JSTests/ChangeLog

   1 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
   2
   3         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
   4         https://bugs.webkit.org/show_bug.cgi?id=144458
   5
   6         Reviewed by Saam Barati.
   7
   8         * microbenchmarks/dfg-internal-function-call.js: Added.
   9         (target):
  10         * microbenchmarks/dfg-internal-function-construct.js: Added.
  11         (target):
  12         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
  13         (target):
  14         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
  15         (target):
  16         * stress/dfg-internal-function-call.js: Added.
  17         (shouldBe):
  18         (target):
  19         * stress/dfg-internal-function-construct.js: Added.
  20         (shouldBe):
  21         (target):
  22         * stress/internal-function-call.js: Added.
  23         (shouldBe):
  24         * stress/internal-function-construct.js: Added.
  25         (shouldBe):
  26
  27 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
  28
  29         [Win] Skip stress/regress-178385.js.
  30         https://bugs.webkit.org/show_bug.cgi?id=179298
  31
  32         Unreviewed test gardening.
  33
  34         * stress/regress-178385.js:
  35
  36 2017-11-03  Keith Miller  <keith_miller@apple.com>
  37
  38         Add test for ic with side effects
  39         https://bugs.webkit.org/show_bug.cgi?id=179268
  40
  41         Reviewed by Saam Barati.
  42
  43         * stress/put-inline-cache-side-effects.js: Added.
  44         (let.i.of.objs.keys):
  45         (f):
  46
  47 2017-11-03  Mark Lam  <mark.lam@apple.com>
  48
  49         CachedCall (and its clients) needs overflow checks.
  50         https://bugs.webkit.org/show_bug.cgi?id=179185
  51
  52         Reviewed by JF Bastien.
  53
  54         * stress/regress-179185.js: Added.
  55
  56 2017-11-02  Michael Saboff  <msaboff@apple.com>
  57
  58         DFG needs to handle code motion of code in for..in loop bodies
  59         https://bugs.webkit.org/show_bug.cgi?id=179212
  60
  61         Reviewed by Keith Miller.
  62
  63         New regression test.
  64
  65         * stress/for-in-side-effects.js: Added.
  66         (getPrototypeOf):
  67         (reset):
  68         (testWithoutFTL.f):
  69         (testWithoutFTL):
  70         (testWithFTL.f):
  71         (testWithFTL):
  72
  73 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
  74
  75         AI does not correctly model the clobber case of ArithClz32
  76         https://bugs.webkit.org/show_bug.cgi?id=179188
  77
  78         Reviewed by Michael Saboff.
  79
  80         * stress/arith-clz32-effects.js: Added.
  81         (foo):
  82         (valueOf):
  83
  84 2017-11-01  Michael Saboff  <msaboff@apple.com>
  85
  86         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
  87         https://bugs.webkit.org/show_bug.cgi?id=179140
  88
  89         Reviewed by Saam Barati.
  90
  91         New regression test.
  92
  93         * stress/regress-179140.js: Added.
  94         (testWithoutFTL):
  95         (testWithFTL):
  96
  97 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
  98
  99         [JSC] Introduce @toObject
 100         https://bugs.webkit.org/show_bug.cgi?id=178726
 101
 102         Reviewed by Saam Barati.
 103
 104         * stress/array-copywithin.js:
 105         (shouldThrow):
 106         * stress/object-constructor-boolean-edge.js: Added.
 107         (shouldBe):
 108         (test):
 109         * stress/object-constructor-global.js: Added.
 110         (shouldBe):
 111         * stress/object-constructor-null-edge.js: Added.
 112         (shouldBe):
 113         (test):
 114         * stress/object-constructor-number-edge.js: Added.
 115         (shouldBe):
 116         (test):
 117         * stress/object-constructor-object-edge.js: Added.
 118         (shouldBe):
 119         (test):
 120         (i.arg):
 121         * stress/object-constructor-string-edge.js: Added.
 122         (shouldBe):
 123         (test):
 124         * stress/object-constructor-symbol-edge.js: Added.
 125         (shouldBe):
 126         (test):
 127         * stress/object-constructor-undefined-edge.js: Added.
 128         (shouldBe):
 129         (test):
 130         * stress/symbol-array-from.js: Added.
 131         (shouldBe):
 132         * stress/to-object-intrinsic-boolean-edge.js: Added.
 133         (shouldBe):
 134         (builtin.createBuiltin):
 135         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
 136         (shouldThrow):
 137         * stress/to-object-intrinsic-number-edge.js: Added.
 138         (shouldBe):
 139         (builtin.createBuiltin):
 140         * stress/to-object-intrinsic-object-edge.js: Added.
 141         (shouldBe):
 142         (builtin.createBuiltin):
 143         (i.arg):
 144         * stress/to-object-intrinsic-string-edge.js: Added.
 145         (shouldBe):
 146         (builtin.createBuiltin):
 147         * stress/to-object-intrinsic-symbol-edge.js: Added.
 148         (shouldBe):
 149         (builtin.createBuiltin):
 150         * stress/to-object-intrinsic.js: Added.
 151         (shouldBe):
 152         (shouldThrow):
 153         (builtin.createBuiltin):
 154
 155 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
 156
 157         [DFG][FTL] Introduce StringSlice
 158         https://bugs.webkit.org/show_bug.cgi?id=178934
 159
 160         Reviewed by Saam Barati.
 161
 162         * microbenchmarks/string-slice-empty.js: Added.
 163         (slice):
 164         * microbenchmarks/string-slice-one-char.js: Added.
 165         (slice):
 166         * microbenchmarks/string-slice.js: Added.
 167         (slice):
 168
 169 2017-10-26  Michael Saboff  <msaboff@apple.com>
 170
 171         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
 172         https://bugs.webkit.org/show_bug.cgi?id=178890
 173
 174         Reviewed by Keith Miller.
 175
 176         New regression test.
 177
 178         * stress/regress-178890.js: Added.
 179
 180 2017-10-26  Mark Lam  <mark.lam@apple.com>
 181
 182         JSRopeString::RopeBuilder::append() should check for overflows.
 183         https://bugs.webkit.org/show_bug.cgi?id=178385
 184         <rdar://problem/35027468>
 185
 186         Reviewed by Saam Barati.
 187
 188         * stress/regress-178385.js: Added.
 189
 190 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
 191
 192         Unreviewed, rolling out r223961.
 193
 194         The change that required this has been rolled out.
 195
 196         Reverted changeset:
 197
 198         "Mark test262.yaml/test262/test/language/statements/try/tco-
 199         catch.js as passing."
 200         https://bugs.webkit.org/show_bug.cgi?id=178592
 201         https://trac.webkit.org/changeset/223961
 202
 203 2017-10-25  Commit Queue  <commit-queue@webkit.org>
 204
 205         Unreviewed, rolling out r223691 and r223729.
 206         https://bugs.webkit.org/show_bug.cgi?id=178834
 207
 208         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
 209         by rniwa on #webkit).
 210
 211         Reverted changesets:
 212
 213         "Turn recursive tail calls into loops"
 214         https://bugs.webkit.org/show_bug.cgi?id=176601
 215         https://trac.webkit.org/changeset/223691
 216
 217         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
 218         comparison is always false due to limited range of data type
 219         [-Wtype-limits]"
 220         https://bugs.webkit.org/show_bug.cgi?id=178543
 221         https://trac.webkit.org/changeset/223729
 222
 223 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
 224
 225         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
 226         https://bugs.webkit.org/show_bug.cgi?id=178592
 227
 228         Unreviewed test gardening.
 229
 230         * test262.yaml:
 231
 232 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
 233
 234         [FTL] Support NewStringObject
 235         https://bugs.webkit.org/show_bug.cgi?id=178737
 236
 237         Reviewed by Saam Barati.
 238
 239         * stress/new-string-object.js: Added.
 240         (shouldBe):
 241         (test):
 242
 243 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 244
 245         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
 246         https://bugs.webkit.org/show_bug.cgi?id=178308
 247
 248         Reviewed by Mark Lam.
 249
 250         * test262.yaml:
 251
 252 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 253
 254         [JSC] Use fastJoin in Array#toString
 255         https://bugs.webkit.org/show_bug.cgi?id=178062
 256
 257         Reviewed by Darin Adler.
 258
 259         * microbenchmarks/contiguous-array-to-string.js: Added.
 260         (target):
 261         * microbenchmarks/double-array-to-string.js: Added.
 262         (target):
 263         * microbenchmarks/int32-array-to-string.js: Added.
 264         (target):
 265
 266 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
 267
 268         stress/check-string-ident.js is improperly skipped
 269         https://bugs.webkit.org/show_bug.cgi?id=178642
 270
 271         Reviewed by Saam Barati.
 272
 273         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
 274         since it enforces the run-jsc-stress-tests script to still set up the
 275         test to run, despite the skip directive that's used before.
 276
 277 2017-10-20  Mark Lam  <mark.lam@apple.com>
 278
 279         Add a test case for r214334.
 280         https://bugs.webkit.org/show_bug.cgi?id=169941
 281         <rdar://problem/31221258>
 282
 283         Reviewed by JF Bastien.
 284
 285         * stress/regress-169941.js: Added.
 286
 287 2017-10-19  JF Bastien  <jfbastien@apple.com>
 288
 289         WebAssembly: no VM / JS version of everything but Instance
 290         https://bugs.webkit.org/show_bug.cgi?id=177473
 291
 292         Reviewed by Filip Pizlo, Saam Barati.
 293
 294         - Exceeding max on memory growth now returns a range error as per
 295         spec. This is a (very minor) breaking change: it used to throw OOM
 296         error. Update the corresponding test.
 297
 298         * wasm/js-api/memory-grow.js:
 299         (assertEq):
 300         * wasm/js-api/table.js:
 301         (assert.throws):
 302
 303 2017-10-19  Mark Lam  <mark.lam@apple.com>
 304
 305         Stringifier::appendStringifiedValue() is missing an exception check.
 306         https://bugs.webkit.org/show_bug.cgi?id=178386
 307         <rdar://problem/35027610>
 308
 309         Reviewed by Saam Barati.
 310
 311         * stress/regress-178386.js: Added.
 312
 313 2017-10-19  Michael Saboff  <msaboff@apple.com>
 314
 315         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
 316         https://bugs.webkit.org/show_bug.cgi?id=178521
 317
 318         Reviewed by JF Bastien.
 319
 320         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
 321         now passes with the current version (5.0) of the Emoji spec.
 322
 323 2017-10-19  Robin Morisset  <rmorisset@apple.com>
 324
 325         Turn recursive tail calls into loops
 326         https://bugs.webkit.org/show_bug.cgi?id=176601
 327
 328         Reviewed by Saam Barati.
 329
 330         Add some simple test that computes factorial in several ways, and other trivial computations.
 331         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
 332         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
 333         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
 334         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
 335
 336         * stress/inline-call-to-recursive-tail-call.js: Added.
 337         (factorial.aux):
 338         (factorial):
 339         (factorial2.aux):
 340         (factorial2.id):
 341         (factorial2):
 342         (factorial3.aux):
 343         (factorial3):
 344         (aux):
 345         (factorial4):
 346         (test):
 347
 348 2017-10-18  Mark Lam  <mark.lam@apple.com>
 349
 350         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
 351         https://bugs.webkit.org/show_bug.cgi?id=177600
 352         <rdar://problem/34710985>
 353
 354         Reviewed by Saam Barati.
 355
 356         * stress/regress-177600.js: Added.
 357
 358 2017-10-18  Mark Lam  <mark.lam@apple.com>
 359
 360         The compiler should always register a structure when it adds its transitionWatchPointSet.
 361         https://bugs.webkit.org/show_bug.cgi?id=178420
 362         <rdar://problem/34814024>
 363
 364         Reviewed by Saam Barati and Filip Pizlo.
 365
 366         * stress/regress-178420.js: Added.
 367         (new.Array.10000.map):
 368
 369 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 370
 371         [JSC] __proto__ getter should be fast
 372         https://bugs.webkit.org/show_bug.cgi?id=178067
 373
 374         Reviewed by Saam Barati.
 375
 376         * stress/dfg-object-proto-accessor.js: Added.
 377         (shouldBe):
 378         (shouldThrow):
 379         (target):
 380         * stress/dfg-object-proto-getter.js: Added.
 381         (shouldBe):
 382         (shouldThrow):
 383         (target):
 384         * stress/dfg-object-prototype-of.js: Added.
 385         (shouldBe):
 386         (shouldThrow):
 387         (target):
 388         * stress/dfg-reflect-get-prototype-of.js: Added.
 389         (shouldBe):
 390         (shouldThrow):
 391         (target):
 392         * stress/intrinsic-getter-with-poly-proto.js: Added.
 393         (shouldBe):
 394         (makePolyProtoObject.foo.C):
 395         (makePolyProtoObject.foo):
 396         (makePolyProtoObject):
 397         (target):
 398         * stress/object-get-prototype-of-filtered.js: Added.
 399         (shouldBe):
 400         (shouldThrow):
 401         (target):
 402         (i.Cocoa):
 403         * stress/object-get-prototype-of-mono-proto.js: Added.
 404         (shouldBe):
 405         (makePolyProtoObject.foo.C):
 406         (makePolyProtoObject.foo):
 407         (makePolyProtoObject):
 408         (target):
 409         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 410         (shouldBe):
 411         (makePolyProtoObject.foo.C):
 412         (makePolyProtoObject.foo):
 413         (makePolyProtoObject):
 414         (target):
 415         * stress/object-get-prototype-of-poly-proto.js: Added.
 416         (shouldBe):
 417         (makePolyProtoObject.foo.C):
 418         (makePolyProtoObject.foo):
 419         (makePolyProtoObject):
 420         (target):
 421         * stress/object-proto-getter-filtered.js: Added.
 422         (shouldBe):
 423         (shouldThrow):
 424         (target):
 425         (i.Cocoa):
 426         * stress/object-proto-getter-poly-mono-proto.js: Added.
 427         (shouldBe):
 428         (makePolyProtoObject.foo.C):
 429         (makePolyProtoObject.foo):
 430         (makePolyProtoObject):
 431         (target):
 432         * stress/object-proto-getter-poly-proto.js: Added.
 433         (shouldBe):
 434         (makePolyProtoObject.foo.C):
 435         (makePolyProtoObject.foo):
 436         (makePolyProtoObject):
 437         (target):
 438         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 439         * stress/string-proto.js: Added.
 440         (shouldBe):
 441         (target):
 442
 443 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
 444
 445         Unreviewed, rolling out r223523.
 446
 447         A test for this change is failing on debug JSC bots.
 448
 449         Reverted changeset:
 450
 451         "[JSC] __proto__ getter should be fast"
 452         https://bugs.webkit.org/show_bug.cgi?id=178067
 453         https://trac.webkit.org/changeset/223523
 454
 455 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
 456
 457         [JSC] __proto__ getter should be fast
 458         https://bugs.webkit.org/show_bug.cgi?id=178067
 459
 460         Reviewed by Saam Barati.
 461
 462         * stress/dfg-object-proto-accessor.js: Added.
 463         (shouldBe):
 464         (shouldThrow):
 465         (target):
 466         * stress/dfg-object-proto-getter.js: Added.
 467         (shouldBe):
 468         (shouldThrow):
 469         (target):
 470         * stress/dfg-object-prototype-of.js: Added.
 471         (shouldBe):
 472         (shouldThrow):
 473         (target):
 474         * stress/dfg-reflect-get-prototype-of.js: Added.
 475         (shouldBe):
 476         (shouldThrow):
 477         (target):
 478         * stress/object-get-prototype-of-filtered.js: Added.
 479         (shouldBe):
 480         (shouldThrow):
 481         (target):
 482         (i.Cocoa):
 483         * stress/object-get-prototype-of-mono-proto.js: Added.
 484         (shouldBe):
 485         (makePolyProtoObject.foo.C):
 486         (makePolyProtoObject.foo):
 487         (makePolyProtoObject):
 488         (target):
 489         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 490         (shouldBe):
 491         (makePolyProtoObject.foo.C):
 492         (makePolyProtoObject.foo):
 493         (makePolyProtoObject):
 494         (target):
 495         * stress/object-get-prototype-of-poly-proto.js: Added.
 496         (shouldBe):
 497         (makePolyProtoObject.foo.C):
 498         (makePolyProtoObject.foo):
 499         (makePolyProtoObject):
 500         (target):
 501         * stress/object-proto-getter-filtered.js: Added.
 502         (shouldBe):
 503         (shouldThrow):
 504         (target):
 505         (i.Cocoa):
 506         * stress/object-proto-getter-poly-mono-proto.js: Added.
 507         (shouldBe):
 508         (makePolyProtoObject.foo.C):
 509         (makePolyProtoObject.foo):
 510         (makePolyProtoObject):
 511         (target):
 512         * stress/object-proto-getter-poly-proto.js: Added.
 513         (shouldBe):
 514         (makePolyProtoObject.foo.C):
 515         (makePolyProtoObject.foo):
 516         (makePolyProtoObject):
 517         (target):
 518         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 519         * stress/string-proto.js: Added.
 520         (shouldBe):
 521         (target):
 522
 523 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 524
 525         Reland "Add Above/Below comparisons for UInt32 patterns"
 526         https://bugs.webkit.org/show_bug.cgi?id=177281
 527
 528         Reviewed by Saam Barati.
 529
 530         * stress/uint32-comparison-jump.js: Added.
 531         (shouldBe):
 532         (above):
 533         (aboveOrEqual):
 534         (below):
 535         (belowOrEqual):
 536         (notAbove):
 537         (notAboveOrEqual):
 538         (notBelow):
 539         (notBelowOrEqual):
 540         * stress/uint32-comparison.js: Added.
 541         (shouldBe):
 542         (above):
 543         (aboveOrEqual):
 544         (below):
 545         (belowOrEqual):
 546         (aboveTest):
 547         (aboveOrEqualTest):
 548         (belowTest):
 549         (belowOrEqualTest):
 550
 551 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
 552
 553         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
 554         https://bugs.webkit.org/show_bug.cgi?id=178210
 555
 556         Reviewed by Saam Barati.
 557
 558         * wasm/function-tests/trap-from-start-async.js:
 559         (async.StartTrapsAsync):
 560         * wasm/function-tests/trap-from-start.js:
 561         (StartTraps):
 562         * wasm/js-api/web-assembly-function.js:
 563         (assert.eq.Object.getPrototypeOf):
 564         * wasm/js-api/wrapper-function.js:
 565         (return.new.WebAssembly.Module):
 566         (assert.throws.makeInstance): Deleted.
 567         (assert.throws.Bar): Deleted.
 568         (assert.throws): Deleted.
 569
 570 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 571
 572         Enable gigacage on iOS
 573         https://bugs.webkit.org/show_bug.cgi?id=177586
 574
 575         Reviewed by JF Bastien.
 576
 577         Add tests for when Gigacage gets runtime disabled.
 578
 579         * stress/disable-gigacage-arrays.js: Added.
 580         (foo):
 581         * stress/disable-gigacage-strings.js: Added.
 582         (foo):
 583         * stress/disable-gigacage-typed-arrays.js: Added.
 584         (foo):
 585
 586 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 587
 588         import.meta should not be assignable
 589         https://bugs.webkit.org/show_bug.cgi?id=178202
 590
 591         Reviewed by Saam Barati.
 592
 593         * modules/import-meta-assignment.js: Added.
 594         (shouldThrow):
 595         (SyntaxError.import.meta.can.shouldThrow):
 596
 597 2017-10-11  Saam Barati  <sbarati@apple.com>
 598
 599         Unreviewed. Actually skip certain type profiler tests in debug.
 600
 601         * typeProfiler.yaml:
 602         * typeProfiler/deltablue-for-of.js:
 603         * typeProfiler/getter-richards.js:
 604
 605 2017-10-11  Commit Queue  <commit-queue@webkit.org>
 606
 607         Unreviewed, rolling out r223113 and r223121.
 608         https://bugs.webkit.org/show_bug.cgi?id=178182
 609
 610         Reintroduced 20% regression on Kraken (Requested by rniwa on
 611         #webkit).
 612
 613         Reverted changesets:
 614
 615         "Enable gigacage on iOS"
 616         https://bugs.webkit.org/show_bug.cgi?id=177586
 617         https://trac.webkit.org/changeset/223113
 618
 619         "Use one virtual allocation for all gigacages and their
 620         runways"
 621         https://bugs.webkit.org/show_bug.cgi?id=178050
 622         https://trac.webkit.org/changeset/223121
 623
 624 2017-10-11  Michael Saboff  <msaboff@apple.com>
 625
 626         Disable test262 named capture group tests with direct unicode names and with references before definitions
 627         https://bugs.webkit.org/show_bug.cgi?id=178177
 628
 629         Reviewed by Keith Miller.
 630
 631         Bugs to track fixing these test are:
 632         https://bugs.webkit.org/show_bug.cgi?id=178174 -
 633             "Add support in named capture group identifiers for direct surrogate pairs"
 634         https://bugs.webkit.org/show_bug.cgi?id=178175 -
 635             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
 636
 637         * test262.yaml:
 638
 639 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
 640
 641         Object properties are undefined in super.call() but not in this.call()
 642         https://bugs.webkit.org/show_bug.cgi?id=177230
 643
 644         Reviewed by Saam Barati.
 645
 646         * stress/super-call-function-subclass.js: Added.
 647         (assert):
 648         (A.prototype.t):
 649         (A):
 650         * stress/super-dot-call-and-apply.js: Added.
 651         (assert):
 652         (A):
 653         (A.prototype.call):
 654         (A.prototype.apply):
 655         (B.prototype.testSuper):
 656         (B):
 657         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
 658         (D.prototype.testSuper):
 659         (D):
 660
 661 2017-10-10  Saam Barati  <sbarati@apple.com>
 662
 663         The prototype cache should be aware of the Executable it generates a Structure for
 664         https://bugs.webkit.org/show_bug.cgi?id=177907
 665
 666         Reviewed by Filip Pizlo.
 667
 668         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
 669         (assert):
 670         (foo.C):
 671         (foo):
 672         (bar.C):
 673         (bar):
 674         (access):
 675         (makeLongChain):
 676         (accessY):
 677
 678 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
 679
 680         `async` should be able to be used as an imported binding name
 681         https://bugs.webkit.org/show_bug.cgi?id=176573
 682
 683         Reviewed by Saam Barati.
 684
 685         * modules/import-default-async.js: Added.
 686         * modules/import-named-async-as.js: Added.
 687         * modules/import-named-async.js: Added.
 688         * modules/import-named-async/target.js: Added.
 689         * modules/import-namespace-async.js: Added.
 690         * test262.yaml:
 691
 692 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 693
 694         Enable gigacage on iOS
 695         https://bugs.webkit.org/show_bug.cgi?id=177586
 696
 697         Reviewed by JF Bastien.
 698
 699         Add tests for when Gigacage gets runtime disabled.
 700
 701         * stress/disable-gigacage-arrays.js: Added.
 702         (foo):
 703         * stress/disable-gigacage-strings.js: Added.
 704         (foo):
 705         * stress/disable-gigacage-typed-arrays.js: Added.
 706         (foo):
 707
 708 2017-10-09  Michael Saboff  <msaboff@apple.com>
 709
 710         Implement RegExp Unicode property escapes
 711         https://bugs.webkit.org/show_bug.cgi?id=172069
 712
 713         Reviewed by JF Bastien.
 714
 715         Enabled Unicode Property tests.
 716
 717         * test262.yaml:
 718
 719 2017-10-09  Commit Queue  <commit-queue@webkit.org>
 720
 721         Unreviewed, rolling out r223015 and r223025.
 722         https://bugs.webkit.org/show_bug.cgi?id=178093
 723
 724         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
 725         #webkit).
 726
 727         Reverted changesets:
 728
 729         "Enable gigacage on iOS"
 730         https://bugs.webkit.org/show_bug.cgi?id=177586
 731         http://trac.webkit.org/changeset/223015
 732
 733         "Unreviewed, disable Gigacage on ARM64 Linux"
 734         https://bugs.webkit.org/show_bug.cgi?id=177586
 735         http://trac.webkit.org/changeset/223025
 736
 737 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 738
 739         Update expectations for test262 tests that pass after r223043.
 740         https://bugs.webkit.org/show_bug.cgi?id=176685
 741
 742         Unreviewed test gardening.
 743
 744         * test262.yaml:
 745
 746 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 747
 748         Unreviewed, rolling out r223022.
 749
 750         This change introduced 18 test262 failures.
 751
 752         Reverted changeset:
 753
 754         "`async` should be able to be used as an imported binding
 755         name"
 756         https://bugs.webkit.org/show_bug.cgi?id=176573
 757         http://trac.webkit.org/changeset/223022
 758
 759 2017-10-09  Saam Barati  <sbarati@apple.com>
 760
 761         3 poly-proto JSC tests timing out on debug after r222827
 762         https://bugs.webkit.org/show_bug.cgi?id=177880
 763         <rdar://problem/34817122>
 764
 765         Unreviewed.
 766
 767         I'm skipping these type profiler tests on debug since they are long running.
 768
 769         * typeProfiler/deltablue-for-of.js:
 770         * typeProfiler/getter-richards.js:
 771
 772 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
 773
 774         Safari 10 /11 problem with if (!await get(something)).
 775         https://bugs.webkit.org/show_bug.cgi?id=176685
 776
 777         Reviewed by Saam Barati.
 778
 779         * stress/async-await-basic.js:
 780         (awaitEpression.async):
 781         * stress/async-await-syntax.js:
 782         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
 783         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
 784
 785 2017-10-08  Saam Barati  <sbarati@apple.com>
 786
 787         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
 788
 789         * typeProfiler/deltablue-for-of.js:
 790         * typeProfiler/getter-richards.js:
 791
 792 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 793
 794         `async` should be able to be used as an imported binding name
 795         https://bugs.webkit.org/show_bug.cgi?id=176573
 796
 797         Reviewed by Darin Adler.
 798
 799         * modules/import-default-async.js: Added.
 800         * modules/import-named-async-as.js: Added.
 801         * modules/import-named-async.js: Added.
 802         * modules/import-named-async/target.js: Added.
 803         * modules/import-namespace-async.js: Added.
 804
 805 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 806
 807         Enable gigacage on iOS
 808         https://bugs.webkit.org/show_bug.cgi?id=177586
 809
 810         Reviewed by JF Bastien.
 811
 812         Add tests for when Gigacage gets runtime disabled.
 813
 814         * stress/disable-gigacage-arrays.js: Added.
 815         (foo):
 816         * stress/disable-gigacage-strings.js: Added.
 817         (foo):
 818         * stress/disable-gigacage-typed-arrays.js: Added.
 819         (foo):
 820
 821 2017-10-06  Commit Queue  <commit-queue@webkit.org>
 822
 823         Unreviewed, rolling out r222791 and r222873.
 824         https://bugs.webkit.org/show_bug.cgi?id=178031
 825
 826         Caused crashes with workers/wasm LayoutTests (Requested by
 827         ryanhaddad on #webkit).
 828
 829         Reverted changesets:
 830
 831         "WebAssembly: no VM / JS version of everything but Instance"
 832         https://bugs.webkit.org/show_bug.cgi?id=177473
 833         http://trac.webkit.org/changeset/222791
 834
 835         "WebAssembly: address no VM / JS follow-ups"
 836         https://bugs.webkit.org/show_bug.cgi?id=177887
 837         http://trac.webkit.org/changeset/222873
 838
 839 2017-10-05  Saam Barati  <sbarati@apple.com>
 840
 841         Make sure all prototypes under poly proto get added into the VM's prototype map
 842         https://bugs.webkit.org/show_bug.cgi?id=177909
 843
 844         Reviewed by Keith Miller.
 845
 846         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
 847         (assert):
 848         (foo.C):
 849         (foo):
 850         (set x):
 851
 852 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
 853
 854         [JSC] Introduce import.meta
 855         https://bugs.webkit.org/show_bug.cgi?id=177703
 856
 857         Reviewed by Filip Pizlo.
 858
 859         * modules/import-meta-syntax.js: Added.
 860         (shouldThrow):
 861         (shouldNotThrow):
 862         * modules/import-meta.js: Added.
 863         * modules/import-meta/cocoa.js: Added.
 864         * modules/resources/assert.js:
 865         (export.shouldNotThrow):
 866         * stress/import-syntax.js:
 867
 868 2017-10-04  Saam Barati  <sbarati@apple.com>
 869
 870         Make pertinent AccessCases watch the poly proto watchpoint
 871         https://bugs.webkit.org/show_bug.cgi?id=177765
 872
 873         Reviewed by Keith Miller.
 874
 875         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
 876         (assert):
 877         (foo.C):
 878         (foo):
 879         (validate):
 880         * stress/poly-proto-clear-stub.js: Added.
 881         (assert):
 882         (foo.C):
 883         (foo):
 884
 885 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
 886
 887         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
 888
 889         Unreviewed test gardening.
 890
 891         * test262.yaml:
 892
 893 2017-10-04  Saam Barati  <sbarati@apple.com>
 894
 895         3 poly-proto JSC tests timing out on debug after r222827
 896         https://bugs.webkit.org/show_bug.cgi?id=177880
 897
 898         Rubber stamped by Mark Lam.
 899
 900         * microbenchmarks/poly-proto-access.js:
 901         * typeProfiler/deltablue-for-of.js:
 902         * typeProfiler/getter-richards.js:
 903
 904 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
 905
 906         Unreviewed, marking tco-catch.js as a failure after test262 update
 907         https://bugs.webkit.org/show_bug.cgi?id=177859
 908
 909         * test262.yaml:
 910
 911 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 912
 913         Unreviewed, marking one async iterator test262 test failed
 914         https://bugs.webkit.org/show_bug.cgi?id=177859
 915
 916         * test262.yaml:
 917
 918 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 919
 920         [Test262] Update Test262 to Oct 4 version
 921         https://bugs.webkit.org/show_bug.cgi?id=177859
 922
 923         Reviewed by Sam Weinig.
 924
 925         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
 926         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
 927
 928         * test262.yaml:
 929         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
 930         (checkSequence):
 931         * test262/harness/typeCoercion.js:
 932         (testCoercibleToIndexZero):
 933         (testCoercibleToIndexOne):
 934         (testCoercibleToIndexFromIndex):
 935         (testNotCoercibleToIndex.testPrimitiveValue):
 936         (testNotCoercibleToInteger):
 937         (testCoercibleToBigIntZero.testPrimitiveValue):
 938         (testCoercibleToBigIntZero):
 939         (testCoercibleToBigIntOne.testPrimitiveValue):
 940         (testCoercibleToBigIntOne):
 941         (testPrimitiveValue):
 942         (testCoercibleToBigIntFromBigInt):
 943         (testNotCoercibleToBigInt.testPrimitiveValue):
 944         (testNotCoercibleToBigInt.testStringValue):
 945         (testNotCoercibleToBigInt):
 946         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
 947         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
 948         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
 949         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
 950         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
 951         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
 952         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
 953         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
 954         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
 955         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
 956         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
 957         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
 958         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
 959         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
 960         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
 961         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
 962         (testCoercibleToBigIntZero):
 963         (testCoercibleToBigIntOne):
 964         (testNotCoercibleToBigInt):
 965         (MyError): Deleted.
 966         (valueOf): Deleted.
 967         (toString): Deleted.
 968         (Symbol.toPrimitive): Deleted.
 969         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
 970         (testCoercibleToIndexZero):
 971         (testCoercibleToIndexOne):
 972         (testNotCoercibleToIndex):
 973         (MyError): Deleted.
 974         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
 975         (assert.sameValue.BigInt.asIntN.toString): Deleted.
 976         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
 977         (BigInt.asIntN.valueOf): Deleted.
 978         (BigInt.asIntN.toString): Deleted.
 979         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
 980         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
 981         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
 982         (testCoercibleToBigIntZero):
 983         (testCoercibleToBigIntOne):
 984         (testNotCoercibleToBigInt):
 985         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
 986         (testCoercibleToIndexZero):
 987         (testCoercibleToIndexOne):
 988         (testNotCoercibleToIndex):
 989         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
 990         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
 991         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
 992         (bits.valueOf):
 993         (bigint.valueOf):
 994         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
 995         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
 996         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
 997         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
 998         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
 999         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1000         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1001         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1002         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1003         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1004         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1005         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1006         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1007         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1008         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1009         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1010         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1011         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1012         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1013         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1014         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1015         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1016         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1017         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1018         (replacer):
1019         (BigInt.prototype.toJSON):
1020         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1021         (replacer):
1022         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1023         (BigInt.prototype.toJSON):
1024         * test262/test/built-ins/JSON/stringify/bigint.js:
1025         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1026         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1027         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1028         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1029         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1030         * test262/test/built-ins/Object/proto-from-ctor.js:
1031         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1032         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1033         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1034         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1035         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1036         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1037         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1038         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1039         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1040         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1041         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1042         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1043         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1044         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1045         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1046         * test262/test/built-ins/Proxy/get-fn-realm.js:
1047         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1048         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1049         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1050         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1051         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1052         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1053         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1054         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1055         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1056         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1057         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1058         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1059         (i6.replace):
1060         (i6b.replace):
1061         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1062         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1063         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1064         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1065         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1066         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1067         * test262/test/built-ins/RegExp/u180e.js: Added.
1068         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1069         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1070         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1071         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1072         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1073         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1074         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1075         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1076         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1077         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1078         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1079         * test262/test/built-ins/String/prototype/endsWith/length.js:
1080         * test262/test/built-ins/String/prototype/endsWith/name.js:
1081         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1082         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1083         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1084         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1085         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1086         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1087         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1088         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1089         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1090         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1091         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1092         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1093         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1094         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1095         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1096         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1097         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1098         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1099         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1100         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1101         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1102         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1103         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1104         * test262/test/built-ins/String/prototype/includes/includes.js:
1105         * test262/test/built-ins/String/prototype/includes/length.js:
1106         * test262/test/built-ins/String/prototype/includes/name.js:
1107         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1108         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1109         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1110         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1111         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1112         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1113         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1114         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1115         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1116         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1117         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1118         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1119         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1120         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1121         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1122         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1123         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1124         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1125         * test262/test/built-ins/String/prototype/trim/u180e.js:
1126         * test262/test/built-ins/Symbol/for/cross-realm.js:
1127         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1128         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1129         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1130         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1131         * test262/test/built-ins/Symbol/match/cross-realm.js:
1132         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1133         * test262/test/built-ins/Symbol/search/cross-realm.js:
1134         * test262/test/built-ins/Symbol/species/cross-realm.js:
1135         * test262/test/built-ins/Symbol/split/cross-realm.js:
1136         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1137         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1138         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1139         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1140         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1141         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1142         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1143         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1144         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1145         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1146         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1147         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1148         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1149         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1150         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1151         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1152         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1153         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1154         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1155         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1156         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1157         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1158         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1159         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1160         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1161         * test262/test/language/eval-code/indirect/realm.js:
1162         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1163         (o.get z):
1164         (o.get a):
1165         * test262/test/language/expressions/call/eval-realm-indirect.js:
1166         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1167         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1168         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1169         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1170         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1171         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1172         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1173         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1174         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1175         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1176         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1177         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1178         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1179         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1180         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1181         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1182         * test262/test/language/expressions/less-than/bigint-and-number.js:
1183         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1184         * test262/test/language/expressions/super/realm.js:
1185         * test262/test/language/expressions/tagged-template/cache-realm.js:
1186         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1187         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1188         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1189         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1190         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1191         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1192         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1193         (o.get z):
1194         (o.get a):
1195         * test262/test/language/statements/for-of/iterator-next-reference.js:
1196         (next):
1197         (iterator.next): Deleted.
1198         (x.of.iterable.): Deleted.
1199         (x.of.iterable.get return): Deleted.
1200         (x.of.iterable.iterator.next): Deleted.
1201         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1202         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1203         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1204         * test262/test/language/white-space/mongolian-vowel-separator.js:
1205         * test262/test262-Revision.txt:
1206
1207 2017-10-03  Saam Barati  <sbarati@apple.com>
1208
1209         Implement polymorphic prototypes
1210         https://bugs.webkit.org/show_bug.cgi?id=176391
1211
1212         Reviewed by Filip Pizlo.
1213
1214         * microbenchmarks/poly-proto-access.js: Added.
1215         (assert):
1216         (foo.C):
1217         (foo.C.prototype.get bar):
1218         (foo):
1219         (bar):
1220         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1221         (assert):
1222         (makePolyProtoObject.foo.C):
1223         (makePolyProtoObject.foo):
1224         (makePolyProtoObject):
1225         (performSet):
1226         * microbenchmarks/poly-proto-setter-speed.js: Added.
1227         (assert):
1228         (makePolyProtoObject.foo.C):
1229         (makePolyProtoObject.foo.C.prototype.set p):
1230         (makePolyProtoObject.foo):
1231         (makePolyProtoObject):
1232         (performSet):
1233         * stress/constructor-with-return.js:
1234         (i.tests.forEach.Constructor):
1235         (i.tests.forEach):
1236         (tests.forEach.Constructor): Deleted.
1237         (tests.forEach): Deleted.
1238         * stress/dom-jit-with-poly-proto.js: Added.
1239         (assert):
1240         (makePolyProtoObject.foo.C):
1241         (makePolyProtoObject.foo):
1242         (makePolyProtoObject):
1243         (validate):
1244         * stress/poly-proto-custom-value-and-accessor.js: Added.
1245         (assert):
1246         (makePolyProtoObject.foo.C):
1247         (makePolyProtoObject.foo):
1248         (makePolyProtoObject):
1249         (items.forEach):
1250         (set get for):
1251         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1252         (assert):
1253         (makePolyProtoObject.foo.C):
1254         (makePolyProtoObject.foo):
1255         (makePolyProtoObject):
1256         (foo):
1257         * stress/poly-proto-miss.js: Added.
1258         (makePolyProtoInstanceWithNullPrototype.foo.C):
1259         (makePolyProtoInstanceWithNullPrototype.foo):
1260         (makePolyProtoInstanceWithNullPrototype):
1261         (assert):
1262         (validate):
1263         * stress/poly-proto-op-in-caching.js: Added.
1264         (assert):
1265         (makePolyProtoObject.foo.C):
1266         (makePolyProtoObject.foo):
1267         (makePolyProtoObject):
1268         (validate):
1269         (validate2):
1270         * stress/poly-proto-put-transition.js: Added.
1271         (assert):
1272         (makePolyProtoObject.foo.C):
1273         (makePolyProtoObject.foo):
1274         (makePolyProtoObject):
1275         (performSet):
1276         (i.obj.__proto__.set p):
1277         * stress/poly-proto-set-prototype.js: Added.
1278         (assert):
1279         (let.alternateProto.get x):
1280         (let.alternateProto2.get y):
1281         (let.alternateProto2.get x):
1282         (foo.C):
1283         (foo):
1284         (validate):
1285         * stress/poly-proto-setter.js: Added.
1286         (assert):
1287         (makePolyProtoObject.foo.C):
1288         (makePolyProtoObject.foo.C.prototype.set p):
1289         (makePolyProtoObject.foo.C.prototype.get p):
1290         (makePolyProtoObject.foo):
1291         (makePolyProtoObject):
1292         (performSet):
1293         * stress/poly-proto-using-inheritance.js: Added.
1294         (assert):
1295         (foo.C):
1296         (foo.C.prototype.get baz):
1297         (foo):
1298         (bar.C):
1299         (bar):
1300         (validate):
1301         * stress/primitive-poly-proto.js: Added.
1302         (makePolyProtoInstance.foo.C):
1303         (makePolyProtoInstance.foo):
1304         (makePolyProtoInstance):
1305         (assert):
1306         (validate):
1307         * stress/prototype-is-not-js-object.js: Added.
1308         (foo.bar):
1309         (foo):
1310         (assert):
1311         (validate):
1312         * stress/try-get-by-id-poly-proto.js: Added.
1313         (assert):
1314         (makePolyProtoObject.foo.C):
1315         (makePolyProtoObject.foo):
1316         (makePolyProtoObject):
1317         (tryGetByIdText):
1318         (x.__proto__.get bar):
1319         (validate):
1320         * typeProfiler/overflow.js:
1321
1322 2017-10-03  JF Bastien  <jfbastien@apple.com>
1323
1324         WebAssembly: no VM / JS version of everything but Instance
1325         https://bugs.webkit.org/show_bug.cgi?id=177473
1326
1327         Reviewed by Filip Pizlo.
1328
1329         - Exceeding max on memory growth now returns a range error as per
1330         spec. This is a (very minor) breaking change: it used to throw OOM
1331         error. Update the corresponding test.
1332
1333         * wasm/js-api/memory-grow.js:
1334         (assertEq):
1335         * wasm/js-api/table.js:
1336         (assert.throws):
1337
1338 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1339
1340         Skip JSC test stress/regress-159779-2.js on debug.
1341         https://bugs.webkit.org/show_bug.cgi?id=177204
1342
1343         Unreviewed test gardening.
1344
1345         * stress/regress-159779-2.js:
1346
1347 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1348
1349         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1350         https://bugs.webkit.org/show_bug.cgi?id=175642
1351
1352         Reviewed by Darin Adler.
1353
1354         * ChakraCore/test/Function/apply3.baseline-jsc:
1355
1356 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1357
1358         Unreviewed, rolling out r222564.
1359         https://bugs.webkit.org/show_bug.cgi?id=177720
1360
1361         "It regressed JetStream by 2% on iOS caused by a 50%
1362         regression on the bigfib subtest" (Requested by saamyjoon on
1363         #webkit).
1364
1365         Reverted changeset:
1366
1367         "Add Above/Below comparisons for UInt32 patterns"
1368         https://bugs.webkit.org/show_bug.cgi?id=177281
1369         http://trac.webkit.org/changeset/222564
1370
1371 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1372
1373         [DFG] Support ArrayPush with multiple args
1374         https://bugs.webkit.org/show_bug.cgi?id=175823
1375
1376         Reviewed by Saam Barati.
1377
1378         * microbenchmarks/array-push-0.js: Added.
1379         (arrayPush0):
1380         * microbenchmarks/array-push-1.js: Added.
1381         (arrayPush1):
1382         * microbenchmarks/array-push-2.js: Added.
1383         (arrayPush2):
1384         * microbenchmarks/array-push-3.js: Added.
1385         (arrayPush3):
1386         * stress/array-push-multiple-contiguous.js: Added.
1387         (shouldBe):
1388         (test):
1389         * stress/array-push-multiple-double-nan.js: Added.
1390         (shouldBe):
1391         (test):
1392         * stress/array-push-multiple-double.js: Added.
1393         (shouldBe):
1394         (test):
1395         * stress/array-push-multiple-int32.js: Added.
1396         (shouldBe):
1397         (test):
1398         * stress/array-push-multiple-many-contiguous.js: Added.
1399         (shouldBe):
1400         (test):
1401         * stress/array-push-multiple-many-double.js: Added.
1402         (shouldBe):
1403         (test):
1404         * stress/array-push-multiple-many-int32.js: Added.
1405         (shouldBe):
1406         (test):
1407         * stress/array-push-multiple-many-storage.js: Added.
1408         (shouldBe):
1409         (test):
1410         * stress/array-push-multiple-storage.js: Added.
1411         (shouldBe):
1412         (test):
1413         * stress/array-push-with-force-exit.js: Added.
1414         (target.createBuiltin):
1415
1416 2017-09-29  Saam Barati  <sbarati@apple.com>
1417
1418         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1419         https://bugs.webkit.org/show_bug.cgi?id=177639
1420
1421         Reviewed by Geoffrey Garen.
1422
1423         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1424         (assert):
1425         (Class):
1426         (items.forEach):
1427         (set get for):
1428
1429 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1430
1431         Unreviewed, rolling out r222563, r222565, and r222581.
1432         https://bugs.webkit.org/show_bug.cgi?id=177675
1433
1434         "It causes a crash when playing youtube videos" (Requested by
1435         saamyjoon on #webkit).
1436
1437         Reverted changesets:
1438
1439         "[DFG] Support ArrayPush with multiple args"
1440         https://bugs.webkit.org/show_bug.cgi?id=175823
1441         http://trac.webkit.org/changeset/222563
1442
1443         "Unreviewed, build fix after r222563"
1444         https://bugs.webkit.org/show_bug.cgi?id=175823
1445         http://trac.webkit.org/changeset/222565
1446
1447         "Unreviewed, fix x86 breaking due to exhausted registers"
1448         https://bugs.webkit.org/show_bug.cgi?id=175823
1449         http://trac.webkit.org/changeset/222581
1450
1451 2017-09-28  Mark Lam  <mark.lam@apple.com>
1452
1453         test262: Unexpected passes after r222617 and r222618.
1454         https://bugs.webkit.org/show_bug.cgi?id=177622
1455         <rdar://problem/34725960>
1456
1457         Reviewed by Saam Barati.
1458
1459         Update test262.yaml for tests that are now passing.
1460
1461         * test262.yaml:
1462
1463 2017-09-27  Michael Saboff  <msaboff@apple.com>
1464
1465         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1466         https://bugs.webkit.org/show_bug.cgi?id=177570
1467
1468         Reviewed by Filip Pizlo.
1469
1470         New regression test.
1471
1472         * stress/regress-177570.js: Added.
1473
1474 2017-09-28  Michael Saboff  <msaboff@apple.com>
1475
1476         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1477         https://bugs.webkit.org/show_bug.cgi?id=177423
1478
1479         Reviewed by Mark Lam.
1480
1481         Updated regression test.
1482
1483         * stress/regress-177423.js:
1484         (catch):
1485
1486 2017-09-27  Mark Lam  <mark.lam@apple.com>
1487
1488         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1489         https://bugs.webkit.org/show_bug.cgi?id=177584
1490         <rdar://problem/34463903>
1491
1492         Reviewed by Saam Barati.
1493
1494         * stress/regress-177584.js: Added.
1495         (assertEqual):
1496         (Array.prototype.Symbol.species):
1497
1498 2017-09-27  Saam Barati  <sbarati@apple.com>
1499
1500         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1501         https://bugs.webkit.org/show_bug.cgi?id=177523
1502
1503         Reviewed by Mark Lam.
1504
1505         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1506         (assert):
1507         (Test):
1508         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1509         (addMethods):
1510         (i.Test.prototype.propName):
1511
1512 2017-09-27  Mark Lam  <mark.lam@apple.com>
1513
1514         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1515         https://bugs.webkit.org/show_bug.cgi?id=177423
1516         <rdar://problem/34621320>
1517
1518         Reviewed by Keith Miller.
1519
1520         * stress/regress-177423.js: Added.
1521
1522 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1523
1524         Add Above/Below comparisons for UInt32 patterns
1525         https://bugs.webkit.org/show_bug.cgi?id=177281
1526
1527         Reviewed by Saam Barati.
1528
1529         * stress/uint32-comparison-jump.js: Added.
1530         (shouldBe):
1531         (above):
1532         (aboveOrEqual):
1533         (below):
1534         (belowOrEqual):
1535         (notAbove):
1536         (notAboveOrEqual):
1537         (notBelow):
1538         (notBelowOrEqual):
1539         * stress/uint32-comparison.js: Added.
1540         (shouldBe):
1541         (above):
1542         (aboveOrEqual):
1543         (below):
1544         (belowOrEqual):
1545         (aboveTest):
1546         (aboveOrEqualTest):
1547         (belowTest):
1548         (belowOrEqualTest):
1549
1550 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1551
1552         [DFG] Support ArrayPush with multiple args
1553         https://bugs.webkit.org/show_bug.cgi?id=175823
1554
1555         Reviewed by Saam Barati.
1556
1557         * microbenchmarks/array-push-0.js: Added.
1558         (arrayPush0):
1559         * microbenchmarks/array-push-1.js: Added.
1560         (arrayPush1):
1561         * microbenchmarks/array-push-2.js: Added.
1562         (arrayPush2):
1563         * microbenchmarks/array-push-3.js: Added.
1564         (arrayPush3):
1565         * stress/array-push-multiple-contiguous.js: Added.
1566         (shouldBe):
1567         (test):
1568         * stress/array-push-multiple-double-nan.js: Added.
1569         (shouldBe):
1570         (test):
1571         * stress/array-push-multiple-double.js: Added.
1572         (shouldBe):
1573         (test):
1574         * stress/array-push-multiple-int32.js: Added.
1575         (shouldBe):
1576         (test):
1577         * stress/array-push-multiple-many-contiguous.js: Added.
1578         (shouldBe):
1579         (test):
1580         * stress/array-push-multiple-many-double.js: Added.
1581         (shouldBe):
1582         (test):
1583         * stress/array-push-multiple-many-int32.js: Added.
1584         (shouldBe):
1585         (test):
1586         * stress/array-push-multiple-many-storage.js: Added.
1587         (shouldBe):
1588         (test):
1589         * stress/array-push-multiple-storage.js: Added.
1590         (shouldBe):
1591         (test):
1592
1593 2017-09-26  Commit Queue  <commit-queue@webkit.org>
1594
1595         Unreviewed, rolling out r222518.
1596         https://bugs.webkit.org/show_bug.cgi?id=177507
1597
1598         Break the High Sierra build (Requested by yusukesuzuki on
1599         #webkit).
1600
1601         Reverted changeset:
1602
1603         "Add Above/Below comparisons for UInt32 patterns"
1604         https://bugs.webkit.org/show_bug.cgi?id=177281
1605         http://trac.webkit.org/changeset/222518
1606
1607 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1608
1609         Add Above/Below comparisons for UInt32 patterns
1610         https://bugs.webkit.org/show_bug.cgi?id=177281
1611
1612         Reviewed by Saam Barati.
1613
1614         * stress/uint32-comparison-jump.js: Added.
1615         (shouldBe):
1616         (above):
1617         (aboveOrEqual):
1618         (below):
1619         (belowOrEqual):
1620         (notAbove):
1621         (notAboveOrEqual):
1622         (notBelow):
1623         (notBelowOrEqual):
1624         * stress/uint32-comparison.js: Added.
1625         (shouldBe):
1626         (above):
1627         (aboveOrEqual):
1628         (below):
1629         (belowOrEqual):
1630         (aboveTest):
1631         (aboveOrEqualTest):
1632         (belowTest):
1633         (belowOrEqualTest):
1634
1635 2017-09-23  Keith Miller  <keith_miller@apple.com>
1636
1637         Fix infinite looping test262 test
1638         https://bugs.webkit.org/show_bug.cgi?id=177412
1639
1640         Reviewed by Yusuke Suzuki.
1641
1642         This test was poorly designed since failing it would cause the vm
1643         to inifinite loop. I've fixed it locally and will fix it on github pending
1644         the results of next weeks tc39 meeting.
1645
1646         * test262.yaml:
1647         * test262/test/language/statements/for-of/iterator-next-reference.js:
1648
1649 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
1650
1651         test262: $.agent became $262.agent in test262 update
1652         https://bugs.webkit.org/show_bug.cgi?id=177407
1653
1654         Reviewed by Yusuke Suzuki.
1655
1656         * test262.yaml:
1657         ~320 tests pass now that we correctly make $262 available.
1658
1659 2017-09-22  Keith Miller  <keith_miller@apple.com>
1660
1661         Speculatively change iteration protocall to use the same next function
1662         https://bugs.webkit.org/show_bug.cgi?id=175653
1663
1664         Reviewed by Saam Barati.
1665
1666         Change test to match the new iteration behavior.
1667
1668         * stress/spread-optimized-properly.js:
1669
1670 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1671
1672         [DFG][FTL] Profile array vector length for array allocation
1673         https://bugs.webkit.org/show_bug.cgi?id=177051
1674
1675         Reviewed by Saam Barati.
1676
1677         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1678         (target):
1679
1680 2017-09-22  Commit Queue  <commit-queue@webkit.org>
1681
1682         Unreviewed, rolling out r222380.
1683         https://bugs.webkit.org/show_bug.cgi?id=177352
1684
1685         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
1686         #webkit).
1687
1688         Reverted changeset:
1689
1690         "[DFG][FTL] Profile array vector length for array allocation"
1691         https://bugs.webkit.org/show_bug.cgi?id=177051
1692         http://trac.webkit.org/changeset/222380
1693
1694 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1695
1696         [DFG][FTL] Profile array vector length for array allocation
1697         https://bugs.webkit.org/show_bug.cgi?id=177051
1698
1699         Reviewed by Saam Barati.
1700
1701         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1702         (target):
1703
1704 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
1705
1706         Skip new hanging test262 tests.
1707         https://bugs.webkit.org/show_bug.cgi?id=177326
1708
1709         Unreviewed test gardening.
1710
1711         * test262.yaml:
1712
1713 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
1714
1715         Mark 6 test262 tests as passing.
1716         https://bugs.webkit.org/show_bug.cgi?id=177307
1717
1718         Unreviewed test gardening.
1719
1720         * test262.yaml:
1721
1722 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1723
1724         Unreviewed follow-up to r222311.
1725
1726         * test262/harness/sta.js:
1727         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
1728         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
1729         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
1730         * test262/test/built-ins/Array/from/elements-added-after.js:
1731         * test262/test/built-ins/Array/from/elements-deleted-after.js:
1732         * test262/test/built-ins/Array/from/elements-updated-after.js:
1733         * test262/test/built-ins/Array/from/from-array.js:
1734         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
1735         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
1736         * test262/test/built-ins/Array/from/source-array-boundary.js:
1737         * test262/test/built-ins/Array/from/source-object-constructor.js:
1738         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
1739         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
1740         * test262/test/built-ins/Array/from/source-object-length.js:
1741         * test262/test/built-ins/Array/from/source-object-missing.js:
1742         * test262/test/built-ins/Array/from/source-object-without.js:
1743         * test262/test/built-ins/Array/from/this-null.js:
1744         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1745         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
1746         * test262/test/language/literals/numeric/7.8.3-1gs.js:
1747         * test262/test/language/literals/numeric/7.8.3-2gs.js:
1748         * test262/test/language/literals/numeric/7.8.3-3gs.js:
1749         * test262/test/language/literals/regexp/7.8.5-1gs.js:
1750         * test262/test/language/literals/string/7.8.4-1gs.js:
1751         Fix some files that I failed to update when I applied my patch.
1752
1753 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1754
1755         Update test262 tests
1756         https://bugs.webkit.org/show_bug.cgi?id=177220
1757
1758         Reviewed by Saam Barati and Yusuke Suzuki.
1759
1760         * test262.yaml:
1761         * test262/test262-Revision.txt:
1762         New rebaselined expectations for all tests.
1763
1764         * test262/*:
1765         Updated.
1766
1767 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1768
1769         [DFG] Remove ToThis more aggressively
1770         https://bugs.webkit.org/show_bug.cgi?id=177056
1771
1772         Reviewed by Saam Barati.
1773
1774         * stress/generator-with-this-strict.js: Added.
1775         (shouldBe):
1776         (generator):
1777         (target):
1778         * stress/generator-with-this.js: Added.
1779         (shouldBe):
1780         (generator):
1781         (target):
1782
1783 2017-09-17  Michael Saboff  <msaboff@apple.com>
1784
1785         https://bugs.webkit.org/show_bug.cgi?id=177038
1786         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
1787
1788         Reviewed by JF Bastien.
1789
1790         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
1791         as it dies using too much memory.
1792
1793 2017-09-15  Saam Barati  <sbarati@apple.com>
1794
1795         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
1796         https://bugs.webkit.org/show_bug.cgi?id=176981
1797
1798         Reviewed by Yusuke Suzuki.
1799
1800         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
1801         (assert):
1802         (verify):
1803         (func):
1804         (const.bar.createBuiltin):
1805
1806 2017-09-14  Saam Barati  <sbarati@apple.com>
1807
1808         It should be valid to exit before each set when doing arity fixup when inlining
1809         https://bugs.webkit.org/show_bug.cgi?id=176948
1810
1811         Reviewed by Keith Miller.
1812
1813         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
1814         (baz):
1815         (bar):
1816         (foo):
1817
1818 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1819
1820         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
1821         https://bugs.webkit.org/show_bug.cgi?id=176867
1822
1823         Reviewed by Sam Weinig.
1824
1825         * microbenchmarks/object-get-own-property-symbols.js: Added.
1826         (test):
1827
1828 2017-09-13  Mark Lam  <mark.lam@apple.com>
1829
1830         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
1831         https://bugs.webkit.org/show_bug.cgi?id=176888
1832         <rdar://problem/34381832>
1833
1834         Not reviewed.
1835
1836         * stress/op_mod-ConstVar.js:
1837         * stress/op_mod-VarConst.js:
1838         * stress/op_mod-VarVar.js:
1839
1840 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
1841
1842         Skip 3 op_mod tests on Debug JSC bots.
1843         https://bugs.webkit.org/show_bug.cgi?id=176630
1844
1845         Unreviewed test gardening.
1846
1847         * stress/op_mod-ConstVar.js:
1848         * stress/op_mod-VarConst.js:
1849         * stress/op_mod-VarVar.js:
1850
1851 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1852
1853         [JSC] Fix Array allocation in Object.keys
1854         https://bugs.webkit.org/show_bug.cgi?id=176826
1855
1856         Reviewed by Saam Barati.
1857
1858         * stress/object-own-property-keys.js: Added.
1859         (shouldBe):
1860
1861 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1862
1863         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1864         https://bugs.webkit.org/show_bug.cgi?id=176010
1865
1866         Reviewed by Filip Pizlo.
1867
1868         * microbenchmarks/weak-map-key.js: Added.
1869         (assert):
1870         (objectKey):
1871         (let.start.Date.now):
1872
1873 2017-09-12  Mark Lam  <mark.lam@apple.com>
1874
1875         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
1876         https://bugs.webkit.org/show_bug.cgi?id=176630
1877
1878         Reviewed by JF Bastien.
1879
1880         Debug builds are just slow, and these tests do a lot.  They pass when I run them
1881         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
1882         a speculative fix for the bots that are seeing these fail.
1883
1884         I also undid the skipping of the op_mod tests for debug builds.
1885
1886         * stress/op_div-ConstVar.js:
1887         * stress/op_div-VarConst.js:
1888         * stress/op_div-VarVar.js:
1889         * stress/op_mod-ConstVar.js:
1890         * stress/op_mod-VarConst.js:
1891         * stress/op_mod-VarVar.js:
1892
1893 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
1894
1895         Skip stress/value-to-boolean.js on Debug bots.
1896         https://bugs.webkit.org/show_bug.cgi?id=176787
1897
1898         Unreviewed test gardening.
1899
1900         * stress/value-to-boolean.js:
1901
1902 2017-09-11  Mark Lam  <mark.lam@apple.com>
1903
1904         Change test expectation for test262/test/language/statements/try/tco-catch.js
1905         https://bugs.webkit.org/show_bug.cgi?id=176749
1906
1907         Rubber stamped by Keith Miller.
1908
1909         It's been failing since at least r221821.  I'm changing the test expectation to
1910         fail to green the bots while I investigate some more.
1911
1912         * test262.yaml:
1913
1914 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
1915
1916         Unreviewed, rolling out r221854.
1917
1918         The test added with this change fails on 32-bit JSC bots.
1919
1920         Reverted changeset:
1921
1922         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
1923         https://bugs.webkit.org/show_bug.cgi?id=176010
1924         http://trac.webkit.org/changeset/221854
1925
1926 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1927
1928         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1929         https://bugs.webkit.org/show_bug.cgi?id=176010
1930
1931         Reviewed by Filip Pizlo.
1932
1933         * microbenchmarks/weak-map-key.js: Added.
1934         (assert):
1935         (objectKey):
1936         (let.start.Date.now):
1937
1938 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1939
1940         [JSC] Optimize Object.keys by using careful array allocation
1941         https://bugs.webkit.org/show_bug.cgi?id=176654
1942
1943         Reviewed by Darin Adler.
1944
1945         * microbenchmarks/object-keys.js: Added.
1946         (test):
1947
1948 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
1949
1950         Error should compute .stack and friends lazily
1951         https://bugs.webkit.org/show_bug.cgi?id=176645
1952
1953         Reviewed by Saam Barati.
1954
1955         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
1956         * microbenchmarks/new-error.js: Added.
1957         * microbenchmarks/throw.js: Added.
1958
1959 2017-09-09  Mark Lam  <mark.lam@apple.com>
1960
1961         [Re-landing] Use JIT probes for DFG OSR exit.
1962         https://bugs.webkit.org/show_bug.cgi?id=175144
1963         <rdar://problem/33437050>
1964
1965         Not reviewed.  Original patch reviewed by Saam Barati.
1966
1967         Disable these tests for debug builds because they run too slow with the new OSR exit.
1968
1969         * stress/op_mod-ConstVar.js:
1970         * stress/op_mod-VarConst.js:
1971         * stress/op_mod-VarVar.js:
1972
1973 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1974
1975         [DFG] NewArrayWithSize(size)'s size does not care negative zero
1976         https://bugs.webkit.org/show_bug.cgi?id=176300
1977
1978         Reviewed by Saam Barati.
1979
1980         * stress/new-array-with-size-div.js: Added.
1981         (shouldBe):
1982         (test):
1983         (i.i):
1984
1985 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1986
1987         [DFG] PutByVal with Array::Generic is too generic
1988         https://bugs.webkit.org/show_bug.cgi?id=176345
1989
1990         Reviewed by Filip Pizlo.
1991
1992         * stress/object-assign-symbols.js: Added.
1993         (shouldBe):
1994         (test):
1995         * stress/object-assign.js: Added.
1996         (shouldBe):
1997         (test):
1998         (i.shouldBe.JSON.stringify.test):
1999
2000 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2001
2002         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2003         https://bugs.webkit.org/show_bug.cgi?id=176590
2004
2005         Reviewed by Saam Barati.
2006
2007         * microbenchmarks/object-iterate-symbols.js: Added.
2008         (test):
2009         * microbenchmarks/object-iterate.js: Added.
2010         (test):
2011         * stress/object-iterate-symbols.js: Added.
2012         (shouldBe):
2013         (test):
2014         * stress/object-iterate.js: Added.
2015         (shouldBe):
2016         (test):
2017
2018 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2019
2020         [Win32] 10 JSC stress tests are failing.
2021         https://bugs.webkit.org/show_bug.cgi?id=176538
2022
2023         Reviewed by Mark Lam.
2024
2025         Skip tests on Windows to make the bots green.
2026
2027         * ChakraCore.yaml:
2028         * stress/date-relaxed.js:
2029
2030 2017-09-06  Mark Lam  <mark.lam@apple.com>
2031
2032         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2033         https://bugs.webkit.org/show_bug.cgi?id=176485
2034         <rdar://problem/33898874>
2035
2036         Reviewed by Keith Miller.
2037
2038         * stress/regress-176485.js: Added.
2039
2040 2017-09-05  Saam Barati  <sbarati@apple.com>
2041
2042         isNotCellSpeculation is wrong with respect to SpecEmpty
2043         https://bugs.webkit.org/show_bug.cgi?id=176429
2044
2045         Reviewed by Michael Saboff.
2046
2047         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2048         (Foo):
2049
2050 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2051
2052         test262: Completion values for control flow do not match the spec
2053         https://bugs.webkit.org/show_bug.cgi?id=171265
2054
2055         Reviewed by Saam Barati.
2056
2057         * stress/completion-value.js:
2058         Condensed test for completion values in top level statements.
2059
2060         * stress/super-get-by-id.js:
2061         ClassDeclaration when evaled no longer produce values. Convert
2062         these to ClassExpressions so they produce the class value.
2063
2064         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2065         This is a progression for currect spec behavior.
2066
2067         * mozilla/mozilla-tests.yaml:
2068         This test is now outdated, so mark it as failing for that reason.
2069
2070         * test262.yaml:
2071         Passing all "cptn" completion value tests.
2072
2073 2017-09-04  Saam Barati  <sbarati@apple.com>
2074
2075         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2076         https://bugs.webkit.org/show_bug.cgi?id=176317
2077
2078         Reviewed by Keith Miller.
2079
2080         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2081         (Foo):
2082
2083 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2084
2085         [DFG][FTL] Efficiently execute number#toString()
2086         https://bugs.webkit.org/show_bug.cgi?id=170007
2087
2088         Reviewed by Keith Miller.
2089
2090         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2091         (test):
2092         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2093         (test):
2094         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2095         (test):
2096         * microbenchmarks/number-to-string-with-radix.js: Added.
2097         (test):
2098         * stress/number-to-string-strength-reduction.js: Added.
2099         (shouldBe):
2100         (test):
2101         * stress/number-to-string-with-radix-10.js: Added.
2102         (shouldBe):
2103         (test):
2104         * stress/number-to-string-with-radix-cse.js: Added.
2105         (shouldBe):
2106         (test):
2107         * stress/number-to-string-with-radix-invalid.js: Added.
2108         (shouldThrow):
2109         * stress/number-to-string-with-radix-watchpoint.js: Added.
2110         (shouldBe):
2111         (test):
2112         (i.i.1e3.Number.prototype.toString):
2113         * stress/number-to-string-with-radix.js: Added.
2114         (shouldBe):
2115         (test):
2116
2117 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2118
2119         [DFG] Relax arity requirement
2120         https://bugs.webkit.org/show_bug.cgi?id=175523
2121
2122         Reviewed by Saam Barati.
2123
2124         * stress/arity-mismatch-arguments-length.js: Added.
2125         (shouldBe):
2126         (test1):
2127         (test):
2128         * stress/arity-mismatch-get-argument.js: Added.
2129         (shouldBe):
2130         (builtin.createBuiltin):
2131         (test):
2132         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2133         (shouldBe):
2134         (inlineTarget):
2135         (test):
2136         * stress/arity-mismatch-inlining.js: Added.
2137         (shouldBe):
2138         (inlineTarget):
2139         (test):
2140         * stress/arity-mismatch-rest.js: Added.
2141         (shouldBe):
2142         (test2):
2143         (test1):
2144         (test):
2145
2146 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2147
2148         [JSC] Fix "name" and "length" of Proxy revoke function
2149         https://bugs.webkit.org/show_bug.cgi?id=176155
2150
2151         Reviewed by Mark Lam.
2152
2153         * test262.yaml:
2154
2155 2017-08-31  Saam Barati  <sbarati@apple.com>
2156
2157         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2158         https://bugs.webkit.org/show_bug.cgi?id=176206
2159
2160         Reviewed by Keith Miller.
2161
2162         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2163         (a):
2164         (b):
2165         (foo):
2166
2167 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2168
2169         Skip two slow JSC tests after r221422.
2170
2171         Unreviewed test gardening.
2172
2173         * stress/regexp-prototype-match-on-too-long-rope.js:
2174         * stress/regexp-prototype-test-on-too-long-rope.js:
2175
2176 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2177
2178         Unreviewed, skipping slow tests.
2179
2180         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2181         work differently now.
2182
2183         * stress/regexp-prototype-exec-on-too-long-rope.js:
2184         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2185
2186 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2187
2188         [JSC] Use reifying system for "name" property of builtin JSFunction
2189         https://bugs.webkit.org/show_bug.cgi?id=175260
2190
2191         Reviewed by Saam Barati.
2192
2193         * stress/accessors-get-set-prefix.js:
2194         * stress/builtin-function-name.js: Added.
2195         (shouldBe):
2196         (shouldThrow):
2197         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2198         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2199         * stress/private-name-as-anonymous-builtin.js: Added.
2200         (shouldBe):
2201         (NotPromise):
2202
2203 2017-08-30  Saam Barati  <sbarati@apple.com>
2204
2205         Unreviewed. Make test stop printing.
2206
2207         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2208
2209 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2210
2211         Unreviewed, rolling out r221327.
2212
2213         This change caused test262 failures.
2214
2215         Reverted changeset:
2216
2217         "[JSC] Use reifying system for "name" property of builtin
2218         JSFunction"
2219         https://bugs.webkit.org/show_bug.cgi?id=175260
2220         http://trac.webkit.org/changeset/221327
2221
2222 2017-08-30  Saam Barati  <sbarati@apple.com>
2223
2224         semicolon is being interpreted as an = in the LiteralParser
2225         https://bugs.webkit.org/show_bug.cgi?id=176114
2226
2227         Reviewed by Oliver Hunt.
2228
2229         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2230         * stress/resources/literal-parser-test-case.js: Added.
2231
2232 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2233
2234         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2235         https://bugs.webkit.org/show_bug.cgi?id=166698
2236
2237         Reviewed by Yusuke Suzuki.
2238
2239         * stress/async-iteration-for-await-of-syntax.js: Added.
2240         (assert):
2241         (checkSyntax):
2242         (checkSyntaxError):
2243         (checkSimpleAsyncGeneratorSloppyMode):
2244         (checkSimpleAsyncGeneratorStrictMode):
2245         (checkNestedAsyncGenerators):
2246         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2247         * stress/async-iteration-for-await-of.js: Added.
2248         (assert):
2249         (async.foo):
2250         (async.boo):
2251         (const.boo.async):
2252
2253 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2254
2255         [JSC] Use reifying system for "name" property of builtin JSFunction
2256         https://bugs.webkit.org/show_bug.cgi?id=175260
2257
2258         Reviewed by Saam Barati.
2259
2260         * stress/accessors-get-set-prefix.js:
2261         * stress/builtin-function-name.js: Added.
2262         (shouldBe):
2263         (shouldThrow):
2264         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2265         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2266
2267 2017-08-25  Saam Barati  <sbarati@apple.com>
2268
2269         Support compiling catch in the DFG
2270         https://bugs.webkit.org/show_bug.cgi?id=174590
2271         <rdar://problem/34047845>
2272
2273         Reviewed by Filip Pizlo.
2274
2275         * microbenchmarks/delta-blue-try-catch.js: Added.
2276         (exception):
2277         (value):
2278         (OrderedCollection):
2279         (OrderedCollection.prototype.add):
2280         (OrderedCollection.prototype.at):
2281         (OrderedCollection.prototype.size):
2282         (OrderedCollection.prototype.removeFirst):
2283         (OrderedCollection.prototype.remove):
2284         (Strength):
2285         (Strength.stronger):
2286         (Strength.weaker):
2287         (Strength.weakestOf):
2288         (Strength.strongest):
2289         (Strength.prototype.nextWeaker):
2290         (Constraint):
2291         (Constraint.prototype.addConstraint):
2292         (Constraint.prototype.satisfy):
2293         (Constraint.prototype.destroyConstraint):
2294         (Constraint.prototype.isInput):
2295         (UnaryConstraint):
2296         (UnaryConstraint.prototype.addToGraph):
2297         (UnaryConstraint.prototype.chooseMethod):
2298         (UnaryConstraint.prototype.isSatisfied):
2299         (UnaryConstraint.prototype.markInputs):
2300         (UnaryConstraint.prototype.output):
2301         (UnaryConstraint.prototype.recalculate):
2302         (UnaryConstraint.prototype.markUnsatisfied):
2303         (UnaryConstraint.prototype.inputsKnown):
2304         (UnaryConstraint.prototype.removeFromGraph):
2305         (StayConstraint):
2306         (StayConstraint.prototype.execute):
2307         (EditConstraint.prototype.isInput):
2308         (EditConstraint.prototype.execute):
2309         (BinaryConstraint):
2310         (BinaryConstraint.prototype.chooseMethod):
2311         (BinaryConstraint.prototype.addToGraph):
2312         (BinaryConstraint.prototype.isSatisfied):
2313         (BinaryConstraint.prototype.markInputs):
2314         (BinaryConstraint.prototype.input):
2315         (BinaryConstraint.prototype.output):
2316         (BinaryConstraint.prototype.recalculate):
2317         (BinaryConstraint.prototype.markUnsatisfied):
2318         (BinaryConstraint.prototype.inputsKnown):
2319         (BinaryConstraint.prototype.removeFromGraph):
2320         (ScaleConstraint):
2321         (ScaleConstraint.prototype.addToGraph):
2322         (ScaleConstraint.prototype.removeFromGraph):
2323         (ScaleConstraint.prototype.markInputs):
2324         (ScaleConstraint.prototype.execute):
2325         (ScaleConstraint.prototype.recalculate):
2326         (EqualityConstraint):
2327         (EqualityConstraint.prototype.execute):
2328         (Variable):
2329         (Variable.prototype.addConstraint):
2330         (Variable.prototype.removeConstraint):
2331         (Planner):
2332         (Planner.prototype.incrementalAdd):
2333         (Planner.prototype.incrementalRemove):
2334         (Planner.prototype.newMark):
2335         (Planner.prototype.makePlan):
2336         (Planner.prototype.extractPlanFromConstraints):
2337         (Planner.prototype.addPropagate):
2338         (Planner.prototype.removePropagateFrom):
2339         (Planner.prototype.addConstraintsConsumingTo):
2340         (Plan):
2341         (Plan.prototype.addConstraint):
2342         (Plan.prototype.size):
2343         (Plan.prototype.constraintAt):
2344         (Plan.prototype.execute):
2345         (chainTest):
2346         (projectionTest):
2347         (change):
2348         (deltaBlue):
2349         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2350         (assert):
2351         (Numbers):
2352         (Numbers.prototype.next):
2353         (return.Transpose):
2354         (return.Transpose.prototype.next):
2355         (transpose):
2356         (verifyEven):
2357         (verifyString):
2358         (foo):
2359         (runIterators):
2360         * microbenchmarks/try-catch-word-count.js: Added.
2361         (let.assert):
2362         (EOF):
2363         (let.texts):
2364         (let.o.apply):
2365         (foo):
2366         (bar):
2367         (f):
2368         (run):
2369         (test1):
2370         (test2):
2371         (test3):
2372         (fn):
2373         (A):
2374         (B):
2375         (A.prototype.getValue):
2376         (B.prototype.getParentValue):
2377         (strlen):
2378         (sum.0):
2379         (test):
2380         (result.test.o):
2381         (set add.set add):
2382         (set forEach):
2383         (stringHash):
2384         (set if):
2385         (testFunction):
2386         (set delete.set has.set add):
2387         * stress/catch-set-argument-speculation-failure.js: Added.
2388         (o):
2389         (e):
2390         (e2):
2391         (escape):
2392         (baz):
2393         (noInline.run):
2394         (noInline):
2395         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2396         (foo):
2397         (e):
2398         (baz):
2399         (bar):
2400
2401 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2402
2403         Unreviewed, rolling out r221119, r221124, and r221143.
2404         https://bugs.webkit.org/show_bug.cgi?id=175973
2405
2406         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2407         on #webkit).
2408
2409         Reverted changesets:
2410
2411         "Support compiling catch in the DFG"
2412         https://bugs.webkit.org/show_bug.cgi?id=174590
2413         http://trac.webkit.org/changeset/221119
2414
2415         "Unreviewed, build fix in GTK port"
2416         https://bugs.webkit.org/show_bug.cgi?id=174590
2417         http://trac.webkit.org/changeset/221124
2418
2419         "DFG::JITCode::osrEntry should get sorted since we perform a
2420         binary search on it"
2421         https://bugs.webkit.org/show_bug.cgi?id=175893
2422         http://trac.webkit.org/changeset/221143
2423
2424 2017-08-24  Michael Saboff  <msaboff@apple.com>
2425
2426         Add support for RegExp "dotAll" flag
2427         https://bugs.webkit.org/show_bug.cgi?id=175924
2428
2429         Reviewed by Keith Miller.
2430
2431         Updated tests for new dotAll ('s' flag) changes.
2432
2433         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2434         * stress/static-getter-in-names.js:
2435
2436 2017-08-24  Mark Lam  <mark.lam@apple.com>
2437
2438         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2439         https://bugs.webkit.org/show_bug.cgi?id=175940
2440         <rdar://problem/29003921>
2441
2442         Reviewed by Saam Barati.
2443
2444         * stress/regress-164081.js: Added.
2445         (shouldEqual):
2446         (testcase):
2447
2448 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2449
2450         Skip flaky JSC test stress/test-finally.js.
2451         https://bugs.webkit.org/show_bug.cgi?id=160283
2452
2453         Unreviewed test gardening.
2454
2455         * stress/test-finally.js:
2456
2457 2017-08-23  Saam Barati  <sbarati@apple.com>
2458
2459         Support compiling catch in the DFG
2460         https://bugs.webkit.org/show_bug.cgi?id=174590
2461
2462         Reviewed by Filip Pizlo.
2463
2464         * microbenchmarks/delta-blue-try-catch.js: Added.
2465         (exception):
2466         (value):
2467         (OrderedCollection):
2468         (OrderedCollection.prototype.add):
2469         (OrderedCollection.prototype.at):
2470         (OrderedCollection.prototype.size):
2471         (OrderedCollection.prototype.removeFirst):
2472         (OrderedCollection.prototype.remove):
2473         (Strength):
2474         (Strength.stronger):
2475         (Strength.weaker):
2476         (Strength.weakestOf):
2477         (Strength.strongest):
2478         (Strength.prototype.nextWeaker):
2479         (Constraint):
2480         (Constraint.prototype.addConstraint):
2481         (Constraint.prototype.satisfy):
2482         (Constraint.prototype.destroyConstraint):
2483         (Constraint.prototype.isInput):
2484         (UnaryConstraint):
2485         (UnaryConstraint.prototype.addToGraph):
2486         (UnaryConstraint.prototype.chooseMethod):
2487         (UnaryConstraint.prototype.isSatisfied):
2488         (UnaryConstraint.prototype.markInputs):
2489         (UnaryConstraint.prototype.output):
2490         (UnaryConstraint.prototype.recalculate):
2491         (UnaryConstraint.prototype.markUnsatisfied):
2492         (UnaryConstraint.prototype.inputsKnown):
2493         (UnaryConstraint.prototype.removeFromGraph):
2494         (StayConstraint):
2495         (StayConstraint.prototype.execute):
2496         (EditConstraint.prototype.isInput):
2497         (EditConstraint.prototype.execute):
2498         (BinaryConstraint):
2499         (BinaryConstraint.prototype.chooseMethod):
2500         (BinaryConstraint.prototype.addToGraph):
2501         (BinaryConstraint.prototype.isSatisfied):
2502         (BinaryConstraint.prototype.markInputs):
2503         (BinaryConstraint.prototype.input):
2504         (BinaryConstraint.prototype.output):
2505         (BinaryConstraint.prototype.recalculate):
2506         (BinaryConstraint.prototype.markUnsatisfied):
2507         (BinaryConstraint.prototype.inputsKnown):
2508         (BinaryConstraint.prototype.removeFromGraph):
2509         (ScaleConstraint):
2510         (ScaleConstraint.prototype.addToGraph):
2511         (ScaleConstraint.prototype.removeFromGraph):
2512         (ScaleConstraint.prototype.markInputs):
2513         (ScaleConstraint.prototype.execute):
2514         (ScaleConstraint.prototype.recalculate):
2515         (EqualityConstraint):
2516         (EqualityConstraint.prototype.execute):
2517         (Variable):
2518         (Variable.prototype.addConstraint):
2519         (Variable.prototype.removeConstraint):
2520         (Planner):
2521         (Planner.prototype.incrementalAdd):
2522         (Planner.prototype.incrementalRemove):
2523         (Planner.prototype.newMark):
2524         (Planner.prototype.makePlan):
2525         (Planner.prototype.extractPlanFromConstraints):
2526         (Planner.prototype.addPropagate):
2527         (Planner.prototype.removePropagateFrom):
2528         (Planner.prototype.addConstraintsConsumingTo):
2529         (Plan):
2530         (Plan.prototype.addConstraint):
2531         (Plan.prototype.size):
2532         (Plan.prototype.constraintAt):
2533         (Plan.prototype.execute):
2534         (chainTest):
2535         (projectionTest):
2536         (change):
2537         (deltaBlue):
2538         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2539         (assert):
2540         (Numbers):
2541         (Numbers.prototype.next):
2542         (return.Transpose):
2543         (return.Transpose.prototype.next):
2544         (transpose):
2545         (verifyEven):
2546         (verifyString):
2547         (foo):
2548         (runIterators):
2549         * microbenchmarks/try-catch-word-count.js: Added.
2550         (let.assert):
2551         (EOF):
2552         (let.texts):
2553         (let.o.apply):
2554         (foo):
2555         (bar):
2556         (f):
2557         (run):
2558         (test1):
2559         (test2):
2560         (test3):
2561         (fn):
2562         (A):
2563         (B):
2564         (A.prototype.getValue):
2565         (B.prototype.getParentValue):
2566         (strlen):
2567         (sum.0):
2568         (test):
2569         (result.test.o):
2570         (set add.set add):
2571         (set forEach):
2572         (stringHash):
2573         (set if):
2574         (testFunction):
2575         (set delete.set has.set add):
2576         * stress/catch-set-argument-speculation-failure.js: Added.
2577         (o):
2578         (e):
2579         (e2):
2580         (escape):
2581         (baz):
2582         (noInline.run):
2583         (noInline):
2584         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2585         (foo):
2586         (e):
2587         (baz):
2588         (bar):
2589
2590 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2591
2592         [JSC] Optimize Map iteration with intrinsic
2593         https://bugs.webkit.org/show_bug.cgi?id=174355
2594
2595         Reviewed by Saam Barati.
2596
2597         * stress/map-iterator-result-should-have-expected-shape.js: Added.
2598         (shouldBe):
2599         (throw.new.Error):
2600         * stress/set-iterator-result-should-have-expected-shape.js: Added.
2601         (shouldBe):
2602         (throw.new.Error.let.iterator.set Symbol):
2603         (throw.new.Error.set add):
2604         (let.iterator.set Symbol):
2605
2606 2017-08-23  Robin Morisset  <rmorisset@apple.com>
2607
2608         Add a micro-benchmark for checking that accessing a variable within a 'with'
2609         block does not automatically prevent type prediction.
2610         https://bugs.webkit.org/show_bug.cgi?id=175738
2611
2612         Reviewed by Saam Barati.
2613
2614         * stress/with_and_arith.js: Added.
2615         (with):
2616
2617 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
2618
2619         [ESNext] Async iteration - Implement Async Generator - runtime
2620         https://bugs.webkit.org/show_bug.cgi?id=175240
2621
2622         Reviewed by Yusuke Suzuki.
2623
2624         * stress/async-iteration-async-from-sync.js: Added.
2625         (assert):
2626         (const.Logger):
2627         (this.fullfilled):
2628         (this.fullfilledDone):
2629         (this.rejected):
2630         (this.catched):
2631         (this.isFinal):
2632         (_assertLogger):
2633         (const.assertLogger):
2634         (const.getPromise.promiseHolder.return.new.Promise):
2635         (foo):
2636         (async.boo):
2637         (bar):
2638         (async.baz):
2639         (async.goo):
2640         * stress/async-iteration-basic.js: Added.
2641         (assert):
2642         (const.Logger):
2643         (this.fullfilled):
2644         (this.fullfilledDone):
2645         (this.rejected):
2646         (this.catched):
2647         (this.isFinal):
2648         (_assertLogger):
2649         (const.assertLogger):
2650         (const.getPromise.promiseHolder.return.new.Promise):
2651         (async.generator):
2652         (iterator.next.then):
2653         (async.baz):
2654         (async.boo):
2655         (async.foo):
2656         (async.goo):
2657         (A.prototype.async.foo):
2658         (A.prototype.async.boo):
2659         (A):
2660         (asyncGenExp.async):
2661         (async.joo):
2662         (j.next.then):
2663         (then):
2664         (async.koo):
2665         (async.loo):
2666         (async.moo):
2667         (async.noo):
2668         (async.ooo):
2669         (async.roo):
2670         (async.poo):
2671         (async.soo):
2672         (async.too):
2673         * stress/async-iteration-evaluation.js: Added.
2674         (assert):
2675         (async.foo):
2676         (catch):
2677         * stress/async-iteration-syntax.js:
2678         * stress/async-iteration-yield-promise.js: Added.
2679         (assert):
2680         (const.Logger):
2681         (this.fullfilled):
2682         (this.fullfilledDone):
2683         (this.rejected):
2684         (this.catched):
2685         (this.isFinal):
2686         (_assertLogger):
2687         (const.assertLogger):
2688         (const.getPromise.promiseHolder.return.new.Promise):
2689         (async.foo):
2690         (async.boo):
2691         (async.bar):
2692         * stress/async-iteration-yield-star-interface.js: Added.
2693         (assert):
2694         (const.getPromise.promiseHolder.return.new.Promise):
2695         (const.Logger):
2696         (this.fullfilled):
2697         (this.fullfilledDone):
2698         (this.rejected):
2699         (this.catched):
2700         (this.custom):
2701         (this.isFinal):
2702         (_assertLogger):
2703         (const.assertLogger):
2704         (let.asyncIter.Symbol.asyncIterator):
2705         (let.asyncIter.next):
2706         (let.asyncIter.throw):
2707         (let.asyncIter.return):
2708         (async.foo):
2709         (asyncIter.Symbol.asyncIterator):
2710         (asyncIter.next):
2711         (async.boo):
2712         (asyncIter.return):
2713         (async.bar):
2714         (async.baz):
2715         (async.foobar):
2716         * stress/async-iteration-yield-star.js: Added.
2717         (assert):
2718         (const.Logger):
2719         (this.fullfilled):
2720         (this.fullfilledDone):
2721         (this.rejected):
2722         (this.catched):
2723         (this.custom):
2724         (this.isFinal):
2725         (_assertLogger):
2726         (const.assertLogger):
2727         (const.getPromise.promiseHolder.return.new.Promise):
2728         (async.foo):
2729         (async.boo):
2730         (async.bar):
2731         (async.baz):
2732         (async.joo):
2733         (async.goo):
2734         (async.koo):
2735         (async.loo):
2736         (let.asyncIter.Symbol.asyncIterator):
2737         (let.asyncIter.next):
2738         (let.asyncIter.throw):
2739         (let.asyncIter.return):
2740         (async.moo):
2741         (async.noo):
2742         * test262.yaml:
2743
2744 2017-08-23  JF Bastien  <jfbastien@apple.com>
2745
2746         Fix printing in test
2747
2748         Unreviewed: fixing verbosity, shouldn't have been there.
2749
2750         * wasm/regress/175693.js:
2751         (else.else):
2752         (catch):
2753
2754 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
2755
2756         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
2757         https://bugs.webkit.org/show_bug.cgi?id=172543
2758
2759         Unreviewed test gardening.
2760
2761         * microbenchmarks/generator-with-several-types.js:
2762
2763 2017-08-17  JF Bastien  <jfbastien@apple.com>
2764
2765         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
2766         https://bugs.webkit.org/show_bug.cgi?id=175693
2767         <rdar://problem/33952443>
2768
2769         Reviewed by Saam Barati.
2770
2771         Add a regression directory for WebAssembly tests.
2772
2773         * wasm.yaml:
2774         * wasm/regress/175693.js: Added.
2775         (else.else):
2776         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
2777         (catch):
2778         * wasm/regress/175693.wasm: Added.
2779
2780 2017-08-15  Robin Morisset  <rmorisset@apple.com>
2781
2782         Support the 'with' keyword in FTL.
2783         https://bugs.webkit.org/show_bug.cgi?id=175585
2784
2785         Reviewed by Saam Barati.
2786
2787         Also improve the JSTest/stress/with.js file to test
2788         what happens when non-objects are passed to with.
2789
2790         * stress/with.js:
2791         (foo):
2792         (i.catch):
2793         (i.with): Deleted.
2794
2795 2017-08-14  Keith Miller  <keith_miller@apple.com>
2796
2797         Add testing tool to lie to the DFG about profiles
2798         https://bugs.webkit.org/show_bug.cgi?id=175487
2799
2800         Reviewed by Saam Barati.
2801
2802         * stress/compare-eq-incomplete-profile.js: Added.
2803         (const.test.createBuiltin):
2804
2805 2017-08-14  Robin Morisset  <rmorisset@apple.com>
2806
2807         Support the with keyword in DFG
2808         https://bugs.webkit.org/show_bug.cgi?id=175470
2809
2810         Reviewed by Saam Barati.
2811
2812         Added a new stress-test for the 'with' keyword, that caught a bug in a
2813         previous version of this code.
2814
2815         * stress/with.js: Added.
2816         (i.with):
2817
2818 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
2819
2820         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
2821         https://bugs.webkit.org/show_bug.cgi?id=175544
2822
2823         Unreviewed test gardening.
2824
2825         * ChakraCore.yaml:
2826
2827 2017-08-09  Caitlin Potter  <caitp@igalia.com>
2828
2829         Early error on ANY operator before new.target
2830         https://bugs.webkit.org/show_bug.cgi?id=157970
2831
2832         Reviewed by Saam Barati.
2833
2834         Instead of throwing if any unary operator precedes new.target, only
2835         throw if the unary operator updates the reference.
2836
2837         The following become legal in JSC:
2838
2839         ```
2840         !new.target
2841         ~new.target
2842         typeof new.target
2843         delete new.target
2844         void new.target
2845         ```
2846
2847         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
2848
2849         * stress/new-target-syntax-errors.js:
2850         * stress/new-target.js:
2851
2852 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
2853
2854         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
2855         https://bugs.webkit.org/show_bug.cgi?id=175255
2856
2857         Unreviewed test gardening.
2858
2859         * stress/regress-169783.js:
2860         * wasm/stress/oom.js:
2861
2862 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2863
2864         REGRESSION: 2 test262/test/language/statements/async-function failures
2865         https://bugs.webkit.org/show_bug.cgi?id=175334
2866
2867         Reviewed by Yusuke Suzuki.
2868
2869         Add @skip parameters to tests, and remove test for async iterator from
2870         async await syntax test because it is already covered by async-iterator-syntax.js
2871
2872         * stress/async-await-syntax.js:
2873         * stress/async-iteration-syntax.js:
2874
2875 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2876
2877         Unreviewed, gardening test262 for Promise resolve / reject function length
2878         https://bugs.webkit.org/show_bug.cgi?id=175333
2879
2880         * test262.yaml:
2881
2882 2017-08-07  Robin Morisset  <rmorisset@apple.com>
2883
2884         GetOwnProperty of TypedArray indexed fields is wrongly configurable
2885         https://bugs.webkit.org/show_bug.cgi?id=175307
2886
2887         Reviewed by Saam Barati.
2888
2889         * stress/typedarray-getownproperty-not-configurable.js: Added.
2890         (assert):
2891         (foo):
2892
2893 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2894
2895         Promise resolve and reject function should have length = 1
2896         https://bugs.webkit.org/show_bug.cgi?id=175242
2897
2898         Reviewed by Saam Barati.
2899
2900         * stress/builtin-function-length.js: Added.
2901         (shouldBe):
2902         (shouldThrow):
2903         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2904         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2905
2906 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2907
2908         [ESNext] Async iteration - Implement Async Generator - parser
2909         https://bugs.webkit.org/show_bug.cgi?id=175210
2910
2911         Reviewed by Yusuke Suzuki.
2912
2913         * stress/async-await-syntax.js:
2914         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2915         * stress/async-iteration-syntax.js: Added.
2916         (assert):
2917         (checkSyntax):
2918         (checkSyntaxError):
2919         (checkSimpleAsyncGeneratorSloppyMode):
2920         (checkSimpleAsyncGeneratorStrictMode):
2921         (checkNestedAsyncGenerators):
2922         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2923         * stress/generator-class-methods-syntax.js:
2924
2925 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2926
2927         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
2928         https://bugs.webkit.org/show_bug.cgi?id=175150
2929
2930         Unreviewed test gardening.
2931
2932         * wasm/js-api/test_memory_constructor.js:
2933
2934 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2935
2936         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
2937         https://bugs.webkit.org/show_bug.cgi?id=175100
2938
2939         Reviewed by Mark Lam.
2940
2941         The JSC test JSTests/wasm/stress/oom.js tries to use all the
2942         available memory until an out of memory exception happens.
2943
2944         The Linux kernel is more tuned for server workloads than for GUI
2945         responsiveness. When a process tries to use a lot of memory, Linux
2946         will do its best to serve the request. This usually translates to
2947         free physical RAM by writing to disk dirty pages and/or moving out
2948         less recently used pages to swap (disk storage).
2949         Meanwhile it does this, the system will become unresponsive and this
2950         leads to freezes that can last even some minutes on the worst cases.
2951
2952         Therefore, let's skip this test on Linux as it will cause more harm
2953         than good on the Linux bots or on the machines of Linux developers.
2954
2955         * wasm/stress/oom.js:
2956
2957 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2958
2959         [JSC] Remove unnecessary print from stress\promise-finally.js test
2960         https://bugs.webkit.org/show_bug.cgi?id=175015
2961
2962         Reviewed by Yusuke Suzuki.
2963
2964         * stress/promise-finally.js:
2965         (p.finally):
2966         (then):
2967
2968 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2969
2970         Unreviewed, update test262 results for optional catch binding
2971
2972         * test262.yaml:
2973
2974 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2975
2976         [JSC] Support optional catch binding
2977         https://bugs.webkit.org/show_bug.cgi?id=174981
2978
2979         Reviewed by Saam Barati.
2980
2981         * stress/optional-catch-binding-syntax.js: Added.
2982         (testSyntax):
2983         (testSyntaxError):
2984         (catch.catch):
2985         * stress/optional-catch-binding.js: Added.
2986         (shouldBe):
2987         (throwException):
2988
2989 2017-07-28  Mark Lam  <mark.lam@apple.com>
2990
2991         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
2992         https://bugs.webkit.org/show_bug.cgi?id=174948
2993         <rdar://problem/33495680>
2994
2995         Reviewed by Filip Pizlo.
2996
2997         * stress/regress-174948.js: Added.
2998
2999 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3000
3001         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3002         https://bugs.webkit.org/show_bug.cgi?id=174900
3003
3004         Reviewed by Saam Barati.
3005
3006         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3007         (sideEffect):
3008         (args):
3009         (test):
3010
3011 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3012
3013         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3014         https://bugs.webkit.org/show_bug.cgi?id=171637
3015
3016         Reviewed by Darin Adler.
3017
3018         * stress/domjit-getter-complex-with-incorrect-object.js:
3019         (i.shouldThrow):
3020         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3021         (shouldBe):
3022         (i.shouldThrow):
3023
3024 2017-07-26  JF Bastien  <jfbastien@apple.com>
3025
3026         WebAssembly: test throwing out of the start function
3027         https://bugs.webkit.org/show_bug.cgi?id=165714
3028         <rdar://problem/29760251>
3029
3030         Reviewed by Keith Miller.
3031
3032         * wasm/assert.js:
3033         * wasm/function-tests/trap-from-start.js: Added.
3034         (StartTraps):
3035         * wasm/function-tests/trap-from-start-async.js: Added.
3036         (async.StartTrapsAsync):
3037
3038 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3039
3040         [FTL] Arguments elimination is suppressed by unreachable blocks
3041         https://bugs.webkit.org/show_bug.cgi?id=174352
3042
3043         Reviewed by Filip Pizlo.
3044
3045         * stress/arguments-elimination-force-exit.js: Added.
3046         (shouldBe):
3047         (strict):
3048         (sloppy):
3049         * stress/arguments-elimination-throw.js: Added.
3050         (shouldBe):
3051         (shouldThrow):
3052         (sloppy):
3053         (isArguments):
3054
3055 2017-07-13  Mark Lam  <mark.lam@apple.com>
3056
3057         Add some additional test cases for bug 170896.
3058         https://bugs.webkit.org/show_bug.cgi?id=174491
3059
3060         Reviewed by Filip Pizlo.
3061
3062         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3063         * stress/regress-170896-with-double-shape-profile.js: Added.
3064         (test):
3065         * stress/regress-170896-with-int32-shape-profile.js: Added.
3066         (test):
3067         * stress/regress-170896.js: Removed.
3068
3069 2017-07-13  Saam Barati  <sbarati@apple.com>
3070
3071         Missing exception check in JSObject::hasInstance
3072         https://bugs.webkit.org/show_bug.cgi?id=174455
3073         <rdar://problem/31384608>
3074
3075         Reviewed by Mark Lam.
3076
3077         * stress/has-instance-exception-check.js: Added.
3078         (assert):
3079         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3080
3081 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3082
3083         [ESnext] Implement Object Spread
3084         https://bugs.webkit.org/show_bug.cgi?id=167963
3085
3086         Reviewed by Saam Barati.
3087
3088         * stress/obj-rest-destructuring-order.js: Added.
3089         (assert):
3090         (o.get z):
3091         (o.get a):
3092         * stress/obj-spread-order.js: Added.
3093         (assert):
3094         (o.get z):
3095         (o.get a):
3096         * stress/object-spread.js: Added.
3097         (let.assert):
3098         (assert.sameValue):
3099         (let.o.get a):
3100         (let.obj.get c):
3101         (cthulhu.get x):
3102         (let.obj.set c):
3103         (calls.o.get z):
3104         (calls.o.get a):
3105         (try.let.obj.get foo):
3106         (get calls):
3107
3108 2017-07-12  Saam Barati  <sbarati@apple.com>
3109
3110         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3111         https://bugs.webkit.org/show_bug.cgi?id=174411
3112         <rdar://problem/31696186>
3113
3114         Reviewed by Mark Lam.
3115
3116         * stress/generic-arguments-correct-delete-behavior.js: Added.
3117         (assert):
3118         (makeTest):
3119
3120 2017-07-07  Mark Lam  <mark.lam@apple.com>
3121
3122         \n\r is not the same as \r\n.
3123         https://bugs.webkit.org/show_bug.cgi?id=173053
3124
3125         Reviewed by Keith Miller.
3126
3127         * stress/regress-173053.js: Added.
3128         * stress/template-literal-line-terminators.js:
3129
3130 2017-07-06  Saam Barati  <sbarati@apple.com>
3131
3132         We are missing places where we invalidate the for-in context
3133         https://bugs.webkit.org/show_bug.cgi?id=174184
3134
3135         Reviewed by Geoffrey Garen.
3136
3137         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3138         (assert):
3139         (test):
3140
3141 2017-07-05  Saam Barati  <sbarati@apple.com>
3142
3143         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3144         https://bugs.webkit.org/show_bug.cgi?id=174188
3145         <rdar://problem/30581423>
3146
3147         Reviewed by Mark Lam.
3148
3149         * stress/new-array-having-a-bad-time-double.js: Added.
3150         (assert):
3151         (foo):
3152
3153 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3154
3155         WTF::StringImpl::copyChars segfaults when built with GCC 7
3156         https://bugs.webkit.org/show_bug.cgi?id=173407
3157
3158         Reviewed by Andreas Kling.
3159
3160         * stress/string-repeat-copy-chars-crash.js: Added.
3161         (shouldBe):
3162
3163 2017-07-03  Saam Barati  <sbarati@apple.com>
3164
3165         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3166
3167         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3168
3169 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3170
3171         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3172
3173         It requires too much memory.
3174
3175         * stress/dont-reserve-huge-capacity-lexer.js:
3176
3177 2017-06-30  Michael Saboff  <msaboff@apple.com>
3178
3179         Skip a test on ARM64 platform since we run out of address space.
3180
3181         Rubber stamped by Saam Barati.
3182
3183         * stress/dont-reserve-huge-capacity-lexer.js:
3184
3185 2017-06-30  Michael Saboff  <msaboff@apple.com>
3186
3187         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3188         https://bugs.webkit.org/show_bug.cgi?id=174044
3189
3190         Reviewed by Oliver Hunt.
3191
3192         New regression test.
3193
3194         * stress/regress-174044.js: Added.
3195         (test1):
3196         (test2):
3197
3198 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3199
3200         RegExpCachedResult::setInput should reify left and right contexts
3201         https://bugs.webkit.org/show_bug.cgi?id=173818
3202
3203         Reviewed by Keith Miller.
3204
3205         * stress/right-left-context-invalidated-by-input.js: Added.
3206         (test.validateContexts):
3207         (test):
3208
3209 2017-06-29  Saam Barati  <sbarati@apple.com>
3210
3211         Calculating postCapacity in unshiftCountSlowCase is wrong
3212         https://bugs.webkit.org/show_bug.cgi?id=173992
3213         <rdar://problem/32283199>
3214
3215         Reviewed by Keith Miller.
3216
3217         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3218         (temp):
3219
3220 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3221
3222         Unreviewed, rolling out r218512.
3223         https://bugs.webkit.org/show_bug.cgi?id=173981
3224
3225         "It changes the behavior of the JS API's JSEvaluateScript
3226         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3227
3228         Reverted changeset:
3229
3230         "test262: Completion values for control flow do not match the
3231         spec"
3232         https://bugs.webkit.org/show_bug.cgi?id=171265
3233         http://trac.webkit.org/changeset/218512
3234
3235 2017-06-27  JF Bastien  <jfbastien@apple.com>
3236
3237         WebAssembly: running out of executable memory should throw OoM
3238         https://bugs.webkit.org/show_bug.cgi?id=171537
3239         <rdar://problem/32963338>
3240
3241         Reviewed by Saam Barati.
3242
3243         * wasm.yaml:
3244         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3245         (const.invoke):
3246         (failCount.0.catch):
3247         (failCount.0.module.undefined.catch):
3248         * wasm/lowExecutableMemory/exports-oom.js: Added.
3249         (const.type):
3250         (const.params):
3251         (const.randomProgram):
3252         (failCount.0.catch):
3253         (failCount.0.module.undefined.catch):
3254         * wasm/lowExecutableMemory/imports-oom.js: Added.
3255         (const.type):
3256         (const.params):
3257         (const.randomProgram):
3258         (f.imports.push):
3259         (failCount.0.catch):
3260         (failCount.0.module.undefined.catch):
3261
3262 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3263
3264         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3265         https://bugs.webkit.org/show_bug.cgi?id=167962
3266
3267         Reviewed by Saam Barati.
3268
3269         * stress/object-rest-deconstruct.js: Added.
3270         (let.assert):
3271         (let.assertPropDescriptor):
3272         (catch):
3273         (get 3):
3274         (foo):
3275         (let.src.get y):
3276         (let.src.set y):
3277         (let.gen):
3278
3279 2017-06-27  Saam Barati  <sbarati@apple.com>
3280
3281         Function constructor needs to follow the spec and validate parameters and body independently
3282         https://bugs.webkit.org/show_bug.cgi?id=173303
3283         <rdar://problem/32732526>
3284
3285         Reviewed by Keith Miller.
3286
3287         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3288         * stress/function-constructor-semantics.js: Added.
3289         (assert):
3290         (hasSyntaxError):
3291         (foo):
3292         (async.foo):
3293         (testError):
3294         (testOK.toString):
3295         (toString):
3296
3297 2017-06-26  Saam Barati  <sbarati@apple.com>
3298
3299         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3300         https://bugs.webkit.org/show_bug.cgi?id=173740
3301
3302         Reviewed by Mark Lam.
3303
3304         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3305         (Array.prototype.Symbol.iterator):
3306
3307 2017-06-26  Saam Barati  <sbarati@apple.com>
3308
3309         Skip a test on 32-bit platforms since we run out of address space.
3310
3311         Rubber stamped by Mark Lam.
3312
3313         * stress/dont-reserve-huge-capacity-lexer.js:
3314
3315 2017-06-26  Saam Barati  <sbarati@apple.com>
3316
3317         Crash in JSC::Lexer<unsigned char>::setCode
3318         https://bugs.webkit.org/show_bug.cgi?id=172754
3319
3320         Reviewed by Mark Lam.
3321
3322         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3323         (catch):
3324
3325 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3326
3327         [JSC] Clean up Object.entries implementation
3328         https://bugs.webkit.org/show_bug.cgi?id=173759
3329
3330         Reviewed by Sam Weinig.
3331
3332         * microbenchmarks/object-entries.js: Added.
3333         (test):
3334
3335 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3336
3337         Remove Reflect.enumerate
3338         https://bugs.webkit.org/show_bug.cgi?id=173806
3339
3340         Reviewed by Yusuke Suzuki.
3341
3342         * ChakraCore.yaml:
3343         * es6.yaml:
3344         These tests now fail because they use Reflect.enumerate.
3345
3346         * test262.yaml:
3347         This test now passes, it checked that Reflect.enumerate is undefined!
3348
3349         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3350         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3351
3352         * stress/reflect-enumerate.js: Removed.
3353         Remove a test solely for Reflect.enumerate.
3354
3355 2017-06-22  Saam Barati  <sbarati@apple.com>
3356
3357         ValueRep(DoubleRep(@v)) can not simply convert to @v
3358         https://bugs.webkit.org/show_bug.cgi?id=173687
3359         <rdar://problem/32855563>
3360
3361         Reviewed by Mark Lam.
3362
3363         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3364         (i.catch):
3365
3366 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3367
3368         [JSC] Object.values should be implemented in C++
3369         https://bugs.webkit.org/show_bug.cgi?id=173703
3370
3371         Reviewed by Sam Weinig.
3372
3373         * microbenchmarks/object-keys-map-values.js: Added.
3374         (test):
3375         * microbenchmarks/object-values.js: Added.
3376         (test):
3377         * stress/object-values-changing-properties.js: Added.
3378         (shouldBe):
3379         (throw.new.Error.let.source.get x):
3380         (throw.new.Error):
3381         (shouldBe.let.handler.get order):
3382         (get let):
3383         (shouldBe.let.handler.get return):
3384         (let.handler.get order):
3385
3386 2017-06-21  Saam Barati  <sbarati@apple.com>
3387
3388         eval virtual call is incorrect in the baseline JIT
3389         https://bugs.webkit.org/show_bug.cgi?id=173587
3390         <rdar://problem/32867897>
3391
3392         Reviewed by Michael Saboff.
3393
3394         * stress/do-eval-virtual-call-correctly.js: Added.
3395         (assert):
3396         (f):
3397         (i.test):
3398         (catch):
3399
3400 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3401
3402         Update test262 test expectations after r218581.
3403
3404         Unreviewed test gardening.
3405
3406         * test262.yaml:
3407
3408 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
3409
3410         Revert changes in bug#160417 about extending `null` not being a derived class
3411         https://bugs.webkit.org/show_bug.cgi?id=169293
3412
3413         Reviewed by Saam Barati.
3414
3415         * stress/class-derived-from-null.js:
3416         (assertThrow):
3417         (test1):
3418         (test2):
3419         (test3):
3420         (test4):
3421         (test5):
3422         (test6):
3423
3424 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3425
3426         [DFG] More ArrayIndexOf fixups for various types
3427         https://bugs.webkit.org/show_bug.cgi?id=173176
3428
3429         Reviewed by Saam Barati.
3430
3431         * stress/array-indexof-arraystorage.js: Added.
3432         (shouldBe):
3433         (indexOfInt32Other):
3434         (indexOfInt32Cell):
3435         (indexOfInt32Boolean):
3436         (indexOfDoubleOther):
3437         (indexOfDoubleCell):
3438         (indexOfDoubleBoolean):
3439         (indexOfInt32):
3440         (indexOfDouble):
3441         * stress/array-indexof-constant-folding.js: Added.
3442         (shouldBe):
3443         (indexOfInt32Other):
3444         (indexOfInt32Cell):
3445         (indexOfInt32Boolean):
3446         (indexOfDoubleOther):
3447         (indexOfDoubleCell):
3448         (indexOfDoubleBoolean):
3449         * stress/array-indexof-hole-and-other.js: Added.
3450         (shouldBe):
3451         (indexOf):
3452         * stress/array-indexof-other.js: Added.
3453         (shouldBe):
3454         (indexOfInt32):
3455         (indexOfDouble):
3456         (indexOfString):
3457         (indexOfObject):
3458         * stress/array-indexof-symbol.js: Added.
3459         (shouldBe):
3460         (indexOfInt32):
3461         (indexOfDouble):
3462         (indexOfString):
3463         (indexOfObject):
3464
3465 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
3466
3467         test262: Completion values for control flow do not match the spec
3468         https://bugs.webkit.org/show_bug.cgi?id=171265
3469
3470         Reviewed by Saam Barati.
3471
3472         * stress/completion-value.js:
3473         Condensed test for completion values in top level statements.
3474
3475         * stress/super-get-by-id.js:
3476         ClassDeclaration when evaled no longer produce values. Convert
3477         these to ClassExpressions so they produce the class value.
3478
3479         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3480         This is a progression for currect spec behavior.
3481
3482         * mozilla/mozilla-tests.yaml:
3483         This test is now outdated, so mark it as failing for that reason.
3484
3485         * test262.yaml:
3486         Passing all "cptn" completion value tests.
3487
3488 2017-06-17  Keith Miller  <keith_miller@apple.com>
3489
3490         ArrayBuffer constructor needs to create subclass structures before its buffer
3491         https://bugs.webkit.org/show_bug.cgi?id=173510
3492
3493         Reviewed by Yusuke Suzuki.
3494
3495         * test262.yaml:
3496
3497 2017-06-17  Keith Miller  <keith_miller@apple.com>
3498
3499         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
3500         https://bugs.webkit.org/show_bug.cgi?id=173506
3501
3502         Reviewed by Ryosuke Niwa.
3503
3504         Re-baseline tests.
3505
3506         * ChakraCore/test/Function/apply3.baseline-jsc:
3507         * test262.yaml:
3508
3509 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3510
3511         [JSC] Add fast path for Object.assign
3512         https://bugs.webkit.org/show_bug.cgi?id=173416
3513
3514         Reviewed by Mark Lam.
3515
3516         * stress/object-assign-changing-properties.js: Added.
3517         (shouldBe):
3518         (throw.new.Error.let.source.get x):
3519         (throw.new.Error):
3520         (shouldBe.let.source.get x):
3521         (shouldBe.let.target.set x):
3522         (shouldBe.let.target.get x):
3523         * stress/object-assign-proxy.js: Added.
3524         (shouldBe):
3525         (throw.new.Error.let.handler.get order):
3526
3527 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3528
3529         [JSC] Implement Object.assign in C++
3530         https://bugs.webkit.org/show_bug.cgi?id=173414
3531
3532         Reviewed by Saam Barati.
3533
3534         * stress/object-assign-string-first.js: Added.
3535         (shouldBe):
3536         (source.get Symbol):
3537         (source.get 1):
3538         (source.get cocoa):
3539
3540 2017-06-14  JF Bastien  <jfbastien@apple.com>
3541
3542         WebAssembly: remove empty test files
3543         https://bugs.webkit.org/show_bug.cgi?id=173382
3544
3545         Reviewed by Saam Barati.
3546
3547         The following files:
3548                 JSTests/wasm/function-tests/call-indirect-params.js
3549                 JSTests/wasm/function-tests/call-indirect.js
3550                 JSTests/wasm/js-api/call-indirect-results.js
3551         Were changed to empty files in https://trac.webkit.org/changeset/209771
3552
3553         They were testing call_indirect with the wrong semantics, before
3554         we implemented tables. That change implemented tables and
3555         therefore removed the erroneous tests.
3556
3557         We have a few tests for call_indirect which already do the right thing:
3558                 JSTests/wasm/function-tests/context-switch.js
3559                 JSTests/wasm/function-tests/exceptions.js
3560                 JSTests/wasm/function-tests/grow-memory-2.js
3561                 JSTests/wasm/function-tests/stack-overflow.js
3562                 JSTests/wasm/function-tests/table-basic-2.js
3563                 JSTests/wasm/function-tests/table-basic.js
3564                 JSTests/wasm/js-api/call-indirect.js
3565                 JSTests/wasm/js-api/table.js
3566                 JSTests/wasm/js-api/unique-signature.js
3567                 JSTests/wasm/js-api/wrapper-function.js
3568
3569         I also just imported the updated spec tests which, among other
3570         things, test call_indirect:
3571                 core/br.wast
3572                 core/br_table.wast
3573                 core/call_indirect.wast
3574                 core/func.wast
3575                 core/func_ptrs.wast
3576                 core/imports.wast
3577                 core/left-to-right.wast
3578                 core/linking.wast
3579                 core/nop.wast
3580                 core/return.wast
3581                 core/typecheck.wast
3582                 core/unreachable.wast
3583
3584         So I think it's OK to just delete the tests which should just have
3585         been deleted back when tables were added.
3586
3587         * wasm/function-tests/call-indirect-params.js: Removed.
3588         * wasm/function-tests/call-indirect.js: Removed.
3589         * wasm/js-api/call-indirect-results.js: Removed.
3590
3591 2017-06-13  JF Bastien  <jfbastien@apple.com>
3592
3593         WebAssembly: import updated spec tests
3594         https://bugs.webkit.org/show_bug.cgi?id=173287
3595         <rdar://problem/32725975>
3596
3597         Reviewed by Saam Barati.
3598
3599         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
3600         with a few modifications so things work.
3601
3602         Fix a bunch of bugs found through this process, and punt a few tests (which I
3603         marked as blocked by this bug).
3604
3605         Fixes:
3606
3607         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
3608         instead of byte alignment. It was also missing memory-alignment.js despite it
3609         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
3610         pass.
3611
3612         Tables can be imported or in a section. There can be only one, but sections can
3613         be empty. An Elements section can exist if there's no Table, as long as it is
3614         also empty.
3615
3616         Memories can be imported or in a section. There can be only one, but sections
3617         can be empty. A Data section can exist if there's no Memory, as long as it is
3618         also empty.
3619
3620         Prototypes: stringify without .prototype. in the string.
3621
3622         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
3623         not a final size, and throws a RangeError on failure, not a TypeError.
3624
3625         Fix compile / instantiate so the reject the promise if given an argument of the
3626         wrong type (instead of failing instantly).
3627
3628         Fix async on neuter test.
3629
3630         Element section shouldn't affect any Table if any of the elements are out of
3631         bounds. We need to process it in two passes.
3632
3633         Segment section shouldn't affect any Data if any of the segments are out of
3634         bounds. We need to process it in two passes.
3635
3636         Empty data segments are valid, but only when there is no memory. Their index
3637         still gets validated, and has to be zero.
3638
3639         Punts:
3640
3641         Error messages with context, the test seems overly restrictive but this is
3642         minor.
3643
3644         compile/instantiate/validate property descriptors.
3645
3646         UTF-8 bugs.
3647
3648         Temporarily disable NaN tests. We need to go back and implement the following
3649         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
3650         much as getting all the other tests passing.
3651
3652         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
3653         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
3654         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
3655         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
3656         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
3657         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
3658         why they're not allowed.
3659
3660         * wasm.yaml:
3661         * wasm/function-tests/i32-load8-s.js:
3662         * wasm/function-tests/memory-access-past-4gib.js:
3663         (const.op.of.WASM.opcodes):
3664         * wasm/function-tests/memory-alignment.js: Added.
3665         (const.op.of.WASM.opcodes):
3666         * wasm/function-tests/memory-section-and-import.js:
3667         * wasm/js-api/Module-compile.js:
3668         (async.testPromiseAPI):
3669         * wasm/js-api/dont-mmap-zero-byte-memory.js:
3670         (testMems):
3671         * wasm/js-api/element.js:
3672         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3673         * wasm/js-api/neutered-inputs.js:
3674         (const.testFunction): Deleted.
3675         (const.testConstructor): Deleted.
3676         * wasm/js-api/table.js:
3677         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3678         (new.WebAssembly.Module):
3679         (assert.throws):
3680         (assertBadTableImport):
3681         (assert.throws.WebAssembly.Table.prototype.grow):
3682         (assertBadTableInstance): Deleted.
3683         * wasm/js-api/test_Data.js:
3684         (DataSectionWithoutMemory):
3685         * wasm/spec-harness/index.js:
3686         (module):
3687         (uniqueTest): Deleted.
3688         (assert_invalid): Deleted.
3689         (assert_soft_invalid): Deleted.
3690         (register): Deleted.
3691         (call): Deleted.
3692         (get instance): Deleted.
3693         (exports): Deleted.
3694         (run): Deleted.
3695         (assert_unlinkable): Deleted.
3696         (assert_uninstantiable): Deleted.
3697         (assert_trap): Deleted.
3698         (try.f): Deleted.
3699         (catch): Deleted.
3700         (assert_exhaustion): Deleted.
3701         (assert_return): Deleted.
3702         (assert_return_nan): Deleted.
3703         * wasm/spec-harness/testharness.css: Removed.
3704         * wasm/spec-harness/testharness.js: Removed.
3705         * wasm/spec-harness/testharnessreport.js: Removed.
3706         * wasm/spec-harness/wasm-constants.js:
3707         (assertTraps):
3708         (assertWasmThrows):
3709         * wasm/spec-harness/wasm-module-builder.js:
3710         (Binary.prototype.emit_section):
3711         (Binary):
3712         (WasmFunctionBuilder.prototype.addBody):
3713         (WasmFunctionBuilder.prototype.end):
3714         (WasmFunctionBuilder):
3715         (WasmModuleBuilder.prototype.stringToBytes):
3716         (WasmModuleBuilder.prototype.addCustomSection):
3717         (WasmModuleBuilder.prototype.addFunctionTableInit):
3718         (WasmModuleBuilder.prototype.appendToTable):
3719         (WasmModuleBuilder.prototype.toArray):
3720         (WasmModuleBuilder.prototype.toBuffer):
3721         (WasmModuleBuilder.prototype.instantiate):
3722         (WasmModuleBuilder):
3723         * wasm/spec-tests/address.wast.js:
3724         * wasm/spec-tests/align.wast.js: Added.
3725         * wasm/spec-tests/binary.wast.js:
3726         * wasm/spec-tests/block.wast.js:
3727         * wasm/spec-tests/br.wast.js:
3728         * wasm/spec-tests/br_if.wast.js:
3729         * wasm/spec-tests/br_table.wast.js:
3730         * wasm/spec-tests/call.wast.js:
3731         * wasm/spec-tests/call_indirect.wast.js:
3732         * wasm/spec-tests/comments.wast.js:
3733         * wasm/spec-tests/const.wast.js: Added.
3734         * wasm/spec-tests/conversions.wast.js: Added.
3735         * wasm/spec-tests/custom_section.wast.js:
3736         * wasm/spec-tests/exports.wast.js:
3737         * wasm/spec-tests/f32.wast.js: Added.
3738         * wasm/spec-tests/f64.wast.js: Added.
3739         * wasm/spec-tests/fac.wast.js:
3740         * wasm/spec-tests/float_exprs.wast.js: Added.
3741         * wasm/spec-tests/float_misc.wast.js: Added.
3742         * wasm/spec-tests/func.wast.js:
3743         * wasm/spec-tests/globals.wast.js:
3744         * wasm/spec-tests/if.wast.js:
3745         * wasm/spec-tests/imports.wast.js:
3746         * wasm/spec-tests/inline-module.wast.js: Added.
3747         * wasm/spec-tests/jsapi.js:
3748         (testJSAPI.test):
3749         (testJSAPI):
3750         * wasm/spec-tests/labels.wast.js:
3751         * wasm/spec-tests/loop.wast.js:
3752         * wasm/spec-tests/memory.wast.js:
3753         * wasm/spec-tests/memory_trap.wast.js: Added.
3754         * wasm/spec-tests/names.wast.js:
3755         * wasm/spec-tests/nop.wast.js:
3756         * wasm/spec-tests/return.wast.js:
3757         * wasm/spec-tests/stack.wast.js:
3758         * wasm/spec-tests/token.wast.js: Added.
3759         * wasm/spec-tests/type.wast.js: Added.
3760         * wasm/spec-tests/typecheck.wast.js:
3761         * wasm/spec-tests/unreachable.wast.js:
3762         * wasm/spec-tests/unreached-invalid.wast.js:
3763         * wasm/spec-tests/unwind.wast.js:
3764         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
3765         * wasm/spec-tests/utf8-import-field.wast.js: Added.
3766         * wasm/spec-tests/utf8-import-module.wast.js: Added.
3767
3768 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
3769
3770         Unreviewed JSC test gardening.
3771
3772         * stress/check-string-ident.js:
3773         * stress/new-largeish-contiguous-array-with-size.js:
3774
3775 2017-06-13  Michael Saboff  <msaboff@apple.com>
3776
3777         DFG doesn't properly handle a property that is change to read only in a prototype
3778         https://bugs.webkit.org/show_bug.cgi?id=173321
3779
3780         Reviewed by Filip Pizlo.
3781
3782         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
3783         * stress/regress-173321.js: Added new regression test.
3784         (shouldBe):
3785         (SimpleObject):
3786         (test):
3787
3788 2017-06-12  Saam Barati  <sbarati@apple.com>
3789
3790         Update test262 test expectation since r218082 makes new tests pass.
3791
3792         * test262.yaml:
3793
3794 2017-06-12  Saam Barati  <sbarati@apple.com>
3795
3796         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
3797         https://bugs.webkit.org/show_bug.cgi?id=172957
3798         <rdar://problem/32602704>
3799
3800         Reviewed by Filip Pizlo.
3801
3802         * stress/spec-empty-flows-through-cell-checks.js: Added.
3803         (A):
3804         (B):
3805         (i.catch):
3806
3807 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
3808
3809         We incorrectly allow escaped characters in keyword tokens
3810         https://bugs.webkit.org/show_bug.cgi?id=171310
3811
3812         Reviewed by Yusuke Suzuki.
3813
3814         * stress/destructuring-assignment-syntax.js:
3815         * stress/error-messages-for-in-operator-should-not-crash.js:
3816         (catch):
3817         * stress/reserved-word-with-escape.js:
3818         (testSyntaxError.String.raw.v):
3819         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
3820         (testSyntaxError.String.raw.a):
3821         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
3822
3823 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3824
3825         [DFG] Add ArrayIndexOf intrinsic
3826         https://bugs.webkit.org/show_bug.cgi?id=172421
3827
3828         Reviewed by Saam Barati.
3829
3830         * stress/array-indexof-array-prototype-change.js: Added.
3831         (shouldBe):
3832         (indexOfInt32):
3833         * stress/array-indexof-have-a-bad-time-getter.js: Added.
3834         (shouldBe):
3835         (indexOfInt32):
3836         * stress/array-indexof-have-a-bad-time.js: Added.
3837         (shouldBe):
3838         (indexOfInt32):
3839         * stress/array-indexof-hole-with-prototype.js: Added.
3840         (shouldBe):
3841         (indexOf):
3842         * stress/array-indexof-hole.js: Added.
3843         (shouldBe):
3844         (indexOf):
3845         * stress/array-indexof-index.js: Added.
3846         (shouldBe):
3847         (indexOfInt32):
3848         (indexOfDouble):
3849         (indexOfString):
3850         (indexOfObject):
3851         (indexOfValue):
3852         * stress/array-indexof-negative-index.js: Added.
3853         (shouldBe):
3854         (indexOfInt32):
3855         (indexOfDouble):
3856         (indexOfString):
3857         (indexOfObject):
3858         (indexOfValue):
3859         * stress/array-indexof-non-int32-start-index.js: Added.
3860         (shouldBe):
3861         (indexOf):
3862         (object.valueOf):
3863         * stress/array-indexof-object-prototype-change.js: Added.
3864         (shouldBe):
3865         (indexOfInt32):
3866         * stress/array-indexof-object.js: Added.
3867         (shouldBe):
3868         (indexOf):
3869         * stress/array-indexof-original-array.js: Added.
3870         (shouldBe):
3871         (indexOfInt32):
3872         * stress/array-indexof-string.js: Added.
3873         (shouldBe):
3874         (indexOf):
3875         * stress/array-indexof-structure-change-convert.js: Added.
3876         (shouldBe):
3877         (indexOf):
3878         * stress/array-indexof-structure-change.js: Added.
3879         (shouldBe):
3880         (indexOf):
3881         * stress/array-indexof.js: Added.
3882         (shouldBe):
3883         (indexOf):
3884
3885 2017-06-11  Keith Miller  <keith_miller@apple.com>
3886
3887         TypedArray constructor with string shouldn't throw
3888         https://bugs.webkit.org/show_bug.cgi?id=173181
3889
3890         Reviewed by JF Bastien.
3891
3892         We should be coercing primitive arguments to numbers in the various
3893         TypedArray constructors.
3894
3895         * stress/typedarray-constructor.js:
3896
3897 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3898
3899         Unreviewed, update test results part 3
3900         https://bugs.webkit.org/show_bug.cgi?id=173227
3901
3902         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
3903
3904 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3905
3906         Unreviewed, update test results part 2
3907         https://bugs.webkit.org/show_bug.cgi?id=173227
3908
3909         * test262.yaml:
3910
3911 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3912
3913         Unreviewed, update test results
3914         https://bugs.webkit.org/show_bug.cgi?id=173227
3915
3916         * microbenchmarks/string-prototype-search-observable-side-effects.js:
3917         * test262.yaml:
3918
3919 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3920
3921         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
3922         https://bugs.webkit.org/show_bug.cgi?id=173227
3923
3924         Reviewed by Mark Lam.
3925
3926         Update the test.
3927
3928         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
3929
3930 2017-06-08  Keith Miller  <keith_miller@apple.com>
3931
3932         WebAssembly: We should only create wrappers for functions that can be exported
3933         https://bugs.webkit.org/show_bug.cgi?id=173088
3934
3935         Reviewed by Saam Barati.
3936
3937         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
3938         on the old testWasmModuleFunctions api, which has been removed.
3939
3940         * wasm/function-tests/copysign.js: Removed.
3941         * wasm/function-tests/ctz.js: Removed.
3942         * wasm/function-tests/drop.js: Removed.
3943         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
3944         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
3945         * wasm/function-tests/dumb-less-than-ite.js: Removed.
3946         * wasm/function-tests/eqz.js: Removed.
3947         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
3948         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
3949         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
3950         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
3951         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
3952         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
3953         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
3954         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
3955         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
3956         * wasm/function-tests/if-then-fallthrough.js: Removed.
3957         * wasm/function-tests/int-to-floating-point.js: Removed.
3958         * wasm/function-tests/loop-mult.js:
3959         * wasm/function-tests/loop-sum.js:
3960         * wasm/function-tests/max.js: Removed.
3961         * wasm/function-tests/min.js: Removed.
3962         * wasm/function-tests/nearest.js: Removed.
3963         * wasm/function-tests/nop.js: Removed.
3964         * wasm/function-tests/popcnt.js: Removed.
3965         * wasm/function-tests/ret5.js:
3966         * wasm/function-tests/select.js: Removed.
3967         * wasm/function-tests/tee-local.js: Removed.
3968         * wasm/function-tests/trunc.js: Removed.
3969
3970 2017-06-07  JF Bastien  <jfbastien@apple.com>
3971
3972         WebAssembly: test imports and exports with 16-bit characters
3973         https://bugs.webkit.org/show_bug.cgi?id=165977
3974         <rdar://problem/29760130>
3975
3976         Reviewed by Saam Barati.
3977
3978         The output for import failure was improved, so many tests need to
3979         be updated here. Only one has new tests as noted below.
3980
3981         * wasm/function-tests/memory-import-and-grow.js:
3982         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
3983         (idxModule):
3984         * wasm/js-api/global-error.js:
3985         (new.Number):
3986         (assert.throws):
3987         * wasm/js-api/table.js:
3988         (assert.throws):
3989         (new.WebAssembly.Table):
3990         * wasm/js-api/test_memory.js:
3991         (test):
3992         * wasm/js-api/wasm-to-wasm-bad-signature.js:
3993         (BadSignatureDropStartParams.):
3994         (BadSignatureDropStartParams):
3995         (BadSignatureDropEndParams.):
3996         (BadSignatureSwapParam.):
3997         (BadSignatureRet.):
3998         * wasm/js-api/web-assembly-instantiate.js:
3999         (assert.asyncTest.async.test):
4000         (assert.asyncTest):
4001         * wasm/js-api/wrapper-function.js:
4002         (return.new.WebAssembly.Module):
4003
4004 2017-06-07  Mark Lam  <mark.lam@apple.com>
4005
4006         Restrict the regress-173035.js test to only run on Darwin x86-64.
4007         https://bugs.webkit.org/show_bug.cgi?id=173075
4008
4009         Reviewed by Saam Barati.
4010
4011         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
4012         this test will require to succeed.  Here's an example of this failure:
4013         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
4014
4015         Since the issue is due to allocation of a very large amount of memory, the test
4016         will probably fail on iOS and other platforms as well.  Hence, we should just
4017         skip this test for any platforms that is not Darwin x86-64.
4018
4019         * stress/regress-173035.js:
4020
4021 2017-06-07  Mark Lam  <mark.lam@apple.com>
4022
4023         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
4024         https://bugs.webkit.org/show_bug.cgi?id=168587
4025
4026         Not reviewed.
4027
4028         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
4029
4030         * stress/test-finally.js:
4031
4032 2017-06-06  Mark Lam  <mark.lam@apple.com>
4033
4034         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
4035         https://bugs.webkit.org/show_bug.cgi?id=173035
4036         <rdar://problem/32554593>
4037
4038         Reviewed by Geoffrey Garen and Filip Pizlo.
4039
4040         * stress/regress-173035.js: Added.
4041
4042 2017-06-06  Saam Barati  <sbarati@apple.com>
4043
4044         Make sure we restore SP when doing calls that could be to JS
4045         https://bugs.webkit.org/show_bug.cgi?id=172946
4046         <rdar://problem/32579026>
4047
4048         Reviewed by JF Bastien.
4049
4050         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
4051         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
4052         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
4053         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
4054         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
4055
4056 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
4057
4058         Unreviewed rollout r217807. Caused a test to crash.
4059
4060         * heapProfiler/class-names.js: Removed.
4061         * heapProfiler/driver/driver.js:
4062         (CheapHeapSnapshotNode):
4063         (CheapHeapSnapshot):
4064         (createCheapHeapSnapshot):
4065         (HeapSnapshot):
4066         (createHeapSnapshot):
4067         * typeProfiler/inheritance.js:
4068         (wrapper.A):
4069         (wrapper.B):
4070         (wrapper.C):
4071         (wrapper):
4072
4073 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
4074
4075         index out of bound in bytecodebasicblock
4076         https://bugs.webkit.org/show_bug.cgi?id=172963
4077
4078         Reviewed by Saam Barati and Mark Lam.
4079
4080         * stress/dfg-call-class-constructor.js: Added.
4081         (Foo):
4082         (i.catch):
4083
4084 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
4085
4086         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
4087         https://bugs.webkit.org/show_bug.cgi?id=172848
4088         <rdar://problem/25709212>
4089
4090         Reviewed by Saam Barati.
4091
4092         * typeProfiler/inheritance.js:
4093         Rewrite the test slightly for clarity. The hoisting was confusing.
4094
4095         * heapProfiler/class-names.js: Added.
4096         (MyES5Class):
4097         (MyES6Class):
4098         (MyES6Subclass):
4099         Test object types and improved class names.
4100
4101         * heapProfiler/driver/driver.js:
4102         (CheapHeapSnapshotNode):
4103         (CheapHeapSnapshot):
4104         (createCheapHeapSnapshot):
4105         (HeapSnapshot):
4106         (createHeapSnapshot):
4107         Update snapshot parsing from version 1 to version 2.
4108
4109 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
4110
4111         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
4112         https://bugs.webkit.org/show_bug.cgi?id=168844
4113
4114         Reviewed by Saam Barati.
4115
4116         * modules/async-function-export.js: Added.
4117         (f):
4118         (export.async.f):
4119
4120 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
4121
4122         ES2015 modules - Export default function hoisting
4123         https://bugs.webkit.org/show_bug.cgi?id=170174
4124
4125         Reviewed by Saam Barati.
4126
4127         This issue itself is solved by fixing function declaration hoisting rules.
4128         This patch just adds the specific test to modules tests to ensure the bug
4129         is fixed.
4130
4131         * modules/export-default-function-hoisting.js: Added.
4132         * modules/export-default-function-hoisting/cappuccino.js: Added.
4133         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
4134         * modules/export-default-function-hoisting/cocoa.js: Added.
4135         (export.default.drinkCocoa):
4136
4137 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
4138
4139         Class Proxy can't be extended
4140         https://bugs.webkit.org/show_bug.cgi?id=169040
4141
4142         Reviewed by Saam Barati.
4143
4144         Adding tests that check correctness of Proxy to ES6 `class`
4145         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
4146
4147         * stress/proxy-class.js: Added.
4148         (assert):
4149         (throw.new.Error.SuperClass):
4150         (throw.new.Error.A):
4151         (throw.new.Error):
4152
4153 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
4154
4155         [JSC] Implement String.prototype.concat in JS builtins
4156         https://bugs.webkit.org/show_bug.cgi?id=172798
4157
4158         Reviewed by Sam Weinig.
4159
4160         * microbenchmarks/string-concat-convert.js: Added.
4161         (test):
4162         * microbenchmarks/string-concat-long-convert.js: Added.
4163         (test):
4164         * microbenchmarks/string-concat-long.js: Added.
4165         (test):
4166         * microbenchmarks/string-concat.js: Added.
4167         (test):
4168
4169 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
4170
4171         Rolling out: Prevent async methods named 'function'
4172         https://bugs.webkit.org/show_bug.cgi?id=172776
4173
4174         Reviewed by Mark Lam.
4175
4176         * stress/async-await-syntax.js:
4177         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
4178         (testTopLevelAsyncAwaitSyntaxSloppyMode):
4179         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
4180         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
4181         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
4182
4183 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
4184
4185         Skip flaky JSC test stress/test-finally.js
4186         https://bugs.webkit.org/show_bug.cgi?id=168587
4187
4188         Unreviewed test gardening.
4189
4190         * stress/test-finally.js:
4191
4192 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
4193
4194         Prevent async methods named 'function' in Object literal
4195         https://bugs.webkit.org/show_bug.cgi?id=172660
4196
4197         Reviewed by Saam Barati.
4198
4199         * stress/async-await-syntax.js:
4200         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
4201
4202 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
4203
4204         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
4205         https://bugs.webkit.org/show_bug.cgi?id=171274
4206
4207         Reviewed by Saam Barati.
4208
4209         * stress/async-arrow-functions-lexical-binding-in-class.js:
4210         (shouldBeAsync):
4211         (shouldBeAsyncAndStoreBind):
4212         (promise.new.Promise):
4213         (ChildClass4):
4214         (ChildClass4.prototype.classValue):
4215         (ChildClass4.prototype.get classProperty):
4216         * stress/async-arrow-functions-lexical-super-binding.js:
4217         (A):
4218         (const.childA1.new.prototype.var.f.async):
4219         (const.childA1.new.var):
4220         (const.childA1.new):
4221         (const.childA2.new.prototype.var.f.async):
4222         (const.childA2.new.var):
4223         (const.childA2.new):
4224         (const.childA3.new.prototype.var.f.async):
4225         (const.childA3.new.var):
4226         (const.childA3.new):
4227         (try.childA4.new.prototype.var.f.async):
4228         (try.childA4.new.var):
4229         (try.childA4.new):
4230         (catch):
4231         (const.childA5.new.prototype.var.f.async):
4232         (const.childA5.new.var):
4233         (const.childA5.new):
4234         (checkClass):
4235         (checkClass.new.prototype.var.f.async):
4236         (checkClass.new.var):
4237         (checkClass.new):
4238         (checkClass.new.prototype.method):
4239         (checkClass.new.prototype.prop):
4240
4241 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
4242
4243         [JSC] Map and Set constructors should have fast path for cloning
4244         https://bugs.webkit.org/show_bug.cgi?id=172413
4245
4246         Reviewed by Saam Barati.
4247
4248         * stress/map-clone-instance-iterator-change.js: Added.
4249         (shouldBe):
4250         (map.Symbol.iterator):
4251         * stress/map-clone-iterator-change.js: Added.
4252         (shouldBe):
4253         (Map.prototype.Symbol.iterator):
4254         * stress/map-clone-next-change.js: Added.
4255         (shouldBe):
4256         (map.Symbol.iterator.__proto__.next):
4257         * stress/map-clone.js: Added.
4258         (shouldBe):
4259         (Map.prototype):
4260         * stress/map-inherit-set.js: Added.
4261         (shouldBe):
4262         (DerivedMap):
4263         (set for):
4264         * stress/set-clone-instance-iterator-change.js: Added.
4265         (shouldBe):
4266         (set Symbol.iterator):
4267         * stress/set-clone-iterator-change.js: Added.
4268         (shouldBe):
4269         (set Set.prototype.Symbol.iterator):
4270         * stress/set-clone-next-change.js: Added.
4271         (shouldBe):
4272         (set Symbol.iterator.__proto__.next):
4273         * stress/set-clone.js: Added.
4274         (shouldBe):
4275         (set Set.prototype.add):
4276         * stress/set-inherit-add.js: Added.
4277         (shouldBe):
4278         (DerivedSet.set add):
4279
4280 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
4281
4282         Unreviewed, rolling out r217458.
4283
4284         This change caused 55 JSC test failures.
4285
4286         Reverted changeset:
4287
4288         "Date should use historical data if it's available."
4289         https://bugs.webkit.org/show_bug.cgi?id=172592
4290         http://trac.webkit.org/changeset/217458
4291
4292 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
4293
4294         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
4295         https://bugs.webkit.org/show_bug.cgi?id=167805
4296
4297         Reviewed by Saam Barati.
4298
4299         * modules/module-jit-reachability.js: Added.
4300
4301 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
4302
4303         Prevent async methods named 'function'
4304         https://bugs.webkit.org/show_bug.cgi?id=172598
4305
4306         Reviewed by Mark Lam.
4307
4308         * stress/async-await-syntax.js:
4309         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
4310         (testTopLevelAsyncAwaitSyntaxSloppyMode):
4311         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
4312         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
4313         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
4314
4315 2017-05-25  Keith Miller  <keith_miller@apple.com>
4316
4317         Date should use historical data if it's available.
4318         https://bugs.webkit.org/show_bug.cgi?id=172592
4319
4320         Reviewed by Mark Lam.
4321
4322         Remove parts of the date tests that rely on the absence of
4323         historical data in Date.
4324
4325         * mozilla/ecma/Date/15.9.5.31-1.js:
4326         (getTestCases):
4327         * mozilla/ecma/Date/15.9.5.35-1.js:
4328         (getTestCases):
4329
4330 2017-05-25  Saam Barati  <sbarati@apple.com>
4331
4332         Our for-in optimization in the bytecode generator does its static analysis incorrectly
4333         https://bugs.webkit.org/show_bug.cgi?id=172532
4334         <rdar://problem/32369452>
4335
4336         Reviewed by Mark Lam.
4337
4338         * stress/for-in-invalidation-for-any-write.js: Added.
4339         (assert):
4340         (test):
4341         (test.i):
4342
4343 2017-05-25  Mark Lam  <mark.lam@apple.com>
4344
4345         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
4346         https://bugs.webkit.org/show_bug.cgi?id=172548
4347         <rdar://problem/31458393>
4348
4349         Reviewed by Filip Pizlo.
4350
4351         * stress/regress-172548.patch: Added.
4352
4353 2017-05-23  Saam Barati  <sbarati@apple.com>
4354
4355         We should not mmap zero bytes for a memory in Wasm
4356         https://bugs.webkit.org/show_bug.cgi?id=172528
4357         <rdar://problem/32257076>
4358
4359         Reviewed by Mark Lam.
4360
4361         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
4362         (testMems):
4363
4364 2017-05-23  Saam Barati  <sbarati@apple.com>
4365
4366         CFGSimplificationPhase should not merge a block with itself
4367         https://bugs.webkit.org/show_bug.cgi?id=172508
4368         <rdar://problem/28424006>
4369
4370         Reviewed by Keith Miller.
4371
4372         * stress/dont-crash-in-cfg-simplification.js: Added.
4373         (bar):
4374         (baz):
4375         (foo):
4376
4377 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
4378
4379         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
4380         https://bugs.webkit.org/show_bug.cgi?id=172216
4381
4382         Reviewed by Saam Barati.
4383
4384         * stress/array-storage-get-by-val.js: Added.
4385         (shouldBe):
4386         (testOutOfBound):
4387         (testInBound):
4388         (testSlowPutOutOfBound):
4389         (testSlowPutInBound):
4390
4391 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
4392
4393         Unreviewed, fix commented out tests
4394         https://bugs.webkit.org/show_bug.cgi?id=172225
4395
4396         * stress/get-by-val-string.js:
4397         (object.43):
4398         (Hello):
4399         (Hello.prototype.get 42):
4400         (Hello.prototype.43):
4401         (Derived):
4402         (shouldBe):
4403         (throw.new.Error): Deleted.
4404
4405 2017-05-21  Saam Barati  <sbarati@apple.com>
4406
4407         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
4408         https://bugs.webkit.org/show_bug.cgi?id=171041
4409         <rdar://problem/32082516>
4410
4411         Reviewed by Yusuke Suzuki.
4412
4413         * stress/lexical-scoping-for-loop.js: Added.
4414         (assert):
4415         (test1):
4416         (test2):
4417         (test3):
4418         (test4):
4419         (test5):
4420         (test6):
4421         (let.test7):
4422         (let.test8):
4423         (let.test9):
4424         (let.test10):
4425         (let.test11):
4426         (let.test12):
4427
4428 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
4429