JSTests/ChangeLog

   1 2018-12-10  Mark Lam  <mark.lam@apple.com>
   2
   3         PropertyAttribute needs a CustomValue bit.
   4         https://bugs.webkit.org/show_bug.cgi?id=191993
   5         <rdar://problem/46264467>
   6
   7         Reviewed by Saam Barati.
   8
   9         * stress/regress-191993.js: Added.
  10
  11 2018-12-10  Caio Lima  <ticaiolima@gmail.com>
  12
  13         [BigInt] Add ValueMul into DFG
  14         https://bugs.webkit.org/show_bug.cgi?id=186175
  15
  16         Reviewed by Yusuke Suzuki.
  17
  18         * stress/big-int-mul-jit-osr.js: Added.
  19         * stress/big-int-mul-jit-untyped.js: Added.
  20         * stress/value-mul-fixup-int32-big-int.js: Added.
  21
  22 2018-12-06  Keith Miller  <keith_miller@apple.com>
  23
  24         stress/big-wasm-memory tests failing on 32-bit JSC bot
  25         https://bugs.webkit.org/show_bug.cgi?id=192020
  26
  27         Reviewed by Saam Barati.
  28
  29         Not every platform has WebAssembly, e.g. 32-bit, so we should exit
  30         the wasm stress tests if the WebAssembly object does not exist.
  31
  32         * stress/big-wasm-memory-grow-no-max.js:
  33         (test.foo):
  34         (test):
  35         (foo): Deleted.
  36         (catch): Deleted.
  37         * stress/big-wasm-memory-grow.js:
  38         (test.foo):
  39         (test):
  40         (foo): Deleted.
  41         (catch): Deleted.
  42         * stress/big-wasm-memory.js:
  43         (test.foo):
  44         (test):
  45         (foo): Deleted.
  46         (catch): Deleted.
  47
  48 2018-12-05  Mark Lam  <mark.lam@apple.com>
  49
  50         speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
  51         https://bugs.webkit.org/show_bug.cgi?id=192441
  52         <rdar://problem/46480355>
  53
  54         Reviewed by Saam Barati.
  55
  56         * stress/regress-192441.js: Added.
  57
  58 2018-12-04  Mark Lam  <mark.lam@apple.com>
  59
  60         DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
  61         https://bugs.webkit.org/show_bug.cgi?id=192386
  62         <rdar://problem/46445516>
  63
  64         Reviewed by Saam Barati.
  65
  66         * stress/regress-192386.js: Added.
  67
  68 2018-12-04  Caio Lima  <ticaiolima@gmail.com>
  69
  70         [ESNext][BigInt] Support logic operations
  71         https://bugs.webkit.org/show_bug.cgi?id=179903
  72
  73         Reviewed by Yusuke Suzuki.
  74
  75         * stress/big-int-branch-usage.js: Added.
  76         * stress/big-int-logical-and.js: Added.
  77         * stress/big-int-logical-not.js: Added.
  78         * stress/big-int-logical-or.js: Added.
  79
  80 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
  81
  82         Unreviewed, rolling out r238833.
  83
  84         Breaks macOS and iOS debug builds.
  85
  86         Reverted changeset:
  87
  88         "[ESNext][BigInt] Support logic operations"
  89         https://bugs.webkit.org/show_bug.cgi?id=179903
  90         https://trac.webkit.org/changeset/238833
  91
  92 2018-12-03  Caio Lima  <ticaiolima@gmail.com>
  93
  94         [ESNext][BigInt] Support logic operations
  95         https://bugs.webkit.org/show_bug.cgi?id=179903
  96
  97         Reviewed by Yusuke Suzuki.
  98
  99         * stress/big-int-branch-usage.js: Added.
 100         * stress/big-int-logical-and.js: Added.
 101         * stress/big-int-logical-not.js: Added.
 102         * stress/big-int-logical-or.js: Added.
 103
 104 2018-12-02  Caio Lima  <ticaiolima@gmail.com>
 105
 106         [ESNext][BigInt] Implement support for "<<" and ">>"
 107         https://bugs.webkit.org/show_bug.cgi?id=186233
 108
 109         Reviewed by Yusuke Suzuki.
 110
 111         * stress/big-int-left-shift-general.js: Added.
 112         * stress/big-int-left-shift-range-error.js: Added.
 113         * stress/big-int-left-shift-type-error.js: Added.
 114         * stress/big-int-left-shift-wrapped-value.js: Added.
 115         * stress/big-int-right-shift-general.js: Added.
 116         * stress/big-int-right-shift-type-error.js: Added.
 117         * stress/big-int-right-shift-wrapped-value.js: Added.
 118         * stress/left-shift-to-primitive-precedence.js: Added.
 119         * stress/right-shift-to-primitive-precedence.js: Added.
 120
 121 2018-11-30  Dean Jackson  <dino@apple.com>
 122
 123         Add first-class support for .mjs files in jsc binary
 124         https://bugs.webkit.org/show_bug.cgi?id=192190
 125         <rdar://problem/46375715>
 126
 127         Reviewed by Keith Miller.
 128
 129         * stress/simple-module.mjs: Added.
 130         * stress/simple-script.js: Added.
 131
 132 2018-11-30  Caio Lima  <ticaiolima@gmail.com>
 133
 134         [BigInt] Implement ValueBitXor into DFG
 135         https://bugs.webkit.org/show_bug.cgi?id=190264
 136
 137         Reviewed by Yusuke Suzuki.
 138
 139         * stress/big-int-bitwise-xor-jit.js: Added.
 140         * stress/big-int-bitwise-xor-memory-stress.js: Added.
 141         * stress/big-int-bitwise-xor-untyped.js: Added.
 142
 143 2018-11-27  Saam barati  <sbarati@apple.com>
 144
 145         r238510 broke scopes of size zero
 146         https://bugs.webkit.org/show_bug.cgi?id=192033
 147         <rdar://problem/46281734>
 148
 149         Reviewed by Keith Miller.
 150
 151         * stress/r238510-bad-loop.js: Added.
 152         (foo):
 153
 154 2018-11-27  Mark Lam  <mark.lam@apple.com>
 155
 156         [Re-landing] NaNs read from Wasm code needs to be be purified.
 157         https://bugs.webkit.org/show_bug.cgi?id=191056
 158         <rdar://problem/45660341>
 159
 160         Reviewed by Filip Pizlo.
 161
 162         * wasm/regress/regress-191056.js: Added.
 163
 164 2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>
 165
 166         Unreviewed, rolling out r238509.
 167
 168         Causes JSC tests to fail on iOS.
 169
 170         Reverted changeset:
 171
 172         "NaNs read from Wasm code needs to be be purified."
 173         https://bugs.webkit.org/show_bug.cgi?id=191056
 174         https://trac.webkit.org/changeset/238509
 175
 176 2018-11-26  Caio Lima  <ticaiolima@gmail.com>
 177
 178         Re-introduce op_bitnot
 179         https://bugs.webkit.org/show_bug.cgi?id=190923
 180
 181         Reviewed by Yusuke Suzuki.
 182
 183         * stress/bit-not-must-generate.js: Added.
 184         * stress/bitwise-not-no-int32.js: Added.
 185
 186 2018-11-26  Saam barati  <sbarati@apple.com>
 187
 188         InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
 189         https://bugs.webkit.org/show_bug.cgi?id=191956
 190         <rdar://problem/45665806>
 191
 192         Reviewed by Yusuke Suzuki.
 193
 194         * stress/end-basic-block-set-local-should-filter-type.js: Added.
 195         (bar):
 196         (foo):
 197
 198 2018-11-26  Saam barati  <sbarati@apple.com>
 199
 200         Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
 201         https://bugs.webkit.org/show_bug.cgi?id=191958
 202         <rdar://problem/46221877>
 203
 204         Reviewed by Yusuke Suzuki.
 205
 206         * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
 207         (x):
 208         (foo):
 209
 210 2018-11-26  Mark Lam  <mark.lam@apple.com>
 211
 212         NaNs read from Wasm code needs to be be purified.
 213         https://bugs.webkit.org/show_bug.cgi?id=191056
 214         <rdar://problem/45660341>
 215
 216         Reviewed by Filip Pizlo.
 217
 218         * wasm/regress/regress-191056.js: Added.
 219
 220 2018-11-26  Michael Saboff  <msaboff@apple.com>
 221
 222         32-bit JSC test failure: stress/regexp-compile-oom.js
 223         https://bugs.webkit.org/show_bug.cgi?id=191375
 224
 225         Reviewed by Mark Lam.
 226
 227         Disabled the test for 32 bit platforms.
 228
 229         * stress/regexp-compile-oom.js:
 230
 231 2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
 232
 233         ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
 234         https://bugs.webkit.org/show_bug.cgi?id=191716
 235         <rdar://problem/45723878>
 236
 237         Reviewed by Saam Barati.
 238
 239         * stress/regress-187373.js: Added.
 240         (async.fn):
 241
 242 2018-11-21  Saam barati  <sbarati@apple.com>
 243
 244         DFGSpeculativeJIT should not &= exitOK with mayExit(node)
 245         https://bugs.webkit.org/show_bug.cgi?id=191897
 246         <rdar://problem/45871998>
 247
 248         Reviewed by Mark Lam.
 249
 250         * stress/exitok-is-not-the-same-as-mayExit.js: Added.
 251         (bar):
 252         (foo):
 253
 254 2018-11-21  Saam barati  <sbarati@apple.com>
 255
 256         Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
 257         https://bugs.webkit.org/show_bug.cgi?id=191895
 258         <rdar://problem/46167406>
 259
 260         Reviewed by Mark Lam.
 261
 262         * stress/known-cell-use-needs-type-check-assertion.js: Added.
 263         (foo):
 264         (bar):
 265
 266 2018-11-21  Mark Lam  <mark.lam@apple.com>
 267
 268         Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
 269         https://bugs.webkit.org/show_bug.cgi?id=191776
 270         <rdar://problem/46152851>
 271
 272         Reviewed by Saam Barati.
 273
 274         * stress/big-wasm-memory-grow-no-max.js:
 275         * stress/big-wasm-memory-grow.js:
 276         * stress/big-wasm-memory.js:
 277         - updated these to expect an OutOfMemoryError.
 278
 279         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
 280         (Binary.prototype.emit_u8):
 281         (Binary.prototype.emit_u32v):
 282         (Binary.prototype.emit_header):
 283         (Binary.prototype.emit_section):
 284         (Binary):
 285         (WasmModuleBuilder):
 286         (WasmModuleBuilder.prototype.addMemory):
 287         (WasmModuleBuilder.prototype.toArray):
 288         (WasmModuleBuilder.prototype.toBuffer):
 289         (WasmModuleBuilder.prototype.instantiate):
 290         (catch):
 291         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
 292         (catch):
 293
 294 2018-11-21  Caio Lima  <ticaiolima@gmail.com>
 295
 296         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
 297         https://bugs.webkit.org/show_bug.cgi?id=190836
 298
 299         Reviewed by Saam Barati and Yusuke Suzuki.
 300
 301         * stress/big-int-out-of-memory-tests.js: Added.
 302
 303 2018-11-20  Mark Lam  <mark.lam@apple.com>
 304
 305         Remove invalid assertion in VMTraps::SignalSender's SignalAction.
 306         https://bugs.webkit.org/show_bug.cgi?id=191856
 307         <rdar://problem/46089992>
 308
 309         Reviewed by Yusuke Suzuki.
 310
 311         * stress/regress-191856.js: Added.
 312         - this test is skipped for now until we have a fix for webkit.org/b/191855.
 313
 314 2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>
 315
 316         Enable JIT on ARM/Linux
 317         https://bugs.webkit.org/show_bug.cgi?id=191548
 318
 319         Reviewed by Yusuke Suzuki.
 320
 321         Disable test on system with limited memory. Program was killed by
 322         the OS before the exception was thrown.
 323
 324         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
 325
 326 2018-11-20  Saam barati  <sbarati@apple.com>
 327
 328         Merging an IC variant may lead to the IC status containing overlapping structure sets
 329         https://bugs.webkit.org/show_bug.cgi?id=191869
 330         <rdar://problem/45403453>
 331
 332         Reviewed by Mark Lam.
 333
 334         * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
 335
 336 2018-11-19  Mark Lam  <mark.lam@apple.com>
 337
 338         globalFuncImportModule() should return a promise when it clears exceptions.
 339         https://bugs.webkit.org/show_bug.cgi?id=191792
 340         <rdar://problem/46090763>
 341
 342         Reviewed by Michael Saboff.
 343
 344         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
 345
 346 2018-11-19  Guillaume Emont  <guijemont@igalia.com>
 347
 348         Skip new memory-hungry tests on memory limited devices
 349
 350         Unreviewed gardening.
 351
 352         * stress/big-wasm-memory-grow-no-max.js:
 353         * stress/big-wasm-memory-grow.js:
 354         * stress/big-wasm-memory.js:
 355
 356 2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 357
 358         Unreviewed, rolling in the rest of r237254
 359         https://bugs.webkit.org/show_bug.cgi?id=190340
 360
 361         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
 362         * stress/function-cache-with-parameters-end-position.js: Added.
 363         (shouldBe):
 364         (shouldThrow):
 365         (i.anonymous):
 366         * stress/function-constructor-name.js: Added.
 367         (shouldBe):
 368         (GeneratorFunction):
 369         (AsyncFunction.async):
 370         (AsyncGeneratorFunction.async):
 371         (anonymous):
 372         (async.anonymous):
 373         * test262/expectations.yaml:
 374
 375 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
 376
 377         All users of ArrayBuffer should agree on the same max size
 378         https://bugs.webkit.org/show_bug.cgi?id=191771
 379
 380         Reviewed by Mark Lam.
 381
 382         * stress/big-wasm-memory-grow-no-max.js: Added.
 383         (foo):
 384         (catch):
 385         * stress/big-wasm-memory-grow.js: Added.
 386         (foo):
 387         (catch):
 388         * stress/big-wasm-memory.js: Added.
 389         (foo):
 390         (catch):
 391
 392 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
 393
 394         Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
 395         run for each JSC config since they're regression tests for runtime bugs.
 396
 397         * stress/json-stringified-overflow-2.js:
 398         * stress/json-stringified-overflow.js:
 399
 400 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
 401
 402         Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
 403         config since they're regression tests for runtime bugs.
 404
 405         * stress/large-unshift-splice.js:
 406         * stress/regress-185888.js:
 407
 408 2018-11-16  Saam Barati  <sbarati@apple.com>
 409
 410         KnownCellUse should also have SpecCellCheck as its type filter
 411         https://bugs.webkit.org/show_bug.cgi?id=191729
 412         <rdar://problem/45872852>
 413
 414         Reviewed by Filip Pizlo.
 415
 416         * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
 417         (C):
 418
 419 2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>
 420
 421         Fix assertion failure on BytecodeGenerator::recordOpcode
 422         https://bugs.webkit.org/show_bug.cgi?id=191724
 423         <rdar://problem/45724395>
 424
 425         Reviewed by Saam Barati.
 426
 427         * stress/regress-187373-2.js: Added.
 428         (foo):
 429
 430 2018-11-15  Mark Lam  <mark.lam@apple.com>
 431
 432         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
 433         https://bugs.webkit.org/show_bug.cgi?id=191730
 434         <rdar://problem/46048517>
 435
 436         Reviewed by Saam Barati.
 437
 438         * stress/regress-187006.js: Removed.
 439           - this test is invalid because its sole purpose is to test for the non-spec
 440             compliant behavior that we just fixed.
 441
 442         * stress/regress-191730.js: Added.
 443
 444 2018-11-15  Mark Lam  <mark.lam@apple.com>
 445
 446         RegExp operations should not take fast patch if lastIndex is not numeric.
 447         https://bugs.webkit.org/show_bug.cgi?id=191731
 448         <rdar://problem/46017305>
 449
 450         Reviewed by Saam Barati.
 451
 452         * stress/regress-191731.js: Added.
 453
 454 2018-11-13  Saam Barati  <sbarati@apple.com>
 455
 456         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
 457         https://bugs.webkit.org/show_bug.cgi?id=191600
 458
 459         Reviewed by Mark Lam.
 460
 461         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
 462         (foo):
 463         (test):
 464         (bar):
 465
 466 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
 467
 468         Unreviewed, rolling out r238132.
 469
 470         The test added with this change is timing out on Debug JSC
 471         bots.
 472
 473         Reverted changeset:
 474
 475         "[BigInt] JSBigInt::createWithLength should throw when length
 476         is greater than JSBigInt::maxLength"
 477         https://bugs.webkit.org/show_bug.cgi?id=190836
 478         https://trac.webkit.org/changeset/238132
 479
 480 2018-11-13  Mark Lam  <mark.lam@apple.com>
 481
 482         Add OOM detection to StringPrototype's substituteBackreferences().
 483         https://bugs.webkit.org/show_bug.cgi?id=191563
 484         <rdar://problem/45720428>
 485
 486         Reviewed by Saam Barati.
 487
 488         * stress/regress-191563.js: Added.
 489
 490 2018-11-13  Mark Lam  <mark.lam@apple.com>
 491
 492         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
 493         https://bugs.webkit.org/show_bug.cgi?id=191579
 494         <rdar://problem/45942472>
 495
 496         Reviewed by Saam Barati.
 497
 498         * stress/regress-191579.js: Added.
 499
 500 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
 501
 502         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
 503         https://bugs.webkit.org/show_bug.cgi?id=190836
 504
 505         Reviewed by Saam Barati.
 506
 507         * stress/big-int-out-of-memory-tests.js: Added.
 508
 509 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
 510
 511         U+180E is no longer a whitespace character
 512         https://bugs.webkit.org/show_bug.cgi?id=191415
 513
 514         Reviewed by Saam Barati.
 515
 516         * ChakraCore/test/es5/regexSpace.baseline:
 517         * ChakraCore/test/es6/unicode_whitespace.js:
 518         Update tests to latest version.
 519         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
 520
 521         * test262.yaml:
 522         * test262/config.yaml:
 523         * test262/expectations.yaml:
 524         Update expectations.
 525
 526 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
 527
 528         [BigInt] Add support to BigInt into ValueAdd
 529         https://bugs.webkit.org/show_bug.cgi?id=186177
 530
 531         Reviewed by Keith Miller.
 532
 533         * stress/big-int-negate-jit.js:
 534         * stress/value-add-big-int-and-string.js: Added.
 535         * stress/value-add-big-int-prediction-propagation.js: Added.
 536         * stress/value-add-big-int-untyped.js: Added.
 537
 538 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
 539
 540         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
 541         https://bugs.webkit.org/show_bug.cgi?id=191184
 542
 543         Reviewed by Saam Barati.
 544
 545         Most tests were failing due to timeouts, since they are too slow to
 546         run on CLoop. The exceptions are:
 547
 548         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
 549         dont-crash-on-stack-overflow-when-parsing-builtin.js and
 550         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
 551         to change the stack size since CLoop requires it to be page aligned.
 552
 553         * microbenchmarks/array-push-1.js:
 554         * microbenchmarks/array-push-2.js:
 555         * microbenchmarks/elidable-new-object-dag.js:
 556         * microbenchmarks/elidable-new-object-roflcopter.js:
 557         * microbenchmarks/elidable-new-object-tree.js:
 558         * microbenchmarks/getter-richards.js:
 559         * microbenchmarks/sinkable-new-object-dag.js:
 560         * microbenchmarks/string-concat-long-convert.js:
 561         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
 562         * slowMicrobenchmarks/array-push-3.js:
 563         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
 564         * slowMicrobenchmarks/spread-small-array.js:
 565         * slowMicrobenchmarks/undefined-property-access.js:
 566         * stress/activation-sink-default-value-tdz-error.js:
 567         * stress/activation-sink-default-value.js:
 568         * stress/activation-sink-osrexit-default-value-tdz-error.js:
 569         * stress/activation-sink-osrexit-default-value.js:
 570         * stress/activation-sink-osrexit.js:
 571         * stress/activation-sink.js:
 572         * stress/allow-math-ic-b3-code-duplication.js:
 573         * stress/array-push-multiple-int32.js:
 574         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
 575         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
 576         * stress/arrowfunction-lexical-this-activation-sink.js:
 577         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
 578         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
 579         * stress/elide-new-object-dag-then-exit.js:
 580         * stress/materialize-regexp-cyclic.js:
 581         * stress/new-regex-inline.js:
 582         * stress/op_add.js:
 583         * stress/op_bitand.js:
 584         * stress/op_bitor.js:
 585         * stress/op_bitxor.js:
 586         * stress/op_div-ConstVar.js:
 587         * stress/op_div-VarConst.js:
 588         * stress/op_div-VarVar.js:
 589         * stress/op_lshift-ConstVar.js:
 590         * stress/op_lshift-VarConst.js:
 591         * stress/op_lshift-VarVar.js:
 592         * stress/op_mod-ConstVar.js:
 593         * stress/op_mod-VarConst.js:
 594         * stress/op_mod-VarVar.js:
 595         * stress/op_mul-ConstVar.js:
 596         * stress/op_mul-VarConst.js:
 597         * stress/op_mul-VarVar.js:
 598         * stress/op_rshift-ConstVar.js:
 599         * stress/op_rshift-VarConst.js:
 600         * stress/op_rshift-VarVar.js:
 601         * stress/op_sub-ConstVar.js:
 602         * stress/op_sub-VarConst.js:
 603         * stress/op_sub-VarVar.js:
 604         * stress/op_urshift-ConstVar.js:
 605         * stress/op_urshift-VarConst.js:
 606         * stress/op_urshift-VarVar.js:
 607         * stress/proxy-get-set-correct-receiver.js:
 608         * stress/regress-179562.js:
 609         * stress/rest-parameter-many-arguments.js:
 610         * stress/sampling-profiler-richards.js:
 611         * stress/splay-flash-access-1ms.js:
 612         * stress/tailCallForwardArguments.js:
 613         * stress/typed-array-get-by-val-profiling.js:
 614         * typeProfiler/getter-richards.js:
 615
 616 2018-11-06  Michael Saboff  <msaboff@apple.com>
 617
 618         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
 619         https://bugs.webkit.org/show_bug.cgi?id=191271
 620
 621         Reviewed by Saam Barati.
 622
 623         Added more test cases and made all test cases run with the same deeply recursive stack
 624         instead of finding that same point for each test case.
 625
 626         * stress/regexp-compile-oom.js:
 627         (prototype.runTest):
 628         (recurseAndTest):
 629         (testList.push.new.TestAndExpectedException):
 630
 631 2018-11-05  Michael Saboff  <msaboff@apple.com>
 632
 633         Unreviewed build fix for linux.
 634
 635         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
 636
 637 2018-11-02  Michael Saboff  <msaboff@apple.com>
 638
 639         Rolling in r237753 with unreviewed build fix.
 640
 641         Fixed issues with DECLARE_THROW_SCOPE placement.
 642
 643 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
 644
 645         Unreviewed, rolling out r237753.
 646
 647         Introduced JSC test failures
 648
 649         Reverted changeset:
 650
 651         "Running out of stack space not properly handled in
 652         RegExp::compile() and its callers"
 653         https://bugs.webkit.org/show_bug.cgi?id=191206
 654         https://trac.webkit.org/changeset/237753
 655
 656 2018-11-02  Michael Saboff  <msaboff@apple.com>
 657
 658         Running out of stack space not properly handled in RegExp::compile() and its callers
 659         https://bugs.webkit.org/show_bug.cgi?id=191206
 660
 661         Reviewed by Filip Pizlo.
 662
 663         New regression test.
 664
 665         * stress/regexp-compile-oom.js: Added.
 666         (recurseAndTest):
 667
 668 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
 669
 670         Skip tests on arm/mips that time out now we're running on CLoop
 671
 672         Unreviewed gardening.
 673
 674         Since the JIT is temporarily disabled on 32-bit platforms, these tests
 675         time out on the bots and need to be disabled. There's more tests
 676         disabled on arm because the timeout is longer on the mips bot (as the
 677         device is slower to start with), so many of the tests don't time out
 678         there.
 679
 680         * microbenchmarks/getter-richards.js: disable on arm and mips.
 681         * stress/op_add.js: disable on arm.
 682         * stress/op_bitand.js: disable on arm.
 683         * stress/op_bitor.js: disable on arm.
 684         * stress/op_bitxor.js: disable on arm.
 685         * stress/op_lshift-ConstVar.js: disable on arm.
 686         * stress/op_lshift-VarConst.js: disable on arm.
 687         * stress/op_lshift-VarVar.js: disable on arm.
 688         * stress/op_mod-ConstVar.js: disable on arm.
 689         * stress/op_mod-VarConst.js: disable on arm.
 690         * stress/op_mod-VarVar.js: disable on arm.
 691         * stress/op_mul-ConstVar.js: disable on arm.
 692         * stress/op_mul-VarConst.js: disable on arm.
 693         * stress/op_mul-VarVar.js: disable on arm.
 694         * stress/op_rshift-ConstVar.js: disable on arm.
 695         * stress/op_rshift-VarConst.js: disable on arm.
 696         * stress/op_rshift-VarVar.js: disable on arm.
 697         * stress/op_sub-ConstVar.js: disable on arm.
 698         * stress/op_sub-VarConst.js: disable on arm.
 699         * stress/op_sub-VarVar.js: disable on arm.
 700         * stress/op_urshift-ConstVar.js: disable on arm.
 701         * stress/op_urshift-VarConst.js: disable on arm.
 702         * stress/op_urshift-VarVar.js: disable on arm.
 703         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
 704         * stress/value-to-boolean.js: disable on arm and mips.
 705
 706 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
 707
 708         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
 709         https://bugs.webkit.org/show_bug.cgi?id=191108
 710         <rdar://problem/45690700>
 711
 712         Reviewed by Saam Barati.
 713
 714         * stress/wide-op_catch.js: Added.
 715         (catch):
 716
 717 2018-10-29  Mark Lam  <mark.lam@apple.com>
 718
 719         Correctly detect string overflow when using the 'Function' constructor.
 720         https://bugs.webkit.org/show_bug.cgi?id=184883
 721         <rdar://problem/36320331>
 722
 723         Reviewed by Saam Barati.
 724
 725         I've verified that this passes on 32-bit as well.
 726
 727         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
 728
 729 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
 730
 731         Add support for GetStack FlushedDouble
 732         https://bugs.webkit.org/show_bug.cgi?id=191012
 733         <rdar://problem/45265141>
 734
 735         Reviewed by Saam Barati.
 736
 737         * stress/get-stack-double.js: Added.
 738         (bar):
 739         (noInline):
 740
 741 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
 742
 743         New bytecode format for JSC
 744         https://bugs.webkit.org/show_bug.cgi?id=187373
 745         <rdar://problem/44186758>
 746
 747         Reviewed by Filip Pizlo.
 748
 749         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
 750
 751         * stress/maximum-inline-capacity.js: Added.
 752         (test1):
 753         (test3.Foo):
 754         (test3):
 755
 756 2018-10-26  Commit Queue  <commit-queue@webkit.org>
 757
 758         Unreviewed, rolling out r237479 and r237484.
 759         https://bugs.webkit.org/show_bug.cgi?id=190978
 760
 761         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
 762
 763         Reverted changesets:
 764
 765         "New bytecode format for JSC"
 766         https://bugs.webkit.org/show_bug.cgi?id=187373
 767         https://trac.webkit.org/changeset/237479
 768
 769         "Gardening: Build fix after r237479."
 770         https://bugs.webkit.org/show_bug.cgi?id=187373
 771         https://trac.webkit.org/changeset/237484
 772
 773 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
 774
 775         New bytecode format for JSC
 776         https://bugs.webkit.org/show_bug.cgi?id=187373
 777         <rdar://problem/44186758>
 778
 779         Reviewed by Filip Pizlo.
 780
 781         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
 782
 783         * stress/maximum-inline-capacity.js: Added.
 784         (test1):
 785         (test3.Foo):
 786         (test3):
 787
 788 2018-10-26  Mark Lam  <mark.lam@apple.com>
 789
 790         Fix missing edge cases with JSGlobalObjects having a bad time.
 791         https://bugs.webkit.org/show_bug.cgi?id=189028
 792         <rdar://problem/45204939>
 793
 794         Reviewed by Saam Barati.
 795
 796         * stress/regress-189028.js: Added.
 797
 798 2018-10-22  Mark Lam  <mark.lam@apple.com>
 799
 800         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
 801         https://bugs.webkit.org/show_bug.cgi?id=190515
 802         <rdar://problem/45222379>
 803
 804         Rubber-stamped by Saam Barati.
 805
 806         Adding another test.
 807
 808         * stress/regress-190515-2.js: Added.
 809
 810 2018-10-22  Mark Lam  <mark.lam@apple.com>
 811
 812         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
 813         https://bugs.webkit.org/show_bug.cgi?id=190515
 814         <rdar://problem/45222379>
 815
 816         Reviewed by Saam Barati.
 817
 818         * stress/regress-190515.js: Added.
 819
 820 2018-10-19  Commit Queue  <commit-queue@webkit.org>
 821
 822         Unreviewed, rolling out r237254.
 823         https://bugs.webkit.org/show_bug.cgi?id=190760
 824
 825         "It regresses JetStream 2 by 5% on some iOS devices"
 826         (Requested by saamyjoon on #webkit).
 827
 828         Reverted changeset:
 829
 830         "[JSC] JSC should have "parseFunction" to optimize Function
 831         constructor"
 832         https://bugs.webkit.org/show_bug.cgi?id=190340
 833         https://trac.webkit.org/changeset/237254
 834
 835 2018-10-19  Saam Barati  <sbarati@apple.com>
 836
 837         vmCall should check if we exit before emitting an OSR exit due to exceptions
 838         https://bugs.webkit.org/show_bug.cgi?id=190740
 839         <rdar://problem/45220139>
 840
 841         Reviewed by Mark Lam.
 842
 843         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
 844         (foo):
 845
 846 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
 847
 848         [ESNext][BigInt] Implement support for "^"
 849         https://bugs.webkit.org/show_bug.cgi?id=186235
 850
 851         Reviewed by Yusuke Suzuki.
 852
 853         * stress/big-int-bitwise-xor-general.js: Added.
 854         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
 855         * stress/big-int-bitwise-xor-type-error.js: Added.
 856         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
 857
 858 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
 859
 860         [BigInt] Add ValueSub into DFG
 861         https://bugs.webkit.org/show_bug.cgi?id=186176
 862
 863         Reviewed by Yusuke Suzuki.
 864
 865         * stress/big-int-subtraction-jit.js:
 866         * stress/value-sub-big-int-prediction-propagation.js: Added.
 867         * stress/value-sub-big-int-untyped.js: Added.
 868         * stress/value-sub-spec-none-case.js: Added.
 869
 870 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
 871
 872         [JSC] JSC should have "parseFunction" to optimize Function constructor
 873         https://bugs.webkit.org/show_bug.cgi?id=190340
 874
 875         Reviewed by Mark Lam.
 876
 877         This patch fixes the line number of syntax errors raised by the Function constructor,
 878         since we now parse the final code only once. And we no longer use block statement
 879         for Function constructor's parsing.
 880
 881         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
 882         * stress/function-cache-with-parameters-end-position.js: Added.
 883         (shouldBe):
 884         (shouldThrow):
 885         (i.anonymous):
 886         * stress/function-constructor-name.js: Added.
 887         (shouldBe):
 888         (GeneratorFunction):
 889         (AsyncFunction.async):
 890         (AsyncGeneratorFunction.async):
 891         (anonymous):
 892         (async.anonymous):
 893         * test262/expectations.yaml:
 894
 895 2018-10-18  Commit Queue  <commit-queue@webkit.org>
 896
 897         Unreviewed, rolling out r237242.
 898         https://bugs.webkit.org/show_bug.cgi?id=190701
 899
 900         it breaks "stress/sampling-profiler-basic.js" (Requested by
 901         caiolima on #webkit).
 902
 903         Reverted changeset:
 904
 905         "[BigInt] Add ValueSub into DFG"
 906         https://bugs.webkit.org/show_bug.cgi?id=186176
 907         https://trac.webkit.org/changeset/237242
 908
 909 2018-10-17  Keith Miller  <keith_miller@apple.com>
 910
 911         AI does not clear Phantom allocation nodes.
 912         https://bugs.webkit.org/show_bug.cgi?id=190694
 913
 914         Reviewed by Saam Barati.
 915
 916         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
 917         (Day):
 918         (DaysInYear):
 919         (TimeInYear):
 920         (TimeFromYear):
 921         (DayFromYear):
 922         (InLeapYear):
 923         (YearFromTime):
 924         (WeekDay):
 925         (DaylightSavingTA):
 926         (GetSecondSundayInMarch):
 927         (TimeInMonth):
 928
 929 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
 930
 931         [BigInt] Add ValueSub into DFG
 932         https://bugs.webkit.org/show_bug.cgi?id=186176
 933
 934         Reviewed by Yusuke Suzuki.
 935
 936         * stress/big-int-subtraction-jit.js:
 937         * stress/value-sub-big-int-prediction-propagation.js: Added.
 938         * stress/value-sub-big-int-untyped.js: Added.
 939
 940 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
 941
 942         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
 943         https://bugs.webkit.org/show_bug.cgi?id=190611
 944
 945         Reviewed by Saam Barati.
 946
 947         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
 948         to improve test runtime. On ARM/MIPS this test even timed out when running all
 949         tests.
 950
 951         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
 952         (test):
 953
 954 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
 955
 956         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
 957
 958         Unreviewed gardening.
 959
 960         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
 961
 962 2018-10-15  Saam barati  <sbarati@apple.com>
 963
 964         Emit fjcvtzs on ARM64E on Darwin
 965         https://bugs.webkit.org/show_bug.cgi?id=184023
 966
 967         Reviewed by Yusuke Suzuki and Filip Pizlo.
 968
 969         * stress/double-to-int32-NaN.js: Added.
 970         (assert):
 971         (foo):
 972
 973 2018-10-15  Saam Barati  <sbarati@apple.com>
 974
 975         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
 976         https://bugs.webkit.org/show_bug.cgi?id=190262
 977         <rdar://problem/44986241>
 978
 979         Reviewed by Mark Lam.
 980
 981         * stress/array-prototype-concat-of-long-spliced-arrays.js:
 982         (test):
 983         * stress/slice-array-storage-with-holes.js: Added.
 984         (main):
 985
 986 2018-10-15  Commit Queue  <commit-queue@webkit.org>
 987
 988         Unreviewed, rolling out r237054.
 989         https://bugs.webkit.org/show_bug.cgi?id=190593
 990
 991         "this regressed JetStream 2 by 6% on iOS" (Requested by
 992         saamyjoon on #webkit).
 993
 994         Reverted changeset:
 995
 996         "[JSC] JSC should have "parseFunction" to optimize Function
 997         constructor"
 998         https://bugs.webkit.org/show_bug.cgi?id=190340
 999         https://trac.webkit.org/changeset/237054
1000
1001 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1002
1003         [JSC] JSON.stringify can accept call-with-no-arguments
1004         https://bugs.webkit.org/show_bug.cgi?id=190343
1005
1006         Reviewed by Mark Lam.
1007
1008         * stress/json-stringify-no-arguments.js: Added.
1009         (shouldBe):
1010
1011 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1012
1013         [JSC] JSC should have "parseFunction" to optimize Function constructor
1014         https://bugs.webkit.org/show_bug.cgi?id=190340
1015
1016         Reviewed by Mark Lam.
1017
1018         This patch fixes the line number of syntax errors raised by the Function constructor,
1019         since we now parse the final code only once. And we no longer use block statement
1020         for Function constructor's parsing.
1021
1022         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1023         * stress/function-cache-with-parameters-end-position.js: Added.
1024         (shouldBe):
1025         (shouldThrow):
1026         (i.anonymous):
1027         * stress/function-constructor-name.js: Added.
1028         (shouldBe):
1029         (GeneratorFunction):
1030         (AsyncFunction.async):
1031         (AsyncGeneratorFunction.async):
1032         (anonymous):
1033         (async.anonymous):
1034         * test262/expectations.yaml:
1035
1036 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
1037
1038         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
1039         https://bugs.webkit.org/show_bug.cgi?id=190426
1040
1041         Unreviewed gardening.
1042
1043         * stress/sampling-profiler-richards.js:
1044
1045 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
1046
1047         [ESNext][BigInt] Implement support for "|"
1048         https://bugs.webkit.org/show_bug.cgi?id=186229
1049
1050         Reviewed by Yusuke Suzuki.
1051
1052         * stress/big-int-bitwise-and-jit.js:
1053         * stress/big-int-bitwise-or-general.js: Added.
1054         * stress/big-int-bitwise-or-jit-untyped.js: Added.
1055         * stress/big-int-bitwise-or-jit.js: Added.
1056         * stress/big-int-bitwise-or-memory-stress.js: Added.
1057         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
1058         * stress/big-int-bitwise-or-type-error.js: Added.
1059         * stress/big-int-bitwise-or-wrapped-value.js: Added.
1060
1061 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
1062
1063         Skip test on systems with limited memory
1064         https://bugs.webkit.org/show_bug.cgi?id=190310
1065
1066         Invoking runDefault adds test to runlist, skipping the test in the next
1067         line does not prevent the test from executing. Change order of lines such
1068         that runDefault is only executed if test is not executed.
1069
1070         Reviewed by Mark Lam.
1071
1072         * stress/regress-190187.js:
1073
1074 2018-10-03  Saam barati  <sbarati@apple.com>
1075
1076         lowXYZ in FTLLower should always filter the type of the incoming edge
1077         https://bugs.webkit.org/show_bug.cgi?id=189939
1078         <rdar://problem/44407030>
1079
1080         Reviewed by Michael Saboff.
1081
1082         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
1083         (foo):
1084         (test):
1085
1086 2018-10-03  Mark Lam  <mark.lam@apple.com>
1087
1088         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
1089         https://bugs.webkit.org/show_bug.cgi?id=190187
1090         <rdar://problem/42512909>
1091
1092         Reviewed by Michael Saboff.
1093
1094         * stress/regress-190187.js: Added.
1095
1096 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
1097
1098         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1099         https://bugs.webkit.org/show_bug.cgi?id=190033
1100
1101         Reviewed by Yusuke Suzuki.
1102
1103         * stress/big-int-to-string.js:
1104
1105 2018-10-01  Mark Lam  <mark.lam@apple.com>
1106
1107         Function.toString() should also copy the source code Functions that are class definitions.
1108         https://bugs.webkit.org/show_bug.cgi?id=190186
1109         <rdar://problem/44733360>
1110
1111         Reviewed by Saam Barati.
1112
1113         * stress/regress-190186.js: Added.
1114
1115 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
1116
1117         Split NaN-check into separate test
1118         https://bugs.webkit.org/show_bug.cgi?id=190010
1119
1120         Reviewed by Saam Barati.
1121
1122         DataView exposes NaN-representation, which is not necessarily the same on each
1123         architecture. Therefore move the check of the NaN-representation into its own
1124         file such that we can disable this test on MIPS where NaN-representation can be
1125         different on older CPUs.
1126
1127         * stress/dataview-jit-set-nan.js: Added.
1128         (assert):
1129         (test.storeLittleEndian):
1130         (test.storeBigEndian):
1131         (test.store):
1132         (test):
1133         * stress/dataview-jit-set.js:
1134         (test5):
1135
1136 2018-10-01  Commit Queue  <commit-queue@webkit.org>
1137
1138         Unreviewed, rolling out r236647.
1139         https://bugs.webkit.org/show_bug.cgi?id=190124
1140
1141         Breaking test stress/big-int-to-string.js (Requested by
1142         caiolima_ on #webkit).
1143
1144         Reverted changeset:
1145
1146         "[BigInt] BigInt.proptotype.toString is broken when radix is
1147         power of 2"
1148         https://bugs.webkit.org/show_bug.cgi?id=190033
1149         https://trac.webkit.org/changeset/236647
1150
1151 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
1152
1153         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1154         https://bugs.webkit.org/show_bug.cgi?id=190033
1155
1156         Reviewed by Yusuke Suzuki.
1157
1158         * stress/big-int-to-string.js:
1159
1160 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
1161
1162         [ESNext][BigInt] Implement support for "&"
1163         https://bugs.webkit.org/show_bug.cgi?id=186228
1164
1165         Reviewed by Yusuke Suzuki.
1166
1167         * stress/big-int-bitwise-and-general.js: Added.
1168         (assert):
1169         (assert.sameValue):
1170         * stress/big-int-bitwise-and-jit.js: Added.
1171         (let.assert.sameValue):
1172         (bigIntBitAnd):
1173         * stress/big-int-bitwise-and-memory-stress.js: Added.
1174         (assert):
1175         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
1176         (assert.sameValue):
1177         (let.o.Symbol.toPrimitive):
1178         (catch):
1179         * stress/big-int-bitwise-and-type-error.js: Added.
1180         (assert):
1181         (assertThrowTypeError):
1182         (let.o.valueOf):
1183         (o.valueOf):
1184         (o.toString):
1185         (o.Symbol.toPrimitive):
1186         * stress/big-int-bitwise-and-wrapped-value.js: Added.
1187         (assert.sameValue):
1188         (testBitAnd):
1189         (let.o.Symbol.toPrimitive):
1190         (o.valueOf):
1191         (o.toString):
1192
1193 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
1194
1195         JSC test stress/jsc-read.js doesn't support CRLF
1196         https://bugs.webkit.org/show_bug.cgi?id=190063
1197
1198         Reviewed by Yusuke Suzuki.
1199
1200         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
1201
1202         * stress/jsc-read.js:
1203         (test):
1204
1205 2018-09-27  Saam barati  <sbarati@apple.com>
1206
1207         Verify the contents of AssemblerBuffer on arm64e
1208         https://bugs.webkit.org/show_bug.cgi?id=190057
1209         <rdar://problem/38916630>
1210
1211         Reviewed by Mark Lam.
1212
1213         * stress/regress-189132.js:
1214
1215 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
1216
1217         Disable test without LLInt on ARMv7
1218         https://bugs.webkit.org/show_bug.cgi?id=190037
1219
1220         Reviewed by Mark Lam.
1221
1222         Test runs out of executable memory on ARMv7, do not run
1223         this test without LLInt enabled.
1224
1225         * stress/regress-169445.js:
1226
1227 2018-09-26  Keith Miller  <keith_miller@apple.com>
1228
1229         We should zero unused property storage when rebalancing array storage.
1230         https://bugs.webkit.org/show_bug.cgi?id=188151
1231
1232         Reviewed by Michael Saboff.
1233
1234         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
1235
1236 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1237
1238         [JSC] Optimize Array#lastIndexOf
1239         https://bugs.webkit.org/show_bug.cgi?id=189780
1240
1241         Reviewed by Saam Barati.
1242
1243         * stress/array-lastindexof-array-prototype-trap.js: Added.
1244         (shouldBe):
1245         (AncestorArray.prototype.get 2):
1246         (AncestorArray):
1247         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
1248         (shouldBe):
1249         * stress/array-lastindexof-hole-nan.js: Added.
1250         (shouldBe):
1251         (throw.new.Error):
1252         * stress/array-lastindexof-infinity.js: Added.
1253         (shouldBe):
1254         (throw.new.Error):
1255         * stress/array-lastindexof-negative-zero.js: Added.
1256         (shouldBe):
1257         (throw.new.Error):
1258         * stress/array-lastindexof-own-getter.js: Added.
1259         (shouldBe):
1260         (throw.new.Error.get array):
1261         (get array):
1262         * stress/array-lastindexof-prototype-trap.js: Added.
1263         (shouldBe):
1264         (DerivedArray.prototype.get 2):
1265         (DerivedArray):
1266
1267 2018-09-25  Saam Barati  <sbarati@apple.com>
1268
1269         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
1270         https://bugs.webkit.org/show_bug.cgi?id=189940
1271         <rdar://problem/43640987>
1272
1273         Reviewed by Mark Lam.
1274
1275         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
1276
1277 2018-09-24  Saam Barati  <sbarati@apple.com>
1278
1279         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
1280         https://bugs.webkit.org/show_bug.cgi?id=189922
1281         <rdar://problem/44651275>
1282
1283         Reviewed by Mark Lam.
1284
1285         * stress/array-indexof-fast-path-effects.js: Added.
1286         * stress/array-indexof-cached-length.js: Added.
1287
1288 2018-09-24  Saam barati  <sbarati@apple.com>
1289
1290         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
1291         https://bugs.webkit.org/show_bug.cgi?id=189682
1292         <rdar://problem/43557315>
1293
1294         Reviewed by Mark Lam.
1295
1296         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
1297         (foo):
1298
1299 2018-09-22  Saam barati  <sbarati@apple.com>
1300
1301         The sampling should not use Strong<CodeBlock> in its machineLocation field
1302         https://bugs.webkit.org/show_bug.cgi?id=189319
1303
1304         Reviewed by Filip Pizlo.
1305
1306         * stress/sampling-profiler-richards.js: Added.
1307
1308 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1309
1310         [JSC] Optimize Array#indexOf in C++ runtime
1311         https://bugs.webkit.org/show_bug.cgi?id=189507
1312
1313         Reviewed by Saam Barati.
1314
1315         * stress/array-indexof-array-prototype-trap.js: Added.
1316         (shouldBe):
1317         (AncestorArray.prototype.get 2):
1318         (AncestorArray):
1319         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
1320         (shouldBe):
1321         * stress/array-indexof-hole-nan.js: Added.
1322         (shouldBe):
1323         (throw.new.Error):
1324         * stress/array-indexof-infinity.js: Added.
1325         (shouldBe):
1326         (throw.new.Error):
1327         * stress/array-indexof-negative-zero.js: Added.
1328         (shouldBe):
1329         (throw.new.Error):
1330         * stress/array-indexof-own-getter.js: Added.
1331         (shouldBe):
1332         (throw.new.Error.get array):
1333         (get array):
1334         * stress/array-indexof-prototype-trap.js: Added.
1335         (shouldBe):
1336         (DerivedArray.prototype.get 2):
1337         (DerivedArray):
1338
1339 2018-09-19  Saam barati  <sbarati@apple.com>
1340
1341         AI rule for MultiPutByOffset executes its effects in the wrong order
1342         https://bugs.webkit.org/show_bug.cgi?id=189757
1343         <rdar://problem/43535257>
1344
1345         Reviewed by Michael Saboff.
1346
1347         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
1348         (foo):
1349         (Foo):
1350         (g):
1351
1352 2018-09-17  Mark Lam  <mark.lam@apple.com>
1353
1354         Ensure that ForInContexts are invalidated if their loop local is over-written.
1355         https://bugs.webkit.org/show_bug.cgi?id=189571
1356         <rdar://problem/44402277>
1357
1358         Reviewed by Saam Barati.
1359
1360         * stress/regress-189571.js: Added.
1361
1362 2018-09-17  Saam barati  <sbarati@apple.com>
1363
1364         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
1365         https://bugs.webkit.org/show_bug.cgi?id=189676
1366         <rdar://problem/39682897>
1367
1368         Reviewed by Michael Saboff.
1369
1370         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
1371         (A):
1372         (K):
1373         (i.catch):
1374
1375 2018-09-14  Saam barati  <sbarati@apple.com>
1376
1377         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
1378         https://bugs.webkit.org/show_bug.cgi?id=189628
1379         <rdar://problem/39481690>
1380
1381         Reviewed by Mark Lam.
1382
1383         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
1384         (foo):
1385
1386 2018-09-11  Mark Lam  <mark.lam@apple.com>
1387
1388         Test for array initialization in arrayProtoFuncSplice.
1389         https://bugs.webkit.org/show_bug.cgi?id=170253
1390         <rdar://problem/31328773>
1391
1392         Rubber-stamped by Saam Barati.
1393
1394         * stress/regress-170253.js: Added.
1395
1396 2018-09-11  Mark Lam  <mark.lam@apple.com>
1397
1398         Test for IntlObject initialization.
1399         https://bugs.webkit.org/show_bug.cgi?id=170251
1400         <rdar://problem/31328419>
1401
1402         Rubber-stamped by Saam Barati.
1403
1404         * stress/regress-170251.js: Added.
1405
1406 2018-09-11  Mark Lam  <mark.lam@apple.com>
1407
1408         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
1409         https://bugs.webkit.org/show_bug.cgi?id=169889
1410         <rdar://problem/31155607>
1411
1412         Reviewed by Saam Barati.
1413
1414         * stress/regress-169889-array-concat.js: Added.
1415         * stress/regress-169889-array-concat1.js: Added.
1416         * stress/regress-169889-array-slice.js: Added.
1417
1418 2018-09-11  Mark Lam  <mark.lam@apple.com>
1419
1420         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
1421         https://bugs.webkit.org/show_bug.cgi?id=169445
1422         <rdar://problem/30957435>
1423
1424         Reviewed by Saam Barati.
1425
1426         * stress/regress-169445.js: Added.
1427         (let.gun.eval.A):
1428         (let.gun.eval.B.C):
1429         (let.gun.eval.B.C.prototype.trigger):
1430         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
1431         (let.gun.eval.B):
1432         (let.gun.eval):
1433
1434 == Rolled over to ChangeLog-2018-09-11 ==