WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binar...
[WebKit-https.git] / JSTests / ChangeLog
1 2017-08-17  JF Bastien  <jfbastien@apple.com>
2
3         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
4         https://bugs.webkit.org/show_bug.cgi?id=175693
5         <rdar://problem/33952443>
6
7         Reviewed by Saam Barati.
8
9         Add a regression directory for WebAssembly tests.
10
11         * wasm.yaml:
12         * wasm/regress/175693.js: Added.
13         (else.else):
14         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
15         (catch):
16         * wasm/regress/175693.wasm: Added.
17
18 2017-08-15  Robin Morisset  <rmorisset@apple.com>
19
20         Support the 'with' keyword in FTL.
21         https://bugs.webkit.org/show_bug.cgi?id=175585
22
23         Reviewed by Saam Barati.
24
25         Also improve the JSTest/stress/with.js file to test
26         what happens when non-objects are passed to with.
27
28         * stress/with.js:
29         (foo):
30         (i.catch):
31         (i.with): Deleted.
32
33 2017-08-14  Keith Miller  <keith_miller@apple.com>
34
35         Add testing tool to lie to the DFG about profiles
36         https://bugs.webkit.org/show_bug.cgi?id=175487
37
38         Reviewed by Saam Barati.
39
40         * stress/compare-eq-incomplete-profile.js: Added.
41         (const.test.createBuiltin):
42
43 2017-08-14  Robin Morisset  <rmorisset@apple.com>
44
45         Support the with keyword in DFG
46         https://bugs.webkit.org/show_bug.cgi?id=175470
47
48         Reviewed by Saam Barati.
49
50         Added a new stress-test for the 'with' keyword, that caught a bug in a
51         previous version of this code.
52
53         * stress/with.js: Added.
54         (i.with):
55
56 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
57
58         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
59         https://bugs.webkit.org/show_bug.cgi?id=175544
60
61         Unreviewed test gardening.
62
63         * ChakraCore.yaml:
64
65 2017-08-09  Caitlin Potter  <caitp@igalia.com>
66
67         Early error on ANY operator before new.target
68         https://bugs.webkit.org/show_bug.cgi?id=157970
69
70         Reviewed by Saam Barati.
71
72         Instead of throwing if any unary operator precedes new.target, only
73         throw if the unary operator updates the reference.
74
75         The following become legal in JSC:
76
77         ```
78         !new.target
79         ~new.target
80         typeof new.target
81         delete new.target
82         void new.target
83         ```
84
85         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
86
87         * stress/new-target-syntax-errors.js:
88         * stress/new-target.js:
89
90 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
91
92         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
93         https://bugs.webkit.org/show_bug.cgi?id=175255
94
95         Unreviewed test gardening.
96
97         * stress/regress-169783.js:
98         * wasm/stress/oom.js:
99
100 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
101
102         REGRESSION: 2 test262/test/language/statements/async-function failures
103         https://bugs.webkit.org/show_bug.cgi?id=175334
104
105         Reviewed by Yusuke Suzuki.
106
107         Add @skip parameters to tests, and remove test for async iterator from 
108         async await syntax test because it is already covered by async-iterator-syntax.js
109
110         * stress/async-await-syntax.js:
111         * stress/async-iteration-syntax.js:
112
113 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
114
115         Unreviewed, gardening test262 for Promise resolve / reject function length
116         https://bugs.webkit.org/show_bug.cgi?id=175333
117
118         * test262.yaml:
119
120 2017-08-07  Robin Morisset  <rmorisset@apple.com>
121
122         GetOwnProperty of TypedArray indexed fields is wrongly configurable
123         https://bugs.webkit.org/show_bug.cgi?id=175307
124
125         Reviewed by Saam Barati.
126
127         * stress/typedarray-getownproperty-not-configurable.js: Added.
128         (assert):
129         (foo):
130
131 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
132
133         Promise resolve and reject function should have length = 1
134         https://bugs.webkit.org/show_bug.cgi?id=175242
135
136         Reviewed by Saam Barati.
137
138         * stress/builtin-function-length.js: Added.
139         (shouldBe):
140         (shouldThrow):
141         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
142         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
143
144 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
145
146         [ESNext] Async iteration - Implement Async Generator - parser
147         https://bugs.webkit.org/show_bug.cgi?id=175210
148
149         Reviewed by Yusuke Suzuki.
150
151         * stress/async-await-syntax.js:
152         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
153         * stress/async-iteration-syntax.js: Added.
154         (assert):
155         (checkSyntax):
156         (checkSyntaxError):
157         (checkSimpleAsyncGeneratorSloppyMode):
158         (checkSimpleAsyncGeneratorStrictMode):
159         (checkNestedAsyncGenerators):
160         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
161         * stress/generator-class-methods-syntax.js:
162
163 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
164
165         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
166         https://bugs.webkit.org/show_bug.cgi?id=175150
167
168         Unreviewed test gardening.
169
170         * wasm/js-api/test_memory_constructor.js:
171
172 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
173
174         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
175         https://bugs.webkit.org/show_bug.cgi?id=175100
176
177         Reviewed by Mark Lam.
178
179         The JSC test JSTests/wasm/stress/oom.js tries to use all the
180         available memory until an out of memory exception happens.
181
182         The Linux kernel is more tuned for server workloads than for GUI
183         responsiveness. When a process tries to use a lot of memory, Linux
184         will do its best to serve the request. This usually translates to
185         free physical RAM by writing to disk dirty pages and/or moving out
186         less recently used pages to swap (disk storage).
187         Meanwhile it does this, the system will become unresponsive and this
188         leads to freezes that can last even some minutes on the worst cases.
189
190         Therefore, let's skip this test on Linux as it will cause more harm
191         than good on the Linux bots or on the machines of Linux developers.
192
193         * wasm/stress/oom.js:
194
195 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
196
197         [JSC] Remove unnecessary print from stress\promise-finally.js test
198         https://bugs.webkit.org/show_bug.cgi?id=175015
199
200         Reviewed by Yusuke Suzuki.
201
202         * stress/promise-finally.js:
203         (p.finally):
204         (then):
205
206 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
207
208         Unreviewed, update test262 results for optional catch binding
209
210         * test262.yaml:
211
212 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
213
214         [JSC] Support optional catch binding
215         https://bugs.webkit.org/show_bug.cgi?id=174981
216
217         Reviewed by Saam Barati.
218
219         * stress/optional-catch-binding-syntax.js: Added.
220         (testSyntax):
221         (testSyntaxError):
222         (catch.catch):
223         * stress/optional-catch-binding.js: Added.
224         (shouldBe):
225         (throwException):
226
227 2017-07-28  Mark Lam  <mark.lam@apple.com>
228
229         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
230         https://bugs.webkit.org/show_bug.cgi?id=174948
231         <rdar://problem/33495680>
232
233         Reviewed by Filip Pizlo.
234
235         * stress/regress-174948.js: Added.
236
237 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
238
239         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
240         https://bugs.webkit.org/show_bug.cgi?id=174900
241
242         Reviewed by Saam Barati.
243
244         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
245         (sideEffect):
246         (args):
247         (test):
248
249 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
250
251         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
252         https://bugs.webkit.org/show_bug.cgi?id=171637
253
254         Reviewed by Darin Adler.
255
256         * stress/domjit-getter-complex-with-incorrect-object.js:
257         (i.shouldThrow):
258         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
259         (shouldBe):
260         (i.shouldThrow):
261
262 2017-07-26  JF Bastien  <jfbastien@apple.com>
263
264         WebAssembly: test throwing out of the start function
265         https://bugs.webkit.org/show_bug.cgi?id=165714
266         <rdar://problem/29760251>
267
268         Reviewed by Keith Miller.
269
270         * wasm/assert.js:
271         * wasm/function-tests/trap-from-start.js: Added.
272         (StartTraps):
273         * wasm/function-tests/trap-from-start-async.js: Added.
274         (async.StartTrapsAsync):
275
276 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
277
278         [FTL] Arguments elimination is suppressed by unreachable blocks
279         https://bugs.webkit.org/show_bug.cgi?id=174352
280
281         Reviewed by Filip Pizlo.
282
283         * stress/arguments-elimination-force-exit.js: Added.
284         (shouldBe):
285         (strict):
286         (sloppy):
287         * stress/arguments-elimination-throw.js: Added.
288         (shouldBe):
289         (shouldThrow):
290         (sloppy):
291         (isArguments):
292
293 2017-07-13  Mark Lam  <mark.lam@apple.com>
294
295         Add some additional test cases for bug 170896.
296         https://bugs.webkit.org/show_bug.cgi?id=174491
297
298         Reviewed by Filip Pizlo.
299
300         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
301         * stress/regress-170896-with-double-shape-profile.js: Added.
302         (test):
303         * stress/regress-170896-with-int32-shape-profile.js: Added.
304         (test):
305         * stress/regress-170896.js: Removed.
306
307 2017-07-13  Saam Barati  <sbarati@apple.com>
308
309         Missing exception check in JSObject::hasInstance
310         https://bugs.webkit.org/show_bug.cgi?id=174455
311         <rdar://problem/31384608>
312
313         Reviewed by Mark Lam.
314
315         * stress/has-instance-exception-check.js: Added.
316         (assert):
317         (let.getter.Object.getOwnPropertyDescriptor.get foo):
318
319 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
320
321         [ESnext] Implement Object Spread
322         https://bugs.webkit.org/show_bug.cgi?id=167963
323
324         Reviewed by Saam Barati.
325
326         * stress/obj-rest-destructuring-order.js: Added.
327         (assert):
328         (o.get z):
329         (o.get a):
330         * stress/obj-spread-order.js: Added.
331         (assert):
332         (o.get z):
333         (o.get a):
334         * stress/object-spread.js: Added.
335         (let.assert):
336         (assert.sameValue):
337         (let.o.get a):
338         (let.obj.get c):
339         (cthulhu.get x):
340         (let.obj.set c):
341         (calls.o.get z):
342         (calls.o.get a):
343         (try.let.obj.get foo):
344         (get calls):
345
346 2017-07-12  Saam Barati  <sbarati@apple.com>
347
348         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
349         https://bugs.webkit.org/show_bug.cgi?id=174411
350         <rdar://problem/31696186>
351
352         Reviewed by Mark Lam.
353
354         * stress/generic-arguments-correct-delete-behavior.js: Added.
355         (assert):
356         (makeTest):
357
358 2017-07-07  Mark Lam  <mark.lam@apple.com>
359
360         \n\r is not the same as \r\n.
361         https://bugs.webkit.org/show_bug.cgi?id=173053
362
363         Reviewed by Keith Miller.
364
365         * stress/regress-173053.js: Added.
366         * stress/template-literal-line-terminators.js:
367
368 2017-07-06  Saam Barati  <sbarati@apple.com>
369
370         We are missing places where we invalidate the for-in context
371         https://bugs.webkit.org/show_bug.cgi?id=174184
372
373         Reviewed by Geoffrey Garen.
374
375         * stress/for-in-invalidate-context-weird-assignments.js: Added.
376         (assert):
377         (test):
378
379 2017-07-05  Saam Barati  <sbarati@apple.com>
380
381         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
382         https://bugs.webkit.org/show_bug.cgi?id=174188
383         <rdar://problem/30581423>
384
385         Reviewed by Mark Lam.
386
387         * stress/new-array-having-a-bad-time-double.js: Added.
388         (assert):
389         (foo):
390
391 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
392
393         WTF::StringImpl::copyChars segfaults when built with GCC 7
394         https://bugs.webkit.org/show_bug.cgi?id=173407
395
396         Reviewed by Andreas Kling.
397
398         * stress/string-repeat-copy-chars-crash.js: Added.
399         (shouldBe):
400
401 2017-07-03  Saam Barati  <sbarati@apple.com>
402
403         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
404
405         * stress/unshiftCountSlowCase-correct-postCapacity.js:
406
407 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
408
409         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
410
411         It requires too much memory.
412
413         * stress/dont-reserve-huge-capacity-lexer.js:
414
415 2017-06-30  Michael Saboff  <msaboff@apple.com>
416
417         Skip a test on ARM64 platform since we run out of address space.
418
419         Rubber stamped by Saam Barati.
420
421         * stress/dont-reserve-huge-capacity-lexer.js:
422
423 2017-06-30  Michael Saboff  <msaboff@apple.com>
424
425         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
426         https://bugs.webkit.org/show_bug.cgi?id=174044
427
428         Reviewed by Oliver Hunt.
429
430         New regression test.
431
432         * stress/regress-174044.js: Added.
433         (test1):
434         (test2):
435
436 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
437
438         RegExpCachedResult::setInput should reify left and right contexts
439         https://bugs.webkit.org/show_bug.cgi?id=173818
440
441         Reviewed by Keith Miller.
442
443         * stress/right-left-context-invalidated-by-input.js: Added.
444         (test.validateContexts):
445         (test):
446
447 2017-06-29  Saam Barati  <sbarati@apple.com>
448
449         Calculating postCapacity in unshiftCountSlowCase is wrong
450         https://bugs.webkit.org/show_bug.cgi?id=173992
451         <rdar://problem/32283199>
452
453         Reviewed by Keith Miller.
454
455         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
456         (temp):
457
458 2017-06-29  Commit Queue  <commit-queue@webkit.org>
459
460         Unreviewed, rolling out r218512.
461         https://bugs.webkit.org/show_bug.cgi?id=173981
462
463         "It changes the behavior of the JS API's JSEvaluateScript
464         which breaks TurboTax" (Requested by saamyjoon on #webkit).
465
466         Reverted changeset:
467
468         "test262: Completion values for control flow do not match the
469         spec"
470         https://bugs.webkit.org/show_bug.cgi?id=171265
471         http://trac.webkit.org/changeset/218512
472
473 2017-06-27  JF Bastien  <jfbastien@apple.com>
474
475         WebAssembly: running out of executable memory should throw OoM
476         https://bugs.webkit.org/show_bug.cgi?id=171537
477         <rdar://problem/32963338>
478
479         Reviewed by Saam Barati.
480
481         * wasm.yaml:
482         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
483         (const.invoke):
484         (failCount.0.catch):
485         (failCount.0.module.undefined.catch):
486         * wasm/lowExecutableMemory/exports-oom.js: Added.
487         (const.type):
488         (const.params):
489         (const.randomProgram):
490         (failCount.0.catch):
491         (failCount.0.module.undefined.catch):
492         * wasm/lowExecutableMemory/imports-oom.js: Added.
493         (const.type):
494         (const.params):
495         (const.randomProgram):
496         (f.imports.push):
497         (failCount.0.catch):
498         (failCount.0.module.undefined.catch):
499
500 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
501
502         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
503         https://bugs.webkit.org/show_bug.cgi?id=167962
504
505         Reviewed by Saam Barati.
506
507         * stress/object-rest-deconstruct.js: Added.
508         (let.assert):
509         (let.assertPropDescriptor):
510         (catch):
511         (get 3):
512         (foo):
513         (let.src.get y):
514         (let.src.set y):
515         (let.gen):
516
517 2017-06-27  Saam Barati  <sbarati@apple.com>
518
519         Function constructor needs to follow the spec and validate parameters and body independently
520         https://bugs.webkit.org/show_bug.cgi?id=173303
521         <rdar://problem/32732526>
522
523         Reviewed by Keith Miller.
524
525         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
526         * stress/function-constructor-semantics.js: Added.
527         (assert):
528         (hasSyntaxError):
529         (foo):
530         (async.foo):
531         (testError):
532         (testOK.toString):
533         (toString):
534
535 2017-06-26  Saam Barati  <sbarati@apple.com>
536
537         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
538         https://bugs.webkit.org/show_bug.cgi?id=173740
539
540         Reviewed by Mark Lam.
541
542         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
543         (Array.prototype.Symbol.iterator):
544
545 2017-06-26  Saam Barati  <sbarati@apple.com>
546
547         Skip a test on 32-bit platforms since we run out of address space.
548
549         Rubber stamped by Mark Lam.
550
551         * stress/dont-reserve-huge-capacity-lexer.js:
552
553 2017-06-26  Saam Barati  <sbarati@apple.com>
554
555         Crash in JSC::Lexer<unsigned char>::setCode
556         https://bugs.webkit.org/show_bug.cgi?id=172754
557
558         Reviewed by Mark Lam.
559
560         * stress/dont-reserve-huge-capacity-lexer.js: Added.
561         (catch):
562
563 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
564
565         [JSC] Clean up Object.entries implementation
566         https://bugs.webkit.org/show_bug.cgi?id=173759
567
568         Reviewed by Sam Weinig.
569
570         * microbenchmarks/object-entries.js: Added.
571         (test):
572
573 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
574
575         Remove Reflect.enumerate
576         https://bugs.webkit.org/show_bug.cgi?id=173806
577
578         Reviewed by Yusuke Suzuki.
579
580         * ChakraCore.yaml:
581         * es6.yaml:
582         These tests now fail because they use Reflect.enumerate.
583
584         * test262.yaml:
585         This test now passes, it checked that Reflect.enumerate is undefined!
586
587         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
588         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
589
590         * stress/reflect-enumerate.js: Removed.
591         Remove a test solely for Reflect.enumerate.
592
593 2017-06-22  Saam Barati  <sbarati@apple.com>
594
595         ValueRep(DoubleRep(@v)) can not simply convert to @v
596         https://bugs.webkit.org/show_bug.cgi?id=173687
597         <rdar://problem/32855563>
598
599         Reviewed by Mark Lam.
600
601         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
602         (i.catch):
603
604 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
605
606         [JSC] Object.values should be implemented in C++
607         https://bugs.webkit.org/show_bug.cgi?id=173703
608
609         Reviewed by Sam Weinig.
610
611         * microbenchmarks/object-keys-map-values.js: Added.
612         (test):
613         * microbenchmarks/object-values.js: Added.
614         (test):
615         * stress/object-values-changing-properties.js: Added.
616         (shouldBe):
617         (throw.new.Error.let.source.get x):
618         (throw.new.Error):
619         (shouldBe.let.handler.get order):
620         (get let):
621         (shouldBe.let.handler.get return):
622         (let.handler.get order):
623
624 2017-06-21  Saam Barati  <sbarati@apple.com>
625
626         eval virtual call is incorrect in the baseline JIT
627         https://bugs.webkit.org/show_bug.cgi?id=173587
628         <rdar://problem/32867897>
629
630         Reviewed by Michael Saboff.
631
632         * stress/do-eval-virtual-call-correctly.js: Added.
633         (assert):
634         (f):
635         (i.test):
636         (catch):
637
638 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
639
640         Update test262 test expectations after r218581.
641
642         Unreviewed test gardening.
643
644         * test262.yaml:
645
646 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
647
648         Revert changes in bug#160417 about extending `null` not being a derived class
649         https://bugs.webkit.org/show_bug.cgi?id=169293
650
651         Reviewed by Saam Barati.
652
653         * stress/class-derived-from-null.js:
654         (assertThrow):
655         (test1):
656         (test2):
657         (test3):
658         (test4):
659         (test5):
660         (test6):
661
662 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
663
664         [DFG] More ArrayIndexOf fixups for various types
665         https://bugs.webkit.org/show_bug.cgi?id=173176
666
667         Reviewed by Saam Barati.
668
669         * stress/array-indexof-arraystorage.js: Added.
670         (shouldBe):
671         (indexOfInt32Other):
672         (indexOfInt32Cell):
673         (indexOfInt32Boolean):
674         (indexOfDoubleOther):
675         (indexOfDoubleCell):
676         (indexOfDoubleBoolean):
677         (indexOfInt32):
678         (indexOfDouble):
679         * stress/array-indexof-constant-folding.js: Added.
680         (shouldBe):
681         (indexOfInt32Other):
682         (indexOfInt32Cell):
683         (indexOfInt32Boolean):
684         (indexOfDoubleOther):
685         (indexOfDoubleCell):
686         (indexOfDoubleBoolean):
687         * stress/array-indexof-hole-and-other.js: Added.
688         (shouldBe):
689         (indexOf):
690         * stress/array-indexof-other.js: Added.
691         (shouldBe):
692         (indexOfInt32):
693         (indexOfDouble):
694         (indexOfString):
695         (indexOfObject):
696         * stress/array-indexof-symbol.js: Added.
697         (shouldBe):
698         (indexOfInt32):
699         (indexOfDouble):
700         (indexOfString):
701         (indexOfObject):
702
703 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
704
705         test262: Completion values for control flow do not match the spec
706         https://bugs.webkit.org/show_bug.cgi?id=171265
707
708         Reviewed by Saam Barati.
709
710         * stress/completion-value.js:
711         Condensed test for completion values in top level statements.
712
713         * stress/super-get-by-id.js:
714         ClassDeclaration when evaled no longer produce values. Convert
715         these to ClassExpressions so they produce the class value.
716         
717         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
718         This is a progression for currect spec behavior.
719
720         * mozilla/mozilla-tests.yaml:
721         This test is now outdated, so mark it as failing for that reason.
722
723         * test262.yaml:
724         Passing all "cptn" completion value tests.
725
726 2017-06-17  Keith Miller  <keith_miller@apple.com>
727
728         ArrayBuffer constructor needs to create subclass structures before its buffer
729         https://bugs.webkit.org/show_bug.cgi?id=173510
730
731         Reviewed by Yusuke Suzuki.
732
733         * test262.yaml:
734
735 2017-06-17  Keith Miller  <keith_miller@apple.com>
736
737         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
738         https://bugs.webkit.org/show_bug.cgi?id=173506
739
740         Reviewed by Ryosuke Niwa.
741
742         Re-baseline tests.
743
744         * ChakraCore/test/Function/apply3.baseline-jsc:
745         * test262.yaml:
746
747 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
748
749         [JSC] Add fast path for Object.assign
750         https://bugs.webkit.org/show_bug.cgi?id=173416
751
752         Reviewed by Mark Lam.
753
754         * stress/object-assign-changing-properties.js: Added.
755         (shouldBe):
756         (throw.new.Error.let.source.get x):
757         (throw.new.Error):
758         (shouldBe.let.source.get x):
759         (shouldBe.let.target.set x):
760         (shouldBe.let.target.get x):
761         * stress/object-assign-proxy.js: Added.
762         (shouldBe):
763         (throw.new.Error.let.handler.get order):
764
765 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
766
767         [JSC] Implement Object.assign in C++
768         https://bugs.webkit.org/show_bug.cgi?id=173414
769
770         Reviewed by Saam Barati.
771
772         * stress/object-assign-string-first.js: Added.
773         (shouldBe):
774         (source.get Symbol):
775         (source.get 1):
776         (source.get cocoa):
777
778 2017-06-14  JF Bastien  <jfbastien@apple.com>
779
780         WebAssembly: remove empty test files
781         https://bugs.webkit.org/show_bug.cgi?id=173382
782
783         Reviewed by Saam Barati.
784
785         The following files:
786                 JSTests/wasm/function-tests/call-indirect-params.js
787                 JSTests/wasm/function-tests/call-indirect.js
788                 JSTests/wasm/js-api/call-indirect-results.js
789         Were changed to empty files in https://trac.webkit.org/changeset/209771
790
791         They were testing call_indirect with the wrong semantics, before
792         we implemented tables. That change implemented tables and
793         therefore removed the erroneous tests.
794
795         We have a few tests for call_indirect which already do the right thing:
796                 JSTests/wasm/function-tests/context-switch.js
797                 JSTests/wasm/function-tests/exceptions.js
798                 JSTests/wasm/function-tests/grow-memory-2.js
799                 JSTests/wasm/function-tests/stack-overflow.js
800                 JSTests/wasm/function-tests/table-basic-2.js
801                 JSTests/wasm/function-tests/table-basic.js
802                 JSTests/wasm/js-api/call-indirect.js
803                 JSTests/wasm/js-api/table.js
804                 JSTests/wasm/js-api/unique-signature.js
805                 JSTests/wasm/js-api/wrapper-function.js
806
807         I also just imported the updated spec tests which, among other
808         things, test call_indirect:
809                 core/br.wast
810                 core/br_table.wast
811                 core/call_indirect.wast
812                 core/func.wast
813                 core/func_ptrs.wast
814                 core/imports.wast
815                 core/left-to-right.wast
816                 core/linking.wast
817                 core/nop.wast
818                 core/return.wast
819                 core/typecheck.wast
820                 core/unreachable.wast
821
822         So I think it's OK to just delete the tests which should just have
823         been deleted back when tables were added.
824
825         * wasm/function-tests/call-indirect-params.js: Removed.
826         * wasm/function-tests/call-indirect.js: Removed.
827         * wasm/js-api/call-indirect-results.js: Removed.
828
829 2017-06-13  JF Bastien  <jfbastien@apple.com>
830
831         WebAssembly: import updated spec tests
832         https://bugs.webkit.org/show_bug.cgi?id=173287
833         <rdar://problem/32725975>
834
835         Reviewed by Saam Barati.
836
837         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
838         with a few modifications so things work.
839
840         Fix a bunch of bugs found through this process, and punt a few tests (which I
841         marked as blocked by this bug).
842
843         Fixes:
844
845         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
846         instead of byte alignment. It was also missing memory-alignment.js despite it
847         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
848         pass.
849
850         Tables can be imported or in a section. There can be only one, but sections can
851         be empty. An Elements section can exist if there's no Table, as long as it is
852         also empty.
853
854         Memories can be imported or in a section. There can be only one, but sections
855         can be empty. A Data section can exist if there's no Memory, as long as it is
856         also empty.
857
858         Prototypes: stringify without .prototype. in the string.
859
860         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
861         not a final size, and throws a RangeError on failure, not a TypeError.
862
863         Fix compile / instantiate so the reject the promise if given an argument of the
864         wrong type (instead of failing instantly).
865
866         Fix async on neuter test.
867
868         Element section shouldn't affect any Table if any of the elements are out of
869         bounds. We need to process it in two passes.
870
871         Segment section shouldn't affect any Data if any of the segments are out of
872         bounds. We need to process it in two passes.
873
874         Empty data segments are valid, but only when there is no memory. Their index
875         still gets validated, and has to be zero.
876
877         Punts:
878
879         Error messages with context, the test seems overly restrictive but this is
880         minor.
881
882         compile/instantiate/validate property descriptors.
883
884         UTF-8 bugs.
885
886         Temporarily disable NaN tests. We need to go back and implement the following
887         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
888         much as getting all the other tests passing.
889
890         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
891         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
892         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
893         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
894         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
895         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
896         why they're not allowed.
897
898         * wasm.yaml:
899         * wasm/function-tests/i32-load8-s.js:
900         * wasm/function-tests/memory-access-past-4gib.js:
901         (const.op.of.WASM.opcodes):
902         * wasm/function-tests/memory-alignment.js: Added.
903         (const.op.of.WASM.opcodes):
904         * wasm/function-tests/memory-section-and-import.js:
905         * wasm/js-api/Module-compile.js:
906         (async.testPromiseAPI):
907         * wasm/js-api/dont-mmap-zero-byte-memory.js:
908         (testMems):
909         * wasm/js-api/element.js:
910         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
911         * wasm/js-api/neutered-inputs.js:
912         (const.testFunction): Deleted.
913         (const.testConstructor): Deleted.
914         * wasm/js-api/table.js:
915         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
916         (new.WebAssembly.Module):
917         (assert.throws):
918         (assertBadTableImport):
919         (assert.throws.WebAssembly.Table.prototype.grow):
920         (assertBadTableInstance): Deleted.
921         * wasm/js-api/test_Data.js:
922         (DataSectionWithoutMemory):
923         * wasm/spec-harness/index.js:
924         (module):
925         (uniqueTest): Deleted.
926         (assert_invalid): Deleted.
927         (assert_soft_invalid): Deleted.
928         (register): Deleted.
929         (call): Deleted.
930         (get instance): Deleted.
931         (exports): Deleted.
932         (run): Deleted.
933         (assert_unlinkable): Deleted.
934         (assert_uninstantiable): Deleted.
935         (assert_trap): Deleted.
936         (try.f): Deleted.
937         (catch): Deleted.
938         (assert_exhaustion): Deleted.
939         (assert_return): Deleted.
940         (assert_return_nan): Deleted.
941         * wasm/spec-harness/testharness.css: Removed.
942         * wasm/spec-harness/testharness.js: Removed.
943         * wasm/spec-harness/testharnessreport.js: Removed.
944         * wasm/spec-harness/wasm-constants.js:
945         (assertTraps):
946         (assertWasmThrows):
947         * wasm/spec-harness/wasm-module-builder.js:
948         (Binary.prototype.emit_section):
949         (Binary):
950         (WasmFunctionBuilder.prototype.addBody):
951         (WasmFunctionBuilder.prototype.end):
952         (WasmFunctionBuilder):
953         (WasmModuleBuilder.prototype.stringToBytes):
954         (WasmModuleBuilder.prototype.addCustomSection):
955         (WasmModuleBuilder.prototype.addFunctionTableInit):
956         (WasmModuleBuilder.prototype.appendToTable):
957         (WasmModuleBuilder.prototype.toArray):
958         (WasmModuleBuilder.prototype.toBuffer):
959         (WasmModuleBuilder.prototype.instantiate):
960         (WasmModuleBuilder):
961         * wasm/spec-tests/address.wast.js:
962         * wasm/spec-tests/align.wast.js: Added.
963         * wasm/spec-tests/binary.wast.js:
964         * wasm/spec-tests/block.wast.js:
965         * wasm/spec-tests/br.wast.js:
966         * wasm/spec-tests/br_if.wast.js:
967         * wasm/spec-tests/br_table.wast.js:
968         * wasm/spec-tests/call.wast.js:
969         * wasm/spec-tests/call_indirect.wast.js:
970         * wasm/spec-tests/comments.wast.js:
971         * wasm/spec-tests/const.wast.js: Added.
972         * wasm/spec-tests/conversions.wast.js: Added.
973         * wasm/spec-tests/custom_section.wast.js:
974         * wasm/spec-tests/exports.wast.js:
975         * wasm/spec-tests/f32.wast.js: Added.
976         * wasm/spec-tests/f64.wast.js: Added.
977         * wasm/spec-tests/fac.wast.js:
978         * wasm/spec-tests/float_exprs.wast.js: Added.
979         * wasm/spec-tests/float_misc.wast.js: Added.
980         * wasm/spec-tests/func.wast.js:
981         * wasm/spec-tests/globals.wast.js:
982         * wasm/spec-tests/if.wast.js:
983         * wasm/spec-tests/imports.wast.js:
984         * wasm/spec-tests/inline-module.wast.js: Added.
985         * wasm/spec-tests/jsapi.js:
986         (testJSAPI.test):
987         (testJSAPI):
988         * wasm/spec-tests/labels.wast.js:
989         * wasm/spec-tests/loop.wast.js:
990         * wasm/spec-tests/memory.wast.js:
991         * wasm/spec-tests/memory_trap.wast.js: Added.
992         * wasm/spec-tests/names.wast.js:
993         * wasm/spec-tests/nop.wast.js:
994         * wasm/spec-tests/return.wast.js:
995         * wasm/spec-tests/stack.wast.js:
996         * wasm/spec-tests/token.wast.js: Added.
997         * wasm/spec-tests/type.wast.js: Added.
998         * wasm/spec-tests/typecheck.wast.js:
999         * wasm/spec-tests/unreachable.wast.js:
1000         * wasm/spec-tests/unreached-invalid.wast.js:
1001         * wasm/spec-tests/unwind.wast.js:
1002         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
1003         * wasm/spec-tests/utf8-import-field.wast.js: Added.
1004         * wasm/spec-tests/utf8-import-module.wast.js: Added.
1005
1006 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
1007
1008         Unreviewed JSC test gardening.
1009
1010         * stress/check-string-ident.js:
1011         * stress/new-largeish-contiguous-array-with-size.js:
1012
1013 2017-06-13  Michael Saboff  <msaboff@apple.com>
1014
1015         DFG doesn't properly handle a property that is change to read only in a prototype
1016         https://bugs.webkit.org/show_bug.cgi?id=173321
1017
1018         Reviewed by Filip Pizlo.
1019
1020         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
1021         * stress/regress-173321.js: Added new regression test.
1022         (shouldBe):
1023         (SimpleObject):
1024         (test):
1025
1026 2017-06-12  Saam Barati  <sbarati@apple.com>
1027
1028         Update test262 test expectation since r218082 makes new tests pass.
1029
1030         * test262.yaml:
1031
1032 2017-06-12  Saam Barati  <sbarati@apple.com>
1033
1034         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
1035         https://bugs.webkit.org/show_bug.cgi?id=172957
1036         <rdar://problem/32602704>
1037
1038         Reviewed by Filip Pizlo.
1039
1040         * stress/spec-empty-flows-through-cell-checks.js: Added.
1041         (A):
1042         (B):
1043         (i.catch):
1044
1045 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
1046
1047         We incorrectly allow escaped characters in keyword tokens
1048         https://bugs.webkit.org/show_bug.cgi?id=171310
1049
1050         Reviewed by Yusuke Suzuki.
1051
1052         * stress/destructuring-assignment-syntax.js:
1053         * stress/error-messages-for-in-operator-should-not-crash.js:
1054         (catch):
1055         * stress/reserved-word-with-escape.js:
1056         (testSyntaxError.String.raw.v):
1057         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
1058         (testSyntaxError.String.raw.a):
1059         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
1060
1061 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1062
1063         [DFG] Add ArrayIndexOf intrinsic
1064         https://bugs.webkit.org/show_bug.cgi?id=172421
1065
1066         Reviewed by Saam Barati.
1067
1068         * stress/array-indexof-array-prototype-change.js: Added.
1069         (shouldBe):
1070         (indexOfInt32):
1071         * stress/array-indexof-have-a-bad-time-getter.js: Added.
1072         (shouldBe):
1073         (indexOfInt32):
1074         * stress/array-indexof-have-a-bad-time.js: Added.
1075         (shouldBe):
1076         (indexOfInt32):
1077         * stress/array-indexof-hole-with-prototype.js: Added.
1078         (shouldBe):
1079         (indexOf):
1080         * stress/array-indexof-hole.js: Added.
1081         (shouldBe):
1082         (indexOf):
1083         * stress/array-indexof-index.js: Added.
1084         (shouldBe):
1085         (indexOfInt32):
1086         (indexOfDouble):
1087         (indexOfString):
1088         (indexOfObject):
1089         (indexOfValue):
1090         * stress/array-indexof-negative-index.js: Added.
1091         (shouldBe):
1092         (indexOfInt32):
1093         (indexOfDouble):
1094         (indexOfString):
1095         (indexOfObject):
1096         (indexOfValue):
1097         * stress/array-indexof-non-int32-start-index.js: Added.
1098         (shouldBe):
1099         (indexOf):
1100         (object.valueOf):
1101         * stress/array-indexof-object-prototype-change.js: Added.
1102         (shouldBe):
1103         (indexOfInt32):
1104         * stress/array-indexof-object.js: Added.
1105         (shouldBe):
1106         (indexOf):
1107         * stress/array-indexof-original-array.js: Added.
1108         (shouldBe):
1109         (indexOfInt32):
1110         * stress/array-indexof-string.js: Added.
1111         (shouldBe):
1112         (indexOf):
1113         * stress/array-indexof-structure-change-convert.js: Added.
1114         (shouldBe):
1115         (indexOf):
1116         * stress/array-indexof-structure-change.js: Added.
1117         (shouldBe):
1118         (indexOf):
1119         * stress/array-indexof.js: Added.
1120         (shouldBe):
1121         (indexOf):
1122
1123 2017-06-11  Keith Miller  <keith_miller@apple.com>
1124
1125         TypedArray constructor with string shouldn't throw
1126         https://bugs.webkit.org/show_bug.cgi?id=173181
1127
1128         Reviewed by JF Bastien.
1129
1130         We should be coercing primitive arguments to numbers in the various
1131         TypedArray constructors.
1132
1133         * stress/typedarray-constructor.js:
1134
1135 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1136
1137         Unreviewed, update test results part 3
1138         https://bugs.webkit.org/show_bug.cgi?id=173227
1139
1140         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
1141
1142 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1143
1144         Unreviewed, update test results part 2
1145         https://bugs.webkit.org/show_bug.cgi?id=173227
1146
1147         * test262.yaml:
1148
1149 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1150
1151         Unreviewed, update test results
1152         https://bugs.webkit.org/show_bug.cgi?id=173227
1153
1154         * microbenchmarks/string-prototype-search-observable-side-effects.js:
1155         * test262.yaml:
1156
1157 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1158
1159         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
1160         https://bugs.webkit.org/show_bug.cgi?id=173227
1161
1162         Reviewed by Mark Lam.
1163
1164         Update the test.
1165
1166         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
1167
1168 2017-06-08  Keith Miller  <keith_miller@apple.com>
1169
1170         WebAssembly: We should only create wrappers for functions that can be exported
1171         https://bugs.webkit.org/show_bug.cgi?id=173088
1172
1173         Reviewed by Saam Barati.
1174
1175         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
1176         on the old testWasmModuleFunctions api, which has been removed.
1177
1178         * wasm/function-tests/copysign.js: Removed.
1179         * wasm/function-tests/ctz.js: Removed.
1180         * wasm/function-tests/drop.js: Removed.
1181         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
1182         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
1183         * wasm/function-tests/dumb-less-than-ite.js: Removed.
1184         * wasm/function-tests/eqz.js: Removed.
1185         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
1186         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
1187         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
1188         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
1189         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
1190         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
1191         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
1192         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
1193         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
1194         * wasm/function-tests/if-then-fallthrough.js: Removed.
1195         * wasm/function-tests/int-to-floating-point.js: Removed.
1196         * wasm/function-tests/loop-mult.js:
1197         * wasm/function-tests/loop-sum.js:
1198         * wasm/function-tests/max.js: Removed.
1199         * wasm/function-tests/min.js: Removed.
1200         * wasm/function-tests/nearest.js: Removed.
1201         * wasm/function-tests/nop.js: Removed.
1202         * wasm/function-tests/popcnt.js: Removed.
1203         * wasm/function-tests/ret5.js:
1204         * wasm/function-tests/select.js: Removed.
1205         * wasm/function-tests/tee-local.js: Removed.
1206         * wasm/function-tests/trunc.js: Removed.
1207
1208 2017-06-07  JF Bastien  <jfbastien@apple.com>
1209
1210         WebAssembly: test imports and exports with 16-bit characters
1211         https://bugs.webkit.org/show_bug.cgi?id=165977
1212         <rdar://problem/29760130>
1213
1214         Reviewed by Saam Barati.
1215
1216         The output for import failure was improved, so many tests need to
1217         be updated here. Only one has new tests as noted below.
1218
1219         * wasm/function-tests/memory-import-and-grow.js:
1220         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
1221         (idxModule):
1222         * wasm/js-api/global-error.js:
1223         (new.Number):
1224         (assert.throws):
1225         * wasm/js-api/table.js:
1226         (assert.throws):
1227         (new.WebAssembly.Table):
1228         * wasm/js-api/test_memory.js:
1229         (test):
1230         * wasm/js-api/wasm-to-wasm-bad-signature.js:
1231         (BadSignatureDropStartParams.):
1232         (BadSignatureDropStartParams):
1233         (BadSignatureDropEndParams.):
1234         (BadSignatureSwapParam.):
1235         (BadSignatureRet.):
1236         * wasm/js-api/web-assembly-instantiate.js:
1237         (assert.asyncTest.async.test):
1238         (assert.asyncTest):
1239         * wasm/js-api/wrapper-function.js:
1240         (return.new.WebAssembly.Module):
1241
1242 2017-06-07  Mark Lam  <mark.lam@apple.com>
1243
1244         Restrict the regress-173035.js test to only run on Darwin x86-64.
1245         https://bugs.webkit.org/show_bug.cgi?id=173075
1246
1247         Reviewed by Saam Barati.
1248
1249         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
1250         this test will require to succeed.  Here's an example of this failure:
1251         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
1252
1253         Since the issue is due to allocation of a very large amount of memory, the test
1254         will probably fail on iOS and other platforms as well.  Hence, we should just
1255         skip this test for any platforms that is not Darwin x86-64.
1256
1257         * stress/regress-173035.js:
1258
1259 2017-06-07  Mark Lam  <mark.lam@apple.com>
1260
1261         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
1262         https://bugs.webkit.org/show_bug.cgi?id=168587
1263
1264         Not reviewed.
1265
1266         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
1267
1268         * stress/test-finally.js:
1269
1270 2017-06-06  Mark Lam  <mark.lam@apple.com>
1271
1272         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
1273         https://bugs.webkit.org/show_bug.cgi?id=173035
1274         <rdar://problem/32554593>
1275
1276         Reviewed by Geoffrey Garen and Filip Pizlo.
1277
1278         * stress/regress-173035.js: Added.
1279
1280 2017-06-06  Saam Barati  <sbarati@apple.com>
1281
1282         Make sure we restore SP when doing calls that could be to JS
1283         https://bugs.webkit.org/show_bug.cgi?id=172946
1284         <rdar://problem/32579026>
1285
1286         Reviewed by JF Bastien.
1287
1288         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
1289         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
1290         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
1291         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
1292         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
1293
1294 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
1295
1296         Unreviewed rollout r217807. Caused a test to crash.
1297
1298         * heapProfiler/class-names.js: Removed.
1299         * heapProfiler/driver/driver.js:
1300         (CheapHeapSnapshotNode):
1301         (CheapHeapSnapshot):
1302         (createCheapHeapSnapshot):
1303         (HeapSnapshot):
1304         (createHeapSnapshot):
1305         * typeProfiler/inheritance.js:
1306         (wrapper.A):
1307         (wrapper.B):
1308         (wrapper.C):
1309         (wrapper):
1310
1311 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
1312
1313         index out of bound in bytecodebasicblock
1314         https://bugs.webkit.org/show_bug.cgi?id=172963
1315
1316         Reviewed by Saam Barati and Mark Lam.
1317
1318         * stress/dfg-call-class-constructor.js: Added.
1319         (Foo):
1320         (i.catch):
1321
1322 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
1323
1324         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
1325         https://bugs.webkit.org/show_bug.cgi?id=172848
1326         <rdar://problem/25709212>
1327
1328         Reviewed by Saam Barati.
1329
1330         * typeProfiler/inheritance.js:
1331         Rewrite the test slightly for clarity. The hoisting was confusing.
1332
1333         * heapProfiler/class-names.js: Added.
1334         (MyES5Class):
1335         (MyES6Class):
1336         (MyES6Subclass):
1337         Test object types and improved class names.
1338
1339         * heapProfiler/driver/driver.js:
1340         (CheapHeapSnapshotNode):
1341         (CheapHeapSnapshot):
1342         (createCheapHeapSnapshot):
1343         (HeapSnapshot):
1344         (createHeapSnapshot):
1345         Update snapshot parsing from version 1 to version 2.
1346
1347 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1348
1349         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
1350         https://bugs.webkit.org/show_bug.cgi?id=168844
1351
1352         Reviewed by Saam Barati.
1353
1354         * modules/async-function-export.js: Added.
1355         (f):
1356         (export.async.f):
1357
1358 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1359
1360         ES2015 modules - Export default function hoisting
1361         https://bugs.webkit.org/show_bug.cgi?id=170174
1362
1363         Reviewed by Saam Barati.
1364
1365         This issue itself is solved by fixing function declaration hoisting rules.
1366         This patch just adds the specific test to modules tests to ensure the bug
1367         is fixed.
1368
1369         * modules/export-default-function-hoisting.js: Added.
1370         * modules/export-default-function-hoisting/cappuccino.js: Added.
1371         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
1372         * modules/export-default-function-hoisting/cocoa.js: Added.
1373         (export.default.drinkCocoa):
1374
1375 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1376
1377         Class Proxy can't be extended
1378         https://bugs.webkit.org/show_bug.cgi?id=169040
1379
1380         Reviewed by Saam Barati.
1381
1382         Adding tests that check correctness of Proxy to ES6 `class`
1383         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
1384
1385         * stress/proxy-class.js: Added.
1386         (assert):
1387         (throw.new.Error.SuperClass):
1388         (throw.new.Error.A):
1389         (throw.new.Error):
1390
1391 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1392
1393         [JSC] Implement String.prototype.concat in JS builtins
1394         https://bugs.webkit.org/show_bug.cgi?id=172798
1395
1396         Reviewed by Sam Weinig.
1397
1398         * microbenchmarks/string-concat-convert.js: Added.
1399         (test):
1400         * microbenchmarks/string-concat-long-convert.js: Added.
1401         (test):
1402         * microbenchmarks/string-concat-long.js: Added.
1403         (test):
1404         * microbenchmarks/string-concat.js: Added.
1405         (test):
1406
1407 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
1408
1409         Rolling out: Prevent async methods named 'function'
1410         https://bugs.webkit.org/show_bug.cgi?id=172776
1411
1412         Reviewed by Mark Lam.
1413
1414         * stress/async-await-syntax.js:
1415         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1416         (testTopLevelAsyncAwaitSyntaxSloppyMode):
1417         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
1418         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1419         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
1420
1421 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
1422
1423         Skip flaky JSC test stress/test-finally.js
1424         https://bugs.webkit.org/show_bug.cgi?id=168587
1425
1426         Unreviewed test gardening.
1427
1428         * stress/test-finally.js:
1429
1430 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
1431
1432         Prevent async methods named 'function' in Object literal
1433         https://bugs.webkit.org/show_bug.cgi?id=172660
1434
1435         Reviewed by Saam Barati.
1436
1437         * stress/async-await-syntax.js:
1438         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
1439
1440 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
1441
1442         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
1443         https://bugs.webkit.org/show_bug.cgi?id=171274
1444
1445         Reviewed by Saam Barati.
1446
1447         * stress/async-arrow-functions-lexical-binding-in-class.js:
1448         (shouldBeAsync):
1449         (shouldBeAsyncAndStoreBind):
1450         (promise.new.Promise):
1451         (ChildClass4):
1452         (ChildClass4.prototype.classValue):
1453         (ChildClass4.prototype.get classProperty):
1454         * stress/async-arrow-functions-lexical-super-binding.js:
1455         (A):
1456         (const.childA1.new.prototype.var.f.async):
1457         (const.childA1.new.var):
1458         (const.childA1.new):
1459         (const.childA2.new.prototype.var.f.async):
1460         (const.childA2.new.var):
1461         (const.childA2.new):
1462         (const.childA3.new.prototype.var.f.async):
1463         (const.childA3.new.var):
1464         (const.childA3.new):
1465         (try.childA4.new.prototype.var.f.async):
1466         (try.childA4.new.var):
1467         (try.childA4.new):
1468         (catch):
1469         (const.childA5.new.prototype.var.f.async):
1470         (const.childA5.new.var):
1471         (const.childA5.new):
1472         (checkClass):
1473         (checkClass.new.prototype.var.f.async):
1474         (checkClass.new.var):
1475         (checkClass.new):
1476         (checkClass.new.prototype.method):
1477         (checkClass.new.prototype.prop):
1478
1479 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1480
1481         [JSC] Map and Set constructors should have fast path for cloning
1482         https://bugs.webkit.org/show_bug.cgi?id=172413
1483
1484         Reviewed by Saam Barati.
1485
1486         * stress/map-clone-instance-iterator-change.js: Added.
1487         (shouldBe):
1488         (map.Symbol.iterator):
1489         * stress/map-clone-iterator-change.js: Added.
1490         (shouldBe):
1491         (Map.prototype.Symbol.iterator):
1492         * stress/map-clone-next-change.js: Added.
1493         (shouldBe):
1494         (map.Symbol.iterator.__proto__.next):
1495         * stress/map-clone.js: Added.
1496         (shouldBe):
1497         (Map.prototype):
1498         * stress/map-inherit-set.js: Added.
1499         (shouldBe):
1500         (DerivedMap):
1501         (set for):
1502         * stress/set-clone-instance-iterator-change.js: Added.
1503         (shouldBe):
1504         (set Symbol.iterator):
1505         * stress/set-clone-iterator-change.js: Added.
1506         (shouldBe):
1507         (set Set.prototype.Symbol.iterator):
1508         * stress/set-clone-next-change.js: Added.
1509         (shouldBe):
1510         (set Symbol.iterator.__proto__.next):
1511         * stress/set-clone.js: Added.
1512         (shouldBe):
1513         (set Set.prototype.add):
1514         * stress/set-inherit-add.js: Added.
1515         (shouldBe):
1516         (DerivedSet.set add):
1517
1518 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
1519
1520         Unreviewed, rolling out r217458.
1521
1522         This change caused 55 JSC test failures.
1523
1524         Reverted changeset:
1525
1526         "Date should use historical data if it's available."
1527         https://bugs.webkit.org/show_bug.cgi?id=172592
1528         http://trac.webkit.org/changeset/217458
1529
1530 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1531
1532         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
1533         https://bugs.webkit.org/show_bug.cgi?id=167805
1534
1535         Reviewed by Saam Barati.
1536
1537         * modules/module-jit-reachability.js: Added.
1538
1539 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
1540
1541         Prevent async methods named 'function'
1542         https://bugs.webkit.org/show_bug.cgi?id=172598
1543
1544         Reviewed by Mark Lam.
1545
1546         * stress/async-await-syntax.js:
1547         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1548         (testTopLevelAsyncAwaitSyntaxSloppyMode):
1549         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
1550         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1551         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
1552
1553 2017-05-25  Keith Miller  <keith_miller@apple.com>
1554
1555         Date should use historical data if it's available.
1556         https://bugs.webkit.org/show_bug.cgi?id=172592
1557
1558         Reviewed by Mark Lam.
1559
1560         Remove parts of the date tests that rely on the absence of
1561         historical data in Date.
1562
1563         * mozilla/ecma/Date/15.9.5.31-1.js:
1564         (getTestCases):
1565         * mozilla/ecma/Date/15.9.5.35-1.js:
1566         (getTestCases):
1567
1568 2017-05-25  Saam Barati  <sbarati@apple.com>
1569
1570         Our for-in optimization in the bytecode generator does its static analysis incorrectly
1571         https://bugs.webkit.org/show_bug.cgi?id=172532
1572         <rdar://problem/32369452>
1573
1574         Reviewed by Mark Lam.
1575
1576         * stress/for-in-invalidation-for-any-write.js: Added.
1577         (assert):
1578         (test):
1579         (test.i):
1580
1581 2017-05-25  Mark Lam  <mark.lam@apple.com>
1582
1583         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
1584         https://bugs.webkit.org/show_bug.cgi?id=172548
1585         <rdar://problem/31458393>
1586
1587         Reviewed by Filip Pizlo.
1588
1589         * stress/regress-172548.patch: Added.
1590
1591 2017-05-23  Saam Barati  <sbarati@apple.com>
1592
1593         We should not mmap zero bytes for a memory in Wasm
1594         https://bugs.webkit.org/show_bug.cgi?id=172528
1595         <rdar://problem/32257076>
1596
1597         Reviewed by Mark Lam.
1598
1599         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
1600         (testMems):
1601
1602 2017-05-23  Saam Barati  <sbarati@apple.com>
1603
1604         CFGSimplificationPhase should not merge a block with itself
1605         https://bugs.webkit.org/show_bug.cgi?id=172508
1606         <rdar://problem/28424006>
1607
1608         Reviewed by Keith Miller.
1609
1610         * stress/dont-crash-in-cfg-simplification.js: Added.
1611         (bar):
1612         (baz):
1613         (foo):
1614
1615 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1616
1617         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
1618         https://bugs.webkit.org/show_bug.cgi?id=172216
1619
1620         Reviewed by Saam Barati.
1621
1622         * stress/array-storage-get-by-val.js: Added.
1623         (shouldBe):
1624         (testOutOfBound):
1625         (testInBound):
1626         (testSlowPutOutOfBound):
1627         (testSlowPutInBound):
1628
1629 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1630
1631         Unreviewed, fix commented out tests
1632         https://bugs.webkit.org/show_bug.cgi?id=172225
1633
1634         * stress/get-by-val-string.js:
1635         (object.43):
1636         (Hello):
1637         (Hello.prototype.get 42):
1638         (Hello.prototype.43):
1639         (Derived):
1640         (shouldBe):
1641         (throw.new.Error): Deleted.
1642
1643 2017-05-21  Saam Barati  <sbarati@apple.com>
1644
1645         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
1646         https://bugs.webkit.org/show_bug.cgi?id=171041
1647         <rdar://problem/32082516>
1648
1649         Reviewed by Yusuke Suzuki.
1650
1651         * stress/lexical-scoping-for-loop.js: Added.
1652         (assert):
1653         (test1):
1654         (test2):
1655         (test3):
1656         (test4):
1657         (test5):
1658         (test6):
1659         (let.test7):
1660         (let.test8):
1661         (let.test9):
1662         (let.test10):
1663         (let.test11):
1664         (let.test12):
1665
1666 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1667
1668         [JSC] Make get_by_val & string "499" to number 499
1669         https://bugs.webkit.org/show_bug.cgi?id=172225
1670
1671         Reviewed by Saam Barati.
1672
1673         * stress/get-by-val-string.js: Added.
1674         (shouldBe):
1675         (shouldThrow):
1676         (object.43):
1677         (Hello):
1678         (Hello.prototype.get 42):
1679         (Hello.prototype.43):
1680         (Derived):
1681
1682 2017-05-19  Mark Lam  <mark.lam@apple.com>
1683
1684         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
1685         https://bugs.webkit.org/show_bug.cgi?id=172383
1686         <rdar://problem/31418651>
1687
1688         Reviewed by Filip Pizlo.
1689
1690         * stress/regress-172383.js: Added.
1691
1692 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
1693
1694         Unreviewed, rolling out r217156.
1695
1696         This change broke the iOS build.
1697
1698         Reverted changeset:
1699
1700         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
1701         result registers."
1702         https://bugs.webkit.org/show_bug.cgi?id=172383
1703         http://trac.webkit.org/changeset/217156
1704
1705 2017-05-19  Mark Lam  <mark.lam@apple.com>
1706
1707         Add missing exception check.
1708         https://bugs.webkit.org/show_bug.cgi?id=172346
1709         <rdar://problem/32289640>
1710
1711         Reviewed by Geoffrey Garen.
1712
1713         * stress/regress-172346.js: Added.
1714
1715 2017-05-19  Mark Lam  <mark.lam@apple.com>
1716
1717         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
1718         https://bugs.webkit.org/show_bug.cgi?id=172383
1719         <rdar://problem/31418651>
1720
1721         Reviewed by Filip Pizlo.
1722
1723         * stress/regress-172383.js: Added.
1724
1725 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
1726
1727         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
1728         https://bugs.webkit.org/show_bug.cgi?id=172369
1729
1730         Reviewed by Mark Lam.
1731
1732         * stress/undecided-concat.js: Added.
1733
1734 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1735
1736         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
1737         https://bugs.webkit.org/show_bug.cgi?id=172098
1738
1739         Reviewed by Saam Barati.
1740
1741         * stress/check-sub-class.js: Added.
1742         (shouldBe):
1743         (shouldThrow):
1744         (calling):
1745         (array.forEach):
1746         (i.array.forEach):
1747
1748 2017-05-18  JF Bastien  <jfbastien@apple.com>
1749
1750         WebAssembly: exports is a getter
1751         https://bugs.webkit.org/show_bug.cgi?id=172129
1752
1753         Reviewed by Saam Barati.
1754
1755         Update test to reflect new semantics.
1756
1757         * wasm/js-api/test_basic_api.js:
1758         (const.c.in.constructorProperties.switch):
1759
1760 2017-05-18  Saam Barati  <sbarati@apple.com>
1761
1762         Proxy's [[Get]] passes incorrect receiver
1763         https://bugs.webkit.org/show_bug.cgi?id=164849
1764         <rdar://problem/31767058>
1765
1766         Reviewed by Yusuke Suzuki.
1767
1768         * stress/proxy-get-set-correct-receiver.js: Added.
1769         (assert):
1770         (test):
1771         (test.let.target.set prop):
1772         (test.let.target.get prop):
1773         (test.get let):
1774         * stress/proxy-set.js:
1775         (let.target.get x):
1776         * stress/reflect-set-proxy-set.js:
1777         (let.target.get x):
1778         * stress/reflect-set-receiver-proxy-set.js:
1779         (let.target.get x):
1780
1781 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
1782
1783         Constructor calls set this too early
1784         https://bugs.webkit.org/show_bug.cgi?id=172302
1785
1786         Reviewed by Saam Barati.
1787         
1788         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
1789         wrong.
1790
1791         * stress/construct-overwritten-variable.js: Added.
1792         (new.x.x):
1793         * stress/construct-spread-overwritten-variable-2.js: Added.
1794         (new.x.x):
1795         * stress/construct-spread-overwritten-variable.js: Added.
1796         (new.x.x):
1797
1798 2017-05-18  Saam Barati  <sbarati@apple.com>
1799
1800         WebAssembly: perform stack checks
1801         https://bugs.webkit.org/show_bug.cgi?id=165546
1802         <rdar://problem/29760307>
1803
1804         Reviewed by Filip Pizlo.
1805
1806         * wasm.yaml:
1807         * wasm/function-tests/factorial.js:
1808         * wasm/function-tests/float-sub.js:
1809         * wasm/function-tests/stack-overflow.js: Added.
1810         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
1811         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
1812         (assertOverflows.makeInstance):
1813         (assertOverflows.makeInstance2):
1814         (assertOverflows.assertThrows):
1815         (assertOverflows):
1816         (assertThrows.test.makeSignature):
1817         (assertThrows.test.makeInstance):
1818         (assertThrows.test):
1819         (assertThrows):
1820
1821 2017-05-18  Keith Miller  <keith_miller@apple.com>
1822
1823         WebAssembly API: test with neutered inputs
1824         https://bugs.webkit.org/show_bug.cgi?id=163899
1825
1826         Reviewed by JF Bastien.
1827
1828         * wasm/js-api/neutered-inputs.js: Added.
1829         (const.testFunction):
1830         (const.testConstructor):
1831         * wasm/js-api/test_basic_api.js:
1832         (const.c.in.constructorProperties.switch):
1833
1834 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
1835
1836         DFG inlining should be hardened for the no-result case
1837         https://bugs.webkit.org/show_bug.cgi?id=172290
1838
1839         Reviewed by Saam Barati.
1840
1841         * stress/array-constructor-no-result.js: Added.
1842         (foo):
1843         * stress/pow-no-result.js: Added.
1844         (foo):
1845
1846 2017-05-18  Commit Queue  <commit-queue@webkit.org>
1847
1848         Unreviewed, rolling out r217031, r217032, and r217037.
1849         https://bugs.webkit.org/show_bug.cgi?id=172293
1850
1851         cause linking errors in Windows (Requested by yusukesuzuki on
1852         #webkit).
1853
1854         Reverted changesets:
1855
1856         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
1857         https://bugs.webkit.org/show_bug.cgi?id=172098
1858         http://trac.webkit.org/changeset/217031
1859
1860         "Unreviewed, rebaseline for newly added ClassInfo"
1861         https://bugs.webkit.org/show_bug.cgi?id=172098
1862         http://trac.webkit.org/changeset/217032
1863
1864         "Unreviewed, fix debug and non-JIT build"
1865         https://bugs.webkit.org/show_bug.cgi?id=172098
1866         http://trac.webkit.org/changeset/217037
1867
1868 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1869
1870         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
1871         https://bugs.webkit.org/show_bug.cgi?id=172098
1872
1873         Reviewed by Saam Barati.
1874
1875         * stress/check-sub-class.js: Added.
1876         (shouldBe):
1877         (shouldThrow):
1878         (calling):
1879         (array.forEach):
1880         (i.array.forEach):
1881
1882 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
1883
1884         Unreviewed, address mlam's review feedback.
1885
1886         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
1887
1888 2017-05-17  Saam Barati  <sbarati@apple.com>
1889
1890         We don't do context switches for Wasm->Wasm call indirect
1891         https://bugs.webkit.org/show_bug.cgi?id=172188
1892         <rdar://problem/32231828>
1893
1894         Reviewed by Keith Miller.
1895
1896         * wasm/function-tests/context-switch.js: Added.
1897         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
1898         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
1899         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
1900         (makeInstance):
1901         (makeInstance2):
1902         (assert.eq.makeInstance):
1903         (assert.eq.makeInstance2):
1904         (assert.eq):
1905
1906 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
1907
1908         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
1909         https://bugs.webkit.org/show_bug.cgi?id=172208
1910
1911         Reviewed by Saam Barati.
1912
1913         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
1914         (foo):
1915         (bar):
1916         (baz):
1917
1918 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1919
1920         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
1921         https://bugs.webkit.org/show_bug.cgi?id=172115
1922
1923         Reviewed by Saam Barati.
1924
1925         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
1926         (shouldBe):
1927         (unknown):
1928         (readWord1):
1929         (readWord2):
1930         (readWord3):
1931         (readWord4):
1932
1933 2017-05-16  JF Bastien  <jfbastien@apple.com>
1934
1935         WebAssembly: add memory fuzzer
1936         https://bugs.webkit.org/show_bug.cgi?id=169976
1937         <rdar://problem/31965328>
1938
1939         Reviewed by Keith Miller.
1940
1941         * wasm/fuzz/memory.js: Added.
1942         (const.insert):
1943         (const.action.string_appeared_here):
1944         (const.performAction):
1945         (catch):
1946
1947 2017-05-16  JF Bastien  <jfbastien@apple.com>
1948
1949         WebAssembly: validate load / store alignment
1950         https://bugs.webkit.org/show_bug.cgi?id=168836
1951         <rdar://problem/31965349>
1952
1953         Reviewed by Keith Miller.
1954
1955         * wasm/WASM.js: fix regular expression greed
1956         * wasm/function-tests/memory-alignment.js: Added.
1957         (const.op.of.WASM.opcodes):
1958         * wasm/wasm.json: fix formatting
1959
1960 2017-05-15  Mark Lam  <mark.lam@apple.com>
1961
1962         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
1963         https://bugs.webkit.org/show_bug.cgi?id=172147
1964
1965         Rubber-stamped by Saam Barati.
1966
1967         * stress/object-rest-deconstruct.js: Removed.
1968         * stress/object-spread.js: Removed.
1969
1970 2017-05-11  JF Bastien  <jfbastien@apple.com>
1971
1972         WebAssembly: stop supporting 0xD
1973         https://bugs.webkit.org/show_bug.cgi?id=168788
1974         <rdar://problem/31880922>
1975
1976         Reviewed by Saam Barati.
1977
1978         Test that only version 1 is supported.
1979
1980         * wasm/js-api/version.js: Added.
1981
1982 2017-05-10  JF Bastien  <jfbastien@apple.com>
1983
1984         WebAssemby: builder doesn't do Memory section maximum correctly
1985         https://bugs.webkit.org/show_bug.cgi?id=171931
1986
1987         Reviewed by Keith Miller.
1988
1989         * wasm/Builder.js:
1990         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
1991         * wasm/Builder_WebAssemblyBinary.js:
1992         (const.emitters.Memory):
1993         * wasm/function-tests/memory-grow-invalid.js: Added.
1994
1995 2017-05-10  JF Bastien  <jfbastien@apple.com>
1996
1997         WebAssembly: support name section
1998         https://bugs.webkit.org/show_bug.cgi?id=171263
1999
2000         Reviewed by Keith Miller.
2001
2002         * wasm/function-tests/nameSection.js: Added.
2003         (const.compile):
2004         * wasm/function-tests/nameSection.wasm: Added.
2005         * wasm/function-tests/stack-trace.js: Update format
2006
2007 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
2008
2009         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
2010         https://bugs.webkit.org/show_bug.cgi?id=171801
2011
2012         Reviewed by Michael Saboff.
2013         
2014         These tests used to crash. The prefix and postfix tests cover different paths, except
2015         postfix-ignored goes down the same path as prefix due to an optimization.
2016
2017         * stress/for-in-postfix-ignored-index.js: Added.
2018         (foo):
2019         * stress/for-in-postfix-index.js: Added.
2020         (foo):
2021         * stress/for-in-prefix-index.js: Added.
2022         (foo):
2023
2024 2017-05-08  Mark Lam  <mark.lam@apple.com>
2025
2026         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
2027         https://bugs.webkit.org/show_bug.cgi?id=171786
2028         <rdar://problem/32051023>
2029
2030         Reviewed by Saam Barati.
2031
2032         * stress/bug-171786.js: Added.
2033
2034 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2035
2036         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
2037         https://bugs.webkit.org/show_bug.cgi?id=171543
2038
2039         Reviewed by Saam Barati.
2040
2041         * stress/arrowfunction-lexical-bind-supercall-4.js:
2042         (J):
2043         (K):
2044
2045 2017-05-05  Saam Barati  <sbarati@apple.com>
2046
2047         putDirectIndex does not properly do defineOwnProperty
2048         https://bugs.webkit.org/show_bug.cgi?id=171591
2049         <rdar://problem/31735695>
2050
2051         Reviewed by Geoffrey Garen.
2052
2053         * stress/array-prototype-splice-making-typed-array.js:
2054         (test):
2055         * stress/array-species-config-array-constructor.js:
2056         (shouldThrow):
2057         (test):
2058         * stress/put-direct-index-broken-2.js: Added.
2059         (assert):
2060         (test):
2061         (makeLengthWritable):
2062         (set get restoreOldDesc):
2063         * stress/put-direct-index-broken.js: Added.
2064         (whatToTest):
2065         (tryRunning):
2066         (tryItOut):
2067         * stress/put-indexed-getter-setter.js: Added.
2068         (foo.X.prototype.set 7):
2069         (foo.X.prototype.get 7):
2070         (foo.X):
2071         (foo):
2072
2073 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2074
2075         [JSC] Math unary functions should be handled by DFG
2076         https://bugs.webkit.org/show_bug.cgi?id=171269
2077
2078         Reviewed by Saam Barati.
2079
2080         * stress/arith-acos-on-various-types.js: Added.
2081         (let.validInputTypedTestCases.validInputTestCases.map):
2082         (isIdentical):
2083         (opaqueACosNoArgument):
2084         (testNoArgument):
2085         (opaqueAllTypesACos):
2086         (testAllTypesCall):
2087         (testSingleTypeCall):
2088         (testConstant):
2089         (opaqueACosForSideEffects):
2090         (testSideEffect.let.testObject.valueOf):
2091         (testSideEffect):
2092         (opaqueACosForCSE):
2093         (testCSE.let.testObject.valueOf):
2094         (testCSE):
2095         (opaqueACosForDCE):
2096         (testDCE.let.testObject.valueOf):
2097         (testDCE):
2098         (testException.opaqueACosWithException):
2099         (testException):
2100         * stress/arith-acosh-on-various-types.js: Added.
2101         (let.validInputTypedTestCases.validInputTestCases.map):
2102         (isIdentical):
2103         (opaqueACoshNoArgument):
2104         (testNoArgument):
2105         (opaqueAllTypesACosh):
2106         (testAllTypesCall):
2107         (testSingleTypeCall):
2108         (testConstant):
2109         (opaqueACoshForSideEffects):
2110         (testSideEffect.let.testObject.valueOf):
2111         (testSideEffect):
2112         (opaqueACoshForCSE):
2113         (testCSE.let.testObject.valueOf):
2114         (testCSE):
2115         (opaqueACoshForDCE):
2116         (testDCE.let.testObject.valueOf):
2117         (testDCE):
2118         (testException.opaqueACoshWithException):
2119         (testException):
2120         * stress/arith-asin-on-various-types.js: Added.
2121         (let.validInputTypedTestCases.validInputTestCases.map):
2122         (isIdentical):
2123         (opaqueASinNoArgument):
2124         (testNoArgument):
2125         (opaqueAllTypesASin):
2126         (testAllTypesCall):
2127         (testSingleTypeCall):
2128         (testConstant):
2129         (opaqueASinForSideEffects):
2130         (testSideEffect.let.testObject.valueOf):
2131         (testSideEffect):
2132         (opaqueASinForCSE):
2133         (testCSE.let.testObject.valueOf):
2134         (testCSE):
2135         (opaqueASinForDCE):
2136         (testDCE.let.testObject.valueOf):
2137         (testDCE):
2138         (testException.opaqueASinWithException):
2139         (testException):
2140         * stress/arith-asinh-on-various-types.js: Added.
2141         (let.validInputTypedTestCases.validInputTestCases.map):
2142         (isIdentical):
2143         (opaqueASinhNoArgument):
2144         (testNoArgument):
2145         (opaqueAllTypesASinh):
2146         (testAllTypesCall):
2147         (testSingleTypeCall):
2148         (testConstant):
2149         (opaqueASinhForSideEffects):
2150         (testSideEffect.let.testObject.valueOf):
2151         (testSideEffect):
2152         (opaqueASinhForCSE):
2153         (testCSE.let.testObject.valueOf):
2154         (testCSE):
2155         (opaqueASinhForDCE):
2156         (testDCE.let.testObject.valueOf):
2157         (testDCE):
2158         (testException.opaqueASinhWithException):
2159         (testException):
2160         * stress/arith-atan-on-various-types.js: Added.
2161         (let.validInputTypedTestCases.validInputTestCases.map):
2162         (isIdentical):
2163         (opaqueATanNoArgument):
2164         (testNoArgument):
2165         (opaqueAllTypesATan):
2166         (testAllTypesCall):
2167         (testSingleTypeCall):
2168         (testConstant):
2169         (opaqueATanForSideEffects):
2170         (testSideEffect.let.testObject.valueOf):
2171         (testSideEffect):
2172         (opaqueATanForCSE):
2173         (testCSE.let.testObject.valueOf):
2174         (testCSE):
2175         (opaqueATanForDCE):
2176         (testDCE.let.testObject.valueOf):
2177         (testDCE):
2178         (testException.opaqueATanWithException):
2179         (testException):
2180         * stress/arith-atanh-on-various-types.js: Added.
2181         (let.validInputTypedTestCases.validInputTestCases.map):
2182         (isIdentical):
2183         (opaqueATanhNoArgument):
2184         (testNoArgument):
2185         (opaqueAllTypesATanh):
2186         (testAllTypesCall):
2187         (testSingleTypeCall):
2188         (testConstant):
2189         (opaqueATanhForSideEffects):
2190         (testSideEffect.let.testObject.valueOf):
2191         (testSideEffect):
2192         (opaqueATanhForCSE):
2193         (testCSE.let.testObject.valueOf):
2194         (testCSE):
2195         (opaqueATanhForDCE):
2196         (testDCE.let.testObject.valueOf):
2197         (testDCE):
2198         (testException.opaqueATanhWithException):
2199         (testException):
2200         * stress/arith-cbrt-on-various-types.js: Added.
2201         (let.validInputTypedTestCases.validInputTestCases.map):
2202         (isIdentical):
2203         (opaqueCbrtNoArgument):
2204         (testNoArgument):
2205         (opaqueAllTypesCbrt):
2206         (testAllTypesCall):
2207         (testSingleTypeCall):
2208         (testConstant):
2209         (opaqueCbrtForSideEffects):
2210         (testSideEffect.let.testObject.valueOf):
2211         (testSideEffect):
2212         (opaqueCbrtForCSE):
2213         (testCSE.let.testObject.valueOf):
2214         (testCSE):
2215         (opaqueCbrtForDCE):
2216         (testDCE.let.testObject.valueOf):
2217         (testDCE):
2218         (testException.opaqueCbrtWithException):
2219         (testException):
2220         * stress/arith-cosh-on-various-types.js: Added.
2221         (let.validInputTypedTestCases.validInputTestCases.map):
2222         (isIdentical):
2223         (opaqueCoshNoArgument):
2224         (testNoArgument):
2225         (opaqueAllTypesCosh):
2226         (testAllTypesCall):
2227         (testSingleTypeCall):
2228         (testConstant):
2229         (opaqueCoshForSideEffects):
2230         (testSideEffect.let.testObject.valueOf):
2231         (testSideEffect):
2232         (opaqueCoshForCSE):
2233         (testCSE.let.testObject.valueOf):
2234         (testCSE):
2235         (opaqueCoshForDCE):
2236         (testDCE.let.testObject.valueOf):
2237         (testDCE):
2238         (testException.opaqueCoshWithException):
2239         (testException):
2240         * stress/arith-expm1-on-various-types.js: Added.
2241         (let.validInputTypedTestCases.validInputTestCases.map):
2242         (isIdentical):
2243         (opaqueExpm1NoArgument):
2244         (testNoArgument):
2245         (opaqueAllTypesExpm1):
2246         (testAllTypesCall):
2247         (testSingleTypeCall):
2248         (testConstant):
2249         (opaqueExpm1ForSideEffects):
2250         (testSideEffect.let.testObject.valueOf):
2251         (testSideEffect):
2252         (opaqueExpm1ForCSE):
2253         (testCSE.let.testObject.valueOf):
2254         (testCSE):
2255         (opaqueExpm1ForDCE):
2256         (testDCE.let.testObject.valueOf):
2257         (testDCE):
2258         (testException.opaqueExpm1WithException):
2259         (testException):
2260         * stress/arith-log10-on-various-types.js: Added.
2261         (let.validInputTypedTestCases.validInputTestCases.map):
2262         (isIdentical):
2263         (opaqueLog10NoArgument):
2264         (testNoArgument):
2265         (opaqueAllTypesLog10):
2266         (testAllTypesCall):
2267         (testSingleTypeCall):
2268         (testConstant):
2269         (opaqueLog10ForSideEffects):
2270         (testSideEffect.let.testObject.valueOf):
2271         (testSideEffect):
2272         (opaqueLog10ForCSE):
2273         (testCSE.let.testObject.valueOf):
2274         (testCSE):
2275         (opaqueLog10ForDCE):
2276         (testDCE.let.testObject.valueOf):
2277         (testDCE):
2278         (testException.opaqueLog10WithException):
2279         (testException):
2280         * stress/arith-log2-on-various-types.js: Added.
2281         (let.validInputTypedTestCases.validInputTestCases.map):
2282         (isIdentical):
2283         (opaqueLog2NoArgument):
2284         (testNoArgument):
2285         (opaqueAllTypesLog2):
2286         (testAllTypesCall):
2287         (testSingleTypeCall):
2288         (testConstant):
2289         (opaqueLog2ForSideEffects):
2290         (testSideEffect.let.testObject.valueOf):
2291         (testSideEffect):
2292         (opaqueLog2ForCSE):
2293         (testCSE.let.testObject.valueOf):
2294         (testCSE):
2295         (opaqueLog2ForDCE):
2296         (testDCE.let.testObject.valueOf):
2297         (testDCE):
2298         (testException.opaqueLog2WithException):
2299         (testException):
2300         * stress/arith-sinh-on-various-types.js: Added.
2301         (let.validInputTypedTestCases.validInputTestCases.map):
2302         (isIdentical):
2303         (opaqueSinhNoArgument):
2304         (testNoArgument):
2305         (opaqueAllTypesSinh):
2306         (testAllTypesCall):
2307         (testSingleTypeCall):
2308         (testConstant):
2309         (opaqueSinhForSideEffects):
2310         (testSideEffect.let.testObject.valueOf):
2311         (testSideEffect):
2312         (opaqueSinhForCSE):
2313         (testCSE.let.testObject.valueOf):
2314         (testCSE):
2315         (opaqueSinhForDCE):
2316         (testDCE.let.testObject.valueOf):
2317         (testDCE):
2318         (testException.opaqueSinhWithException):
2319         (testException):
2320         * stress/arith-tan-on-various-types.js:
2321         (isIdentical):
2322         * stress/arith-tanh-on-various-types.js: Added.
2323         (let.validInputTypedTestCases.validInputTestCases.map):
2324         (isIdentical):
2325         (opaqueTanhNoArgument):
2326         (testNoArgument):
2327         (opaqueAllTypesTanh):
2328         (testAllTypesCall):
2329         (testSingleTypeCall):
2330         (testConstant):
2331         (opaqueTanhForSideEffects):
2332         (testSideEffect.let.testObject.valueOf):
2333         (testSideEffect):
2334         (opaqueTanhForCSE):
2335         (testCSE.let.testObject.valueOf):
2336         (testCSE):
2337         (opaqueTanhForDCE):
2338         (testDCE.let.testObject.valueOf):
2339         (testDCE):
2340         (testException.opaqueTanhWithException):
2341         (testException):
2342
2343 2017-05-03  Keith Miller  <keith_miller@apple.com>
2344
2345         Array.prototype.sort should also allow a null comparator
2346         https://bugs.webkit.org/show_bug.cgi?id=171621
2347
2348         Reviewed by Michael Saboff.
2349
2350         Add test to make it less likely we revert to the incompatable behavior.
2351         Also, fix now incorrect tests.
2352
2353         * ChakraCore/test/Array/array_sort.baseline-jsc:
2354         * stress/array-sort-bad-comparator.js:
2355         (test):
2356         * stress/sort-null-comparator.js: Added.
2357         (assertEq):
2358
2359 2017-05-03  Caitlin Potter  <caitp@igalia.com>
2360
2361         [JSC] remove unneeded asyncFunctionTests.yaml
2362         https://bugs.webkit.org/show_bug.cgi?id=171611
2363
2364         Reviewed by Yusuke Suzuki.
2365
2366         Async functions have shipped, and those tests are run as part of
2367         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
2368
2369         * asyncFunctionTests.yaml: Removed.
2370         * stress/async-await-long-loop.js:
2371         * stress/async-await-throw-loop.js:
2372
2373 2017-05-03  Keith Miller  <keith_miller@apple.com>
2374
2375         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
2376         https://bugs.webkit.org/show_bug.cgi?id=47825
2377
2378         Reviewed by Saam Barati.
2379
2380         * stress/sorting-boolean-result-comparator.js: Added.
2381         (checkArray):
2382
2383 2017-05-02  David Kilzer  <ddkilzer@apple.com>
2384
2385         check-webkit-style should keep JavaScript test functions in sync
2386         <https://webkit.org/b/171424>
2387
2388         Reviewed by Joseph Pecoraro.
2389
2390         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
2391         and shouldThrow() in sync with other copies of these methods.
2392
2393         * stress/resources/standalone-pre.js:
2394         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
2395         variables with underscore.
2396         (shouldThrow): Fix whitespace.
2397
2398 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2399
2400         We initialize functions too early in an eval
2401         https://bugs.webkit.org/show_bug.cgi?id=161099
2402
2403         Reviewed by Saam Barati.
2404
2405         * stress/eval-func-decl-with-let-const-class.js: Added.
2406
2407 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2408
2409         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
2410         https://bugs.webkit.org/show_bug.cgi?id=163208
2411
2412         Reviewed by Saam Barati.
2413
2414         * stress/eval-func-decl-block-scoping-reassign.js: Added.
2415         (assert):
2416         (throw.new.Error.f):
2417         (throw.new.Error):
2418         * stress/eval-func-decl-block-with-remove.js: Added.
2419         (assert):
2420         (foo.boo):
2421         (foo):
2422         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
2423         (assert):
2424         (assertThrow):
2425         (foo):
2426         (boo):
2427         (joo):
2428         (koo):
2429         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
2430         (assert):
2431         (assertThrow):
2432         (foo):
2433         (boo):
2434         (hoo):
2435         (joo):
2436         (koo):
2437         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
2438         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
2439         (assert):
2440         (assertThrow):
2441         (foo):
2442         (boo):
2443         (goo):
2444         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
2445         (assert):
2446         (assertThrow):
2447         (foo):
2448         (boo):
2449         (boo.let.val2):
2450         (boo.let.val3):
2451         * stress/eval-func-decl-in-frozen-global.js: Added.
2452         (assert):
2453         (assertThrow):
2454         (throw.new.Error):
2455         (Object.freeze):
2456         * stress/eval-func-decl-in-global-of-eval.js: Added.
2457         (assert):
2458         (assertThrow):
2459         (bar):
2460         (baz):
2461         (foobar):
2462         * stress/eval-func-decl-in-global.js: Added.
2463         (assert):
2464         (assertThrow):
2465         * stress/eval-func-decl-in-if.js: Added.
2466         (assert):
2467         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
2468         (assert):
2469         (assertThrow):
2470         (foo):
2471         (boo):
2472         (foobar):
2473         (hoo):
2474         (joo):
2475         (koo):
2476         (loo):
2477         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
2478         (assert):
2479         (assertThrow):
2480         (foo):
2481         (boo):
2482         (goo):
2483         * stress/variable-under-tdz-eval-tricky.js:
2484         (assert):
2485         * test262.yaml:
2486
2487 2017-04-27  Mark Lam  <mark.lam@apple.com>
2488
2489         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
2490         https://bugs.webkit.org/show_bug.cgi?id=171404
2491         <rdar://problem/31876178>
2492
2493         Reviewed by Saam Barati.
2494
2495         * stress/js-fixed-array-out-of-memory.js: Added.
2496
2497 2017-04-27  David Kilzer  <ddkilzer@apple.com>
2498
2499         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
2500         <https://webkit.org/b/171362>
2501         <rdar://problem/31867686>
2502
2503         Reviewed by Joseph Pecoraro.
2504
2505         * stress/resources/standalone-pre.js:
2506         (shouldBe):
2507         (shouldNotThrow):
2508         (shouldThrow):
2509         - Update shouldBe() to accept anonymous function arguments.
2510           (The shouldNotBe() function was never copied over.)
2511         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
2512           function arguments (which were missed in r202609 for Bug
2513           159232).
2514
2515 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2516
2517         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
2518         https://bugs.webkit.org/show_bug.cgi?id=171262
2519
2520         Reviewed by Saam Barati.
2521
2522         * stress/spread-outer-create-rest.js: Added.
2523         (assert):
2524         (foo):
2525         (bar):
2526         (baz):
2527
2528 2017-04-26  Saam Barati  <sbarati@apple.com>
2529
2530         Print Wasm function index in stack trace
2531         https://bugs.webkit.org/show_bug.cgi?id=171349
2532
2533         Reviewed by JF Bastien.
2534
2535         * wasm/function-tests/stack-trace.js: Added.
2536         (import.Builder.from.string_appeared_here.assert):
2537         (let.imp):
2538         * wasm/function-tests/trap-after-cross-instance-call.js:
2539         (wasmFrameCountFromError):
2540         * wasm/function-tests/trap-load-2.js:
2541         (wasmFrameCountFromError):
2542         * wasm/function-tests/trap-load.js:
2543         (wasmFrameCountFromError):
2544
2545 2017-04-26  Saam Barati  <sbarati@apple.com>
2546
2547         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
2548         https://bugs.webkit.org/show_bug.cgi?id=170924
2549         <rdar://problem/31721052>
2550
2551         Reviewed by Mark Lam.
2552
2553         * stress/error-message-for-function-base-not-found.js: Added.
2554         (assert):
2555         (throw.new.Error):
2556         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
2557         (catch):
2558
2559 2017-04-26  Keith Miller  <keith_miller@apple.com>
2560
2561         WebAssembly: Implement tier up
2562         https://bugs.webkit.org/show_bug.cgi?id=170134
2563
2564         Reviewed by Filip Pizlo.
2565
2566         * wasm/function-tests/trap-after-cross-instance-call.js:
2567         * wasm/tier-up/js-to-wasm.js: Added.
2568         (async.test):
2569         * wasm/tier-up/wasm-to-wasm.js: Added.
2570         (async.test):
2571
2572 2017-04-26  Caitlin Potter  <caitp@igalia.com>
2573
2574         [JSC] Object.keys() must discard property names with no PropertyDescriptor
2575         https://bugs.webkit.org/show_bug.cgi?id=171291
2576
2577         Reviewed by Yusuke Suzuki.
2578
2579         * es6/Proxy_ownKeys_duplicates.js:
2580         * stress/proxy-own-keys.js:
2581         (let.handler.getOwnPropertyDescriptor):
2582         (let.handler.ownKeys):
2583
2584 2017-04-25  Commit Queue  <commit-queue@webkit.org>
2585
2586         Unreviewed, rolling out r215476.
2587         https://bugs.webkit.org/show_bug.cgi?id=171304
2588
2589         "It broke JSBench" (Requested by saamyjoon on #webkit).
2590
2591         Reverted changeset:
2592
2593         "[ES6]. Implement Annex B.3.3 function hoisting rules for
2594         eval"
2595         https://bugs.webkit.org/show_bug.cgi?id=163208
2596         http://trac.webkit.org/changeset/215476
2597
2598 2017-04-25  Saam Barati  <sbarati@apple.com>
2599
2600         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
2601         https://bugs.webkit.org/show_bug.cgi?id=171150
2602         <rdar://problem/31771880>
2603
2604         Reviewed by Sam Weinig.
2605
2606         * stress/spread-optimized-properly.js: Added.
2607         (assert):
2608         (test):
2609         (shallowEq):
2610         (makeArrayIterator):
2611         (test.bar):
2612         (test.callback):
2613         (test.arr.__proto__.Symbol.iterator):
2614         (test.arr.Symbol.iterator):
2615         (test.get bar):
2616         (test.hackedNext):
2617         (test.test):
2618         (test.):
2619
2620 2017-04-25  Mark Lam  <mark.lam@apple.com>
2621
2622         [Follow up] Array.prototype.slice() should ensure that end >= begin.
2623         https://bugs.webkit.org/show_bug.cgi?id=170989
2624         <rdar://problem/31705652>
2625
2626         Not reviewed.
2627
2628         Follow up to rename a test file that was accidentally named wrongly.
2629
2630         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
2631         * stress/regress-170989.patch: Removed.
2632
2633 2017-04-25  Mark Lam  <mark.lam@apple.com>
2634
2635         Array.prototype.slice() should ensure that end >= begin.
2636         https://bugs.webkit.org/show_bug.cgi?id=170989
2637         <rdar://problem/31705652>
2638
2639         Reviewed by Saam Barati.
2640
2641         * stress/regress-170989.patch: Added.
2642
2643 2017-04-25  Mark Lam  <mark.lam@apple.com>
2644
2645         Local CSE wrongly CSEs array accesses with different result types.
2646         https://bugs.webkit.org/show_bug.cgi?id=170990
2647         <rdar://problem/31705945>
2648
2649         Reviewed by Saam Barati.
2650
2651         * stress/regress-170990.js: Added.
2652
2653 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2654
2655         WebAssembly: exporting a property with a name that's a number doesn't work
2656         https://bugs.webkit.org/show_bug.cgi?id=168857
2657
2658         Reviewed by JF Bastien.
2659
2660         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
2661
2662         * wasm/js-api/test_Instance.js:
2663         (ExportedNumber):
2664
2665 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2666
2667         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
2668         https://bugs.webkit.org/show_bug.cgi?id=171190
2669
2670         Reviewed by Saam Barati.
2671
2672         * stress/async-await-syntax.js:
2673         * test262.yaml:
2674
2675 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
2676
2677         [JSC] Use JSFixedArray directly when using call_varargs
2678         https://bugs.webkit.org/show_bug.cgi?id=171057
2679
2680         Reviewed by Saam Barati.
2681
2682         * stress/spread-capture-rest.js: Added.
2683         (shouldBe):
2684         (capture):
2685         (a):
2686         (b):
2687         * stress/spread-multi-layers.js: Added.
2688         (shouldBe):
2689         (a):
2690         (b):
2691         (c):
2692         (d):
2693         * stress/spread-non-varargs.js: Added.
2694         (shouldBe):
2695         (a):
2696         (b):
2697
2698 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2699
2700         test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
2701         https://bugs.webkit.org/show_bug.cgi?id=170897
2702
2703         Reviewed by Saam Barati.
2704
2705         * test262.yaml:
2706
2707 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2708
2709         Address some FIXMEs in JavaScript tests for bugs that have been fixed
2710         https://bugs.webkit.org/show_bug.cgi?id=171191
2711
2712         Reviewed by JF Bastien.
2713
2714         * stress/proxy-is-extensible.js:
2715
2716 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2717
2718         test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
2719         https://bugs.webkit.org/show_bug.cgi?id=171160
2720
2721         Reviewed by JF Bastien.
2722
2723         * stress/inferred-names.js:
2724         * test262.yaml:
2725
2726 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
2727
2728         test262: test262/test/language/expressions/generators/yield-as-label.js
2729         https://bugs.webkit.org/show_bug.cgi?id=170979
2730
2731         Reviewed by Saam Barati.
2732
2733         * stress/async-await-module-reserved-word.js:
2734         * stress/async-await-reserved-word.js:
2735         Converge on "Cannot" instead of "Can't".
2736
2737         * catch-parameter-syntax.js:
2738         * yield-named-variable-generator.js:
2739         * yield-named-variable.js:
2740         * stress/yield-label-generator.js:
2741         * stress/yield-label.js:
2742         * stress/yield-reserved-word.js: Added.
2743         More complete list of when 'yield' is allowed.
2744
2745         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
2746         * test262.yaml:
2747
2748 2017-04-23  Commit Queue  <commit-queue@webkit.org>
2749
2750         Unreviewed, rolling out r215674.
2751         https://bugs.webkit.org/show_bug.cgi?id=171212
2752
2753         Possible unintended commit. This patch was on the wrong bug.
2754         (Requested by JoePeck on #webkit).
2755
2756         Reverted changeset:
2757
2758         "test262: test262/test/language/expressions/generators/yield-
2759         as-label.js"
2760         https://bugs.webkit.org/show_bug.cgi?id=170979
2761         http://trac.webkit.org/changeset/215674
2762
2763 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
2764
2765         test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
2766         https://bugs.webkit.org/show_bug.cgi?id=171197
2767
2768         Reviewed by Saam Barati.
2769
2770         * test262.yaml:
2771
2772 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
2773
2774         test262: test262/test/language/expressions/generators/yield-as-label.js
2775         https://bugs.webkit.org/show_bug.cgi?id=170979
2776
2777         Reviewed by Saam Barati.
2778
2779         * stress/async-await-module-reserved-word.js:
2780         * stress/async-await-reserved-word.js:
2781         Converge on "Cannot" instead of "Can't".
2782
2783         * catch-parameter-syntax.js:
2784         * yield-named-variable-generator.js:
2785         * yield-named-variable.js:
2786         * stress/yield-label-generator.js:
2787         * stress/yield-label.js:
2788         * stress/yield-reserved-word.js: Added.
2789         More complete list of when 'yield' is allowed.
2790
2791         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
2792         * test262.yaml:
2793
2794 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
2795
2796         test262: test262/test/built-ins/Number/parseFloat.js
2797         https://bugs.webkit.org/show_bug.cgi?id=171193
2798
2799         Reviewed by Yusuke Suzuki.
2800
2801         * test262.yaml:
2802
2803 2017-04-22  JF Bastien  <jfbastien@apple.com>
2804
2805         WebAssembly: Module.exports, Module.imports, Module.customSections are wrong
2806         https://bugs.webkit.org/show_bug.cgi?id=171078
2807
2808         Reviewed by Saam Barati.
2809
2810         They're static properties of Module, not instance properties of a module.
2811         https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymoduleexports
2812
2813         * wasm/js-api/Module.customSection.js:
2814         (assert.throws.WebAssembly.Module.customSections):
2815         (assert.eq):
2816         (assert.throws.WebAssembly.Module.prototype.customSections): Deleted.
2817         * wasm/js-api/Module.exports.js:
2818         (assert.throws.WebAssembly.Module.exports):
2819         (assert.truthy):
2820         (assert.throws.WebAssembly.Module.prototype.exports): Deleted.
2821         * wasm/js-api/Module.imports.js:
2822         (assert.throws.WebAssembly.Module.imports):
2823         (assert.truthy):
2824         (assert.throws.WebAssembly.Module.prototype.imports): Deleted.
2825
2826 2017-04-21  JF Bastien  <jfbastien@apple.com>
2827
2828         Silence noisy test
2829
2830         Unreviewed, Fil / Michael and I talked about it in the corridor. I
2831         just forgot to set verbose to false before commit.
2832
2833         * wasm/stress/oom.js:
2834
2835 2017-04-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2836
2837         [JSC][FTL] FTL should support Arrayify
2838         https://bugs.webkit.org/show_bug.cgi?id=169596
2839
2840         Reviewed by Saam Barati.
2841
2842         * stress/arrayify.js: Added.
2843         (arrayifyInt32):
2844         (arrayifyDouble):
2845         (arrayifyContiguous):
2846
2847 2017-04-20  Mark Lam  <mark.lam@apple.com>
2848
2849         virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
2850         https://bugs.webkit.org/show_bug.cgi?id=171079
2851         <rdar://problem/31684756>
2852
2853         Reviewed by Saam Barati.
2854
2855         * stress/regress-171079.js: Added.
2856
2857 2017-04-15  Filip Pizlo  <fpizlo@apple.com>
2858
2859         Optimize SharedArrayBuffer in the DFG+FTL
2860         https://bugs.webkit.org/show_bug.cgi?id=164108
2861
2862         Reviewed by Saam Barati.
2863         
2864         Added a fairly comprehensive test of the intrinsics. This creates a function for each possible
2865         combination of type and operation, and then first uses it nicely and then tries a bunch of
2866         erroneous conditions like OOB.
2867
2868         * stress/SharedArrayBuffer-opt.js: Added.
2869         (string_appeared_here.switch):
2870         (string_appeared_here.str):
2871         (runAtomic):
2872         (shouldFail):
2873         (Symbol):
2874         (string_appeared_here.a.of.arrays.m.of.atomics):
2875         * stress/SharedArrayBuffer.js:
2876
2877 2017-04-19  Mark Lam  <mark.lam@apple.com>
2878
2879         B3StackmapSpecial should handle when stackmap values are not recoverable from a Def'ed arg.
2880         https://bugs.webkit.org/show_bug.cgi?id=170973
2881         <rdar://problem/30318657>
2882
2883         Reviewed by Filip Pizlo.
2884
2885         * stress/regress-170973.js: Added.
2886
2887 2017-04-19  JF Bastien  <jfbastien@apple.com>
2888
2889         WebAssembly: limit slow memories
2890         https://bugs.webkit.org/show_bug.cgi?id=170825
2891
2892         Reviewed by Saam Barati.
2893
2894         * wasm.yaml:
2895         * wasm/stress/oom.js: Added.
2896         (try.true.WebAssemblyMemoryMode):
2897         (catch):
2898
2899 2017-04-19  JF Bastien  <jfbastien@apple.com>
2900
2901         WebAssembly: don't expose any WebAssembly JS object if JIT is off
2902         https://bugs.webkit.org/show_bug.cgi?id=170782
2903
2904         Reviewed by Saam Barati.
2905
2906         * wasm.yaml:
2907         * wasm/noJIT/noJIT.js: Added.
2908
2909 2017-04-18  Mark Lam  <mark.lam@apple.com>
2910
2911         r211670 broke double to int conversion.
2912         https://bugs.webkit.org/show_bug.cgi?id=170961
2913         <rdar://problem/31687696>
2914
2915         Reviewed by Yusuke Suzuki.
2916
2917         * microbenchmarks/double-to-int32.js: Added.
2918         * stress/to-int32-sensible2.js: Added.
2919
2920 2017-04-18  Oleksandr Skachkov  <gskachkov@gmail.com>
2921
2922         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
2923         https://bugs.webkit.org/show_bug.cgi?id=163208
2924
2925         Reviewed by Saam Barati.
2926
2927         * stress/eval-func-decl-block-scoping-reassign.js: Added.
2928         (assert):
2929         (throw.new.Error.f):
2930         (throw.new.Error):
2931         * stress/eval-func-decl-block-with-remove.js: Added.
2932         (assert):
2933         (foo.boo):
2934         (foo):
2935         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
2936         (assert):
2937         (assertThrow):
2938         (foo):
2939         (boo):
2940         (joo):
2941         (koo):
2942         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
2943         (assert):
2944         (assertThrow):
2945         (foo):
2946         (boo):
2947         (hoo):
2948         (joo):
2949         (koo):
2950         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
2951         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
2952         (assert):
2953         (assertThrow):
2954         (foo):
2955         (boo):
2956         (goo):
2957         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
2958         (assert):
2959         (assertThrow):
2960         (foo):
2961         (boo):
2962         (boo.let.val2):
2963         (boo.let.val3):
2964         * stress/eval-func-decl-in-frozen-global.js: Added.
2965         (assert):
2966         (assertThrow):
2967         (throw.new.Error):
2968         (Object.freeze):
2969         * stress/eval-func-decl-in-global-of-eval.js: Added.
2970         (assert):
2971         (assertThrow):
2972         (bar):
2973         (baz):
2974         (foobar):
2975         * stress/eval-func-decl-in-global.js: Added.
2976         (assert):
2977         (assertThrow):
2978         * stress/eval-func-decl-in-if.js: Added.
2979         (assert):
2980         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
2981         (assert):
2982         (assertThrow):
2983         (foo):
2984         (boo):
2985         (foobar):
2986         (hoo):
2987         (joo):
2988         (koo):
2989         (loo):
2990         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
2991         (assert):
2992         (assertThrow):
2993         (foo):
2994         (boo):
2995         (goo):
2996         * stress/variable-under-tdz-eval-tricky.js:
2997         (assert):
2998         * test262.yaml:
2999
3000 2017-04-18  Filip Pizlo  <fpizlo@apple.com>
3001
3002         wasm/function-tests/memory-multiagent times out sometimes
3003         https://bugs.webkit.org/show_bug.cgi?id=170958
3004
3005         Reviewed by Keith Miller.
3006         
3007         Add the ability to skip tests easily. Skip the test.
3008
3009         * wasm.yaml:
3010         * wasm/function-tests/memory-multiagent.js:
3011
3012 2017-04-18  Saam Barati  <sbarati@apple.com>
3013
3014         Follow up to debug build stack overflow in test after r215453
3015
3016         Rubber stamped by Mark Lam.
3017
3018         * stress/call-apply-exponential-bytecode-size.js: Decrease the call
3019         size to prevent stack overflow errors on debug builds.
3020
3021 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3022
3023         [DFG] Convert ValueAdd(Int32, String) => MakeRope(ToString(Int32), String)
3024         https://bugs.webkit.org/show_bug.cgi?id=170943
3025
3026         Reviewed by Geoffrey Garen.
3027
3028         * microbenchmarks/number-to-string-with-add-empty.js: Added.
3029         (toStringLeft):
3030         (toStringRight):
3031         * microbenchmarks/number-to-string-with-add-in-loop.js: Added.
3032         (toStringLeft):
3033         (toStringRight):
3034         * microbenchmarks/number-to-string-with-add.js: Added.
3035         (toStringLeft):
3036         (toStringRight):
3037         * stress/number-to-string-with-add.js: Added.
3038         (shouldBe):
3039         (toStringRight):
3040         (toStringLeftEmpty):
3041         (toStringRightEmpty):
3042
3043 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3044
3045         [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
3046         https://bugs.webkit.org/show_bug.cgi?id=170940
3047
3048         Reviewed by Filip Pizlo.
3049
3050         * microbenchmarks/for-of-array.js: Added.
3051         (fn):
3052
3053 2017-04-17  Saam Barati  <sbarati@apple.com>
3054
3055         BytecodeGenerator ".call" and ".apply" is exponential in nesting depth
3056         https://bugs.webkit.org/show_bug.cgi?id=139847
3057         <rdar://problem/19321122>
3058
3059         Reviewed by Oliver Hunt.
3060
3061         * stress/call-apply-exponential-bytecode-size.js: Added.
3062         (assert):
3063         (const.inc):
3064         (const.inc2):
3065         (bar):
3066         (randomApplyOrCall):
3067         (baz):
3068         (jaz):
3069         (haz):
3070         (foo):
3071
3072 2017-04-17  Mark Lam  <mark.lam@apple.com>
3073
3074         JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
3075         https://bugs.webkit.org/show_bug.cgi?id=170896
3076         <rdar://problem/31651319>
3077
3078         Reviewed by JF Bastien and Keith Miller.
3079
3080         * stress/regress-170896.js: Added.
3081
3082 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3083
3084         test262: test262/test/built-ins/Object/prototype/toLocaleString/primitive_this_value.js
3085         https://bugs.webkit.org/show_bug.cgi?id=170882
3086
3087         Reviewed by Saam Barati.
3088
3089         * test262.yaml:
3090
3091 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3092
3093         test262: test262/test/built-ins/isNaN/toprimitive-not-callable-throws.js
3094         https://bugs.webkit.org/show_bug.cgi?id=170888
3095
3096         Reviewed by Saam Barati.
3097
3098         * stress/computed-accessor.js:
3099         * stress/eval-in-arrow-function.js:
3100         * stress/rest-elements.js:
3101         * stress/string-object-define-own-property.js:
3102         Remove unused shouldThrow.
3103
3104         * stress/symbol-toprimitive-errors.js: Added.
3105         Check for ToPrimitive TypeErrors.
3106
3107         * test262.yaml:
3108
3109 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3110
3111         test262: test262/test/language/expressions/tagged-template/template-object.js
3112         https://bugs.webkit.org/show_bug.cgi?id=170878
3113
3114         Reviewed by Saam Barati.
3115
3116         * stress/array-length-not-writable.js: Added.
3117         (assert):
3118         * test262.yaml:
3119
3120 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3121
3122         test262: test262/test/built-ins/Object/getOwnPropertyNames/15.2.3.4-4-44.js
3123         https://bugs.webkit.org/show_bug.cgi?id=170879
3124
3125         Reviewed by Saam Barati.
3126
3127         * ChakraCore/test/es5/enumerable.baseline-jsc:
3128         * test262.yaml:
3129
3130 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3131
3132         test262: test262/test/built-ins/Date/prototype/Symbol.toPrimitive/name.js
3133         https://bugs.webkit.org/show_bug.cgi?id=170884
3134
3135         Reviewed by Yusuke Suzuki.
3136
3137         * test262.yaml:
3138
3139 2017-04-15  Joseph Pecoraro  <pecoraro@apple.com>
3140
3141         test262: test262/test/language/global-code/new.target-arrow.js
3142         https://bugs.webkit.org/show_bug.cgi?id=170872
3143
3144         Reviewed by Saam Barati.
3145
3146         * stress/async-arrow-functions-lexical-new.target-binding.js:
3147         (shouldThrowAsync): Deleted.
3148         (shouldThrowAsync.async): Deleted.
3149         This code should have thrown a SyntaxError. Instead it was throwing
3150         a ReferenceError for the internal @newTargetLocal variable.
3151
3152         * stress/new-target-syntax-errors.js:
3153         Cover the arrow function in global code cases.
3154
3155         * ChakraCore.yaml:
3156         * ChakraCore/test/es6/globalLambdaNewTargetSyntaxError.baseline-jsc:
3157         We now pass with an expected SyntaxError. Our error message is different.
3158
3159         * test262.yaml:
3160
3161 2017-04-14  Saam Barati  <sbarati@apple.com>
3162
3163         ParseInt intrinsic in DFG backend doesn't properly flush its operands
3164         https://bugs.webkit.org/show_bug.cgi?id=170865
3165
3166         Reviewed by Mark Lam and Geoffrey Garen.
3167
3168         * stress/parse-int-intrinsic-dfg-backend-flush.js: Added.
3169         (assert):
3170         (foo):
3171
3172 2017-04-14  Caitlin Potter  <caitp@igalia.com>
3173
3174         [JSC] use ExpressionErrorClassifier for AwaitExpression operand
3175         https://bugs.webkit.org/show_bug.cgi?id=170844
3176
3177         Reviewed by Saam Barati.
3178
3179         * stress/regress-170732.js: Added.
3180
3181 2017-04-14  Oleksandr Skachkov  <gskachkov@gmail.com>
3182
3183         Safari 10.1 JSON.parse returns incorrect object for numeric keys with decimal values
3184         https://bugs.webkit.org/show_bug.cgi?id=170442
3185
3186         Reviewed by Yusuke Suzuki.
3187
3188         * stress/object-number-properties.js:
3189
3190 2017-04-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3191
3192         [JSC] Date.parse should accept wider range of representation
3193         https://bugs.webkit.org/show_bug.cgi?id=170720
3194
3195         Reviewed by Darin Adler.
3196
3197         * stress/date-relaxed.js: Added.
3198         (shouldBe):
3199         (throw.new.Error):
3200
3201 2017-04-13  Mark Lam  <mark.lam@apple.com>
3202
3203         Should use flushDirect() when flushing the scopeRegister due to needsScopeRegister().
3204         https://bugs.webkit.org/show_bug.cgi?id=170661
3205         <rdar://problem/31579046>
3206
3207         Reviewed by Filip Pizlo.
3208
3209         * stress/regress-170661.js: Added.
3210
3211 2017-04-13  JF Bastien  <jfbastien@apple.com>
3212
3213         WebAssembly: manage memory better
3214         https://bugs.webkit.org/show_bug.cgi?id=170628
3215
3216         Reviewed by Keith Miller, Michael Saboff.
3217
3218         * wasm/Builder.js: move a helper out so tests can use it
3219         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3220         * wasm/WASM.js: add utilities to classify opcodes
3221         (export.opcodes):
3222         (export.const.memoryAccessInfo.op.const.sign):
3223         * wasm/function-tests/memory-access-past-4gib.js: Added. This test
3224         fails before this patch.
3225         (const.op.of.WASM.opcodes):
3226         * wasm/function-tests/memory-many.js: Added. This simple tests
3227         just shouldn't crash. In verbose mode it's useful at determining
3228         if the GC falls behind or not.
3229         * wasm/function-tests/memory-multiagent.js: Added. Emulate postMessage.
3230         (const.startAgents.numAgentsToStart.a.agent.receiveBroadcast):
3231         (const.startAgents.numAgentsToStart.a.write.const.idx.Math.random):
3232         (const.broadcastToAgents):
3233         * wasm/js-api/extension-MemoryMode.js: verbose logging.
3234         (testMemoryNoMax):
3235         (testMemory):
3236         (testInstanceNoMemory):
3237         (testInstanceNoMax):
3238         (testInstance):
3239         * wasm/utilities.js: move a utility here.
3240
3241 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
3242
3243         test262: test262/test/built-ins/NativeErrors/EvalError/proto.js
3244         https://bugs.webkit.org/show_bug.cgi?id=170668
3245
3246         Reviewed by Keith Miller.
3247
3248         * ChakraCore.yaml:
3249         * ChakraCore/test/Lib/error.baseline-jsc: Added.
3250         This test does not match the spec.
3251
3252         * test262.yaml:
3253
3254 2017-04-12  Joseph Pecoraro  <pecoraro@apple.com>
3255
3256         test262: test262/test/language/literals/regexp/u-dec-esc.js
3257         https://bugs.webkit.org/show_bug.cgi?id=170687
3258
3259         Reviewed by Michael Saboff.
3260
3261         * test262.yaml:
3262
3263 2017-04-11  Michael Saboff  <msaboff@apple.com>
3264
3265         Implement Object.isFrozen() and Object.isSealed() per ECMA spec
3266         https://bugs.webkit.org/show_bug.cgi?id=170753
3267
3268         Reviewed by Mark Lam.
3269
3270         Added JSC baseline and enabled defineIndexProperty test.
3271
3272         Note that JSC differs from Chakra in that a JSC doesn't use indexed
3273         properties placed on the Array prototype when sorting the indexed 
3274         properties of an Object.  This is behavior is considered undefined
3275         in the standard.
3276
3277         * ChakraCore.yaml:
3278         * ChakraCore/test/es5/defineIndexProperty.baseline-jsc: Added.
3279
3280 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
3281
3282         test262: test262/test/annexB/language/comments/multi-line-html-close.js
3283         https://bugs.webkit.org/show_bug.cgi?id=170648
3284
3285         Reviewed by Keith Miller.
3286
3287         * test262.yaml:
3288
3289 2017-04-11  Joseph Pecoraro  <pecoraro@apple.com>
3290
3291         test262: test262/test/built-ins/Array/S15.4.3_A2.2.js
3292         https://bugs.webkit.org/show_bug.cgi?id=170652
3293
3294         Reviewed by Michael Saboff.
3295
3296         * stress/native-constructors-length.js: Added.
3297         (assertLengthDescriptorAttributes):
3298         Add a quick test for the length properties of all native constructors.
3299
3300         * ChakraCore/test/es5/enumerable.baseline-jsc:
3301         Rebaseline expectations for this test.
3302
3303         * test262.yaml:
3304
3305 2017-04-10  Keith Miller  <keith_miller@apple.com>
3306
3307         WebAssembly: Update spec tests
3308         https://bugs.webkit.org/show_bug.cgi?id=170683
3309
3310         Rubber-stamped by JF Bastien.
3311
3312         * wasm.yaml:
3313         * wasm/spec-tests/br_table.wast.js:
3314         * wasm/spec-tests/conversions.wast.js: Removed.
3315         * wasm/spec-tests/f32_bitwise.wast.js: Added.
3316         * wasm/spec-tests/f32_cmp.wast.js:
3317         * wasm/spec-tests/f64_bitwise.wast.js: Added.
3318         * wasm/spec-tests/f64_cmp.wast.js:
3319         * wasm/spec-tests/i32.wast.js:
3320         * wasm/spec-tests/i64.wast.js:
3321         * wasm/spec-tests/int_exprs.wast.js:
3322         * wasm/spec-tests/memory.wast.js:
3323
3324 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
3325
3326         test262: test262/test/annexB/language/expressions/object/__proto__-fn-name.js
3327         https://bugs.webkit.org/show_bug.cgi?id=170650
3328
3329         Reviewed by Saam Barati.
3330
3331         * stress/inferred-names.js:
3332         * test262.yaml:
3333
3334 2017-04-09  Joseph Pecoraro  <pecoraro@apple.com>
3335
3336         test262: test262/test/annexB/language/literals/regexp/identity-escape.js
3337         https://bugs.webkit.org/show_bug.cgi?id=170651
3338
3339         Reviewed by Saam Barati.
3340
3341         * test262.yaml:
3342
3343 2017-04-07  Michael Saboff  <msaboff@apple.com>
3344
3345         Fix and enable ChakraCore/test/es6/ES6Function_bugs.js after r215072
3346         https://bugs.webkit.org/show_bug.cgi?id=170580
3347
3348         Reviewed by JF Bastien.
3349
3350         Commented out subtest that expects defineProperty("length") to a getter on a
3351         sealed function shouldn't throw.
3352
3353         * ChakraCore.yaml:
3354         * ChakraCore/test/es6/ES6Function_bugs.js:
3355
3356 2017-04-06  Michael Saboff  <msaboff@apple.com>
3357
3358         Cannot Object.seal() or Object.freeze() global "this"
3359         https://bugs.webkit.org/show_bug.cgi?id=170549
3360
3361         Reviewed by Mark Lam.
3362
3363         Enabled failing tests fixed by the corresponding code change:
3364             ChakraCore/test/LetConst/delete.js
3365             ChakraCore/test/LetConst/dop.js
3366             ChakraCore/test/LetConst/dop1.js
3367
3368         * ChakraCore.yaml:
3369         * ChakraCore/test/LetConst/dop.baseline-jsc: Added JSC specific expected output.
3370         * ChakraCore/test/LetConst/dop1.baseline-jsc: Added JSC specific expected output.
3371
3372 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3373
3374         test262: ES2017 test progressions need updated expectations (arguments.caller removed)
3375         https://bugs.webkit.org/show_bug.cgi?id=170536
3376
3377         Reviewed by Mark Lam.
3378
3379         * test262.yaml:
3380         After r208867 the tests are out of date and are now expected to fail.
3381
3382 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3383
3384         test262: Final rebaseline of existing tests, a few tests have started failing
3385         https://bugs.webkit.org/show_bug.cgi?id=170538
3386
3387         Reviewed by Mark Lam.
3388
3389         * test262.yaml:
3390         These tests started failing a while ago. Mark them as legitmate failures.
3391
3392 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3393
3394         test262: Rebaseline expectations for now passing tests
3395         https://bugs.webkit.org/show_bug.cgi?id=170532
3396
3397         Reviewed by Ryosuke Niwa.
3398
3399         * test262.yaml:
3400         Update expectations for tests we are now passing.
3401
3402 2017-04-05  Joseph Pecoraro  <pecoraro@apple.com>
3403
3404         test262: module test progressions need updated expectations (@@iterator changes)
3405         https://bugs.webkit.org/show_bug.cgi?id=170535
3406
3407         Reviewed by Saam Barati.
3408
3409         * test262.yaml:
3410         After r212430 the tests are out of date and are now expected to fail.
3411
3412 2017-04-05  Michael Saboff  <msaboff@apple.com>
3413
3414         Unreviewed rollout of r214642 as the test still intermittently fails.
3415
3416         Disabled ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js.
3417
3418         * ChakraCore.yaml:
3419
3420 2017-04-05  Michael Saboff  <msaboff@apple.com>
3421
3422         REGRESSION (Safari 10.1): Inserting elements into arrays fails when array contains very large numbers
3423         https://bugs.webkit.org/show_bug.cgi?id=170264
3424         <rdar://problem/31375593>
3425
3426         Rubber-stamped by Saam Barati.
3427
3428         The original bug was fixed in: https://trac.webkit.org/changeset/214714
3429         I'm just adding another test for good measure.
3430
3431         * stress/double-array-to-array-storage.js: Added.
3432         (assert):
3433
3434 2017-04-05  Keith Miller  <keith_miller@apple.com>
3435
3436         WebAssembly: We shouldn't need to pin size registers if we have a fast memory.
3437         https://bugs.webkit.org/show_bug.cgi?id=170504
3438
3439         Reviewed by Mark Lam.
3440
3441         * wasm/function-tests/trap-after-cross-instance-call.js: Added.
3442         (b.new.WebAssembly.Memory):
3443         (importObject.foo.bar):
3444         (wasmFrameCountFromError):
3445
3446 2017-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3447
3448         [JSC] Generate TemplateObjects at linking time
3449         https://bugs.webkit.org/show_bug.cgi?id=169743
3450
3451         Reviewed by Keith Miller.
3452
3453         * stress/template-string-tags-eval.js: Added.
3454         (shouldBe):
3455         (tag):
3456
3457 2017-04-04  Mark Lam  <mark.lam@apple.com>
3458
3459         On ARM64, DFG::SpeculativeJIT::compileArithMod() failed to ensure result is of DataFormatInt32.
3460         https://bugs.webkit.org/show_bug.cgi?id=170473
3461         <rdar://problem/29912391>
3462
3463         Reviewed by Saam Barati.
3464
3465         * stress/regress-170473.js: Added.
3466
3467 2017-04-03  Mark Lam  <mark.lam@apple.com>
3468
3469         Fix incorrect capacity delta calculation reported in SparseArrayValueMap::add().
3470         https://bugs.webkit.org/show_bug.cgi?id=170412
3471         <rdar://problem/29697336>
3472
3473         Reviewed by Filip Pizlo.
3474
3475         * stress/regress-170412.js: Added.
3476
3477 2017-04-03  Keith Miller  <keith_miller@apple.com>
3478
3479         WebAssembly: Update spec tests
3480         https://bugs.webkit.org/show_bug.cgi?id=170361
3481
3482         Rubber-stamped by Saam Barati.
3483
3484         Update the spec tests to run tests generated by the newer spec
3485         test builder wasm-spec/test/builder.py. This patch also adds the
3486         necessary harness code in spec-harness.js so we can run the tests.
3487
3488         * wasm.yaml:
3489         * wasm/import-spec-tests.rb:
3490         * wasm/spec-harness.js: Added.
3491         (import.string_appeared_here.then):
3492         (test):
3493         (promise_test):
3494         (let.assert_unreached):
3495         * wasm/spec-harness/index.js: Added.
3496         (let.testNum):
3497         (assertThrows):
3498         (_assert):
3499         (ValueResult):
3500         (ErrorResult):
3501         (Result.prototype.isError):
3502         (binary):
3503         (module):
3504         (uniqueTest):
3505         (assert_invalid):
3506         (assert_soft_invalid):
3507         (register):
3508         (call):
3509         (get instance):
3510         (exports):
3511         (run):
3512         (assert_unlinkable):
3513         (assert_uninstantiable):
3514         (assert_trap):
3515         (try.f):
3516         (catch):
3517         (assert_exhaustion):
3518         (assert_return):
3519         (assert_return_nan):
3520         * wasm/spec-harness/testharness.css: Added.
3521         (html):
3522         (#log .warning,):
3523         (#log .error,):
3524         (section#summary):
3525         (table#results):
3526         (table#results th:first-child,):
3527         (table#results th:last-child,):
3528         (table#results.assertions th:last-child,):
3529         (table#results th):
3530         (table#results td):
3531         (tr.pass > td:first-child):
3532         (tr.fail > td:first-child):
3533         (tr.timeout > td:first-child):
3534         (tr.notrun > td:first-child):
3535         (.pass > td:first-child, .fail > td:first-child, .timeout > td:first-child, .notrun > td:first-child):
3536         (table#results span):
3537         (table#results span.expected):
3538         (table#results span.actual):
3539         (span.ok):
3540         (tr.error):
3541         (span.timeout):
3542         (span.ok, span.timeout, span.error):
3543         * wasm/spec-harness/testharness.js: Added.
3544         (WindowTestEnvironment):
3545         (WindowTestEnvironment.prototype._dispatch):
3546         (WindowTestEnvironment.prototype._forEach_windows):
3547         (WindowTestEnvironment.prototype.on_tests_ready):
3548         (WindowTestEnvironment.prototype.setup_messages):
3549         (WindowTestEnvironment.prototype.next_default_test_name):
3550         (WindowTestEnvironment.prototype.on_new_harness_properties):
3551         (WindowTestEnvironment.prototype.add_on_loaded_callback):
3552         (WindowTestEnvironment.prototype.test_timeout):
3553         (WindowTestEnvironment.prototype.global_scope):
3554         (WorkerTestEnvironment):
3555         (WorkerTestEnvironment.prototype._dispatch):
3556         (WorkerTestEnvironment.prototype._add_message_port):
3557         (WorkerTestEnvironment.prototype.next_default_test_name):
3558         (WorkerTestEnvironment.prototype.on_new_harness_properties):
3559         (WorkerTestEnvironment.prototype.on_tests_ready):
3560         (WorkerTestEnvironment.prototype.add_on_loaded_callback):
3561         (WorkerTestEnvironment.prototype.test_timeout):
3562         (WorkerTestEnvironment.prototype.global_scope):
3563         (DedicatedWorkerTestEnvironment):
3564         (DedicatedWorkerTestEnvironment.prototype.on_tests_ready):
3565         (SharedWorkerTestEnvironment):
3566         (SharedWorkerTestEnvironment.prototype.on_tests_ready):
3567         (ServiceWorkerTestEnvironment):
3568         (ServiceWorkerTestEnvironment.prototype.add_on_loaded_callback):
3569         (create_test_environment):
3570         (is_shared_worker):
3571         (is_service_worker):
3572         (test):
3573         (async_test):
3574         (promise_test):
3575         (this.wait_for):
3576         (EventWatcher):
3577         (setup):
3578         (done):
3579         (generate_tests):
3580         (step_timeout):
3581         (truncate):
3582         (is_node):
3583         (format_value):
3584         * wasm/spec-harness/testharnessreport.js: Added.
3585         * wasm/spec-harness/wasm-constants.js: Added.
3586         (bytes):
3587         (bytesWithHeader):
3588         (makeSig):
3589         (makeSig_v_x):
3590         (makeSig_v_xx):
3591         (makeSig_r_v):
3592         (makeSig_r_x):
3593         (makeSig_r_xx):
3594         (assertTraps):
3595         (assertWasmThrows):
3596         * wasm/spec-harness/wasm-module-builder.js: Added.
3597         (Binary.prototype.emit_u8):
3598         (Binary.prototype.emit_u16):
3599         (Binary.prototype.emit_u32):
3600         (Binary.prototype.emit_u32v):
3601         (Binary.prototype.emit_bytes):
3602         (Binary.prototype.emit_string):
3603         (Binary.prototype.emit_header):
3604         (Binary.prototype.emit_section):
3605         (Binary):
3606         (WasmFunctionBuilder):
3607         (WasmFunctionBuilder.prototype.exportAs):
3608         (WasmFunctionBuilder.prototype.exportFunc):
3609         (WasmFunctionBuilder.prototype.addBody):
3610         (WasmFunctionBuilder.prototype.addLocals):
3611         (WasmFunctionBuilder.prototype.end):
3612         (WasmGlobalBuilder):
3613         (WasmGlobalBuilder.prototype.exportAs):
3614         (WasmModuleBuilder):
3615         (WasmModuleBuilder.prototype.addStart):
3616         (WasmModuleBuilder.prototype.addMemory):
3617         (WasmModuleBuilder.prototype.addExplicitSection):
3618         (WasmModuleBuilder.prototype.addType):
3619         (WasmModuleBuilder.prototype.addGlobal):
3620         (WasmModuleBuilder.prototype.addFunction):
3621         (WasmModuleBuilder.prototype.addImport):
3622         (WasmModuleBuilder.prototype.addImportedGlobal):
3623         (WasmModuleBuilder.prototype.addImportedMemory):
3624         (WasmModuleBuilder.prototype.addImportedTable):
3625         (WasmModuleBuilder.prototype.addExport):
3626         (WasmModuleBuilder.prototype.addExportOfKind):
3627         (WasmModuleBuilder.prototype.addDataSegment):
3628         (WasmModuleBuilder.prototype.exportMemoryAs):
3629         (WasmModuleBuilder.prototype.addFunctionTableInit):
3630         (WasmModuleBuilder.prototype.appendToTable):
3631         (WasmModuleBuilder.prototype.setFunctionTableLength):
3632         (WasmModuleBuilder.prototype.toArray):
3633         (WasmModuleBuilder.prototype.toBuffer):
3634         (WasmModuleBuilder.prototype.instantiate):
3635         * wasm/spec-harness/wast.js: Added.
3636         (normalize):
3637         (require.else._registry.name):
3638         (require):
3639         (add_hex_char):
3640         (add_char):
3641         (string_with):
3642         (list_of_opt):
3643         (break_bytes.f):
3644         (break_bytes):
3645         (f):
3646         (decls):
3647         (func_type):
3648         (limits):
3649         (global_type):
3650         (testop):
3651         (relop):
3652         (unop):
3653         (binop):
3654         (cvtop):
3655         (oper):
3656         (mem_size):
3657         (extension):
3658         (memop):
3659         (storeop):
3660         (var):
3661         (constop):
3662         (instr.else.switch.case.0.f):
3663         (instr.else.switch.case.1.f.1):
3664         (instr.else.switch.case.2.f.2):
3665         (instr):
3666         (func_with_name):
3667         (func):
3668         (start):
3669         (table):
3670         (memory):
3671         (segment):
3672         (elems):
3673         (data):
3674         (typedef):
3675         (import_kind):
3676         (import):
3677         (export_kind):
3678         (export):
3679         (var_opt):
3680         (is_func_import):
3681         (is_table_import):
3682         (is_memory_import):
3683         (is_global_import):
3684         (f.1):
3685         (f.2):
3686         (f.3):
3687         (module_with_var_opt):
3688         (module_):
3689         (literal):
3690         (definition):
3691         (access):
3692         (action):
3693         (script):
3694         (_registry.string_appeared_here):
3695         (init):
3696         (make_matrix):
3697         (copy):
3698         (append):
3699         (sub):
3700         (fill):
3701         (blit):
3702         (iter):
3703         (map):
3704         (iteri):
3705         (mapi):
3706         (to_list):
3707         (list_length):
3708         (of_list):
3709         (fold_left):
3710         (fold_right):
3711         (maxson):
3712         (trickle):
3713         (bubble):
3714         (trickleup):
3715         (sort):
3716         (merge):
3717         (isortto):
3718         (sortto):
3719         (stable_sort):
3720         (import_type):
3721         (export_type):
3722         (dims.n):
3723         (dims.d.i):
3724         (dims):
3725         (map_file):
3726         (create):
3727         (of_array):
3728         (slice_left):
3729         (slice_right):
3730         (slice_left_1):
3731         (slice_right_1):
3732         (slice_left_2):
3733         (slice_right_2):
3734         (array1_of_genarray):
3735         (array2_of_genarray):
3736         (array3_of_genarray):
3737         (reshape_1):
3738         (reshape_2):
3739         (reshape_3):
3740         (reshape):
3741         (__):
3742         (contents):
3743         (to_bytes):
3744         (nth):
3745         (length):
3746         (clear):
3747         (reset):
3748         (resize):
3749         (add_substring):
3750         (add_subbytes):
3751         (add_string):
3752         (add_bytes):
3753         (add_buffer):
3754         (add_channel):
3755         (output_buffer):
3756         (closing):
3757         (advance_to_closing):
3758         (advance_to_non_alpha):
3759         (find_ident):
3760         (add_substitute):
3761         (make):
3762         (to_string):
3763         (of_string):
3764         (sub_string):
3765         (extend):
3766         (blit_string):
3767         (concat):
3768         (cat):
3769         (is_space):
3770         (trim):