JSTests/ChangeLog

   1 2017-10-26  Michael Saboff  <msaboff@apple.com>
   2
   3         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
   4         https://bugs.webkit.org/show_bug.cgi?id=178890
   5
   6         Reviewed by Keith Miller.
   7
   8         New regression test.
   9
  10         * stress/regress-178890.js: Added.
  11
  12 2017-10-26  Mark Lam  <mark.lam@apple.com>
  13
  14         JSRopeString::RopeBuilder::append() should check for overflows.
  15         https://bugs.webkit.org/show_bug.cgi?id=178385
  16         <rdar://problem/35027468>
  17
  18         Reviewed by Saam Barati.
  19
  20         * stress/regress-178385.js: Added.
  21
  22 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
  23
  24         Unreviewed, rolling out r223961.
  25
  26         The change that required this has been rolled out.
  27
  28         Reverted changeset:
  29
  30         "Mark test262.yaml/test262/test/language/statements/try/tco-
  31         catch.js as passing."
  32         https://bugs.webkit.org/show_bug.cgi?id=178592
  33         https://trac.webkit.org/changeset/223961
  34
  35 2017-10-25  Commit Queue  <commit-queue@webkit.org>
  36
  37         Unreviewed, rolling out r223691 and r223729.
  38         https://bugs.webkit.org/show_bug.cgi?id=178834
  39
  40         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
  41         by rniwa on #webkit).
  42
  43         Reverted changesets:
  44
  45         "Turn recursive tail calls into loops"
  46         https://bugs.webkit.org/show_bug.cgi?id=176601
  47         https://trac.webkit.org/changeset/223691
  48
  49         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
  50         comparison is always false due to limited range of data type
  51         [-Wtype-limits]"
  52         https://bugs.webkit.org/show_bug.cgi?id=178543
  53         https://trac.webkit.org/changeset/223729
  54
  55 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
  56
  57         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
  58         https://bugs.webkit.org/show_bug.cgi?id=178592
  59
  60         Unreviewed test gardening.
  61
  62         * test262.yaml:
  63
  64 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
  65
  66         [FTL] Support NewStringObject
  67         https://bugs.webkit.org/show_bug.cgi?id=178737
  68
  69         Reviewed by Saam Barati.
  70
  71         * stress/new-string-object.js: Added.
  72         (shouldBe):
  73         (test):
  74
  75 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
  76
  77         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
  78         https://bugs.webkit.org/show_bug.cgi?id=178308
  79
  80         Reviewed by Mark Lam.
  81
  82         * test262.yaml:
  83
  84 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
  85
  86         [JSC] Use fastJoin in Array#toString
  87         https://bugs.webkit.org/show_bug.cgi?id=178062
  88
  89         Reviewed by Darin Adler.
  90
  91         * microbenchmarks/contiguous-array-to-string.js: Added.
  92         (target):
  93         * microbenchmarks/double-array-to-string.js: Added.
  94         (target):
  95         * microbenchmarks/int32-array-to-string.js: Added.
  96         (target):
  97
  98 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
  99
 100         stress/check-string-ident.js is improperly skipped
 101         https://bugs.webkit.org/show_bug.cgi?id=178642
 102
 103         Reviewed by Saam Barati.
 104
 105         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
 106         since it enforces the run-jsc-stress-tests script to still set up the
 107         test to run, despite the skip directive that's used before.
 108
 109 2017-10-20  Mark Lam  <mark.lam@apple.com>
 110
 111         Add a test case for r214334.
 112         https://bugs.webkit.org/show_bug.cgi?id=169941
 113         <rdar://problem/31221258>
 114
 115         Reviewed by JF Bastien.
 116
 117         * stress/regress-169941.js: Added.
 118
 119 2017-10-19  JF Bastien  <jfbastien@apple.com>
 120
 121         WebAssembly: no VM / JS version of everything but Instance
 122         https://bugs.webkit.org/show_bug.cgi?id=177473
 123
 124         Reviewed by Filip Pizlo, Saam Barati.
 125
 126         - Exceeding max on memory growth now returns a range error as per
 127         spec. This is a (very minor) breaking change: it used to throw OOM
 128         error. Update the corresponding test.
 129
 130         * wasm/js-api/memory-grow.js:
 131         (assertEq):
 132         * wasm/js-api/table.js:
 133         (assert.throws):
 134
 135 2017-10-19  Mark Lam  <mark.lam@apple.com>
 136
 137         Stringifier::appendStringifiedValue() is missing an exception check.
 138         https://bugs.webkit.org/show_bug.cgi?id=178386
 139         <rdar://problem/35027610>
 140
 141         Reviewed by Saam Barati.
 142
 143         * stress/regress-178386.js: Added.
 144
 145 2017-10-19  Michael Saboff  <msaboff@apple.com>
 146
 147         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
 148         https://bugs.webkit.org/show_bug.cgi?id=178521
 149
 150         Reviewed by JF Bastien.
 151
 152         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
 153         now passes with the current version (5.0) of the Emoji spec.
 154
 155 2017-10-19  Robin Morisset  <rmorisset@apple.com>
 156
 157         Turn recursive tail calls into loops
 158         https://bugs.webkit.org/show_bug.cgi?id=176601
 159
 160         Reviewed by Saam Barati.
 161
 162         Add some simple test that computes factorial in several ways, and other trivial computations.
 163         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
 164         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
 165         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
 166         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
 167
 168         * stress/inline-call-to-recursive-tail-call.js: Added.
 169         (factorial.aux):
 170         (factorial):
 171         (factorial2.aux):
 172         (factorial2.id):
 173         (factorial2):
 174         (factorial3.aux):
 175         (factorial3):
 176         (aux):
 177         (factorial4):
 178         (test):
 179
 180 2017-10-18  Mark Lam  <mark.lam@apple.com>
 181
 182         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
 183         https://bugs.webkit.org/show_bug.cgi?id=177600
 184         <rdar://problem/34710985>
 185
 186         Reviewed by Saam Barati.
 187
 188         * stress/regress-177600.js: Added.
 189
 190 2017-10-18  Mark Lam  <mark.lam@apple.com>
 191
 192         The compiler should always register a structure when it adds its transitionWatchPointSet.
 193         https://bugs.webkit.org/show_bug.cgi?id=178420
 194         <rdar://problem/34814024>
 195
 196         Reviewed by Saam Barati and Filip Pizlo.
 197
 198         * stress/regress-178420.js: Added.
 199         (new.Array.10000.map):
 200
 201 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 202
 203         [JSC] __proto__ getter should be fast
 204         https://bugs.webkit.org/show_bug.cgi?id=178067
 205
 206         Reviewed by Saam Barati.
 207
 208         * stress/dfg-object-proto-accessor.js: Added.
 209         (shouldBe):
 210         (shouldThrow):
 211         (target):
 212         * stress/dfg-object-proto-getter.js: Added.
 213         (shouldBe):
 214         (shouldThrow):
 215         (target):
 216         * stress/dfg-object-prototype-of.js: Added.
 217         (shouldBe):
 218         (shouldThrow):
 219         (target):
 220         * stress/dfg-reflect-get-prototype-of.js: Added.
 221         (shouldBe):
 222         (shouldThrow):
 223         (target):
 224         * stress/intrinsic-getter-with-poly-proto.js: Added.
 225         (shouldBe):
 226         (makePolyProtoObject.foo.C):
 227         (makePolyProtoObject.foo):
 228         (makePolyProtoObject):
 229         (target):
 230         * stress/object-get-prototype-of-filtered.js: Added.
 231         (shouldBe):
 232         (shouldThrow):
 233         (target):
 234         (i.Cocoa):
 235         * stress/object-get-prototype-of-mono-proto.js: Added.
 236         (shouldBe):
 237         (makePolyProtoObject.foo.C):
 238         (makePolyProtoObject.foo):
 239         (makePolyProtoObject):
 240         (target):
 241         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 242         (shouldBe):
 243         (makePolyProtoObject.foo.C):
 244         (makePolyProtoObject.foo):
 245         (makePolyProtoObject):
 246         (target):
 247         * stress/object-get-prototype-of-poly-proto.js: Added.
 248         (shouldBe):
 249         (makePolyProtoObject.foo.C):
 250         (makePolyProtoObject.foo):
 251         (makePolyProtoObject):
 252         (target):
 253         * stress/object-proto-getter-filtered.js: Added.
 254         (shouldBe):
 255         (shouldThrow):
 256         (target):
 257         (i.Cocoa):
 258         * stress/object-proto-getter-poly-mono-proto.js: Added.
 259         (shouldBe):
 260         (makePolyProtoObject.foo.C):
 261         (makePolyProtoObject.foo):
 262         (makePolyProtoObject):
 263         (target):
 264         * stress/object-proto-getter-poly-proto.js: Added.
 265         (shouldBe):
 266         (makePolyProtoObject.foo.C):
 267         (makePolyProtoObject.foo):
 268         (makePolyProtoObject):
 269         (target):
 270         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 271         * stress/string-proto.js: Added.
 272         (shouldBe):
 273         (target):
 274
 275 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
 276
 277         Unreviewed, rolling out r223523.
 278
 279         A test for this change is failing on debug JSC bots.
 280
 281         Reverted changeset:
 282
 283         "[JSC] __proto__ getter should be fast"
 284         https://bugs.webkit.org/show_bug.cgi?id=178067
 285         https://trac.webkit.org/changeset/223523
 286
 287 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
 288
 289         [JSC] __proto__ getter should be fast
 290         https://bugs.webkit.org/show_bug.cgi?id=178067
 291
 292         Reviewed by Saam Barati.
 293
 294         * stress/dfg-object-proto-accessor.js: Added.
 295         (shouldBe):
 296         (shouldThrow):
 297         (target):
 298         * stress/dfg-object-proto-getter.js: Added.
 299         (shouldBe):
 300         (shouldThrow):
 301         (target):
 302         * stress/dfg-object-prototype-of.js: Added.
 303         (shouldBe):
 304         (shouldThrow):
 305         (target):
 306         * stress/dfg-reflect-get-prototype-of.js: Added.
 307         (shouldBe):
 308         (shouldThrow):
 309         (target):
 310         * stress/object-get-prototype-of-filtered.js: Added.
 311         (shouldBe):
 312         (shouldThrow):
 313         (target):
 314         (i.Cocoa):
 315         * stress/object-get-prototype-of-mono-proto.js: Added.
 316         (shouldBe):
 317         (makePolyProtoObject.foo.C):
 318         (makePolyProtoObject.foo):
 319         (makePolyProtoObject):
 320         (target):
 321         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 322         (shouldBe):
 323         (makePolyProtoObject.foo.C):
 324         (makePolyProtoObject.foo):
 325         (makePolyProtoObject):
 326         (target):
 327         * stress/object-get-prototype-of-poly-proto.js: Added.
 328         (shouldBe):
 329         (makePolyProtoObject.foo.C):
 330         (makePolyProtoObject.foo):
 331         (makePolyProtoObject):
 332         (target):
 333         * stress/object-proto-getter-filtered.js: Added.
 334         (shouldBe):
 335         (shouldThrow):
 336         (target):
 337         (i.Cocoa):
 338         * stress/object-proto-getter-poly-mono-proto.js: Added.
 339         (shouldBe):
 340         (makePolyProtoObject.foo.C):
 341         (makePolyProtoObject.foo):
 342         (makePolyProtoObject):
 343         (target):
 344         * stress/object-proto-getter-poly-proto.js: Added.
 345         (shouldBe):
 346         (makePolyProtoObject.foo.C):
 347         (makePolyProtoObject.foo):
 348         (makePolyProtoObject):
 349         (target):
 350         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 351         * stress/string-proto.js: Added.
 352         (shouldBe):
 353         (target):
 354
 355 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 356
 357         Reland "Add Above/Below comparisons for UInt32 patterns"
 358         https://bugs.webkit.org/show_bug.cgi?id=177281
 359
 360         Reviewed by Saam Barati.
 361
 362         * stress/uint32-comparison-jump.js: Added.
 363         (shouldBe):
 364         (above):
 365         (aboveOrEqual):
 366         (below):
 367         (belowOrEqual):
 368         (notAbove):
 369         (notAboveOrEqual):
 370         (notBelow):
 371         (notBelowOrEqual):
 372         * stress/uint32-comparison.js: Added.
 373         (shouldBe):
 374         (above):
 375         (aboveOrEqual):
 376         (below):
 377         (belowOrEqual):
 378         (aboveTest):
 379         (aboveOrEqualTest):
 380         (belowTest):
 381         (belowOrEqualTest):
 382
 383 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
 384
 385         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
 386         https://bugs.webkit.org/show_bug.cgi?id=178210
 387
 388         Reviewed by Saam Barati.
 389
 390         * wasm/function-tests/trap-from-start-async.js:
 391         (async.StartTrapsAsync):
 392         * wasm/function-tests/trap-from-start.js:
 393         (StartTraps):
 394         * wasm/js-api/web-assembly-function.js:
 395         (assert.eq.Object.getPrototypeOf):
 396         * wasm/js-api/wrapper-function.js:
 397         (return.new.WebAssembly.Module):
 398         (assert.throws.makeInstance): Deleted.
 399         (assert.throws.Bar): Deleted.
 400         (assert.throws): Deleted.
 401
 402 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 403
 404         Enable gigacage on iOS
 405         https://bugs.webkit.org/show_bug.cgi?id=177586
 406
 407         Reviewed by JF Bastien.
 408
 409         Add tests for when Gigacage gets runtime disabled.
 410
 411         * stress/disable-gigacage-arrays.js: Added.
 412         (foo):
 413         * stress/disable-gigacage-strings.js: Added.
 414         (foo):
 415         * stress/disable-gigacage-typed-arrays.js: Added.
 416         (foo):
 417
 418 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 419
 420         import.meta should not be assignable
 421         https://bugs.webkit.org/show_bug.cgi?id=178202
 422
 423         Reviewed by Saam Barati.
 424
 425         * modules/import-meta-assignment.js: Added.
 426         (shouldThrow):
 427         (SyntaxError.import.meta.can.shouldThrow):
 428
 429 2017-10-11  Saam Barati  <sbarati@apple.com>
 430
 431         Unreviewed. Actually skip certain type profiler tests in debug.
 432
 433         * typeProfiler.yaml:
 434         * typeProfiler/deltablue-for-of.js:
 435         * typeProfiler/getter-richards.js:
 436
 437 2017-10-11  Commit Queue  <commit-queue@webkit.org>
 438
 439         Unreviewed, rolling out r223113 and r223121.
 440         https://bugs.webkit.org/show_bug.cgi?id=178182
 441
 442         Reintroduced 20% regression on Kraken (Requested by rniwa on
 443         #webkit).
 444
 445         Reverted changesets:
 446
 447         "Enable gigacage on iOS"
 448         https://bugs.webkit.org/show_bug.cgi?id=177586
 449         https://trac.webkit.org/changeset/223113
 450
 451         "Use one virtual allocation for all gigacages and their
 452         runways"
 453         https://bugs.webkit.org/show_bug.cgi?id=178050
 454         https://trac.webkit.org/changeset/223121
 455
 456 2017-10-11  Michael Saboff  <msaboff@apple.com>
 457
 458         Disable test262 named capture group tests with direct unicode names and with references before definitions
 459         https://bugs.webkit.org/show_bug.cgi?id=178177
 460
 461         Reviewed by Keith Miller.
 462
 463         Bugs to track fixing these test are:
 464         https://bugs.webkit.org/show_bug.cgi?id=178174 -
 465             "Add support in named capture group identifiers for direct surrogate pairs"
 466         https://bugs.webkit.org/show_bug.cgi?id=178175 -
 467             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
 468
 469         * test262.yaml:
 470
 471 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
 472
 473         Object properties are undefined in super.call() but not in this.call()
 474         https://bugs.webkit.org/show_bug.cgi?id=177230
 475
 476         Reviewed by Saam Barati.
 477
 478         * stress/super-call-function-subclass.js: Added.
 479         (assert):
 480         (A.prototype.t):
 481         (A):
 482         * stress/super-dot-call-and-apply.js: Added.
 483         (assert):
 484         (A):
 485         (A.prototype.call):
 486         (A.prototype.apply):
 487         (B.prototype.testSuper):
 488         (B):
 489         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
 490         (D.prototype.testSuper):
 491         (D):
 492
 493 2017-10-10  Saam Barati  <sbarati@apple.com>
 494
 495         The prototype cache should be aware of the Executable it generates a Structure for
 496         https://bugs.webkit.org/show_bug.cgi?id=177907
 497
 498         Reviewed by Filip Pizlo.
 499
 500         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
 501         (assert):
 502         (foo.C):
 503         (foo):
 504         (bar.C):
 505         (bar):
 506         (access):
 507         (makeLongChain):
 508         (accessY):
 509
 510 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
 511
 512         `async` should be able to be used as an imported binding name
 513         https://bugs.webkit.org/show_bug.cgi?id=176573
 514
 515         Reviewed by Saam Barati.
 516
 517         * modules/import-default-async.js: Added.
 518         * modules/import-named-async-as.js: Added.
 519         * modules/import-named-async.js: Added.
 520         * modules/import-named-async/target.js: Added.
 521         * modules/import-namespace-async.js: Added.
 522         * test262.yaml:
 523
 524 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 525
 526         Enable gigacage on iOS
 527         https://bugs.webkit.org/show_bug.cgi?id=177586
 528
 529         Reviewed by JF Bastien.
 530
 531         Add tests for when Gigacage gets runtime disabled.
 532
 533         * stress/disable-gigacage-arrays.js: Added.
 534         (foo):
 535         * stress/disable-gigacage-strings.js: Added.
 536         (foo):
 537         * stress/disable-gigacage-typed-arrays.js: Added.
 538         (foo):
 539
 540 2017-10-09  Michael Saboff  <msaboff@apple.com>
 541
 542         Implement RegExp Unicode property escapes
 543         https://bugs.webkit.org/show_bug.cgi?id=172069
 544
 545         Reviewed by JF Bastien.
 546
 547         Enabled Unicode Property tests.
 548
 549         * test262.yaml:
 550
 551 2017-10-09  Commit Queue  <commit-queue@webkit.org>
 552
 553         Unreviewed, rolling out r223015 and r223025.
 554         https://bugs.webkit.org/show_bug.cgi?id=178093
 555
 556         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
 557         #webkit).
 558
 559         Reverted changesets:
 560
 561         "Enable gigacage on iOS"
 562         https://bugs.webkit.org/show_bug.cgi?id=177586
 563         http://trac.webkit.org/changeset/223015
 564
 565         "Unreviewed, disable Gigacage on ARM64 Linux"
 566         https://bugs.webkit.org/show_bug.cgi?id=177586
 567         http://trac.webkit.org/changeset/223025
 568
 569 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 570
 571         Update expectations for test262 tests that pass after r223043.
 572         https://bugs.webkit.org/show_bug.cgi?id=176685
 573
 574         Unreviewed test gardening.
 575
 576         * test262.yaml:
 577
 578 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 579
 580         Unreviewed, rolling out r223022.
 581
 582         This change introduced 18 test262 failures.
 583
 584         Reverted changeset:
 585
 586         "`async` should be able to be used as an imported binding
 587         name"
 588         https://bugs.webkit.org/show_bug.cgi?id=176573
 589         http://trac.webkit.org/changeset/223022
 590
 591 2017-10-09  Saam Barati  <sbarati@apple.com>
 592
 593         3 poly-proto JSC tests timing out on debug after r222827
 594         https://bugs.webkit.org/show_bug.cgi?id=177880
 595         <rdar://problem/34817122>
 596
 597         Unreviewed.
 598
 599         I'm skipping these type profiler tests on debug since they are long running.
 600
 601         * typeProfiler/deltablue-for-of.js:
 602         * typeProfiler/getter-richards.js:
 603
 604 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
 605
 606         Safari 10 /11 problem with if (!await get(something)).
 607         https://bugs.webkit.org/show_bug.cgi?id=176685
 608
 609         Reviewed by Saam Barati.
 610
 611         * stress/async-await-basic.js:
 612         (awaitEpression.async):
 613         * stress/async-await-syntax.js:
 614         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
 615         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
 616
 617 2017-10-08  Saam Barati  <sbarati@apple.com>
 618
 619         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
 620
 621         * typeProfiler/deltablue-for-of.js:
 622         * typeProfiler/getter-richards.js:
 623
 624 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 625
 626         `async` should be able to be used as an imported binding name
 627         https://bugs.webkit.org/show_bug.cgi?id=176573
 628
 629         Reviewed by Darin Adler.
 630
 631         * modules/import-default-async.js: Added.
 632         * modules/import-named-async-as.js: Added.
 633         * modules/import-named-async.js: Added.
 634         * modules/import-named-async/target.js: Added.
 635         * modules/import-namespace-async.js: Added.
 636
 637 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 638
 639         Enable gigacage on iOS
 640         https://bugs.webkit.org/show_bug.cgi?id=177586
 641
 642         Reviewed by JF Bastien.
 643
 644         Add tests for when Gigacage gets runtime disabled.
 645
 646         * stress/disable-gigacage-arrays.js: Added.
 647         (foo):
 648         * stress/disable-gigacage-strings.js: Added.
 649         (foo):
 650         * stress/disable-gigacage-typed-arrays.js: Added.
 651         (foo):
 652
 653 2017-10-06  Commit Queue  <commit-queue@webkit.org>
 654
 655         Unreviewed, rolling out r222791 and r222873.
 656         https://bugs.webkit.org/show_bug.cgi?id=178031
 657
 658         Caused crashes with workers/wasm LayoutTests (Requested by
 659         ryanhaddad on #webkit).
 660
 661         Reverted changesets:
 662
 663         "WebAssembly: no VM / JS version of everything but Instance"
 664         https://bugs.webkit.org/show_bug.cgi?id=177473
 665         http://trac.webkit.org/changeset/222791
 666
 667         "WebAssembly: address no VM / JS follow-ups"
 668         https://bugs.webkit.org/show_bug.cgi?id=177887
 669         http://trac.webkit.org/changeset/222873
 670
 671 2017-10-05  Saam Barati  <sbarati@apple.com>
 672
 673         Make sure all prototypes under poly proto get added into the VM's prototype map
 674         https://bugs.webkit.org/show_bug.cgi?id=177909
 675
 676         Reviewed by Keith Miller.
 677
 678         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
 679         (assert):
 680         (foo.C):
 681         (foo):
 682         (set x):
 683
 684 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
 685
 686         [JSC] Introduce import.meta
 687         https://bugs.webkit.org/show_bug.cgi?id=177703
 688
 689         Reviewed by Filip Pizlo.
 690
 691         * modules/import-meta-syntax.js: Added.
 692         (shouldThrow):
 693         (shouldNotThrow):
 694         * modules/import-meta.js: Added.
 695         * modules/import-meta/cocoa.js: Added.
 696         * modules/resources/assert.js:
 697         (export.shouldNotThrow):
 698         * stress/import-syntax.js:
 699
 700 2017-10-04  Saam Barati  <sbarati@apple.com>
 701
 702         Make pertinent AccessCases watch the poly proto watchpoint
 703         https://bugs.webkit.org/show_bug.cgi?id=177765
 704
 705         Reviewed by Keith Miller.
 706
 707         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
 708         (assert):
 709         (foo.C):
 710         (foo):
 711         (validate):
 712         * stress/poly-proto-clear-stub.js: Added.
 713         (assert):
 714         (foo.C):
 715         (foo):
 716
 717 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
 718
 719         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
 720
 721         Unreviewed test gardening.
 722
 723         * test262.yaml:
 724
 725 2017-10-04  Saam Barati  <sbarati@apple.com>
 726
 727         3 poly-proto JSC tests timing out on debug after r222827
 728         https://bugs.webkit.org/show_bug.cgi?id=177880
 729
 730         Rubber stamped by Mark Lam.
 731
 732         * microbenchmarks/poly-proto-access.js:
 733         * typeProfiler/deltablue-for-of.js:
 734         * typeProfiler/getter-richards.js:
 735
 736 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
 737
 738         Unreviewed, marking tco-catch.js as a failure after test262 update
 739         https://bugs.webkit.org/show_bug.cgi?id=177859
 740
 741         * test262.yaml:
 742
 743 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 744
 745         Unreviewed, marking one async iterator test262 test failed
 746         https://bugs.webkit.org/show_bug.cgi?id=177859
 747
 748         * test262.yaml:
 749
 750 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
 751
 752         [Test262] Update Test262 to Oct 4 version
 753         https://bugs.webkit.org/show_bug.cgi?id=177859
 754
 755         Reviewed by Sam Weinig.
 756
 757         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
 758         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
 759
 760         * test262.yaml:
 761         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
 762         (checkSequence):
 763         * test262/harness/typeCoercion.js:
 764         (testCoercibleToIndexZero):
 765         (testCoercibleToIndexOne):
 766         (testCoercibleToIndexFromIndex):
 767         (testNotCoercibleToIndex.testPrimitiveValue):
 768         (testNotCoercibleToInteger):
 769         (testCoercibleToBigIntZero.testPrimitiveValue):
 770         (testCoercibleToBigIntZero):
 771         (testCoercibleToBigIntOne.testPrimitiveValue):
 772         (testCoercibleToBigIntOne):
 773         (testPrimitiveValue):
 774         (testCoercibleToBigIntFromBigInt):
 775         (testNotCoercibleToBigInt.testPrimitiveValue):
 776         (testNotCoercibleToBigInt.testStringValue):
 777         (testNotCoercibleToBigInt):
 778         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
 779         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
 780         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
 781         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
 782         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
 783         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
 784         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
 785         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
 786         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
 787         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
 788         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
 789         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
 790         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
 791         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
 792         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
 793         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
 794         (testCoercibleToBigIntZero):
 795         (testCoercibleToBigIntOne):
 796         (testNotCoercibleToBigInt):
 797         (MyError): Deleted.
 798         (valueOf): Deleted.
 799         (toString): Deleted.
 800         (Symbol.toPrimitive): Deleted.
 801         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
 802         (testCoercibleToIndexZero):
 803         (testCoercibleToIndexOne):
 804         (testNotCoercibleToIndex):
 805         (MyError): Deleted.
 806         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
 807         (assert.sameValue.BigInt.asIntN.toString): Deleted.
 808         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
 809         (BigInt.asIntN.valueOf): Deleted.
 810         (BigInt.asIntN.toString): Deleted.
 811         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
 812         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
 813         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
 814         (testCoercibleToBigIntZero):
 815         (testCoercibleToBigIntOne):
 816         (testNotCoercibleToBigInt):
 817         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
 818         (testCoercibleToIndexZero):
 819         (testCoercibleToIndexOne):
 820         (testNotCoercibleToIndex):
 821         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
 822         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
 823         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
 824         (bits.valueOf):
 825         (bigint.valueOf):
 826         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
 827         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
 828         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
 829         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
 830         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
 831         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
 832         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
 833         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
 834         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
 835         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
 836         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
 837         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
 838         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
 839         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
 840         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
 841         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
 842         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
 843         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
 844         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
 845         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
 846         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
 847         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
 848         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
 849         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
 850         (replacer):
 851         (BigInt.prototype.toJSON):
 852         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
 853         (replacer):
 854         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
 855         (BigInt.prototype.toJSON):
 856         * test262/test/built-ins/JSON/stringify/bigint.js:
 857         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
 858         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
 859         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
 860         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
 861         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
 862         * test262/test/built-ins/Object/proto-from-ctor.js:
 863         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
 864         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
 865         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
 866         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
 867         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
 868         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
 869         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
 870         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
 871         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
 872         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
 873         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
 874         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
 875         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
 876         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
 877         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
 878         * test262/test/built-ins/Proxy/get-fn-realm.js:
 879         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
 880         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
 881         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
 882         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
 883         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
 884         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
 885         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
 886         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
 887         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
 888         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
 889         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
 890         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
 891         (i6.replace):
 892         (i6b.replace):
 893         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
 894         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
 895         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
 896         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
 897         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
 898         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
 899         * test262/test/built-ins/RegExp/u180e.js: Added.
 900         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
 901         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
 902         * test262/test/built-ins/String/proto-from-ctor-realm.js:
 903         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
 904         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
 905         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
 906         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
 907         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
 908         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
 909         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
 910         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
 911         * test262/test/built-ins/String/prototype/endsWith/length.js:
 912         * test262/test/built-ins/String/prototype/endsWith/name.js:
 913         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
 914         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
 915         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
 916         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
 917         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
 918         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
 919         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
 920         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
 921         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
 922         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
 923         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
 924         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
 925         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
 926         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
 927         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
 928         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
 929         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
 930         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
 931         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
 932         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
 933         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
 934         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
 935         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
 936         * test262/test/built-ins/String/prototype/includes/includes.js:
 937         * test262/test/built-ins/String/prototype/includes/length.js:
 938         * test262/test/built-ins/String/prototype/includes/name.js:
 939         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
 940         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
 941         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
 942         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
 943         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
 944         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
 945         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
 946         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
 947         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
 948         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
 949         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
 950         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
 951         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
 952         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
 953         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
 954         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
 955         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
 956         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
 957         * test262/test/built-ins/String/prototype/trim/u180e.js:
 958         * test262/test/built-ins/Symbol/for/cross-realm.js:
 959         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
 960         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
 961         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
 962         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
 963         * test262/test/built-ins/Symbol/match/cross-realm.js:
 964         * test262/test/built-ins/Symbol/replace/cross-realm.js:
 965         * test262/test/built-ins/Symbol/search/cross-realm.js:
 966         * test262/test/built-ins/Symbol/species/cross-realm.js:
 967         * test262/test/built-ins/Symbol/split/cross-realm.js:
 968         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
 969         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
 970         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
 971         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
 972         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
 973         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
 974         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
 975         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
 976         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
 977         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
 978         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
 979         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
 980         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
 981         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
 982         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
 983         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
 984         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
 985         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
 986         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
 987         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
 988         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
 989         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
 990         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
 991         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
 992         * test262/test/language/comments/mongolian-vowel-separator-single.js:
 993         * test262/test/language/eval-code/indirect/realm.js:
 994         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
 995         (o.get z):
 996         (o.get a):
 997         * test262/test/language/expressions/call/eval-realm-indirect.js:
 998         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
 999         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1000         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1001         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1002         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1003         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1004         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1005         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1006         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1007         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1008         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1009         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1010         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1011         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1012         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1013         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1014         * test262/test/language/expressions/less-than/bigint-and-number.js:
1015         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1016         * test262/test/language/expressions/super/realm.js:
1017         * test262/test/language/expressions/tagged-template/cache-realm.js:
1018         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1019         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1020         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1021         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1022         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1023         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1024         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1025         (o.get z):
1026         (o.get a):
1027         * test262/test/language/statements/for-of/iterator-next-reference.js:
1028         (next):
1029         (iterator.next): Deleted.
1030         (x.of.iterable.): Deleted.
1031         (x.of.iterable.get return): Deleted.
1032         (x.of.iterable.iterator.next): Deleted.
1033         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1034         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1035         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1036         * test262/test/language/white-space/mongolian-vowel-separator.js:
1037         * test262/test262-Revision.txt:
1038
1039 2017-10-03  Saam Barati  <sbarati@apple.com>
1040
1041         Implement polymorphic prototypes
1042         https://bugs.webkit.org/show_bug.cgi?id=176391
1043
1044         Reviewed by Filip Pizlo.
1045
1046         * microbenchmarks/poly-proto-access.js: Added.
1047         (assert):
1048         (foo.C):
1049         (foo.C.prototype.get bar):
1050         (foo):
1051         (bar):
1052         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1053         (assert):
1054         (makePolyProtoObject.foo.C):
1055         (makePolyProtoObject.foo):
1056         (makePolyProtoObject):
1057         (performSet):
1058         * microbenchmarks/poly-proto-setter-speed.js: Added.
1059         (assert):
1060         (makePolyProtoObject.foo.C):
1061         (makePolyProtoObject.foo.C.prototype.set p):
1062         (makePolyProtoObject.foo):
1063         (makePolyProtoObject):
1064         (performSet):
1065         * stress/constructor-with-return.js:
1066         (i.tests.forEach.Constructor):
1067         (i.tests.forEach):
1068         (tests.forEach.Constructor): Deleted.
1069         (tests.forEach): Deleted.
1070         * stress/dom-jit-with-poly-proto.js: Added.
1071         (assert):
1072         (makePolyProtoObject.foo.C):
1073         (makePolyProtoObject.foo):
1074         (makePolyProtoObject):
1075         (validate):
1076         * stress/poly-proto-custom-value-and-accessor.js: Added.
1077         (assert):
1078         (makePolyProtoObject.foo.C):
1079         (makePolyProtoObject.foo):
1080         (makePolyProtoObject):
1081         (items.forEach):
1082         (set get for):
1083         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1084         (assert):
1085         (makePolyProtoObject.foo.C):
1086         (makePolyProtoObject.foo):
1087         (makePolyProtoObject):
1088         (foo):
1089         * stress/poly-proto-miss.js: Added.
1090         (makePolyProtoInstanceWithNullPrototype.foo.C):
1091         (makePolyProtoInstanceWithNullPrototype.foo):
1092         (makePolyProtoInstanceWithNullPrototype):
1093         (assert):
1094         (validate):
1095         * stress/poly-proto-op-in-caching.js: Added.
1096         (assert):
1097         (makePolyProtoObject.foo.C):
1098         (makePolyProtoObject.foo):
1099         (makePolyProtoObject):
1100         (validate):
1101         (validate2):
1102         * stress/poly-proto-put-transition.js: Added.
1103         (assert):
1104         (makePolyProtoObject.foo.C):
1105         (makePolyProtoObject.foo):
1106         (makePolyProtoObject):
1107         (performSet):
1108         (i.obj.__proto__.set p):
1109         * stress/poly-proto-set-prototype.js: Added.
1110         (assert):
1111         (let.alternateProto.get x):
1112         (let.alternateProto2.get y):
1113         (let.alternateProto2.get x):
1114         (foo.C):
1115         (foo):
1116         (validate):
1117         * stress/poly-proto-setter.js: Added.
1118         (assert):
1119         (makePolyProtoObject.foo.C):
1120         (makePolyProtoObject.foo.C.prototype.set p):
1121         (makePolyProtoObject.foo.C.prototype.get p):
1122         (makePolyProtoObject.foo):
1123         (makePolyProtoObject):
1124         (performSet):
1125         * stress/poly-proto-using-inheritance.js: Added.
1126         (assert):
1127         (foo.C):
1128         (foo.C.prototype.get baz):
1129         (foo):
1130         (bar.C):
1131         (bar):
1132         (validate):
1133         * stress/primitive-poly-proto.js: Added.
1134         (makePolyProtoInstance.foo.C):
1135         (makePolyProtoInstance.foo):
1136         (makePolyProtoInstance):
1137         (assert):
1138         (validate):
1139         * stress/prototype-is-not-js-object.js: Added.
1140         (foo.bar):
1141         (foo):
1142         (assert):
1143         (validate):
1144         * stress/try-get-by-id-poly-proto.js: Added.
1145         (assert):
1146         (makePolyProtoObject.foo.C):
1147         (makePolyProtoObject.foo):
1148         (makePolyProtoObject):
1149         (tryGetByIdText):
1150         (x.__proto__.get bar):
1151         (validate):
1152         * typeProfiler/overflow.js:
1153
1154 2017-10-03  JF Bastien  <jfbastien@apple.com>
1155
1156         WebAssembly: no VM / JS version of everything but Instance
1157         https://bugs.webkit.org/show_bug.cgi?id=177473
1158
1159         Reviewed by Filip Pizlo.
1160
1161         - Exceeding max on memory growth now returns a range error as per
1162         spec. This is a (very minor) breaking change: it used to throw OOM
1163         error. Update the corresponding test.
1164
1165         * wasm/js-api/memory-grow.js:
1166         (assertEq):
1167         * wasm/js-api/table.js:
1168         (assert.throws):
1169
1170 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1171
1172         Skip JSC test stress/regress-159779-2.js on debug.
1173         https://bugs.webkit.org/show_bug.cgi?id=177204
1174
1175         Unreviewed test gardening.
1176
1177         * stress/regress-159779-2.js:
1178
1179 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1180
1181         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1182         https://bugs.webkit.org/show_bug.cgi?id=175642
1183
1184         Reviewed by Darin Adler.
1185
1186         * ChakraCore/test/Function/apply3.baseline-jsc:
1187
1188 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1189
1190         Unreviewed, rolling out r222564.
1191         https://bugs.webkit.org/show_bug.cgi?id=177720
1192
1193         "It regressed JetStream by 2% on iOS caused by a 50%
1194         regression on the bigfib subtest" (Requested by saamyjoon on
1195         #webkit).
1196
1197         Reverted changeset:
1198
1199         "Add Above/Below comparisons for UInt32 patterns"
1200         https://bugs.webkit.org/show_bug.cgi?id=177281
1201         http://trac.webkit.org/changeset/222564
1202
1203 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1204
1205         [DFG] Support ArrayPush with multiple args
1206         https://bugs.webkit.org/show_bug.cgi?id=175823
1207
1208         Reviewed by Saam Barati.
1209
1210         * microbenchmarks/array-push-0.js: Added.
1211         (arrayPush0):
1212         * microbenchmarks/array-push-1.js: Added.
1213         (arrayPush1):
1214         * microbenchmarks/array-push-2.js: Added.
1215         (arrayPush2):
1216         * microbenchmarks/array-push-3.js: Added.
1217         (arrayPush3):
1218         * stress/array-push-multiple-contiguous.js: Added.
1219         (shouldBe):
1220         (test):
1221         * stress/array-push-multiple-double-nan.js: Added.
1222         (shouldBe):
1223         (test):
1224         * stress/array-push-multiple-double.js: Added.
1225         (shouldBe):
1226         (test):
1227         * stress/array-push-multiple-int32.js: Added.
1228         (shouldBe):
1229         (test):
1230         * stress/array-push-multiple-many-contiguous.js: Added.
1231         (shouldBe):
1232         (test):
1233         * stress/array-push-multiple-many-double.js: Added.
1234         (shouldBe):
1235         (test):
1236         * stress/array-push-multiple-many-int32.js: Added.
1237         (shouldBe):
1238         (test):
1239         * stress/array-push-multiple-many-storage.js: Added.
1240         (shouldBe):
1241         (test):
1242         * stress/array-push-multiple-storage.js: Added.
1243         (shouldBe):
1244         (test):
1245         * stress/array-push-with-force-exit.js: Added.
1246         (target.createBuiltin):
1247
1248 2017-09-29  Saam Barati  <sbarati@apple.com>
1249
1250         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1251         https://bugs.webkit.org/show_bug.cgi?id=177639
1252
1253         Reviewed by Geoffrey Garen.
1254
1255         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1256         (assert):
1257         (Class):
1258         (items.forEach):
1259         (set get for):
1260
1261 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1262
1263         Unreviewed, rolling out r222563, r222565, and r222581.
1264         https://bugs.webkit.org/show_bug.cgi?id=177675
1265
1266         "It causes a crash when playing youtube videos" (Requested by
1267         saamyjoon on #webkit).
1268
1269         Reverted changesets:
1270
1271         "[DFG] Support ArrayPush with multiple args"
1272         https://bugs.webkit.org/show_bug.cgi?id=175823
1273         http://trac.webkit.org/changeset/222563
1274
1275         "Unreviewed, build fix after r222563"
1276         https://bugs.webkit.org/show_bug.cgi?id=175823
1277         http://trac.webkit.org/changeset/222565
1278
1279         "Unreviewed, fix x86 breaking due to exhausted registers"
1280         https://bugs.webkit.org/show_bug.cgi?id=175823
1281         http://trac.webkit.org/changeset/222581
1282
1283 2017-09-28  Mark Lam  <mark.lam@apple.com>
1284
1285         test262: Unexpected passes after r222617 and r222618.
1286         https://bugs.webkit.org/show_bug.cgi?id=177622
1287         <rdar://problem/34725960>
1288
1289         Reviewed by Saam Barati.
1290
1291         Update test262.yaml for tests that are now passing.
1292
1293         * test262.yaml:
1294
1295 2017-09-27  Michael Saboff  <msaboff@apple.com>
1296
1297         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1298         https://bugs.webkit.org/show_bug.cgi?id=177570
1299
1300         Reviewed by Filip Pizlo.
1301
1302         New regression test.
1303
1304         * stress/regress-177570.js: Added.
1305
1306 2017-09-28  Michael Saboff  <msaboff@apple.com>
1307
1308         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1309         https://bugs.webkit.org/show_bug.cgi?id=177423
1310
1311         Reviewed by Mark Lam.
1312
1313         Updated regression test.
1314
1315         * stress/regress-177423.js:
1316         (catch):
1317
1318 2017-09-27  Mark Lam  <mark.lam@apple.com>
1319
1320         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1321         https://bugs.webkit.org/show_bug.cgi?id=177584
1322         <rdar://problem/34463903>
1323
1324         Reviewed by Saam Barati.
1325
1326         * stress/regress-177584.js: Added.
1327         (assertEqual):
1328         (Array.prototype.Symbol.species):
1329
1330 2017-09-27  Saam Barati  <sbarati@apple.com>
1331
1332         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1333         https://bugs.webkit.org/show_bug.cgi?id=177523
1334
1335         Reviewed by Mark Lam.
1336
1337         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1338         (assert):
1339         (Test):
1340         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1341         (addMethods):
1342         (i.Test.prototype.propName):
1343
1344 2017-09-27  Mark Lam  <mark.lam@apple.com>
1345
1346         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1347         https://bugs.webkit.org/show_bug.cgi?id=177423
1348         <rdar://problem/34621320>
1349
1350         Reviewed by Keith Miller.
1351
1352         * stress/regress-177423.js: Added.
1353
1354 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1355
1356         Add Above/Below comparisons for UInt32 patterns
1357         https://bugs.webkit.org/show_bug.cgi?id=177281
1358
1359         Reviewed by Saam Barati.
1360
1361         * stress/uint32-comparison-jump.js: Added.
1362         (shouldBe):
1363         (above):
1364         (aboveOrEqual):
1365         (below):
1366         (belowOrEqual):
1367         (notAbove):
1368         (notAboveOrEqual):
1369         (notBelow):
1370         (notBelowOrEqual):
1371         * stress/uint32-comparison.js: Added.
1372         (shouldBe):
1373         (above):
1374         (aboveOrEqual):
1375         (below):
1376         (belowOrEqual):
1377         (aboveTest):
1378         (aboveOrEqualTest):
1379         (belowTest):
1380         (belowOrEqualTest):
1381
1382 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1383
1384         [DFG] Support ArrayPush with multiple args
1385         https://bugs.webkit.org/show_bug.cgi?id=175823
1386
1387         Reviewed by Saam Barati.
1388
1389         * microbenchmarks/array-push-0.js: Added.
1390         (arrayPush0):
1391         * microbenchmarks/array-push-1.js: Added.
1392         (arrayPush1):
1393         * microbenchmarks/array-push-2.js: Added.
1394         (arrayPush2):
1395         * microbenchmarks/array-push-3.js: Added.
1396         (arrayPush3):
1397         * stress/array-push-multiple-contiguous.js: Added.
1398         (shouldBe):
1399         (test):
1400         * stress/array-push-multiple-double-nan.js: Added.
1401         (shouldBe):
1402         (test):
1403         * stress/array-push-multiple-double.js: Added.
1404         (shouldBe):
1405         (test):
1406         * stress/array-push-multiple-int32.js: Added.
1407         (shouldBe):
1408         (test):
1409         * stress/array-push-multiple-many-contiguous.js: Added.
1410         (shouldBe):
1411         (test):
1412         * stress/array-push-multiple-many-double.js: Added.
1413         (shouldBe):
1414         (test):
1415         * stress/array-push-multiple-many-int32.js: Added.
1416         (shouldBe):
1417         (test):
1418         * stress/array-push-multiple-many-storage.js: Added.
1419         (shouldBe):
1420         (test):
1421         * stress/array-push-multiple-storage.js: Added.
1422         (shouldBe):
1423         (test):
1424
1425 2017-09-26  Commit Queue  <commit-queue@webkit.org>
1426
1427         Unreviewed, rolling out r222518.
1428         https://bugs.webkit.org/show_bug.cgi?id=177507
1429
1430         Break the High Sierra build (Requested by yusukesuzuki on
1431         #webkit).
1432
1433         Reverted changeset:
1434
1435         "Add Above/Below comparisons for UInt32 patterns"
1436         https://bugs.webkit.org/show_bug.cgi?id=177281
1437         http://trac.webkit.org/changeset/222518
1438
1439 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1440
1441         Add Above/Below comparisons for UInt32 patterns
1442         https://bugs.webkit.org/show_bug.cgi?id=177281
1443
1444         Reviewed by Saam Barati.
1445
1446         * stress/uint32-comparison-jump.js: Added.
1447         (shouldBe):
1448         (above):
1449         (aboveOrEqual):
1450         (below):
1451         (belowOrEqual):
1452         (notAbove):
1453         (notAboveOrEqual):
1454         (notBelow):
1455         (notBelowOrEqual):
1456         * stress/uint32-comparison.js: Added.
1457         (shouldBe):
1458         (above):
1459         (aboveOrEqual):
1460         (below):
1461         (belowOrEqual):
1462         (aboveTest):
1463         (aboveOrEqualTest):
1464         (belowTest):
1465         (belowOrEqualTest):
1466
1467 2017-09-23  Keith Miller  <keith_miller@apple.com>
1468
1469         Fix infinite looping test262 test
1470         https://bugs.webkit.org/show_bug.cgi?id=177412
1471
1472         Reviewed by Yusuke Suzuki.
1473
1474         This test was poorly designed since failing it would cause the vm
1475         to inifinite loop. I've fixed it locally and will fix it on github pending
1476         the results of next weeks tc39 meeting.
1477
1478         * test262.yaml:
1479         * test262/test/language/statements/for-of/iterator-next-reference.js:
1480
1481 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
1482
1483         test262: $.agent became $262.agent in test262 update
1484         https://bugs.webkit.org/show_bug.cgi?id=177407
1485
1486         Reviewed by Yusuke Suzuki.
1487
1488         * test262.yaml:
1489         ~320 tests pass now that we correctly make $262 available.
1490
1491 2017-09-22  Keith Miller  <keith_miller@apple.com>
1492
1493         Speculatively change iteration protocall to use the same next function
1494         https://bugs.webkit.org/show_bug.cgi?id=175653
1495
1496         Reviewed by Saam Barati.
1497
1498         Change test to match the new iteration behavior.
1499
1500         * stress/spread-optimized-properly.js:
1501
1502 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1503
1504         [DFG][FTL] Profile array vector length for array allocation
1505         https://bugs.webkit.org/show_bug.cgi?id=177051
1506
1507         Reviewed by Saam Barati.
1508
1509         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1510         (target):
1511
1512 2017-09-22  Commit Queue  <commit-queue@webkit.org>
1513
1514         Unreviewed, rolling out r222380.
1515         https://bugs.webkit.org/show_bug.cgi?id=177352
1516
1517         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
1518         #webkit).
1519
1520         Reverted changeset:
1521
1522         "[DFG][FTL] Profile array vector length for array allocation"
1523         https://bugs.webkit.org/show_bug.cgi?id=177051
1524         http://trac.webkit.org/changeset/222380
1525
1526 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1527
1528         [DFG][FTL] Profile array vector length for array allocation
1529         https://bugs.webkit.org/show_bug.cgi?id=177051
1530
1531         Reviewed by Saam Barati.
1532
1533         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1534         (target):
1535
1536 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
1537
1538         Skip new hanging test262 tests.
1539         https://bugs.webkit.org/show_bug.cgi?id=177326
1540
1541         Unreviewed test gardening.
1542
1543         * test262.yaml:
1544
1545 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
1546
1547         Mark 6 test262 tests as passing.
1548         https://bugs.webkit.org/show_bug.cgi?id=177307
1549
1550         Unreviewed test gardening.
1551
1552         * test262.yaml:
1553
1554 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1555
1556         Unreviewed follow-up to r222311.
1557
1558         * test262/harness/sta.js:
1559         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
1560         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
1561         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
1562         * test262/test/built-ins/Array/from/elements-added-after.js:
1563         * test262/test/built-ins/Array/from/elements-deleted-after.js:
1564         * test262/test/built-ins/Array/from/elements-updated-after.js:
1565         * test262/test/built-ins/Array/from/from-array.js:
1566         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
1567         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
1568         * test262/test/built-ins/Array/from/source-array-boundary.js:
1569         * test262/test/built-ins/Array/from/source-object-constructor.js:
1570         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
1571         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
1572         * test262/test/built-ins/Array/from/source-object-length.js:
1573         * test262/test/built-ins/Array/from/source-object-missing.js:
1574         * test262/test/built-ins/Array/from/source-object-without.js:
1575         * test262/test/built-ins/Array/from/this-null.js:
1576         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1577         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
1578         * test262/test/language/literals/numeric/7.8.3-1gs.js:
1579         * test262/test/language/literals/numeric/7.8.3-2gs.js:
1580         * test262/test/language/literals/numeric/7.8.3-3gs.js:
1581         * test262/test/language/literals/regexp/7.8.5-1gs.js:
1582         * test262/test/language/literals/string/7.8.4-1gs.js:
1583         Fix some files that I failed to update when I applied my patch.
1584
1585 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1586
1587         Update test262 tests
1588         https://bugs.webkit.org/show_bug.cgi?id=177220
1589
1590         Reviewed by Saam Barati and Yusuke Suzuki.
1591
1592         * test262.yaml:
1593         * test262/test262-Revision.txt:
1594         New rebaselined expectations for all tests.
1595
1596         * test262/*:
1597         Updated.
1598
1599 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1600
1601         [DFG] Remove ToThis more aggressively
1602         https://bugs.webkit.org/show_bug.cgi?id=177056
1603
1604         Reviewed by Saam Barati.
1605
1606         * stress/generator-with-this-strict.js: Added.
1607         (shouldBe):
1608         (generator):
1609         (target):
1610         * stress/generator-with-this.js: Added.
1611         (shouldBe):
1612         (generator):
1613         (target):
1614
1615 2017-09-17  Michael Saboff  <msaboff@apple.com>
1616
1617         https://bugs.webkit.org/show_bug.cgi?id=177038
1618         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
1619
1620         Reviewed by JF Bastien.
1621
1622         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
1623         as it dies using too much memory.
1624
1625 2017-09-15  Saam Barati  <sbarati@apple.com>
1626
1627         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
1628         https://bugs.webkit.org/show_bug.cgi?id=176981
1629
1630         Reviewed by Yusuke Suzuki.
1631
1632         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
1633         (assert):
1634         (verify):
1635         (func):
1636         (const.bar.createBuiltin):
1637
1638 2017-09-14  Saam Barati  <sbarati@apple.com>
1639
1640         It should be valid to exit before each set when doing arity fixup when inlining
1641         https://bugs.webkit.org/show_bug.cgi?id=176948
1642
1643         Reviewed by Keith Miller.
1644
1645         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
1646         (baz):
1647         (bar):
1648         (foo):
1649
1650 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1651
1652         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
1653         https://bugs.webkit.org/show_bug.cgi?id=176867
1654
1655         Reviewed by Sam Weinig.
1656
1657         * microbenchmarks/object-get-own-property-symbols.js: Added.
1658         (test):
1659
1660 2017-09-13  Mark Lam  <mark.lam@apple.com>
1661
1662         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
1663         https://bugs.webkit.org/show_bug.cgi?id=176888
1664         <rdar://problem/34381832>
1665
1666         Not reviewed.
1667
1668         * stress/op_mod-ConstVar.js:
1669         * stress/op_mod-VarConst.js:
1670         * stress/op_mod-VarVar.js:
1671
1672 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
1673
1674         Skip 3 op_mod tests on Debug JSC bots.
1675         https://bugs.webkit.org/show_bug.cgi?id=176630
1676
1677         Unreviewed test gardening.
1678
1679         * stress/op_mod-ConstVar.js:
1680         * stress/op_mod-VarConst.js:
1681         * stress/op_mod-VarVar.js:
1682
1683 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1684
1685         [JSC] Fix Array allocation in Object.keys
1686         https://bugs.webkit.org/show_bug.cgi?id=176826
1687
1688         Reviewed by Saam Barati.
1689
1690         * stress/object-own-property-keys.js: Added.
1691         (shouldBe):
1692
1693 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
1694
1695         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1696         https://bugs.webkit.org/show_bug.cgi?id=176010
1697
1698         Reviewed by Filip Pizlo.
1699
1700         * microbenchmarks/weak-map-key.js: Added.
1701         (assert):
1702         (objectKey):
1703         (let.start.Date.now):
1704
1705 2017-09-12  Mark Lam  <mark.lam@apple.com>
1706
1707         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
1708         https://bugs.webkit.org/show_bug.cgi?id=176630
1709
1710         Reviewed by JF Bastien.
1711
1712         Debug builds are just slow, and these tests do a lot.  They pass when I run them
1713         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
1714         a speculative fix for the bots that are seeing these fail.
1715
1716         I also undid the skipping of the op_mod tests for debug builds.
1717
1718         * stress/op_div-ConstVar.js:
1719         * stress/op_div-VarConst.js:
1720         * stress/op_div-VarVar.js:
1721         * stress/op_mod-ConstVar.js:
1722         * stress/op_mod-VarConst.js:
1723         * stress/op_mod-VarVar.js:
1724
1725 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
1726
1727         Skip stress/value-to-boolean.js on Debug bots.
1728         https://bugs.webkit.org/show_bug.cgi?id=176787
1729
1730         Unreviewed test gardening.
1731
1732         * stress/value-to-boolean.js:
1733
1734 2017-09-11  Mark Lam  <mark.lam@apple.com>
1735
1736         Change test expectation for test262/test/language/statements/try/tco-catch.js
1737         https://bugs.webkit.org/show_bug.cgi?id=176749
1738
1739         Rubber stamped by Keith Miller.
1740
1741         It's been failing since at least r221821.  I'm changing the test expectation to
1742         fail to green the bots while I investigate some more.
1743
1744         * test262.yaml:
1745
1746 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
1747
1748         Unreviewed, rolling out r221854.
1749
1750         The test added with this change fails on 32-bit JSC bots.
1751
1752         Reverted changeset:
1753
1754         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
1755         https://bugs.webkit.org/show_bug.cgi?id=176010
1756         http://trac.webkit.org/changeset/221854
1757
1758 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1759
1760         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
1761         https://bugs.webkit.org/show_bug.cgi?id=176010
1762
1763         Reviewed by Filip Pizlo.
1764
1765         * microbenchmarks/weak-map-key.js: Added.
1766         (assert):
1767         (objectKey):
1768         (let.start.Date.now):
1769
1770 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1771
1772         [JSC] Optimize Object.keys by using careful array allocation
1773         https://bugs.webkit.org/show_bug.cgi?id=176654
1774
1775         Reviewed by Darin Adler.
1776
1777         * microbenchmarks/object-keys.js: Added.
1778         (test):
1779
1780 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
1781
1782         Error should compute .stack and friends lazily
1783         https://bugs.webkit.org/show_bug.cgi?id=176645
1784
1785         Reviewed by Saam Barati.
1786
1787         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
1788         * microbenchmarks/new-error.js: Added.
1789         * microbenchmarks/throw.js: Added.
1790
1791 2017-09-09  Mark Lam  <mark.lam@apple.com>
1792
1793         [Re-landing] Use JIT probes for DFG OSR exit.
1794         https://bugs.webkit.org/show_bug.cgi?id=175144
1795         <rdar://problem/33437050>
1796
1797         Not reviewed.  Original patch reviewed by Saam Barati.
1798
1799         Disable these tests for debug builds because they run too slow with the new OSR exit.
1800
1801         * stress/op_mod-ConstVar.js:
1802         * stress/op_mod-VarConst.js:
1803         * stress/op_mod-VarVar.js:
1804
1805 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1806
1807         [DFG] NewArrayWithSize(size)'s size does not care negative zero
1808         https://bugs.webkit.org/show_bug.cgi?id=176300
1809
1810         Reviewed by Saam Barati.
1811
1812         * stress/new-array-with-size-div.js: Added.
1813         (shouldBe):
1814         (test):
1815         (i.i):
1816
1817 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1818
1819         [DFG] PutByVal with Array::Generic is too generic
1820         https://bugs.webkit.org/show_bug.cgi?id=176345
1821
1822         Reviewed by Filip Pizlo.
1823
1824         * stress/object-assign-symbols.js: Added.
1825         (shouldBe):
1826         (test):
1827         * stress/object-assign.js: Added.
1828         (shouldBe):
1829         (test):
1830         (i.shouldBe.JSON.stringify.test):
1831
1832 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1833
1834         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
1835         https://bugs.webkit.org/show_bug.cgi?id=176590
1836
1837         Reviewed by Saam Barati.
1838
1839         * microbenchmarks/object-iterate-symbols.js: Added.
1840         (test):
1841         * microbenchmarks/object-iterate.js: Added.
1842         (test):
1843         * stress/object-iterate-symbols.js: Added.
1844         (shouldBe):
1845         (test):
1846         * stress/object-iterate.js: Added.
1847         (shouldBe):
1848         (test):
1849
1850 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
1851
1852         [Win32] 10 JSC stress tests are failing.
1853         https://bugs.webkit.org/show_bug.cgi?id=176538
1854
1855         Reviewed by Mark Lam.
1856
1857         Skip tests on Windows to make the bots green.
1858
1859         * ChakraCore.yaml:
1860         * stress/date-relaxed.js:
1861
1862 2017-09-06  Mark Lam  <mark.lam@apple.com>
1863
1864         constructGenericTypedArrayViewWithArguments() is missing an exception check.
1865         https://bugs.webkit.org/show_bug.cgi?id=176485
1866         <rdar://problem/33898874>
1867
1868         Reviewed by Keith Miller.
1869
1870         * stress/regress-176485.js: Added.
1871
1872 2017-09-05  Saam Barati  <sbarati@apple.com>
1873
1874         isNotCellSpeculation is wrong with respect to SpecEmpty
1875         https://bugs.webkit.org/show_bug.cgi?id=176429
1876
1877         Reviewed by Michael Saboff.
1878
1879         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
1880         (Foo):
1881
1882 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
1883
1884         test262: Completion values for control flow do not match the spec
1885         https://bugs.webkit.org/show_bug.cgi?id=171265
1886
1887         Reviewed by Saam Barati.
1888
1889         * stress/completion-value.js:
1890         Condensed test for completion values in top level statements.
1891
1892         * stress/super-get-by-id.js:
1893         ClassDeclaration when evaled no longer produce values. Convert
1894         these to ClassExpressions so they produce the class value.
1895
1896         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1897         This is a progression for currect spec behavior.
1898
1899         * mozilla/mozilla-tests.yaml:
1900         This test is now outdated, so mark it as failing for that reason.
1901
1902         * test262.yaml:
1903         Passing all "cptn" completion value tests.
1904
1905 2017-09-04  Saam Barati  <sbarati@apple.com>
1906
1907         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
1908         https://bugs.webkit.org/show_bug.cgi?id=176317
1909
1910         Reviewed by Keith Miller.
1911
1912         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
1913         (Foo):
1914
1915 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1916
1917         [DFG][FTL] Efficiently execute number#toString()
1918         https://bugs.webkit.org/show_bug.cgi?id=170007
1919
1920         Reviewed by Keith Miller.
1921
1922         * microbenchmarks/number-to-string-strength-reduction.js: Added.
1923         (test):
1924         * microbenchmarks/number-to-string-with-radix-10.js: Added.
1925         (test):
1926         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
1927         (test):
1928         * microbenchmarks/number-to-string-with-radix.js: Added.
1929         (test):
1930         * stress/number-to-string-strength-reduction.js: Added.
1931         (shouldBe):
1932         (test):
1933         * stress/number-to-string-with-radix-10.js: Added.
1934         (shouldBe):
1935         (test):
1936         * stress/number-to-string-with-radix-cse.js: Added.
1937         (shouldBe):
1938         (test):
1939         * stress/number-to-string-with-radix-invalid.js: Added.
1940         (shouldThrow):
1941         * stress/number-to-string-with-radix-watchpoint.js: Added.
1942         (shouldBe):
1943         (test):
1944         (i.i.1e3.Number.prototype.toString):
1945         * stress/number-to-string-with-radix.js: Added.
1946         (shouldBe):
1947         (test):
1948
1949 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1950
1951         [DFG] Relax arity requirement
1952         https://bugs.webkit.org/show_bug.cgi?id=175523
1953
1954         Reviewed by Saam Barati.
1955
1956         * stress/arity-mismatch-arguments-length.js: Added.
1957         (shouldBe):
1958         (test1):
1959         (test):
1960         * stress/arity-mismatch-get-argument.js: Added.
1961         (shouldBe):
1962         (builtin.createBuiltin):
1963         (test):
1964         * stress/arity-mismatch-inlining-extra-slots.js: Added.
1965         (shouldBe):
1966         (inlineTarget):
1967         (test):
1968         * stress/arity-mismatch-inlining.js: Added.
1969         (shouldBe):
1970         (inlineTarget):
1971         (test):
1972         * stress/arity-mismatch-rest.js: Added.
1973         (shouldBe):
1974         (test2):
1975         (test1):
1976         (test):
1977
1978 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1979
1980         [JSC] Fix "name" and "length" of Proxy revoke function
1981         https://bugs.webkit.org/show_bug.cgi?id=176155
1982
1983         Reviewed by Mark Lam.
1984
1985         * test262.yaml:
1986
1987 2017-08-31  Saam Barati  <sbarati@apple.com>
1988
1989         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
1990         https://bugs.webkit.org/show_bug.cgi?id=176206
1991
1992         Reviewed by Keith Miller.
1993
1994         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
1995         (a):
1996         (b):
1997         (foo):
1998
1999 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2000
2001         Skip two slow JSC tests after r221422.
2002
2003         Unreviewed test gardening.
2004
2005         * stress/regexp-prototype-match-on-too-long-rope.js:
2006         * stress/regexp-prototype-test-on-too-long-rope.js:
2007
2008 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2009
2010         Unreviewed, skipping slow tests.
2011
2012         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2013         work differently now.
2014
2015         * stress/regexp-prototype-exec-on-too-long-rope.js:
2016         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2017
2018 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2019
2020         [JSC] Use reifying system for "name" property of builtin JSFunction
2021         https://bugs.webkit.org/show_bug.cgi?id=175260
2022
2023         Reviewed by Saam Barati.
2024
2025         * stress/accessors-get-set-prefix.js:
2026         * stress/builtin-function-name.js: Added.
2027         (shouldBe):
2028         (shouldThrow):
2029         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2030         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2031         * stress/private-name-as-anonymous-builtin.js: Added.
2032         (shouldBe):
2033         (NotPromise):
2034
2035 2017-08-30  Saam Barati  <sbarati@apple.com>
2036
2037         Unreviewed. Make test stop printing.
2038
2039         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2040
2041 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2042
2043         Unreviewed, rolling out r221327.
2044
2045         This change caused test262 failures.
2046
2047         Reverted changeset:
2048
2049         "[JSC] Use reifying system for "name" property of builtin
2050         JSFunction"
2051         https://bugs.webkit.org/show_bug.cgi?id=175260
2052         http://trac.webkit.org/changeset/221327
2053
2054 2017-08-30  Saam Barati  <sbarati@apple.com>
2055
2056         semicolon is being interpreted as an = in the LiteralParser
2057         https://bugs.webkit.org/show_bug.cgi?id=176114
2058
2059         Reviewed by Oliver Hunt.
2060
2061         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2062         * stress/resources/literal-parser-test-case.js: Added.
2063
2064 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2065
2066         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2067         https://bugs.webkit.org/show_bug.cgi?id=166698
2068
2069         Reviewed by Yusuke Suzuki.
2070
2071         * stress/async-iteration-for-await-of-syntax.js: Added.
2072         (assert):
2073         (checkSyntax):
2074         (checkSyntaxError):
2075         (checkSimpleAsyncGeneratorSloppyMode):
2076         (checkSimpleAsyncGeneratorStrictMode):
2077         (checkNestedAsyncGenerators):
2078         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2079         * stress/async-iteration-for-await-of.js: Added.
2080         (assert):
2081         (async.foo):
2082         (async.boo):
2083         (const.boo.async):
2084
2085 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2086
2087         [JSC] Use reifying system for "name" property of builtin JSFunction
2088         https://bugs.webkit.org/show_bug.cgi?id=175260
2089
2090         Reviewed by Saam Barati.
2091
2092         * stress/accessors-get-set-prefix.js:
2093         * stress/builtin-function-name.js: Added.
2094         (shouldBe):
2095         (shouldThrow):
2096         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2097         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2098
2099 2017-08-25  Saam Barati  <sbarati@apple.com>
2100
2101         Support compiling catch in the DFG
2102         https://bugs.webkit.org/show_bug.cgi?id=174590
2103         <rdar://problem/34047845>
2104
2105         Reviewed by Filip Pizlo.
2106
2107         * microbenchmarks/delta-blue-try-catch.js: Added.
2108         (exception):
2109         (value):
2110         (OrderedCollection):
2111         (OrderedCollection.prototype.add):
2112         (OrderedCollection.prototype.at):
2113         (OrderedCollection.prototype.size):
2114         (OrderedCollection.prototype.removeFirst):
2115         (OrderedCollection.prototype.remove):
2116         (Strength):
2117         (Strength.stronger):
2118         (Strength.weaker):
2119         (Strength.weakestOf):
2120         (Strength.strongest):
2121         (Strength.prototype.nextWeaker):
2122         (Constraint):
2123         (Constraint.prototype.addConstraint):
2124         (Constraint.prototype.satisfy):
2125         (Constraint.prototype.destroyConstraint):
2126         (Constraint.prototype.isInput):
2127         (UnaryConstraint):
2128         (UnaryConstraint.prototype.addToGraph):
2129         (UnaryConstraint.prototype.chooseMethod):
2130         (UnaryConstraint.prototype.isSatisfied):
2131         (UnaryConstraint.prototype.markInputs):
2132         (UnaryConstraint.prototype.output):
2133         (UnaryConstraint.prototype.recalculate):
2134         (UnaryConstraint.prototype.markUnsatisfied):
2135         (UnaryConstraint.prototype.inputsKnown):
2136         (UnaryConstraint.prototype.removeFromGraph):
2137         (StayConstraint):
2138         (StayConstraint.prototype.execute):
2139         (EditConstraint.prototype.isInput):
2140         (EditConstraint.prototype.execute):
2141         (BinaryConstraint):
2142         (BinaryConstraint.prototype.chooseMethod):
2143         (BinaryConstraint.prototype.addToGraph):
2144         (BinaryConstraint.prototype.isSatisfied):
2145         (BinaryConstraint.prototype.markInputs):
2146         (BinaryConstraint.prototype.input):
2147         (BinaryConstraint.prototype.output):
2148         (BinaryConstraint.prototype.recalculate):
2149         (BinaryConstraint.prototype.markUnsatisfied):
2150         (BinaryConstraint.prototype.inputsKnown):
2151         (BinaryConstraint.prototype.removeFromGraph):
2152         (ScaleConstraint):
2153         (ScaleConstraint.prototype.addToGraph):
2154         (ScaleConstraint.prototype.removeFromGraph):
2155         (ScaleConstraint.prototype.markInputs):
2156         (ScaleConstraint.prototype.execute):
2157         (ScaleConstraint.prototype.recalculate):
2158         (EqualityConstraint):
2159         (EqualityConstraint.prototype.execute):
2160         (Variable):
2161         (Variable.prototype.addConstraint):
2162         (Variable.prototype.removeConstraint):
2163         (Planner):
2164         (Planner.prototype.incrementalAdd):
2165         (Planner.prototype.incrementalRemove):
2166         (Planner.prototype.newMark):
2167         (Planner.prototype.makePlan):
2168         (Planner.prototype.extractPlanFromConstraints):
2169         (Planner.prototype.addPropagate):
2170         (Planner.prototype.removePropagateFrom):
2171         (Planner.prototype.addConstraintsConsumingTo):
2172         (Plan):
2173         (Plan.prototype.addConstraint):
2174         (Plan.prototype.size):
2175         (Plan.prototype.constraintAt):
2176         (Plan.prototype.execute):
2177         (chainTest):
2178         (projectionTest):
2179         (change):
2180         (deltaBlue):
2181         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2182         (assert):
2183         (Numbers):
2184         (Numbers.prototype.next):
2185         (return.Transpose):
2186         (return.Transpose.prototype.next):
2187         (transpose):
2188         (verifyEven):
2189         (verifyString):
2190         (foo):
2191         (runIterators):
2192         * microbenchmarks/try-catch-word-count.js: Added.
2193         (let.assert):
2194         (EOF):
2195         (let.texts):
2196         (let.o.apply):
2197         (foo):
2198         (bar):
2199         (f):
2200         (run):
2201         (test1):
2202         (test2):
2203         (test3):
2204         (fn):
2205         (A):
2206         (B):
2207         (A.prototype.getValue):
2208         (B.prototype.getParentValue):
2209         (strlen):
2210         (sum.0):
2211         (test):
2212         (result.test.o):
2213         (set add.set add):
2214         (set forEach):
2215         (stringHash):
2216         (set if):
2217         (testFunction):
2218         (set delete.set has.set add):
2219         * stress/catch-set-argument-speculation-failure.js: Added.
2220         (o):
2221         (e):
2222         (e2):
2223         (escape):
2224         (baz):
2225         (noInline.run):
2226         (noInline):
2227         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2228         (foo):
2229         (e):
2230         (baz):
2231         (bar):
2232
2233 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2234
2235         Unreviewed, rolling out r221119, r221124, and r221143.
2236         https://bugs.webkit.org/show_bug.cgi?id=175973
2237
2238         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2239         on #webkit).
2240
2241         Reverted changesets:
2242
2243         "Support compiling catch in the DFG"
2244         https://bugs.webkit.org/show_bug.cgi?id=174590
2245         http://trac.webkit.org/changeset/221119
2246
2247         "Unreviewed, build fix in GTK port"
2248         https://bugs.webkit.org/show_bug.cgi?id=174590
2249         http://trac.webkit.org/changeset/221124
2250
2251         "DFG::JITCode::osrEntry should get sorted since we perform a
2252         binary search on it"
2253         https://bugs.webkit.org/show_bug.cgi?id=175893
2254         http://trac.webkit.org/changeset/221143
2255
2256 2017-08-24  Michael Saboff  <msaboff@apple.com>
2257
2258         Add support for RegExp "dotAll" flag
2259         https://bugs.webkit.org/show_bug.cgi?id=175924
2260
2261         Reviewed by Keith Miller.
2262
2263         Updated tests for new dotAll ('s' flag) changes.
2264
2265         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2266         * stress/static-getter-in-names.js:
2267
2268 2017-08-24  Mark Lam  <mark.lam@apple.com>
2269
2270         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2271         https://bugs.webkit.org/show_bug.cgi?id=175940
2272         <rdar://problem/29003921>
2273
2274         Reviewed by Saam Barati.
2275
2276         * stress/regress-164081.js: Added.
2277         (shouldEqual):
2278         (testcase):
2279
2280 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2281
2282         Skip flaky JSC test stress/test-finally.js.
2283         https://bugs.webkit.org/show_bug.cgi?id=160283
2284
2285         Unreviewed test gardening.
2286
2287         * stress/test-finally.js:
2288
2289 2017-08-23  Saam Barati  <sbarati@apple.com>
2290
2291         Support compiling catch in the DFG
2292         https://bugs.webkit.org/show_bug.cgi?id=174590
2293
2294         Reviewed by Filip Pizlo.
2295
2296         * microbenchmarks/delta-blue-try-catch.js: Added.
2297         (exception):
2298         (value):
2299         (OrderedCollection):
2300         (OrderedCollection.prototype.add):
2301         (OrderedCollection.prototype.at):
2302         (OrderedCollection.prototype.size):
2303         (OrderedCollection.prototype.removeFirst):
2304         (OrderedCollection.prototype.remove):
2305         (Strength):
2306         (Strength.stronger):
2307         (Strength.weaker):
2308         (Strength.weakestOf):
2309         (Strength.strongest):
2310         (Strength.prototype.nextWeaker):
2311         (Constraint):
2312         (Constraint.prototype.addConstraint):
2313         (Constraint.prototype.satisfy):
2314         (Constraint.prototype.destroyConstraint):
2315         (Constraint.prototype.isInput):
2316         (UnaryConstraint):
2317         (UnaryConstraint.prototype.addToGraph):
2318         (UnaryConstraint.prototype.chooseMethod):
2319         (UnaryConstraint.prototype.isSatisfied):
2320         (UnaryConstraint.prototype.markInputs):
2321         (UnaryConstraint.prototype.output):
2322         (UnaryConstraint.prototype.recalculate):
2323         (UnaryConstraint.prototype.markUnsatisfied):
2324         (UnaryConstraint.prototype.inputsKnown):
2325         (UnaryConstraint.prototype.removeFromGraph):
2326         (StayConstraint):
2327         (StayConstraint.prototype.execute):
2328         (EditConstraint.prototype.isInput):
2329         (EditConstraint.prototype.execute):
2330         (BinaryConstraint):
2331         (BinaryConstraint.prototype.chooseMethod):
2332         (BinaryConstraint.prototype.addToGraph):
2333         (BinaryConstraint.prototype.isSatisfied):
2334         (BinaryConstraint.prototype.markInputs):
2335         (BinaryConstraint.prototype.input):
2336         (BinaryConstraint.prototype.output):
2337         (BinaryConstraint.prototype.recalculate):
2338         (BinaryConstraint.prototype.markUnsatisfied):
2339         (BinaryConstraint.prototype.inputsKnown):
2340         (BinaryConstraint.prototype.removeFromGraph):
2341         (ScaleConstraint):
2342         (ScaleConstraint.prototype.addToGraph):
2343         (ScaleConstraint.prototype.removeFromGraph):
2344         (ScaleConstraint.prototype.markInputs):
2345         (ScaleConstraint.prototype.execute):
2346         (ScaleConstraint.prototype.recalculate):
2347         (EqualityConstraint):
2348         (EqualityConstraint.prototype.execute):
2349         (Variable):
2350         (Variable.prototype.addConstraint):
2351         (Variable.prototype.removeConstraint):
2352         (Planner):
2353         (Planner.prototype.incrementalAdd):
2354         (Planner.prototype.incrementalRemove):
2355         (Planner.prototype.newMark):
2356         (Planner.prototype.makePlan):
2357         (Planner.prototype.extractPlanFromConstraints):
2358         (Planner.prototype.addPropagate):
2359         (Planner.prototype.removePropagateFrom):
2360         (Planner.prototype.addConstraintsConsumingTo):
2361         (Plan):
2362         (Plan.prototype.addConstraint):
2363         (Plan.prototype.size):
2364         (Plan.prototype.constraintAt):
2365         (Plan.prototype.execute):
2366         (chainTest):
2367         (projectionTest):
2368         (change):
2369         (deltaBlue):
2370         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2371         (assert):
2372         (Numbers):
2373         (Numbers.prototype.next):
2374         (return.Transpose):
2375         (return.Transpose.prototype.next):
2376         (transpose):
2377         (verifyEven):
2378         (verifyString):
2379         (foo):
2380         (runIterators):
2381         * microbenchmarks/try-catch-word-count.js: Added.
2382         (let.assert):
2383         (EOF):
2384         (let.texts):
2385         (let.o.apply):
2386         (foo):
2387         (bar):
2388         (f):
2389         (run):
2390         (test1):
2391         (test2):
2392         (test3):
2393         (fn):
2394         (A):
2395         (B):
2396         (A.prototype.getValue):
2397         (B.prototype.getParentValue):
2398         (strlen):
2399         (sum.0):
2400         (test):
2401         (result.test.o):
2402         (set add.set add):
2403         (set forEach):
2404         (stringHash):
2405         (set if):
2406         (testFunction):
2407         (set delete.set has.set add):
2408         * stress/catch-set-argument-speculation-failure.js: Added.
2409         (o):
2410         (e):
2411         (e2):
2412         (escape):
2413         (baz):
2414         (noInline.run):
2415         (noInline):
2416         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2417         (foo):
2418         (e):
2419         (baz):
2420         (bar):
2421
2422 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2423
2424         [JSC] Optimize Map iteration with intrinsic
2425         https://bugs.webkit.org/show_bug.cgi?id=174355
2426
2427         Reviewed by Saam Barati.
2428
2429         * stress/map-iterator-result-should-have-expected-shape.js: Added.
2430         (shouldBe):
2431         (throw.new.Error):
2432         * stress/set-iterator-result-should-have-expected-shape.js: Added.
2433         (shouldBe):
2434         (throw.new.Error.let.iterator.set Symbol):
2435         (throw.new.Error.set add):
2436         (let.iterator.set Symbol):
2437
2438 2017-08-23  Robin Morisset  <rmorisset@apple.com>
2439
2440         Add a micro-benchmark for checking that accessing a variable within a 'with'
2441         block does not automatically prevent type prediction.
2442         https://bugs.webkit.org/show_bug.cgi?id=175738
2443
2444         Reviewed by Saam Barati.
2445
2446         * stress/with_and_arith.js: Added.
2447         (with):
2448
2449 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
2450
2451         [ESNext] Async iteration - Implement Async Generator - runtime
2452         https://bugs.webkit.org/show_bug.cgi?id=175240
2453
2454         Reviewed by Yusuke Suzuki.
2455
2456         * stress/async-iteration-async-from-sync.js: Added.
2457         (assert):
2458         (const.Logger):
2459         (this.fullfilled):
2460         (this.fullfilledDone):
2461         (this.rejected):
2462         (this.catched):
2463         (this.isFinal):
2464         (_assertLogger):
2465         (const.assertLogger):
2466         (const.getPromise.promiseHolder.return.new.Promise):
2467         (foo):
2468         (async.boo):
2469         (bar):
2470         (async.baz):
2471         (async.goo):
2472         * stress/async-iteration-basic.js: Added.
2473         (assert):
2474         (const.Logger):
2475         (this.fullfilled):
2476         (this.fullfilledDone):
2477         (this.rejected):
2478         (this.catched):
2479         (this.isFinal):
2480         (_assertLogger):
2481         (const.assertLogger):
2482         (const.getPromise.promiseHolder.return.new.Promise):
2483         (async.generator):
2484         (iterator.next.then):
2485         (async.baz):
2486         (async.boo):
2487         (async.foo):
2488         (async.goo):
2489         (A.prototype.async.foo):
2490         (A.prototype.async.boo):
2491         (A):
2492         (asyncGenExp.async):
2493         (async.joo):
2494         (j.next.then):
2495         (then):
2496         (async.koo):
2497         (async.loo):
2498         (async.moo):
2499         (async.noo):
2500         (async.ooo):
2501         (async.roo):
2502         (async.poo):
2503         (async.soo):
2504         (async.too):
2505         * stress/async-iteration-evaluation.js: Added.
2506         (assert):
2507         (async.foo):
2508         (catch):
2509         * stress/async-iteration-syntax.js:
2510         * stress/async-iteration-yield-promise.js: Added.
2511         (assert):
2512         (const.Logger):
2513         (this.fullfilled):
2514         (this.fullfilledDone):
2515         (this.rejected):
2516         (this.catched):
2517         (this.isFinal):
2518         (_assertLogger):
2519         (const.assertLogger):
2520         (const.getPromise.promiseHolder.return.new.Promise):
2521         (async.foo):
2522         (async.boo):
2523         (async.bar):
2524         * stress/async-iteration-yield-star-interface.js: Added.
2525         (assert):
2526         (const.getPromise.promiseHolder.return.new.Promise):
2527         (const.Logger):
2528         (this.fullfilled):
2529         (this.fullfilledDone):
2530         (this.rejected):
2531         (this.catched):
2532         (this.custom):
2533         (this.isFinal):
2534         (_assertLogger):
2535         (const.assertLogger):
2536         (let.asyncIter.Symbol.asyncIterator):
2537         (let.asyncIter.next):
2538         (let.asyncIter.throw):
2539         (let.asyncIter.return):
2540         (async.foo):
2541         (asyncIter.Symbol.asyncIterator):
2542         (asyncIter.next):
2543         (async.boo):
2544         (asyncIter.return):
2545         (async.bar):
2546         (async.baz):
2547         (async.foobar):
2548         * stress/async-iteration-yield-star.js: Added.
2549         (assert):
2550         (const.Logger):
2551         (this.fullfilled):
2552         (this.fullfilledDone):
2553         (this.rejected):
2554         (this.catched):
2555         (this.custom):
2556         (this.isFinal):
2557         (_assertLogger):
2558         (const.assertLogger):
2559         (const.getPromise.promiseHolder.return.new.Promise):
2560         (async.foo):
2561         (async.boo):
2562         (async.bar):
2563         (async.baz):
2564         (async.joo):
2565         (async.goo):
2566         (async.koo):
2567         (async.loo):
2568         (let.asyncIter.Symbol.asyncIterator):
2569         (let.asyncIter.next):
2570         (let.asyncIter.throw):
2571         (let.asyncIter.return):
2572         (async.moo):
2573         (async.noo):
2574         * test262.yaml:
2575
2576 2017-08-23  JF Bastien  <jfbastien@apple.com>
2577
2578         Fix printing in test
2579
2580         Unreviewed: fixing verbosity, shouldn't have been there.
2581
2582         * wasm/regress/175693.js:
2583         (else.else):
2584         (catch):
2585
2586 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
2587
2588         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
2589         https://bugs.webkit.org/show_bug.cgi?id=172543
2590
2591         Unreviewed test gardening.
2592
2593         * microbenchmarks/generator-with-several-types.js:
2594
2595 2017-08-17  JF Bastien  <jfbastien@apple.com>
2596
2597         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
2598         https://bugs.webkit.org/show_bug.cgi?id=175693
2599         <rdar://problem/33952443>
2600
2601         Reviewed by Saam Barati.
2602
2603         Add a regression directory for WebAssembly tests.
2604
2605         * wasm.yaml:
2606         * wasm/regress/175693.js: Added.
2607         (else.else):
2608         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
2609         (catch):
2610         * wasm/regress/175693.wasm: Added.
2611
2612 2017-08-15  Robin Morisset  <rmorisset@apple.com>
2613
2614         Support the 'with' keyword in FTL.
2615         https://bugs.webkit.org/show_bug.cgi?id=175585
2616
2617         Reviewed by Saam Barati.
2618
2619         Also improve the JSTest/stress/with.js file to test
2620         what happens when non-objects are passed to with.
2621
2622         * stress/with.js:
2623         (foo):
2624         (i.catch):
2625         (i.with): Deleted.
2626
2627 2017-08-14  Keith Miller  <keith_miller@apple.com>
2628
2629         Add testing tool to lie to the DFG about profiles
2630         https://bugs.webkit.org/show_bug.cgi?id=175487
2631
2632         Reviewed by Saam Barati.
2633
2634         * stress/compare-eq-incomplete-profile.js: Added.
2635         (const.test.createBuiltin):
2636
2637 2017-08-14  Robin Morisset  <rmorisset@apple.com>
2638
2639         Support the with keyword in DFG
2640         https://bugs.webkit.org/show_bug.cgi?id=175470
2641
2642         Reviewed by Saam Barati.
2643
2644         Added a new stress-test for the 'with' keyword, that caught a bug in a
2645         previous version of this code.
2646
2647         * stress/with.js: Added.
2648         (i.with):
2649
2650 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
2651
2652         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
2653         https://bugs.webkit.org/show_bug.cgi?id=175544
2654
2655         Unreviewed test gardening.
2656
2657         * ChakraCore.yaml:
2658
2659 2017-08-09  Caitlin Potter  <caitp@igalia.com>
2660
2661         Early error on ANY operator before new.target
2662         https://bugs.webkit.org/show_bug.cgi?id=157970
2663
2664         Reviewed by Saam Barati.
2665
2666         Instead of throwing if any unary operator precedes new.target, only
2667         throw if the unary operator updates the reference.
2668
2669         The following become legal in JSC:
2670
2671         ```
2672         !new.target
2673         ~new.target
2674         typeof new.target
2675         delete new.target
2676         void new.target
2677         ```
2678
2679         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
2680
2681         * stress/new-target-syntax-errors.js:
2682         * stress/new-target.js:
2683
2684 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
2685
2686         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
2687         https://bugs.webkit.org/show_bug.cgi?id=175255
2688
2689         Unreviewed test gardening.
2690
2691         * stress/regress-169783.js:
2692         * wasm/stress/oom.js:
2693
2694 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
2695
2696         REGRESSION: 2 test262/test/language/statements/async-function failures
2697         https://bugs.webkit.org/show_bug.cgi?id=175334
2698
2699         Reviewed by Yusuke Suzuki.
2700
2701         Add @skip parameters to tests, and remove test for async iterator from
2702         async await syntax test because it is already covered by async-iterator-syntax.js
2703
2704         * stress/async-await-syntax.js:
2705         * stress/async-iteration-syntax.js:
2706
2707 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2708
2709         Unreviewed, gardening test262 for Promise resolve / reject function length
2710         https://bugs.webkit.org/show_bug.cgi?id=175333
2711
2712         * test262.yaml:
2713
2714 2017-08-07  Robin Morisset  <rmorisset@apple.com>
2715
2716         GetOwnProperty of TypedArray indexed fields is wrongly configurable
2717         https://bugs.webkit.org/show_bug.cgi?id=175307
2718
2719         Reviewed by Saam Barati.
2720
2721         * stress/typedarray-getownproperty-not-configurable.js: Added.
2722         (assert):
2723         (foo):
2724
2725 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2726
2727         Promise resolve and reject function should have length = 1
2728         https://bugs.webkit.org/show_bug.cgi?id=175242
2729
2730         Reviewed by Saam Barati.
2731
2732         * stress/builtin-function-length.js: Added.
2733         (shouldBe):
2734         (shouldThrow):
2735         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2736         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2737
2738 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2739
2740         [ESNext] Async iteration - Implement Async Generator - parser
2741         https://bugs.webkit.org/show_bug.cgi?id=175210
2742
2743         Reviewed by Yusuke Suzuki.
2744
2745         * stress/async-await-syntax.js:
2746         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2747         * stress/async-iteration-syntax.js: Added.
2748         (assert):
2749         (checkSyntax):
2750         (checkSyntaxError):
2751         (checkSimpleAsyncGeneratorSloppyMode):
2752         (checkSimpleAsyncGeneratorStrictMode):
2753         (checkNestedAsyncGenerators):
2754         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2755         * stress/generator-class-methods-syntax.js:
2756
2757 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2758
2759         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
2760         https://bugs.webkit.org/show_bug.cgi?id=175150
2761
2762         Unreviewed test gardening.
2763
2764         * wasm/js-api/test_memory_constructor.js:
2765
2766 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
2767
2768         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
2769         https://bugs.webkit.org/show_bug.cgi?id=175100
2770
2771         Reviewed by Mark Lam.
2772
2773         The JSC test JSTests/wasm/stress/oom.js tries to use all the
2774         available memory until an out of memory exception happens.
2775
2776         The Linux kernel is more tuned for server workloads than for GUI
2777         responsiveness. When a process tries to use a lot of memory, Linux
2778         will do its best to serve the request. This usually translates to
2779         free physical RAM by writing to disk dirty pages and/or moving out
2780         less recently used pages to swap (disk storage).
2781         Meanwhile it does this, the system will become unresponsive and this
2782         leads to freezes that can last even some minutes on the worst cases.
2783
2784         Therefore, let's skip this test on Linux as it will cause more harm
2785         than good on the Linux bots or on the machines of Linux developers.
2786
2787         * wasm/stress/oom.js:
2788
2789 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2790
2791         [JSC] Remove unnecessary print from stress\promise-finally.js test
2792         https://bugs.webkit.org/show_bug.cgi?id=175015
2793
2794         Reviewed by Yusuke Suzuki.
2795
2796         * stress/promise-finally.js:
2797         (p.finally):
2798         (then):
2799
2800 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2801
2802         Unreviewed, update test262 results for optional catch binding
2803
2804         * test262.yaml:
2805
2806 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2807
2808         [JSC] Support optional catch binding
2809         https://bugs.webkit.org/show_bug.cgi?id=174981
2810
2811         Reviewed by Saam Barati.
2812
2813         * stress/optional-catch-binding-syntax.js: Added.
2814         (testSyntax):
2815         (testSyntaxError):
2816         (catch.catch):
2817         * stress/optional-catch-binding.js: Added.
2818         (shouldBe):
2819         (throwException):
2820
2821 2017-07-28  Mark Lam  <mark.lam@apple.com>
2822
2823         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
2824         https://bugs.webkit.org/show_bug.cgi?id=174948
2825         <rdar://problem/33495680>
2826
2827         Reviewed by Filip Pizlo.
2828
2829         * stress/regress-174948.js: Added.
2830
2831 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2832
2833         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
2834         https://bugs.webkit.org/show_bug.cgi?id=174900
2835
2836         Reviewed by Saam Barati.
2837
2838         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
2839         (sideEffect):
2840         (args):
2841         (test):
2842
2843 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2844
2845         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
2846         https://bugs.webkit.org/show_bug.cgi?id=171637
2847
2848         Reviewed by Darin Adler.
2849
2850         * stress/domjit-getter-complex-with-incorrect-object.js:
2851         (i.shouldThrow):
2852         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
2853         (shouldBe):
2854         (i.shouldThrow):
2855
2856 2017-07-26  JF Bastien  <jfbastien@apple.com>
2857
2858         WebAssembly: test throwing out of the start function
2859         https://bugs.webkit.org/show_bug.cgi?id=165714
2860         <rdar://problem/29760251>
2861
2862         Reviewed by Keith Miller.
2863
2864         * wasm/assert.js:
2865         * wasm/function-tests/trap-from-start.js: Added.
2866         (StartTraps):
2867         * wasm/function-tests/trap-from-start-async.js: Added.
2868         (async.StartTrapsAsync):
2869
2870 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2871
2872         [FTL] Arguments elimination is suppressed by unreachable blocks
2873         https://bugs.webkit.org/show_bug.cgi?id=174352
2874
2875         Reviewed by Filip Pizlo.
2876
2877         * stress/arguments-elimination-force-exit.js: Added.
2878         (shouldBe):
2879         (strict):
2880         (sloppy):
2881         * stress/arguments-elimination-throw.js: Added.
2882         (shouldBe):
2883         (shouldThrow):
2884         (sloppy):
2885         (isArguments):
2886
2887 2017-07-13  Mark Lam  <mark.lam@apple.com>
2888
2889         Add some additional test cases for bug 170896.
2890         https://bugs.webkit.org/show_bug.cgi?id=174491
2891
2892         Reviewed by Filip Pizlo.
2893
2894         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
2895         * stress/regress-170896-with-double-shape-profile.js: Added.
2896         (test):
2897         * stress/regress-170896-with-int32-shape-profile.js: Added.
2898         (test):
2899         * stress/regress-170896.js: Removed.
2900
2901 2017-07-13  Saam Barati  <sbarati@apple.com>
2902
2903         Missing exception check in JSObject::hasInstance
2904         https://bugs.webkit.org/show_bug.cgi?id=174455
2905         <rdar://problem/31384608>
2906
2907         Reviewed by Mark Lam.
2908
2909         * stress/has-instance-exception-check.js: Added.
2910         (assert):
2911         (let.getter.Object.getOwnPropertyDescriptor.get foo):
2912
2913 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
2914
2915         [ESnext] Implement Object Spread
2916         https://bugs.webkit.org/show_bug.cgi?id=167963
2917
2918         Reviewed by Saam Barati.
2919
2920         * stress/obj-rest-destructuring-order.js: Added.
2921         (assert):
2922         (o.get z):
2923         (o.get a):
2924         * stress/obj-spread-order.js: Added.
2925         (assert):
2926         (o.get z):
2927         (o.get a):
2928         * stress/object-spread.js: Added.
2929         (let.assert):
2930         (assert.sameValue):
2931         (let.o.get a):
2932         (let.obj.get c):
2933         (cthulhu.get x):
2934         (let.obj.set c):
2935         (calls.o.get z):
2936         (calls.o.get a):
2937         (try.let.obj.get foo):
2938         (get calls):
2939
2940 2017-07-12  Saam Barati  <sbarati@apple.com>
2941
2942         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
2943         https://bugs.webkit.org/show_bug.cgi?id=174411
2944         <rdar://problem/31696186>
2945
2946         Reviewed by Mark Lam.
2947
2948         * stress/generic-arguments-correct-delete-behavior.js: Added.
2949         (assert):
2950         (makeTest):
2951
2952 2017-07-07  Mark Lam  <mark.lam@apple.com>
2953
2954         \n\r is not the same as \r\n.
2955         https://bugs.webkit.org/show_bug.cgi?id=173053
2956
2957         Reviewed by Keith Miller.
2958
2959         * stress/regress-173053.js: Added.
2960         * stress/template-literal-line-terminators.js:
2961
2962 2017-07-06  Saam Barati  <sbarati@apple.com>
2963
2964         We are missing places where we invalidate the for-in context
2965         https://bugs.webkit.org/show_bug.cgi?id=174184
2966
2967         Reviewed by Geoffrey Garen.
2968
2969         * stress/for-in-invalidate-context-weird-assignments.js: Added.
2970         (assert):
2971         (test):
2972
2973 2017-07-05  Saam Barati  <sbarati@apple.com>
2974
2975         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
2976         https://bugs.webkit.org/show_bug.cgi?id=174188
2977         <rdar://problem/30581423>
2978
2979         Reviewed by Mark Lam.
2980
2981         * stress/new-array-having-a-bad-time-double.js: Added.
2982         (assert):
2983         (foo):
2984
2985 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2986
2987         WTF::StringImpl::copyChars segfaults when built with GCC 7
2988         https://bugs.webkit.org/show_bug.cgi?id=173407
2989
2990         Reviewed by Andreas Kling.
2991
2992         * stress/string-repeat-copy-chars-crash.js: Added.
2993         (shouldBe):
2994
2995 2017-07-03  Saam Barati  <sbarati@apple.com>
2996
2997         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
2998
2999         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3000
3001 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3002
3003         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3004
3005         It requires too much memory.
3006
3007         * stress/dont-reserve-huge-capacity-lexer.js:
3008
3009 2017-06-30  Michael Saboff  <msaboff@apple.com>
3010
3011         Skip a test on ARM64 platform since we run out of address space.
3012
3013         Rubber stamped by Saam Barati.
3014
3015         * stress/dont-reserve-huge-capacity-lexer.js:
3016
3017 2017-06-30  Michael Saboff  <msaboff@apple.com>
3018
3019         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3020         https://bugs.webkit.org/show_bug.cgi?id=174044
3021
3022         Reviewed by Oliver Hunt.
3023
3024         New regression test.
3025
3026         * stress/regress-174044.js: Added.
3027         (test1):
3028         (test2):
3029
3030 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3031
3032         RegExpCachedResult::setInput should reify left and right contexts
3033         https://bugs.webkit.org/show_bug.cgi?id=173818
3034
3035         Reviewed by Keith Miller.
3036
3037         * stress/right-left-context-invalidated-by-input.js: Added.
3038         (test.validateContexts):
3039         (test):
3040
3041 2017-06-29  Saam Barati  <sbarati@apple.com>
3042
3043         Calculating postCapacity in unshiftCountSlowCase is wrong
3044         https://bugs.webkit.org/show_bug.cgi?id=173992
3045         <rdar://problem/32283199>
3046
3047         Reviewed by Keith Miller.
3048
3049         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3050         (temp):
3051
3052 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3053
3054         Unreviewed, rolling out r218512.
3055         https://bugs.webkit.org/show_bug.cgi?id=173981
3056
3057         "It changes the behavior of the JS API's JSEvaluateScript
3058         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3059
3060         Reverted changeset:
3061
3062         "test262: Completion values for control flow do not match the
3063         spec"
3064         https://bugs.webkit.org/show_bug.cgi?id=171265
3065         http://trac.webkit.org/changeset/218512
3066
3067 2017-06-27  JF Bastien  <jfbastien@apple.com>
3068
3069         WebAssembly: running out of executable memory should throw OoM
3070         https://bugs.webkit.org/show_bug.cgi?id=171537
3071         <rdar://problem/32963338>
3072
3073         Reviewed by Saam Barati.
3074
3075         * wasm.yaml:
3076         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3077         (const.invoke):
3078         (failCount.0.catch):
3079         (failCount.0.module.undefined.catch):
3080         * wasm/lowExecutableMemory/exports-oom.js: Added.
3081         (const.type):
3082         (const.params):
3083         (const.randomProgram):
3084         (failCount.0.catch):
3085         (failCount.0.module.undefined.catch):
3086         * wasm/lowExecutableMemory/imports-oom.js: Added.
3087         (const.type):
3088         (const.params):
3089         (const.randomProgram):
3090         (f.imports.push):
3091         (failCount.0.catch):
3092         (failCount.0.module.undefined.catch):
3093
3094 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3095
3096         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3097         https://bugs.webkit.org/show_bug.cgi?id=167962
3098
3099         Reviewed by Saam Barati.
3100
3101         * stress/object-rest-deconstruct.js: Added.
3102         (let.assert):
3103         (let.assertPropDescriptor):
3104         (catch):
3105         (get 3):
3106         (foo):
3107         (let.src.get y):
3108         (let.src.set y):
3109         (let.gen):
3110
3111 2017-06-27  Saam Barati  <sbarati@apple.com>
3112
3113         Function constructor needs to follow the spec and validate parameters and body independently
3114         https://bugs.webkit.org/show_bug.cgi?id=173303
3115         <rdar://problem/32732526>
3116
3117         Reviewed by Keith Miller.
3118
3119         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3120         * stress/function-constructor-semantics.js: Added.
3121         (assert):
3122         (hasSyntaxError):
3123         (foo):
3124         (async.foo):
3125         (testError):
3126         (testOK.toString):
3127         (toString):
3128
3129 2017-06-26  Saam Barati  <sbarati@apple.com>
3130
3131         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3132         https://bugs.webkit.org/show_bug.cgi?id=173740
3133
3134         Reviewed by Mark Lam.
3135
3136         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3137         (Array.prototype.Symbol.iterator):
3138
3139 2017-06-26  Saam Barati  <sbarati@apple.com>
3140
3141         Skip a test on 32-bit platforms since we run out of address space.
3142
3143         Rubber stamped by Mark Lam.
3144
3145         * stress/dont-reserve-huge-capacity-lexer.js:
3146
3147 2017-06-26  Saam Barati  <sbarati@apple.com>
3148
3149         Crash in JSC::Lexer<unsigned char>::setCode
3150         https://bugs.webkit.org/show_bug.cgi?id=172754
3151
3152         Reviewed by Mark Lam.
3153
3154         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3155         (catch):
3156
3157 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3158
3159         [JSC] Clean up Object.entries implementation
3160         https://bugs.webkit.org/show_bug.cgi?id=173759
3161
3162         Reviewed by Sam Weinig.
3163
3164         * microbenchmarks/object-entries.js: Added.
3165         (test):
3166
3167 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3168
3169         Remove Reflect.enumerate
3170         https://bugs.webkit.org/show_bug.cgi?id=173806
3171
3172         Reviewed by Yusuke Suzuki.
3173
3174         * ChakraCore.yaml:
3175         * es6.yaml:
3176         These tests now fail because they use Reflect.enumerate.
3177
3178         * test262.yaml:
3179         This test now passes, it checked that Reflect.enumerate is undefined!
3180
3181         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3182         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3183
3184         * stress/reflect-enumerate.js: Removed.
3185         Remove a test solely for Reflect.enumerate.
3186
3187 2017-06-22  Saam Barati  <sbarati@apple.com>
3188
3189         ValueRep(DoubleRep(@v)) can not simply convert to @v
3190         https://bugs.webkit.org/show_bug.cgi?id=173687
3191         <rdar://problem/32855563>
3192
3193         Reviewed by Mark Lam.
3194
3195         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3196         (i.catch):
3197
3198 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3199
3200         [JSC] Object.values should be implemented in C++
3201         https://bugs.webkit.org/show_bug.cgi?id=173703
3202
3203         Reviewed by Sam Weinig.
3204
3205         * microbenchmarks/object-keys-map-values.js: Added.
3206         (test):
3207         * microbenchmarks/object-values.js: Added.
3208         (test):
3209         * stress/object-values-changing-properties.js: Added.
3210         (shouldBe):
3211         (throw.new.Error.let.source.get x):
3212         (throw.new.Error):
3213         (shouldBe.let.handler.get order):
3214         (get let):
3215         (shouldBe.let.handler.get return):
3216         (let.handler.get order):
3217
3218 2017-06-21  Saam Barati  <sbarati@apple.com>
3219
3220         eval virtual call is incorrect in the baseline JIT
3221         https://bugs.webkit.org/show_bug.cgi?id=173587
3222         <rdar://problem/32867897>
3223
3224         Reviewed by Michael Saboff.
3225
3226         * stress/do-eval-virtual-call-correctly.js: Added.
3227         (assert):
3228         (f):
3229         (i.test):
3230         (catch):
3231
3232 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3233
3234         Update test262 test expectations after r218581.
3235
3236         Unreviewed test gardening.
3237
3238         * test262.yaml:
3239
3240 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
3241
3242         Revert changes in bug#160417 about extending `null` not being a derived class
3243         https://bugs.webkit.org/show_bug.cgi?id=169293
3244
3245         Reviewed by Saam Barati.
3246
3247         * stress/class-derived-from-null.js:
3248         (assertThrow):
3249         (test1):
3250         (test2):
3251         (test3):
3252         (test4):
3253         (test5):
3254         (test6):
3255
3256 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3257
3258         [DFG] More ArrayIndexOf fixups for various types
3259         https://bugs.webkit.org/show_bug.cgi?id=173176
3260
3261         Reviewed by Saam Barati.
3262
3263         * stress/array-indexof-arraystorage.js: Added.
3264         (shouldBe):
3265         (indexOfInt32Other):
3266         (indexOfInt32Cell):
3267         (indexOfInt32Boolean):
3268         (indexOfDoubleOther):
3269         (indexOfDoubleCell):
3270         (indexOfDoubleBoolean):
3271         (indexOfInt32):
3272         (indexOfDouble):
3273         * stress/array-indexof-constant-folding.js: Added.
3274         (shouldBe):
3275         (indexOfInt32Other):
3276         (indexOfInt32Cell):
3277         (indexOfInt32Boolean):
3278         (indexOfDoubleOther):
3279         (indexOfDoubleCell):
3280         (indexOfDoubleBoolean):
3281         * stress/array-indexof-hole-and-other.js: Added.
3282         (shouldBe):
3283         (indexOf):
3284         * stress/array-indexof-other.js: Added.
3285         (shouldBe):
3286         (indexOfInt32):
3287         (indexOfDouble):
3288         (indexOfString):
3289         (indexOfObject):
3290         * stress/array-indexof-symbol.js: Added.
3291         (shouldBe):
3292         (indexOfInt32):
3293         (indexOfDouble):
3294         (indexOfString):
3295         (indexOfObject):
3296
3297 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
3298
3299         test262: Completion values for control flow do not match the spec
3300         https://bugs.webkit.org/show_bug.cgi?id=171265
3301
3302         Reviewed by Saam Barati.
3303
3304         * stress/completion-value.js:
3305         Condensed test for completion values in top level statements.
3306
3307         * stress/super-get-by-id.js:
3308         ClassDeclaration when evaled no longer produce values. Convert
3309         these to ClassExpressions so they produce the class value.
3310
3311         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3312         This is a progression for currect spec behavior.
3313
3314         * mozilla/mozilla-tests.yaml:
3315         This test is now outdated, so mark it as failing for that reason.
3316
3317         * test262.yaml:
3318         Passing all "cptn" completion value tests.
3319
3320 2017-06-17  Keith Miller  <keith_miller@apple.com>
3321
3322         ArrayBuffer constructor needs to create subclass structures before its buffer
3323         https://bugs.webkit.org/show_bug.cgi?id=173510
3324
3325         Reviewed by Yusuke Suzuki.
3326
3327         * test262.yaml:
3328
3329 2017-06-17  Keith Miller  <keith_miller@apple.com>
3330
3331         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
3332         https://bugs.webkit.org/show_bug.cgi?id=173506
3333
3334         Reviewed by Ryosuke Niwa.
3335
3336         Re-baseline tests.
3337
3338         * ChakraCore/test/Function/apply3.baseline-jsc:
3339         * test262.yaml:
3340
3341 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3342
3343         [JSC] Add fast path for Object.assign
3344         https://bugs.webkit.org/show_bug.cgi?id=173416
3345
3346         Reviewed by Mark Lam.
3347
3348         * stress/object-assign-changing-properties.js: Added.
3349         (shouldBe):
3350         (throw.new.Error.let.source.get x):
3351         (throw.new.Error):
3352         (shouldBe.let.source.get x):
3353         (shouldBe.let.target.set x):
3354         (shouldBe.let.target.get x):
3355         * stress/object-assign-proxy.js: Added.
3356         (shouldBe):
3357         (throw.new.Error.let.handler.get order):
3358
3359 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3360
3361         [JSC] Implement Object.assign in C++
3362         https://bugs.webkit.org/show_bug.cgi?id=173414
3363
3364         Reviewed by Saam Barati.
3365
3366         * stress/object-assign-string-first.js: Added.
3367         (shouldBe):
3368         (source.get Symbol):
3369         (source.get 1):
3370         (source.get cocoa):
3371
3372 2017-06-14  JF Bastien  <jfbastien@apple.com>
3373
3374         WebAssembly: remove empty test files
3375         https://bugs.webkit.org/show_bug.cgi?id=173382
3376
3377         Reviewed by Saam Barati.
3378
3379         The following files:
3380                 JSTests/wasm/function-tests/call-indirect-params.js
3381                 JSTests/wasm/function-tests/call-indirect.js
3382                 JSTests/wasm/js-api/call-indirect-results.js
3383         Were changed to empty files in https://trac.webkit.org/changeset/209771
3384
3385         They were testing call_indirect with the wrong semantics, before
3386         we implemented tables. That change implemented tables and
3387         therefore removed the erroneous tests.
3388
3389         We have a few tests for call_indirect which already do the right thing:
3390                 JSTests/wasm/function-tests/context-switch.js
3391                 JSTests/wasm/function-tests/exceptions.js
3392                 JSTests/wasm/function-tests/grow-memory-2.js
3393                 JSTests/wasm/function-tests/stack-overflow.js
3394                 JSTests/wasm/function-tests/table-basic-2.js
3395                 JSTests/wasm/function-tests/table-basic.js
3396                 JSTests/wasm/js-api/call-indirect.js
3397                 JSTests/wasm/js-api/table.js
3398                 JSTests/wasm/js-api/unique-signature.js
3399                 JSTests/wasm/js-api/wrapper-function.js
3400
3401         I also just imported the updated spec tests which, among other
3402         things, test call_indirect:
3403                 core/br.wast
3404                 core/br_table.wast
3405                 core/call_indirect.wast
3406                 core/func.wast
3407                 core/func_ptrs.wast
3408                 core/imports.wast
3409                 core/left-to-right.wast
3410                 core/linking.wast
3411                 core/nop.wast
3412                 core/return.wast
3413                 core/typecheck.wast
3414                 core/unreachable.wast
3415
3416         So I think it's OK to just delete the tests which should just have
3417         been deleted back when tables were added.
3418
3419         * wasm/function-tests/call-indirect-params.js: Removed.
3420         * wasm/function-tests/call-indirect.js: Removed.
3421         * wasm/js-api/call-indirect-results.js: Removed.
3422
3423 2017-06-13  JF Bastien  <jfbastien@apple.com>
3424
3425         WebAssembly: import updated spec tests
3426         https://bugs.webkit.org/show_bug.cgi?id=173287
3427         <rdar://problem/32725975>
3428
3429         Reviewed by Saam Barati.
3430
3431         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
3432         with a few modifications so things work.
3433
3434         Fix a bunch of bugs found through this process, and punt a few tests (which I
3435         marked as blocked by this bug).
3436
3437         Fixes:
3438
3439         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
3440         instead of byte alignment. It was also missing memory-alignment.js despite it
3441         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
3442         pass.
3443
3444         Tables can be imported or in a section. There can be only one, but sections can
3445         be empty. An Elements section can exist if there's no Table, as long as it is
3446         also empty.
3447
3448         Memories can be imported or in a section. There can be only one, but sections
3449         can be empty. A Data section can exist if there's no Memory, as long as it is
3450         also empty.
3451
3452         Prototypes: stringify without .prototype. in the string.
3453
3454         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
3455         not a final size, and throws a RangeError on failure, not a TypeError.
3456
3457         Fix compile / instantiate so the reject the promise if given an argument of the
3458         wrong type (instead of failing instantly).
3459
3460         Fix async on neuter test.
3461
3462         Element section shouldn't affect any Table if any of the elements are out of
3463         bounds. We need to process it in two passes.
3464
3465         Segment section shouldn't affect any Data if any of the segments are out of
3466         bounds. We need to process it in two passes.
3467
3468         Empty data segments are valid, but only when there is no memory. Their index
3469         still gets validated, and has to be zero.
3470
3471         Punts:
3472
3473         Error messages with context, the test seems overly restrictive but this is
3474         minor.
3475
3476         compile/instantiate/validate property descriptors.
3477
3478         UTF-8 bugs.
3479
3480         Temporarily disable NaN tests. We need to go back and implement the following
3481         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
3482         much as getting all the other tests passing.
3483
3484         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
3485         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
3486         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
3487         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
3488         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
3489         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
3490         why they're not allowed.
3491
3492         * wasm.yaml:
3493         * wasm/function-tests/i32-load8-s.js:
3494         * wasm/function-tests/memory-access-past-4gib.js:
3495         (const.op.of.WASM.opcodes):
3496         * wasm/function-tests/memory-alignment.js: Added.
3497         (const.op.of.WASM.opcodes):
3498         * wasm/function-tests/memory-section-and-import.js:
3499         * wasm/js-api/Module-compile.js:
3500         (async.testPromiseAPI):
3501         * wasm/js-api/dont-mmap-zero-byte-memory.js:
3502         (testMems):
3503         * wasm/js-api/element.js:
3504         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3505         * wasm/js-api/neutered-inputs.js:
3506         (const.testFunction): Deleted.
3507         (const.testConstructor): Deleted.
3508         * wasm/js-api/table.js:
3509         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3510         (new.WebAssembly.Module):
3511         (assert.throws):
3512         (assertBadTableImport):
3513         (assert.throws.WebAssembly.Table.prototype.grow):
3514         (assertBadTableInstance): Deleted.
3515         * wasm/js-api/test_Data.js:
3516         (DataSectionWithoutMemory):
3517         * wasm/spec-harness/index.js:
3518         (module):
3519         (uniqueTest): Deleted.
3520         (assert_invalid): Deleted.
3521         (assert_soft_invalid): Deleted.
3522         (register): Deleted.
3523         (call): Deleted.
3524         (get instance): Deleted.
3525         (exports): Deleted.
3526         (run): Deleted.
3527         (assert_unlinkable): Deleted.
3528         (assert_uninstantiable): Deleted.
3529         (assert_trap): Deleted.
3530         (try.f): Deleted.
3531         (catch): Deleted.
3532         (assert_exhaustion): Deleted.
3533         (assert_return): Deleted.
3534         (assert_return_nan): Deleted.
3535         * wasm/spec-harness/testharness.css: Removed.
3536         * wasm/spec-harness/testharness.js: Removed.
3537         * wasm/spec-harness/testharnessreport.js: Removed.
3538         * wasm/spec-harness/wasm-constants.js:
3539         (assertTraps):
3540         (assertWasmThrows):
3541         * wasm/spec-harness/wasm-module-builder.js:
3542         (Binary.prototype.emit_section):
3543         (Binary):
3544         (WasmFunctionBuilder.prototype.addBody):
3545         (WasmFunctionBuilder.prototype.end):
3546         (WasmFunctionBuilder):
3547         (WasmModuleBuilder.prototype.stringToBytes):
3548         (WasmModuleBuilder.prototype.addCustomSection):
3549         (WasmModuleBuilder.prototype.addFunctionTableInit):
3550         (WasmModuleBuilder.prototype.appendToTable):
3551         (WasmModuleBuilder.prototype.toArray):
3552         (WasmModuleBuilder.prototype.toBuffer):
3553         (WasmModuleBuilder.prototype.instantiate):
3554         (WasmModuleBuilder):
3555         * wasm/spec-tests/address.wast.js:
3556         * wasm/spec-tests/align.wast.js: Added.
3557         * wasm/spec-tests/binary.wast.js:
3558         * wasm/spec-tests/block.wast.js:
3559         * wasm/spec-tests/br.wast.js:
3560         * wasm/spec-tests/br_if.wast.js:
3561         * wasm/spec-tests/br_table.wast.js:
3562         * wasm/spec-tests/call.wast.js:
3563         * wasm/spec-tests/call_indirect.wast.js:
3564         * wasm/spec-tests/comments.wast.js:
3565         * wasm/spec-tests/const.wast.js: Added.
3566         * wasm/spec-tests/conversions.wast.js: Added.
3567         * wasm/spec-tests/custom_section.wast.js:
3568         * wasm/spec-tests/exports.wast.js:
3569         * wasm/spec-tests/f32.wast.js: Added.
3570         * wasm/spec-tests/f64.wast.js: Added.
3571         * wasm/spec-tests/fac.wast.js:
3572         * wasm/spec-tests/float_exprs.wast.js: Added.
3573         * wasm/spec-tests/float_misc.wast.js: Added.
3574         * wasm/spec-tests/func.wast.js:
3575         * wasm/spec-tests/globals.wast.js:
3576         * wasm/spec-tests/if.wast.js:
3577         * wasm/spec-tests/imports.wast.js:
3578         * wasm/spec-tests/inline-module.wast.js: Added.
3579         * wasm/spec-tests/jsapi.js:
3580         (testJSAPI.test):
3581         (testJSAPI):
3582         * wasm/spec-tests/labels.wast.js:
3583         * wasm/spec-tests/loop.wast.js:
3584         * wasm/spec-tests/memory.wast.js:
3585         * wasm/spec-tests/memory_trap.wast.js: Added.
3586         * wasm/spec-tests/names.wast.js:
3587         * wasm/spec-tests/nop.wast.js:
3588         * wasm/spec-tests/return.wast.js:
3589         * wasm/spec-tests/stack.wast.js:
3590         * wasm/spec-tests/token.wast.js: Added.
3591         * wasm/spec-tests/type.wast.js: Added.
3592         * wasm/spec-tests/typecheck.wast.js:
3593         * wasm/spec-tests/unreachable.wast.js:
3594         * wasm/spec-tests/unreached-invalid.wast.js:
3595         * wasm/spec-tests/unwind.wast.js:
3596         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
3597         * wasm/spec-tests/utf8-import-field.wast.js: Added.
3598         * wasm/spec-tests/utf8-import-module.wast.js: Added.
3599
3600 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
3601
3602         Unreviewed JSC test gardening.
3603
3604         * stress/check-string-ident.js:
3605         * stress/new-largeish-contiguous-array-with-size.js:
3606
3607 2017-06-13  Michael Saboff  <msaboff@apple.com>
3608
3609         DFG doesn't properly handle a property that is change to read only in a prototype
3610         https://bugs.webkit.org/show_bug.cgi?id=173321
3611
3612         Reviewed by Filip Pizlo.
3613
3614         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
3615         * stress/regress-173321.js: Added new regression test.
3616         (shouldBe):
3617         (SimpleObject):
3618         (test):
3619
3620 2017-06-12  Saam Barati  <sbarati@apple.com>
3621
3622         Update test262 test expectation since r218082 makes new tests pass.
3623
3624         * test262.yaml:
3625
3626 2017-06-12  Saam Barati  <sbarati@apple.com>
3627
3628         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
3629         https://bugs.webkit.org/show_bug.cgi?id=172957
3630         <rdar://problem/32602704>
3631
3632         Reviewed by Filip Pizlo.
3633
3634         * stress/spec-empty-flows-through-cell-checks.js: Added.
3635         (A):
3636         (B):
3637         (i.catch):
3638
3639 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
3640
3641         We incorrectly allow escaped characters in keyword tokens
3642         https://bugs.webkit.org/show_bug.cgi?id=171310
3643
3644         Reviewed by Yusuke Suzuki.
3645
3646         * stress/destructuring-assignment-syntax.js:
3647         * stress/error-messages-for-in-operator-should-not-crash.js:
3648         (catch):
3649         * stress/reserved-word-with-escape.js:
3650         (testSyntaxError.String.raw.v):
3651         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
3652         (testSyntaxError.String.raw.a):
3653         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
3654
3655 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3656
3657         [DFG] Add ArrayIndexOf intrinsic
3658         https://bugs.webkit.org/show_bug.cgi?id=172421
3659
3660         Reviewed by Saam Barati.
3661
3662         * stress/array-indexof-array-prototype-change.js: Added.
3663         (shouldBe):
3664         (indexOfInt32):
3665         * stress/array-indexof-have-a-bad-time-getter.js: Added.
3666         (shouldBe):
3667         (indexOfInt32):
3668         * stress/array-indexof-have-a-bad-time.js: Added.
3669         (shouldBe):
3670         (indexOfInt32):
3671         * stress/array-indexof-hole-with-prototype.js: Added.
3672         (shouldBe):
3673         (indexOf):
3674         * stress/array-indexof-hole.js: Added.
3675         (shouldBe):
3676         (indexOf):
3677         * stress/array-indexof-index.js: Added.
3678         (shouldBe):
3679         (indexOfInt32):
3680         (indexOfDouble):
3681         (indexOfString):
3682         (indexOfObject):
3683         (indexOfValue):
3684         * stress/array-indexof-negative-index.js: Added.
3685         (shouldBe):
3686         (indexOfInt32):
3687         (indexOfDouble):
3688         (indexOfString):
3689         (indexOfObject):
3690         (indexOfValue):
3691         * stress/array-indexof-non-int32-start-index.js: Added.
3692         (shouldBe):
3693         (indexOf):
3694         (object.valueOf):
3695         * stress/array-indexof-object-prototype-change.js: Added.
3696         (shouldBe):
3697         (indexOfInt32):
3698         * stress/array-indexof-object.js: Added.
3699         (shouldBe):
3700         (indexOf):
3701         * stress/array-indexof-original-array.js: Added.
3702         (shouldBe):
3703         (indexOfInt32):
3704         * stress/array-indexof-string.js: Added.
3705         (shouldBe):
3706         (indexOf):
3707         * stress/array-indexof-structure-change-convert.js: Added.
3708         (shouldBe):
3709         (indexOf):
3710         * stress/array-indexof-structure-change.js: Added.
3711         (shouldBe):
3712         (indexOf):
3713         * stress/array-indexof.js: Added.
3714         (shouldBe):
3715         (indexOf):
3716
3717 2017-06-11  Keith Miller  <keith_miller@apple.com>
3718
3719         TypedArray constructor with string shouldn't throw
3720         https://bugs.webkit.org/show_bug.cgi?id=173181
3721
3722         Reviewed by JF Bastien.
3723
3724         We should be