PropertyAttribute needs a CustomValue bit.
[WebKit-https.git] / JSTests / ChangeLog
1 2018-12-10  Mark Lam  <mark.lam@apple.com>
2
3         PropertyAttribute needs a CustomValue bit.
4         https://bugs.webkit.org/show_bug.cgi?id=191993
5         <rdar://problem/46264467>
6
7         Reviewed by Saam Barati.
8
9         * stress/regress-191993.js: Added.
10
11 2018-12-10  Caio Lima  <ticaiolima@gmail.com>
12
13         [BigInt] Add ValueMul into DFG
14         https://bugs.webkit.org/show_bug.cgi?id=186175
15
16         Reviewed by Yusuke Suzuki.
17
18         * stress/big-int-mul-jit-osr.js: Added.
19         * stress/big-int-mul-jit-untyped.js: Added.
20         * stress/value-mul-fixup-int32-big-int.js: Added.
21
22 2018-12-06  Keith Miller  <keith_miller@apple.com>
23
24         stress/big-wasm-memory tests failing on 32-bit JSC bot
25         https://bugs.webkit.org/show_bug.cgi?id=192020
26
27         Reviewed by Saam Barati.
28
29         Not every platform has WebAssembly, e.g. 32-bit, so we should exit
30         the wasm stress tests if the WebAssembly object does not exist.
31
32         * stress/big-wasm-memory-grow-no-max.js:
33         (test.foo):
34         (test):
35         (foo): Deleted.
36         (catch): Deleted.
37         * stress/big-wasm-memory-grow.js:
38         (test.foo):
39         (test):
40         (foo): Deleted.
41         (catch): Deleted.
42         * stress/big-wasm-memory.js:
43         (test.foo):
44         (test):
45         (foo): Deleted.
46         (catch): Deleted.
47
48 2018-12-05  Mark Lam  <mark.lam@apple.com>
49
50         speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
51         https://bugs.webkit.org/show_bug.cgi?id=192441
52         <rdar://problem/46480355>
53
54         Reviewed by Saam Barati.
55
56         * stress/regress-192441.js: Added.
57
58 2018-12-04  Mark Lam  <mark.lam@apple.com>
59
60         DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
61         https://bugs.webkit.org/show_bug.cgi?id=192386
62         <rdar://problem/46445516>
63
64         Reviewed by Saam Barati.
65
66         * stress/regress-192386.js: Added.
67
68 2018-12-04  Caio Lima  <ticaiolima@gmail.com>
69
70         [ESNext][BigInt] Support logic operations
71         https://bugs.webkit.org/show_bug.cgi?id=179903
72
73         Reviewed by Yusuke Suzuki.
74
75         * stress/big-int-branch-usage.js: Added.
76         * stress/big-int-logical-and.js: Added.
77         * stress/big-int-logical-not.js: Added.
78         * stress/big-int-logical-or.js: Added.
79
80 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
81
82         Unreviewed, rolling out r238833.
83
84         Breaks macOS and iOS debug builds.
85
86         Reverted changeset:
87
88         "[ESNext][BigInt] Support logic operations"
89         https://bugs.webkit.org/show_bug.cgi?id=179903
90         https://trac.webkit.org/changeset/238833
91
92 2018-12-03  Caio Lima  <ticaiolima@gmail.com>
93
94         [ESNext][BigInt] Support logic operations
95         https://bugs.webkit.org/show_bug.cgi?id=179903
96
97         Reviewed by Yusuke Suzuki.
98
99         * stress/big-int-branch-usage.js: Added.
100         * stress/big-int-logical-and.js: Added.
101         * stress/big-int-logical-not.js: Added.
102         * stress/big-int-logical-or.js: Added.
103
104 2018-12-02  Caio Lima  <ticaiolima@gmail.com>
105
106         [ESNext][BigInt] Implement support for "<<" and ">>"
107         https://bugs.webkit.org/show_bug.cgi?id=186233
108
109         Reviewed by Yusuke Suzuki.
110
111         * stress/big-int-left-shift-general.js: Added.
112         * stress/big-int-left-shift-range-error.js: Added.
113         * stress/big-int-left-shift-type-error.js: Added.
114         * stress/big-int-left-shift-wrapped-value.js: Added.
115         * stress/big-int-right-shift-general.js: Added.
116         * stress/big-int-right-shift-type-error.js: Added.
117         * stress/big-int-right-shift-wrapped-value.js: Added.
118         * stress/left-shift-to-primitive-precedence.js: Added.
119         * stress/right-shift-to-primitive-precedence.js: Added.
120
121 2018-11-30  Dean Jackson  <dino@apple.com>
122
123         Add first-class support for .mjs files in jsc binary
124         https://bugs.webkit.org/show_bug.cgi?id=192190
125         <rdar://problem/46375715>
126
127         Reviewed by Keith Miller.
128
129         * stress/simple-module.mjs: Added.
130         * stress/simple-script.js: Added.
131
132 2018-11-30  Caio Lima  <ticaiolima@gmail.com>
133
134         [BigInt] Implement ValueBitXor into DFG
135         https://bugs.webkit.org/show_bug.cgi?id=190264
136
137         Reviewed by Yusuke Suzuki.
138
139         * stress/big-int-bitwise-xor-jit.js: Added.
140         * stress/big-int-bitwise-xor-memory-stress.js: Added.
141         * stress/big-int-bitwise-xor-untyped.js: Added.
142
143 2018-11-27  Saam barati  <sbarati@apple.com>
144
145         r238510 broke scopes of size zero
146         https://bugs.webkit.org/show_bug.cgi?id=192033
147         <rdar://problem/46281734>
148
149         Reviewed by Keith Miller.
150
151         * stress/r238510-bad-loop.js: Added.
152         (foo):
153
154 2018-11-27  Mark Lam  <mark.lam@apple.com>
155
156         [Re-landing] NaNs read from Wasm code needs to be be purified.
157         https://bugs.webkit.org/show_bug.cgi?id=191056
158         <rdar://problem/45660341>
159
160         Reviewed by Filip Pizlo.
161
162         * wasm/regress/regress-191056.js: Added.
163
164 2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>
165
166         Unreviewed, rolling out r238509.
167
168         Causes JSC tests to fail on iOS.
169
170         Reverted changeset:
171
172         "NaNs read from Wasm code needs to be be purified."
173         https://bugs.webkit.org/show_bug.cgi?id=191056
174         https://trac.webkit.org/changeset/238509
175
176 2018-11-26  Caio Lima  <ticaiolima@gmail.com>
177
178         Re-introduce op_bitnot
179         https://bugs.webkit.org/show_bug.cgi?id=190923
180
181         Reviewed by Yusuke Suzuki.
182
183         * stress/bit-not-must-generate.js: Added.
184         * stress/bitwise-not-no-int32.js: Added.
185
186 2018-11-26  Saam barati  <sbarati@apple.com>
187
188         InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
189         https://bugs.webkit.org/show_bug.cgi?id=191956
190         <rdar://problem/45665806>
191
192         Reviewed by Yusuke Suzuki.
193
194         * stress/end-basic-block-set-local-should-filter-type.js: Added.
195         (bar):
196         (foo):
197
198 2018-11-26  Saam barati  <sbarati@apple.com>
199
200         Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
201         https://bugs.webkit.org/show_bug.cgi?id=191958
202         <rdar://problem/46221877>
203
204         Reviewed by Yusuke Suzuki.
205
206         * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
207         (x):
208         (foo):
209
210 2018-11-26  Mark Lam  <mark.lam@apple.com>
211
212         NaNs read from Wasm code needs to be be purified.
213         https://bugs.webkit.org/show_bug.cgi?id=191056
214         <rdar://problem/45660341>
215
216         Reviewed by Filip Pizlo.
217
218         * wasm/regress/regress-191056.js: Added.
219
220 2018-11-26  Michael Saboff  <msaboff@apple.com>
221
222         32-bit JSC test failure: stress/regexp-compile-oom.js
223         https://bugs.webkit.org/show_bug.cgi?id=191375
224
225         Reviewed by Mark Lam.
226
227         Disabled the test for 32 bit platforms.
228
229         * stress/regexp-compile-oom.js:
230
231 2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
232
233         ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
234         https://bugs.webkit.org/show_bug.cgi?id=191716
235         <rdar://problem/45723878>
236
237         Reviewed by Saam Barati.
238
239         * stress/regress-187373.js: Added.
240         (async.fn):
241
242 2018-11-21  Saam barati  <sbarati@apple.com>
243
244         DFGSpeculativeJIT should not &= exitOK with mayExit(node)
245         https://bugs.webkit.org/show_bug.cgi?id=191897
246         <rdar://problem/45871998>
247
248         Reviewed by Mark Lam.
249
250         * stress/exitok-is-not-the-same-as-mayExit.js: Added.
251         (bar):
252         (foo):
253
254 2018-11-21  Saam barati  <sbarati@apple.com>
255
256         Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
257         https://bugs.webkit.org/show_bug.cgi?id=191895
258         <rdar://problem/46167406>
259
260         Reviewed by Mark Lam.
261
262         * stress/known-cell-use-needs-type-check-assertion.js: Added.
263         (foo):
264         (bar):
265
266 2018-11-21  Mark Lam  <mark.lam@apple.com>
267
268         Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
269         https://bugs.webkit.org/show_bug.cgi?id=191776
270         <rdar://problem/46152851>
271
272         Reviewed by Saam Barati.
273
274         * stress/big-wasm-memory-grow-no-max.js:
275         * stress/big-wasm-memory-grow.js:
276         * stress/big-wasm-memory.js:
277         - updated these to expect an OutOfMemoryError.
278
279         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
280         (Binary.prototype.emit_u8):
281         (Binary.prototype.emit_u32v):
282         (Binary.prototype.emit_header):
283         (Binary.prototype.emit_section):
284         (Binary):
285         (WasmModuleBuilder):
286         (WasmModuleBuilder.prototype.addMemory):
287         (WasmModuleBuilder.prototype.toArray):
288         (WasmModuleBuilder.prototype.toBuffer):
289         (WasmModuleBuilder.prototype.instantiate):
290         (catch):
291         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
292         (catch):
293
294 2018-11-21  Caio Lima  <ticaiolima@gmail.com>
295
296         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
297         https://bugs.webkit.org/show_bug.cgi?id=190836
298
299         Reviewed by Saam Barati and Yusuke Suzuki.
300
301         * stress/big-int-out-of-memory-tests.js: Added.
302
303 2018-11-20  Mark Lam  <mark.lam@apple.com>
304
305         Remove invalid assertion in VMTraps::SignalSender's SignalAction.
306         https://bugs.webkit.org/show_bug.cgi?id=191856
307         <rdar://problem/46089992>
308
309         Reviewed by Yusuke Suzuki.
310
311         * stress/regress-191856.js: Added.
312         - this test is skipped for now until we have a fix for webkit.org/b/191855.
313
314 2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>
315
316         Enable JIT on ARM/Linux
317         https://bugs.webkit.org/show_bug.cgi?id=191548
318
319         Reviewed by Yusuke Suzuki.
320
321         Disable test on system with limited memory. Program was killed by
322         the OS before the exception was thrown.
323
324         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
325
326 2018-11-20  Saam barati  <sbarati@apple.com>
327
328         Merging an IC variant may lead to the IC status containing overlapping structure sets
329         https://bugs.webkit.org/show_bug.cgi?id=191869
330         <rdar://problem/45403453>
331
332         Reviewed by Mark Lam.
333
334         * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
335
336 2018-11-19  Mark Lam  <mark.lam@apple.com>
337
338         globalFuncImportModule() should return a promise when it clears exceptions.
339         https://bugs.webkit.org/show_bug.cgi?id=191792
340         <rdar://problem/46090763>
341
342         Reviewed by Michael Saboff.
343
344         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
345
346 2018-11-19  Guillaume Emont  <guijemont@igalia.com>
347
348         Skip new memory-hungry tests on memory limited devices
349
350         Unreviewed gardening.
351
352         * stress/big-wasm-memory-grow-no-max.js:
353         * stress/big-wasm-memory-grow.js:
354         * stress/big-wasm-memory.js:
355
356 2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
357
358         Unreviewed, rolling in the rest of r237254
359         https://bugs.webkit.org/show_bug.cgi?id=190340
360
361         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
362         * stress/function-cache-with-parameters-end-position.js: Added.
363         (shouldBe):
364         (shouldThrow):
365         (i.anonymous):
366         * stress/function-constructor-name.js: Added.
367         (shouldBe):
368         (GeneratorFunction):
369         (AsyncFunction.async):
370         (AsyncGeneratorFunction.async):
371         (anonymous):
372         (async.anonymous):
373         * test262/expectations.yaml:
374
375 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
376
377         All users of ArrayBuffer should agree on the same max size
378         https://bugs.webkit.org/show_bug.cgi?id=191771
379
380         Reviewed by Mark Lam.
381
382         * stress/big-wasm-memory-grow-no-max.js: Added.
383         (foo):
384         (catch):
385         * stress/big-wasm-memory-grow.js: Added.
386         (foo):
387         (catch):
388         * stress/big-wasm-memory.js: Added.
389         (foo):
390         (catch):
391
392 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
393
394         Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
395         run for each JSC config since they're regression tests for runtime bugs.
396
397         * stress/json-stringified-overflow-2.js:
398         * stress/json-stringified-overflow.js:
399
400 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
401
402         Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
403         config since they're regression tests for runtime bugs.
404
405         * stress/large-unshift-splice.js:
406         * stress/regress-185888.js:
407
408 2018-11-16  Saam Barati  <sbarati@apple.com>
409
410         KnownCellUse should also have SpecCellCheck as its type filter
411         https://bugs.webkit.org/show_bug.cgi?id=191729
412         <rdar://problem/45872852>
413
414         Reviewed by Filip Pizlo.
415
416         * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
417         (C):
418
419 2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>
420
421         Fix assertion failure on BytecodeGenerator::recordOpcode
422         https://bugs.webkit.org/show_bug.cgi?id=191724
423         <rdar://problem/45724395>
424
425         Reviewed by Saam Barati.
426
427         * stress/regress-187373-2.js: Added.
428         (foo):
429
430 2018-11-15  Mark Lam  <mark.lam@apple.com>
431
432         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
433         https://bugs.webkit.org/show_bug.cgi?id=191730
434         <rdar://problem/46048517>
435
436         Reviewed by Saam Barati.
437
438         * stress/regress-187006.js: Removed.
439           - this test is invalid because its sole purpose is to test for the non-spec
440             compliant behavior that we just fixed.
441
442         * stress/regress-191730.js: Added.
443
444 2018-11-15  Mark Lam  <mark.lam@apple.com>
445
446         RegExp operations should not take fast patch if lastIndex is not numeric.
447         https://bugs.webkit.org/show_bug.cgi?id=191731
448         <rdar://problem/46017305>
449
450         Reviewed by Saam Barati.
451
452         * stress/regress-191731.js: Added.
453
454 2018-11-13  Saam Barati  <sbarati@apple.com>
455
456         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
457         https://bugs.webkit.org/show_bug.cgi?id=191600
458
459         Reviewed by Mark Lam.
460
461         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
462         (foo):
463         (test):
464         (bar):
465
466 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
467
468         Unreviewed, rolling out r238132.
469
470         The test added with this change is timing out on Debug JSC
471         bots.
472
473         Reverted changeset:
474
475         "[BigInt] JSBigInt::createWithLength should throw when length
476         is greater than JSBigInt::maxLength"
477         https://bugs.webkit.org/show_bug.cgi?id=190836
478         https://trac.webkit.org/changeset/238132
479
480 2018-11-13  Mark Lam  <mark.lam@apple.com>
481
482         Add OOM detection to StringPrototype's substituteBackreferences().
483         https://bugs.webkit.org/show_bug.cgi?id=191563
484         <rdar://problem/45720428>
485
486         Reviewed by Saam Barati.
487
488         * stress/regress-191563.js: Added.
489
490 2018-11-13  Mark Lam  <mark.lam@apple.com>
491
492         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
493         https://bugs.webkit.org/show_bug.cgi?id=191579
494         <rdar://problem/45942472>
495
496         Reviewed by Saam Barati.
497
498         * stress/regress-191579.js: Added.
499
500 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
501
502         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
503         https://bugs.webkit.org/show_bug.cgi?id=190836
504
505         Reviewed by Saam Barati.
506
507         * stress/big-int-out-of-memory-tests.js: Added.
508
509 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
510
511         U+180E is no longer a whitespace character
512         https://bugs.webkit.org/show_bug.cgi?id=191415
513
514         Reviewed by Saam Barati.
515
516         * ChakraCore/test/es5/regexSpace.baseline:
517         * ChakraCore/test/es6/unicode_whitespace.js:
518         Update tests to latest version.
519         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
520
521         * test262.yaml:
522         * test262/config.yaml:
523         * test262/expectations.yaml:
524         Update expectations.
525
526 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
527
528         [BigInt] Add support to BigInt into ValueAdd
529         https://bugs.webkit.org/show_bug.cgi?id=186177
530
531         Reviewed by Keith Miller.
532
533         * stress/big-int-negate-jit.js:
534         * stress/value-add-big-int-and-string.js: Added.
535         * stress/value-add-big-int-prediction-propagation.js: Added.
536         * stress/value-add-big-int-untyped.js: Added.
537
538 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
539
540         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
541         https://bugs.webkit.org/show_bug.cgi?id=191184
542
543         Reviewed by Saam Barati.
544
545         Most tests were failing due to timeouts, since they are too slow to
546         run on CLoop. The exceptions are:
547
548         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
549         dont-crash-on-stack-overflow-when-parsing-builtin.js and
550         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
551         to change the stack size since CLoop requires it to be page aligned.
552
553         * microbenchmarks/array-push-1.js:
554         * microbenchmarks/array-push-2.js:
555         * microbenchmarks/elidable-new-object-dag.js:
556         * microbenchmarks/elidable-new-object-roflcopter.js:
557         * microbenchmarks/elidable-new-object-tree.js:
558         * microbenchmarks/getter-richards.js:
559         * microbenchmarks/sinkable-new-object-dag.js:
560         * microbenchmarks/string-concat-long-convert.js:
561         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
562         * slowMicrobenchmarks/array-push-3.js:
563         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
564         * slowMicrobenchmarks/spread-small-array.js:
565         * slowMicrobenchmarks/undefined-property-access.js:
566         * stress/activation-sink-default-value-tdz-error.js:
567         * stress/activation-sink-default-value.js:
568         * stress/activation-sink-osrexit-default-value-tdz-error.js:
569         * stress/activation-sink-osrexit-default-value.js:
570         * stress/activation-sink-osrexit.js:
571         * stress/activation-sink.js:
572         * stress/allow-math-ic-b3-code-duplication.js:
573         * stress/array-push-multiple-int32.js:
574         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
575         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
576         * stress/arrowfunction-lexical-this-activation-sink.js:
577         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
578         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
579         * stress/elide-new-object-dag-then-exit.js:
580         * stress/materialize-regexp-cyclic.js:
581         * stress/new-regex-inline.js:
582         * stress/op_add.js:
583         * stress/op_bitand.js:
584         * stress/op_bitor.js:
585         * stress/op_bitxor.js:
586         * stress/op_div-ConstVar.js:
587         * stress/op_div-VarConst.js:
588         * stress/op_div-VarVar.js:
589         * stress/op_lshift-ConstVar.js:
590         * stress/op_lshift-VarConst.js:
591         * stress/op_lshift-VarVar.js:
592         * stress/op_mod-ConstVar.js:
593         * stress/op_mod-VarConst.js:
594         * stress/op_mod-VarVar.js:
595         * stress/op_mul-ConstVar.js:
596         * stress/op_mul-VarConst.js:
597         * stress/op_mul-VarVar.js:
598         * stress/op_rshift-ConstVar.js:
599         * stress/op_rshift-VarConst.js:
600         * stress/op_rshift-VarVar.js:
601         * stress/op_sub-ConstVar.js:
602         * stress/op_sub-VarConst.js:
603         * stress/op_sub-VarVar.js:
604         * stress/op_urshift-ConstVar.js:
605         * stress/op_urshift-VarConst.js:
606         * stress/op_urshift-VarVar.js:
607         * stress/proxy-get-set-correct-receiver.js:
608         * stress/regress-179562.js:
609         * stress/rest-parameter-many-arguments.js:
610         * stress/sampling-profiler-richards.js:
611         * stress/splay-flash-access-1ms.js:
612         * stress/tailCallForwardArguments.js:
613         * stress/typed-array-get-by-val-profiling.js:
614         * typeProfiler/getter-richards.js:
615
616 2018-11-06  Michael Saboff  <msaboff@apple.com>
617
618         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
619         https://bugs.webkit.org/show_bug.cgi?id=191271
620
621         Reviewed by Saam Barati.
622
623         Added more test cases and made all test cases run with the same deeply recursive stack
624         instead of finding that same point for each test case.
625
626         * stress/regexp-compile-oom.js:
627         (prototype.runTest):
628         (recurseAndTest):
629         (testList.push.new.TestAndExpectedException):
630
631 2018-11-05  Michael Saboff  <msaboff@apple.com>
632
633         Unreviewed build fix for linux.
634
635         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
636
637 2018-11-02  Michael Saboff  <msaboff@apple.com>
638
639         Rolling in r237753 with unreviewed build fix.
640
641         Fixed issues with DECLARE_THROW_SCOPE placement.
642
643 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
644
645         Unreviewed, rolling out r237753.
646
647         Introduced JSC test failures
648
649         Reverted changeset:
650
651         "Running out of stack space not properly handled in
652         RegExp::compile() and its callers"
653         https://bugs.webkit.org/show_bug.cgi?id=191206
654         https://trac.webkit.org/changeset/237753
655
656 2018-11-02  Michael Saboff  <msaboff@apple.com>
657
658         Running out of stack space not properly handled in RegExp::compile() and its callers
659         https://bugs.webkit.org/show_bug.cgi?id=191206
660
661         Reviewed by Filip Pizlo.
662
663         New regression test.
664
665         * stress/regexp-compile-oom.js: Added.
666         (recurseAndTest):
667
668 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
669
670         Skip tests on arm/mips that time out now we're running on CLoop
671
672         Unreviewed gardening.
673
674         Since the JIT is temporarily disabled on 32-bit platforms, these tests
675         time out on the bots and need to be disabled. There's more tests
676         disabled on arm because the timeout is longer on the mips bot (as the
677         device is slower to start with), so many of the tests don't time out
678         there.
679
680         * microbenchmarks/getter-richards.js: disable on arm and mips.
681         * stress/op_add.js: disable on arm.
682         * stress/op_bitand.js: disable on arm.
683         * stress/op_bitor.js: disable on arm.
684         * stress/op_bitxor.js: disable on arm.
685         * stress/op_lshift-ConstVar.js: disable on arm.
686         * stress/op_lshift-VarConst.js: disable on arm.
687         * stress/op_lshift-VarVar.js: disable on arm.
688         * stress/op_mod-ConstVar.js: disable on arm.
689         * stress/op_mod-VarConst.js: disable on arm.
690         * stress/op_mod-VarVar.js: disable on arm.
691         * stress/op_mul-ConstVar.js: disable on arm.
692         * stress/op_mul-VarConst.js: disable on arm.
693         * stress/op_mul-VarVar.js: disable on arm.
694         * stress/op_rshift-ConstVar.js: disable on arm.
695         * stress/op_rshift-VarConst.js: disable on arm.
696         * stress/op_rshift-VarVar.js: disable on arm.
697         * stress/op_sub-ConstVar.js: disable on arm.
698         * stress/op_sub-VarConst.js: disable on arm.
699         * stress/op_sub-VarVar.js: disable on arm.
700         * stress/op_urshift-ConstVar.js: disable on arm.
701         * stress/op_urshift-VarConst.js: disable on arm.
702         * stress/op_urshift-VarVar.js: disable on arm.
703         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
704         * stress/value-to-boolean.js: disable on arm and mips.
705
706 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
707
708         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
709         https://bugs.webkit.org/show_bug.cgi?id=191108
710         <rdar://problem/45690700>
711
712         Reviewed by Saam Barati.
713
714         * stress/wide-op_catch.js: Added.
715         (catch):
716
717 2018-10-29  Mark Lam  <mark.lam@apple.com>
718
719         Correctly detect string overflow when using the 'Function' constructor.
720         https://bugs.webkit.org/show_bug.cgi?id=184883
721         <rdar://problem/36320331>
722
723         Reviewed by Saam Barati.
724
725         I've verified that this passes on 32-bit as well.
726
727         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
728
729 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
730
731         Add support for GetStack FlushedDouble
732         https://bugs.webkit.org/show_bug.cgi?id=191012
733         <rdar://problem/45265141>
734
735         Reviewed by Saam Barati.
736
737         * stress/get-stack-double.js: Added.
738         (bar):
739         (noInline):
740
741 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
742
743         New bytecode format for JSC
744         https://bugs.webkit.org/show_bug.cgi?id=187373
745         <rdar://problem/44186758>
746
747         Reviewed by Filip Pizlo.
748
749         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
750
751         * stress/maximum-inline-capacity.js: Added.
752         (test1):
753         (test3.Foo):
754         (test3):
755
756 2018-10-26  Commit Queue  <commit-queue@webkit.org>
757
758         Unreviewed, rolling out r237479 and r237484.
759         https://bugs.webkit.org/show_bug.cgi?id=190978
760
761         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
762
763         Reverted changesets:
764
765         "New bytecode format for JSC"
766         https://bugs.webkit.org/show_bug.cgi?id=187373
767         https://trac.webkit.org/changeset/237479
768
769         "Gardening: Build fix after r237479."
770         https://bugs.webkit.org/show_bug.cgi?id=187373
771         https://trac.webkit.org/changeset/237484
772
773 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
774
775         New bytecode format for JSC
776         https://bugs.webkit.org/show_bug.cgi?id=187373
777         <rdar://problem/44186758>
778
779         Reviewed by Filip Pizlo.
780
781         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
782
783         * stress/maximum-inline-capacity.js: Added.
784         (test1):
785         (test3.Foo):
786         (test3):
787
788 2018-10-26  Mark Lam  <mark.lam@apple.com>
789
790         Fix missing edge cases with JSGlobalObjects having a bad time.
791         https://bugs.webkit.org/show_bug.cgi?id=189028
792         <rdar://problem/45204939>
793
794         Reviewed by Saam Barati.
795
796         * stress/regress-189028.js: Added.
797
798 2018-10-22  Mark Lam  <mark.lam@apple.com>
799
800         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
801         https://bugs.webkit.org/show_bug.cgi?id=190515
802         <rdar://problem/45222379>
803
804         Rubber-stamped by Saam Barati.
805
806         Adding another test.
807
808         * stress/regress-190515-2.js: Added.
809
810 2018-10-22  Mark Lam  <mark.lam@apple.com>
811
812         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
813         https://bugs.webkit.org/show_bug.cgi?id=190515
814         <rdar://problem/45222379>
815
816         Reviewed by Saam Barati.
817
818         * stress/regress-190515.js: Added.
819
820 2018-10-19  Commit Queue  <commit-queue@webkit.org>
821
822         Unreviewed, rolling out r237254.
823         https://bugs.webkit.org/show_bug.cgi?id=190760
824
825         "It regresses JetStream 2 by 5% on some iOS devices"
826         (Requested by saamyjoon on #webkit).
827
828         Reverted changeset:
829
830         "[JSC] JSC should have "parseFunction" to optimize Function
831         constructor"
832         https://bugs.webkit.org/show_bug.cgi?id=190340
833         https://trac.webkit.org/changeset/237254
834
835 2018-10-19  Saam Barati  <sbarati@apple.com>
836
837         vmCall should check if we exit before emitting an OSR exit due to exceptions
838         https://bugs.webkit.org/show_bug.cgi?id=190740
839         <rdar://problem/45220139>
840
841         Reviewed by Mark Lam.
842
843         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
844         (foo):
845
846 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
847
848         [ESNext][BigInt] Implement support for "^"
849         https://bugs.webkit.org/show_bug.cgi?id=186235
850
851         Reviewed by Yusuke Suzuki.
852
853         * stress/big-int-bitwise-xor-general.js: Added.
854         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
855         * stress/big-int-bitwise-xor-type-error.js: Added.
856         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
857
858 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
859
860         [BigInt] Add ValueSub into DFG
861         https://bugs.webkit.org/show_bug.cgi?id=186176
862
863         Reviewed by Yusuke Suzuki.
864
865         * stress/big-int-subtraction-jit.js:
866         * stress/value-sub-big-int-prediction-propagation.js: Added.
867         * stress/value-sub-big-int-untyped.js: Added.
868         * stress/value-sub-spec-none-case.js: Added.
869
870 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
871
872         [JSC] JSC should have "parseFunction" to optimize Function constructor
873         https://bugs.webkit.org/show_bug.cgi?id=190340
874
875         Reviewed by Mark Lam.
876
877         This patch fixes the line number of syntax errors raised by the Function constructor,
878         since we now parse the final code only once. And we no longer use block statement
879         for Function constructor's parsing.
880
881         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
882         * stress/function-cache-with-parameters-end-position.js: Added.
883         (shouldBe):
884         (shouldThrow):
885         (i.anonymous):
886         * stress/function-constructor-name.js: Added.
887         (shouldBe):
888         (GeneratorFunction):
889         (AsyncFunction.async):
890         (AsyncGeneratorFunction.async):
891         (anonymous):
892         (async.anonymous):
893         * test262/expectations.yaml:
894
895 2018-10-18  Commit Queue  <commit-queue@webkit.org>
896
897         Unreviewed, rolling out r237242.
898         https://bugs.webkit.org/show_bug.cgi?id=190701
899
900         it breaks "stress/sampling-profiler-basic.js" (Requested by
901         caiolima on #webkit).
902
903         Reverted changeset:
904
905         "[BigInt] Add ValueSub into DFG"
906         https://bugs.webkit.org/show_bug.cgi?id=186176
907         https://trac.webkit.org/changeset/237242
908
909 2018-10-17  Keith Miller  <keith_miller@apple.com>
910
911         AI does not clear Phantom allocation nodes.
912         https://bugs.webkit.org/show_bug.cgi?id=190694
913
914         Reviewed by Saam Barati.
915
916         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
917         (Day):
918         (DaysInYear):
919         (TimeInYear):
920         (TimeFromYear):
921         (DayFromYear):
922         (InLeapYear):
923         (YearFromTime):
924         (WeekDay):
925         (DaylightSavingTA):
926         (GetSecondSundayInMarch):
927         (TimeInMonth):
928
929 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
930
931         [BigInt] Add ValueSub into DFG
932         https://bugs.webkit.org/show_bug.cgi?id=186176
933
934         Reviewed by Yusuke Suzuki.
935
936         * stress/big-int-subtraction-jit.js:
937         * stress/value-sub-big-int-prediction-propagation.js: Added.
938         * stress/value-sub-big-int-untyped.js: Added.
939
940 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
941
942         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
943         https://bugs.webkit.org/show_bug.cgi?id=190611
944
945         Reviewed by Saam Barati.
946
947         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
948         to improve test runtime. On ARM/MIPS this test even timed out when running all
949         tests.
950
951         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
952         (test):
953
954 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
955
956         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
957
958         Unreviewed gardening.
959
960         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
961
962 2018-10-15  Saam barati  <sbarati@apple.com>
963
964         Emit fjcvtzs on ARM64E on Darwin
965         https://bugs.webkit.org/show_bug.cgi?id=184023
966
967         Reviewed by Yusuke Suzuki and Filip Pizlo.
968
969         * stress/double-to-int32-NaN.js: Added.
970         (assert):
971         (foo):
972
973 2018-10-15  Saam Barati  <sbarati@apple.com>
974
975         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
976         https://bugs.webkit.org/show_bug.cgi?id=190262
977         <rdar://problem/44986241>
978
979         Reviewed by Mark Lam.
980
981         * stress/array-prototype-concat-of-long-spliced-arrays.js:
982         (test):
983         * stress/slice-array-storage-with-holes.js: Added.
984         (main):
985
986 2018-10-15  Commit Queue  <commit-queue@webkit.org>
987
988         Unreviewed, rolling out r237054.
989         https://bugs.webkit.org/show_bug.cgi?id=190593
990
991         "this regressed JetStream 2 by 6% on iOS" (Requested by
992         saamyjoon on #webkit).
993
994         Reverted changeset:
995
996         "[JSC] JSC should have "parseFunction" to optimize Function
997         constructor"
998         https://bugs.webkit.org/show_bug.cgi?id=190340
999         https://trac.webkit.org/changeset/237054
1000
1001 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1002
1003         [JSC] JSON.stringify can accept call-with-no-arguments
1004         https://bugs.webkit.org/show_bug.cgi?id=190343
1005
1006         Reviewed by Mark Lam.
1007
1008         * stress/json-stringify-no-arguments.js: Added.
1009         (shouldBe):
1010
1011 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1012
1013         [JSC] JSC should have "parseFunction" to optimize Function constructor
1014         https://bugs.webkit.org/show_bug.cgi?id=190340
1015
1016         Reviewed by Mark Lam.
1017
1018         This patch fixes the line number of syntax errors raised by the Function constructor,
1019         since we now parse the final code only once. And we no longer use block statement
1020         for Function constructor's parsing.
1021
1022         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1023         * stress/function-cache-with-parameters-end-position.js: Added.
1024         (shouldBe):
1025         (shouldThrow):
1026         (i.anonymous):
1027         * stress/function-constructor-name.js: Added.
1028         (shouldBe):
1029         (GeneratorFunction):
1030         (AsyncFunction.async):
1031         (AsyncGeneratorFunction.async):
1032         (anonymous):
1033         (async.anonymous):
1034         * test262/expectations.yaml:
1035
1036 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
1037
1038         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
1039         https://bugs.webkit.org/show_bug.cgi?id=190426
1040
1041         Unreviewed gardening.
1042
1043         * stress/sampling-profiler-richards.js:
1044
1045 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
1046
1047         [ESNext][BigInt] Implement support for "|"
1048         https://bugs.webkit.org/show_bug.cgi?id=186229
1049
1050         Reviewed by Yusuke Suzuki.
1051
1052         * stress/big-int-bitwise-and-jit.js:
1053         * stress/big-int-bitwise-or-general.js: Added.
1054         * stress/big-int-bitwise-or-jit-untyped.js: Added.
1055         * stress/big-int-bitwise-or-jit.js: Added.
1056         * stress/big-int-bitwise-or-memory-stress.js: Added.
1057         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
1058         * stress/big-int-bitwise-or-type-error.js: Added.
1059         * stress/big-int-bitwise-or-wrapped-value.js: Added.
1060
1061 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
1062
1063         Skip test on systems with limited memory
1064         https://bugs.webkit.org/show_bug.cgi?id=190310
1065
1066         Invoking runDefault adds test to runlist, skipping the test in the next
1067         line does not prevent the test from executing. Change order of lines such
1068         that runDefault is only executed if test is not executed.
1069
1070         Reviewed by Mark Lam.
1071
1072         * stress/regress-190187.js:
1073
1074 2018-10-03  Saam barati  <sbarati@apple.com>
1075
1076         lowXYZ in FTLLower should always filter the type of the incoming edge
1077         https://bugs.webkit.org/show_bug.cgi?id=189939
1078         <rdar://problem/44407030>
1079
1080         Reviewed by Michael Saboff.
1081
1082         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
1083         (foo):
1084         (test):
1085
1086 2018-10-03  Mark Lam  <mark.lam@apple.com>
1087
1088         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
1089         https://bugs.webkit.org/show_bug.cgi?id=190187
1090         <rdar://problem/42512909>
1091
1092         Reviewed by Michael Saboff.
1093
1094         * stress/regress-190187.js: Added.
1095
1096 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
1097
1098         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1099         https://bugs.webkit.org/show_bug.cgi?id=190033
1100
1101         Reviewed by Yusuke Suzuki.
1102
1103         * stress/big-int-to-string.js:
1104
1105 2018-10-01  Mark Lam  <mark.lam@apple.com>
1106
1107         Function.toString() should also copy the source code Functions that are class definitions.
1108         https://bugs.webkit.org/show_bug.cgi?id=190186
1109         <rdar://problem/44733360>
1110
1111         Reviewed by Saam Barati.
1112
1113         * stress/regress-190186.js: Added.
1114
1115 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
1116
1117         Split NaN-check into separate test
1118         https://bugs.webkit.org/show_bug.cgi?id=190010
1119
1120         Reviewed by Saam Barati.
1121
1122         DataView exposes NaN-representation, which is not necessarily the same on each
1123         architecture. Therefore move the check of the NaN-representation into its own
1124         file such that we can disable this test on MIPS where NaN-representation can be
1125         different on older CPUs.
1126
1127         * stress/dataview-jit-set-nan.js: Added.
1128         (assert):
1129         (test.storeLittleEndian):
1130         (test.storeBigEndian):
1131         (test.store):
1132         (test):
1133         * stress/dataview-jit-set.js:
1134         (test5):
1135
1136 2018-10-01  Commit Queue  <commit-queue@webkit.org>
1137
1138         Unreviewed, rolling out r236647.
1139         https://bugs.webkit.org/show_bug.cgi?id=190124
1140
1141         Breaking test stress/big-int-to-string.js (Requested by
1142         caiolima_ on #webkit).
1143
1144         Reverted changeset:
1145
1146         "[BigInt] BigInt.proptotype.toString is broken when radix is
1147         power of 2"
1148         https://bugs.webkit.org/show_bug.cgi?id=190033
1149         https://trac.webkit.org/changeset/236647
1150
1151 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
1152
1153         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1154         https://bugs.webkit.org/show_bug.cgi?id=190033
1155
1156         Reviewed by Yusuke Suzuki.
1157
1158         * stress/big-int-to-string.js:
1159
1160 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
1161
1162         [ESNext][BigInt] Implement support for "&"
1163         https://bugs.webkit.org/show_bug.cgi?id=186228
1164
1165         Reviewed by Yusuke Suzuki.
1166
1167         * stress/big-int-bitwise-and-general.js: Added.
1168         (assert):
1169         (assert.sameValue):
1170         * stress/big-int-bitwise-and-jit.js: Added.
1171         (let.assert.sameValue):
1172         (bigIntBitAnd):
1173         * stress/big-int-bitwise-and-memory-stress.js: Added.
1174         (assert):
1175         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
1176         (assert.sameValue):
1177         (let.o.Symbol.toPrimitive):
1178         (catch):
1179         * stress/big-int-bitwise-and-type-error.js: Added.
1180         (assert):
1181         (assertThrowTypeError):
1182         (let.o.valueOf):
1183         (o.valueOf):
1184         (o.toString):
1185         (o.Symbol.toPrimitive):
1186         * stress/big-int-bitwise-and-wrapped-value.js: Added.
1187         (assert.sameValue):
1188         (testBitAnd):
1189         (let.o.Symbol.toPrimitive):
1190         (o.valueOf):
1191         (o.toString):
1192
1193 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
1194
1195         JSC test stress/jsc-read.js doesn't support CRLF
1196         https://bugs.webkit.org/show_bug.cgi?id=190063
1197
1198         Reviewed by Yusuke Suzuki.
1199
1200         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
1201
1202         * stress/jsc-read.js:
1203         (test):
1204
1205 2018-09-27  Saam barati  <sbarati@apple.com>
1206
1207         Verify the contents of AssemblerBuffer on arm64e
1208         https://bugs.webkit.org/show_bug.cgi?id=190057
1209         <rdar://problem/38916630>
1210
1211         Reviewed by Mark Lam.
1212
1213         * stress/regress-189132.js:
1214
1215 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
1216
1217         Disable test without LLInt on ARMv7
1218         https://bugs.webkit.org/show_bug.cgi?id=190037
1219
1220         Reviewed by Mark Lam.
1221
1222         Test runs out of executable memory on ARMv7, do not run
1223         this test without LLInt enabled.
1224
1225         * stress/regress-169445.js:
1226
1227 2018-09-26  Keith Miller  <keith_miller@apple.com>
1228
1229         We should zero unused property storage when rebalancing array storage.
1230         https://bugs.webkit.org/show_bug.cgi?id=188151
1231
1232         Reviewed by Michael Saboff.
1233
1234         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
1235
1236 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1237
1238         [JSC] Optimize Array#lastIndexOf
1239         https://bugs.webkit.org/show_bug.cgi?id=189780
1240
1241         Reviewed by Saam Barati.
1242
1243         * stress/array-lastindexof-array-prototype-trap.js: Added.
1244         (shouldBe):
1245         (AncestorArray.prototype.get 2):
1246         (AncestorArray):
1247         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
1248         (shouldBe):
1249         * stress/array-lastindexof-hole-nan.js: Added.
1250         (shouldBe):
1251         (throw.new.Error):
1252         * stress/array-lastindexof-infinity.js: Added.
1253         (shouldBe):
1254         (throw.new.Error):
1255         * stress/array-lastindexof-negative-zero.js: Added.
1256         (shouldBe):
1257         (throw.new.Error):
1258         * stress/array-lastindexof-own-getter.js: Added.
1259         (shouldBe):
1260         (throw.new.Error.get array):
1261         (get array):
1262         * stress/array-lastindexof-prototype-trap.js: Added.
1263         (shouldBe):
1264         (DerivedArray.prototype.get 2):
1265         (DerivedArray):
1266
1267 2018-09-25  Saam Barati  <sbarati@apple.com>
1268
1269         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
1270         https://bugs.webkit.org/show_bug.cgi?id=189940
1271         <rdar://problem/43640987>
1272
1273         Reviewed by Mark Lam.
1274
1275         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
1276
1277 2018-09-24  Saam Barati  <sbarati@apple.com>
1278
1279         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
1280         https://bugs.webkit.org/show_bug.cgi?id=189922
1281         <rdar://problem/44651275>
1282
1283         Reviewed by Mark Lam.
1284
1285         * stress/array-indexof-fast-path-effects.js: Added.
1286         * stress/array-indexof-cached-length.js: Added.
1287
1288 2018-09-24  Saam barati  <sbarati@apple.com>
1289
1290         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
1291         https://bugs.webkit.org/show_bug.cgi?id=189682
1292         <rdar://problem/43557315>
1293
1294         Reviewed by Mark Lam.
1295
1296         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
1297         (foo):
1298
1299 2018-09-22  Saam barati  <sbarati@apple.com>
1300
1301         The sampling should not use Strong<CodeBlock> in its machineLocation field
1302         https://bugs.webkit.org/show_bug.cgi?id=189319
1303
1304         Reviewed by Filip Pizlo.
1305
1306         * stress/sampling-profiler-richards.js: Added.
1307
1308 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1309
1310         [JSC] Optimize Array#indexOf in C++ runtime
1311         https://bugs.webkit.org/show_bug.cgi?id=189507
1312
1313         Reviewed by Saam Barati.
1314
1315         * stress/array-indexof-array-prototype-trap.js: Added.
1316         (shouldBe):
1317         (AncestorArray.prototype.get 2):
1318         (AncestorArray):
1319         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
1320         (shouldBe):
1321         * stress/array-indexof-hole-nan.js: Added.
1322         (shouldBe):
1323         (throw.new.Error):
1324         * stress/array-indexof-infinity.js: Added.
1325         (shouldBe):
1326         (throw.new.Error):
1327         * stress/array-indexof-negative-zero.js: Added.
1328         (shouldBe):
1329         (throw.new.Error):
1330         * stress/array-indexof-own-getter.js: Added.
1331         (shouldBe):
1332         (throw.new.Error.get array):
1333         (get array):
1334         * stress/array-indexof-prototype-trap.js: Added.
1335         (shouldBe):
1336         (DerivedArray.prototype.get 2):
1337         (DerivedArray):
1338
1339 2018-09-19  Saam barati  <sbarati@apple.com>
1340
1341         AI rule for MultiPutByOffset executes its effects in the wrong order
1342         https://bugs.webkit.org/show_bug.cgi?id=189757
1343         <rdar://problem/43535257>
1344
1345         Reviewed by Michael Saboff.
1346
1347         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
1348         (foo):
1349         (Foo):
1350         (g):
1351
1352 2018-09-17  Mark Lam  <mark.lam@apple.com>
1353
1354         Ensure that ForInContexts are invalidated if their loop local is over-written.
1355         https://bugs.webkit.org/show_bug.cgi?id=189571
1356         <rdar://problem/44402277>
1357
1358         Reviewed by Saam Barati.
1359
1360         * stress/regress-189571.js: Added.
1361
1362 2018-09-17  Saam barati  <sbarati@apple.com>
1363
1364         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
1365         https://bugs.webkit.org/show_bug.cgi?id=189676
1366         <rdar://problem/39682897>
1367
1368         Reviewed by Michael Saboff.
1369
1370         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
1371         (A):
1372         (K):
1373         (i.catch):
1374
1375 2018-09-14  Saam barati  <sbarati@apple.com>
1376
1377         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
1378         https://bugs.webkit.org/show_bug.cgi?id=189628
1379         <rdar://problem/39481690>
1380
1381         Reviewed by Mark Lam.
1382
1383         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
1384         (foo):
1385
1386 2018-09-11  Mark Lam  <mark.lam@apple.com>
1387
1388         Test for array initialization in arrayProtoFuncSplice.
1389         https://bugs.webkit.org/show_bug.cgi?id=170253
1390         <rdar://problem/31328773>
1391
1392         Rubber-stamped by Saam Barati.
1393
1394         * stress/regress-170253.js: Added.
1395
1396 2018-09-11  Mark Lam  <mark.lam@apple.com>
1397
1398         Test for IntlObject initialization.
1399         https://bugs.webkit.org/show_bug.cgi?id=170251
1400         <rdar://problem/31328419>
1401
1402         Rubber-stamped by Saam Barati.
1403
1404         * stress/regress-170251.js: Added.
1405
1406 2018-09-11  Mark Lam  <mark.lam@apple.com>
1407
1408         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
1409         https://bugs.webkit.org/show_bug.cgi?id=169889
1410         <rdar://problem/31155607>
1411
1412         Reviewed by Saam Barati.
1413
1414         * stress/regress-169889-array-concat.js: Added.
1415         * stress/regress-169889-array-concat1.js: Added.
1416         * stress/regress-169889-array-slice.js: Added.
1417
1418 2018-09-11  Mark Lam  <mark.lam@apple.com>
1419
1420         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
1421         https://bugs.webkit.org/show_bug.cgi?id=169445
1422         <rdar://problem/30957435>
1423
1424         Reviewed by Saam Barati.
1425
1426         * stress/regress-169445.js: Added.
1427         (let.gun.eval.A):
1428         (let.gun.eval.B.C):
1429         (let.gun.eval.B.C.prototype.trigger):
1430         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
1431         (let.gun.eval.B):
1432         (let.gun.eval):
1433
1434 == Rolled over to ChangeLog-2018-09-11 ==