1 2017-09-15 Saam Barati <sbarati@apple.com>
3 Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
4 https://bugs.webkit.org/show_bug.cgi?id=176981
6 Reviewed by Yusuke Suzuki.
8 * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
12 (const.bar.createBuiltin):
14 2017-09-14 Saam Barati <sbarati@apple.com>
16 It should be valid to exit before each set when doing arity fixup when inlining
17 https://bugs.webkit.org/show_bug.cgi?id=176948
19 Reviewed by Keith Miller.
21 * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
26 2017-09-14 Yusuke Suzuki <utatane.tea@gmail.com>
28 [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
29 https://bugs.webkit.org/show_bug.cgi?id=176867
31 Reviewed by Sam Weinig.
33 * microbenchmarks/object-get-own-property-symbols.js: Added.
36 2017-09-13 Mark Lam <mark.lam@apple.com>
38 Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
39 https://bugs.webkit.org/show_bug.cgi?id=176888
40 <rdar://problem/34381832>
44 * stress/op_mod-ConstVar.js:
45 * stress/op_mod-VarConst.js:
46 * stress/op_mod-VarVar.js:
48 2017-09-13 Ryan Haddad <ryanhaddad@apple.com>
50 Skip 3 op_mod tests on Debug JSC bots.
51 https://bugs.webkit.org/show_bug.cgi?id=176630
53 Unreviewed test gardening.
55 * stress/op_mod-ConstVar.js:
56 * stress/op_mod-VarConst.js:
57 * stress/op_mod-VarVar.js:
59 2017-09-13 Yusuke Suzuki <utatane.tea@gmail.com>
61 [JSC] Fix Array allocation in Object.keys
62 https://bugs.webkit.org/show_bug.cgi?id=176826
64 Reviewed by Saam Barati.
66 * stress/object-own-property-keys.js: Added.
69 2017-09-12 Yusuke Suzuki <utatane.tea@gmail.com>
71 [DFG] Optimize WeakMap::get by adding intrinsic and fixup
72 https://bugs.webkit.org/show_bug.cgi?id=176010
74 Reviewed by Filip Pizlo.
76 * microbenchmarks/weak-map-key.js: Added.
81 2017-09-12 Mark Lam <mark.lam@apple.com>
83 REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
84 https://bugs.webkit.org/show_bug.cgi?id=176630
86 Reviewed by JF Bastien.
88 Debug builds are just slow, and these tests do a lot. They pass when I run them
89 locally on my MacBook Pro. So, I'm bumping their timing multiplier to 2.0x as
90 a speculative fix for the bots that are seeing these fail.
92 I also undid the skipping of the op_mod tests for debug builds.
94 * stress/op_div-ConstVar.js:
95 * stress/op_div-VarConst.js:
96 * stress/op_div-VarVar.js:
97 * stress/op_mod-ConstVar.js:
98 * stress/op_mod-VarConst.js:
99 * stress/op_mod-VarVar.js:
101 2017-09-12 Ryan Haddad <ryanhaddad@apple.com>
103 Skip stress/value-to-boolean.js on Debug bots.
104 https://bugs.webkit.org/show_bug.cgi?id=176787
106 Unreviewed test gardening.
108 * stress/value-to-boolean.js:
110 2017-09-11 Mark Lam <mark.lam@apple.com>
112 Change test expectation for test262/test/language/statements/try/tco-catch.js
113 https://bugs.webkit.org/show_bug.cgi?id=176749
115 Rubber stamped by Keith Miller.
117 It's been failing since at least r221821. I'm changing the test expectation to
118 fail to green the bots while I investigate some more.
122 2017-09-11 Ryan Haddad <ryanhaddad@apple.com>
124 Unreviewed, rolling out r221854.
126 The test added with this change fails on 32-bit JSC bots.
130 "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
131 https://bugs.webkit.org/show_bug.cgi?id=176010
132 http://trac.webkit.org/changeset/221854
134 2017-09-03 Yusuke Suzuki <utatane.tea@gmail.com>
136 [DFG] Optimize WeakMap::get by adding intrinsic and fixup
137 https://bugs.webkit.org/show_bug.cgi?id=176010
139 Reviewed by Filip Pizlo.
141 * microbenchmarks/weak-map-key.js: Added.
144 (let.start.Date.now):
146 2017-09-09 Yusuke Suzuki <utatane.tea@gmail.com>
148 [JSC] Optimize Object.keys by using careful array allocation
149 https://bugs.webkit.org/show_bug.cgi?id=176654
151 Reviewed by Darin Adler.
153 * microbenchmarks/object-keys.js: Added.
156 2017-09-09 Filip Pizlo <fpizlo@apple.com>
158 Error should compute .stack and friends lazily
159 https://bugs.webkit.org/show_bug.cgi?id=176645
161 Reviewed by Saam Barati.
163 * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
164 * microbenchmarks/new-error.js: Added.
165 * microbenchmarks/throw.js: Added.
167 2017-09-09 Mark Lam <mark.lam@apple.com>
169 [Re-landing] Use JIT probes for DFG OSR exit.
170 https://bugs.webkit.org/show_bug.cgi?id=175144
171 <rdar://problem/33437050>
173 Not reviewed. Original patch reviewed by Saam Barati.
175 Disable these tests for debug builds because they run too slow with the new OSR exit.
177 * stress/op_mod-ConstVar.js:
178 * stress/op_mod-VarConst.js:
179 * stress/op_mod-VarVar.js:
181 2017-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
183 [DFG] NewArrayWithSize(size)'s size does not care negative zero
184 https://bugs.webkit.org/show_bug.cgi?id=176300
186 Reviewed by Saam Barati.
188 * stress/new-array-with-size-div.js: Added.
193 2017-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
195 [DFG] PutByVal with Array::Generic is too generic
196 https://bugs.webkit.org/show_bug.cgi?id=176345
198 Reviewed by Filip Pizlo.
200 * stress/object-assign-symbols.js: Added.
203 * stress/object-assign.js: Added.
206 (i.shouldBe.JSON.stringify.test):
208 2017-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
210 [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
211 https://bugs.webkit.org/show_bug.cgi?id=176590
213 Reviewed by Saam Barati.
215 * microbenchmarks/object-iterate-symbols.js: Added.
217 * microbenchmarks/object-iterate.js: Added.
219 * stress/object-iterate-symbols.js: Added.
222 * stress/object-iterate.js: Added.
226 2017-09-07 Per Arne Vollan <pvollan@apple.com>
228 [Win32] 10 JSC stress tests are failing.
229 https://bugs.webkit.org/show_bug.cgi?id=176538
231 Reviewed by Mark Lam.
233 Skip tests on Windows to make the bots green.
236 * stress/date-relaxed.js:
238 2017-09-06 Mark Lam <mark.lam@apple.com>
240 constructGenericTypedArrayViewWithArguments() is missing an exception check.
241 https://bugs.webkit.org/show_bug.cgi?id=176485
242 <rdar://problem/33898874>
244 Reviewed by Keith Miller.
246 * stress/regress-176485.js: Added.
248 2017-09-05 Saam Barati <sbarati@apple.com>
250 isNotCellSpeculation is wrong with respect to SpecEmpty
251 https://bugs.webkit.org/show_bug.cgi?id=176429
253 Reviewed by Michael Saboff.
255 * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
258 2017-09-05 Joseph Pecoraro <pecoraro@apple.com>
260 test262: Completion values for control flow do not match the spec
261 https://bugs.webkit.org/show_bug.cgi?id=171265
263 Reviewed by Saam Barati.
265 * stress/completion-value.js:
266 Condensed test for completion values in top level statements.
268 * stress/super-get-by-id.js:
269 ClassDeclaration when evaled no longer produce values. Convert
270 these to ClassExpressions so they produce the class value.
272 * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
273 This is a progression for currect spec behavior.
275 * mozilla/mozilla-tests.yaml:
276 This test is now outdated, so mark it as failing for that reason.
279 Passing all "cptn" completion value tests.
281 2017-09-04 Saam Barati <sbarati@apple.com>
283 typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
284 https://bugs.webkit.org/show_bug.cgi?id=176317
286 Reviewed by Keith Miller.
288 * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
291 2017-09-03 Yusuke Suzuki <utatane.tea@gmail.com>
293 [DFG][FTL] Efficiently execute number#toString()
294 https://bugs.webkit.org/show_bug.cgi?id=170007
296 Reviewed by Keith Miller.
298 * microbenchmarks/number-to-string-strength-reduction.js: Added.
300 * microbenchmarks/number-to-string-with-radix-10.js: Added.
302 * microbenchmarks/number-to-string-with-radix-cse.js: Added.
304 * microbenchmarks/number-to-string-with-radix.js: Added.
306 * stress/number-to-string-strength-reduction.js: Added.
309 * stress/number-to-string-with-radix-10.js: Added.
312 * stress/number-to-string-with-radix-cse.js: Added.
315 * stress/number-to-string-with-radix-invalid.js: Added.
317 * stress/number-to-string-with-radix-watchpoint.js: Added.
320 (i.i.1e3.Number.prototype.toString):
321 * stress/number-to-string-with-radix.js: Added.
325 2017-09-02 Yusuke Suzuki <utatane.tea@gmail.com>
327 [DFG] Relax arity requirement
328 https://bugs.webkit.org/show_bug.cgi?id=175523
330 Reviewed by Saam Barati.
332 * stress/arity-mismatch-arguments-length.js: Added.
336 * stress/arity-mismatch-get-argument.js: Added.
338 (builtin.createBuiltin):
340 * stress/arity-mismatch-inlining-extra-slots.js: Added.
344 * stress/arity-mismatch-inlining.js: Added.
348 * stress/arity-mismatch-rest.js: Added.
354 2017-08-31 Yusuke Suzuki <utatane.tea@gmail.com>
356 [JSC] Fix "name" and "length" of Proxy revoke function
357 https://bugs.webkit.org/show_bug.cgi?id=176155
359 Reviewed by Mark Lam.
363 2017-08-31 Saam Barati <sbarati@apple.com>
365 Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
366 https://bugs.webkit.org/show_bug.cgi?id=176206
368 Reviewed by Keith Miller.
370 * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
375 2017-08-31 Ryan Haddad <ryanhaddad@apple.com>
377 Skip two slow JSC tests after r221422.
379 Unreviewed test gardening.
381 * stress/regexp-prototype-match-on-too-long-rope.js:
382 * stress/regexp-prototype-test-on-too-long-rope.js:
384 2017-08-31 Filip Pizlo <fpizlo@apple.com>
386 Unreviewed, skipping slow tests.
388 These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
389 work differently now.
391 * stress/regexp-prototype-exec-on-too-long-rope.js:
392 * stress/string-prototype-charCodeAt-on-too-long-rope.js:
394 2017-08-31 Yusuke Suzuki <utatane.tea@gmail.com>
396 [JSC] Use reifying system for "name" property of builtin JSFunction
397 https://bugs.webkit.org/show_bug.cgi?id=175260
399 Reviewed by Saam Barati.
401 * stress/accessors-get-set-prefix.js:
402 * stress/builtin-function-name.js: Added.
405 (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
406 (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
407 * stress/private-name-as-anonymous-builtin.js: Added.
411 2017-08-30 Saam Barati <sbarati@apple.com>
413 Unreviewed. Make test stop printing.
415 * microbenchmarks/fake-iterators-that-throw-when-finished.js:
417 2017-08-30 Ryan Haddad <ryanhaddad@apple.com>
419 Unreviewed, rolling out r221327.
421 This change caused test262 failures.
425 "[JSC] Use reifying system for "name" property of builtin
427 https://bugs.webkit.org/show_bug.cgi?id=175260
428 http://trac.webkit.org/changeset/221327
430 2017-08-30 Saam Barati <sbarati@apple.com>
432 semicolon is being interpreted as an = in the LiteralParser
433 https://bugs.webkit.org/show_bug.cgi?id=176114
435 Reviewed by Oliver Hunt.
437 * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
438 * stress/resources/literal-parser-test-case.js: Added.
440 2017-08-30 Oleksandr Skachkov <gskachkov@gmail.com>
442 [ESNext] Async iteration - Implement async iteration statement: for-await-of
443 https://bugs.webkit.org/show_bug.cgi?id=166698
445 Reviewed by Yusuke Suzuki.
447 * stress/async-iteration-for-await-of-syntax.js: Added.
451 (checkSimpleAsyncGeneratorSloppyMode):
452 (checkSimpleAsyncGeneratorStrictMode):
453 (checkNestedAsyncGenerators):
454 (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
455 * stress/async-iteration-for-await-of.js: Added.
461 2017-08-29 Yusuke Suzuki <utatane.tea@gmail.com>
463 [JSC] Use reifying system for "name" property of builtin JSFunction
464 https://bugs.webkit.org/show_bug.cgi?id=175260
466 Reviewed by Saam Barati.
468 * stress/accessors-get-set-prefix.js:
469 * stress/builtin-function-name.js: Added.
472 (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
473 (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
475 2017-08-25 Saam Barati <sbarati@apple.com>
477 Support compiling catch in the DFG
478 https://bugs.webkit.org/show_bug.cgi?id=174590
479 <rdar://problem/34047845>
481 Reviewed by Filip Pizlo.
483 * microbenchmarks/delta-blue-try-catch.js: Added.
487 (OrderedCollection.prototype.add):
488 (OrderedCollection.prototype.at):
489 (OrderedCollection.prototype.size):
490 (OrderedCollection.prototype.removeFirst):
491 (OrderedCollection.prototype.remove):
495 (Strength.weakestOf):
496 (Strength.strongest):
497 (Strength.prototype.nextWeaker):
499 (Constraint.prototype.addConstraint):
500 (Constraint.prototype.satisfy):
501 (Constraint.prototype.destroyConstraint):
502 (Constraint.prototype.isInput):
504 (UnaryConstraint.prototype.addToGraph):
505 (UnaryConstraint.prototype.chooseMethod):
506 (UnaryConstraint.prototype.isSatisfied):
507 (UnaryConstraint.prototype.markInputs):
508 (UnaryConstraint.prototype.output):
509 (UnaryConstraint.prototype.recalculate):
510 (UnaryConstraint.prototype.markUnsatisfied):
511 (UnaryConstraint.prototype.inputsKnown):
512 (UnaryConstraint.prototype.removeFromGraph):
514 (StayConstraint.prototype.execute):
515 (EditConstraint.prototype.isInput):
516 (EditConstraint.prototype.execute):
518 (BinaryConstraint.prototype.chooseMethod):
519 (BinaryConstraint.prototype.addToGraph):
520 (BinaryConstraint.prototype.isSatisfied):
521 (BinaryConstraint.prototype.markInputs):
522 (BinaryConstraint.prototype.input):
523 (BinaryConstraint.prototype.output):
524 (BinaryConstraint.prototype.recalculate):
525 (BinaryConstraint.prototype.markUnsatisfied):
526 (BinaryConstraint.prototype.inputsKnown):
527 (BinaryConstraint.prototype.removeFromGraph):
529 (ScaleConstraint.prototype.addToGraph):
530 (ScaleConstraint.prototype.removeFromGraph):
531 (ScaleConstraint.prototype.markInputs):
532 (ScaleConstraint.prototype.execute):
533 (ScaleConstraint.prototype.recalculate):
534 (EqualityConstraint):
535 (EqualityConstraint.prototype.execute):
537 (Variable.prototype.addConstraint):
538 (Variable.prototype.removeConstraint):
540 (Planner.prototype.incrementalAdd):
541 (Planner.prototype.incrementalRemove):
542 (Planner.prototype.newMark):
543 (Planner.prototype.makePlan):
544 (Planner.prototype.extractPlanFromConstraints):
545 (Planner.prototype.addPropagate):
546 (Planner.prototype.removePropagateFrom):
547 (Planner.prototype.addConstraintsConsumingTo):
549 (Plan.prototype.addConstraint):
550 (Plan.prototype.size):
551 (Plan.prototype.constraintAt):
552 (Plan.prototype.execute):
557 * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
560 (Numbers.prototype.next):
562 (return.Transpose.prototype.next):
568 * microbenchmarks/try-catch-word-count.js: Added.
583 (A.prototype.getValue):
584 (B.prototype.getParentValue):
594 (set delete.set has.set add):
595 * stress/catch-set-argument-speculation-failure.js: Added.
603 * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
609 2017-08-24 Commit Queue <commit-queue@webkit.org>
611 Unreviewed, rolling out r221119, r221124, and r221143.
612 https://bugs.webkit.org/show_bug.cgi?id=175973
614 "I think it regressed JSBench by 20%" (Requested by saamyjoon
619 "Support compiling catch in the DFG"
620 https://bugs.webkit.org/show_bug.cgi?id=174590
621 http://trac.webkit.org/changeset/221119
623 "Unreviewed, build fix in GTK port"
624 https://bugs.webkit.org/show_bug.cgi?id=174590
625 http://trac.webkit.org/changeset/221124
627 "DFG::JITCode::osrEntry should get sorted since we perform a
629 https://bugs.webkit.org/show_bug.cgi?id=175893
630 http://trac.webkit.org/changeset/221143
632 2017-08-24 Michael Saboff <msaboff@apple.com>
634 Add support for RegExp "dotAll" flag
635 https://bugs.webkit.org/show_bug.cgi?id=175924
637 Reviewed by Keith Miller.
639 Updated tests for new dotAll ('s' flag) changes.
641 * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
642 * stress/static-getter-in-names.js:
644 2017-08-24 Mark Lam <mark.lam@apple.com>
646 Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
647 https://bugs.webkit.org/show_bug.cgi?id=175940
648 <rdar://problem/29003921>
650 Reviewed by Saam Barati.
652 * stress/regress-164081.js: Added.
656 2017-08-24 Ryan Haddad <ryanhaddad@apple.com>
658 Skip flaky JSC test stress/test-finally.js.
659 https://bugs.webkit.org/show_bug.cgi?id=160283
661 Unreviewed test gardening.
663 * stress/test-finally.js:
665 2017-08-23 Saam Barati <sbarati@apple.com>
667 Support compiling catch in the DFG
668 https://bugs.webkit.org/show_bug.cgi?id=174590
670 Reviewed by Filip Pizlo.
672 * microbenchmarks/delta-blue-try-catch.js: Added.
676 (OrderedCollection.prototype.add):
677 (OrderedCollection.prototype.at):
678 (OrderedCollection.prototype.size):
679 (OrderedCollection.prototype.removeFirst):
680 (OrderedCollection.prototype.remove):
684 (Strength.weakestOf):
685 (Strength.strongest):
686 (Strength.prototype.nextWeaker):
688 (Constraint.prototype.addConstraint):
689 (Constraint.prototype.satisfy):
690 (Constraint.prototype.destroyConstraint):
691 (Constraint.prototype.isInput):
693 (UnaryConstraint.prototype.addToGraph):
694 (UnaryConstraint.prototype.chooseMethod):
695 (UnaryConstraint.prototype.isSatisfied):
696 (UnaryConstraint.prototype.markInputs):
697 (UnaryConstraint.prototype.output):
698 (UnaryConstraint.prototype.recalculate):
699 (UnaryConstraint.prototype.markUnsatisfied):
700 (UnaryConstraint.prototype.inputsKnown):
701 (UnaryConstraint.prototype.removeFromGraph):
703 (StayConstraint.prototype.execute):
704 (EditConstraint.prototype.isInput):
705 (EditConstraint.prototype.execute):
707 (BinaryConstraint.prototype.chooseMethod):
708 (BinaryConstraint.prototype.addToGraph):
709 (BinaryConstraint.prototype.isSatisfied):
710 (BinaryConstraint.prototype.markInputs):
711 (BinaryConstraint.prototype.input):
712 (BinaryConstraint.prototype.output):
713 (BinaryConstraint.prototype.recalculate):
714 (BinaryConstraint.prototype.markUnsatisfied):
715 (BinaryConstraint.prototype.inputsKnown):
716 (BinaryConstraint.prototype.removeFromGraph):
718 (ScaleConstraint.prototype.addToGraph):
719 (ScaleConstraint.prototype.removeFromGraph):
720 (ScaleConstraint.prototype.markInputs):
721 (ScaleConstraint.prototype.execute):
722 (ScaleConstraint.prototype.recalculate):
723 (EqualityConstraint):
724 (EqualityConstraint.prototype.execute):
726 (Variable.prototype.addConstraint):
727 (Variable.prototype.removeConstraint):
729 (Planner.prototype.incrementalAdd):
730 (Planner.prototype.incrementalRemove):
731 (Planner.prototype.newMark):
732 (Planner.prototype.makePlan):
733 (Planner.prototype.extractPlanFromConstraints):
734 (Planner.prototype.addPropagate):
735 (Planner.prototype.removePropagateFrom):
736 (Planner.prototype.addConstraintsConsumingTo):
738 (Plan.prototype.addConstraint):
739 (Plan.prototype.size):
740 (Plan.prototype.constraintAt):
741 (Plan.prototype.execute):
746 * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
749 (Numbers.prototype.next):
751 (return.Transpose.prototype.next):
757 * microbenchmarks/try-catch-word-count.js: Added.
772 (A.prototype.getValue):
773 (B.prototype.getParentValue):
783 (set delete.set has.set add):
784 * stress/catch-set-argument-speculation-failure.js: Added.
792 * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
798 2017-08-23 Yusuke Suzuki <utatane.tea@gmail.com>
800 [JSC] Optimize Map iteration with intrinsic
801 https://bugs.webkit.org/show_bug.cgi?id=174355
803 Reviewed by Saam Barati.
805 * stress/map-iterator-result-should-have-expected-shape.js: Added.
808 * stress/set-iterator-result-should-have-expected-shape.js: Added.
810 (throw.new.Error.let.iterator.set Symbol):
811 (throw.new.Error.set add):
812 (let.iterator.set Symbol):
814 2017-08-23 Robin Morisset <rmorisset@apple.com>
816 Add a micro-benchmark for checking that accessing a variable within a 'with'
817 block does not automatically prevent type prediction.
818 https://bugs.webkit.org/show_bug.cgi?id=175738
820 Reviewed by Saam Barati.
822 * stress/with_and_arith.js: Added.
825 2017-08-23 Skachkov Oleksandr <gskachkov@gmail.com>
827 [ESNext] Async iteration - Implement Async Generator - runtime
828 https://bugs.webkit.org/show_bug.cgi?id=175240
830 Reviewed by Yusuke Suzuki.
832 * stress/async-iteration-async-from-sync.js: Added.
836 (this.fullfilledDone):
841 (const.assertLogger):
842 (const.getPromise.promiseHolder.return.new.Promise):
848 * stress/async-iteration-basic.js: Added.
852 (this.fullfilledDone):
857 (const.assertLogger):
858 (const.getPromise.promiseHolder.return.new.Promise):
860 (iterator.next.then):
865 (A.prototype.async.foo):
866 (A.prototype.async.boo):
881 * stress/async-iteration-evaluation.js: Added.
885 * stress/async-iteration-syntax.js:
886 * stress/async-iteration-yield-promise.js: Added.
890 (this.fullfilledDone):
895 (const.assertLogger):
896 (const.getPromise.promiseHolder.return.new.Promise):
900 * stress/async-iteration-yield-star-interface.js: Added.
902 (const.getPromise.promiseHolder.return.new.Promise):
905 (this.fullfilledDone):
911 (const.assertLogger):
912 (let.asyncIter.Symbol.asyncIterator):
913 (let.asyncIter.next):
914 (let.asyncIter.throw):
915 (let.asyncIter.return):
917 (asyncIter.Symbol.asyncIterator):
924 * stress/async-iteration-yield-star.js: Added.
928 (this.fullfilledDone):
934 (const.assertLogger):
935 (const.getPromise.promiseHolder.return.new.Promise):
944 (let.asyncIter.Symbol.asyncIterator):
945 (let.asyncIter.next):
946 (let.asyncIter.throw):
947 (let.asyncIter.return):
952 2017-08-23 JF Bastien <jfbastien@apple.com>
956 Unreviewed: fixing verbosity, shouldn't have been there.
958 * wasm/regress/175693.js:
962 2017-08-18 Ryan Haddad <ryanhaddad@apple.com>
964 Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
965 https://bugs.webkit.org/show_bug.cgi?id=172543
967 Unreviewed test gardening.
969 * microbenchmarks/generator-with-several-types.js:
971 2017-08-17 JF Bastien <jfbastien@apple.com>
973 WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
974 https://bugs.webkit.org/show_bug.cgi?id=175693
975 <rdar://problem/33952443>
977 Reviewed by Saam Barati.
979 Add a regression directory for WebAssembly tests.
982 * wasm/regress/175693.js: Added.
984 (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
986 * wasm/regress/175693.wasm: Added.
988 2017-08-15 Robin Morisset <rmorisset@apple.com>
990 Support the 'with' keyword in FTL.
991 https://bugs.webkit.org/show_bug.cgi?id=175585
993 Reviewed by Saam Barati.
995 Also improve the JSTest/stress/with.js file to test
996 what happens when non-objects are passed to with.
1003 2017-08-14 Keith Miller <keith_miller@apple.com>
1005 Add testing tool to lie to the DFG about profiles
1006 https://bugs.webkit.org/show_bug.cgi?id=175487
1008 Reviewed by Saam Barati.
1010 * stress/compare-eq-incomplete-profile.js: Added.
1011 (const.test.createBuiltin):
1013 2017-08-14 Robin Morisset <rmorisset@apple.com>
1015 Support the with keyword in DFG
1016 https://bugs.webkit.org/show_bug.cgi?id=175470
1018 Reviewed by Saam Barati.
1020 Added a new stress-test for the 'with' keyword, that caught a bug in a
1021 previous version of this code.
1023 * stress/with.js: Added.
1026 2017-08-14 Ryan Haddad <ryanhaddad@apple.com>
1028 Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
1029 https://bugs.webkit.org/show_bug.cgi?id=175544
1031 Unreviewed test gardening.
1035 2017-08-09 Caitlin Potter <caitp@igalia.com>
1037 Early error on ANY operator before new.target
1038 https://bugs.webkit.org/show_bug.cgi?id=157970
1040 Reviewed by Saam Barati.
1042 Instead of throwing if any unary operator precedes new.target, only
1043 throw if the unary operator updates the reference.
1045 The following become legal in JSC:
1055 All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
1057 * stress/new-target-syntax-errors.js:
1058 * stress/new-target.js:
1060 2017-08-09 Ryan Haddad <ryanhaddad@apple.com>
1062 Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
1063 https://bugs.webkit.org/show_bug.cgi?id=175255
1065 Unreviewed test gardening.
1067 * stress/regress-169783.js:
1068 * wasm/stress/oom.js:
1070 2017-08-09 Oleksandr Skachkov <gskachkov@gmail.com>
1072 REGRESSION: 2 test262/test/language/statements/async-function failures
1073 https://bugs.webkit.org/show_bug.cgi?id=175334
1075 Reviewed by Yusuke Suzuki.
1077 Add @skip parameters to tests, and remove test for async iterator from
1078 async await syntax test because it is already covered by async-iterator-syntax.js
1080 * stress/async-await-syntax.js:
1081 * stress/async-iteration-syntax.js:
1083 2017-08-08 Yusuke Suzuki <utatane.tea@gmail.com>
1085 Unreviewed, gardening test262 for Promise resolve / reject function length
1086 https://bugs.webkit.org/show_bug.cgi?id=175333
1090 2017-08-07 Robin Morisset <rmorisset@apple.com>
1092 GetOwnProperty of TypedArray indexed fields is wrongly configurable
1093 https://bugs.webkit.org/show_bug.cgi?id=175307
1095 Reviewed by Saam Barati.
1097 * stress/typedarray-getownproperty-not-configurable.js: Added.
1101 2017-08-06 Yusuke Suzuki <utatane.tea@gmail.com>
1103 Promise resolve and reject function should have length = 1
1104 https://bugs.webkit.org/show_bug.cgi?id=175242
1106 Reviewed by Saam Barati.
1108 * stress/builtin-function-length.js: Added.
1111 (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1112 (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1114 2017-08-06 Oleksandr Skachkov <gskachkov@gmail.com>
1116 [ESNext] Async iteration - Implement Async Generator - parser
1117 https://bugs.webkit.org/show_bug.cgi?id=175210
1119 Reviewed by Yusuke Suzuki.
1121 * stress/async-await-syntax.js:
1122 (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1123 * stress/async-iteration-syntax.js: Added.
1127 (checkSimpleAsyncGeneratorSloppyMode):
1128 (checkSimpleAsyncGeneratorStrictMode):
1129 (checkNestedAsyncGenerators):
1130 (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
1131 * stress/generator-class-methods-syntax.js:
1133 2017-08-03 Carlos Alberto Lopez Perez <clopez@igalia.com>
1135 JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
1136 https://bugs.webkit.org/show_bug.cgi?id=175150
1138 Unreviewed test gardening.
1140 * wasm/js-api/test_memory_constructor.js:
1142 2017-08-02 Carlos Alberto Lopez Perez <clopez@igalia.com>
1144 [Linux] JSTests/wasm/stress/oom.js should not run on Linux
1145 https://bugs.webkit.org/show_bug.cgi?id=175100
1147 Reviewed by Mark Lam.
1149 The JSC test JSTests/wasm/stress/oom.js tries to use all the
1150 available memory until an out of memory exception happens.
1152 The Linux kernel is more tuned for server workloads than for GUI
1153 responsiveness. When a process tries to use a lot of memory, Linux
1154 will do its best to serve the request. This usually translates to
1155 free physical RAM by writing to disk dirty pages and/or moving out
1156 less recently used pages to swap (disk storage).
1157 Meanwhile it does this, the system will become unresponsive and this
1158 leads to freezes that can last even some minutes on the worst cases.
1160 Therefore, let's skip this test on Linux as it will cause more harm
1161 than good on the Linux bots or on the machines of Linux developers.
1163 * wasm/stress/oom.js:
1165 2017-08-01 Oleksandr Skachkov <gskachkov@gmail.com>
1167 [JSC] Remove unnecessary print from stress\promise-finally.js test
1168 https://bugs.webkit.org/show_bug.cgi?id=175015
1170 Reviewed by Yusuke Suzuki.
1172 * stress/promise-finally.js:
1176 2017-07-31 Yusuke Suzuki <utatane.tea@gmail.com>
1178 Unreviewed, update test262 results for optional catch binding
1182 2017-07-31 Yusuke Suzuki <utatane.tea@gmail.com>
1184 [JSC] Support optional catch binding
1185 https://bugs.webkit.org/show_bug.cgi?id=174981
1187 Reviewed by Saam Barati.
1189 * stress/optional-catch-binding-syntax.js: Added.
1193 * stress/optional-catch-binding.js: Added.
1197 2017-07-28 Mark Lam <mark.lam@apple.com>
1199 ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
1200 https://bugs.webkit.org/show_bug.cgi?id=174948
1201 <rdar://problem/33495680>
1203 Reviewed by Filip Pizlo.
1205 * stress/regress-174948.js: Added.
1207 2017-07-28 Yusuke Suzuki <utatane.tea@gmail.com>
1209 ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
1210 https://bugs.webkit.org/show_bug.cgi?id=174900
1212 Reviewed by Saam Barati.
1214 * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
1219 2017-07-27 Yusuke Suzuki <utatane.tea@gmail.com>
1221 Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
1222 https://bugs.webkit.org/show_bug.cgi?id=171637
1224 Reviewed by Darin Adler.
1226 * stress/domjit-getter-complex-with-incorrect-object.js:
1228 * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
1232 2017-07-26 JF Bastien <jfbastien@apple.com>
1234 WebAssembly: test throwing out of the start function
1235 https://bugs.webkit.org/show_bug.cgi?id=165714
1236 <rdar://problem/29760251>
1238 Reviewed by Keith Miller.
1241 * wasm/function-tests/trap-from-start.js: Added.
1243 * wasm/function-tests/trap-from-start-async.js: Added.
1244 (async.StartTrapsAsync):
1246 2017-07-21 Yusuke Suzuki <utatane.tea@gmail.com>
1248 [FTL] Arguments elimination is suppressed by unreachable blocks
1249 https://bugs.webkit.org/show_bug.cgi?id=174352
1251 Reviewed by Filip Pizlo.
1253 * stress/arguments-elimination-force-exit.js: Added.
1257 * stress/arguments-elimination-throw.js: Added.
1263 2017-07-13 Mark Lam <mark.lam@apple.com>
1265 Add some additional test cases for bug 170896.
1266 https://bugs.webkit.org/show_bug.cgi?id=174491
1268 Reviewed by Filip Pizlo.
1270 * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
1271 * stress/regress-170896-with-double-shape-profile.js: Added.
1273 * stress/regress-170896-with-int32-shape-profile.js: Added.
1275 * stress/regress-170896.js: Removed.
1277 2017-07-13 Saam Barati <sbarati@apple.com>
1279 Missing exception check in JSObject::hasInstance
1280 https://bugs.webkit.org/show_bug.cgi?id=174455
1281 <rdar://problem/31384608>
1283 Reviewed by Mark Lam.
1285 * stress/has-instance-exception-check.js: Added.
1287 (let.getter.Object.getOwnPropertyDescriptor.get foo):
1289 2017-07-13 Caio Lima <ticaiolima@gmail.com>
1291 [ESnext] Implement Object Spread
1292 https://bugs.webkit.org/show_bug.cgi?id=167963
1294 Reviewed by Saam Barati.
1296 * stress/obj-rest-destructuring-order.js: Added.
1300 * stress/obj-spread-order.js: Added.
1304 * stress/object-spread.js: Added.
1313 (try.let.obj.get foo):
1316 2017-07-12 Saam Barati <sbarati@apple.com>
1318 GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
1319 https://bugs.webkit.org/show_bug.cgi?id=174411
1320 <rdar://problem/31696186>
1322 Reviewed by Mark Lam.
1324 * stress/generic-arguments-correct-delete-behavior.js: Added.
1328 2017-07-07 Mark Lam <mark.lam@apple.com>
1330 \n\r is not the same as \r\n.
1331 https://bugs.webkit.org/show_bug.cgi?id=173053
1333 Reviewed by Keith Miller.
1335 * stress/regress-173053.js: Added.
1336 * stress/template-literal-line-terminators.js:
1338 2017-07-06 Saam Barati <sbarati@apple.com>
1340 We are missing places where we invalidate the for-in context
1341 https://bugs.webkit.org/show_bug.cgi?id=174184
1343 Reviewed by Geoffrey Garen.
1345 * stress/for-in-invalidate-context-weird-assignments.js: Added.
1349 2017-07-05 Saam Barati <sbarati@apple.com>
1351 NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
1352 https://bugs.webkit.org/show_bug.cgi?id=174188
1353 <rdar://problem/30581423>
1355 Reviewed by Mark Lam.
1357 * stress/new-array-having-a-bad-time-double.js: Added.
1361 2017-07-05 Yusuke Suzuki <utatane.tea@gmail.com>
1363 WTF::StringImpl::copyChars segfaults when built with GCC 7
1364 https://bugs.webkit.org/show_bug.cgi?id=173407
1366 Reviewed by Andreas Kling.
1368 * stress/string-repeat-copy-chars-crash.js: Added.
1371 2017-07-03 Saam Barati <sbarati@apple.com>
1373 Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
1375 * stress/unshiftCountSlowCase-correct-postCapacity.js:
1377 2017-07-03 Yusuke Suzuki <utatane.tea@gmail.com>
1379 Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
1381 It requires too much memory.
1383 * stress/dont-reserve-huge-capacity-lexer.js:
1385 2017-06-30 Michael Saboff <msaboff@apple.com>
1387 Skip a test on ARM64 platform since we run out of address space.
1389 Rubber stamped by Saam Barati.
1391 * stress/dont-reserve-huge-capacity-lexer.js:
1393 2017-06-30 Michael Saboff <msaboff@apple.com>
1395 RegExp's anchored with .* with \g flag can return wrong match start for strings with multiple matches
1396 https://bugs.webkit.org/show_bug.cgi?id=174044
1398 Reviewed by Oliver Hunt.
1400 New regression test.
1402 * stress/regress-174044.js: Added.
1406 2017-06-30 Filip Pizlo <fpizlo@apple.com>
1408 RegExpCachedResult::setInput should reify left and right contexts
1409 https://bugs.webkit.org/show_bug.cgi?id=173818
1411 Reviewed by Keith Miller.
1413 * stress/right-left-context-invalidated-by-input.js: Added.
1414 (test.validateContexts):
1417 2017-06-29 Saam Barati <sbarati@apple.com>
1419 Calculating postCapacity in unshiftCountSlowCase is wrong
1420 https://bugs.webkit.org/show_bug.cgi?id=173992
1421 <rdar://problem/32283199>
1423 Reviewed by Keith Miller.
1425 * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
1428 2017-06-29 Commit Queue <commit-queue@webkit.org>
1430 Unreviewed, rolling out r218512.
1431 https://bugs.webkit.org/show_bug.cgi?id=173981
1433 "It changes the behavior of the JS API's JSEvaluateScript
1434 which breaks TurboTax" (Requested by saamyjoon on #webkit).
1438 "test262: Completion values for control flow do not match the
1440 https://bugs.webkit.org/show_bug.cgi?id=171265
1441 http://trac.webkit.org/changeset/218512
1443 2017-06-27 JF Bastien <jfbastien@apple.com>
1445 WebAssembly: running out of executable memory should throw OoM
1446 https://bugs.webkit.org/show_bug.cgi?id=171537
1447 <rdar://problem/32963338>
1449 Reviewed by Saam Barati.
1452 * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
1454 (failCount.0.catch):
1455 (failCount.0.module.undefined.catch):
1456 * wasm/lowExecutableMemory/exports-oom.js: Added.
1459 (const.randomProgram):
1460 (failCount.0.catch):
1461 (failCount.0.module.undefined.catch):
1462 * wasm/lowExecutableMemory/imports-oom.js: Added.
1465 (const.randomProgram):
1467 (failCount.0.catch):
1468 (failCount.0.module.undefined.catch):
1470 2017-06-27 Caio Lima <ticaiolima@gmail.com>
1472 [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
1473 https://bugs.webkit.org/show_bug.cgi?id=167962
1475 Reviewed by Saam Barati.
1477 * stress/object-rest-deconstruct.js: Added.
1479 (let.assertPropDescriptor):
1487 2017-06-27 Saam Barati <sbarati@apple.com>
1489 Function constructor needs to follow the spec and validate parameters and body independently
1490 https://bugs.webkit.org/show_bug.cgi?id=173303
1491 <rdar://problem/32732526>
1493 Reviewed by Keith Miller.
1495 * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1496 * stress/function-constructor-semantics.js: Added.
1505 2017-06-26 Saam Barati <sbarati@apple.com>
1507 RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
1508 https://bugs.webkit.org/show_bug.cgi?id=173740
1510 Reviewed by Mark Lam.
1512 * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
1513 (Array.prototype.Symbol.iterator):
1515 2017-06-26 Saam Barati <sbarati@apple.com>
1517 Skip a test on 32-bit platforms since we run out of address space.
1519 Rubber stamped by Mark Lam.
1521 * stress/dont-reserve-huge-capacity-lexer.js:
1523 2017-06-26 Saam Barati <sbarati@apple.com>
1525 Crash in JSC::Lexer<unsigned char>::setCode
1526 https://bugs.webkit.org/show_bug.cgi?id=172754
1528 Reviewed by Mark Lam.
1530 * stress/dont-reserve-huge-capacity-lexer.js: Added.
1533 2017-06-24 Yusuke Suzuki <utatane.tea@gmail.com>
1535 [JSC] Clean up Object.entries implementation
1536 https://bugs.webkit.org/show_bug.cgi?id=173759
1538 Reviewed by Sam Weinig.
1540 * microbenchmarks/object-entries.js: Added.
1543 2017-06-24 Joseph Pecoraro <pecoraro@apple.com>
1545 Remove Reflect.enumerate
1546 https://bugs.webkit.org/show_bug.cgi?id=173806
1548 Reviewed by Yusuke Suzuki.
1552 These tests now fail because they use Reflect.enumerate.
1555 This test now passes, it checked that Reflect.enumerate is undefined!
1557 * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
1558 Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
1560 * stress/reflect-enumerate.js: Removed.
1561 Remove a test solely for Reflect.enumerate.
1563 2017-06-22 Saam Barati <sbarati@apple.com>
1565 ValueRep(DoubleRep(@v)) can not simply convert to @v
1566 https://bugs.webkit.org/show_bug.cgi?id=173687
1567 <rdar://problem/32855563>
1569 Reviewed by Mark Lam.
1571 * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
1574 2017-06-22 Yusuke Suzuki <utatane.tea@gmail.com>
1576 [JSC] Object.values should be implemented in C++
1577 https://bugs.webkit.org/show_bug.cgi?id=173703
1579 Reviewed by Sam Weinig.
1581 * microbenchmarks/object-keys-map-values.js: Added.
1583 * microbenchmarks/object-values.js: Added.
1585 * stress/object-values-changing-properties.js: Added.
1587 (throw.new.Error.let.source.get x):
1589 (shouldBe.let.handler.get order):
1591 (shouldBe.let.handler.get return):
1592 (let.handler.get order):
1594 2017-06-21 Saam Barati <sbarati@apple.com>
1596 eval virtual call is incorrect in the baseline JIT
1597 https://bugs.webkit.org/show_bug.cgi?id=173587
1598 <rdar://problem/32867897>
1600 Reviewed by Michael Saboff.
1602 * stress/do-eval-virtual-call-correctly.js: Added.
1608 2017-06-20 Ryan Haddad <ryanhaddad@apple.com>
1610 Update test262 test expectations after r218581.
1612 Unreviewed test gardening.
1616 2017-06-20 Oleksandr Skachkov <gskachkov@gmail.com>
1618 Revert changes in bug#160417 about extending `null` not being a derived class
1619 https://bugs.webkit.org/show_bug.cgi?id=169293
1621 Reviewed by Saam Barati.
1623 * stress/class-derived-from-null.js:
1632 2017-06-13 Yusuke Suzuki <utatane.tea@gmail.com>
1634 [DFG] More ArrayIndexOf fixups for various types
1635 https://bugs.webkit.org/show_bug.cgi?id=173176
1637 Reviewed by Saam Barati.
1639 * stress/array-indexof-arraystorage.js: Added.
1641 (indexOfInt32Other):
1643 (indexOfInt32Boolean):
1644 (indexOfDoubleOther):
1645 (indexOfDoubleCell):
1646 (indexOfDoubleBoolean):
1649 * stress/array-indexof-constant-folding.js: Added.
1651 (indexOfInt32Other):
1653 (indexOfInt32Boolean):
1654 (indexOfDoubleOther):
1655 (indexOfDoubleCell):
1656 (indexOfDoubleBoolean):
1657 * stress/array-indexof-hole-and-other.js: Added.
1660 * stress/array-indexof-other.js: Added.
1666 * stress/array-indexof-symbol.js: Added.
1673 2017-06-19 Joseph Pecoraro <pecoraro@apple.com>
1675 test262: Completion values for control flow do not match the spec
1676 https://bugs.webkit.org/show_bug.cgi?id=171265
1678 Reviewed by Saam Barati.
1680 * stress/completion-value.js:
1681 Condensed test for completion values in top level statements.
1683 * stress/super-get-by-id.js:
1684 ClassDeclaration when evaled no longer produce values. Convert
1685 these to ClassExpressions so they produce the class value.
1687 * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1688 This is a progression for currect spec behavior.
1690 * mozilla/mozilla-tests.yaml:
1691 This test is now outdated, so mark it as failing for that reason.
1694 Passing all "cptn" completion value tests.
1696 2017-06-17 Keith Miller <keith_miller@apple.com>
1698 ArrayBuffer constructor needs to create subclass structures before its buffer
1699 https://bugs.webkit.org/show_bug.cgi?id=173510
1701 Reviewed by Yusuke Suzuki.
1705 2017-06-17 Keith Miller <keith_miller@apple.com>
1707 ArrayPrototype methods should use JSValue::toLength for non-Arrays.
1708 https://bugs.webkit.org/show_bug.cgi?id=173506
1710 Reviewed by Ryosuke Niwa.
1714 * ChakraCore/test/Function/apply3.baseline-jsc:
1717 2017-06-16 Yusuke Suzuki <utatane.tea@gmail.com>
1719 [JSC] Add fast path for Object.assign
1720 https://bugs.webkit.org/show_bug.cgi?id=173416
1722 Reviewed by Mark Lam.
1724 * stress/object-assign-changing-properties.js: Added.
1726 (throw.new.Error.let.source.get x):
1728 (shouldBe.let.source.get x):
1729 (shouldBe.let.target.set x):
1730 (shouldBe.let.target.get x):
1731 * stress/object-assign-proxy.js: Added.
1733 (throw.new.Error.let.handler.get order):
1735 2017-06-15 Yusuke Suzuki <utatane.tea@gmail.com>
1737 [JSC] Implement Object.assign in C++
1738 https://bugs.webkit.org/show_bug.cgi?id=173414
1740 Reviewed by Saam Barati.
1742 * stress/object-assign-string-first.js: Added.
1744 (source.get Symbol):
1748 2017-06-14 JF Bastien <jfbastien@apple.com>
1750 WebAssembly: remove empty test files
1751 https://bugs.webkit.org/show_bug.cgi?id=173382
1753 Reviewed by Saam Barati.
1755 The following files:
1756 JSTests/wasm/function-tests/call-indirect-params.js
1757 JSTests/wasm/function-tests/call-indirect.js
1758 JSTests/wasm/js-api/call-indirect-results.js
1759 Were changed to empty files in https://trac.webkit.org/changeset/209771
1761 They were testing call_indirect with the wrong semantics, before
1762 we implemented tables. That change implemented tables and
1763 therefore removed the erroneous tests.
1765 We have a few tests for call_indirect which already do the right thing:
1766 JSTests/wasm/function-tests/context-switch.js
1767 JSTests/wasm/function-tests/exceptions.js
1768 JSTests/wasm/function-tests/grow-memory-2.js
1769 JSTests/wasm/function-tests/stack-overflow.js
1770 JSTests/wasm/function-tests/table-basic-2.js
1771 JSTests/wasm/function-tests/table-basic.js
1772 JSTests/wasm/js-api/call-indirect.js
1773 JSTests/wasm/js-api/table.js
1774 JSTests/wasm/js-api/unique-signature.js
1775 JSTests/wasm/js-api/wrapper-function.js
1777 I also just imported the updated spec tests which, among other
1778 things, test call_indirect:
1781 core/call_indirect.wast
1785 core/left-to-right.wast
1790 core/unreachable.wast
1792 So I think it's OK to just delete the tests which should just have
1793 been deleted back when tables were added.
1795 * wasm/function-tests/call-indirect-params.js: Removed.
1796 * wasm/function-tests/call-indirect.js: Removed.
1797 * wasm/js-api/call-indirect-results.js: Removed.
1799 2017-06-13 JF Bastien <jfbastien@apple.com>
1801 WebAssembly: import updated spec tests
1802 https://bugs.webkit.org/show_bug.cgi?id=173287
1803 <rdar://problem/32725975>
1805 Reviewed by Saam Barati.
1807 Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
1808 with a few modifications so things work.
1810 Fix a bunch of bugs found through this process, and punt a few tests (which I
1811 marked as blocked by this bug).
1815 Fix load / store alignment: r216908 erroneously implemented it as bit alignment
1816 instead of byte alignment. It was also missing memory-alignment.js despite it
1817 being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
1820 Tables can be imported or in a section. There can be only one, but sections can
1821 be empty. An Elements section can exist if there's no Table, as long as it is
1824 Memories can be imported or in a section. There can be only one, but sections
1825 can be empty. A Data section can exist if there's no Memory, as long as it is
1828 Prototypes: stringify without .prototype. in the string.
1830 WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
1831 not a final size, and throws a RangeError on failure, not a TypeError.
1833 Fix compile / instantiate so the reject the promise if given an argument of the
1834 wrong type (instead of failing instantly).
1836 Fix async on neuter test.
1838 Element section shouldn't affect any Table if any of the elements are out of
1839 bounds. We need to process it in two passes.
1841 Segment section shouldn't affect any Data if any of the segments are out of
1842 bounds. We need to process it in two passes.
1844 Empty data segments are valid, but only when there is no memory. Their index
1845 still gets validated, and has to be zero.
1849 Error messages with context, the test seems overly restrictive but this is
1852 compile/instantiate/validate property descriptors.
1856 Temporarily disable NaN tests. We need to go back and implement the following
1857 semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
1858 much as getting all the other tests passing.
1860 Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
1861 no_fold_promote_demote (an interesting corner case which we get wrong). mul by
1862 one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
1863 0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
1864 to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
1865 (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
1866 why they're not allowed.
1869 * wasm/function-tests/i32-load8-s.js:
1870 * wasm/function-tests/memory-access-past-4gib.js:
1871 (const.op.of.WASM.opcodes):
1872 * wasm/function-tests/memory-alignment.js: Added.
1873 (const.op.of.WASM.opcodes):
1874 * wasm/function-tests/memory-section-and-import.js:
1875 * wasm/js-api/Module-compile.js:
1876 (async.testPromiseAPI):
1877 * wasm/js-api/dont-mmap-zero-byte-memory.js:
1879 * wasm/js-api/element.js:
1880 (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1881 * wasm/js-api/neutered-inputs.js:
1882 (const.testFunction): Deleted.
1883 (const.testConstructor): Deleted.
1884 * wasm/js-api/table.js:
1885 (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1886 (new.WebAssembly.Module):
1888 (assertBadTableImport):
1889 (assert.throws.WebAssembly.Table.prototype.grow):
1890 (assertBadTableInstance): Deleted.
1891 * wasm/js-api/test_Data.js:
1892 (DataSectionWithoutMemory):
1893 * wasm/spec-harness/index.js:
1895 (uniqueTest): Deleted.
1896 (assert_invalid): Deleted.
1897 (assert_soft_invalid): Deleted.
1898 (register): Deleted.
1900 (get instance): Deleted.
1903 (assert_unlinkable): Deleted.
1904 (assert_uninstantiable): Deleted.
1905 (assert_trap): Deleted.
1908 (assert_exhaustion): Deleted.
1909 (assert_return): Deleted.
1910 (assert_return_nan): Deleted.
1911 * wasm/spec-harness/testharness.css: Removed.
1912 * wasm/spec-harness/testharness.js: Removed.
1913 * wasm/spec-harness/testharnessreport.js: Removed.
1914 * wasm/spec-harness/wasm-constants.js:
1917 * wasm/spec-harness/wasm-module-builder.js:
1918 (Binary.prototype.emit_section):
1920 (WasmFunctionBuilder.prototype.addBody):
1921 (WasmFunctionBuilder.prototype.end):
1922 (WasmFunctionBuilder):
1923 (WasmModuleBuilder.prototype.stringToBytes):
1924 (WasmModuleBuilder.prototype.addCustomSection):
1925 (WasmModuleBuilder.prototype.addFunctionTableInit):
1926 (WasmModuleBuilder.prototype.appendToTable):
1927 (WasmModuleBuilder.prototype.toArray):
1928 (WasmModuleBuilder.prototype.toBuffer):
1929 (WasmModuleBuilder.prototype.instantiate):
1930 (WasmModuleBuilder):
1931 * wasm/spec-tests/address.wast.js:
1932 * wasm/spec-tests/align.wast.js: Added.
1933 * wasm/spec-tests/binary.wast.js:
1934 * wasm/spec-tests/block.wast.js:
1935 * wasm/spec-tests/br.wast.js:
1936 * wasm/spec-tests/br_if.wast.js:
1937 * wasm/spec-tests/br_table.wast.js:
1938 * wasm/spec-tests/call.wast.js:
1939 * wasm/spec-tests/call_indirect.wast.js:
1940 * wasm/spec-tests/comments.wast.js:
1941 * wasm/spec-tests/const.wast.js: Added.
1942 * wasm/spec-tests/conversions.wast.js: Added.
1943 * wasm/spec-tests/custom_section.wast.js:
1944 * wasm/spec-tests/exports.wast.js:
1945 * wasm/spec-tests/f32.wast.js: Added.
1946 * wasm/spec-tests/f64.wast.js: Added.
1947 * wasm/spec-tests/fac.wast.js:
1948 * wasm/spec-tests/float_exprs.wast.js: Added.
1949 * wasm/spec-tests/float_misc.wast.js: Added.
1950 * wasm/spec-tests/func.wast.js:
1951 * wasm/spec-tests/globals.wast.js:
1952 * wasm/spec-tests/if.wast.js:
1953 * wasm/spec-tests/imports.wast.js:
1954 * wasm/spec-tests/inline-module.wast.js: Added.
1955 * wasm/spec-tests/jsapi.js:
1958 * wasm/spec-tests/labels.wast.js:
1959 * wasm/spec-tests/loop.wast.js:
1960 * wasm/spec-tests/memory.wast.js:
1961 * wasm/spec-tests/memory_trap.wast.js: Added.
1962 * wasm/spec-tests/names.wast.js:
1963 * wasm/spec-tests/nop.wast.js:
1964 * wasm/spec-tests/return.wast.js:
1965 * wasm/spec-tests/stack.wast.js:
1966 * wasm/spec-tests/token.wast.js: Added.
1967 * wasm/spec-tests/type.wast.js: Added.
1968 * wasm/spec-tests/typecheck.wast.js:
1969 * wasm/spec-tests/unreachable.wast.js:
1970 * wasm/spec-tests/unreached-invalid.wast.js:
1971 * wasm/spec-tests/unwind.wast.js:
1972 * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
1973 * wasm/spec-tests/utf8-import-field.wast.js: Added.
1974 * wasm/spec-tests/utf8-import-module.wast.js: Added.
1976 2017-06-13 Ryan Haddad <ryanhaddad@apple.com>
1978 Unreviewed JSC test gardening.
1980 * stress/check-string-ident.js:
1981 * stress/new-largeish-contiguous-array-with-size.js:
1983 2017-06-13 Michael Saboff <msaboff@apple.com>
1985 DFG doesn't properly handle a property that is change to read only in a prototype
1986 https://bugs.webkit.org/show_bug.cgi?id=173321
1988 Reviewed by Filip Pizlo.
1990 * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
1991 * stress/regress-173321.js: Added new regression test.
1996 2017-06-12 Saam Barati <sbarati@apple.com>
1998 Update test262 test expectation since r218082 makes new tests pass.
2002 2017-06-12 Saam Barati <sbarati@apple.com>
2004 We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
2005 https://bugs.webkit.org/show_bug.cgi?id=172957
2006 <rdar://problem/32602704>
2008 Reviewed by Filip Pizlo.
2010 * stress/spec-empty-flows-through-cell-checks.js: Added.
2015 2017-06-12 Oleksandr Skachkov <gskachkov@gmail.com>
2017 We incorrectly allow escaped characters in keyword tokens
2018 https://bugs.webkit.org/show_bug.cgi?id=171310
2020 Reviewed by Yusuke Suzuki.
2022 * stress/destructuring-assignment-syntax.js:
2023 * stress/error-messages-for-in-operator-should-not-crash.js:
2025 * stress/reserved-word-with-escape.js:
2026 (testSyntaxError.String.raw.v):
2027 (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
2028 (testSyntaxError.String.raw.a):
2029 * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
2031 2017-06-09 Yusuke Suzuki <utatane.tea@gmail.com>
2033 [DFG] Add ArrayIndexOf intrinsic
2034 https://bugs.webkit.org/show_bug.cgi?id=172421
2036 Reviewed by Saam Barati.
2038 * stress/array-indexof-array-prototype-change.js: Added.
2041 * stress/array-indexof-have-a-bad-time-getter.js: Added.
2044 * stress/array-indexof-have-a-bad-time.js: Added.
2047 * stress/array-indexof-hole-with-prototype.js: Added.
2050 * stress/array-indexof-hole.js: Added.
2053 * stress/array-indexof-index.js: Added.
2060 * stress/array-indexof-negative-index.js: Added.
2067 * stress/array-indexof-non-int32-start-index.js: Added.
2071 * stress/array-indexof-object-prototype-change.js: Added.
2074 * stress/array-indexof-object.js: Added.
2077 * stress/array-indexof-original-array.js: Added.
2080 * stress/array-indexof-string.js: Added.
2083 * stress/array-indexof-structure-change-convert.js: Added.
2086 * stress/array-indexof-structure-change.js: Added.
2089 * stress/array-indexof.js: Added.
2093 2017-06-11 Keith Miller <keith_miller@apple.com>
2095 TypedArray constructor with string shouldn't throw
2096 https://bugs.webkit.org/show_bug.cgi?id=173181
2098 Reviewed by JF Bastien.
2100 We should be coercing primitive arguments to numbers in the various
2101 TypedArray constructors.
2103 * stress/typedarray-constructor.js:
2105 2017-06-11 Yusuke Suzuki <utatane.tea@gmail.com>
2107 Unreviewed, update test results part 3
2108 https://bugs.webkit.org/show_bug.cgi?id=173227
2110 * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
2112 2017-06-10 Yusuke Suzuki <utatane.tea@gmail.com>
2114 Unreviewed, update test results part 2
2115 https://bugs.webkit.org/show_bug.cgi?id=173227
2119 2017-06-10 Yusuke Suzuki <utatane.tea@gmail.com>
2121 Unreviewed, update test results
2122 https://bugs.webkit.org/show_bug.cgi?id=173227
2124 * microbenchmarks/string-prototype-search-observable-side-effects.js:
2127 2017-06-10 Yusuke Suzuki <utatane.tea@gmail.com>
2129 [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
2130 https://bugs.webkit.org/show_bug.cgi?id=173227
2132 Reviewed by Mark Lam.
2136 * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
2138 2017-06-08 Keith Miller <keith_miller@apple.com>
2140 WebAssembly: We should only create wrappers for functions that can be exported
2141 https://bugs.webkit.org/show_bug.cgi?id=173088
2143 Reviewed by Saam Barati.
2145 Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
2146 on the old testWasmModuleFunctions api, which has been removed.
2148 * wasm/function-tests/copysign.js: Removed.
2149 * wasm/function-tests/ctz.js: Removed.
2150 * wasm/function-tests/drop.js: Removed.
2151 * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
2152 * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
2153 * wasm/function-tests/dumb-less-than-ite.js: Removed.
2154 * wasm/function-tests/eqz.js: Removed.
2155 * wasm/function-tests/i32-trunc-s-f32.js: Removed.
2156 * wasm/function-tests/i32-trunc-s-f64.js: Removed.
2157 * wasm/function-tests/i32-trunc-u-f32.js: Removed.
2158 * wasm/function-tests/i32-trunc-u-f64.js: Removed.
2159 * wasm/function-tests/i64-trunc-s-f32.js: Removed.
2160 * wasm/function-tests/i64-trunc-s-f64.js: Removed.
2161 * wasm/function-tests/i64-trunc-u-f32.js: Removed.
2162 * wasm/function-tests/i64-trunc-u-f64.js: Removed.
2163 * wasm/function-tests/if-then-else-fallthrough.js: Removed.
2164 * wasm/function-tests/if-then-fallthrough.js: Removed.
2165 * wasm/function-tests/int-to-floating-point.js: Removed.
2166 * wasm/function-tests/loop-mult.js:
2167 * wasm/function-tests/loop-sum.js:
2168 * wasm/function-tests/max.js: Removed.
2169 * wasm/function-tests/min.js: Removed.
2170 * wasm/function-tests/nearest.js: Removed.
2171 * wasm/function-tests/nop.js: Removed.
2172 * wasm/function-tests/popcnt.js: Removed.
2173 * wasm/function-tests/ret5.js:
2174 * wasm/function-tests/select.js: Removed.
2175 * wasm/function-tests/tee-local.js: Removed.
2176 * wasm/function-tests/trunc.js: Removed.
2178 2017-06-07 JF Bastien <jfbastien@apple.com>
2180 WebAssembly: test imports and exports with 16-bit characters
2181 https://bugs.webkit.org/show_bug.cgi?id=165977
2182 <rdar://problem/29760130>
2184 Reviewed by Saam Barati.
2186 The output for import failure was improved, so many tests need to
2187 be updated here. Only one has new tests as noted below.
2189 * wasm/function-tests/memory-import-and-grow.js:
2190 * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
2192 * wasm/js-api/global-error.js:
2195 * wasm/js-api/table.js:
2197 (new.WebAssembly.Table):
2198 * wasm/js-api/test_memory.js:
2200 * wasm/js-api/wasm-to-wasm-bad-signature.js:
2201 (BadSignatureDropStartParams.):
2202 (BadSignatureDropStartParams):
2203 (BadSignatureDropEndParams.):
2204 (BadSignatureSwapParam.):
2206 * wasm/js-api/web-assembly-instantiate.js:
2207 (assert.asyncTest.async.test):
2209 * wasm/js-api/wrapper-function.js:
2210 (return.new.WebAssembly.Module):
2212 2017-06-07 Mark Lam <mark.lam@apple.com>
2214 Restrict the regress-173035.js test to only run on Darwin x86-64.
2215 https://bugs.webkit.org/show_bug.cgi?id=173075
2217 Reviewed by Saam Barati.
2219 This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
2220 this test will require to succeed. Here's an example of this failure:
2221 https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
2223 Since the issue is due to allocation of a very large amount of memory, the test
2224 will probably fail on iOS and other platforms as well. Hence, we should just
2225 skip this test for any platforms that is not Darwin x86-64.
2227 * stress/regress-173035.js:
2229 2017-06-07 Mark Lam <mark.lam@apple.com>
2231 ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
2232 https://bugs.webkit.org/show_bug.cgi?id=168587
2236 Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
2238 * stress/test-finally.js:
2240 2017-06-06 Mark Lam <mark.lam@apple.com>
2242 Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
2243 https://bugs.webkit.org/show_bug.cgi?id=173035
2244 <rdar://problem/32554593>
2246 Reviewed by Geoffrey Garen and Filip Pizlo.
2248 * stress/regress-173035.js: Added.
2250 2017-06-06 Saam Barati <sbarati@apple.com>
2252 Make sure we restore SP when doing calls that could be to JS
2253 https://bugs.webkit.org/show_bug.cgi?id=172946
2254 <rdar://problem/32579026>
2256 Reviewed by JF Bastien.
2258 * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
2259 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
2260 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
2261 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
2262 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
2264 2017-06-06 Joseph Pecoraro <pecoraro@apple.com>
2266 Unreviewed rollout r217807. Caused a test to crash.
2268 * heapProfiler/class-names.js: Removed.
2269 * heapProfiler/driver/driver.js:
2270 (CheapHeapSnapshotNode):
2271 (CheapHeapSnapshot):
2272 (createCheapHeapSnapshot):
2274 (createHeapSnapshot):
2275 * typeProfiler/inheritance.js:
2281 2017-06-06 Filip Pizlo <fpizlo@apple.com>
2283 index out of bound in bytecodebasicblock
2284 https://bugs.webkit.org/show_bug.cgi?id=172963
2286 Reviewed by Saam Barati and Mark Lam.
2288 * stress/dfg-call-class-constructor.js: Added.
2292 2017-06-05 Joseph Pecoraro <pecoraro@apple.com>
2294 Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
2295 https://bugs.webkit.org/show_bug.cgi?id=172848
2296 <rdar://problem/25709212>
2298 Reviewed by Saam Barati.
2300 * typeProfiler/inheritance.js:
2301 Rewrite the test slightly for clarity. The hoisting was confusing.
2303 * heapProfiler/class-names.js: Added.
2307 Test object types and improved class names.
2309 * heapProfiler/driver/driver.js:
2310 (CheapHeapSnapshotNode):
2311 (CheapHeapSnapshot):
2312 (createCheapHeapSnapshot):
2314 (createHeapSnapshot):
2315 Update snapshot parsing from version 1 to version 2.
2317 2017-06-02 Yusuke Suzuki <utatane.tea@gmail.com>
2319 ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
2320 https://bugs.webkit.org/show_bug.cgi?id=168844
2322 Reviewed by Saam Barati.
2324 * modules/async-function-export.js: Added.
2328 2017-06-02 Yusuke Suzuki <utatane.tea@gmail.com>
2330 ES2015 modules - Export default function hoisting
2331 https://bugs.webkit.org/show_bug.cgi?id=170174
2333 Reviewed by Saam Barati.
2335 This issue itself is solved by fixing function declaration hoisting rules.
2336 This patch just adds the specific test to modules tests to ensure the bug
2339 * modules/export-default-function-hoisting.js: Added.
2340 * modules/export-default-function-hoisting/cappuccino.js: Added.
2341 (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
2342 * modules/export-default-function-hoisting/cocoa.js: Added.
2343 (export.default.drinkCocoa):
2345 2017-06-01 Oleksandr Skachkov <gskachkov@gmail.com>
2347 Class Proxy can't be extended
2348 https://bugs.webkit.org/show_bug.cgi?id=169040
2350 Reviewed by Saam Barati.
2352 Adding tests that check correctness of Proxy to ES6 `class`
2353 Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
2355 * stress/proxy-class.js: Added.
2357 (throw.new.Error.SuperClass):
2358 (throw.new.Error.A):
2361 2017-05-31 Yusuke Suzuki <utatane.tea@gmail.com>
2363 [JSC] Implement String.prototype.concat in JS builtins
2364 https://bugs.webkit.org/show_bug.cgi?id=172798
2366 Reviewed by Sam Weinig.
2368 * microbenchmarks/string-concat-convert.js: Added.
2370 * microbenchmarks/string-concat-long-convert.js: Added.
2372 * microbenchmarks/string-concat-long.js: Added.
2374 * microbenchmarks/string-concat.js: Added.
2377 2017-05-31 Oleksandr Skachkov <gskachkov@gmail.com>
2379 Rolling out: Prevent async methods named 'function'
2380 https://bugs.webkit.org/show_bug.cgi?id=172776
2382 Reviewed by Mark Lam.
2384 * stress/async-await-syntax.js:
2385 (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2386 (testTopLevelAsyncAwaitSyntaxSloppyMode):
2387 (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2388 (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2389 (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2391 2017-05-31 Ryan Haddad <ryanhaddad@apple.com>
2393 Skip flaky JSC test stress/test-finally.js
2394 https://bugs.webkit.org/show_bug.cgi?id=168587
2396 Unreviewed test gardening.
2398 * stress/test-finally.js:
2400 2017-05-30 Oleksandr Skachkov <gskachkov@gmail.com>
2402 Prevent async methods named 'function' in Object literal
2403 https://bugs.webkit.org/show_bug.cgi?id=172660
2405 Reviewed by Saam Barati.
2407 * stress/async-await-syntax.js:
2408 (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2410 2017-05-30 Oleksandr Skachkov <gskachkov@gmail.com>
2412 ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
2413 https://bugs.webkit.org/show_bug.cgi?id=171274
2415 Reviewed by Saam Barati.
2417 * stress/async-arrow-functions-lexical-binding-in-class.js:
2419 (shouldBeAsyncAndStoreBind):
2420 (promise.new.Promise):
2422 (ChildClass4.prototype.classValue):
2423 (ChildClass4.prototype.get classProperty):
2424 * stress/async-arrow-functions-lexical-super-binding.js:
2426 (const.childA1.new.prototype.var.f.async):
2427 (const.childA1.new.var):
2428 (const.childA1.new):
2429 (const.childA2.new.prototype.var.f.async):
2430 (const.childA2.new.var):
2431 (const.childA2.new):
2432 (const.childA3.new.prototype.var.f.async):
2433 (const.childA3.new.var):
2434 (const.childA3.new):
2435 (try.childA4.new.prototype.var.f.async):
2436 (try.childA4.new.var):
2439 (const.childA5.new.prototype.var.f.async):
2440 (const.childA5.new.var):
2441 (const.childA5.new):
2443 (checkClass.new.prototype.var.f.async):
2444 (checkClass.new.var):
2446 (checkClass.new.prototype.method):
2447 (checkClass.new.prototype.prop):
2449 2017-05-27 Yusuke Suzuki <utatane.tea@gmail.com>
2451 [JSC] Map and Set constructors should have fast path for cloning
2452 https://bugs.webkit.org/show_bug.cgi?id=172413
2454 Reviewed by Saam Barati.
2456 * stress/map-clone-instance-iterator-change.js: Added.
2458 (map.Symbol.iterator):
2459 * stress/map-clone-iterator-change.js: Added.
2461 (Map.prototype.Symbol.iterator):
2462 * stress/map-clone-next-change.js: Added.
2464 (map.Symbol.iterator.__proto__.next):
2465 * stress/map-clone.js: Added.
2468 * stress/map-inherit-set.js: Added.
2472 * stress/set-clone-instance-iterator-change.js: Added.
2474 (set Symbol.iterator):
2475 * stress/set-clone-iterator-change.js: Added.
2477 (set Set.prototype.Symbol.iterator):
2478 * stress/set-clone-next-change.js: Added.
2480 (set Symbol.iterator.__proto__.next):
2481 * stress/set-clone.js: Added.
2483 (set Set.prototype.add):
2484 * stress/set-inherit-add.js: Added.
2486 (DerivedSet.set add):
2488 2017-05-26 Ryan Haddad <ryanhaddad@apple.com>
2490 Unreviewed, rolling out r217458.
2492 This change caused 55 JSC test failures.
2496 "Date should use historical data if it's available."
2497 https://bugs.webkit.org/show_bug.cgi?id=172592
2498 http://trac.webkit.org/changeset/217458
2500 2017-05-26 Yusuke Suzuki <utatane.tea@gmail.com>
2502 Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
2503 https://bugs.webkit.org/show_bug.cgi?id=167805
2505 Reviewed by Saam Barati.
2507 * modules/module-jit-reachability.js: Added.
2509 2017-05-26 Oleksandr Skachkov <gskachkov@gmail.com>
2511 Prevent async methods named 'function'
2512 https://bugs.webkit.org/show_bug.cgi?id=172598
2514 Reviewed by Mark Lam.
2516 * stress/async-await-syntax.js:
2517 (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2518 (testTopLevelAsyncAwaitSyntaxSloppyMode):
2519 (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2520 (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2521 (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2523 2017-05-25 Keith Miller <keith_miller@apple.com>
2525 Date should use historical data if it's available.
2526 https://bugs.webkit.org/show_bug.cgi?id=172592
2528 Reviewed by Mark Lam.
2530 Remove parts of the date tests that rely on the absence of
2531 historical data in Date.
2533 * mozilla/ecma/Date/15.9.5.31-1.js:
2535 * mozilla/ecma/Date/15.9.5.35-1.js:
2538 2017-05-25 Saam Barati <sbarati@apple.com>
2540 Our for-in optimization in the bytecode generator does its static analysis incorrectly
2541 https://bugs.webkit.org/show_bug.cgi?id=172532
2542 <rdar://problem/32369452>
2544 Reviewed by Mark Lam.
2546 * stress/for-in-invalidation-for-any-write.js: Added.
2551 2017-05-25 Mark Lam <mark.lam@apple.com>
2553 ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
2554 https://bugs.webkit.org/show_bug.cgi?id=172548
2555 <rdar://problem/31458393>
2557 Reviewed by Filip Pizlo.
2559 * stress/regress-172548.patch: Added.
2561 2017-05-23 Saam Barati <sbarati@apple.com>
2563 We should not mmap zero bytes for a memory in Wasm
2564 https://bugs.webkit.org/show_bug.cgi?id=172528
2565 <rdar://problem/32257076>
2567 Reviewed by Mark Lam.
2569 * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
2572 2017-05-23 Saam Barati <sbarati@apple.com>
2574 CFGSimplificationPhase should not merge a block with itself
2575 https://bugs.webkit.org/show_bug.cgi?id=172508
2576 <rdar://problem/28424006>
2578 Reviewed by Keith Miller.
2580 * stress/dont-crash-in-cfg-simplification.js: Added.
2585 2017-05-20 Yusuke Suzuki <utatane.tea@gmail.com>
2587 [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
2588 https://bugs.webkit.org/show_bug.cgi?id=172216
2590 Reviewed by Saam Barati.
2592 * stress/array-storage-get-by-val.js: Added.
2596 (testSlowPutOutOfBound):
2597 (testSlowPutInBound):
2599 2017-05-21 Yusuke Suzuki <utatane.tea@gmail.com>
2601 Unreviewed, fix commented out tests
2602 https://bugs.webkit.org/show_bug.cgi?id=172225
2604 * stress/get-by-val-string.js:
2607 (Hello.prototype.get 42):
2608 (Hello.prototype.43):
2611 (throw.new.Error): Deleted.
2613 2017-05-21 Saam Barati <sbarati@apple.com>
2615 We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
2616 https://bugs.webkit.org/show_bug.cgi?id=171041
2617 <rdar://problem/32082516>
2619 Reviewed by Yusuke Suzuki.
2621 * stress/lexical-scoping-for-loop.js: Added.
2636 2017-05-19 Yusuke Suzuki <utatane.tea@gmail.com>
2638 [JSC] Make get_by_val & string "499" to number 499
2639 https://bugs.webkit.org/show_bug.cgi?id=172225
2641 Reviewed by Saam Barati.
2643 * stress/get-by-val-string.js: Added.
2648 (Hello.prototype.get 42):
2649 (Hello.prototype.43):
2652 2017-05-19 Mark Lam <mark.lam@apple.com>
2654 [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2655 https://bugs.webkit.org/show_bug.cgi?id=172383
2656 <rdar://problem/31418651>
2658 Reviewed by Filip Pizlo.
2660 * stress/regress-172383.js: Added.
2662 2017-05-19 Ryan Haddad <ryanhaddad@apple.com>
2664 Unreviewed, rolling out r217156.
2666 This change broke the iOS build.
2670 "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
2672 https://bugs.webkit.org/show_bug.cgi?id=172383
2673 http://trac.webkit.org/changeset/217156
2675 2017-05-19 Mark Lam <mark.lam@apple.com>
2677 Add missing exception check.
2678 https://bugs.webkit.org/show_bug.cgi?id=172346
2679 <rdar://problem/32289640>
2681 Reviewed by Geoffrey Garen.
2683 * stress/regress-172346.js: Added.
2685 2017-05-19 Mark Lam <mark.lam@apple.com>
2687 DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2688 https://bugs.webkit.org/show_bug.cgi?id=172383
2689 <rdar://problem/31418651>
2691 Reviewed by Filip Pizlo.
2693 * stress/regress-172383.js: Added.
2695 2017-05-19 Filip Pizlo <fpizlo@apple.com>
2697 arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
2698 https://bugs.webkit.org/show_bug.cgi?id=172369
2700 Reviewed by Mark Lam.
2702 * stress/undecided-concat.js: Added.
2704 2017-05-19 Yusuke Suzuki <utatane.tea@gmail.com>
2706 [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2707 https://bugs.webkit.org/show_bug.cgi?id=172098
2709 Reviewed by Saam Barati.
2711 * stress/check-sub-class.js: Added.
2718 2017-05-18 JF Bastien <jfbastien@apple.com>
2720 WebAssembly: exports is a getter
2721 https://bugs.webkit.org/show_bug.cgi?id=172129
2723 Reviewed by Saam Barati.
2725 Update test to reflect new semantics.
2727 * wasm/js-api/test_basic_api.js:
2728 (const.c.in.constructorProperties.switch):
2730 2017-05-18 Saam Barati <sbarati@apple.com>
2732 Proxy's [[Get]] passes incorrect receiver
2733 https://bugs.webkit.org/show_bug.cgi?id=164849
2734 <rdar://problem/31767058>
2736 Reviewed by Yusuke Suzuki.
2738 * stress/proxy-get-set-correct-receiver.js: Added.
2741 (test.let.target.set prop):
2742 (test.let.target.get prop):
2744 * stress/proxy-set.js:
2746 * stress/reflect-set-proxy-set.js:
2748 * stress/reflect-set-receiver-proxy-set.js:
2751 2017-05-18 Filip Pizlo <fpizlo@apple.com>
2753 Constructor calls set this too early
2754 https://bugs.webkit.org/show_bug.cgi?id=172302
2756 Reviewed by Saam Barati.
2758 This tests all three kinds of constructs in BytecodeGenerator. All three were previously
2761 * stress/construct-overwritten-variable.js: Added.
2763 * stress/construct-spread-overwritten-variable-2.js: Added.
2765 * stress/construct-spread-overwritten-variable.js: Added.
2768 2017-05-18 Saam Barati <sbarati@apple.com>
2770 WebAssembly: perform stack checks
2771 https://bugs.webkit.org/show_bug.cgi?id=165546
2772 <rdar://problem/29760307>
2774 Reviewed by Filip Pizlo.
2777 * wasm/function-tests/factorial.js:
2778 * wasm/function-tests/float-sub.js:
2779 * wasm/function-tests/stack-overflow.js: Added.
2780 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2781 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2782 (assertOverflows.makeInstance):
2783 (assertOverflows.makeInstance2):
2784 (assertOverflows.assertThrows):
2786 (assertThrows.test.makeSignature):
2787 (assertThrows.test.makeInstance):
2788 (assertThrows.test):
2791 2017-05-18 Keith Miller <keith_miller@apple.com>
2793 WebAssembly API: test with neutered inputs
2794 https://bugs.webkit.org/show_bug.cgi?id=163899
2796 Reviewed by JF Bastien.
2798 * wasm/js-api/neutered-inputs.js: Added.
2799 (const.testFunction):
2800 (const.testConstructor):
2801 * wasm/js-api/test_basic_api.js:
2802 (const.c.in.constructorProperties.switch):
2804 2017-05-18 Filip Pizlo <fpizlo@apple.com>
2806 DFG inlining should be hardened for the no-result case
2807 https://bugs.webkit.org/show_bug.cgi?id=172290
2809 Reviewed by Saam Barati.
2811 * stress/array-constructor-no-result.js: Added.
2813 * stress/pow-no-result.js: Added.
2816 2017-05-18 Commit Queue <commit-queue@webkit.org>
2818 Unreviewed, rolling out r217031, r217032, and r217037.
2819 https://bugs.webkit.org/show_bug.cgi?id=172293
2821 cause linking errors in Windows (Requested by yusukesuzuki on
2824 Reverted changesets:
2826 "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
2827 https://bugs.webkit.org/show_bug.cgi?id=172098
2828 http://trac.webkit.org/changeset/217031
2830 "Unreviewed, rebaseline for newly added ClassInfo"
2831 https://bugs.webkit.org/show_bug.cgi?id=172098
2832 http://trac.webkit.org/changeset/217032
2834 "Unreviewed, fix debug and non-JIT build"
2835 https://bugs.webkit.org/show_bug.cgi?id=172098
2836 http://trac.webkit.org/changeset/217037
2838 2017-05-16 Yusuke Suzuki <utatane.tea@gmail.com>
2840 [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2841 https://bugs.webkit.org/show_bug.cgi?id=172098
2843 Reviewed by Saam Barati.
2845 * stress/check-sub-class.js: Added.
2852 2017-05-17 Filip Pizlo <fpizlo@apple.com>
2854 Unreviewed, address mlam's review feedback.
2856 * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
2858 2017-05-17 Saam Barati <sbarati@apple.com>
2860 We don't do context switches for Wasm->Wasm call indirect
2861 https://bugs.webkit.org/show_bug.cgi?id=172188
2862 <rdar://problem/32231828>
2864 Reviewed by Keith Miller.
2866 * wasm/function-tests/context-switch.js: Added.
2867 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2868 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
2869 (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
2872 (assert.eq.makeInstance):
2873 (assert.eq.makeInstance2):
2876 2017-05-17 Filip Pizlo <fpizlo@apple.com>
2878 JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
2879 https://bugs.webkit.org/show_bug.cgi?id=172208
2881 Reviewed by Saam Barati.
2883 * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
2888 2017-05-16 Yusuke Suzuki <utatane.tea@gmail.com>
2890 [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
2891 https://bugs.webkit.org/show_bug.cgi?id=172115
2893 Reviewed by Saam Barati.
2895 * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
2903 2017-05-16 JF Bastien <jfbastien@apple.com>
2905 WebAssembly: add memory fuzzer
2906 https://bugs.webkit.org/show_bug.cgi?id=169976
2907 <rdar://problem/31965328>
2909 Reviewed by Keith Miller.
2911 * wasm/fuzz/memory.js: Added.
2913 (const.action.string_appeared_here):
2914 (const.performAction):
2917 2017-05-16 JF Bastien <jfbastien@apple.com>
2919 WebAssembly: validate load / store alignment
2920 https://bugs.webkit.org/show_bug.cgi?id=168836
2921 <rdar://problem/31965349>
2923 Reviewed by Keith Miller.
2925 * wasm/WASM.js: fix regular expression greed
2926 * wasm/function-tests/memory-alignment.js: Added.
2927 (const.op.of.WASM.opcodes):
2928 * wasm/wasm.json: fix formatting
2930 2017-05-15 Mark Lam <mark.lam@apple.com>
2932 Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
2933 https://bugs.webkit.org/show_bug.cgi?id=172147
2935 Rubber-stamped by Saam Barati.
2937 * stress/object-rest-deconstruct.js: Removed.
2938 * stress/object-spread.js: Removed.
2940 2017-05-11 JF Bastien <jfbastien@apple.com>
2942 WebAssembly: stop supporting 0xD
2943 https://bugs.webkit.org/show_bug.cgi?id=168788
2944 <rdar://problem/31880922>
2946 Reviewed by Saam Barati.
2948 Test that only version 1 is supported.
2950 * wasm/js-api/version.js: Added.
2952 2017-05-10 JF Bastien <jfbastien@apple.com>
2954 WebAssemby: builder doesn't do Memory section maximum correctly
2955 https://bugs.webkit.org/show_bug.cgi?id=171931
2957 Reviewed by Keith Miller.
2960 (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
2961 * wasm/Builder_WebAssemblyBinary.js:
2962 (const.emitters.Memory):
2963 * wasm/function-tests/memory-grow-invalid.js: Added.
2965 2017-05-10 JF Bastien <jfbastien@apple.com>
2967 WebAssembly: support name section
2968 https://bugs.webkit.org/show_bug.cgi?id=171263
2970 Reviewed by Keith Miller.
2972 * wasm/function-tests/nameSection.js: Added.
2974 * wasm/function-tests/nameSection.wasm: Added.
2975 * wasm/function-tests/stack-trace.js: Update format
2977 2017-05-10 Filip Pizlo <fpizlo@apple.com>
2979 Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
2980 https://bugs.webkit.org/show_bug.cgi?id=171801
2982 Reviewed by Michael Saboff.
2984 These tests used to crash. The prefix and postfix tests cover different paths, except
2985 postfix-ignored goes down the same path as prefix due to an optimization.
2987 * stress/for-in-postfix-ignored-index.js: Added.
2989 * stress/for-in-postfix-index.js: Added.
2991 * stress/for-in-prefix-index.js: Added.
2994 2017-05-08 Mark Lam <mark.lam@apple.com>
2996 op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
2997 https://bugs.webkit.org/show_bug.cgi?id=171786
2998 <rdar://problem/32051023>
3000 Reviewed by Saam Barati.
3002 * stress/bug-171786.js: Added.
3004 2017-05-06 Oleksandr Skachkov <gskachkov@gmail.com>
3006 [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
3007 https://bugs.webkit.org/show_bug.cgi?id=171543
3009 Reviewed by Saam Barati.
3011 * stress/arrowfunction-lexical-bind-supercall-4.js:
3015 2017-05-05 Saam Barati <sbarati@apple.com>
3017 putDirectIndex does not properly do defineOwnProperty
3018 https://bugs.webkit.org/show_bug.cgi?id=171591
3019 <rdar://problem/31735695>
3021 Reviewed by Geoffrey Garen.
3023 * stress/array-prototype-splice-making-typed-array.js:
3025 * stress/array-species-config-array-constructor.js:
3028 * stress/put-direct-index-broken-2.js: Added.
3031 (makeLengthWritable):
3032 (set get restoreOldDesc):
3033 * stress/put-direct-index-broken.js: Added.
3037 * stress/put-indexed-getter-setter.js: Added.
3038 (foo.X.prototype.set 7):
3039 (foo.X.prototype.get 7):
3043 2017-05-04 Yusuke Suzuki <utatane.tea@gmail.com>
3045 [JSC] Math unary functions should be handled by DFG
3046 https://bugs.webkit.org/show_bug.cgi?id=171269
3048 Reviewed by Saam Barati.
3050 * stress/arith-acos-on-various-types.js: Added.
3051 (let.validInputTypedTestCases.validInputTestCases.map):
3053 (opaqueACosNoArgument):
3055 (opaqueAllTypesACos):
3057 (testSingleTypeCall):
3059 (opaqueACosForSideEffects):
3060 (testSideEffect.let.testObject.valueOf):
3063 (testCSE.let.testObject.valueOf):
3066 (testDCE.let.testObject.valueOf):
3068 (testException.opaqueACosWithException):
3070 * stress/arith-acosh-on-various-types.js: Added.
3071 (let.validInputTypedTestCases.validInputTestCases.map):
3073 (opaqueACoshNoArgument):
3075 (opaqueAllTypesACosh):
3077 (testSingleTypeCall):
3079 (opaqueACoshForSideEffects):
3080 (testSideEffect.let.testObject.valueOf):
3082 (opaqueACoshForCSE):
3083 (testCSE.let.testObject.valueOf):
3085 (opaqueACoshForDCE):
3086 (testDCE.let.testObject.valueOf):
3088 (testException.opaqueACoshWithException):
3090 * stress/arith-asin-on-various-types.js: Added.
3091 (let.validInputTypedTestCases.validInputTestCases.map):
3093 (opaqueASinNoArgument):
3095 (opaqueAllTypesASin):
3097 (testSingleTypeCall):
3099 (opaqueASinForSideEffects):
3100 (testSideEffect.let.testObject.valueOf):
3103 (testCSE.let.testObject.valueOf):
3106 (testDCE.let.testObject.valueOf):
3108 (testException.opaqueASinWithException):
3110 * stress/arith-asinh-on-various-types.js: Added.
3111 (let.validInputTypedTestCases.validInputTestCases.map):
3113 (opaqueASinhNoArgument):
3115 (opaqueAllTypesASinh):
3117 (testSingleTypeCall):
3119 (opaqueASinhForSideEffects):
3120 (testSideEffect.let.testObject.valueOf):
3122 (opaqueASinhForCSE):
3123 (testCSE.let.testObject.valueOf):
3125 (opaqueASinhForDCE):
3126 (testDCE.let.testObject.valueOf):
3128 (testException.opaqueASinhWithException):
3130 * stress/arith-atan-on-various-types.js: Added.
3131 (let.validInputTypedTestCases.validInputTestCases.map):
3133 (opaqueATanNoArgument):
3135 (opaqueAllTypesATan):
3137 (testSingleTypeCall):
3139 (opaqueATanForSideEffects):
3140 (testSideEffect.let.testObject.valueOf):
3143 (testCSE.let.testObject.valueOf):
3146 (testDCE.let.testObject.valueOf):
3148 (testException.opaqueATanWithException):
3150 * stress/arith-atanh-on-various-types.js: Added.
3151 (let.validInputTypedTestCases.validInputTestCases.map):
3153 (opaqueATanhNoArgument):
3155 (opaqueAllTypesATanh):
3157 (testSingleTypeCall):
3159 (opaqueATanhForSideEffects):
3160 (testSideEffect.let.testObject.valueOf):
3162 (opaqueATanhForCSE):
3163 (testCSE.let.testObject.valueOf):
3165 (opaqueATanhForDCE):
3166 (testDCE.let.testObject.valueOf):
3168 (testException.opaqueATanhWithException):
3170 * stress/arith-cbrt-on-various-types.js: Added.
3171 (let.validInputTypedTestCases.validInputTestCases.map):
3173 (opaqueCbrtNoArgument):
3175 (opaqueAllTypesCbrt):
3177 (testSingleTypeCall):
3179 (opaqueCbrtForSideEffects):
3180 (testSideEffect.let.testObject.valueOf):
3183 (testCSE.let.testObject.valueOf):
3186 (testDCE.let.testObject.valueOf):
3188 (testException.opaqueCbrtWithException):
3190 * stress/arith-cosh-on-various-types.js: Added.
3191 (let.validInputTypedTestCases.validInputTestCases.map):
3193 (opaqueCoshNoArgument):
3195 (opaqueAllTypesCosh):
3197 (testSingleTypeCall):
3199 (opaqueCoshForSideEffects):
3200 (testSideEffect.let.testObject.valueOf):
3203 (testCSE.let.testObject.valueOf):
3206 (testDCE.let.testObject.valueOf):
3208 (testException.opaqueCoshWithException):
3210 * stress/arith-expm1-on-various-types.js: Added.
3211 (let.validInputTypedTestCases.validInputTestCases.map):
3213 (opaqueExpm1NoArgument):
3215 (opaqueAllTypesExpm1):
3217 (testSingleTypeCall):
3219 (opaqueExpm1ForSideEffects):
3220 (testSideEffect.let.testObject.valueOf):
3222 (opaqueExpm1ForCSE):
3223 (testCSE.let.testObject.valueOf):
3225 (opaqueExpm1ForDCE):
3226 (testDCE.let.testObject.valueOf):
3228 (testException.opaqueExpm1WithException):
3230 * stress/arith-log10-on-various-types.js: Added.
3231 (let.validInputTypedTestCases.validInputTestCases.map):
3233 (opaqueLog10NoArgument):
3235 (opaqueAllTypesLog10):
3237 (testSingleTypeCall):
3239 (opaqueLog10ForSideEffects):
3240 (testSideEffect.let.testObject.valueOf):
3242 (opaqueLog10ForCSE):
3243 (testCSE.let.testObject.valueOf):
3245 (opaqueLog10ForDCE):
3246 (testDCE.let.testObject.valueOf):
3248 (testException.opaqueLog10WithException):
3250 * stress/arith-log2-on-various-types.js: Added.
3251 (let.validInputTypedTestCases.validInputTestCases.map):
3253 (opaqueLog2NoArgument):
3255 (opaqueAllTypesLog2):
3257 (testSingleTypeCall):
3259 (opaqueLog2ForSideEffects):
3260 (testSideEffect.let.testObject.valueOf):
3263 (testCSE.let.testObject.valueOf):
3266 (testDCE.let.testObject.valueOf):
3268 (testException.opaqueLog2WithException):
3270 * stress/arith-sinh-on-various-types.js: Added.
3271 (let.validInputTypedTestCases.validInputTestCases.map):
3273 (opaqueSinhNoArgument):
3275 (opaqueAllTypesSinh):
3277 (testSingleTypeCall):
3279 (opaqueSinhForSideEffects):
3280 (testSideEffect.let.testObject.valueOf):
3283 (testCSE.let.testObject.valueOf):
3286 (testDCE.let.testObject.valueOf):
3288 (testException.opaqueSinhWithException):
3290 * stress/arith-tan-on-various-types.js:
3292 * stress/arith-tanh-on-various-types.js: Added.
3293 (let.validInputTypedTestCases.validInputTestCases.map):
3295 (opaqueTanhNoArgument):
3297 (opaqueAllTypesTanh):
3299 (testSingleTypeCall):
3301 (opaqueTanhForSideEffects):
3302 (testSideEffect.let.testObject.valueOf):
3305 (testCSE.let.testObject.valueOf):
3308 (testDCE.let.testObject.valueOf):
3310 (testException.opaqueTanhWithException):
3313 2017-05-03 Keith Miller <keith_miller@apple.com>
3315 Array.prototype.sort should also allow a null comparator
3316 https://bugs.webkit.org/show_bug.cgi?id=171621
3318 Reviewed by Michael Saboff.
3320 Add test to make it less likely we revert to the incompatable behavior.
3321 Also, fix now incorrect tests.
3323 * ChakraCore/test/Array/array_sort.baseline-jsc:
3324 * stress/array-sort-bad-comparator.js:
3326 * stress/sort-null-comparator.js: Added.
3329 2017-05-03 Caitlin Potter <caitp@igalia.com>
3331 [JSC] remove unneeded asyncFunctionTests.yaml
3332 https://bugs.webkit.org/show_bug.cgi?id=171611
3334 Reviewed by Yusuke Suzuki.
3336 Async functions have shipped, and those tests are run as part of
3337 JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
3339 * asyncFunctionTests.yaml: Removed.
3340 * stress/async-await-long-loop.js:
3341 * stress/async-await-throw-loop.js:
3343 2017-05-03 Keith Miller <keith_miller@apple.com>
3345 Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
3346 https://bugs.webkit.org/show_bug.cgi?id=47825
3348 Reviewed by Saam Barati.
3350 * stress/sorting-boolean-result-comparator.js: Added.
3353 2017-05-02 David Kilzer <ddkilzer@apple.com>
3355 check-webkit-style should keep JavaScript test functions in sync
3356 <https://webkit.org/b/171424>
3358 Reviewed by Joseph Pecoraro.
3360 This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
3361 and shouldThrow() in sync with other copies of these methods.
3363 * stress/resources/standalone-pre.js:
3364 (shouldBe): Fix whitespace. Prefix 'exception' and 'quiet'
3365 variables with underscore.
3366 (shouldThrow): Fix whitespace.
3368 2017-04-30 Oleksandr Skachkov <gskachkov@gmail.com>
3370 We initialize functions too early in an eval
3371 https://bugs.webkit.org/show_bug.cgi?id=161099
3373 Reviewed by Saam Barati.
3375 * stress/eval-func-decl-with-let-const-class.js: Added.
3377 2017-04-30 Oleksandr Skachkov <gskachkov@gmail.com>
3379 [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3380 https://bugs.webkit.org/show_bug.cgi?id=163208
3382 Reviewed by Saam Barati.
3384 * stress/eval-func-decl-block-scoping-reassign.js: Added.
3386 (throw.new.Error.f):
3388 * stress/eval-func-decl-block-with-remove.js: Added.
3392 * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3399 * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3407 * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3408 * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3414 * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3421 * stress/eval-func-decl-in-frozen-global.js: Added.
3426 * stress/eval-func-decl-in-global-of-eval.js: Added.
3432 * stress/eval-func-decl-in-global.js: Added.
3435 * stress/eval-func-decl-in-if.js: Added.
3437 * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3447 * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3453 * stress/variable-under-tdz-eval-tricky.js:
3457 2017-04-27 Mark Lam <mark.lam@apple.com>
3459 Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
3460 https://bugs.webkit.org/show_bug.cgi?id=171404
3461 <rdar://problem/31876178>
3463 Reviewed by Saam Barati.
3465 * stress/js-fixed-array-out-of-memory.js: Added.
3467 2017-04-27 David Kilzer <ddkilzer@apple.com>
3469 Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
3470 <https://webkit.org/b/171362>
3471 <rdar://problem/31867686>
3473 Reviewed by Joseph Pecoraro.
3475 * stress/resources/standalone-pre.js:
3479 - Update shouldBe() to accept anonymous function arguments.
3480 (The shouldNotBe() function was never copied over.)
3481 - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
3482 function arguments (which were missed in r202609 for Bug
3485 2017-04-27 Yusuke Suzuki <utatane.tea@gmail.com>
3487 [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
3488 https://bugs.webkit.org/show_bug.cgi?id=171262
3490 Reviewed by Saam Barati.
3492 * stress/spread-outer-create-rest.js: Added.
3498 2017-04-26 Saam Barati <sbarati@apple.com>
3500 Print Wasm function index in stack trace
3501 https://bugs.webkit.org/show_bug.cgi?id=171349
3503 Reviewed by JF Bastien.
3505 * wasm/function-tests/stack-trace.js: Added.
3506 (import.Builder.from.string_appeared_here.assert):
3508 * wasm/function-tests/trap-after-cross-instance-call.js:
3509 (wasmFrameCountFromError):
3510 * wasm/function-tests/trap-load-2.js:
3511 (wasmFrameCountFromError):
3512 * wasm/function-tests/trap-load.js:
3513 (wasmFrameCountFromError):
3515 2017-04-26 Saam Barati <sbarati@apple.com>
3517 ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
3518 https://bugs.webkit.org/show_bug.cgi?id=170924
3519 <rdar://problem/31721052>
3521 Reviewed by Mark Lam.
3523 * stress/error-message-for-function-base-not-found.js: Added.
3526 * stress/error-messages-for-in-operator-should-not-crash.js: Added.
3529 2017-04-26 Keith Miller <keith_miller@apple.com>
3531 WebAssembly: Implement tier up
3532 https://bugs.webkit.org/show_bug.cgi?id=170134
3534 Reviewed by Filip Pizlo.
3536 * wasm/function-tests/trap-after-cross-instance-call.js:
3537 * wasm/tier-up/js-to-wasm.js: Added.
3539 * wasm/tier-up/wasm-to-wasm.js: Added.
3542 2017-04-26 Caitlin Potter <caitp@igalia.com>
3544 [JSC] Object.keys() must discard property names with no PropertyDescriptor
3545 https://bugs.webkit.org/show_bug.cgi?id=171291
3547 Reviewed by Yusuke Suzuki.
3549 * es6/Proxy_ownKeys_duplicates.js:
3550 * stress/proxy-own-keys.js:
3551 (let.handler.getOwnPropertyDescriptor):
3552 (let.handler.ownKeys):
3554 2017-04-25 Commit Queue <commit-queue@webkit.org>
3556 Unreviewed, rolling out r215476.
3557 https://bugs.webkit.org/show_bug.cgi?id=171304
3559 "It broke JSBench" (Requested by saamyjoon on #webkit).
3563 "[ES6]. Implement Annex B.3.3 function hoisting rules for
3565 https://bugs.webkit.org/show_bug.cgi?id=163208
3566 http://trac.webkit.org/changeset/215476
3568 2017-04-25 Saam Barati <sbarati@apple.com>
3570 JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
3571 https://bugs.webkit.org/show_bug.cgi?id=171150
3572 <rdar://problem/31771880>
3574 Reviewed by Sam Weinig.
3576 * stress/spread-optimized-properly.js: Added.
3580 (makeArrayIterator):
3583 (test.arr.__proto__.Symbol.iterator):
3584 (test.arr.Symbol.iterator):
3590 2017-04-25 Mark Lam <mark.lam@apple.com>
3592 [Follow up] Array.prototype.slice() should ensure that end >= begin.
3593 https://bugs.webkit.org/show_bug.cgi?id=170989
3594 <rdar://problem/31705652>
3598 Follow up to rename a test file that was accidentally named wrongly.
3600 * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
3601 * stress/regress-170989.patch: Removed.
3603 2017-04-25 Mark Lam <mark.lam@apple.com>
3605 Array.prototype.slice() should ensure that end >= begin.
3606 https://bugs.webkit.org/show_bug.cgi?id=170989
3607 <rdar://problem/31705652>
3609 Reviewed by Saam Barati.
3611 * stress/regress-170989.patch: Added.
3613 2017-04-25 Mark Lam <mark.lam@apple.com>
3615 Local CSE wrongly CSEs array accesses with different result types.
3616 https://bugs.webkit.org/show_bug.cgi?id=170990
3617 <rdar://problem/31705945>
3619 Reviewed by Saam Barati.
3621 * stress/regress-170990.js: Added.
3623 2017-04-25 Yusuke Suzuki <utatane.tea@gmail.com>
3625 WebAssembly: exporting a property with a name that's a number doesn't work
3626 https://bugs.webkit.org/show_bug.cgi?id=168857
3628 Reviewed by JF Bastien.
3630 r213453 allows Wasm instances to expose indexed properties. We activate the tests.
3632 * wasm/js-api/test_Instance.js:
3635 2017-04-24 Joseph Pecoraro <pecoraro@apple.com>
3637 test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
3638 https://bugs.webkit.org/show_bug.cgi?id=171190
3640 Reviewed by Saam Barati.
3642 * stress/async-await-syntax.js:
3645 2017-04-24 Yusuke Suzuki <utatane.tea@gmail.com>
3647 [JSC] Use JSFixedArray directly when using call_varargs
3648 https://bugs.webkit.org/show_bug.cgi?id=171057
3650 Reviewed by Saam Barati.
3652 * stress/spread-capture-rest.js: Added.
3657 * stress/spread-multi-layers.js: Added.
3663 * stress/spread-non-varargs.js: Added.
3668 2017-04-24 Joseph Pecoraro <pecoraro@apple.com>
3670 test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
3671 https://bugs.webkit.org/show_bug.cgi?id=170897
3673 Reviewed by Saam Barati.
3677 2017-04-24 Joseph Pecoraro <pecoraro@apple.com>
3679 Address some FIXMEs in JavaScript tests for bugs that have been fixed
3680 https://bugs.webkit.org/show_bug.cgi?id=171191
3682 Reviewed by JF Bastien.
3684 * stress/proxy-is-extensible.js:
3686 2017-04-24 Joseph Pecoraro <pecoraro@apple.com>
3688 test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
3689 https://bugs.webkit.org/show_bug.cgi?id=171160
3691 Reviewed by JF Bastien.
3693 * stress/inferred-names.js:
3696 2017-04-24 Joseph Pecoraro <pecoraro@apple.com>
3698 test262: test262/test/language/expressions/generators/yield-as-label.js
3699 https://bugs.webkit.org/show_bug.cgi?id=170979
3701 Reviewed by Saam Barati.
3703 * stress/async-await-module-reserved-word.js:
3704 * stress/async-await-reserved-word.js:
3705 Converge on "Cannot" instead of "Can't".
3707 * catch-parameter-syntax.js:
3708 * yield-named-variable-generator.js:
3709 * yield-named-variable.js:
3710 * stress/yield-label-generator.js:
3711 * stress/yield-label.js:
3712 * stress/yield-reserved-word.js: Added.
3713 More complete list of when 'yield' is allowed.
3715 * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3718 2017-04-23 Commit Queue <commit-queue@webkit.org>
3720 Unreviewed, rolling out r215674.
3721 https://bugs.webkit.org/show_bug.cgi?id=171212
3723 Possible unintended commit. This patch was on the wrong bug.
3724 (Requested by JoePeck on #webkit).
3728 "test262: test262/test/language/expressions/generators/yield-
3730 https://bugs.webkit.org/show_bug.cgi?id=170979
3731 http://trac.webkit.org/changeset/215674
3733 2017-04-23 Joseph Pecoraro <pecoraro@apple.com>
3735 test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
3736 https://bugs.webkit.org/show_bug.cgi?id=171197
3738 Reviewed by Saam Barati.
3742 2017-04-23 Joseph Pecoraro <pecoraro@apple.com>
3744 test262: test262/test/language/expressions/generators/yield-as-label.js
3745 https://bugs.webkit.org/show_bug.cgi?id=170979
3747 Reviewed by Saam Barati.
3749 * stress/async-await-module-reserved-word.js:
3750 * stress/async-await-reserved-word.js:
3751 Converge on "Cannot" instead of "Can't".
3753 * catch-parameter-syntax.js:
3754 * yield-named-variable-generator.js:
3755 * yield-named-variable.js:
3756 * stress/yield-label-generator.js:
3757 * stress/yield-label.js:
3758 * stress/yield-reserved-word.js: Added.
3759 More complete list of when 'yield' is allowed.
3761 * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3764 2017-04-23 Joseph Pecoraro <pecoraro@apple.com>
3766 test262: test262/test/built-ins/Number/parseFloat.js
3767 https://bugs.webkit.org/show_bug.cgi?id=171193
3769 Reviewed by Yusuke Suzuki.