b78dc4e026f02f622738f1aed7f853d2dfcd2ff1
[WebKit-https.git] / JSTests / ChangeLog
1 2018-01-03  Michael Saboff  <msaboff@apple.com>
2
3         Disable SharedArrayBuffers from Web API
4         https://bugs.webkit.org/show_bug.cgi?id=181266
5
6         Reviewed by Saam Barati.
7
8         Disabled SharedArrayBuffer tests.
9
10         * stress/SharedArrayBuffer-opt.js:
11         * stress/SharedArrayBuffer.js:
12         * stress/array-buffer-byte-length.js:
13         * stress/atomics-add-uint32.js:
14         * stress/atomics-known-int-use.js:
15         * stress/atomics-neg-zero.js:
16         * stress/atomics-store-return.js:
17         * stress/lars-sab-workers.js:
18         * stress/regress-159779-1.js:
19         * stress/regress-159779-2.js:
20         * stress/regress-170473.js:
21         * test262.yaml:
22
23 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
24
25         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
26         https://bugs.webkit.org/show_bug.cgi?id=181258
27
28         Reviewed by Antonio Gomes.
29
30         * stress/big-int-constructor-gc.js:
31         * stress/big-int-constructor-oom.js:
32
33 2018-01-03  Robin Morisset  <rmorisset@apple.com>
34
35         Inlining of a function that ends in op_unreachable crashes
36         https://bugs.webkit.org/show_bug.cgi?id=181027
37
38         Reviewed by Filip Pizlo.
39
40         * stress/inlining-unreachable.js: Added.
41         (bar):
42         (baz):
43         (i.catch):
44
45 2018-01-02  Saam Barati  <sbarati@apple.com>
46
47         Incorrect assertion inside AccessCase
48         https://bugs.webkit.org/show_bug.cgi?id=181200
49         <rdar://problem/35494754>
50
51         Reviewed by Yusuke Suzuki.
52
53         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
54         (ctor):
55         (theFunc):
56         (run):
57
58 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
59
60         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
61         https://bugs.webkit.org/show_bug.cgi?id=175359
62
63         Reviewed by Yusuke Suzuki.
64
65         * bigIntTests.yaml:
66         * stress/big-int-as-key.js: Added.
67         * stress/big-int-constructor-gc.js: Added.
68         * stress/big-int-constructor-oom.js: Added.
69         * stress/big-int-constructor-properties.js: Added.
70         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
71         * stress/big-int-constructor-prototype.js: Added.
72         * stress/big-int-constructor.js: Added.
73         * stress/big-int-function-apply.js:
74         * stress/big-int-length.js: Added.
75         * stress/big-int-prop-descriptor.js: Added.
76         * stress/big-int-proto-constructor.js: Added.
77         * stress/big-int-proto-name.js: Added.
78         * stress/big-int-prototype-properties.js: Added.
79         * stress/big-int-prototype-proto.js: Added.
80         * stress/big-int-prototype-value-of.js: Added.
81         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
82         * stress/big-int-prototype-to-string-apply.js: Added.
83         * stress/big-int-to-object.js: Added.
84         * stress/big-int-to-string.js: Added.
85
86 2017-12-28  Saam Barati  <sbarati@apple.com>
87
88         Assertion used to determine if something is an async generator is wrong
89         https://bugs.webkit.org/show_bug.cgi?id=181168
90         <rdar://problem/35640560>
91
92         Reviewed by Yusuke Suzuki.
93
94         * stress/async-generator-assertion.js: Added.
95
96 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
97
98         Skip stress/splay-flash-access tests on memory limited platforms
99         https://bugs.webkit.org/show_bug.cgi?id=181086
100
101         Reviewed by Carlos Alberto Lopez Perez.
102
103         These tests use about 185M of memory, and occasionally get OOM-killed
104         on memory limited platforms.
105
106         * stress/splay-flash-access-1ms.js:
107         * stress/splay-flash-access.js:
108
109 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
110
111         Skip slow jsc tests on embedded platforms
112         https://bugs.webkit.org/show_bug.cgi?id=180937
113
114         Reviewed by Carlos Alberto Lopez Perez.
115
116         The tests typeProfiler/deltablue-for-of.js and
117         typeProfiler/getter-richards.js take a very long time in the
118         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
119         thus always timeout. They should be skipped on these platforms.
120
121         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
122         * typeProfiler/getter-richards.js: Skip on arm*/mips.
123
124 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
125
126         [JSC] Do not check isValid() in op_new_regexp
127         https://bugs.webkit.org/show_bug.cgi?id=180970
128
129         Reviewed by Saam Barati.
130
131         * stress/regexp-syntax-error-invalid-flags.js: Added.
132         (shouldThrow):
133
134 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
135
136         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
137         https://bugs.webkit.org/show_bug.cgi?id=180712
138
139         Reviewed by Michael Catanzaro.
140
141         stress/call-apply-exponential-bytecode-size.js crashes if the
142         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
143         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
144         should skip the test on other platforms.
145
146         * stress/call-apply-exponential-bytecode-size.js:
147
148 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
149
150         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
151         https://bugs.webkit.org/show_bug.cgi?id=179762
152
153         Reviewed by Saam Barati.
154
155         * stress/call-varargs-double-new-array-buffer.js: Added.
156         (assert):
157         (bar):
158         (foo):
159         * stress/call-varargs-spread-new-array-buffer.js: Added.
160         (assert):
161         (bar):
162         (foo):
163         * stress/call-varargs-spread-new-array-buffer2.js: Added.
164         (assert):
165         (bar):
166         (foo):
167         * stress/forward-varargs-double-new-array-buffer.js: Added.
168         (assert):
169         (test.baz):
170         (test.bar):
171         (test.foo):
172         (test):
173         * stress/new-array-buffer-sinking-osrexit.js: Added.
174         (target):
175         (test):
176         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
177         (shouldBe):
178         (test):
179         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
180         (shouldBe):
181         (target):
182         (test):
183         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
184         (assert):
185         (test1.bar):
186         (test1.foo):
187         (test1):
188         (test2.bar):
189         (test2.foo):
190         (test3.baz):
191         (test3.bar):
192         (test3.foo):
193         (test4.baz):
194         (test4.bar):
195         (test4.foo):
196         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
197         (assert):
198         (test.baz):
199         (test.bar):
200         (test.foo):
201         (test):
202         * stress/phantom-new-array-buffer-osr-exit.js: Added.
203         (assert):
204         (baz):
205         (bar):
206         (effects):
207         (foo):
208
209 2017-12-14  Saam Barati  <sbarati@apple.com>
210
211         The CleanUp after LICM is erroneously removing a Check
212         https://bugs.webkit.org/show_bug.cgi?id=180852
213         <rdar://problem/36063494>
214
215         Reviewed by Filip Pizlo.
216
217         * stress/dont-run-cleanup-after-licm.js: Added.
218
219 2017-12-14  Michael Saboff  <msaboff@apple.com>
220
221         REGRESSION (r225695): Repro crash on yahoo login page
222         https://bugs.webkit.org/show_bug.cgi?id=180761
223
224         Reviewed by JF Bastien.
225
226         New regression test.
227
228         * stress/regress-180761.js: Added.
229
230 2017-12-13  Keith Miller  <keith_miller@apple.com>
231
232         JSObjects should have a mask for loading indexed properties
233         https://bugs.webkit.org/show_bug.cgi?id=180768
234
235         Reviewed by Mark Lam.
236
237         * stress/int16-put-by-val-in-and-out-of-bounds.js:
238         (test):
239
240 2017-12-13  Saam Barati  <sbarati@apple.com>
241
242         Arrow functions need their own structure because they have different properties than sloppy functions
243         https://bugs.webkit.org/show_bug.cgi?id=180779
244         <rdar://problem/35814591>
245
246         Reviewed by Mark Lam.
247
248         * stress/arrow-function-needs-its-own-structure.js: Added.
249         (assert):
250         (readPrototype):
251         (noInline.let.f1):
252         (noInline):
253
254 2017-12-13  Saam Barati  <sbarati@apple.com>
255
256         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
257         https://bugs.webkit.org/show_bug.cgi?id=163579
258         <rdar://problem/35455798>
259
260         Reviewed by Mark Lam.
261
262         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
263         (assert):
264         (test1):
265         (i.test1):
266         (i.test1.C):
267         (i.test1.async.foo):
268         (i.test1.foo):
269         (test2):
270
271 2017-12-13  Saam Barati  <sbarati@apple.com>
272
273         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
274         https://bugs.webkit.org/show_bug.cgi?id=180734
275         <rdar://problem/35640547>
276
277         Reviewed by Yusuke Suzuki.
278
279         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
280         (__isPropertyOfType):
281         (__getProperties):
282         (__getObjects):
283         (__getRandomObject):
284         (theClass.):
285         (theClass):
286         (childClass):
287         (counter.catch):
288
289 2017-12-12  Saam Barati  <sbarati@apple.com>
290
291         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
292         https://bugs.webkit.org/show_bug.cgi?id=180725
293         <rdar://problem/35970511>
294
295         Reviewed by Michael Saboff.
296
297         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
298         (f1):
299         (f2):
300         (let.o2.valueOf):
301
302 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
303
304         [JSC] Implement optimized WeakMap and WeakSet
305         https://bugs.webkit.org/show_bug.cgi?id=179929
306
307         Reviewed by Saam Barati.
308
309         * microbenchmarks/weak-map-key.js:
310         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
311         (assert):
312         (objectKey):
313         (let.start.Date.now):
314         * stress/basic-weakmap.js: Added.
315         (shouldBe):
316         (test):
317         * stress/basic-weakset.js: Added.
318         (shouldBe):
319         (test.set new):
320         * stress/weakmap-cse-set-break.js: Added.
321         (shouldBe):
322         (test):
323         * stress/weakmap-cse.js: Added.
324         (shouldBe):
325         (test):
326         * stress/weakmap-gc.js: Added.
327         (test):
328         * stress/weakset-cse-add-break.js: Added.
329         (shouldBe):
330         (test.set new):
331         * stress/weakset-cse.js: Added.
332         (shouldBe):
333         (test.set new):
334         * stress/weakset-gc.js: Added.
335         (test.set add):
336         (test.set new):
337         (test):
338
339 2017-12-12  Saam Barati  <sbarati@apple.com>
340
341         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
342         https://bugs.webkit.org/show_bug.cgi?id=180723
343         <rdar://problem/35859726>
344
345         Reviewed by JF Bastien.
346
347         * stress/get-my-argument-by-val-constant-folding.js: Added.
348         (test):
349         (catch):
350
351 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
352
353         [ESNext][BigInt] Implement BigInt literals and JSBigInt
354         https://bugs.webkit.org/show_bug.cgi?id=179000
355
356         Reviewed by Darin Adler and Yusuke Suzuki.
357
358         * bigIntTests.yaml: Added.
359         * stress/big-int-literal-line-terminator.js: Added.
360         * stress/big-int-literals.js: Added.
361         * stress/big-int-operations-error.js: Added.
362         * stress/big-int-type-of.js: Added.
363         * stress/big-int-white-space-trailing-leading.js: Added.
364         * stress/big-int-function-apply.js: Added.
365
366 2017-12-11  Saam Barati  <sbarati@apple.com>
367
368         We need to disableCaching() in ErrorInstance when we materialize properties
369         https://bugs.webkit.org/show_bug.cgi?id=180343
370         <rdar://problem/35833002>
371
372         Reviewed by Mark Lam.
373
374         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
375         (assert):
376         (makeError):
377         (storeToStack):
378         (storeToStackAlreadyMaterialized):
379
380 2017-12-05  JF Bastien  <jfbastien@apple.com>
381
382         WebAssembly: don't eagerly checksum
383         https://bugs.webkit.org/show_bug.cgi?id=180441
384         <rdar://problem/35156628>
385
386         Reviewed by Saam Barati.
387
388         Checksum is now disabled, so tests only have <?> as the module
389         name.
390
391         * wasm/function-tests/nameSection.js:
392         * wasm/function-tests/stack-overflow.js:
393         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
394         (assertOverflows.assertThrows):
395         (assertOverflows):
396         * wasm/function-tests/stack-trace.js:
397
398 2017-12-04  JF Bastien  <jfbastien@apple.com>
399
400         Proxy all functions, except the $ objects
401         https://bugs.webkit.org/show_bug.cgi?id=180375
402
403         Reviewed by Saam Barati.
404
405         It looks like this test may have broken some executions because I
406         call some internal objects. Explicitly ignore objects whose name
407         starts with "$" because it's a bad idea anyways.
408
409         * stress/proxy-all-the-parameters.js:
410         (generateObjects):
411         (get throw):
412
413 2017-12-04  Saam Barati  <sbarati@apple.com>
414
415         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
416         https://bugs.webkit.org/show_bug.cgi?id=180366
417         <rdar://problem/35685877>
418
419         Reviewed by Michael Saboff.
420
421         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
422         (theParent):
423         (test1.base.getParentStaticValue):
424         (test1.base):
425         (test1.__v_24888.prototype.set prop):
426         (test1.__v_24888):
427         (test2.base.getParentStaticValue):
428         (test2.base):
429         (test2.__v_24888.prototype.set prop):
430         (test2.__v_24888):
431         (test2):
432
433 2017-12-01  JF Bastien  <jfbastien@apple.com>
434
435         Try proxying all function arguments
436         https://bugs.webkit.org/show_bug.cgi?id=180306
437
438         Reviewed by Saam Barati.
439
440         * stress/proxy-all-the-parameters.js: Added.
441         (isPropertyOfType):
442         (getProperties):
443         (generateObjects):
444         (getObjects):
445         (getFunctions):
446         (get throw):
447         (let.o.of.getObjects.let.f.of.getFunctions.catch):
448
449 2017-12-01  JF Bastien  <jfbastien@apple.com>
450
451         JavaScriptCore: missing exception checks in Math functions that take more than one argument
452         https://bugs.webkit.org/show_bug.cgi?id=180297
453         <rdar://problem/35745556>
454
455         Reviewed by Mark Lam.
456
457         * stress/math-exceptions.js: Added.
458         (get try):
459         (catch):
460
461 2017-12-01  JF Bastien  <jfbastien@apple.com>
462
463         JavaScriptCore: add test for weird class static getters
464         https://bugs.webkit.org/show_bug.cgi?id=180281
465         <rdar://problem/35592139>
466
467         Reviewed by Mark Lam.
468
469         I fixed a bug for it in r224927 and didn't add a test. Do so.
470
471         * stress/class-static-get-weird.js: Added.
472         (c.prototype.get name):
473         (c):
474         (c.prototype.get arguments):
475         (c.prototype.get caller):
476         (c.prototype.get length):
477
478 2017-12-01  Saam Barati  <sbarati@apple.com>
479
480         Having a bad time needs to handle ArrayClass indexing type as well
481         https://bugs.webkit.org/show_bug.cgi?id=180274
482         <rdar://problem/35667869>
483
484         Reviewed by Keith Miller and Mark Lam.
485
486         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
487         (assert):
488         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
489         (assert):
490
491 2017-12-01  JF Bastien  <jfbastien@apple.com>
492
493         WebAssembly: restore cached stack limit after out-call
494         https://bugs.webkit.org/show_bug.cgi?id=179106
495         <rdar://problem/35337525>
496
497         Reviewed by Saam Barati.
498
499         * wasm/function-tests/double-instance.js: Added.
500         (const.imp.boom):
501         (const.imp.get callAnother):
502
503 2017-11-30  JF Bastien  <jfbastien@apple.com>
504
505         WebAssembly: improve stack trace
506         https://bugs.webkit.org/show_bug.cgi?id=179343
507
508         Reviewed by Saam Barati.
509
510         Update the tests to follow the new format. Notably, SHA1 module
511         hash is now included in traces, and stubs are properly identified.
512
513         * wasm/assert.js: Add an assertion which matches regular expressions.
514         * wasm/function-tests/nameSection.js:
515         * wasm/function-tests/stack-overflow.js:
516         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
517         (assertOverflows.assertThrows.wasm.1):
518         (assertOverflows.assertThrows.wasm.0):
519         (assertOverflows.assertThrows):
520         (assertOverflows):
521         * wasm/function-tests/stack-trace.js:
522         (import.Builder.from.string_appeared_here.assert): Deleted.
523         * wasm/function-tests/trap-after-cross-instance-call.js:
524         (wasmFrameCountFromError):
525         * wasm/function-tests/trap-load-2.js:
526         (wasmFrameCountFromError):
527         * wasm/function-tests/trap-load.js:
528         (wasmFrameCountFromError):
529
530 2017-11-30  Mark Lam  <mark.lam@apple.com>
531
532         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
533         https://bugs.webkit.org/show_bug.cgi?id=180219
534         <rdar://problem/35696536>
535
536         Reviewed by Filip Pizlo.
537
538         * stress/regress-180219.js: Added.
539
540 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
541
542         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
543         https://bugs.webkit.org/show_bug.cgi?id=180190
544
545         Reviewed by Mark Lam.
546
547         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
548         (shouldBe):
549         (test1):
550         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
551         (shouldBe):
552         (test1):
553         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
554         (shouldBe):
555         (test1):
556         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
557         (shouldBe):
558         (test1):
559         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
560         (shouldBe):
561         (test1):
562         * stress/operation-in-may-have-negative-int32.js: Added.
563         (shouldBe):
564         (test2):
565         * stress/operation-in-negative-int32-cast.js: Added.
566         (shouldBe):
567         (test1):
568
569 2017-11-28  JF Bastien  <jfbastien@apple.com>
570
571         Strict and sloppy functions shouldn't share structure
572         https://bugs.webkit.org/show_bug.cgi?id=180103
573         <rdar://problem/35667847>
574
575         Reviewed by Saam Barati.
576
577         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
578         because the IC was wrong.
579         (foo):
580         (bar):
581         (baz):
582         (catch):
583         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
584         in this patch, but may as well test odd strict mode corner cases.
585         (bar):
586         (baz):
587         (catch):
588         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
589         (foo):
590         (bar):
591         (baz):
592         (catch):
593         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
594         next file, but with invalidation of the FunctionExecutable's
595         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
596         slower path.
597         (foo):
598         (bar.const.x):
599         (bar.const.y):
600         (bar):
601         (catch):
602         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
603         strict nesting works correctly.
604         (foo):
605         (bar.baz):
606         (bar):
607         * stress/strict-function-structure.js: Added. The test used to
608         assert in objectProtoFuncHasOwnProperty.
609         (foo):
610         (bar):
611         (baz):
612         * stress/strict-nested-function-structure.js: Added. Nesting.
613         (foo):
614         (bar):
615         (baz.boo):
616         (baz):
617
618 2017-11-29  Robin Morisset  <rmorisset@apple.com>
619
620         The recursive tail call optimisation is wrong on closures
621         https://bugs.webkit.org/show_bug.cgi?id=179835
622
623         Reviewed by Saam Barati.
624
625         * stress/closure-recursive-tail-call.js: Added.
626         (makeClosure):
627
628 2017-11-27  JF Bastien  <jfbastien@apple.com>
629
630         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
631         https://bugs.webkit.org/show_bug.cgi?id=180051
632         <rdar://problem/35614371>
633
634         Reviewed by Saam Barati.
635
636         * stress/rest-parameter-negative.js: Added.
637         (__f_5484):
638         (catch):
639         (__f_5485):
640         (__v_22598.catch):
641
642 2017-11-27  Saam Barati  <sbarati@apple.com>
643
644         Spread can escape when CreateRest does not
645         https://bugs.webkit.org/show_bug.cgi?id=180057
646         <rdar://problem/35676119>
647
648         Reviewed by JF Bastien.
649
650         * stress/spread-escapes-but-create-rest-does-not.js: Added.
651         (assert):
652         (getProperties):
653         (theFunc):
654         (let.obj.valueOf):
655
656 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
657
658         [DFG] Add NormalizeMapKey DFG IR
659         https://bugs.webkit.org/show_bug.cgi?id=179912
660
661         Reviewed by Saam Barati.
662
663         * stress/map-untyped-normalize-cse.js: Added.
664         (shouldBe):
665         (test):
666         * stress/map-untyped-normalize.js: Added.
667         (shouldBe):
668         (test):
669         * stress/set-untyped-normalize-cse.js: Added.
670         (shouldBe):
671         (set return.set has.set has):
672         * stress/set-untyped-normalize.js: Added.
673         (shouldBe):
674         (set return.set has):
675
676 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
677
678         [FTL] Support DeleteById and DeleteByVal
679         https://bugs.webkit.org/show_bug.cgi?id=180022
680
681         Reviewed by Saam Barati.
682
683         * stress/delete-by-id.js: Added.
684         (shouldBe):
685         (test1):
686         (test2):
687         * stress/delete-by-val-ftl.js: Added.
688         (shouldBe):
689         (test1):
690         (test2):
691
692 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
693
694         [DFG] Introduce {Set,Map,WeakMap}Fields
695         https://bugs.webkit.org/show_bug.cgi?id=179925
696
697         Reviewed by Saam Barati.
698
699         * stress/map-set-clobber-map-get.js: Added.
700         (shouldBe):
701         (test):
702         * stress/map-set-does-not-clobber-set-has.js: Added.
703         (shouldBe):
704         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
705         (shouldBe):
706         (test):
707         * stress/set-add-clobber-set-has.js: Added.
708         (shouldBe):
709         * stress/set-add-does-not-clobber-map-get.js: Added.
710         (shouldBe):
711
712 2017-11-24  Mark Lam  <mark.lam@apple.com>
713
714         Move unsafe jsc shell test functions to the $vm object.
715         https://bugs.webkit.org/show_bug.cgi?id=179980
716
717         Reviewed by Yusuke Suzuki.
718
719         * controlFlowProfiler/driver/driver.js:
720         * controlFlowProfiler/execution-count.js:
721         * controlFlowProfiler/if-statement.js:
722         * controlFlowProfiler/loop-statements.js:
723         * controlFlowProfiler/switch-statements.js:
724         * controlFlowProfiler/test-jit.js:
725         * exceptionFuzz/3d-cube.js:
726         * exceptionFuzz/date-format-xparb.js:
727         * exceptionFuzz/earley-boyer.js:
728         * heapProfiler/basic-edges.js:
729         * heapProfiler/property-edge-types.js:
730         * microbenchmarks/try-get-by-id-basic.js:
731         * microbenchmarks/try-get-by-id-polymorphic.js:
732         * modules/namespace-object-try-get.js:
733         * stress/argument-count-bytecode.js:
734         * stress/argument-intrinsic-basic.js:
735         * stress/argument-intrinsic-inlining-use-caller-arg.js:
736         * stress/argument-intrinsic-inlining-with-result-escape.js:
737         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
738         * stress/argument-intrinsic-inlining-with-vararg.js:
739         * stress/argument-intrinsic-nested-inlining.js:
740         * stress/argument-intrinsic-not-convert-to-get-argument.js:
741         * stress/argument-intrinsic-with-stack-write.js:
742         * stress/arity-mismatch-get-argument.js:
743         * stress/array-message-passing.js:
744         * stress/array-push-with-force-exit.js:
745         * stress/check-dom-with-signature.js:
746         * stress/check-sub-class.js:
747         * stress/compare-eq-incomplete-profile.js:
748         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
749         * stress/do-eval-virtual-call-correctly.js:
750         * stress/dom-jit-with-poly-proto.js:
751         * stress/domjit-exception-ic.js:
752         * stress/domjit-exception.js:
753         * stress/domjit-getter-complex-with-incorrect-object.js:
754         * stress/domjit-getter-complex.js:
755         * stress/domjit-getter-poly.js:
756         * stress/domjit-getter-proto.js:
757         * stress/domjit-getter-super-poly.js:
758         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
759         * stress/domjit-getter-type-check.js:
760         * stress/domjit-getter.js:
761         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
762         * stress/for-in-proxy-target-changed-structure.js:
763         * stress/for-in-proxy.js:
764         * stress/generational-opaque-roots.js:
765         * stress/global-const-redeclaration-setting-2.js:
766         * stress/global-const-redeclaration-setting-3.js:
767         * stress/global-const-redeclaration-setting-4.js:
768         * stress/global-const-redeclaration-setting-5.js:
769         * stress/global-const-redeclaration-setting.js:
770         * stress/import-basic.js:
771         * stress/import-from-eval.js:
772         * stress/import-reject-with-exception.js:
773         * stress/import-syntax.js:
774         * stress/impure-get-own-property-slot-inline-cache.js:
775         * stress/is-constructor.js:
776         * stress/istypedarrayview-intrinsic.js:
777         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
778         * stress/jsc-test-functions-should-be-more-robust.js:
779         * stress/object-toString-with-proxy.js:
780         * stress/poly-proto-custom-value-and-accessor.js:
781         * stress/proxy-inline-cache.js:
782         * stress/re-execute-error-module.js:
783         * stress/regress-150532.js:
784         * stress/regress-156992.js:
785         * stress/regress-179619.js:
786         * stress/resources/shadow-chicken-support.js:
787         * stress/runtime-array.js:
788         * stress/sampling-profiler-microtasks.js:
789         * stress/shadow-chicken-enabled.js:
790         * stress/spread-correct-global-object-on-exception.js:
791         * stress/super-get-by-id.js:
792         * stress/tailCallForwardArguments.js:
793         * stress/to-object-intrinsic-boolean-edge.js:
794         * stress/to-object-intrinsic-null-or-undefined-edge.js:
795         * stress/to-object-intrinsic-number-edge.js:
796         * stress/to-object-intrinsic-object-edge.js:
797         * stress/to-object-intrinsic-string-edge.js:
798         * stress/to-object-intrinsic-symbol-edge.js:
799         * stress/to-object-intrinsic.js:
800         * stress/try-catch-custom-getter-as-get-by-id.js:
801         * stress/try-get-by-id-poly-proto.js:
802         * stress/try-get-by-id-should-spill-registers-dfg.js:
803         * stress/try-get-by-id.js:
804         * typeProfiler/arrow-functions.js:
805         * typeProfiler/basic.js:
806         * typeProfiler/captured.js:
807         * typeProfiler/classes.js:
808         * typeProfiler/dfg-jit-optimizations.js:
809         * typeProfiler/dictionary-mode.js:
810         * typeProfiler/es6-block-scoping.js:
811         * typeProfiler/es6-classes.js:
812         * typeProfiler/inheritance.js:
813         * typeProfiler/int52-dfg.js:
814         * typeProfiler/loop.js:
815         * typeProfiler/optional-fields.js:
816         * typeProfiler/overflow.js:
817         * typeProfiler/return.js:
818         * typeProfiler/symbol.js:
819         * typeProfiler/weird-prototype-chain.js:
820
821 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
822
823         [DFG][FTL] Support MapSet / SetAdd intrinsics
824         https://bugs.webkit.org/show_bug.cgi?id=179858
825
826         Reviewed by Saam Barati.
827
828         * microbenchmarks/map-has-and-set.js: Added.
829         (test):
830         * stress/map-set-check-failure.js: Added.
831         (shouldBe):
832         (shouldThrow):
833         (target):
834         * stress/map-set-cse.js: Added.
835         (shouldBe):
836         (test):
837         * stress/set-add-check-failure.js: Added.
838         (shouldBe):
839         (shouldThrow):
840         (set shouldThrow):
841         * stress/set-add-cse.js: Added.
842         (shouldBe):
843
844 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
845
846         [JSC] Allow poly proto for intrinsic getters
847         https://bugs.webkit.org/show_bug.cgi?id=179550
848
849         Reviewed by Saam Barati.
850
851         This change is also tested by existing tests.
852
853             1. stress/intrinsic-getter-with-poly-proto.js
854             2. stress/poly-proto-intrinsic-getter-correctness.js
855
856         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
857         (shouldBe):
858         (makePolyProtoObject.foo.C):
859         (makePolyProtoObject.foo):
860         (makePolyProtoObject):
861         (target):
862         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
863         (shouldBe):
864         (makePolyProtoObject.foo.C):
865         (makePolyProtoObject.foo):
866         (makePolyProtoObject):
867         (target):
868
869 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
870
871         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
872         https://bugs.webkit.org/show_bug.cgi?id=179744
873
874         Reviewed by Michael Catanzaro.
875
876         This test uses too much memory for our buildbots on these platforms
877         and gets OOM-killed.
878
879         * stress/unshiftCountSlowCase-correct-postCapacity.js:
880         Skip if $memoryLimited and linux.
881
882 2017-11-17  JF Bastien  <jfbastien@apple.com>
883
884         WebAssembly JS API: throw when a promise can't be created
885         https://bugs.webkit.org/show_bug.cgi?id=179826
886         <rdar://problem/35455813>
887
888         Reviewed by Mark Lam.
889
890         Test WebAssembly.{compile,instantiate} where promise creation
891         fails because of a stack overflow.
892
893         * wasm/js-api/promise-stack-overflow.js: Added.
894         (const.runNearStackLimit.f.const.t):
895         (async.testCompile):
896         (async.testInstantiate):
897
898 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
899
900         Unreviewed, mark regress-178385.js as memory exhausting
901
902         * stress/regress-178385.js:
903
904 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
905
906         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
907
908         Unreviewed test gardening.
909
910         * test262.yaml:
911
912 2017-11-16  Robin Morisset  <rmorisset@apple.com>
913
914         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
915         https://bugs.webkit.org/show_bug.cgi?id=179763
916         <rdar://problem/35550513>
917
918         Reviewed by Keith Miller.
919
920         Just adding a slightly cleaned-up version of the original fuzzer-found test.
921
922         * stress/tdz-this-in-try-catch.js: Added.
923         (__v_6388):
924         (__v_6392):
925
926 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
927
928         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
929         https://bugs.webkit.org/show_bug.cgi?id=179594
930
931         Reviewed by Saam Barati.
932
933         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
934         (shouldBe):
935         (args):
936         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
937         (shouldBe):
938         (args):
939
940 2017-11-14  Saam Barati  <sbarati@apple.com>
941
942         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
943         https://bugs.webkit.org/show_bug.cgi?id=179639
944         <rdar://problem/35513018>
945
946         Reviewed by JF Bastien.
947
948         * wasm/function-tests/grow-memory-cause-gc.js: Added.
949         (escape):
950         (i.func):
951
952 2017-11-13  Mark Lam  <mark.lam@apple.com>
953
954         Add more overflow check book-keeping for MarkedArgumentBuffer.
955         https://bugs.webkit.org/show_bug.cgi?id=179634
956         <rdar://problem/35492517>
957
958         Reviewed by Saam Barati.
959
960         * stress/regress-179634.js: Added.
961
962 2017-11-13  Mark Lam  <mark.lam@apple.com>
963
964         Make the jsc shell loadGetterFromGetterSetter() function more robust.
965         https://bugs.webkit.org/show_bug.cgi?id=179619
966         <rdar://problem/35492518>
967
968         Reviewed by Saam Barati.
969
970         * stress/regress-179619.js: Added.
971
972 2017-11-12  Mark Lam  <mark.lam@apple.com>
973
974         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
975         https://bugs.webkit.org/show_bug.cgi?id=179562
976         <rdar://problem/35467022>
977
978         Reviewed by Saam Barati.
979
980         * regress-179562.js: Added.
981
982 2017-11-08  Saam Barati  <sbarati@apple.com>
983
984         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
985         https://bugs.webkit.org/show_bug.cgi?id=177792
986
987         Reviewed by Yusuke Suzuki.
988
989         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
990         (assert):
991         (foo.Foo.prototype.ensureX):
992         (foo.Foo):
993         (foo):
994         (access):
995
996 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
997
998         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
999         https://bugs.webkit.org/show_bug.cgi?id=178592
1000
1001         Unreviewed test gardening.
1002
1003         * test262.yaml:
1004
1005 2017-11-08  Robin Morisset  <rmorisset@apple.com>
1006
1007         Turn recursive tail calls into loops
1008         https://bugs.webkit.org/show_bug.cgi?id=176601
1009
1010         Reviewed by Saam Barati.
1011
1012         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
1013
1014         Add some simple test that computes factorial in several ways, and other trivial computations.
1015         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1016         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1017         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1018         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1019
1020         * stress/inline-call-to-recursive-tail-call.js: Added.
1021         (factorial.aux):
1022         (factorial):
1023         (factorial2.aux2):
1024         (factorial2.id):
1025         (factorial2):
1026         (factorial3.aux3):
1027         (factorial3):
1028         (aux4):
1029         (factorial4):
1030         (foo):
1031         (auxBar):
1032         (bar):
1033         (test):
1034
1035 2017-11-07  Mark Lam  <mark.lam@apple.com>
1036
1037         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
1038         https://bugs.webkit.org/show_bug.cgi?id=179355
1039         <rdar://problem/35263053>
1040
1041         Reviewed by Saam Barati.
1042
1043         * stress/regress-179355.js: Added.
1044
1045 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1046
1047         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
1048         https://bugs.webkit.org/show_bug.cgi?id=144458
1049
1050         Reviewed by Saam Barati.
1051
1052         * microbenchmarks/dfg-internal-function-call.js: Added.
1053         (target):
1054         * microbenchmarks/dfg-internal-function-construct.js: Added.
1055         (target):
1056         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
1057         (target):
1058         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
1059         (target):
1060         * stress/dfg-internal-function-call.js: Added.
1061         (shouldBe):
1062         (target):
1063         * stress/dfg-internal-function-construct.js: Added.
1064         (shouldBe):
1065         (target):
1066         * stress/internal-function-call.js: Added.
1067         (shouldBe):
1068         * stress/internal-function-construct.js: Added.
1069         (shouldBe):
1070
1071 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
1072
1073         [Win] Skip stress/regress-178385.js.
1074         https://bugs.webkit.org/show_bug.cgi?id=179298
1075
1076         Unreviewed test gardening.
1077
1078         * stress/regress-178385.js:
1079
1080 2017-11-03  Keith Miller  <keith_miller@apple.com>
1081
1082         Add test for ic with side effects
1083         https://bugs.webkit.org/show_bug.cgi?id=179268
1084
1085         Reviewed by Saam Barati.
1086
1087         * stress/put-inline-cache-side-effects.js: Added.
1088         (let.i.of.objs.keys):
1089         (f):
1090
1091 2017-11-03  Mark Lam  <mark.lam@apple.com>
1092
1093         CachedCall (and its clients) needs overflow checks.
1094         https://bugs.webkit.org/show_bug.cgi?id=179185
1095
1096         Reviewed by JF Bastien.
1097
1098         * stress/regress-179185.js: Added.
1099
1100 2017-11-02  Michael Saboff  <msaboff@apple.com>
1101
1102         DFG needs to handle code motion of code in for..in loop bodies
1103         https://bugs.webkit.org/show_bug.cgi?id=179212
1104
1105         Reviewed by Keith Miller.
1106
1107         New regression test.
1108
1109         * stress/for-in-side-effects.js: Added.
1110         (getPrototypeOf):
1111         (reset):
1112         (testWithoutFTL.f):
1113         (testWithoutFTL):
1114         (testWithFTL.f):
1115         (testWithFTL):
1116
1117 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
1118
1119         AI does not correctly model the clobber case of ArithClz32
1120         https://bugs.webkit.org/show_bug.cgi?id=179188
1121
1122         Reviewed by Michael Saboff.
1123
1124         * stress/arith-clz32-effects.js: Added.
1125         (foo):
1126         (valueOf):
1127
1128 2017-11-01  Michael Saboff  <msaboff@apple.com>
1129
1130         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
1131         https://bugs.webkit.org/show_bug.cgi?id=179140
1132
1133         Reviewed by Saam Barati.
1134
1135         New regression test.
1136
1137         * stress/regress-179140.js: Added.
1138         (testWithoutFTL):
1139         (testWithFTL):
1140
1141 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1142
1143         [JSC] Introduce @toObject
1144         https://bugs.webkit.org/show_bug.cgi?id=178726
1145
1146         Reviewed by Saam Barati.
1147
1148         * stress/array-copywithin.js:
1149         (shouldThrow):
1150         * stress/object-constructor-boolean-edge.js: Added.
1151         (shouldBe):
1152         (test):
1153         * stress/object-constructor-global.js: Added.
1154         (shouldBe):
1155         * stress/object-constructor-null-edge.js: Added.
1156         (shouldBe):
1157         (test):
1158         * stress/object-constructor-number-edge.js: Added.
1159         (shouldBe):
1160         (test):
1161         * stress/object-constructor-object-edge.js: Added.
1162         (shouldBe):
1163         (test):
1164         (i.arg):
1165         * stress/object-constructor-string-edge.js: Added.
1166         (shouldBe):
1167         (test):
1168         * stress/object-constructor-symbol-edge.js: Added.
1169         (shouldBe):
1170         (test):
1171         * stress/object-constructor-undefined-edge.js: Added.
1172         (shouldBe):
1173         (test):
1174         * stress/symbol-array-from.js: Added.
1175         (shouldBe):
1176         * stress/to-object-intrinsic-boolean-edge.js: Added.
1177         (shouldBe):
1178         (builtin.createBuiltin):
1179         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
1180         (shouldThrow):
1181         * stress/to-object-intrinsic-number-edge.js: Added.
1182         (shouldBe):
1183         (builtin.createBuiltin):
1184         * stress/to-object-intrinsic-object-edge.js: Added.
1185         (shouldBe):
1186         (builtin.createBuiltin):
1187         (i.arg):
1188         * stress/to-object-intrinsic-string-edge.js: Added.
1189         (shouldBe):
1190         (builtin.createBuiltin):
1191         * stress/to-object-intrinsic-symbol-edge.js: Added.
1192         (shouldBe):
1193         (builtin.createBuiltin):
1194         * stress/to-object-intrinsic.js: Added.
1195         (shouldBe):
1196         (shouldThrow):
1197         (builtin.createBuiltin):
1198
1199 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1200
1201         [DFG][FTL] Introduce StringSlice
1202         https://bugs.webkit.org/show_bug.cgi?id=178934
1203
1204         Reviewed by Saam Barati.
1205
1206         * microbenchmarks/string-slice-empty.js: Added.
1207         (slice):
1208         * microbenchmarks/string-slice-one-char.js: Added.
1209         (slice):
1210         * microbenchmarks/string-slice.js: Added.
1211         (slice):
1212
1213 2017-10-26  Michael Saboff  <msaboff@apple.com>
1214
1215         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
1216         https://bugs.webkit.org/show_bug.cgi?id=178890
1217
1218         Reviewed by Keith Miller.
1219
1220         New regression test.
1221
1222         * stress/regress-178890.js: Added.
1223
1224 2017-10-26  Mark Lam  <mark.lam@apple.com>
1225
1226         JSRopeString::RopeBuilder::append() should check for overflows.
1227         https://bugs.webkit.org/show_bug.cgi?id=178385
1228         <rdar://problem/35027468>
1229
1230         Reviewed by Saam Barati.
1231
1232         * stress/regress-178385.js: Added.
1233
1234 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
1235
1236         Unreviewed, rolling out r223961.
1237
1238         The change that required this has been rolled out.
1239
1240         Reverted changeset:
1241
1242         "Mark test262.yaml/test262/test/language/statements/try/tco-
1243         catch.js as passing."
1244         https://bugs.webkit.org/show_bug.cgi?id=178592
1245         https://trac.webkit.org/changeset/223961
1246
1247 2017-10-25  Commit Queue  <commit-queue@webkit.org>
1248
1249         Unreviewed, rolling out r223691 and r223729.
1250         https://bugs.webkit.org/show_bug.cgi?id=178834
1251
1252         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
1253         by rniwa on #webkit).
1254
1255         Reverted changesets:
1256
1257         "Turn recursive tail calls into loops"
1258         https://bugs.webkit.org/show_bug.cgi?id=176601
1259         https://trac.webkit.org/changeset/223691
1260
1261         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
1262         comparison is always false due to limited range of data type
1263         [-Wtype-limits]"
1264         https://bugs.webkit.org/show_bug.cgi?id=178543
1265         https://trac.webkit.org/changeset/223729
1266
1267 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
1268
1269         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
1270         https://bugs.webkit.org/show_bug.cgi?id=178592
1271
1272         Unreviewed test gardening.
1273
1274         * test262.yaml:
1275
1276 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1277
1278         [FTL] Support NewStringObject
1279         https://bugs.webkit.org/show_bug.cgi?id=178737
1280
1281         Reviewed by Saam Barati.
1282
1283         * stress/new-string-object.js: Added.
1284         (shouldBe):
1285         (test):
1286
1287 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1288
1289         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
1290         https://bugs.webkit.org/show_bug.cgi?id=178308
1291
1292         Reviewed by Mark Lam.
1293
1294         * test262.yaml:
1295
1296 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1297
1298         [JSC] Use fastJoin in Array#toString
1299         https://bugs.webkit.org/show_bug.cgi?id=178062
1300
1301         Reviewed by Darin Adler.
1302
1303         * microbenchmarks/contiguous-array-to-string.js: Added.
1304         (target):
1305         * microbenchmarks/double-array-to-string.js: Added.
1306         (target):
1307         * microbenchmarks/int32-array-to-string.js: Added.
1308         (target):
1309
1310 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
1311
1312         stress/check-string-ident.js is improperly skipped
1313         https://bugs.webkit.org/show_bug.cgi?id=178642
1314
1315         Reviewed by Saam Barati.
1316
1317         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
1318         since it enforces the run-jsc-stress-tests script to still set up the
1319         test to run, despite the skip directive that's used before.
1320
1321 2017-10-20  Mark Lam  <mark.lam@apple.com>
1322
1323         Add a test case for r214334.
1324         https://bugs.webkit.org/show_bug.cgi?id=169941
1325         <rdar://problem/31221258>
1326
1327         Reviewed by JF Bastien.
1328
1329         * stress/regress-169941.js: Added.
1330
1331 2017-10-19  JF Bastien  <jfbastien@apple.com>
1332
1333         WebAssembly: no VM / JS version of everything but Instance
1334         https://bugs.webkit.org/show_bug.cgi?id=177473
1335
1336         Reviewed by Filip Pizlo, Saam Barati.
1337
1338         - Exceeding max on memory growth now returns a range error as per
1339         spec. This is a (very minor) breaking change: it used to throw OOM
1340         error. Update the corresponding test.
1341
1342         * wasm/js-api/memory-grow.js:
1343         (assertEq):
1344         * wasm/js-api/table.js:
1345         (assert.throws):
1346
1347 2017-10-19  Mark Lam  <mark.lam@apple.com>
1348
1349         Stringifier::appendStringifiedValue() is missing an exception check.
1350         https://bugs.webkit.org/show_bug.cgi?id=178386
1351         <rdar://problem/35027610>
1352
1353         Reviewed by Saam Barati.
1354
1355         * stress/regress-178386.js: Added.
1356
1357 2017-10-19  Michael Saboff  <msaboff@apple.com>
1358
1359         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
1360         https://bugs.webkit.org/show_bug.cgi?id=178521
1361
1362         Reviewed by JF Bastien.
1363
1364         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
1365         now passes with the current version (5.0) of the Emoji spec.
1366
1367 2017-10-19  Robin Morisset  <rmorisset@apple.com>
1368
1369         Turn recursive tail calls into loops
1370         https://bugs.webkit.org/show_bug.cgi?id=176601
1371
1372         Reviewed by Saam Barati.
1373
1374         Add some simple test that computes factorial in several ways, and other trivial computations.
1375         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
1376         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
1377         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
1378         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
1379
1380         * stress/inline-call-to-recursive-tail-call.js: Added.
1381         (factorial.aux):
1382         (factorial):
1383         (factorial2.aux):
1384         (factorial2.id):
1385         (factorial2):
1386         (factorial3.aux):
1387         (factorial3):
1388         (aux):
1389         (factorial4):
1390         (test):
1391
1392 2017-10-18  Mark Lam  <mark.lam@apple.com>
1393
1394         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
1395         https://bugs.webkit.org/show_bug.cgi?id=177600
1396         <rdar://problem/34710985>
1397
1398         Reviewed by Saam Barati.
1399
1400         * stress/regress-177600.js: Added.
1401
1402 2017-10-18  Mark Lam  <mark.lam@apple.com>
1403
1404         The compiler should always register a structure when it adds its transitionWatchPointSet.
1405         https://bugs.webkit.org/show_bug.cgi?id=178420
1406         <rdar://problem/34814024>
1407
1408         Reviewed by Saam Barati and Filip Pizlo.
1409
1410         * stress/regress-178420.js: Added.
1411         (new.Array.10000.map):
1412
1413 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1414
1415         [JSC] __proto__ getter should be fast
1416         https://bugs.webkit.org/show_bug.cgi?id=178067
1417
1418         Reviewed by Saam Barati.
1419
1420         * stress/dfg-object-proto-accessor.js: Added.
1421         (shouldBe):
1422         (shouldThrow):
1423         (target):
1424         * stress/dfg-object-proto-getter.js: Added.
1425         (shouldBe):
1426         (shouldThrow):
1427         (target):
1428         * stress/dfg-object-prototype-of.js: Added.
1429         (shouldBe):
1430         (shouldThrow):
1431         (target):
1432         * stress/dfg-reflect-get-prototype-of.js: Added.
1433         (shouldBe):
1434         (shouldThrow):
1435         (target):
1436         * stress/intrinsic-getter-with-poly-proto.js: Added.
1437         (shouldBe):
1438         (makePolyProtoObject.foo.C):
1439         (makePolyProtoObject.foo):
1440         (makePolyProtoObject):
1441         (target):
1442         * stress/object-get-prototype-of-filtered.js: Added.
1443         (shouldBe):
1444         (shouldThrow):
1445         (target):
1446         (i.Cocoa):
1447         * stress/object-get-prototype-of-mono-proto.js: Added.
1448         (shouldBe):
1449         (makePolyProtoObject.foo.C):
1450         (makePolyProtoObject.foo):
1451         (makePolyProtoObject):
1452         (target):
1453         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1454         (shouldBe):
1455         (makePolyProtoObject.foo.C):
1456         (makePolyProtoObject.foo):
1457         (makePolyProtoObject):
1458         (target):
1459         * stress/object-get-prototype-of-poly-proto.js: Added.
1460         (shouldBe):
1461         (makePolyProtoObject.foo.C):
1462         (makePolyProtoObject.foo):
1463         (makePolyProtoObject):
1464         (target):
1465         * stress/object-proto-getter-filtered.js: Added.
1466         (shouldBe):
1467         (shouldThrow):
1468         (target):
1469         (i.Cocoa):
1470         * stress/object-proto-getter-poly-mono-proto.js: Added.
1471         (shouldBe):
1472         (makePolyProtoObject.foo.C):
1473         (makePolyProtoObject.foo):
1474         (makePolyProtoObject):
1475         (target):
1476         * stress/object-proto-getter-poly-proto.js: Added.
1477         (shouldBe):
1478         (makePolyProtoObject.foo.C):
1479         (makePolyProtoObject.foo):
1480         (makePolyProtoObject):
1481         (target):
1482         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1483         * stress/string-proto.js: Added.
1484         (shouldBe):
1485         (target):
1486
1487 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
1488
1489         Unreviewed, rolling out r223523.
1490
1491         A test for this change is failing on debug JSC bots.
1492
1493         Reverted changeset:
1494
1495         "[JSC] __proto__ getter should be fast"
1496         https://bugs.webkit.org/show_bug.cgi?id=178067
1497         https://trac.webkit.org/changeset/223523
1498
1499 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1500
1501         [JSC] __proto__ getter should be fast
1502         https://bugs.webkit.org/show_bug.cgi?id=178067
1503
1504         Reviewed by Saam Barati.
1505
1506         * stress/dfg-object-proto-accessor.js: Added.
1507         (shouldBe):
1508         (shouldThrow):
1509         (target):
1510         * stress/dfg-object-proto-getter.js: Added.
1511         (shouldBe):
1512         (shouldThrow):
1513         (target):
1514         * stress/dfg-object-prototype-of.js: Added.
1515         (shouldBe):
1516         (shouldThrow):
1517         (target):
1518         * stress/dfg-reflect-get-prototype-of.js: Added.
1519         (shouldBe):
1520         (shouldThrow):
1521         (target):
1522         * stress/object-get-prototype-of-filtered.js: Added.
1523         (shouldBe):
1524         (shouldThrow):
1525         (target):
1526         (i.Cocoa):
1527         * stress/object-get-prototype-of-mono-proto.js: Added.
1528         (shouldBe):
1529         (makePolyProtoObject.foo.C):
1530         (makePolyProtoObject.foo):
1531         (makePolyProtoObject):
1532         (target):
1533         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
1534         (shouldBe):
1535         (makePolyProtoObject.foo.C):
1536         (makePolyProtoObject.foo):
1537         (makePolyProtoObject):
1538         (target):
1539         * stress/object-get-prototype-of-poly-proto.js: Added.
1540         (shouldBe):
1541         (makePolyProtoObject.foo.C):
1542         (makePolyProtoObject.foo):
1543         (makePolyProtoObject):
1544         (target):
1545         * stress/object-proto-getter-filtered.js: Added.
1546         (shouldBe):
1547         (shouldThrow):
1548         (target):
1549         (i.Cocoa):
1550         * stress/object-proto-getter-poly-mono-proto.js: Added.
1551         (shouldBe):
1552         (makePolyProtoObject.foo.C):
1553         (makePolyProtoObject.foo):
1554         (makePolyProtoObject):
1555         (target):
1556         * stress/object-proto-getter-poly-proto.js: Added.
1557         (shouldBe):
1558         (makePolyProtoObject.foo.C):
1559         (makePolyProtoObject.foo):
1560         (makePolyProtoObject):
1561         (target):
1562         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
1563         * stress/string-proto.js: Added.
1564         (shouldBe):
1565         (target):
1566
1567 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1568
1569         Reland "Add Above/Below comparisons for UInt32 patterns"
1570         https://bugs.webkit.org/show_bug.cgi?id=177281
1571
1572         Reviewed by Saam Barati.
1573
1574         * stress/uint32-comparison-jump.js: Added.
1575         (shouldBe):
1576         (above):
1577         (aboveOrEqual):
1578         (below):
1579         (belowOrEqual):
1580         (notAbove):
1581         (notAboveOrEqual):
1582         (notBelow):
1583         (notBelowOrEqual):
1584         * stress/uint32-comparison.js: Added.
1585         (shouldBe):
1586         (above):
1587         (aboveOrEqual):
1588         (below):
1589         (belowOrEqual):
1590         (aboveTest):
1591         (aboveOrEqualTest):
1592         (belowTest):
1593         (belowOrEqualTest):
1594
1595 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1596
1597         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
1598         https://bugs.webkit.org/show_bug.cgi?id=178210
1599
1600         Reviewed by Saam Barati.
1601
1602         * wasm/function-tests/trap-from-start-async.js:
1603         (async.StartTrapsAsync):
1604         * wasm/function-tests/trap-from-start.js:
1605         (StartTraps):
1606         * wasm/js-api/web-assembly-function.js:
1607         (assert.eq.Object.getPrototypeOf):
1608         * wasm/js-api/wrapper-function.js:
1609         (return.new.WebAssembly.Module):
1610         (assert.throws.makeInstance): Deleted.
1611         (assert.throws.Bar): Deleted.
1612         (assert.throws): Deleted.
1613
1614 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1615
1616         Enable gigacage on iOS
1617         https://bugs.webkit.org/show_bug.cgi?id=177586
1618
1619         Reviewed by JF Bastien.
1620         
1621         Add tests for when Gigacage gets runtime disabled.
1622
1623         * stress/disable-gigacage-arrays.js: Added.
1624         (foo):
1625         * stress/disable-gigacage-strings.js: Added.
1626         (foo):
1627         * stress/disable-gigacage-typed-arrays.js: Added.
1628         (foo):
1629
1630 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1631
1632         import.meta should not be assignable
1633         https://bugs.webkit.org/show_bug.cgi?id=178202
1634
1635         Reviewed by Saam Barati.
1636
1637         * modules/import-meta-assignment.js: Added.
1638         (shouldThrow):
1639         (SyntaxError.import.meta.can.shouldThrow):
1640
1641 2017-10-11  Saam Barati  <sbarati@apple.com>
1642
1643         Unreviewed. Actually skip certain type profiler tests in debug.
1644
1645         * typeProfiler.yaml:
1646         * typeProfiler/deltablue-for-of.js:
1647         * typeProfiler/getter-richards.js:
1648
1649 2017-10-11  Commit Queue  <commit-queue@webkit.org>
1650
1651         Unreviewed, rolling out r223113 and r223121.
1652         https://bugs.webkit.org/show_bug.cgi?id=178182
1653
1654         Reintroduced 20% regression on Kraken (Requested by rniwa on
1655         #webkit).
1656
1657         Reverted changesets:
1658
1659         "Enable gigacage on iOS"
1660         https://bugs.webkit.org/show_bug.cgi?id=177586
1661         https://trac.webkit.org/changeset/223113
1662
1663         "Use one virtual allocation for all gigacages and their
1664         runways"
1665         https://bugs.webkit.org/show_bug.cgi?id=178050
1666         https://trac.webkit.org/changeset/223121
1667
1668 2017-10-11  Michael Saboff  <msaboff@apple.com>
1669
1670         Disable test262 named capture group tests with direct unicode names and with references before definitions
1671         https://bugs.webkit.org/show_bug.cgi?id=178177
1672
1673         Reviewed by Keith Miller.
1674
1675         Bugs to track fixing these test are:
1676         https://bugs.webkit.org/show_bug.cgi?id=178174 -
1677             "Add support in named capture group identifiers for direct surrogate pairs"
1678         https://bugs.webkit.org/show_bug.cgi?id=178175 -
1679             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
1680
1681         * test262.yaml:
1682
1683 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
1684
1685         Object properties are undefined in super.call() but not in this.call()
1686         https://bugs.webkit.org/show_bug.cgi?id=177230
1687
1688         Reviewed by Saam Barati.
1689
1690         * stress/super-call-function-subclass.js: Added.
1691         (assert):
1692         (A.prototype.t):
1693         (A):
1694         * stress/super-dot-call-and-apply.js: Added.
1695         (assert):
1696         (A):
1697         (A.prototype.call):
1698         (A.prototype.apply):
1699         (B.prototype.testSuper):
1700         (B):
1701         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
1702         (D.prototype.testSuper):
1703         (D):
1704
1705 2017-10-10  Saam Barati  <sbarati@apple.com>
1706
1707         The prototype cache should be aware of the Executable it generates a Structure for
1708         https://bugs.webkit.org/show_bug.cgi?id=177907
1709
1710         Reviewed by Filip Pizlo.
1711
1712         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
1713         (assert):
1714         (foo.C):
1715         (foo):
1716         (bar.C):
1717         (bar):
1718         (access):
1719         (makeLongChain):
1720         (accessY):
1721
1722 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1723
1724         `async` should be able to be used as an imported binding name
1725         https://bugs.webkit.org/show_bug.cgi?id=176573
1726
1727         Reviewed by Saam Barati.
1728
1729         * modules/import-default-async.js: Added.
1730         * modules/import-named-async-as.js: Added.
1731         * modules/import-named-async.js: Added.
1732         * modules/import-named-async/target.js: Added.
1733         * modules/import-namespace-async.js: Added.
1734         * test262.yaml:
1735
1736 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1737
1738         Enable gigacage on iOS
1739         https://bugs.webkit.org/show_bug.cgi?id=177586
1740
1741         Reviewed by JF Bastien.
1742         
1743         Add tests for when Gigacage gets runtime disabled.
1744
1745         * stress/disable-gigacage-arrays.js: Added.
1746         (foo):
1747         * stress/disable-gigacage-strings.js: Added.
1748         (foo):
1749         * stress/disable-gigacage-typed-arrays.js: Added.
1750         (foo):
1751
1752 2017-10-09  Michael Saboff  <msaboff@apple.com>
1753
1754         Implement RegExp Unicode property escapes
1755         https://bugs.webkit.org/show_bug.cgi?id=172069
1756
1757         Reviewed by JF Bastien.
1758
1759         Enabled Unicode Property tests.
1760
1761         * test262.yaml:
1762
1763 2017-10-09  Commit Queue  <commit-queue@webkit.org>
1764
1765         Unreviewed, rolling out r223015 and r223025.
1766         https://bugs.webkit.org/show_bug.cgi?id=178093
1767
1768         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
1769         #webkit).
1770
1771         Reverted changesets:
1772
1773         "Enable gigacage on iOS"
1774         https://bugs.webkit.org/show_bug.cgi?id=177586
1775         http://trac.webkit.org/changeset/223015
1776
1777         "Unreviewed, disable Gigacage on ARM64 Linux"
1778         https://bugs.webkit.org/show_bug.cgi?id=177586
1779         http://trac.webkit.org/changeset/223025
1780
1781 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1782
1783         Update expectations for test262 tests that pass after r223043.
1784         https://bugs.webkit.org/show_bug.cgi?id=176685
1785
1786         Unreviewed test gardening.
1787
1788         * test262.yaml:
1789
1790 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
1791
1792         Unreviewed, rolling out r223022.
1793
1794         This change introduced 18 test262 failures.
1795
1796         Reverted changeset:
1797
1798         "`async` should be able to be used as an imported binding
1799         name"
1800         https://bugs.webkit.org/show_bug.cgi?id=176573
1801         http://trac.webkit.org/changeset/223022
1802
1803 2017-10-09  Saam Barati  <sbarati@apple.com>
1804
1805         3 poly-proto JSC tests timing out on debug after r222827
1806         https://bugs.webkit.org/show_bug.cgi?id=177880
1807         <rdar://problem/34817122>
1808
1809         Unreviewed.
1810
1811         I'm skipping these type profiler tests on debug since they are long running.
1812
1813         * typeProfiler/deltablue-for-of.js:
1814         * typeProfiler/getter-richards.js:
1815
1816 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1817
1818         Safari 10 /11 problem with if (!await get(something)).
1819         https://bugs.webkit.org/show_bug.cgi?id=176685
1820
1821         Reviewed by Saam Barati.
1822
1823         * stress/async-await-basic.js:
1824         (awaitEpression.async):
1825         * stress/async-await-syntax.js:
1826         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1827         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1828
1829 2017-10-08  Saam Barati  <sbarati@apple.com>
1830
1831         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1832
1833         * typeProfiler/deltablue-for-of.js:
1834         * typeProfiler/getter-richards.js:
1835
1836 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1837
1838         `async` should be able to be used as an imported binding name
1839         https://bugs.webkit.org/show_bug.cgi?id=176573
1840
1841         Reviewed by Darin Adler.
1842
1843         * modules/import-default-async.js: Added.
1844         * modules/import-named-async-as.js: Added.
1845         * modules/import-named-async.js: Added.
1846         * modules/import-named-async/target.js: Added.
1847         * modules/import-namespace-async.js: Added.
1848
1849 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1850
1851         Enable gigacage on iOS
1852         https://bugs.webkit.org/show_bug.cgi?id=177586
1853
1854         Reviewed by JF Bastien.
1855         
1856         Add tests for when Gigacage gets runtime disabled.
1857
1858         * stress/disable-gigacage-arrays.js: Added.
1859         (foo):
1860         * stress/disable-gigacage-strings.js: Added.
1861         (foo):
1862         * stress/disable-gigacage-typed-arrays.js: Added.
1863         (foo):
1864
1865 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1866
1867         Unreviewed, rolling out r222791 and r222873.
1868         https://bugs.webkit.org/show_bug.cgi?id=178031
1869
1870         Caused crashes with workers/wasm LayoutTests (Requested by
1871         ryanhaddad on #webkit).
1872
1873         Reverted changesets:
1874
1875         "WebAssembly: no VM / JS version of everything but Instance"
1876         https://bugs.webkit.org/show_bug.cgi?id=177473
1877         http://trac.webkit.org/changeset/222791
1878
1879         "WebAssembly: address no VM / JS follow-ups"
1880         https://bugs.webkit.org/show_bug.cgi?id=177887
1881         http://trac.webkit.org/changeset/222873
1882
1883 2017-10-05  Saam Barati  <sbarati@apple.com>
1884
1885         Make sure all prototypes under poly proto get added into the VM's prototype map
1886         https://bugs.webkit.org/show_bug.cgi?id=177909
1887
1888         Reviewed by Keith Miller.
1889
1890         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1891         (assert):
1892         (foo.C):
1893         (foo):
1894         (set x):
1895
1896 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1897
1898         [JSC] Introduce import.meta
1899         https://bugs.webkit.org/show_bug.cgi?id=177703
1900
1901         Reviewed by Filip Pizlo.
1902
1903         * modules/import-meta-syntax.js: Added.
1904         (shouldThrow):
1905         (shouldNotThrow):
1906         * modules/import-meta.js: Added.
1907         * modules/import-meta/cocoa.js: Added.
1908         * modules/resources/assert.js:
1909         (export.shouldNotThrow):
1910         * stress/import-syntax.js:
1911
1912 2017-10-04  Saam Barati  <sbarati@apple.com>
1913
1914         Make pertinent AccessCases watch the poly proto watchpoint
1915         https://bugs.webkit.org/show_bug.cgi?id=177765
1916
1917         Reviewed by Keith Miller.
1918
1919         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1920         (assert):
1921         (foo.C):
1922         (foo):
1923         (validate):
1924         * stress/poly-proto-clear-stub.js: Added.
1925         (assert):
1926         (foo.C):
1927         (foo):
1928
1929 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1930
1931         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1932
1933         Unreviewed test gardening.
1934
1935         * test262.yaml:
1936
1937 2017-10-04  Saam Barati  <sbarati@apple.com>
1938
1939         3 poly-proto JSC tests timing out on debug after r222827
1940         https://bugs.webkit.org/show_bug.cgi?id=177880
1941
1942         Rubber stamped by Mark Lam.
1943
1944         * microbenchmarks/poly-proto-access.js:
1945         * typeProfiler/deltablue-for-of.js:
1946         * typeProfiler/getter-richards.js:
1947
1948 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1949
1950         Unreviewed, marking tco-catch.js as a failure after test262 update
1951         https://bugs.webkit.org/show_bug.cgi?id=177859
1952
1953         * test262.yaml:
1954
1955 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1956
1957         Unreviewed, marking one async iterator test262 test failed
1958         https://bugs.webkit.org/show_bug.cgi?id=177859
1959
1960         * test262.yaml:
1961
1962 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1963
1964         [Test262] Update Test262 to Oct 4 version
1965         https://bugs.webkit.org/show_bug.cgi?id=177859
1966
1967         Reviewed by Sam Weinig.
1968
1969         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1970         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1971
1972         * test262.yaml:
1973         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1974         (checkSequence):
1975         * test262/harness/typeCoercion.js:
1976         (testCoercibleToIndexZero):
1977         (testCoercibleToIndexOne):
1978         (testCoercibleToIndexFromIndex):
1979         (testNotCoercibleToIndex.testPrimitiveValue):
1980         (testNotCoercibleToInteger):
1981         (testCoercibleToBigIntZero.testPrimitiveValue):
1982         (testCoercibleToBigIntZero):
1983         (testCoercibleToBigIntOne.testPrimitiveValue):
1984         (testCoercibleToBigIntOne):
1985         (testPrimitiveValue):
1986         (testCoercibleToBigIntFromBigInt):
1987         (testNotCoercibleToBigInt.testPrimitiveValue):
1988         (testNotCoercibleToBigInt.testStringValue):
1989         (testNotCoercibleToBigInt):
1990         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1991         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1992         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1993         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1994         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1995         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1996         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1997         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1998         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1999         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
2000         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
2001         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
2002         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
2003         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
2004         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
2005         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
2006         (testCoercibleToBigIntZero):
2007         (testCoercibleToBigIntOne):
2008         (testNotCoercibleToBigInt):
2009         (MyError): Deleted.
2010         (valueOf): Deleted.
2011         (toString): Deleted.
2012         (Symbol.toPrimitive): Deleted.
2013         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
2014         (testCoercibleToIndexZero):
2015         (testCoercibleToIndexOne):
2016         (testNotCoercibleToIndex):
2017         (MyError): Deleted.
2018         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
2019         (assert.sameValue.BigInt.asIntN.toString): Deleted.
2020         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
2021         (BigInt.asIntN.valueOf): Deleted.
2022         (BigInt.asIntN.toString): Deleted.
2023         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
2024         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
2025         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
2026         (testCoercibleToBigIntZero):
2027         (testCoercibleToBigIntOne):
2028         (testNotCoercibleToBigInt):
2029         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
2030         (testCoercibleToIndexZero):
2031         (testCoercibleToIndexOne):
2032         (testNotCoercibleToIndex):
2033         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
2034         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
2035         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
2036         (bits.valueOf):
2037         (bigint.valueOf):
2038         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
2039         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
2040         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
2041         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
2042         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
2043         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
2044         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
2045         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
2046         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
2047         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
2048         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
2049         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
2050         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
2051         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
2052         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
2053         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
2054         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
2055         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
2056         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
2057         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
2058         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
2059         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
2060         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
2061         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
2062         (replacer):
2063         (BigInt.prototype.toJSON):
2064         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
2065         (replacer):
2066         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
2067         (BigInt.prototype.toJSON):
2068         * test262/test/built-ins/JSON/stringify/bigint.js:
2069         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
2070         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
2071         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
2072         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
2073         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
2074         * test262/test/built-ins/Object/proto-from-ctor.js:
2075         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
2076         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
2077         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
2078         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
2079         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
2080         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
2081         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
2082         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
2083         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
2084         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
2085         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
2086         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
2087         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
2088         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
2089         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
2090         * test262/test/built-ins/Proxy/get-fn-realm.js:
2091         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
2092         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
2093         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
2094         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
2095         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
2096         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
2097         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
2098         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
2099         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
2100         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
2101         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
2102         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
2103         (i6.replace):
2104         (i6b.replace):
2105         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
2106         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
2107         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
2108         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
2109         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
2110         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
2111         * test262/test/built-ins/RegExp/u180e.js: Added.
2112         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
2113         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
2114         * test262/test/built-ins/String/proto-from-ctor-realm.js:
2115         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
2116         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
2117         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
2118         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
2119         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
2120         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
2121         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
2122         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
2123         * test262/test/built-ins/String/prototype/endsWith/length.js:
2124         * test262/test/built-ins/String/prototype/endsWith/name.js:
2125         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
2126         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
2127         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
2128         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
2129         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
2130         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
2131         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
2132         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
2133         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
2134         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
2135         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
2136         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
2137         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
2138         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
2139         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
2140         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
2141         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
2142         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
2143         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
2144         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
2145         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
2146         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
2147         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
2148         * test262/test/built-ins/String/prototype/includes/includes.js:
2149         * test262/test/built-ins/String/prototype/includes/length.js:
2150         * test262/test/built-ins/String/prototype/includes/name.js:
2151         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
2152         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
2153         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
2154         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
2155         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
2156         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
2157         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
2158         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
2159         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
2160         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
2161         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
2162         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
2163         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
2164         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
2165         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
2166         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
2167         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
2168         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
2169         * test262/test/built-ins/String/prototype/trim/u180e.js:
2170         * test262/test/built-ins/Symbol/for/cross-realm.js:
2171         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
2172         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
2173         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
2174         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
2175         * test262/test/built-ins/Symbol/match/cross-realm.js:
2176         * test262/test/built-ins/Symbol/replace/cross-realm.js:
2177         * test262/test/built-ins/Symbol/search/cross-realm.js:
2178         * test262/test/built-ins/Symbol/species/cross-realm.js:
2179         * test262/test/built-ins/Symbol/split/cross-realm.js:
2180         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
2181         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
2182         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
2183         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
2184         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
2185         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
2186         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
2187         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
2188         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
2189         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
2190         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
2191         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
2192         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
2193         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
2194         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
2195         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
2196         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
2197         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
2198         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
2199         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
2200         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
2201         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
2202         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
2203         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
2204         * test262/test/language/comments/mongolian-vowel-separator-single.js:
2205         * test262/test/language/eval-code/indirect/realm.js:
2206         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
2207         (o.get z):
2208         (o.get a):
2209         * test262/test/language/expressions/call/eval-realm-indirect.js:
2210         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
2211         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
2212         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
2213         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
2214         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
2215         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
2216         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
2217         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
2218         * test262/test/language/expressions/greater-than/bigint-and-number.js:
2219         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
2220         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
2221         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
2222         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
2223         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
2224         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
2225         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
2226         * test262/test/language/expressions/less-than/bigint-and-number.js:
2227         * test262/test/language/expressions/new/non-ctor-err-realm.js:
2228         * test262/test/language/expressions/super/realm.js:
2229         * test262/test/language/expressions/tagged-template/cache-realm.js:
2230         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
2231         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
2232         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
2233         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
2234         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
2235         * test262/test/language/literals/string/mongolian-vowel-separator.js:
2236         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
2237         (o.get z):
2238         (o.get a):
2239         * test262/test/language/statements/for-of/iterator-next-reference.js:
2240         (next):
2241         (iterator.next): Deleted.
2242         (x.of.iterable.): Deleted.
2243         (x.of.iterable.get return): Deleted.
2244         (x.of.iterable.iterator.next): Deleted.
2245         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
2246         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
2247         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
2248         * test262/test/language/white-space/mongolian-vowel-separator.js:
2249         * test262/test262-Revision.txt:
2250
2251 2017-10-03  Saam Barati  <sbarati@apple.com>
2252
2253         Implement polymorphic prototypes
2254         https://bugs.webkit.org/show_bug.cgi?id=176391
2255
2256         Reviewed by Filip Pizlo.
2257
2258         * microbenchmarks/poly-proto-access.js: Added.
2259         (assert):
2260         (foo.C):
2261         (foo.C.prototype.get bar):
2262         (foo):
2263         (bar):
2264         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
2265         (assert):
2266         (makePolyProtoObject.foo.C):
2267         (makePolyProtoObject.foo):
2268         (makePolyProtoObject):
2269         (performSet):
2270         * microbenchmarks/poly-proto-setter-speed.js: Added.
2271         (assert):
2272         (makePolyProtoObject.foo.C):
2273         (makePolyProtoObject.foo.C.prototype.set p):
2274         (makePolyProtoObject.foo):
2275         (makePolyProtoObject):
2276         (performSet):
2277         * stress/constructor-with-return.js:
2278         (i.tests.forEach.Constructor):
2279         (i.tests.forEach):
2280         (tests.forEach.Constructor): Deleted.
2281         (tests.forEach): Deleted.
2282         * stress/dom-jit-with-poly-proto.js: Added.
2283         (assert):
2284         (makePolyProtoObject.foo.C):
2285         (makePolyProtoObject.foo):
2286         (makePolyProtoObject):
2287         (validate):
2288         * stress/poly-proto-custom-value-and-accessor.js: Added.
2289         (assert):
2290         (makePolyProtoObject.foo.C):
2291         (makePolyProtoObject.foo):
2292         (makePolyProtoObject):
2293         (items.forEach):
2294         (set get for):
2295         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
2296         (assert):
2297         (makePolyProtoObject.foo.C):
2298         (makePolyProtoObject.foo):
2299         (makePolyProtoObject):
2300         (foo):
2301         * stress/poly-proto-miss.js: Added.
2302         (makePolyProtoInstanceWithNullPrototype.foo.C):
2303         (makePolyProtoInstanceWithNullPrototype.foo):
2304         (makePolyProtoInstanceWithNullPrototype):
2305         (assert):
2306         (validate):
2307         * stress/poly-proto-op-in-caching.js: Added.
2308         (assert):
2309         (makePolyProtoObject.foo.C):
2310         (makePolyProtoObject.foo):
2311         (makePolyProtoObject):
2312         (validate):
2313         (validate2):
2314         * stress/poly-proto-put-transition.js: Added.
2315         (assert):
2316         (makePolyProtoObject.foo.C):
2317         (makePolyProtoObject.foo):
2318         (makePolyProtoObject):
2319         (performSet):
2320         (i.obj.__proto__.set p):
2321         * stress/poly-proto-set-prototype.js: Added.
2322         (assert):
2323         (let.alternateProto.get x):
2324         (let.alternateProto2.get y):
2325         (let.alternateProto2.get x):
2326         (foo.C):
2327         (foo):
2328         (validate):
2329         * stress/poly-proto-setter.js: Added.
2330         (assert):
2331         (makePolyProtoObject.foo.C):
2332         (makePolyProtoObject.foo.C.prototype.set p):
2333         (makePolyProtoObject.foo.C.prototype.get p):
2334         (makePolyProtoObject.foo):
2335         (makePolyProtoObject):
2336         (performSet):
2337         * stress/poly-proto-using-inheritance.js: Added.
2338         (assert):
2339         (foo.C):
2340         (foo.C.prototype.get baz):
2341         (foo):
2342         (bar.C):
2343         (bar):
2344         (validate):
2345         * stress/primitive-poly-proto.js: Added.
2346         (makePolyProtoInstance.foo.C):
2347         (makePolyProtoInstance.foo):
2348         (makePolyProtoInstance):
2349         (assert):
2350         (validate):
2351         * stress/prototype-is-not-js-object.js: Added.
2352         (foo.bar):
2353         (foo):
2354         (assert):
2355         (validate):
2356         * stress/try-get-by-id-poly-proto.js: Added.
2357         (assert):
2358         (makePolyProtoObject.foo.C):
2359         (makePolyProtoObject.foo):
2360         (makePolyProtoObject):
2361         (tryGetByIdText):
2362         (x.__proto__.get bar):
2363         (validate):
2364         * typeProfiler/overflow.js:
2365
2366 2017-10-03  JF Bastien  <jfbastien@apple.com>
2367
2368         WebAssembly: no VM / JS version of everything but Instance
2369         https://bugs.webkit.org/show_bug.cgi?id=177473
2370
2371         Reviewed by Filip Pizlo.
2372
2373         - Exceeding max on memory growth now returns a range error as per
2374         spec. This is a (very minor) breaking change: it used to throw OOM
2375         error. Update the corresponding test.
2376
2377         * wasm/js-api/memory-grow.js:
2378         (assertEq):
2379         * wasm/js-api/table.js:
2380         (assert.throws):
2381
2382 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
2383
2384         Skip JSC test stress/regress-159779-2.js on debug.
2385         https://bugs.webkit.org/show_bug.cgi?id=177204
2386
2387         Unreviewed test gardening.
2388
2389         * stress/regress-159779-2.js:
2390
2391 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
2392
2393         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
2394         https://bugs.webkit.org/show_bug.cgi?id=175642
2395
2396         Reviewed by Darin Adler.
2397
2398         * ChakraCore/test/Function/apply3.baseline-jsc:
2399
2400 2017-10-01  Commit Queue  <commit-queue@webkit.org>
2401
2402         Unreviewed, rolling out r222564.
2403         https://bugs.webkit.org/show_bug.cgi?id=177720
2404
2405         "It regressed JetStream by 2% on iOS caused by a 50%
2406         regression on the bigfib subtest" (Requested by saamyjoon on
2407         #webkit).
2408
2409         Reverted changeset:
2410
2411         "Add Above/Below comparisons for UInt32 patterns"
2412         https://bugs.webkit.org/show_bug.cgi?id=177281
2413         http://trac.webkit.org/changeset/222564
2414
2415 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2416
2417         [DFG] Support ArrayPush with multiple args
2418         https://bugs.webkit.org/show_bug.cgi?id=175823
2419
2420         Reviewed by Saam Barati.
2421
2422         * microbenchmarks/array-push-0.js: Added.
2423         (arrayPush0):
2424         * microbenchmarks/array-push-1.js: Added.
2425         (arrayPush1):
2426         * microbenchmarks/array-push-2.js: Added.
2427         (arrayPush2):
2428         * microbenchmarks/array-push-3.js: Added.
2429         (arrayPush3):
2430         * stress/array-push-multiple-contiguous.js: Added.
2431         (shouldBe):
2432         (test):
2433         * stress/array-push-multiple-double-nan.js: Added.
2434         (shouldBe):
2435         (test):
2436         * stress/array-push-multiple-double.js: Added.
2437         (shouldBe):
2438         (test):
2439         * stress/array-push-multiple-int32.js: Added.
2440         (shouldBe):
2441         (test):
2442         * stress/array-push-multiple-many-contiguous.js: Added.
2443         (shouldBe):
2444         (test):
2445         * stress/array-push-multiple-many-double.js: Added.
2446         (shouldBe):
2447         (test):
2448         * stress/array-push-multiple-many-int32.js: Added.
2449         (shouldBe):
2450         (test):
2451         * stress/array-push-multiple-many-storage.js: Added.
2452         (shouldBe):
2453         (test):
2454         * stress/array-push-multiple-storage.js: Added.
2455         (shouldBe):
2456         (test):
2457         * stress/array-push-with-force-exit.js: Added.
2458         (target.createBuiltin):
2459
2460 2017-09-29  Saam Barati  <sbarati@apple.com>
2461
2462         Custom GetterSetterAccessCase does not use the correct slotBase when making call
2463         https://bugs.webkit.org/show_bug.cgi?id=177639
2464
2465         Reviewed by Geoffrey Garen.
2466
2467         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
2468         (assert):
2469         (Class):
2470         (items.forEach):
2471         (set get for):
2472
2473 2017-09-29  Commit Queue  <commit-queue@webkit.org>
2474
2475         Unreviewed, rolling out r222563, r222565, and r222581.
2476         https://bugs.webkit.org/show_bug.cgi?id=177675
2477
2478         "It causes a crash when playing youtube videos" (Requested by
2479         saamyjoon on #webkit).
2480
2481         Reverted changesets:
2482
2483         "[DFG] Support ArrayPush with multiple args"
2484         https://bugs.webkit.org/show_bug.cgi?id=175823
2485         http://trac.webkit.org/changeset/222563
2486
2487         "Unreviewed, build fix after r222563"
2488         https://bugs.webkit.org/show_bug.cgi?id=175823
2489         http://trac.webkit.org/changeset/222565
2490
2491         "Unreviewed, fix x86 breaking due to exhausted registers"
2492         https://bugs.webkit.org/show_bug.cgi?id=175823
2493         http://trac.webkit.org/changeset/222581
2494
2495 2017-09-28  Mark Lam  <mark.lam@apple.com>
2496
2497         test262: Unexpected passes after r222617 and r222618.
2498         https://bugs.webkit.org/show_bug.cgi?id=177622
2499         <rdar://problem/34725960>
2500
2501         Reviewed by Saam Barati.
2502
2503         Update test262.yaml for tests that are now passing.
2504
2505         * test262.yaml:
2506
2507 2017-09-27  Michael Saboff  <msaboff@apple.com>
2508
2509         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
2510         https://bugs.webkit.org/show_bug.cgi?id=177570
2511
2512         Reviewed by Filip Pizlo.
2513
2514         New regression test.
2515
2516         * stress/regress-177570.js: Added.
2517
2518 2017-09-28  Michael Saboff  <msaboff@apple.com>
2519
2520         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
2521         https://bugs.webkit.org/show_bug.cgi?id=177423
2522
2523         Reviewed by Mark Lam.
2524
2525         Updated regression test.
2526
2527         * stress/regress-177423.js:
2528         (catch):
2529
2530 2017-09-27  Mark Lam  <mark.lam@apple.com>
2531
2532         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
2533         https://bugs.webkit.org/show_bug.cgi?id=177584
2534         <rdar://problem/34463903>
2535
2536         Reviewed by Saam Barati.
2537
2538         * stress/regress-177584.js: Added.
2539         (assertEqual):
2540         (Array.prototype.Symbol.species):
2541
2542 2017-09-27  Saam Barati  <sbarati@apple.com>
2543
2544         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
2545         https://bugs.webkit.org/show_bug.cgi?id=177523
2546
2547         Reviewed by Mark Lam.
2548
2549         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
2550         (assert):
2551         (Test):
2552         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
2553         (addMethods):
2554         (i.Test.prototype.propName):
2555
2556 2017-09-27  Mark Lam  <mark.lam@apple.com>
2557
2558         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
2559         https://bugs.webkit.org/show_bug.cgi?id=177423
2560         <rdar://problem/34621320>
2561
2562         Reviewed by Keith Miller.
2563
2564         * stress/regress-177423.js: Added.
2565
2566 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2567
2568         Add Above/Below comparisons for UInt32 patterns
2569         https://bugs.webkit.org/show_bug.cgi?id=177281
2570
2571         Reviewed by Saam Barati.
2572
2573         * stress/uint32-comparison-jump.js: Added.
2574         (shouldBe):
2575         (above):
2576         (aboveOrEqual):
2577         (below):
2578         (belowOrEqual):
2579         (notAbove):
2580         (notAboveOrEqual):
2581         (notBelow):
2582         (notBelowOrEqual):
2583         * stress/uint32-comparison.js: Added.
2584         (shouldBe):
2585         (above):
2586         (aboveOrEqual):
2587         (below):
2588         (belowOrEqual):
2589         (aboveTest):
2590         (aboveOrEqualTest):
2591         (belowTest):
2592         (belowOrEqualTest):
2593
2594 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2595
2596         [DFG] Support ArrayPush with multiple args
2597         https://bugs.webkit.org/show_bug.cgi?id=175823
2598
2599         Reviewed by Saam Barati.
2600
2601         * microbenchmarks/array-push-0.js: Added.
2602         (arrayPush0):
2603         * microbenchmarks/array-push-1.js: Added.
2604         (arrayPush1):
2605         * microbenchmarks/array-push-2.js: Added.
2606         (arrayPush2):
2607         * microbenchmarks/array-push-3.js: Added.
2608         (arrayPush3):
2609         * stress/array-push-multiple-contiguous.js: Added.
2610         (shouldBe):
2611         (test):
2612         * stress/array-push-multiple-double-nan.js: Added.
2613         (shouldBe):
2614         (test):
2615         * stress/array-push-multiple-double.js: Added.
2616         (shouldBe):
2617         (test):
2618         * stress/array-push-multiple-int32.js: Added.
2619         (shouldBe):
2620         (test):
2621         * stress/array-push-multiple-many-contiguous.js: Added.
2622         (shouldBe):
2623         (test):
2624         * stress/array-push-multiple-many-double.js: Added.
2625         (shouldBe):
2626         (test):
2627         * stress/array-push-multiple-many-int32.js: Added.
2628         (shouldBe):
2629         (test):
2630         * stress/array-push-multiple-many-storage.js: Added.
2631         (shouldBe):
2632         (test):
2633         * stress/array-push-multiple-storage.js: Added.
2634         (shouldBe):
2635         (test):
2636
2637 2017-09-26  Commit Queue  <commit-queue@webkit.org>
2638
2639         Unreviewed, rolling out r222518.
2640         https://bugs.webkit.org/show_bug.cgi?id=177507
2641
2642         Break the High Sierra build (Requested by yusukesuzuki on
2643         #webkit).
2644
2645         Reverted changeset:
2646
2647         "Add Above/Below comparisons for UInt32 patterns"
2648         https://bugs.webkit.org/show_bug.cgi?id=177281
2649         http://trac.webkit.org/changeset/222518
2650
2651 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2652
2653         Add Above/Below comparisons for UInt32 patterns
2654         https://bugs.webkit.org/show_bug.cgi?id=177281
2655
2656         Reviewed by Saam Barati.
2657
2658         * stress/uint32-comparison-jump.js: Added.
2659         (shouldBe):
2660         (above):
2661         (aboveOrEqual):
2662         (below):
2663         (belowOrEqual):
2664         (notAbove):
2665         (notAboveOrEqual):
2666         (notBelow):
2667         (notBelowOrEqual):
2668         * stress/uint32-comparison.js: Added.
2669         (shouldBe):
2670         (above):
2671         (aboveOrEqual):
2672         (below):
2673         (belowOrEqual):
2674         (aboveTest):
2675         (aboveOrEqualTest):
2676         (belowTest):
2677         (belowOrEqualTest):
2678
2679 2017-09-23  Keith Miller  <keith_miller@apple.com>
2680
2681         Fix infinite looping test262 test
2682         https://bugs.webkit.org/show_bug.cgi?id=177412
2683
2684         Reviewed by Yusuke Suzuki.
2685
2686         This test was poorly designed since failing it would cause the vm
2687         to inifinite loop. I've fixed it locally and will fix it on github pending
2688         the results of next weeks tc39 meeting.
2689
2690         * test262.yaml:
2691         * test262/test/language/statements/for-of/iterator-next-reference.js:
2692
2693 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2694
2695         test262: $.agent became $262.agent in test262 update
2696         https://bugs.webkit.org/show_bug.cgi?id=177407
2697
2698         Reviewed by Yusuke Suzuki.
2699
2700         * test262.yaml:
2701         ~320 tests pass now that we correctly make $262 available.
2702
2703 2017-09-22  Keith Miller  <keith_miller@apple.com>
2704
2705         Speculatively change iteration protocall to use the same next function
2706         https://bugs.webkit.org/show_bug.cgi?id=175653
2707
2708         Reviewed by Saam Barati.
2709
2710         Change test to match the new iteration behavior.
2711
2712         * stress/spread-optimized-properly.js:
2713
2714 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2715
2716         [DFG][FTL] Profile array vector length for array allocation
2717         https://bugs.webkit.org/show_bug.cgi?id=177051
2718
2719         Reviewed by Saam Barati.
2720
2721         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2722         (target):
2723
2724 2017-09-22  Commit Queue  <commit-queue@webkit.org>
2725
2726         Unreviewed, rolling out r222380.
2727         https://bugs.webkit.org/show_bug.cgi?id=177352
2728
2729         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
2730         #webkit).
2731
2732         Reverted changeset:
2733
2734         "[DFG][FTL] Profile array vector length for array allocation"
2735         https://bugs.webkit.org/show_bug.cgi?id=177051
2736         http://trac.webkit.org/changeset/222380
2737
2738 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2739
2740         [DFG][FTL] Profile array vector length for array allocation
2741         https://bugs.webkit.org/show_bug.cgi?id=177051
2742
2743         Reviewed by Saam Barati.
2744
2745         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
2746         (target):
2747
2748 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
2749
2750         Skip new hanging test262 tests.
2751         https://bugs.webkit.org/show_bug.cgi?id=177326
2752
2753         Unreviewed test gardening.
2754
2755         * test262.yaml:
2756
2757 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
2758
2759         Mark 6 test262 tests as passing.
2760         https://bugs.webkit.org/show_bug.cgi?id=177307
2761
2762         Unreviewed test gardening.
2763
2764         * test262.yaml:
2765
2766 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2767
2768         Unreviewed follow-up to r222311.
2769
2770         * test262/harness/sta.js:
2771         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
2772         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
2773         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
2774         * test262/test/built-ins/Array/from/elements-added-after.js:
2775         * test262/test/built-ins/Array/from/elements-deleted-after.js:
2776         * test262/test/built-ins/Array/from/elements-updated-after.js:
2777         * test262/test/built-ins/Array/from/from-array.js:
2778         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
2779         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
2780         * test262/test/built-ins/Array/from/source-array-boundary.js:
2781         * test262/test/built-ins/Array/from/source-object-constructor.js:
2782         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
2783         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
2784         * test262/test/built-ins/Array/from/source-object-length.js:
2785         * test262/test/built-ins/Array/from/source-object-missing.js:
2786         * test262/test/built-ins/Array/from/source-object-without.js:
2787         * test262/test/built-ins/Array/from/this-null.js:
2788         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2789         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
2790         * test262/test/language/literals/numeric/7.8.3-1gs.js:
2791         * test262/test/language/literals/numeric/7.8.3-2gs.js:
2792         * test262/test/language/literals/numeric/7.8.3-3gs.js:
2793         * test262/test/language/literals/regexp/7.8.5-1gs.js:
2794         * test262/test/language/literals/string/7.8.4-1gs.js:
2795         Fix some files that I failed to update when I applied my patch.
2796
2797 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
2798
2799         Update test262 tests
2800         https://bugs.webkit.org/show_bug.cgi?id=177220
2801
2802         Reviewed by Saam Barati and Yusuke Suzuki.
2803
2804         * test262.yaml:
2805         * test262/test262-Revision.txt:
2806         New rebaselined expectations for all tests.
2807
2808         * test262/*:
2809         Updated.
2810
2811 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2812
2813         [DFG] Remove ToThis more aggressively
2814         https://bugs.webkit.org/show_bug.cgi?id=177056
2815
2816         Reviewed by Saam Barati.
2817
2818         * stress/generator-with-this-strict.js: Added.
2819         (shouldBe):
2820         (generator):
2821         (target):
2822         * stress/generator-with-this.js: Added.
2823         (shouldBe):
2824         (generator):
2825         (target):
2826
2827 2017-09-17  Michael Saboff  <msaboff@apple.com>
2828
2829         https://bugs.webkit.org/show_bug.cgi?id=177038
2830         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2831
2832         Reviewed by JF Bastien.
2833
2834         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2835         as it dies using too much memory.
2836
2837 2017-09-15  Saam Barati  <sbarati@apple.com>
2838
2839         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2840         https://bugs.webkit.org/show_bug.cgi?id=176981
2841
2842         Reviewed by Yusuke Suzuki.
2843
2844         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2845         (assert):
2846         (verify):
2847         (func):
2848         (const.bar.createBuiltin):
2849
2850 2017-09-14  Saam Barati  <sbarati@apple.com>
2851
2852         It should be valid to exit before each set when doing arity fixup when inlining
2853         https://bugs.webkit.org/show_bug.cgi?id=176948
2854
2855         Reviewed by Keith Miller.
2856
2857         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2858         (baz):
2859         (bar):
2860         (foo):
2861
2862 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2863
2864         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2865         https://bugs.webkit.org/show_bug.cgi?id=176867
2866
2867         Reviewed by Sam Weinig.
2868
2869         * microbenchmarks/object-get-own-property-symbols.js: Added.
2870         (test):
2871
2872 2017-09-13  Mark Lam  <mark.lam@apple.com>
2873
2874         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2875         https://bugs.webkit.org/show_bug.cgi?id=176888
2876         <rdar://problem/34381832>
2877
2878         Not reviewed.
2879
2880         * stress/op_mod-ConstVar.js:
2881         * stress/op_mod-VarConst.js:
2882         * stress/op_mod-VarVar.js:
2883
2884 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2885
2886         Skip 3 op_mod tests on Debug JSC bots.
2887         https://bugs.webkit.org/show_bug.cgi?id=176630
2888
2889         Unreviewed test gardening.
2890
2891         * stress/op_mod-ConstVar.js:
2892         * stress/op_mod-VarConst.js:
2893         * stress/op_mod-VarVar.js:
2894
2895 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2896
2897         [JSC] Fix Array allocation in Object.keys
2898         https://bugs.webkit.org/show_bug.cgi?id=176826
2899
2900         Reviewed by Saam Barati.
2901
2902         * stress/object-own-property-keys.js: Added.
2903         (shouldBe):
2904
2905 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2906
2907         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2908         https://bugs.webkit.org/show_bug.cgi?id=176010
2909
2910         Reviewed by Filip Pizlo.
2911
2912         * microbenchmarks/weak-map-key.js: Added.
2913         (assert):
2914         (objectKey):
2915         (let.start.Date.now):
2916
2917 2017-09-12  Mark Lam  <mark.lam@apple.com>
2918
2919         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2920         https://bugs.webkit.org/show_bug.cgi?id=176630
2921
2922         Reviewed by JF Bastien.
2923
2924         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2925         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2926         a speculative fix for the bots that are seeing these fail.
2927
2928         I also undid the skipping of the op_mod tests for debug builds.
2929
2930         * stress/op_div-ConstVar.js:
2931         * stress/op_div-VarConst.js:
2932         * stress/op_div-VarVar.js:
2933         * stress/op_mod-ConstVar.js:
2934         * stress/op_mod-VarConst.js:
2935         * stress/op_mod-VarVar.js:
2936
2937 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2938
2939         Skip stress/value-to-boolean.js on Debug bots.
2940         https://bugs.webkit.org/show_bug.cgi?id=176787
2941
2942         Unreviewed test gardening.
2943
2944         * stress/value-to-boolean.js:
2945
2946 2017-09-11  Mark Lam  <mark.lam@apple.com>
2947
2948         Change test expectation for test262/test/language/statements/try/tco-catch.js
2949         https://bugs.webkit.org/show_bug.cgi?id=176749
2950
2951         Rubber stamped by Keith Miller.
2952
2953         It's been failing since at least r221821.  I'm changing the test expectation to
2954         fail to green the bots while I investigate some more.
2955
2956         * test262.yaml:
2957
2958 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2959
2960         Unreviewed, rolling out r221854.
2961
2962         The test added with this change fails on 32-bit JSC bots.
2963
2964         Reverted changeset:
2965
2966         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2967         https://bugs.webkit.org/show_bug.cgi?id=176010
2968         http://trac.webkit.org/changeset/221854
2969
2970 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2971
2972         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2973         https://bugs.webkit.org/show_bug.cgi?id=176010
2974
2975         Reviewed by Filip Pizlo.
2976
2977         * microbenchmarks/weak-map-key.js: Added.
2978         (assert):
2979         (objectKey):
2980         (let.start.Date.now):
2981
2982 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2983
2984         [JSC] Optimize Object.keys by using careful array allocation
2985         https://bugs.webkit.org/show_bug.cgi?id=176654
2986
2987         Reviewed by Darin Adler.
2988
2989         * microbenchmarks/object-keys.js: Added.
2990         (test):
2991
2992 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2993
2994         Error should compute .stack and friends lazily
2995         https://bugs.webkit.org/show_bug.cgi?id=176645
2996
2997         Reviewed by Saam Barati.
2998
2999         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
3000         * microbenchmarks/new-error.js: Added.
3001         * microbenchmarks/throw.js: Added.
3002
3003 2017-09-09  Mark Lam  <mark.lam@apple.com>
3004
3005         [Re-landing] Use JIT probes for DFG OSR exit.
3006         https://bugs.webkit.org/show_bug.cgi?id=175144
3007         <rdar://problem/33437050>
3008
3009         Not reviewed.  Original patch reviewed by Saam Barati.
3010
3011         Disable these tests for debug builds because they run too slow with the new OSR exit.
3012
3013         * stress/op_mod-ConstVar.js:
3014         * stress/op_mod-VarConst.js:
3015         * stress/op_mod-VarVar.js:
3016
3017 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3018
3019         [DFG] NewArrayWithSize(size)'s size does not care negative zero
3020         https://bugs.webkit.org/show_bug.cgi?id=176300
3021
3022         Reviewed by Saam Barati.
3023
3024         * stress/new-array-with-size-div.js: Added.
3025         (shouldBe):
3026         (test):
3027         (i.i):
3028
3029 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3030
3031         [DFG] PutByVal with Array::Generic is too generic
3032         https://bugs.webkit.org/show_bug.cgi?id=176345
3033
3034         Reviewed by Filip Pizlo.
3035
3036         * stress/object-assign-symbols.js: Added.
3037         (shouldBe):
3038         (test):
3039         * stress/object-assign.js: Added.
3040         (shouldBe):
3041         (test):
3042         (i.shouldBe.JSON.stringify.test):
3043
3044 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3045
3046         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
3047         https://bugs.webkit.org/show_bug.cgi?id=176590
3048
3049         Reviewed by Saam Barati.
3050
3051         * microbenchmarks/object-iterate-symbols.js: Added.
3052         (test):
3053         * microbenchmarks/object-iterate.js: Added.
3054         (test):
3055         * stress/object-iterate-symbols.js: Added.
3056         (shouldBe):
3057         (test):
3058         * stress/object-iterate.js: Added.
3059         (shouldBe):
3060         (test):
3061
3062 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
3063
3064         [Win32] 10 JSC stress tests are failing.
3065         https://bugs.webkit.org/show_bug.cgi?id=176538
3066
3067         Reviewed by Mark Lam.
3068
3069         Skip tests on Windows to make the bots green.
3070
3071         * ChakraCore.yaml:
3072         * stress/date-relaxed.js:
3073
3074 2017-09-06  Mark Lam  <mark.lam@apple.com>
3075
3076         constructGenericTypedArrayViewWithArguments() is missing an exception check.
3077         https://bugs.webkit.org/show_bug.cgi?id=176485
3078         <rdar://problem/33898874>
3079
3080         Reviewed by Keith Miller.
3081
3082         * stress/regress-176485.js: Added.
3083
3084 2017-09-05  Saam Barati  <sbarati@apple.com>
3085
3086         isNotCellSpeculation is wrong with respect to SpecEmpty
3087         https://bugs.webkit.org/show_bug.cgi?id=176429
3088
3089         Reviewed by Michael Saboff.
3090
3091         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
3092         (Foo):
3093
3094 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
3095
3096         test262: Completion values for control flow do not match the spec
3097         https://bugs.webkit.org/show_bug.cgi?id=171265
3098
3099         Reviewed by Saam Barati.
3100
3101         * stress/completion-value.js:
3102         Condensed test for completion values in top level statements.
3103
3104         * stress/super-get-by-id.js:
3105         ClassDeclaration when evaled no longer produce values. Convert
3106         these to ClassExpressions so they produce the class value.
3107         
3108         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3109         This is a progression for currect spec behavior.
3110
3111         * mozilla/mozilla-tests.yaml:
3112         This test is now outdated, so mark it as failing for that reason.
3113
3114         * test262.yaml:
3115         Passing all "cptn" completion value tests.
3116
3117 2017-09-04  Saam Barati  <sbarati@apple.com>
3118
3119         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
3120         https://bugs.webkit.org/show_bug.cgi?id=176317
3121
3122         Reviewed by Keith Miller.
3123
3124         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
3125         (Foo):
3126
3127 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3128
3129         [DFG][FTL] Efficiently execute number#toString()
3130         https://bugs.webkit.org/show_bug.cgi?id=170007
3131
3132         Reviewed by Keith Miller.
3133
3134         * microbenchmarks/number-to-string-strength-reduction.js: Added.
3135         (test):
3136         * microbenchmarks/number-to-string-with-radix-10.js: Added.
3137         (test):
3138         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
3139         (test):
3140         * microbenchmarks/number-to-string-with-radix.js: Added.
3141         (test):
3142         * stress/number-to-string-strength-reduction.js: Added.
3143         (shouldBe):
3144         (test):
3145         * stress/number-to-string-with-radix-10.js: Added.
3146         (shouldBe):
3147         (test):
3148         * stress/number-to-string-with-radix-cse.js: Added.
3149         (shouldBe):
3150         (test):
3151         * stress/number-to-string-with-radix-invalid.js: Added.
3152         (shouldThrow):
3153         * stress/number-to-string-with-radix-watchpoint.js: Added.
3154         (shouldBe):
3155         (test):
3156         (i.i.1e3.Number.prototype.toString):
3157         * stress/number-to-string-with-radix.js: Added.
3158         (shouldBe):
3159         (test):
3160
3161 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
3162
3163         [DFG] Relax arity requirement
3164         https://bugs.webkit.org/show_bug.cgi?id=175523
3165
3166         Reviewed by Saam Barati.
3167
3168         * stress/arity-mismatch-arguments-length.js: Added.
3169         (shouldBe):
3170         (test1):
3171         (test):
3172         * stress/arity-mismatch-get-argument.js: Added.
3173         (shouldBe):
3174         (builtin.createBuiltin):
3175         (test):
3176         * stress/arity-mismatch-inlining-extra-slots.js: Added.
3177         (shouldBe):
3178         (inlineTarget):
3179         (test):
3180         * stress/arity-mismatch-inlining.js: Added.
3181         (shouldBe):
3182         (inlineTarget):
3183         (test):
3184         * stress/arity-mismatch-rest.js: Added.
3185         (shouldBe):
3186         (test2):
3187         (test1):
3188         (test):
3189
3190 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3191
3192         [JSC] Fix "name" and "length" of Proxy revoke function
3193         https://bugs.webkit.org/show_bug.cgi?id=176155
3194
3195         Reviewed by Mark Lam.
3196
3197         * test262.yaml:
3198
3199 2017-08-31  Saam Barati  <sbarati@apple.com>
3200
3201         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
3202         https://bugs.webkit.org/show_bug.cgi?id=176206
3203
3204         Reviewed by Keith Miller.
3205
3206         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
3207         (a):
3208         (b):
3209         (foo):
3210
3211 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
3212
3213         Skip two slow JSC tests after r221422.
3214
3215         Unreviewed test gardening.
3216
3217         * stress/regexp-prototype-match-on-too-long-rope.js:
3218         * stress/regexp-prototype-test-on-too-long-rope.js:
3219
3220 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
3221
3222         Unreviewed, skipping slow tests.
3223         
3224         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
3225         work differently now.
3226
3227         * stress/regexp-prototype-exec-on-too-long-rope.js:
3228         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
3229
3230 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3231
3232         [JSC] Use reifying system for "name" property of builtin JSFunction
3233         https://bugs.webkit.org/show_bug.cgi?id=175260
3234
3235         Reviewed by Saam Barati.
3236
3237         * stress/accessors-get-set-prefix.js:
3238         * stress/builtin-function-name.js: Added.
3239         (shouldBe):
3240         (shouldThrow):
3241         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3242         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3243         * stress/private-name-as-anonymous-builtin.js: Added.
3244         (shouldBe):
3245         (NotPromise):
3246
3247 2017-08-30  Saam Barati  <sbarati@apple.com>
3248
3249         Unreviewed. Make test stop printing.
3250
3251         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
3252
3253 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
3254
3255         Unreviewed, rolling out r221327.
3256
3257         This change caused test262 failures.
3258
3259         Reverted changeset:
3260
3261         "[JSC] Use reifying system for "name" property of builtin
3262         JSFunction"
3263         https://bugs.webkit.org/show_bug.cgi?id=175260
3264         http://trac.webkit.org/changeset/221327
3265
3266 2017-08-30  Saam Barati  <sbarati@apple.com>
3267
3268         semicolon is being interpreted as an = in the LiteralParser
3269         https://bugs.webkit.org/show_bug.cgi?id=176114
3270
3271         Reviewed by Oliver Hunt.
3272
3273         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
3274         * stress/resources/literal-parser-test-case.js: Added.
3275
3276 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3277
3278         [ESNext] Async iteration - Implement async iteration statement: for-await-of
3279         https://bugs.webkit.org/show_bug.cgi?id=166698
3280
3281         Reviewed by Yusuke Suzuki.
3282
3283         * stress/async-iteration-for-await-of-syntax.js: Added.
3284         (assert):
3285         (checkSyntax):
3286         (checkSyntaxError):
3287         (checkSimpleAsyncGeneratorSloppyMode):
3288         (checkSimpleAsyncGeneratorStrictMode):
3289         (checkNestedAsyncGenerators):
3290         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3291         * stress/async-iteration-for-await-of.js: Added.
3292         (assert):
3293         (async.foo):
3294         (async.boo):
3295         (const.boo.async):
3296
3297 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
3298
3299         [JSC] Use reifying system for "name" property of builtin JSFunction
3300         https://bugs.webkit.org/show_bug.cgi?id=175260
3301
3302         Reviewed by Saam Barati.
3303
3304         * stress/accessors-get-set-prefix.js:
3305         * stress/builtin-function-name.js: Added.
3306         (shouldBe):
3307         (shouldThrow):
3308         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3309         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3310
3311 2017-08-25  Saam Barati  <sbarati@apple.com>
3312
3313         Support compiling catch in the DFG
3314         https://bugs.webkit.org/show_bug.cgi?id=174590
3315         <rdar://problem/34047845>
3316
3317         Reviewed by Filip Pizlo.
3318
3319         * microbenchmarks/delta-blue-try-catch.js: Added.
3320         (exception):
3321         (value):
3322         (OrderedCollection):
3323         (OrderedCollection.prototype.add):
3324         (OrderedCollection.prototype.at):
3325         (OrderedCollection.prototype.size):
3326         (OrderedCollection.prototype.removeFirst):
3327         (OrderedCollection.prototype.remove):
3328         (Strength):
3329         (Strength.stronger):
3330         (Strength.weaker):
3331         (Strength.weakestOf):
3332         (Strength.strongest):
3333         (Strength.prototype.nextWeaker):
3334         (Constraint):
3335         (Constraint.prototype.addConstraint):
3336         (Constraint.prototype.satisfy):
3337         (Constraint.prototype.destroyConstraint):
3338         (Constraint.prototype.isInput):
3339         (UnaryConstraint):
3340         (UnaryConstraint.prototype.addToGraph):
3341         (UnaryConstraint.prototype.chooseMethod):
3342         (UnaryConstraint.prototype.isSatisfied):
3343         (UnaryConstraint.prototype.markInputs):
3344         (UnaryConstraint.prototype.output):
3345         (UnaryConstraint.prototype.recalculate):
3346         (UnaryConstraint.prototype.markUnsatisfied):
3347         (UnaryConstraint.prototype.inputsKnown):
3348         (UnaryConstraint.prototype.removeFromGraph):
3349         (StayConstraint):
3350         (StayConstraint.prototype.execute):
3351         (EditConstraint.prototype.isInput):
3352         (EditConstraint.prototype.execute):
3353         (BinaryConstraint):
3354         (BinaryConstraint.prototype.chooseMethod):
3355         (BinaryConstraint.prototype.addToGraph):
3356         (BinaryConstraint.prototype.isSatisfied):
3357         (BinaryConstraint.prototype.markInputs):
3358         (BinaryConstraint.prototype.input):
3359         (BinaryConstraint.prototype.output):
3360         (BinaryConstraint.prototype.recalculate):
3361         (BinaryConstraint.prototype.markUnsatisfied):
3362         (BinaryConstraint.prototype.inputsKnown):
3363         (BinaryConstraint.prototype.removeFromGraph):
3364         (ScaleConstraint):
3365         (ScaleConstraint.prototype.addToGraph):
3366         (ScaleConstraint.prototype.removeFromGraph):
3367         (ScaleConstraint.prototype.markInputs):
3368         (ScaleConstraint.prototype.execute):
3369         (ScaleConstraint.prototype.recalculate):
3370         (EqualityConstraint):
3371         (EqualityConstraint.prototype.execute):
3372         (Variable):
3373         (Variable.prototype.addConstraint):
3374         (Variable.prototype.removeConstraint):
3375         (Planner):
3376         (Planner.prototype.incrementalAdd):
3377         (Planner.prototype.incrementalRemove):
3378         (Planner.prototype.newMark):
3379         (Planner.prototype.makePlan):
3380         (Planner.prototype.extractPlanFromConstraints):
3381         (Planner.prototype.addPropagate):
3382         (Planner.prototype.removePropagateFrom):
3383         (Planner.prototype.addConstraintsConsumingTo):
3384         (Plan):
3385         (Plan.prototype.addConstraint):
3386         (Plan.prototype.size):
3387         (Plan.prototype.constraintAt):
3388         (Plan.prototype.execute):
3389         (chainTest):
3390         (projectionTest):
3391         (change):
3392         (deltaBlue):
3393         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3394         (assert):
3395         (Numbers):
3396         (Numbers.prototype.next):
3397         (return.Transpose):
3398         (return.Transpose.prototype.next):
3399         (transpose):
3400         (verifyEven):
3401         (verifyString):
3402         (foo):
3403         (runIterators):
3404         * microbenchmarks/try-catch-word-count.js: Added.
3405         (let.assert):
3406         (EOF):
3407         (let.texts):
3408         (let.o.apply):
3409         (foo):
3410         (bar):
3411         (f):
3412         (run):
3413         (test1):
3414         (test2):
3415         (test3):
3416         (fn):
3417         (A):
3418         (B):
3419         (A.prototype.getValue):
3420         (B.prototype.getParentValue):
3421         (strlen):
3422         (sum.0):
3423         (test):
3424         (result.test.o):
3425         (set add.set add):
3426         (set forEach):
3427         (stringHash):
3428         (set if):
3429         (testFunction):
3430         (set delete.set has.set add):
3431         * stress/catch-set-argument-speculation-failure.js: Added.
3432         (o):
3433         (e):
3434         (e2):
3435         (escape):
3436         (baz):
3437         (noInline.run):
3438         (noInline):
3439         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3440         (foo):
3441         (e):
3442         (baz):
3443         (bar):
3444
3445 2017-08-24  Commit Queue  <commit-queue@webkit.org>
3446
3447         Unreviewed, rolling out r221119, r221124, and r221143.
3448         https://bugs.webkit.org/show_bug.cgi?id=175973
3449
3450         "I think it regressed JSBench by 20%" (Requested by saamyjoon
3451         on #webkit).
3452
3453         Reverted changesets:
3454
3455         "Support compiling catch in the DFG"
3456         https://bugs.webkit.org/show_bug.cgi?id=174590
3457         http://trac.webkit.org/changeset/221119
3458
3459         "Unreviewed, build fix in GTK port"
3460         https://bugs.webkit.org/show_bug.cgi?id=174590
3461         http://trac.webkit.org/changeset/221124
3462
3463         "DFG::JITCode::osrEntry should get sorted since we perform a
3464         binary search on it"
3465         https://bugs.webkit.org/show_bug.cgi?id=175893
3466         http://trac.webkit.org/changeset/221143
3467
3468 2017-08-24  Michael Saboff  <msaboff@apple.com>
3469
3470         Add support for RegExp "dotAll" flag
3471         https://bugs.webkit.org/show_bug.cgi?id=175924
3472
3473         Reviewed by Keith Miller.
3474
3475         Updated tests for new dotAll ('s' flag) changes.
3476
3477         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
3478         * stress/static-getter-in-names.js:
3479
3480 2017-08-24  Mark Lam  <mark.lam@apple.com>
3481
3482         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
3483         https://bugs.webkit.org/show_bug.cgi?id=175940
3484         <rdar://problem/29003921>
3485
3486         Reviewed by Saam Barati.
3487
3488         * stress/regress-164081.js: Added.
3489         (shouldEqual):
3490         (testcase):
3491
3492 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
3493
3494         Skip flaky JSC test stress/test-finally.js.
3495         https://bugs.webkit.org/show_bug.cgi?id=160283
3496
3497         Unreviewed test gardening.
3498
3499         * stress/test-finally.js:
3500
3501 2017-08-23  Saam Barati  <sbarati@apple.com>
3502
3503         Support compiling catch in the DFG
3504         https://bugs.webkit.org/show_bug.cgi?id=174590
3505
3506         Reviewed by Filip Pizlo.
3507
3508         * microbenchmarks/delta-blue-try-catch.js: Added.
3509         (exception):
3510         (value):
3511         (OrderedCollection):
3512         (OrderedCollection.prototype.add):
3513         (OrderedCollection.prototype.at):
3514         (OrderedCollection.prototype.size):
3515         (OrderedCollection.prototype.removeFirst):
3516         (OrderedCollection.prototype.remove):
3517         (Strength):
3518         (Strength.stronger):
3519         (Strength.weaker):
3520         (Strength.weakestOf):
3521         (Strength.strongest):
3522         (Strength.prototype.nextWeaker):
3523         (Constraint):
3524         (Constraint.prototype.addConstraint):
3525         (Constraint.prototype.satisfy):
3526         (Constraint.prototype.destroyConstraint):
3527         (Constraint.prototype.isInput):
3528         (UnaryConstraint):
3529         (UnaryConstraint.prototype.addToGraph):
3530         (UnaryConstraint.prototype.chooseMethod):
3531         (UnaryConstraint.prototype.isSatisfied):
3532         (UnaryConstraint.prototype.markInputs):
3533         (UnaryConstraint.prototype.output):
3534         (UnaryConstraint.prototype.recalculate):
3535         (UnaryConstraint.prototype.markUnsatisfied):
3536         (UnaryConstraint.prototype.inputsKnown):
3537         (UnaryConstraint.prototype.removeFromGraph):
3538         (StayConstraint):
3539         (StayConstraint.prototype.execute):
3540         (EditConstraint.prototype.isInput):
3541         (EditConstraint.prototype.execute):
3542         (BinaryConstraint):
3543         (BinaryConstraint.prototype.chooseMethod):
3544         (BinaryConstraint.prototype.addToGraph):
3545         (BinaryConstraint.prototype.isSatisfied):
3546         (BinaryConstraint.prototype.markInputs):
3547         (BinaryConstraint.prototype.input):
3548         (BinaryConstraint.prototype.output):
3549         (BinaryConstraint.prototype.recalculate):
3550         (BinaryConstraint.prototype.markUnsatisfied):
3551         (BinaryConstraint.prototype.inputsKnown):
3552         (BinaryConstraint.prototype.removeFromGraph):
3553         (ScaleConstraint):
3554         (ScaleConstraint.prototype.addToGraph):
3555         (ScaleConstraint.prototype.removeFromGraph):
3556         (ScaleConstraint.prototype.markInputs):
3557         (ScaleConstraint.prototype.execute):
3558         (ScaleConstraint.prototype.recalculate):
3559         (EqualityConstraint):
3560         (EqualityConstraint.prototype.execute):
3561         (Variable):
3562         (Variable.prototype.addConstraint):
3563         (Variable.prototype.removeConstraint):
3564         (Planner):
3565         (Planner.prototype.incrementalAdd):
3566         (Planner.prototype.incrementalRemove):
3567         (Planner.prototype.newMark):
3568         (Planner.prototype.makePlan):
3569         (Planner.prototype.extractPlanFromConstraints):
3570         (Planner.prototype.addPropagate):
3571         (Planner.prototype.removePropagateFrom):
3572         (Planner.prototype.addConstraintsConsumingTo):
3573         (Plan):
3574         (Plan.prototype.addConstraint):
3575         (Plan.prototype.size):
3576         (Plan.prototype.constraintAt):
3577         (Plan.prototype.execute):
3578         (chainTest):
3579         (projectionTest):
3580         (change):
3581         (deltaBlue):
3582         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
3583         (assert):
3584         (Numbers):
3585         (Numbers.prototype.next):
3586         (return.Transpose):
3587         (return.Transpose.prototype.next):
3588         (transpose):
3589         (verifyEven):
3590         (verifyString):
3591         (foo):
3592         (runIterators):
3593         * microbenchmarks/try-catch-word-count.js: Added.
3594         (let.assert):
3595         (EOF):
3596         (let.texts):
3597         (let.o.apply):
3598         (foo):
3599         (bar):
3600         (f):
3601         (run):
3602         (test1):
3603         (test2):
3604         (test3):
3605         (fn):
3606         (A):
3607         (B):
3608         (A.prototype.getValue):
3609         (B.prototype.getParentValue):
3610         (strlen):
3611         (sum.0):
3612         (test):
3613         (result.test.o):
3614         (set add.set add):
3615         (set forEach):
3616         (stringHash):
3617         (set if):
3618         (testFunction):
3619         (set delete.set has.set add):
3620         * stress/catch-set-argument-speculation-failure.js: Added.
3621         (o):
3622         (e):
3623         (e2):
3624         (escape):
3625         (baz):
3626         (noInline.run):
3627         (noInline):
3628         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
3629         (foo):
3630         (e):
3631         (baz):
3632         (bar):
3633
3634 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3635
3636         [JSC] Optimize Map iteration with intrinsic
3637         https://bugs.webkit.org/show_bug.cgi?id=174355
3638
3639         Reviewed by Saam Barati.
3640
3641         * stress/map-iterator-result-should-have-expected-shape.js: Added.
3642         (shouldBe):
3643         (throw.new.Error):
3644         * stress/set-iterator-result-should-have-expected-shape.js: Added.
3645         (shouldBe):
3646         (throw.new.Error.let.iterator.set Symbol):
3647         (throw.new.Error.set add):
3648         (let.iterator.set Symbol):
3649
3650 2017-08-23  Robin Morisset  <rmorisset@apple.com>
3651
3652         Add a micro-benchmark for checking that accessing a variable within a 'with'
3653         block does not automatically prevent type prediction.
3654         https://bugs.webkit.org/show_bug.cgi?id=175738
3655
3656         Reviewed by Saam Barati.
3657
3658         * stress/with_and_arith.js: Added.
3659         (with):
3660
3661 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
3662
3663         [ESNext] Async iteration - Implement Async Generator - runtime
3664         https://bugs.webkit.org/show_bug.cgi?id=175240
3665
3666         Reviewed by Yusuke Suzuki.
3667
3668         * stress/async-iteration-async-from-sync.js: Added.
3669         (assert):
3670         (const.Logger):
3671         (this.fullfilled):
3672         (this.fullfilledDone):
3673         (this.rejected):
3674         (this.catched):
3675         (this.isFinal):
3676         (_assertLogger):
3677         (const.assertLogger):
3678         (const.getPromise.promiseHolder.return.new.Promise):
3679         (foo):
3680         (async.boo):
3681         (bar):
3682         (async.baz):
3683         (async.goo):
3684         * stress/async-iteration-basic.js: Added.
3685         (assert):
3686         (const.Logger):
3687         (this.fullfilled):
3688         (this.fullfilledDone):
3689         (this.rejected):
3690         (this.catched):
3691         (this.isFinal):
3692         (_assertLogger):
3693         (const.assertLogger):
3694         (const.getPromise.promiseHolder.return.new.Promise):
3695         (async.generator):
3696         (iterator.next.then):
3697         (async.baz):
3698         (async.boo):
3699         (async.foo):
3700         (async.goo):
3701         (A.prototype.async.foo):
3702         (A.prototype.async.boo):
3703         (A):
3704         (asyncGenExp.async):
3705         (async.joo):
3706         (j.next.then):
3707         (then):
3708         (async.koo):
3709         (async.loo):
3710         (async.moo):
3711         (async.noo):
3712         (async.ooo):
3713         (async.roo):
3714         (async.poo):
3715         (async.soo):
3716         (async.too):
3717         * stress/async-iteration-evaluation.js: Added.
3718         (assert):
3719         (async.foo):
3720         (catch):
3721         * stress/async-iteration-syntax.js:
3722         * stress/async-iteration-yield-promise.js: Added.
3723         (assert):
3724         (const.Logger):
3725         (this.fullfilled):
3726         (this.fullfilledDone):
3727         (this.rejected):
3728         (this.catched):
3729         (this.isFinal):
3730         (_assertLogger):
3731         (const.assertLogger):
3732         (const.getPromise.promiseHolder.return.new.Promise):
3733         (async.foo):
3734         (async.boo):
3735         (async.bar):
3736         * stress/async-iteration-yield-star-interface.js: Added.
3737         (assert):
3738         (const.getPromise.promiseHolder.return.new.Promise):
3739         (const.Logger):
3740         (this.fullfilled):
3741         (this.fullfilledDone):
3742         (this.rejected):
3743         (this.catched):
3744         (this.custom):
3745         (this.isFinal):
3746         (_assertLogger):
3747         (const.assertLogger):
3748         (let.asyncIter.Symbol.asyncIterator):
3749         (let.asyncIter.next):
3750         (let.asyncIter.throw):
3751         (let.asyncIter.return):
3752         (async.foo):
3753         (asyncIter.Symbol.asyncIterator):
3754         (asyncIter.next):
3755         (async.boo):
3756         (asyncIter.return):
3757         (async.bar):
3758         (async.baz):
3759         (async.foobar):
3760         * stress/async-iteration-yield-star.js: Added.
3761         (assert):
3762         (const.Logger):
3763         (this.fullfilled):
3764         (this.fullfilledDone):
3765         (this.rejected):
3766         (this.catched):
3767         (this.custom):
3768         (this.isFinal):
3769         (_assertLogger):
3770         (const.assertLogger):
3771         (const.getPromise.promiseHolder.return.new.Promise):
3772         (async.foo):
3773         (async.boo):
3774         (async.bar):
3775         (async.baz):
3776         (async.joo):
3777         (async.goo):
3778         (async.koo):
3779         (async.loo):
3780         (let.asyncIter.Symbol.asyncIterator):
3781         (let.asyncIter.next):
3782         (let.asyncIter.throw):
3783         (let.asyncIter.return):
3784         (async.moo):
3785         (async.noo):
3786         * test262.yaml:
3787
3788 2017-08-23  JF Bastien  <jfbastien@apple.com>
3789
3790         Fix printing in test
3791
3792         Unreviewed: fixing verbosity, shouldn't have been there.
3793
3794         * wasm/regress/175693.js:
3795         (else.else):
3796         (catch):
3797
3798 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
3799
3800         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
3801         https://bugs.webkit.org/show_bug.cgi?id=172543
3802
3803         Unreviewed test gardening.
3804
3805         * microbenchmarks/generator-with-several-types.js:
3806
3807 2017-08-17  JF Bastien  <jfbastien@apple.com>
3808
3809         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
3810         https://bugs.webkit.org/show_bug.cgi?id=175693
3811         <rdar://problem/33952443>
3812
3813         Reviewed by Saam Barati.
3814
3815         Add a regression directory for WebAssembly tests.
3816
3817         * wasm.yaml:
3818         * wasm/regress/175693.js: Added.
3819         (else.else):
3820         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3821         (catch):
3822         * wasm/regress/175693.wasm: Added.
3823
3824 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3825
3826         Support the 'with' keyword in FTL.
3827         https://bugs.webkit.org/show_bug.cgi?id=175585
3828
3829         Reviewed by Saam Barati.
3830
3831         Also improve the JSTest/stress/with.js file to test
3832         what happens when non-objects are passed to with.
3833
3834         * stress/with.js:
3835         (foo):
3836         (i.catch):
3837         (i.with): Deleted.
3838
3839 2017-08-14  Keith Miller  <keith_miller@apple.com>
3840
3841         Add testing tool to lie to the DFG about profiles
3842         https://bugs.webkit.org/show_bug.cgi?id=175487
3843
3844         Reviewed by Saam Barati.
3845
3846         * stress/compare-eq-incomplete-profile.js: Added.
3847         (const.test.createBuiltin):
3848
3849 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3850
3851         Support the with keyword in DFG
3852         https://bugs.webkit.org/show_bug.cgi?id=175470
3853
3854         Reviewed by Saam Barati.
3855
3856         Added a new stress-test for the 'with' keyword, that caught a bug in a
3857         previous version of this code.
3858
3859         * stress/with.js: Added.
3860         (i.with):
3861
3862 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3863
3864         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3865         https://bugs.webkit.org/show_bug.cgi?id=175544
3866
3867         Unreviewed test gardening.
3868
3869         * ChakraCore.yaml:
3870
3871 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3872
3873         Early error on ANY operator before new.target
3874         https://bugs.webkit.org/show_bug.cgi?id=157970
3875
3876         Reviewed by Saam Barati.
3877
3878         Instead of throwing if any unary operator precedes new.target, only
3879         throw if the unary operator updates the reference.
3880
3881         The following become legal in JSC:
3882
3883         ```
3884         !new.target
3885         ~new.target
3886         typeof new.target
3887         delete new.target
3888         void new.target
3889         ```
3890
3891         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3892
3893         * stress/new-target-syntax-errors.js:
3894         * stress/new-target.js:
3895
3896 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3897
3898         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3899         https://bugs.webkit.org/show_bug.cgi?id=175255
3900
3901         Unreviewed test gardening.
3902
3903         * stress/regress-169783.js:
3904         * wasm/stress/oom.js:
3905
3906 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3907
3908         REGRESSION: 2 test262/test/language/statements/async-function failures
3909         https://bugs.webkit.org/show_bug.cgi?id=175334
3910
3911         Reviewed by Yusuke Suzuki.
3912
3913         Add @skip parameters to tests, and remove test for async iterator from 
3914         async await syntax test because it is already covered by async-iterator-syntax.js
3915
3916         * stress/async-await-syntax.js:
3917         * stress/async-iteration-syntax.js:
3918
3919 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3920
3921         Unreviewed, gardening test262 for Promise resolve / reject function length
3922         https://bugs.webkit.org/show_bug.cgi?id=175333
3923
3924         * test262.yaml:
3925
3926 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3927
3928         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3929         https://bugs.webkit.org/show_bug.cgi?id=175307
3930
3931         Reviewed by Saam Barati.
3932
3933         * stress/typedarray-getownproperty-not-configurable.js: Added.
3934         (assert):
3935         (foo):
3936
3937 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3938
3939         Promise resolve and reject function should have length = 1
3940         https://bugs.webkit.org/show_bug.cgi?id=175242
3941
3942         Reviewed by Saam Barati.
3943
3944         * stress/builtin-function-length.js: Added.
3945         (shouldBe):
3946         (shouldThrow):
3947         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3948         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3949
3950 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3951
3952         [ESNext] Async iteration - Implement Async Generator - parser
3953         https://bugs.webkit.org/show_bug.cgi?id=175210
3954
3955         Reviewed by Yusuke Suzuki.
3956
3957         * stress/async-await-syntax.js:
3958         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3959         * stress/async-iteration-syntax.js: Added.
3960         (assert):
3961         (checkSyntax):
3962         (checkSyntaxError):
3963         (checkSimpleAsyncGeneratorSloppyMode):
3964         (checkSimpleAsyncGeneratorStrictMode):
3965         (checkNestedAsyncGenerators):
3966         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3967         * stress/generator-class-methods-syntax.js:
3968
3969 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3970
3971         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3972         https://bugs.webkit.org/show_bug.cgi?id=175150
3973
3974         Unreviewed test gardening.
3975
3976         * wasm/js-api/test_memory_constructor.js:
3977
3978 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3979
3980         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3981         https://bugs.webkit.org/show_bug.cgi?id=175100
3982
3983         Reviewed by Mark Lam.
3984
3985         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3986         available memory until an out of memory exception happens.
3987
3988         The Linux kernel is more tuned for server workloads than for GUI
3989         responsiveness. When a process tries to use a lot of memory, Linux
3990         will do its best to serve the request. This usually translates to
3991         free physical RAM by writing to disk dirty pages and/or moving out
3992         less recently used pages to swap (disk storage).
3993         Meanwhile it does this, the system will become unresponsive and this
3994         leads to freezes that can last even some minutes on the worst cases.
3995
3996         Therefore, let's skip this test on Linux as it will cause more harm
3997         than good on the Linux bots or on the machines of Linux developers.
3998
3999         * wasm/stress/oom.js:
4000
4001 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
4002
4003         [JSC] Remove unnecessary print from stress\promise-finally.js test
4004         https://bugs.webkit.org/show_bug.cgi?id=175015
4005
4006         Reviewed by Yusuke Suzuki.
4007
4008         * stress/promise-finally.js:
4009         (p.finally):
4010         (then):
4011
4012 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
4013
4014         Unreviewed, update test262 results for optional catch binding
4015
4016         * test262.yaml:
4017
4018 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
4019
4020         [JSC] Support optional catch binding
4021         https://bugs.webkit.org/show_bug.cgi?id=174981
4022
4023         Reviewed by Saam Barati.
4024
4025         * stress/optional-catch-binding-syntax.js: Added.
4026         (testSyntax):
4027         (testSyntaxError):
4028         (catch.catch):
4029         * stress/optional-catch-binding.js: Added.
4030         (shouldBe):
4031         (throwException):
4032
4033 2017-07-28  Mark Lam  <mark.lam@apple.com>
4034
4035         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
4036         https://bugs.webkit.org/show_bug.cgi?id=174948
4037         <rdar://problem/33495680>
4038
4039         Reviewed by Filip Pizlo.
4040
4041         * stress/regress-174948.js: Added.
4042
4043 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
4044
4045         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
4046         https://bugs.webkit.org/show_bug.cgi?id=174900
4047
4048         Reviewed by Saam Barati.
4049
4050         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
4051         (sideEffect):
4052         (args):
4053         (test):
4054
4055 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
4056
4057         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
4058         https://bugs.webkit.org/show_bug.cgi?id=171637
4059
4060         Reviewed by Darin Adler.
4061
4062         * stress/domjit-getter-complex-with-incorrect-object.js:
4063         (i.shouldThrow):
4064         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
4065         (shouldBe):
4066         (i.shouldThrow):
4067
4068 2017-07-26  JF Bastien  <jfbastien@apple.com>
4069
4070         WebAssembly: test throwing out of the start function
4071         https://bugs.webkit.org/show_bug.cgi?id=165714
4072         <rdar://problem/29760251>
4073
4074         Reviewed by Keith Miller.
4075
4076         * wasm/assert.js:
4077         * wasm/function-tests/trap-from-start.js: Added.
4078         (StartTraps):
4079         * wasm/function-tests/trap-from-start-async.js: Added.
4080         (async.StartTrapsAsync):
4081
4082 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
4083
4084         [FTL] Arguments elimination is suppressed by unreachable blocks
4085         https://bugs.webkit.org/show_bug.cgi?id=174352
4086
4087         Reviewed by Filip Pizlo.
4088
4089         * stress/arguments-elimination-force-exit.js: Added.
4090         (shouldBe):
4091         (strict):
4092         (sloppy):
4093         * stress/arguments-elimination-throw.js: Added.
4094         (shouldBe):
4095         (shouldThrow):
4096         (sloppy):
4097         (isArguments):
4098
4099 2017-07-13  Mark Lam  <mark.lam@apple.com>
4100
4101         Add some additional test cases for bug 170896.
4102         https://bugs.webkit.org/show_bug.cgi?id=174491
4103
4104         Reviewed by Filip Pizlo.
4105
4106         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
4107         * stress/regress-170896-with-double-shape-profile.js: Added.
4108         (test):
4109         * stress/regress-170896-with-int32-shape-profile.js: Added.
4110         (test):
4111         * stress/regress-170896.js: Removed.
4112
4113 2017-07-13  Saam Barati  <sbarati@apple.com>
4114
4115         Missing exception check in JSObject::hasInstance
4116         https://bugs.webkit.org/show_bug.cgi?id=174455
4117         <rdar://problem/31384608>
4118
4119         Reviewed by Mark Lam.
4120
4121         * stress/has-instance-exception-check.js: Added.
4122         (assert):
4123         (let.getter.Object.getOwnPropertyDescriptor.get foo):
4124
4125 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
4126
4127         [ESnext] Implement Object Spread
4128         https://bugs.webkit.org/show_bug.cgi?id=167963
4129
4130         Reviewed by Saam Barati.
4131
4132         * stress/obj-rest-destructuring-order.js: Added.
4133         (assert):
4134         (o.get z):
4135         (o.get a):
4136         * stress/obj-spread-order.js: Added.
4137         (assert):
4138         (o.get z):
4139         (o.get a):
4140         * stress/object-spread.js: Added.
4141         (let.assert):
4142         (assert.sameValue):
4143         (let.o.get a):
4144         (let.obj.get c):
4145         (cthulhu.get x):
4146         (let.obj.set c):
4147         (calls.o.get z):
4148         (calls.o.get a):
4149         (try.let.obj.get foo):
4150         (get calls):
4151
4152 2017-07-12  Saam Barati  <sbarati@apple.com>
4153
4154         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
4155         https://bugs.webkit.org/show_bug.cgi?id=174411
4156         <rdar://problem/31696186>
4157
4158         Reviewed by Mark Lam.
4159
4160         * stress/generic-arguments-correct-delete-behavior.js: Added.
4161         (assert):
4162         (makeTest):
4163
4164 2017-07-07  Mark Lam  <mark.lam@apple.com>
4165
4166         \n\r is not the same as \r\n.
4167         https://bugs.webkit.org/show_bug.cgi?id=173053
4168
4169         Reviewed by Keith Miller.
4170
4171         * stress/regress-173053.js: Added.
4172         * stress/template-literal-line-terminators.js:
4173
4174 2017-07-06  Saam Barati  <sbarati@apple.com>
4175
4176         We are missing places where we invalidate the for-in context
4177         https://bugs.webkit.org/show_bug.cgi?id=174184
4178
4179         Reviewed by Geoffrey Garen.
4180
4181         * stress/for-in-invalidate-context-weird-assignments.js: Added.
4182         (assert):
4183         (test):
4184
4185 2017-07-05  Saam Barati  <sbarati@apple.com>
4186
4187         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
4188         https://bugs.webkit.org/show_bug.cgi?id=174188
4189         <rdar://problem/30581423>
4190
4191         Reviewed by Mark Lam.
4192
4193         * stress/new-array-having-a-bad-time-double.js: Added.
4194         (assert):
4195         (foo):
4196
4197 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
4198
4199         WTF::StringImpl::copyChars segfaults when built with GCC 7
4200         https://bugs.webkit.org/show_bug.cgi?id=173407
4201
4202         Reviewed by Andreas Kling.
4203
4204         * stress/string-repeat-copy-chars-crash.js: Added.
4205         (shouldBe):
4206
4207 2017-07-03  Saam Barati  <sbarati@apple.com>
4208
4209         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
4210
4211         * stress/unshiftCountSlowCase-correct-postCapacity.js:
4212
4213 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
4214
4215         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
4216
4217         It requires too much memory.
4218
4219         * stress/dont-reserve-huge-capacity-lexer.js:
4220
4221 2017-06-30  Michael Saboff  <msaboff@apple.com>
4222
4223         Skip a test on ARM64 platform since we run out of address space.
4224
4225         Rubber stamped by Saam Barati.
4226
4227         * stress/dont-reserve-huge-capacity-lexer.js:
4228
4229 2017-06-30  Michael Saboff  <msaboff@apple.com>
4230
4231         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
4232         https://bugs.webkit.org/show_bug.cgi?id=174044
4233
4234         Reviewed by Oliver Hunt.
4235
4236         New regression test.
4237
4238         * stress/regress-174044.js: Added.
4239         (test1):
4240         (test2):
4241
4242 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
4243
4244         RegExpCachedResult::setInput should reify left and right contexts
4245         https://bugs.webkit.org/show_bug.cgi?id=173818
4246
4247         Reviewed by Keith Miller.
4248
4249         * stress/right-left-context-invalidated-by-input.js: Added.
4250         (test.validateContexts):
4251         (test):
4252
4253 2017-06-29  Saam Barati  <sbarati@apple.com>
4254
4255         Calculating postCapacity in unshiftCountSlowCase is wrong
4256         https://bugs.webkit.org/show_bug.cgi?id=173992
4257         <rdar://problem/32283199>
4258
4259         Reviewed by Keith Miller.
4260
4261         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
4262         (temp):
4263
4264 2017-06-29  Commit Queue  <commit-queue@webkit.org>
4265
4266         Unreviewed, rolling out r218512.
4267         https://bugs.webkit.org/show_bug.cgi?id=173981
4268
4269         "It changes the behavior of the JS API's JSEvaluateScript
4270         which breaks TurboTax" (Requested by saamyjoon on #webkit).
4271
4272         Reverted changeset:
4273
4274         "test262: Completion values for control flow do not match the
4275         spec"
4276         https://bugs.webkit.org/show_bug.cgi?id=171265
4277         http://trac.webkit.org/changeset/218512
4278
4279 2017-06-27  JF Bastien  <jfbastien@apple.com>
4280
4281         WebAssembly: running out of executable memory should throw OoM
4282         https://bugs.webkit.org/show_bug.cgi?id=171537
4283         <rdar://problem/32963338>
4284
4285         Reviewed by Saam Barati.
4286
4287         * wasm.yaml:
4288         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
4289         (const.invoke):
4290         (failCount.0.catch):
4291         (failCount.0.module.undefined.catch):
4292         * wasm/lowExecutableMemory/exports-oom.js: Added.
4293         (const.type):
4294         (const.params):
4295         (const.randomProgram):
4296         (failCount.0.catch):
4297         (failCount.0.module.undefined.catch):
4298         * wasm/lowExecutableMemory/imports-oom.js: Added.
4299         (const.type):
4300         (const.params):
4301         (const.randomProgram):
4302         (f.imports.push):
4303         (failCount.0.catch):
4304         (failCount.0.module.undefined.catch):
4305
4306 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
4307
4308         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
4309         https://bugs.webkit.org/show_bug.cgi?id=167962
4310
4311         Reviewed by Saam Barati.
4312
4313         * stress/object-rest-deconstruct.js: Added.
4314         (let.assert):
4315         (let.assertPropDescriptor):
4316         (catch):
4317         (get 3):
4318         (foo):
4319         (let.src.get y):
4320         (let.src.set y):
4321         (let.gen):
4322
4323 2017-06-27  Saam Barati  <sbarati@apple.com>
4324
4325         Function constructor needs to follow the spec and validate parameters and body independently
4326         https://bugs.webkit.org/show_bug.cgi?id=173303
4327         <rdar://problem/32732526>
4328
4329         Reviewed by Keith Miller.
4330
4331         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
4332         * stress/function-constructor-semantics.js: Added.
4333         (assert):
4334         (hasSyntaxError):
4335         (foo):
4336         (async.foo):
4337         (testError):
4338         (testOK.toString):
4339         (toString):
4340
4341 2017-06-26  Saam Barati  <sbarati@apple.com>
4342
4343         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
4344         https://bugs.webkit.org/show_bug.cgi?id=173740
4345
4346         Reviewed by Mark Lam.
4347
4348         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
4349         (Array.prototype.Symbol.iterator):
4350
4351 2017-06-26  Saam Barati  <sbarati@apple.com>
4352
4353         Skip a test on 32-bit platforms since we run out of address space.
4354
4355         Rubber stamped by Mark Lam.
4356
4357         * stress/dont-reserve-huge-capacity-lexer.js:
4358
4359 2017-06-26  Saam Barati  <sbarati@apple.com>
4360
4361         Crash in JSC::Lexer<unsigned char>::setCode
4362         https://bugs.webkit.org/show_bug.cgi?id=172754
4363
4364         Reviewed by Mark Lam.
4365
4366         * stress/dont-reserve-huge-capacity-lexer.js: Added.
4367         (catch):
4368
4369 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
4370
4371         [JSC] Clean up Object.entries implementation
4372         https://bugs.webkit.org/show_bug.cgi?id=173759
4373
4374         Reviewed by Sam Weinig.
4375
4376         * microbenchmarks/object-entries.js: Added.
4377         (test):
4378
4379 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
4380
4381         Remove Reflect.enumerate
4382         https://bugs.webkit.org/show_bug.cgi?id=173806
4383
4384         Reviewed by Yusuke Suzuki.
4385
4386         * ChakraCore.yaml:
4387         * es6.yaml:
4388         These tests now fail because they use Reflect.enumerate.
4389
4390         * test262.yaml:
4391         This test now passes, it checked that Reflect.enumerate is undefined!
4392
4393         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
4394         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
4395
4396         * stress/reflect-enumerate.js: Removed.
4397         Remove a test solely for Reflect.enumerate.
4398
4399 2017-06-22  Saam Barati  <sbarati@apple.com>
4400
4401         ValueRep(DoubleRep(@v)) can not simply convert to @v
4402         https://bugs.webkit.org/show_bug.cgi?id=173687
4403         <rdar://problem/32855563>
4404
4405         Reviewed by Mark Lam.
4406
4407         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
4408         (i.catch):
4409
4410 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
4411
4412         [JSC] Object.values should be implemented in C++
4413         https://bugs.webkit.org/show_bug.cgi?id=173703
4414
4415         Reviewed by Sam Weinig.
4416
4417         * microbenchmarks/object-keys-map-values.js: Added.
4418         (test):
4419         * microbenchmarks/object-values.js: Added.
4420         (test):
4421         * stress/object-values-changing-properties.js: Added.
4422         (shouldBe):
4423         (throw.new.Error.let.source.get x):
4424         (throw.new.Error):
4425         (shouldBe.let.handler.get order):
4426         (get let):
4427         (shouldBe.let.handler.get return):
4428         (let.handler.get order):
4429
4430 2017-06-21  Saam Barati  <sbarati@apple.com>
4431
4432         eval virtual call is incorrect in the baseline JIT
4433         https://bugs.webkit.org/show_bug.cgi?id=173587
4434         <rdar://problem/32867897>
4435
4436         Reviewed by Michael Saboff.
4437
4438         * stress/do-eval-virtual-call-correctly.js: Added.
4439         (assert):
4440         (f):
4441         (i.test):
4442         (catch):
4443
4444 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
4445
4446         Update test262 test expectations after r218581.