new.var):
2445         (checkClass.new):
2446         (checkClass.new.prototype.method):
2447         (checkClass.new.prototype.prop):
2448
2449 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2450
2451         [JSC] Map and Set constructors should have fast path for cloning
2452         https://bugs.webkit.org/show_bug.cgi?id=172413
2453
2454         Reviewed by Saam Barati.
2455
2456         * stress/map-clone-instance-iterator-change.js: Added.
2457         (shouldBe):
2458         (map.Symbol.iterator):
2459         * stress/map-clone-iterator-change.js: Added.
2460         (shouldBe):
2461         (Map.prototype.Symbol.iterator):
2462         * stress/map-clone-next-change.js: Added.
2463         (shouldBe):
2464         (map.Symbol.iterator.__proto__.next):
2465         * stress/map-clone.js: Added.
2466         (shouldBe):
2467         (Map.prototype):
2468         * stress/map-inherit-set.js: Added.
2469         (shouldBe):
2470         (DerivedMap):
2471         (set for):
2472         * stress/set-clone-instance-iterator-change.js: Added.
2473         (shouldBe):
2474         (set Symbol.iterator):
2475         * stress/set-clone-iterator-change.js: Added.
2476         (shouldBe):
2477         (set Set.prototype.Symbol.iterator):
2478         * stress/set-clone-next-change.js: Added.
2479         (shouldBe):
2480         (set Symbol.iterator.__proto__.next):
2481         * stress/set-clone.js: Added.
2482         (shouldBe):
2483         (set Set.prototype.add):
2484         * stress/set-inherit-add.js: Added.
2485         (shouldBe):
2486         (DerivedSet.set add):
2487
2488 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
2489
2490         Unreviewed, rolling out r217458.
2491
2492         This change caused 55 JSC test failures.
2493
2494         Reverted changeset:
2495
2496         "Date should use historical data if it's available."
2497         https://bugs.webkit.org/show_bug.cgi?id=172592
2498         http://trac.webkit.org/changeset/217458
2499
2500 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2501
2502         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
2503         https://bugs.webkit.org/show_bug.cgi?id=167805
2504
2505         Reviewed by Saam Barati.
2506
2507         * modules/module-jit-reachability.js: Added.
2508
2509 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
2510
2511         Prevent async methods named 'function'
2512         https://bugs.webkit.org/show_bug.cgi?id=172598
2513
2514         Reviewed by Mark Lam.
2515
2516         * stress/async-await-syntax.js:
2517         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2518         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2519         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2520         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2521         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2522
2523 2017-05-25  Keith Miller  <keith_miller@apple.com>
2524
2525         Date should use historical data if it's available.
2526         https://bugs.webkit.org/show_bug.cgi?id=172592
2527
2528         Reviewed by Mark Lam.
2529
2530         Remove parts of the date tests that rely on the absence of
2531         historical data in Date.
2532
2533         * mozilla/ecma/Date/15.9.5.31-1.js:
2534         (getTestCases):
2535         * mozilla/ecma/Date/15.9.5.35-1.js:
2536         (getTestCases):
2537
2538 2017-05-25  Saam Barati  <sbarati@apple.com>
2539
2540         Our for-in optimization in the bytecode generator does its static analysis incorrectly
2541         https://bugs.webkit.org/show_bug.cgi?id=172532
2542         <rdar://problem/32369452>
2543
2544         Reviewed by Mark Lam.
2545
2546         * stress/for-in-invalidation-for-any-write.js: Added.
2547         (assert):
2548         (test):
2549         (test.i):
2550
2551 2017-05-25  Mark Lam  <mark.lam@apple.com>
2552
2553         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
2554         https://bugs.webkit.org/show_bug.cgi?id=172548
2555         <rdar://problem/31458393>
2556
2557         Reviewed by Filip Pizlo.
2558
2559         * stress/regress-172548.patch: Added.
2560
2561 2017-05-23  Saam Barati  <sbarati@apple.com>
2562
2563         We should not mmap zero bytes for a memory in Wasm
2564         https://bugs.webkit.org/show_bug.cgi?id=172528
2565         <rdar://problem/32257076>
2566
2567         Reviewed by Mark Lam.
2568
2569         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
2570         (testMems):
2571
2572 2017-05-23  Saam Barati  <sbarati@apple.com>
2573
2574         CFGSimplificationPhase should not merge a block with itself
2575         https://bugs.webkit.org/show_bug.cgi?id=172508
2576         <rdar://problem/28424006>
2577
2578         Reviewed by Keith Miller.
2579
2580         * stress/dont-crash-in-cfg-simplification.js: Added.
2581         (bar):
2582         (baz):
2583         (foo):
2584
2585 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2586
2587         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
2588         https://bugs.webkit.org/show_bug.cgi?id=172216
2589
2590         Reviewed by Saam Barati.
2591
2592         * stress/array-storage-get-by-val.js: Added.
2593         (shouldBe):
2594         (testOutOfBound):
2595         (testInBound):
2596         (testSlowPutOutOfBound):
2597         (testSlowPutInBound):
2598
2599 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2600
2601         Unreviewed, fix commented out tests
2602         https://bugs.webkit.org/show_bug.cgi?id=172225
2603
2604         * stress/get-by-val-string.js:
2605         (object.43):
2606         (Hello):
2607         (Hello.prototype.get 42):
2608         (Hello.prototype.43):
2609         (Derived):
2610         (shouldBe):
2611         (throw.new.Error): Deleted.
2612
2613 2017-05-21  Saam Barati  <sbarati@apple.com>
2614
2615         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
2616         https://bugs.webkit.org/show_bug.cgi?id=171041
2617         <rdar://problem/32082516>
2618
2619         Reviewed by Yusuke Suzuki.
2620
2621         * stress/lexical-scoping-for-loop.js: Added.
2622         (assert):
2623         (test1):
2624         (test2):
2625         (test3):
2626         (test4):
2627         (test5):
2628         (test6):
2629         (let.test7):
2630         (let.test8):
2631         (let.test9):
2632         (let.test10):
2633         (let.test11):
2634         (let.test12):
2635
2636 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2637
2638         [JSC] Make get_by_val & string "499" to number 499
2639         https://bugs.webkit.org/show_bug.cgi?id=172225
2640
2641         Reviewed by Saam Barati.
2642
2643         * stress/get-by-val-string.js: Added.
2644         (shouldBe):
2645         (shouldThrow):
2646         (object.43):
2647         (Hello):
2648         (Hello.prototype.get 42):
2649         (Hello.prototype.43):
2650         (Derived):
2651
2652 2017-05-19  Mark Lam  <mark.lam@apple.com>
2653
2654         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2655         https://bugs.webkit.org/show_bug.cgi?id=172383
2656         <rdar://problem/31418651>
2657
2658         Reviewed by Filip Pizlo.
2659
2660         * stress/regress-172383.js: Added.
2661
2662 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
2663
2664         Unreviewed, rolling out r217156.
2665
2666         This change broke the iOS build.
2667
2668         Reverted changeset:
2669
2670         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
2671         result registers."
2672         https://bugs.webkit.org/show_bug.cgi?id=172383
2673         http://trac.webkit.org/changeset/217156
2674
2675 2017-05-19  Mark Lam  <mark.lam@apple.com>
2676
2677         Add missing exception check.
2678         https://bugs.webkit.org/show_bug.cgi?id=172346
2679         <rdar://problem/32289640>
2680
2681         Reviewed by Geoffrey Garen.
2682
2683         * stress/regress-172346.js: Added.
2684
2685 2017-05-19  Mark Lam  <mark.lam@apple.com>
2686
2687         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2688         https://bugs.webkit.org/show_bug.cgi?id=172383
2689         <rdar://problem/31418651>
2690
2691         Reviewed by Filip Pizlo.
2692
2693         * stress/regress-172383.js: Added.
2694
2695 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
2696
2697         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
2698         https://bugs.webkit.org/show_bug.cgi?id=172369
2699
2700         Reviewed by Mark Lam.
2701
2702         * stress/undecided-concat.js: Added.
2703
2704 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2705
2706         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2707         https://bugs.webkit.org/show_bug.cgi?id=172098
2708
2709         Reviewed by Saam Barati.
2710
2711         * stress/check-sub-class.js: Added.
2712         (shouldBe):
2713         (shouldThrow):
2714         (calling):
2715         (array.forEach):
2716         (i.array.forEach):
2717
2718 2017-05-18  JF Bastien  <jfbastien@apple.com>
2719
2720         WebAssembly: exports is a getter
2721         https://bugs.webkit.org/show_bug.cgi?id=172129
2722
2723         Reviewed by Saam Barati.
2724
2725         Update test to reflect new semantics.
2726
2727         * wasm/js-api/test_basic_api.js:
2728         (const.c.in.constructorProperties.switch):
2729
2730 2017-05-18  Saam Barati  <sbarati@apple.com>
2731
2732         Proxy's [[Get]] passes incorrect receiver
2733         https://bugs.webkit.org/show_bug.cgi?id=164849
2734         <rdar://problem/31767058>
2735
2736         Reviewed by Yusuke Suzuki.
2737
2738         * stress/proxy-get-set-correct-receiver.js: Added.
2739         (assert):
2740         (test):
2741         (test.let.target.set prop):
2742         (test.let.target.get prop):
2743         (test.get let):
2744         * stress/proxy-set.js:
2745         (let.target.get x):
2746         * stress/reflect-set-proxy-set.js:
2747         (let.target.get x):
2748         * stress/reflect-set-receiver-proxy-set.js:
2749         (let.target.get x):
2750
2751 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2752
2753         Constructor calls set this too early
2754         https://bugs.webkit.org/show_bug.cgi?id=172302
2755
2756         Reviewed by Saam Barati.
2757
2758         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
2759         wrong.
2760
2761         * stress/construct-overwritten-variable.js: Added.
2762         (new.x.x):
2763         * stress/construct-spread-overwritten-variable-2.js: Added.
2764         (new.x.x):
2765         * stress/construct-spread-overwritten-variable.js: Added.
2766         (new.x.x):
2767
2768 2017-05-18  Saam Barati  <sbarati@apple.com>
2769
2770         WebAssembly: perform stack checks
2771         https://bugs.webkit.org/show_bug.cgi?id=165546
2772         <rdar://problem/29760307>
2773
2774         Reviewed by Filip Pizlo.
2775
2776         * wasm.yaml:
2777         * wasm/function-tests/factorial.js:
2778         * wasm/function-tests/float-sub.js:
2779         * wasm/function-tests/stack-overflow.js: Added.
2780         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2781         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2782         (assertOverflows.makeInstance):
2783         (assertOverflows.makeInstance2):
2784         (assertOverflows.assertThrows):
2785         (assertOverflows):
2786         (assertThrows.test.makeSignature):
2787         (assertThrows.test.makeInstance):
2788         (assertThrows.test):
2789         (assertThrows):
2790
2791 2017-05-18  Keith Miller  <keith_miller@apple.com>
2792
2793         WebAssembly API: test with neutered inputs
2794         https://bugs.webkit.org/show_bug.cgi?id=163899
2795
2796         Reviewed by JF Bastien.
2797
2798         * wasm/js-api/neutered-inputs.js: Added.
2799         (const.testFunction):
2800         (const.testConstructor):
2801         * wasm/js-api/test_basic_api.js:
2802         (const.c.in.constructorProperties.switch):
2803
2804 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2805
2806         DFG inlining should be hardened for the no-result case
2807         https://bugs.webkit.org/show_bug.cgi?id=172290
2808
2809         Reviewed by Saam Barati.
2810
2811         * stress/array-constructor-no-result.js: Added.
2812         (foo):
2813         * stress/pow-no-result.js: Added.
2814         (foo):
2815
2816 2017-05-18  Commit Queue  <commit-queue@webkit.org>
2817
2818         Unreviewed, rolling out r217031, r217032, and r217037.
2819         https://bugs.webkit.org/show_bug.cgi?id=172293
2820
2821         cause linking errors in Windows (Requested by yusukesuzuki on
2822         #webkit).
2823
2824         Reverted changesets:
2825
2826         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
2827         https://bugs.webkit.org/show_bug.cgi?id=172098
2828         http://trac.webkit.org/changeset/217031
2829
2830         "Unreviewed, rebaseline for newly added ClassInfo"
2831         https://bugs.webkit.org/show_bug.cgi?id=172098
2832         http://trac.webkit.org/changeset/217032
2833
2834         "Unreviewed, fix debug and non-JIT build"
2835         https://bugs.webkit.org/show_bug.cgi?id=172098
2836         http://trac.webkit.org/changeset/217037
2837
2838 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2839
2840         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2841         https://bugs.webkit.org/show_bug.cgi?id=172098
2842
2843         Reviewed by Saam Barati.
2844
2845         * stress/check-sub-class.js: Added.
2846         (shouldBe):
2847         (shouldThrow):
2848         (calling):
2849         (array.forEach):
2850         (i.array.forEach):
2851
2852 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2853
2854         Unreviewed, address mlam's review feedback.
2855
2856         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
2857
2858 2017-05-17  Saam Barati  <sbarati@apple.com>
2859
2860         We don't do context switches for Wasm->Wasm call indirect
2861         https://bugs.webkit.org/show_bug.cgi?id=172188
2862         <rdar://problem/32231828>
2863
2864         Reviewed by Keith Miller.
2865
2866         * wasm/function-tests/context-switch.js: Added.
2867         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2868         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
2869         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
2870         (makeInstance):
2871         (makeInstance2):
2872         (assert.eq.makeInstance):
2873         (assert.eq.makeInstance2):
2874         (assert.eq):
2875
2876 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2877
2878         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
2879         https://bugs.webkit.org/show_bug.cgi?id=172208
2880
2881         Reviewed by Saam Barati.
2882
2883         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
2884         (foo):
2885         (bar):
2886         (baz):
2887
2888 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2889
2890         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
2891         https://bugs.webkit.org/show_bug.cgi?id=172115
2892
2893         Reviewed by Saam Barati.
2894
2895         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
2896         (shouldBe):
2897         (unknown):
2898         (readWord1):
2899         (readWord2):
2900         (readWord3):
2901         (readWord4):
2902
2903 2017-05-16  JF Bastien  <jfbastien@apple.com>
2904
2905         WebAssembly: add memory fuzzer
2906         https://bugs.webkit.org/show_bug.cgi?id=169976
2907         <rdar://problem/31965328>
2908
2909         Reviewed by Keith Miller.
2910
2911         * wasm/fuzz/memory.js: Added.
2912         (const.insert):
2913         (const.action.string_appeared_here):
2914         (const.performAction):
2915         (catch):
2916
2917 2017-05-16  JF Bastien  <jfbastien@apple.com>
2918
2919         WebAssembly: validate load / store alignment
2920         https://bugs.webkit.org/show_bug.cgi?id=168836
2921         <rdar://problem/31965349>
2922
2923         Reviewed by Keith Miller.
2924
2925         * wasm/WASM.js: fix regular expression greed
2926         * wasm/function-tests/memory-alignment.js: Added.
2927         (const.op.of.WASM.opcodes):
2928         * wasm/wasm.json: fix formatting
2929
2930 2017-05-15  Mark Lam  <mark.lam@apple.com>
2931
2932         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
2933         https://bugs.webkit.org/show_bug.cgi?id=172147
2934
2935         Rubber-stamped by Saam Barati.
2936
2937         * stress/object-rest-deconstruct.js: Removed.
2938         * stress/object-spread.js: Removed.
2939
2940 2017-05-11  JF Bastien  <jfbastien@apple.com>
2941
2942         WebAssembly: stop supporting 0xD
2943         https://bugs.webkit.org/show_bug.cgi?id=168788
2944         <rdar://problem/31880922>
2945
2946         Reviewed by Saam Barati.
2947
2948         Test that only version 1 is supported.
2949
2950         * wasm/js-api/version.js: Added.
2951
2952 2017-05-10  JF Bastien  <jfbastien@apple.com>
2953
2954         WebAssemby: builder doesn't do Memory section maximum correctly
2955         https://bugs.webkit.org/show_bug.cgi?id=171931
2956
2957         Reviewed by Keith Miller.
2958
2959         * wasm/Builder.js:
2960         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
2961         * wasm/Builder_WebAssemblyBinary.js:
2962         (const.emitters.Memory):
2963         * wasm/function-tests/memory-grow-invalid.js: Added.
2964
2965 2017-05-10  JF Bastien  <jfbastien@apple.com>
2966
2967         WebAssembly: support name section
2968         https://bugs.webkit.org/show_bug.cgi?id=171263
2969
2970         Reviewed by Keith Miller.
2971
2972         * wasm/function-tests/nameSection.js: Added.
2973         (const.compile):
2974         * wasm/function-tests/nameSection.wasm: Added.
2975         * wasm/function-tests/stack-trace.js: Update format
2976
2977 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
2978
2979         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
2980         https://bugs.webkit.org/show_bug.cgi?id=171801
2981
2982         Reviewed by Michael Saboff.
2983
2984         These tests used to crash. The prefix and postfix tests cover different paths, except
2985         postfix-ignored goes down the same path as prefix due to an optimization.
2986
2987         * stress/for-in-postfix-ignored-index.js: Added.
2988         (foo):
2989         * stress/for-in-postfix-index.js: Added.
2990         (foo):
2991         * stress/for-in-prefix-index.js: Added.
2992         (foo):
2993
2994 2017-05-08  Mark Lam  <mark.lam@apple.com>
2995
2996         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
2997         https://bugs.webkit.org/show_bug.cgi?id=171786
2998         <rdar://problem/32051023>
2999
3000         Reviewed by Saam Barati.
3001
3002         * stress/bug-171786.js: Added.
3003
3004 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3005
3006         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
3007         https://bugs.webkit.org/show_bug.cgi?id=171543
3008
3009         Reviewed by Saam Barati.
3010
3011         * stress/arrowfunction-lexical-bind-supercall-4.js:
3012         (J):
3013         (K):
3014
3015 2017-05-05  Saam Barati  <sbarati@apple.com>
3016
3017         putDirectIndex does not properly do defineOwnProperty
3018         https://bugs.webkit.org/show_bug.cgi?id=171591
3019         <rdar://problem/31735695>
3020
3021         Reviewed by Geoffrey Garen.
3022
3023         * stress/array-prototype-splice-making-typed-array.js:
3024         (test):
3025         * stress/array-species-config-array-constructor.js:
3026         (shouldThrow):
3027         (test):
3028         * stress/put-direct-index-broken-2.js: Added.
3029         (assert):
3030         (test):
3031         (makeLengthWritable):
3032         (set get restoreOldDesc):
3033         * stress/put-direct-index-broken.js: Added.
3034         (whatToTest):
3035         (tryRunning):
3036         (tryItOut):
3037         * stress/put-indexed-getter-setter.js: Added.
3038         (foo.X.prototype.set 7):
3039         (foo.X.prototype.get 7):
3040         (foo.X):
3041         (foo):
3042
3043 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
3044
3045         [JSC] Math unary functions should be handled by DFG
3046         https://bugs.webkit.org/show_bug.cgi?id=171269
3047
3048         Reviewed by Saam Barati.
3049
3050         * stress/arith-acos-on-various-types.js: Added.
3051         (let.validInputTypedTestCases.validInputTestCases.map):
3052         (isIdentical):
3053         (opaqueACosNoArgument):
3054         (testNoArgument):
3055         (opaqueAllTypesACos):
3056         (testAllTypesCall):
3057         (testSingleTypeCall):
3058         (testConstant):
3059         (opaqueACosForSideEffects):
3060         (testSideEffect.let.testObject.valueOf):
3061         (testSideEffect):
3062         (opaqueACosForCSE):
3063         (testCSE.let.testObject.valueOf):
3064         (testCSE):
3065         (opaqueACosForDCE):
3066         (testDCE.let.testObject.valueOf):
3067         (testDCE):
3068         (testException.opaqueACosWithException):
3069         (testException):
3070         * stress/arith-acosh-on-various-types.js: Added.
3071         (let.validInputTypedTestCases.validInputTestCases.map):
3072         (isIdentical):
3073         (opaqueACoshNoArgument):
3074         (testNoArgument):
3075         (opaqueAllTypesACosh):
3076         (testAllTypesCall):
3077         (testSingleTypeCall):
3078         (testConstant):
3079         (opaqueACoshForSideEffects):
3080         (testSideEffect.let.testObject.valueOf):
3081         (testSideEffect):
3082         (opaqueACoshForCSE):
3083         (testCSE.let.testObject.valueOf):
3084         (testCSE):
3085         (opaqueACoshForDCE):
3086         (testDCE.let.testObject.valueOf):
3087         (testDCE):
3088         (testException.opaqueACoshWithException):
3089         (testException):
3090         * stress/arith-asin-on-various-types.js: Added.
3091         (let.validInputTypedTestCases.validInputTestCases.map):
3092         (isIdentical):
3093         (opaqueASinNoArgument):
3094         (testNoArgument):
3095         (opaqueAllTypesASin):
3096         (testAllTypesCall):
3097         (testSingleTypeCall):
3098         (testConstant):
3099         (opaqueASinForSideEffects):
3100         (testSideEffect.let.testObject.valueOf):
3101         (testSideEffect):
3102         (opaqueASinForCSE):
3103         (testCSE.let.testObject.valueOf):
3104         (testCSE):
3105         (opaqueASinForDCE):
3106         (testDCE.let.testObject.valueOf):
3107         (testDCE):
3108         (testException.opaqueASinWithException):
3109         (testException):
3110         * stress/arith-asinh-on-various-types.js: Added.
3111         (let.validInputTypedTestCases.validInputTestCases.map):
3112         (isIdentical):
3113         (opaqueASinhNoArgument):
3114         (testNoArgument):
3115         (opaqueAllTypesASinh):
3116         (testAllTypesCall):
3117         (testSingleTypeCall):
3118         (testConstant):
3119         (opaqueASinhForSideEffects):
3120         (testSideEffect.let.testObject.valueOf):
3121         (testSideEffect):
3122         (opaqueASinhForCSE):
3123         (testCSE.let.testObject.valueOf):
3124         (testCSE):
3125         (opaqueASinhForDCE):
3126         (testDCE.let.testObject.valueOf):
3127         (testDCE):
3128         (testException.opaqueASinhWithException):
3129         (testException):
3130         * stress/arith-atan-on-various-types.js: Added.
3131         (let.validInputTypedTestCases.validInputTestCases.map):
3132         (isIdentical):
3133         (opaqueATanNoArgument):
3134         (testNoArgument):
3135         (opaqueAllTypesATan):
3136         (testAllTypesCall):
3137         (testSingleTypeCall):
3138         (testConstant):
3139         (opaqueATanForSideEffects):
3140         (testSideEffect.let.testObject.valueOf):
3141         (testSideEffect):
3142         (opaqueATanForCSE):
3143         (testCSE.let.testObject.valueOf):
3144         (testCSE):
3145         (opaqueATanForDCE):
3146         (testDCE.let.testObject.valueOf):
3147         (testDCE):
3148         (testException.opaqueATanWithException):
3149         (testException):
3150         * stress/arith-atanh-on-various-types.js: Added.
3151         (let.validInputTypedTestCases.validInputTestCases.map):
3152         (isIdentical):
3153         (opaqueATanhNoArgument):
3154         (testNoArgument):
3155         (opaqueAllTypesATanh):
3156         (testAllTypesCall):
3157         (testSingleTypeCall):
3158         (testConstant):
3159         (opaqueATanhForSideEffects):
3160         (testSideEffect.let.testObject.valueOf):
3161         (testSideEffect):
3162         (opaqueATanhForCSE):
3163         (testCSE.let.testObject.valueOf):
3164         (testCSE):
3165         (opaqueATanhForDCE):
3166         (testDCE.let.testObject.valueOf):
3167         (testDCE):
3168         (testException.opaqueATanhWithException):
3169         (testException):
3170         * stress/arith-cbrt-on-various-types.js: Added.
3171         (let.validInputTypedTestCases.validInputTestCases.map):
3172         (isIdentical):
3173         (opaqueCbrtNoArgument):
3174         (testNoArgument):
3175         (opaqueAllTypesCbrt):
3176         (testAllTypesCall):
3177         (testSingleTypeCall):
3178         (testConstant):
3179         (opaqueCbrtForSideEffects):
3180         (testSideEffect.let.testObject.valueOf):
3181         (testSideEffect):
3182         (opaqueCbrtForCSE):
3183         (testCSE.let.testObject.valueOf):
3184         (testCSE):
3185         (opaqueCbrtForDCE):
3186         (testDCE.let.testObject.valueOf):
3187         (testDCE):
3188         (testException.opaqueCbrtWithException):
3189         (testException):
3190         * stress/arith-cosh-on-various-types.js: Added.
3191         (let.validInputTypedTestCases.validInputTestCases.map):
3192         (isIdentical):
3193         (opaqueCoshNoArgument):
3194         (testNoArgument):
3195         (opaqueAllTypesCosh):
3196         (testAllTypesCall):
3197         (testSingleTypeCall):
3198         (testConstant):
3199         (opaqueCoshForSideEffects):
3200         (testSideEffect.let.testObject.valueOf):
3201         (testSideEffect):
3202         (opaqueCoshForCSE):
3203         (testCSE.let.testObject.valueOf):
3204         (testCSE):
3205         (opaqueCoshForDCE):
3206         (testDCE.let.testObject.valueOf):
3207         (testDCE):
3208         (testException.opaqueCoshWithException):
3209         (testException):
3210         * stress/arith-expm1-on-various-types.js: Added.
3211         (let.validInputTypedTestCases.validInputTestCases.map):
3212         (isIdentical):
3213         (opaqueExpm1NoArgument):
3214         (testNoArgument):
3215         (opaqueAllTypesExpm1):
3216         (testAllTypesCall):
3217         (testSingleTypeCall):
3218         (testConstant):
3219         (opaqueExpm1ForSideEffects):
3220         (testSideEffect.let.testObject.valueOf):
3221         (testSideEffect):
3222         (opaqueExpm1ForCSE):
3223         (testCSE.let.testObject.valueOf):
3224         (testCSE):
3225         (opaqueExpm1ForDCE):
3226         (testDCE.let.testObject.valueOf):
3227         (testDCE):
3228         (testException.opaqueExpm1WithException):
3229         (testException):
3230         * stress/arith-log10-on-various-types.js: Added.
3231         (let.validInputTypedTestCases.validInputTestCases.map):
3232         (isIdentical):
3233         (opaqueLog10NoArgument):
3234         (testNoArgument):
3235         (opaqueAllTypesLog10):
3236         (testAllTypesCall):
3237         (testSingleTypeCall):
3238         (testConstant):
3239         (opaqueLog10ForSideEffects):
3240         (testSideEffect.let.testObject.valueOf):
3241         (testSideEffect):
3242         (opaqueLog10ForCSE):
3243         (testCSE.let.testObject.valueOf):
3244         (testCSE):
3245         (opaqueLog10ForDCE):
3246         (testDCE.let.testObject.valueOf):
3247         (testDCE):
3248         (testException.opaqueLog10WithException):
3249         (testException):
3250         * stress/arith-log2-on-various-types.js: Added.
3251         (let.validInputTypedTestCases.validInputTestCases.map):
3252         (isIdentical):
3253         (opaqueLog2NoArgument):
3254         (testNoArgument):
3255         (opaqueAllTypesLog2):
3256         (testAllTypesCall):
3257         (testSingleTypeCall):
3258         (testConstant):
3259         (opaqueLog2ForSideEffects):
3260         (testSideEffect.let.testObject.valueOf):
3261         (testSideEffect):
3262         (opaqueLog2ForCSE):
3263         (testCSE.let.testObject.valueOf):
3264         (testCSE):
3265         (opaqueLog2ForDCE):
3266         (testDCE.let.testObject.valueOf):
3267         (testDCE):
3268         (testException.opaqueLog2WithException):
3269         (testException):
3270         * stress/arith-sinh-on-various-types.js: Added.
3271         (let.validInputTypedTestCases.validInputTestCases.map):
3272         (isIdentical):
3273         (opaqueSinhNoArgument):
3274         (testNoArgument):
3275         (opaqueAllTypesSinh):
3276         (testAllTypesCall):
3277         (testSingleTypeCall):
3278         (testConstant):
3279         (opaqueSinhForSideEffects):
3280         (testSideEffect.let.testObject.valueOf):
3281         (testSideEffect):
3282         (opaqueSinhForCSE):
3283         (testCSE.let.testObject.valueOf):
3284         (testCSE):
3285         (opaqueSinhForDCE):
3286         (testDCE.let.testObject.valueOf):
3287         (testDCE):
3288         (testException.opaqueSinhWithException):
3289         (testException):
3290         * stress/arith-tan-on-various-types.js:
3291         (isIdentical):
3292         * stress/arith-tanh-on-various-types.js: Added.
3293         (let.validInputTypedTestCases.validInputTestCases.map):
3294         (isIdentical):
3295         (opaqueTanhNoArgument):
3296         (testNoArgument):
3297         (opaqueAllTypesTanh):
3298         (testAllTypesCall):
3299         (testSingleTypeCall):
3300         (testConstant):
3301         (opaqueTanhForSideEffects):
3302         (testSideEffect.let.testObject.valueOf):
3303         (testSideEffect):
3304         (opaqueTanhForCSE):
3305         (testCSE.let.testObject.valueOf):
3306         (testCSE):
3307         (opaqueTanhForDCE):
3308         (testDCE.let.testObject.valueOf):
3309         (testDCE):
3310         (testException.opaqueTanhWithException):
3311         (testException):
3312
3313 2017-05-03  Keith Miller  <keith_miller@apple.com>
3314
3315         Array.prototype.sort should also allow a null comparator
3316         https://bugs.webkit.org/show_bug.cgi?id=171621
3317
3318         Reviewed by Michael Saboff.
3319
3320         Add test to make it less likely we revert to the incompatable behavior.
3321         Also, fix now incorrect tests.
3322
3323         * ChakraCore/test/Array/array_sort.baseline-jsc:
3324         * stress/array-sort-bad-comparator.js:
3325         (test):
3326         * stress/sort-null-comparator.js: Added.
3327         (assertEq):
3328
3329 2017-05-03  Caitlin Potter  <caitp@igalia.com>
3330
3331         [JSC] remove unneeded asyncFunctionTests.yaml
3332         https://bugs.webkit.org/show_bug.cgi?id=171611
3333
3334         Reviewed by Yusuke Suzuki.
3335
3336         Async functions have shipped, and those tests are run as part of
3337         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
3338
3339         * asyncFunctionTests.yaml: Removed.
3340         * stress/async-await-long-loop.js:
3341         * stress/async-await-throw-loop.js:
3342
3343 2017-05-03  Keith Miller  <keith_miller@apple.com>
3344
3345         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
3346         https://bugs.webkit.org/show_bug.cgi?id=47825
3347
3348         Reviewed by Saam Barati.
3349
3350         * stress/sorting-boolean-result-comparator.js: Added.
3351         (checkArray):
3352
3353 2017-05-02  David Kilzer  <ddkilzer@apple.com>
3354
3355         check-webkit-style should keep JavaScript test functions in sync
3356         <https://webkit.org/b/171424>
3357
3358         Reviewed by Joseph Pecoraro.
3359
3360         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
3361         and shouldThrow() in sync with other copies of these methods.
3362
3363         * stress/resources/standalone-pre.js:
3364         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
3365         variables with underscore.
3366         (shouldThrow): Fix whitespace.
3367
3368 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3369
3370         We initialize functions too early in an eval
3371         https://bugs.webkit.org/show_bug.cgi?id=161099
3372
3373         Reviewed by Saam Barati.
3374
3375         * stress/eval-func-decl-with-let-const-class.js: Added.
3376
3377 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3378
3379         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3380         https://bugs.webkit.org/show_bug.cgi?id=163208
3381
3382         Reviewed by Saam Barati.
3383
3384         * stress/eval-func-decl-block-scoping-reassign.js: Added.
3385         (assert):
3386         (throw.new.Error.f):
3387         (throw.new.Error):
3388         * stress/eval-func-decl-block-with-remove.js: Added.
3389         (assert):
3390         (foo.boo):
3391         (foo):
3392         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3393         (assert):
3394         (assertThrow):
3395         (foo):
3396         (boo):
3397         (joo):
3398         (koo):
3399         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3400         (assert):
3401         (assertThrow):
3402         (foo):
3403         (boo):
3404         (hoo):
3405         (joo):
3406         (koo):
3407         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3408         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3409         (assert):
3410         (assertThrow):
3411         (foo):
3412         (boo):
3413         (goo):
3414         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3415         (assert):
3416         (assertThrow):
3417         (foo):
3418         (boo):
3419         (boo.let.val2):
3420         (boo.let.val3):
3421         * stress/eval-func-decl-in-frozen-global.js: Added.
3422         (assert):
3423         (assertThrow):
3424         (throw.new.Error):
3425         (Object.freeze):
3426         * stress/eval-func-decl-in-global-of-eval.js: Added.
3427         (assert):
3428         (assertThrow):
3429         (bar):
3430         (baz):
3431         (foobar):
3432         * stress/eval-func-decl-in-global.js: Added.
3433         (assert):
3434         (assertThrow):
3435         * stress/eval-func-decl-in-if.js: Added.
3436         (assert):
3437         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3438         (assert):
3439         (assertThrow):
3440         (foo):
3441         (boo):
3442         (foobar):
3443         (hoo):
3444         (joo):
3445         (koo):
3446         (loo):
3447         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3448         (assert):
3449         (assertThrow):
3450         (foo):
3451         (boo):
3452         (goo):
3453         * stress/variable-under-tdz-eval-tricky.js:
3454         (assert):
3455         * test262.yaml:
3456
3457 2017-04-27  Mark Lam  <mark.lam@apple.com>
3458
3459         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
3460         https://bugs.webkit.org/show_bug.cgi?id=171404
3461         <rdar://problem/31876178>
3462
3463         Reviewed by Saam Barati.
3464
3465         * stress/js-fixed-array-out-of-memory.js: Added.
3466
3467 2017-04-27  David Kilzer  <ddkilzer@apple.com>
3468
3469         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
3470         <https://webkit.org/b/171362>
3471         <rdar://problem/31867686>
3472
3473         Reviewed by Joseph Pecoraro.
3474
3475         * stress/resources/standalone-pre.js:
3476         (shouldBe):
3477         (shouldNotThrow):
3478         (shouldThrow):
3479         - Update shouldBe() to accept anonymous function arguments.
3480           (The shouldNotBe() function was never copied over.)
3481         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
3482           function arguments (which were missed in r202609 for Bug
3483           159232).
3484
3485 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3486
3487         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
3488         https://bugs.webkit.org/show_bug.cgi?id=171262
3489
3490         Reviewed by Saam Barati.
3491
3492         * stress/spread-outer-create-rest.js: Added.
3493         (assert):
3494         (foo):
3495         (bar):
3496         (baz):
3497
3498 2017-04-26  Saam Barati  <sbarati@apple.com>
3499
3500         Print Wasm function index in stack trace
3501         https://bugs.webkit.org/show_bug.cgi?id=171349
3502
3503         Reviewed by JF Bastien.
3504
3505         * wasm/function-tests/stack-trace.js: Added.
3506         (import.Builder.from.string_appeared_here.assert):
3507         (let.imp):
3508         * wasm/function-tests/trap-after-cross-instance-call.js:
3509         (wasmFrameCountFromError):
3510         * wasm/function-tests/trap-load-2.js:
3511         (wasmFrameCountFromError):
3512         * wasm/function-tests/trap-load.js:
3513         (wasmFrameCountFromError):
3514
3515 2017-04-26  Saam Barati  <sbarati@apple.com>
3516
3517         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
3518         https://bugs.webkit.org/show_bug.cgi?id=170924
3519         <rdar://problem/31721052>
3520
3521         Reviewed by Mark Lam.
3522
3523         * stress/error-message-for-function-base-not-found.js: Added.
3524         (assert):
3525         (throw.new.Error):
3526         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
3527         (catch):
3528
3529 2017-04-26  Keith Miller  <keith_miller@apple.com>
3530
3531         WebAssembly: Implement tier up
3532         https://bugs.webkit.org/show_bug.cgi?id=170134
3533
3534         Reviewed by Filip Pizlo.
3535
3536         * wasm/function-tests/trap-after-cross-instance-call.js:
3537         * wasm/tier-up/js-to-wasm.js: Added.
3538         (async.test):
3539         * wasm/tier-up/wasm-to-wasm.js: Added.
3540         (async.test):
3541
3542 2017-04-26  Caitlin Potter  <caitp@igalia.com>
3543
3544         [JSC] Object.keys() must discard property names with no PropertyDescriptor
3545         https://bugs.webkit.org/show_bug.cgi?id=171291
3546
3547         Reviewed by Yusuke Suzuki.
3548
3549         * es6/Proxy_ownKeys_duplicates.js:
3550         * stress/proxy-own-keys.js:
3551         (let.handler.getOwnPropertyDescriptor):
3552         (let.handler.ownKeys):
3553
3554 2017-04-25  Commit Queue  <commit-queue@webkit.org>
3555
3556         Unreviewed, rolling out r215476.
3557         https://bugs.webkit.org/show_bug.cgi?id=171304
3558
3559         "It broke JSBench" (Requested by saamyjoon on #webkit).
3560
3561         Reverted changeset:
3562
3563         "[ES6]. Implement Annex B.3.3 function hoisting rules for
3564         eval"
3565         https://bugs.webkit.org/show_bug.cgi?id=163208
3566         http://trac.webkit.org/changeset/215476
3567
3568 2017-04-25  Saam Barati  <sbarati@apple.com>
3569
3570         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
3571         https://bugs.webkit.org/show_bug.cgi?id=171150
3572         <rdar://problem/31771880>
3573
3574         Reviewed by Sam Weinig.
3575
3576         * stress/spread-optimized-properly.js: Added.
3577         (assert):
3578         (test):
3579         (shallowEq):
3580         (makeArrayIterator):
3581         (test.bar):
3582         (test.callback):
3583         (test.arr.__proto__.Symbol.iterator):
3584         (test.arr.Symbol.iterator):
3585         (test.get bar):
3586         (test.hackedNext):
3587         (test.test):
3588         (test.):
3589
3590 2017-04-25  Mark Lam  <mark.lam@apple.com>
3591
3592         [Follow up] Array.prototype.slice() should ensure that end >= begin.
3593         https://bugs.webkit.org/show_bug.cgi?id=170989
3594         <rdar://problem/31705652>
3595
3596         Not reviewed.
3597
3598         Follow up to rename a test file that was accidentally named wrongly.
3599
3600         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
3601         * stress/regress-170989.patch: Removed.
3602
3603 2017-04-25  Mark Lam  <mark.lam@apple.com>
3604
3605         Array.prototype.slice() should ensure that end >= begin.
3606         https://bugs.webkit.org/show_bug.cgi?id=170989
3607         <rdar://problem/31705652>
3608
3609         Reviewed by Saam Barati.
3610
3611         * stress/regress-170989.patch: Added.
3612
3613 2017-04-25  Mark Lam  <mark.lam@apple.com>
3614
3615         Local CSE wrongly CSEs array accesses with different result types.
3616         https://bugs.webkit.org/show_bug.cgi?id=170990
3617         <rdar://problem/31705945>
3618
3619         Reviewed by Saam Barati.
3620
3621         * stress/regress-170990.js: Added.
3622
3623 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3624
3625         WebAssembly: exporting a property with a name that's a number doesn't work
3626         https://bugs.webkit.org/show_bug.cgi?id=168857
3627
3628         Reviewed by JF Bastien.
3629
3630         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
3631
3632         * wasm/js-api/test_Instance.js:
3633         (ExportedNumber):
3634
3635 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3636
3637         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
3638         https://bugs.webkit.org/show_bug.cgi?id=171190
3639
3640         Reviewed by Saam Barati.
3641
3642         * stress/async-await-syntax.js:
3643         * test262.yaml:
3644
3645 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3646
3647         [JSC] Use JSFixedArray directly when using call_varargs
3648         https://bugs.webkit.org/show_bug.cgi?id=171057
3649
3650         Reviewed by Saam Barati.
3651
3652         * stress/spread-capture-rest.js: Added.
3653         (shouldBe):
3654         (capture):
3655         (a):
3656         (b):
3657         * stress/spread-multi-layers.js: Added.
3658         (shouldBe):
3659         (a):
3660         (b):
3661         (c):
3662         (d):
3663         * stress/spread-non-varargs.js: Added.
3664         (shouldBe):
3665         (a):
3666         (b):
3667
3668 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3669
3670         test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
3671         https://bugs.webkit.org/show_bug.cgi?id=170897
3672
3673         Reviewed by Saam Barati.
3674
3675         * test262.yaml:
3676
3677 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3678
3679         Address some FIXMEs in JavaScript tests for bugs that have been fixed
3680         https://bugs.webkit.org/show_bug.cgi?id=171191
3681
3682         Reviewed by JF Bastien.
3683
3684         * stress/proxy-is-extensible.js:
3685
3686 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3687
3688         test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
3689         https://bugs.webkit.org/show_bug.cgi?id=171160
3690
3691         Reviewed by JF Bastien.
3692
3693         * stress/inferred-names.js:
3694         * test262.yaml:
3695
3696 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3697
3698         test262: test262/test/language/expressions/generators/yield-as-label.js
3699         https://bugs.webkit.org/show_bug.cgi?id=170979
3700
3701         Reviewed by Saam Barati.
3702
3703         * stress/async-await-module-reserved-word.js:
3704         * stress/async-await-reserved-word.js:
3705         Converge on "Cannot" instead of "Can't".
3706
3707         * catch-parameter-syntax.js:
3708         * yield-named-variable-generator.js:
3709         * yield-named-variable.js:
3710         * stress/yield-label-generator.js:
3711         * stress/yield-label.js:
3712         * stress/yield-reserved-word.js: Added.
3713         More complete list of when 'yield' is allowed.
3714
3715         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3716         * test262.yaml:
3717
3718 2017-04-23  Commit Queue  <commit-queue@webkit.org>
3719
3720         Unreviewed, rolling out r215674.
3721         https://bugs.webkit.org/show_bug.cgi?id=171212
3722
3723         Possible unintended commit. This patch was on the wrong bug.
3724         (Requested by JoePeck on #webkit).
3725
3726         Reverted changeset:
3727
3728         "test262: test262/test/language/expressions/generators/yield-
3729         as-label.js"
3730         https://bugs.webkit.org/show_bug.cgi?id=170979
3731         http://trac.webkit.org/changeset/215674
3732
3733 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3734
3735         test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
3736         https://bugs.webkit.org/show_bug.cgi?id=171197
3737
3738         Reviewed by Saam Barati.
3739
3740         * test262.yaml:
3741
3742 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3743
3744         test262: test262/test/language/expressions/generators/yield-as-label.js
3745         https://bugs.webkit.org/show_bug.cgi?id=170979
3746
3747         Reviewed by Saam Barati.
3748
3749         * stress/async-await-module-reserved-word.js:
3750         * stress/async-await-reserved-word.js:
3751         Converge on "Cannot" instead of "Can't".
3752
3753         * catch-parameter-syntax.js:
3754         * yield-named-variable-generator.js:
3755         * yield-named-variable.js:
3756         * stress/yield-label-generator.js:
3757         * stress/yield-label.js:
3758         * stress/yield-reserved-word.js: Added.
3759         More complete list of when 'yield' is allowed.
3760
3761         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3762         * test262.yaml:
3763
3764 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3765
3766         test262: test262/test/built-ins/Number/parseFloat.js
3767         https://bugs.webkit.org/show_bug.cgi?id=171193
3768
3769         Reviewed by Yusuke Suzuki.
3770
3771         * test262.yaml: