test262: $.agent became $262.agent in test262 update
[WebKit-https.git] / JSTests / ChangeLog
1 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
2
3         test262: $.agent became $262.agent in test262 update
4         https://bugs.webkit.org/show_bug.cgi?id=177407
5
6         Reviewed by Yusuke Suzuki.
7
8         * test262.yaml:
9         ~320 tests pass now that we correctly make $262 available.
10
11 2017-09-22  Keith Miller  <keith_miller@apple.com>
12
13         Speculatively change iteration protocall to use the same next function
14         https://bugs.webkit.org/show_bug.cgi?id=175653
15
16         Reviewed by Saam Barati.
17
18         Change test to match the new iteration behavior.
19
20         * stress/spread-optimized-properly.js:
21
22 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
23
24         [DFG][FTL] Profile array vector length for array allocation
25         https://bugs.webkit.org/show_bug.cgi?id=177051
26
27         Reviewed by Saam Barati.
28
29         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
30         (target):
31
32 2017-09-22  Commit Queue  <commit-queue@webkit.org>
33
34         Unreviewed, rolling out r222380.
35         https://bugs.webkit.org/show_bug.cgi?id=177352
36
37         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
38         #webkit).
39
40         Reverted changeset:
41
42         "[DFG][FTL] Profile array vector length for array allocation"
43         https://bugs.webkit.org/show_bug.cgi?id=177051
44         http://trac.webkit.org/changeset/222380
45
46 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
47
48         [DFG][FTL] Profile array vector length for array allocation
49         https://bugs.webkit.org/show_bug.cgi?id=177051
50
51         Reviewed by Saam Barati.
52
53         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
54         (target):
55
56 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
57
58         Skip new hanging test262 tests.
59         https://bugs.webkit.org/show_bug.cgi?id=177326
60
61         Unreviewed test gardening.
62
63         * test262.yaml:
64
65 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
66
67         Mark 6 test262 tests as passing.
68         https://bugs.webkit.org/show_bug.cgi?id=177307
69
70         Unreviewed test gardening.
71
72         * test262.yaml:
73
74 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
75
76         Unreviewed follow-up to r222311.
77
78         * test262/harness/sta.js:
79         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
80         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
81         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
82         * test262/test/built-ins/Array/from/elements-added-after.js:
83         * test262/test/built-ins/Array/from/elements-deleted-after.js:
84         * test262/test/built-ins/Array/from/elements-updated-after.js:
85         * test262/test/built-ins/Array/from/from-array.js:
86         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
87         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
88         * test262/test/built-ins/Array/from/source-array-boundary.js:
89         * test262/test/built-ins/Array/from/source-object-constructor.js:
90         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
91         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
92         * test262/test/built-ins/Array/from/source-object-length.js:
93         * test262/test/built-ins/Array/from/source-object-missing.js:
94         * test262/test/built-ins/Array/from/source-object-without.js:
95         * test262/test/built-ins/Array/from/this-null.js:
96         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
97         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
98         * test262/test/language/literals/numeric/7.8.3-1gs.js:
99         * test262/test/language/literals/numeric/7.8.3-2gs.js:
100         * test262/test/language/literals/numeric/7.8.3-3gs.js:
101         * test262/test/language/literals/regexp/7.8.5-1gs.js:
102         * test262/test/language/literals/string/7.8.4-1gs.js:
103         Fix some files that I failed to update when I applied my patch.
104
105 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
106
107         Update test262 tests
108         https://bugs.webkit.org/show_bug.cgi?id=177220
109
110         Reviewed by Saam Barati and Yusuke Suzuki.
111
112         * test262.yaml:
113         * test262/test262-Revision.txt:
114         New rebaselined expectations for all tests.
115
116         * test262/*:
117         Updated.
118
119 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
120
121         [DFG] Remove ToThis more aggressively
122         https://bugs.webkit.org/show_bug.cgi?id=177056
123
124         Reviewed by Saam Barati.
125
126         * stress/generator-with-this-strict.js: Added.
127         (shouldBe):
128         (generator):
129         (target):
130         * stress/generator-with-this.js: Added.
131         (shouldBe):
132         (generator):
133         (target):
134
135 2017-09-17  Michael Saboff  <msaboff@apple.com>
136
137         https://bugs.webkit.org/show_bug.cgi?id=177038
138         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
139
140         Reviewed by JF Bastien.
141
142         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
143         as it dies using too much memory.
144
145 2017-09-15  Saam Barati  <sbarati@apple.com>
146
147         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
148         https://bugs.webkit.org/show_bug.cgi?id=176981
149
150         Reviewed by Yusuke Suzuki.
151
152         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
153         (assert):
154         (verify):
155         (func):
156         (const.bar.createBuiltin):
157
158 2017-09-14  Saam Barati  <sbarati@apple.com>
159
160         It should be valid to exit before each set when doing arity fixup when inlining
161         https://bugs.webkit.org/show_bug.cgi?id=176948
162
163         Reviewed by Keith Miller.
164
165         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
166         (baz):
167         (bar):
168         (foo):
169
170 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
171
172         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
173         https://bugs.webkit.org/show_bug.cgi?id=176867
174
175         Reviewed by Sam Weinig.
176
177         * microbenchmarks/object-get-own-property-symbols.js: Added.
178         (test):
179
180 2017-09-13  Mark Lam  <mark.lam@apple.com>
181
182         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
183         https://bugs.webkit.org/show_bug.cgi?id=176888
184         <rdar://problem/34381832>
185
186         Not reviewed.
187
188         * stress/op_mod-ConstVar.js:
189         * stress/op_mod-VarConst.js:
190         * stress/op_mod-VarVar.js:
191
192 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
193
194         Skip 3 op_mod tests on Debug JSC bots.
195         https://bugs.webkit.org/show_bug.cgi?id=176630
196
197         Unreviewed test gardening.
198
199         * stress/op_mod-ConstVar.js:
200         * stress/op_mod-VarConst.js:
201         * stress/op_mod-VarVar.js:
202
203 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
204
205         [JSC] Fix Array allocation in Object.keys
206         https://bugs.webkit.org/show_bug.cgi?id=176826
207
208         Reviewed by Saam Barati.
209
210         * stress/object-own-property-keys.js: Added.
211         (shouldBe):
212
213 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
214
215         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
216         https://bugs.webkit.org/show_bug.cgi?id=176010
217
218         Reviewed by Filip Pizlo.
219
220         * microbenchmarks/weak-map-key.js: Added.
221         (assert):
222         (objectKey):
223         (let.start.Date.now):
224
225 2017-09-12  Mark Lam  <mark.lam@apple.com>
226
227         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
228         https://bugs.webkit.org/show_bug.cgi?id=176630
229
230         Reviewed by JF Bastien.
231
232         Debug builds are just slow, and these tests do a lot.  They pass when I run them
233         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
234         a speculative fix for the bots that are seeing these fail.
235
236         I also undid the skipping of the op_mod tests for debug builds.
237
238         * stress/op_div-ConstVar.js:
239         * stress/op_div-VarConst.js:
240         * stress/op_div-VarVar.js:
241         * stress/op_mod-ConstVar.js:
242         * stress/op_mod-VarConst.js:
243         * stress/op_mod-VarVar.js:
244
245 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
246
247         Skip stress/value-to-boolean.js on Debug bots.
248         https://bugs.webkit.org/show_bug.cgi?id=176787
249
250         Unreviewed test gardening.
251
252         * stress/value-to-boolean.js:
253
254 2017-09-11  Mark Lam  <mark.lam@apple.com>
255
256         Change test expectation for test262/test/language/statements/try/tco-catch.js
257         https://bugs.webkit.org/show_bug.cgi?id=176749
258
259         Rubber stamped by Keith Miller.
260
261         It's been failing since at least r221821.  I'm changing the test expectation to
262         fail to green the bots while I investigate some more.
263
264         * test262.yaml:
265
266 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
267
268         Unreviewed, rolling out r221854.
269
270         The test added with this change fails on 32-bit JSC bots.
271
272         Reverted changeset:
273
274         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
275         https://bugs.webkit.org/show_bug.cgi?id=176010
276         http://trac.webkit.org/changeset/221854
277
278 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
279
280         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
281         https://bugs.webkit.org/show_bug.cgi?id=176010
282
283         Reviewed by Filip Pizlo.
284
285         * microbenchmarks/weak-map-key.js: Added.
286         (assert):
287         (objectKey):
288         (let.start.Date.now):
289
290 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
291
292         [JSC] Optimize Object.keys by using careful array allocation
293         https://bugs.webkit.org/show_bug.cgi?id=176654
294
295         Reviewed by Darin Adler.
296
297         * microbenchmarks/object-keys.js: Added.
298         (test):
299
300 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
301
302         Error should compute .stack and friends lazily
303         https://bugs.webkit.org/show_bug.cgi?id=176645
304
305         Reviewed by Saam Barati.
306
307         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
308         * microbenchmarks/new-error.js: Added.
309         * microbenchmarks/throw.js: Added.
310
311 2017-09-09  Mark Lam  <mark.lam@apple.com>
312
313         [Re-landing] Use JIT probes for DFG OSR exit.
314         https://bugs.webkit.org/show_bug.cgi?id=175144
315         <rdar://problem/33437050>
316
317         Not reviewed.  Original patch reviewed by Saam Barati.
318
319         Disable these tests for debug builds because they run too slow with the new OSR exit.
320
321         * stress/op_mod-ConstVar.js:
322         * stress/op_mod-VarConst.js:
323         * stress/op_mod-VarVar.js:
324
325 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
326
327         [DFG] NewArrayWithSize(size)'s size does not care negative zero
328         https://bugs.webkit.org/show_bug.cgi?id=176300
329
330         Reviewed by Saam Barati.
331
332         * stress/new-array-with-size-div.js: Added.
333         (shouldBe):
334         (test):
335         (i.i):
336
337 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
338
339         [DFG] PutByVal with Array::Generic is too generic
340         https://bugs.webkit.org/show_bug.cgi?id=176345
341
342         Reviewed by Filip Pizlo.
343
344         * stress/object-assign-symbols.js: Added.
345         (shouldBe):
346         (test):
347         * stress/object-assign.js: Added.
348         (shouldBe):
349         (test):
350         (i.shouldBe.JSON.stringify.test):
351
352 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
353
354         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
355         https://bugs.webkit.org/show_bug.cgi?id=176590
356
357         Reviewed by Saam Barati.
358
359         * microbenchmarks/object-iterate-symbols.js: Added.
360         (test):
361         * microbenchmarks/object-iterate.js: Added.
362         (test):
363         * stress/object-iterate-symbols.js: Added.
364         (shouldBe):
365         (test):
366         * stress/object-iterate.js: Added.
367         (shouldBe):
368         (test):
369
370 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
371
372         [Win32] 10 JSC stress tests are failing.
373         https://bugs.webkit.org/show_bug.cgi?id=176538
374
375         Reviewed by Mark Lam.
376
377         Skip tests on Windows to make the bots green.
378
379         * ChakraCore.yaml:
380         * stress/date-relaxed.js:
381
382 2017-09-06  Mark Lam  <mark.lam@apple.com>
383
384         constructGenericTypedArrayViewWithArguments() is missing an exception check.
385         https://bugs.webkit.org/show_bug.cgi?id=176485
386         <rdar://problem/33898874>
387
388         Reviewed by Keith Miller.
389
390         * stress/regress-176485.js: Added.
391
392 2017-09-05  Saam Barati  <sbarati@apple.com>
393
394         isNotCellSpeculation is wrong with respect to SpecEmpty
395         https://bugs.webkit.org/show_bug.cgi?id=176429
396
397         Reviewed by Michael Saboff.
398
399         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
400         (Foo):
401
402 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
403
404         test262: Completion values for control flow do not match the spec
405         https://bugs.webkit.org/show_bug.cgi?id=171265
406
407         Reviewed by Saam Barati.
408
409         * stress/completion-value.js:
410         Condensed test for completion values in top level statements.
411
412         * stress/super-get-by-id.js:
413         ClassDeclaration when evaled no longer produce values. Convert
414         these to ClassExpressions so they produce the class value.
415         
416         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
417         This is a progression for currect spec behavior.
418
419         * mozilla/mozilla-tests.yaml:
420         This test is now outdated, so mark it as failing for that reason.
421
422         * test262.yaml:
423         Passing all "cptn" completion value tests.
424
425 2017-09-04  Saam Barati  <sbarati@apple.com>
426
427         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
428         https://bugs.webkit.org/show_bug.cgi?id=176317
429
430         Reviewed by Keith Miller.
431
432         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
433         (Foo):
434
435 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
436
437         [DFG][FTL] Efficiently execute number#toString()
438         https://bugs.webkit.org/show_bug.cgi?id=170007
439
440         Reviewed by Keith Miller.
441
442         * microbenchmarks/number-to-string-strength-reduction.js: Added.
443         (test):
444         * microbenchmarks/number-to-string-with-radix-10.js: Added.
445         (test):
446         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
447         (test):
448         * microbenchmarks/number-to-string-with-radix.js: Added.
449         (test):
450         * stress/number-to-string-strength-reduction.js: Added.
451         (shouldBe):
452         (test):
453         * stress/number-to-string-with-radix-10.js: Added.
454         (shouldBe):
455         (test):
456         * stress/number-to-string-with-radix-cse.js: Added.
457         (shouldBe):
458         (test):
459         * stress/number-to-string-with-radix-invalid.js: Added.
460         (shouldThrow):
461         * stress/number-to-string-with-radix-watchpoint.js: Added.
462         (shouldBe):
463         (test):
464         (i.i.1e3.Number.prototype.toString):
465         * stress/number-to-string-with-radix.js: Added.
466         (shouldBe):
467         (test):
468
469 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
470
471         [DFG] Relax arity requirement
472         https://bugs.webkit.org/show_bug.cgi?id=175523
473
474         Reviewed by Saam Barati.
475
476         * stress/arity-mismatch-arguments-length.js: Added.
477         (shouldBe):
478         (test1):
479         (test):
480         * stress/arity-mismatch-get-argument.js: Added.
481         (shouldBe):
482         (builtin.createBuiltin):
483         (test):
484         * stress/arity-mismatch-inlining-extra-slots.js: Added.
485         (shouldBe):
486         (inlineTarget):
487         (test):
488         * stress/arity-mismatch-inlining.js: Added.
489         (shouldBe):
490         (inlineTarget):
491         (test):
492         * stress/arity-mismatch-rest.js: Added.
493         (shouldBe):
494         (test2):
495         (test1):
496         (test):
497
498 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
499
500         [JSC] Fix "name" and "length" of Proxy revoke function
501         https://bugs.webkit.org/show_bug.cgi?id=176155
502
503         Reviewed by Mark Lam.
504
505         * test262.yaml:
506
507 2017-08-31  Saam Barati  <sbarati@apple.com>
508
509         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
510         https://bugs.webkit.org/show_bug.cgi?id=176206
511
512         Reviewed by Keith Miller.
513
514         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
515         (a):
516         (b):
517         (foo):
518
519 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
520
521         Skip two slow JSC tests after r221422.
522
523         Unreviewed test gardening.
524
525         * stress/regexp-prototype-match-on-too-long-rope.js:
526         * stress/regexp-prototype-test-on-too-long-rope.js:
527
528 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
529
530         Unreviewed, skipping slow tests.
531         
532         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
533         work differently now.
534
535         * stress/regexp-prototype-exec-on-too-long-rope.js:
536         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
537
538 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
539
540         [JSC] Use reifying system for "name" property of builtin JSFunction
541         https://bugs.webkit.org/show_bug.cgi?id=175260
542
543         Reviewed by Saam Barati.
544
545         * stress/accessors-get-set-prefix.js:
546         * stress/builtin-function-name.js: Added.
547         (shouldBe):
548         (shouldThrow):
549         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
550         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
551         * stress/private-name-as-anonymous-builtin.js: Added.
552         (shouldBe):
553         (NotPromise):
554
555 2017-08-30  Saam Barati  <sbarati@apple.com>
556
557         Unreviewed. Make test stop printing.
558
559         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
560
561 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
562
563         Unreviewed, rolling out r221327.
564
565         This change caused test262 failures.
566
567         Reverted changeset:
568
569         "[JSC] Use reifying system for "name" property of builtin
570         JSFunction"
571         https://bugs.webkit.org/show_bug.cgi?id=175260
572         http://trac.webkit.org/changeset/221327
573
574 2017-08-30  Saam Barati  <sbarati@apple.com>
575
576         semicolon is being interpreted as an = in the LiteralParser
577         https://bugs.webkit.org/show_bug.cgi?id=176114
578
579         Reviewed by Oliver Hunt.
580
581         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
582         * stress/resources/literal-parser-test-case.js: Added.
583
584 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
585
586         [ESNext] Async iteration - Implement async iteration statement: for-await-of
587         https://bugs.webkit.org/show_bug.cgi?id=166698
588
589         Reviewed by Yusuke Suzuki.
590
591         * stress/async-iteration-for-await-of-syntax.js: Added.
592         (assert):
593         (checkSyntax):
594         (checkSyntaxError):
595         (checkSimpleAsyncGeneratorSloppyMode):
596         (checkSimpleAsyncGeneratorStrictMode):
597         (checkNestedAsyncGenerators):
598         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
599         * stress/async-iteration-for-await-of.js: Added.
600         (assert):
601         (async.foo):
602         (async.boo):
603         (const.boo.async):
604
605 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
606
607         [JSC] Use reifying system for "name" property of builtin JSFunction
608         https://bugs.webkit.org/show_bug.cgi?id=175260
609
610         Reviewed by Saam Barati.
611
612         * stress/accessors-get-set-prefix.js:
613         * stress/builtin-function-name.js: Added.
614         (shouldBe):
615         (shouldThrow):
616         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
617         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
618
619 2017-08-25  Saam Barati  <sbarati@apple.com>
620
621         Support compiling catch in the DFG
622         https://bugs.webkit.org/show_bug.cgi?id=174590
623         <rdar://problem/34047845>
624
625         Reviewed by Filip Pizlo.
626
627         * microbenchmarks/delta-blue-try-catch.js: Added.
628         (exception):
629         (value):
630         (OrderedCollection):
631         (OrderedCollection.prototype.add):
632         (OrderedCollection.prototype.at):
633         (OrderedCollection.prototype.size):
634         (OrderedCollection.prototype.removeFirst):
635         (OrderedCollection.prototype.remove):
636         (Strength):
637         (Strength.stronger):
638         (Strength.weaker):
639         (Strength.weakestOf):
640         (Strength.strongest):
641         (Strength.prototype.nextWeaker):
642         (Constraint):
643         (Constraint.prototype.addConstraint):
644         (Constraint.prototype.satisfy):
645         (Constraint.prototype.destroyConstraint):
646         (Constraint.prototype.isInput):
647         (UnaryConstraint):
648         (UnaryConstraint.prototype.addToGraph):
649         (UnaryConstraint.prototype.chooseMethod):
650         (UnaryConstraint.prototype.isSatisfied):
651         (UnaryConstraint.prototype.markInputs):
652         (UnaryConstraint.prototype.output):
653         (UnaryConstraint.prototype.recalculate):
654         (UnaryConstraint.prototype.markUnsatisfied):
655         (UnaryConstraint.prototype.inputsKnown):
656         (UnaryConstraint.prototype.removeFromGraph):
657         (StayConstraint):
658         (StayConstraint.prototype.execute):
659         (EditConstraint.prototype.isInput):
660         (EditConstraint.prototype.execute):
661         (BinaryConstraint):
662         (BinaryConstraint.prototype.chooseMethod):
663         (BinaryConstraint.prototype.addToGraph):
664         (BinaryConstraint.prototype.isSatisfied):
665         (BinaryConstraint.prototype.markInputs):
666         (BinaryConstraint.prototype.input):
667         (BinaryConstraint.prototype.output):
668         (BinaryConstraint.prototype.recalculate):
669         (BinaryConstraint.prototype.markUnsatisfied):
670         (BinaryConstraint.prototype.inputsKnown):
671         (BinaryConstraint.prototype.removeFromGraph):
672         (ScaleConstraint):
673         (ScaleConstraint.prototype.addToGraph):
674         (ScaleConstraint.prototype.removeFromGraph):
675         (ScaleConstraint.prototype.markInputs):
676         (ScaleConstraint.prototype.execute):
677         (ScaleConstraint.prototype.recalculate):
678         (EqualityConstraint):
679         (EqualityConstraint.prototype.execute):
680         (Variable):
681         (Variable.prototype.addConstraint):
682         (Variable.prototype.removeConstraint):
683         (Planner):
684         (Planner.prototype.incrementalAdd):
685         (Planner.prototype.incrementalRemove):
686         (Planner.prototype.newMark):
687         (Planner.prototype.makePlan):
688         (Planner.prototype.extractPlanFromConstraints):
689         (Planner.prototype.addPropagate):
690         (Planner.prototype.removePropagateFrom):
691         (Planner.prototype.addConstraintsConsumingTo):
692         (Plan):
693         (Plan.prototype.addConstraint):
694         (Plan.prototype.size):
695         (Plan.prototype.constraintAt):
696         (Plan.prototype.execute):
697         (chainTest):
698         (projectionTest):
699         (change):
700         (deltaBlue):
701         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
702         (assert):
703         (Numbers):
704         (Numbers.prototype.next):
705         (return.Transpose):
706         (return.Transpose.prototype.next):
707         (transpose):
708         (verifyEven):
709         (verifyString):
710         (foo):
711         (runIterators):
712         * microbenchmarks/try-catch-word-count.js: Added.
713         (let.assert):
714         (EOF):
715         (let.texts):
716         (let.o.apply):
717         (foo):
718         (bar):
719         (f):
720         (run):
721         (test1):
722         (test2):
723         (test3):
724         (fn):
725         (A):
726         (B):
727         (A.prototype.getValue):
728         (B.prototype.getParentValue):
729         (strlen):
730         (sum.0):
731         (test):
732         (result.test.o):
733         (set add.set add):
734         (set forEach):
735         (stringHash):
736         (set if):
737         (testFunction):
738         (set delete.set has.set add):
739         * stress/catch-set-argument-speculation-failure.js: Added.
740         (o):
741         (e):
742         (e2):
743         (escape):
744         (baz):
745         (noInline.run):
746         (noInline):
747         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
748         (foo):
749         (e):
750         (baz):
751         (bar):
752
753 2017-08-24  Commit Queue  <commit-queue@webkit.org>
754
755         Unreviewed, rolling out r221119, r221124, and r221143.
756         https://bugs.webkit.org/show_bug.cgi?id=175973
757
758         "I think it regressed JSBench by 20%" (Requested by saamyjoon
759         on #webkit).
760
761         Reverted changesets:
762
763         "Support compiling catch in the DFG"
764         https://bugs.webkit.org/show_bug.cgi?id=174590
765         http://trac.webkit.org/changeset/221119
766
767         "Unreviewed, build fix in GTK port"
768         https://bugs.webkit.org/show_bug.cgi?id=174590
769         http://trac.webkit.org/changeset/221124
770
771         "DFG::JITCode::osrEntry should get sorted since we perform a
772         binary search on it"
773         https://bugs.webkit.org/show_bug.cgi?id=175893
774         http://trac.webkit.org/changeset/221143
775
776 2017-08-24  Michael Saboff  <msaboff@apple.com>
777
778         Add support for RegExp "dotAll" flag
779         https://bugs.webkit.org/show_bug.cgi?id=175924
780
781         Reviewed by Keith Miller.
782
783         Updated tests for new dotAll ('s' flag) changes.
784
785         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
786         * stress/static-getter-in-names.js:
787
788 2017-08-24  Mark Lam  <mark.lam@apple.com>
789
790         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
791         https://bugs.webkit.org/show_bug.cgi?id=175940
792         <rdar://problem/29003921>
793
794         Reviewed by Saam Barati.
795
796         * stress/regress-164081.js: Added.
797         (shouldEqual):
798         (testcase):
799
800 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
801
802         Skip flaky JSC test stress/test-finally.js.
803         https://bugs.webkit.org/show_bug.cgi?id=160283
804
805         Unreviewed test gardening.
806
807         * stress/test-finally.js:
808
809 2017-08-23  Saam Barati  <sbarati@apple.com>
810
811         Support compiling catch in the DFG
812         https://bugs.webkit.org/show_bug.cgi?id=174590
813
814         Reviewed by Filip Pizlo.
815
816         * microbenchmarks/delta-blue-try-catch.js: Added.
817         (exception):
818         (value):
819         (OrderedCollection):
820         (OrderedCollection.prototype.add):
821         (OrderedCollection.prototype.at):
822         (OrderedCollection.prototype.size):
823         (OrderedCollection.prototype.removeFirst):
824         (OrderedCollection.prototype.remove):
825         (Strength):
826         (Strength.stronger):
827         (Strength.weaker):
828         (Strength.weakestOf):
829         (Strength.strongest):
830         (Strength.prototype.nextWeaker):
831         (Constraint):
832         (Constraint.prototype.addConstraint):
833         (Constraint.prototype.satisfy):
834         (Constraint.prototype.destroyConstraint):
835         (Constraint.prototype.isInput):
836         (UnaryConstraint):
837         (UnaryConstraint.prototype.addToGraph):
838         (UnaryConstraint.prototype.chooseMethod):
839         (UnaryConstraint.prototype.isSatisfied):
840         (UnaryConstraint.prototype.markInputs):
841         (UnaryConstraint.prototype.output):
842         (UnaryConstraint.prototype.recalculate):
843         (UnaryConstraint.prototype.markUnsatisfied):
844         (UnaryConstraint.prototype.inputsKnown):
845         (UnaryConstraint.prototype.removeFromGraph):
846         (StayConstraint):
847         (StayConstraint.prototype.execute):
848         (EditConstraint.prototype.isInput):
849         (EditConstraint.prototype.execute):
850         (BinaryConstraint):
851         (BinaryConstraint.prototype.chooseMethod):
852         (BinaryConstraint.prototype.addToGraph):
853         (BinaryConstraint.prototype.isSatisfied):
854         (BinaryConstraint.prototype.markInputs):
855         (BinaryConstraint.prototype.input):
856         (BinaryConstraint.prototype.output):
857         (BinaryConstraint.prototype.recalculate):
858         (BinaryConstraint.prototype.markUnsatisfied):
859         (BinaryConstraint.prototype.inputsKnown):
860         (BinaryConstraint.prototype.removeFromGraph):
861         (ScaleConstraint):
862         (ScaleConstraint.prototype.addToGraph):
863         (ScaleConstraint.prototype.removeFromGraph):
864         (ScaleConstraint.prototype.markInputs):
865         (ScaleConstraint.prototype.execute):
866         (ScaleConstraint.prototype.recalculate):
867         (EqualityConstraint):
868         (EqualityConstraint.prototype.execute):
869         (Variable):
870         (Variable.prototype.addConstraint):
871         (Variable.prototype.removeConstraint):
872         (Planner):
873         (Planner.prototype.incrementalAdd):
874         (Planner.prototype.incrementalRemove):
875         (Planner.prototype.newMark):
876         (Planner.prototype.makePlan):
877         (Planner.prototype.extractPlanFromConstraints):
878         (Planner.prototype.addPropagate):
879         (Planner.prototype.removePropagateFrom):
880         (Planner.prototype.addConstraintsConsumingTo):
881         (Plan):
882         (Plan.prototype.addConstraint):
883         (Plan.prototype.size):
884         (Plan.prototype.constraintAt):
885         (Plan.prototype.execute):
886         (chainTest):
887         (projectionTest):
888         (change):
889         (deltaBlue):
890         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
891         (assert):
892         (Numbers):
893         (Numbers.prototype.next):
894         (return.Transpose):
895         (return.Transpose.prototype.next):
896         (transpose):
897         (verifyEven):
898         (verifyString):
899         (foo):
900         (runIterators):
901         * microbenchmarks/try-catch-word-count.js: Added.
902         (let.assert):
903         (EOF):
904         (let.texts):
905         (let.o.apply):
906         (foo):
907         (bar):
908         (f):
909         (run):
910         (test1):
911         (test2):
912         (test3):
913         (fn):
914         (A):
915         (B):
916         (A.prototype.getValue):
917         (B.prototype.getParentValue):
918         (strlen):
919         (sum.0):
920         (test):
921         (result.test.o):
922         (set add.set add):
923         (set forEach):
924         (stringHash):
925         (set if):
926         (testFunction):
927         (set delete.set has.set add):
928         * stress/catch-set-argument-speculation-failure.js: Added.
929         (o):
930         (e):
931         (e2):
932         (escape):
933         (baz):
934         (noInline.run):
935         (noInline):
936         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
937         (foo):
938         (e):
939         (baz):
940         (bar):
941
942 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
943
944         [JSC] Optimize Map iteration with intrinsic
945         https://bugs.webkit.org/show_bug.cgi?id=174355
946
947         Reviewed by Saam Barati.
948
949         * stress/map-iterator-result-should-have-expected-shape.js: Added.
950         (shouldBe):
951         (throw.new.Error):
952         * stress/set-iterator-result-should-have-expected-shape.js: Added.
953         (shouldBe):
954         (throw.new.Error.let.iterator.set Symbol):
955         (throw.new.Error.set add):
956         (let.iterator.set Symbol):
957
958 2017-08-23  Robin Morisset  <rmorisset@apple.com>
959
960         Add a micro-benchmark for checking that accessing a variable within a 'with'
961         block does not automatically prevent type prediction.
962         https://bugs.webkit.org/show_bug.cgi?id=175738
963
964         Reviewed by Saam Barati.
965
966         * stress/with_and_arith.js: Added.
967         (with):
968
969 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
970
971         [ESNext] Async iteration - Implement Async Generator - runtime
972         https://bugs.webkit.org/show_bug.cgi?id=175240
973
974         Reviewed by Yusuke Suzuki.
975
976         * stress/async-iteration-async-from-sync.js: Added.
977         (assert):
978         (const.Logger):
979         (this.fullfilled):
980         (this.fullfilledDone):
981         (this.rejected):
982         (this.catched):
983         (this.isFinal):
984         (_assertLogger):
985         (const.assertLogger):
986         (const.getPromise.promiseHolder.return.new.Promise):
987         (foo):
988         (async.boo):
989         (bar):
990         (async.baz):
991         (async.goo):
992         * stress/async-iteration-basic.js: Added.
993         (assert):
994         (const.Logger):
995         (this.fullfilled):
996         (this.fullfilledDone):
997         (this.rejected):
998         (this.catched):
999         (this.isFinal):
1000         (_assertLogger):
1001         (const.assertLogger):
1002         (const.getPromise.promiseHolder.return.new.Promise):
1003         (async.generator):
1004         (iterator.next.then):
1005         (async.baz):
1006         (async.boo):
1007         (async.foo):
1008         (async.goo):
1009         (A.prototype.async.foo):
1010         (A.prototype.async.boo):
1011         (A):
1012         (asyncGenExp.async):
1013         (async.joo):
1014         (j.next.then):
1015         (then):
1016         (async.koo):
1017         (async.loo):
1018         (async.moo):
1019         (async.noo):
1020         (async.ooo):
1021         (async.roo):
1022         (async.poo):
1023         (async.soo):
1024         (async.too):
1025         * stress/async-iteration-evaluation.js: Added.
1026         (assert):
1027         (async.foo):
1028         (catch):
1029         * stress/async-iteration-syntax.js:
1030         * stress/async-iteration-yield-promise.js: Added.
1031         (assert):
1032         (const.Logger):
1033         (this.fullfilled):
1034         (this.fullfilledDone):
1035         (this.rejected):
1036         (this.catched):
1037         (this.isFinal):
1038         (_assertLogger):
1039         (const.assertLogger):
1040         (const.getPromise.promiseHolder.return.new.Promise):
1041         (async.foo):
1042         (async.boo):
1043         (async.bar):
1044         * stress/async-iteration-yield-star-interface.js: Added.
1045         (assert):
1046         (const.getPromise.promiseHolder.return.new.Promise):
1047         (const.Logger):
1048         (this.fullfilled):
1049         (this.fullfilledDone):
1050         (this.rejected):
1051         (this.catched):
1052         (this.custom):
1053         (this.isFinal):
1054         (_assertLogger):
1055         (const.assertLogger):
1056         (let.asyncIter.Symbol.asyncIterator):
1057         (let.asyncIter.next):
1058         (let.asyncIter.throw):
1059         (let.asyncIter.return):
1060         (async.foo):
1061         (asyncIter.Symbol.asyncIterator):
1062         (asyncIter.next):
1063         (async.boo):
1064         (asyncIter.return):
1065         (async.bar):
1066         (async.baz):
1067         (async.foobar):
1068         * stress/async-iteration-yield-star.js: Added.
1069         (assert):
1070         (const.Logger):
1071         (this.fullfilled):
1072         (this.fullfilledDone):
1073         (this.rejected):
1074         (this.catched):
1075         (this.custom):
1076         (this.isFinal):
1077         (_assertLogger):
1078         (const.assertLogger):
1079         (const.getPromise.promiseHolder.return.new.Promise):
1080         (async.foo):
1081         (async.boo):
1082         (async.bar):
1083         (async.baz):
1084         (async.joo):
1085         (async.goo):
1086         (async.koo):
1087         (async.loo):
1088         (let.asyncIter.Symbol.asyncIterator):
1089         (let.asyncIter.next):
1090         (let.asyncIter.throw):
1091         (let.asyncIter.return):
1092         (async.moo):
1093         (async.noo):
1094         * test262.yaml:
1095
1096 2017-08-23  JF Bastien  <jfbastien@apple.com>
1097
1098         Fix printing in test
1099
1100         Unreviewed: fixing verbosity, shouldn't have been there.
1101
1102         * wasm/regress/175693.js:
1103         (else.else):
1104         (catch):
1105
1106 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
1107
1108         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
1109         https://bugs.webkit.org/show_bug.cgi?id=172543
1110
1111         Unreviewed test gardening.
1112
1113         * microbenchmarks/generator-with-several-types.js:
1114
1115 2017-08-17  JF Bastien  <jfbastien@apple.com>
1116
1117         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
1118         https://bugs.webkit.org/show_bug.cgi?id=175693
1119         <rdar://problem/33952443>
1120
1121         Reviewed by Saam Barati.
1122
1123         Add a regression directory for WebAssembly tests.
1124
1125         * wasm.yaml:
1126         * wasm/regress/175693.js: Added.
1127         (else.else):
1128         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
1129         (catch):
1130         * wasm/regress/175693.wasm: Added.
1131
1132 2017-08-15  Robin Morisset  <rmorisset@apple.com>
1133
1134         Support the 'with' keyword in FTL.
1135         https://bugs.webkit.org/show_bug.cgi?id=175585
1136
1137         Reviewed by Saam Barati.
1138
1139         Also improve the JSTest/stress/with.js file to test
1140         what happens when non-objects are passed to with.
1141
1142         * stress/with.js:
1143         (foo):
1144         (i.catch):
1145         (i.with): Deleted.
1146
1147 2017-08-14  Keith Miller  <keith_miller@apple.com>
1148
1149         Add testing tool to lie to the DFG about profiles
1150         https://bugs.webkit.org/show_bug.cgi?id=175487
1151
1152         Reviewed by Saam Barati.
1153
1154         * stress/compare-eq-incomplete-profile.js: Added.
1155         (const.test.createBuiltin):
1156
1157 2017-08-14  Robin Morisset  <rmorisset@apple.com>
1158
1159         Support the with keyword in DFG
1160         https://bugs.webkit.org/show_bug.cgi?id=175470
1161
1162         Reviewed by Saam Barati.
1163
1164         Added a new stress-test for the 'with' keyword, that caught a bug in a
1165         previous version of this code.
1166
1167         * stress/with.js: Added.
1168         (i.with):
1169
1170 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
1171
1172         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
1173         https://bugs.webkit.org/show_bug.cgi?id=175544
1174
1175         Unreviewed test gardening.
1176
1177         * ChakraCore.yaml:
1178
1179 2017-08-09  Caitlin Potter  <caitp@igalia.com>
1180
1181         Early error on ANY operator before new.target
1182         https://bugs.webkit.org/show_bug.cgi?id=157970
1183
1184         Reviewed by Saam Barati.
1185
1186         Instead of throwing if any unary operator precedes new.target, only
1187         throw if the unary operator updates the reference.
1188
1189         The following become legal in JSC:
1190
1191         ```
1192         !new.target
1193         ~new.target
1194         typeof new.target
1195         delete new.target
1196         void new.target
1197         ```
1198
1199         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
1200
1201         * stress/new-target-syntax-errors.js:
1202         * stress/new-target.js:
1203
1204 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
1205
1206         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
1207         https://bugs.webkit.org/show_bug.cgi?id=175255
1208
1209         Unreviewed test gardening.
1210
1211         * stress/regress-169783.js:
1212         * wasm/stress/oom.js:
1213
1214 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
1215
1216         REGRESSION: 2 test262/test/language/statements/async-function failures
1217         https://bugs.webkit.org/show_bug.cgi?id=175334
1218
1219         Reviewed by Yusuke Suzuki.
1220
1221         Add @skip parameters to tests, and remove test for async iterator from 
1222         async await syntax test because it is already covered by async-iterator-syntax.js
1223
1224         * stress/async-await-syntax.js:
1225         * stress/async-iteration-syntax.js:
1226
1227 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1228
1229         Unreviewed, gardening test262 for Promise resolve / reject function length
1230         https://bugs.webkit.org/show_bug.cgi?id=175333
1231
1232         * test262.yaml:
1233
1234 2017-08-07  Robin Morisset  <rmorisset@apple.com>
1235
1236         GetOwnProperty of TypedArray indexed fields is wrongly configurable
1237         https://bugs.webkit.org/show_bug.cgi?id=175307
1238
1239         Reviewed by Saam Barati.
1240
1241         * stress/typedarray-getownproperty-not-configurable.js: Added.
1242         (assert):
1243         (foo):
1244
1245 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1246
1247         Promise resolve and reject function should have length = 1
1248         https://bugs.webkit.org/show_bug.cgi?id=175242
1249
1250         Reviewed by Saam Barati.
1251
1252         * stress/builtin-function-length.js: Added.
1253         (shouldBe):
1254         (shouldThrow):
1255         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
1256         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
1257
1258 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
1259
1260         [ESNext] Async iteration - Implement Async Generator - parser
1261         https://bugs.webkit.org/show_bug.cgi?id=175210
1262
1263         Reviewed by Yusuke Suzuki.
1264
1265         * stress/async-await-syntax.js:
1266         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1267         * stress/async-iteration-syntax.js: Added.
1268         (assert):
1269         (checkSyntax):
1270         (checkSyntaxError):
1271         (checkSimpleAsyncGeneratorSloppyMode):
1272         (checkSimpleAsyncGeneratorStrictMode):
1273         (checkNestedAsyncGenerators):
1274         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
1275         * stress/generator-class-methods-syntax.js:
1276
1277 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1278
1279         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
1280         https://bugs.webkit.org/show_bug.cgi?id=175150
1281
1282         Unreviewed test gardening.
1283
1284         * wasm/js-api/test_memory_constructor.js:
1285
1286 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
1287
1288         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
1289         https://bugs.webkit.org/show_bug.cgi?id=175100
1290
1291         Reviewed by Mark Lam.
1292
1293         The JSC test JSTests/wasm/stress/oom.js tries to use all the
1294         available memory until an out of memory exception happens.
1295
1296         The Linux kernel is more tuned for server workloads than for GUI
1297         responsiveness. When a process tries to use a lot of memory, Linux
1298         will do its best to serve the request. This usually translates to
1299         free physical RAM by writing to disk dirty pages and/or moving out
1300         less recently used pages to swap (disk storage).
1301         Meanwhile it does this, the system will become unresponsive and this
1302         leads to freezes that can last even some minutes on the worst cases.
1303
1304         Therefore, let's skip this test on Linux as it will cause more harm
1305         than good on the Linux bots or on the machines of Linux developers.
1306
1307         * wasm/stress/oom.js:
1308
1309 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1310
1311         [JSC] Remove unnecessary print from stress\promise-finally.js test
1312         https://bugs.webkit.org/show_bug.cgi?id=175015
1313
1314         Reviewed by Yusuke Suzuki.
1315
1316         * stress/promise-finally.js:
1317         (p.finally):
1318         (then):
1319
1320 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1321
1322         Unreviewed, update test262 results for optional catch binding
1323
1324         * test262.yaml:
1325
1326 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
1327
1328         [JSC] Support optional catch binding
1329         https://bugs.webkit.org/show_bug.cgi?id=174981
1330
1331         Reviewed by Saam Barati.
1332
1333         * stress/optional-catch-binding-syntax.js: Added.
1334         (testSyntax):
1335         (testSyntaxError):
1336         (catch.catch):
1337         * stress/optional-catch-binding.js: Added.
1338         (shouldBe):
1339         (throwException):
1340
1341 2017-07-28  Mark Lam  <mark.lam@apple.com>
1342
1343         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
1344         https://bugs.webkit.org/show_bug.cgi?id=174948
1345         <rdar://problem/33495680>
1346
1347         Reviewed by Filip Pizlo.
1348
1349         * stress/regress-174948.js: Added.
1350
1351 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
1352
1353         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
1354         https://bugs.webkit.org/show_bug.cgi?id=174900
1355
1356         Reviewed by Saam Barati.
1357
1358         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
1359         (sideEffect):
1360         (args):
1361         (test):
1362
1363 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1364
1365         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
1366         https://bugs.webkit.org/show_bug.cgi?id=171637
1367
1368         Reviewed by Darin Adler.
1369
1370         * stress/domjit-getter-complex-with-incorrect-object.js:
1371         (i.shouldThrow):
1372         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
1373         (shouldBe):
1374         (i.shouldThrow):
1375
1376 2017-07-26  JF Bastien  <jfbastien@apple.com>
1377
1378         WebAssembly: test throwing out of the start function
1379         https://bugs.webkit.org/show_bug.cgi?id=165714
1380         <rdar://problem/29760251>
1381
1382         Reviewed by Keith Miller.
1383
1384         * wasm/assert.js:
1385         * wasm/function-tests/trap-from-start.js: Added.
1386         (StartTraps):
1387         * wasm/function-tests/trap-from-start-async.js: Added.
1388         (async.StartTrapsAsync):
1389
1390 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1391
1392         [FTL] Arguments elimination is suppressed by unreachable blocks
1393         https://bugs.webkit.org/show_bug.cgi?id=174352
1394
1395         Reviewed by Filip Pizlo.
1396
1397         * stress/arguments-elimination-force-exit.js: Added.
1398         (shouldBe):
1399         (strict):
1400         (sloppy):
1401         * stress/arguments-elimination-throw.js: Added.
1402         (shouldBe):
1403         (shouldThrow):
1404         (sloppy):
1405         (isArguments):
1406
1407 2017-07-13  Mark Lam  <mark.lam@apple.com>
1408
1409         Add some additional test cases for bug 170896.
1410         https://bugs.webkit.org/show_bug.cgi?id=174491
1411
1412         Reviewed by Filip Pizlo.
1413
1414         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
1415         * stress/regress-170896-with-double-shape-profile.js: Added.
1416         (test):
1417         * stress/regress-170896-with-int32-shape-profile.js: Added.
1418         (test):
1419         * stress/regress-170896.js: Removed.
1420
1421 2017-07-13  Saam Barati  <sbarati@apple.com>
1422
1423         Missing exception check in JSObject::hasInstance
1424         https://bugs.webkit.org/show_bug.cgi?id=174455
1425         <rdar://problem/31384608>
1426
1427         Reviewed by Mark Lam.
1428
1429         * stress/has-instance-exception-check.js: Added.
1430         (assert):
1431         (let.getter.Object.getOwnPropertyDescriptor.get foo):
1432
1433 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
1434
1435         [ESnext] Implement Object Spread
1436         https://bugs.webkit.org/show_bug.cgi?id=167963
1437
1438         Reviewed by Saam Barati.
1439
1440         * stress/obj-rest-destructuring-order.js: Added.
1441         (assert):
1442         (o.get z):
1443         (o.get a):
1444         * stress/obj-spread-order.js: Added.
1445         (assert):
1446         (o.get z):
1447         (o.get a):
1448         * stress/object-spread.js: Added.
1449         (let.assert):
1450         (assert.sameValue):
1451         (let.o.get a):
1452         (let.obj.get c):
1453         (cthulhu.get x):
1454         (let.obj.set c):
1455         (calls.o.get z):
1456         (calls.o.get a):
1457         (try.let.obj.get foo):
1458         (get calls):
1459
1460 2017-07-12  Saam Barati  <sbarati@apple.com>
1461
1462         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
1463         https://bugs.webkit.org/show_bug.cgi?id=174411
1464         <rdar://problem/31696186>
1465
1466         Reviewed by Mark Lam.
1467
1468         * stress/generic-arguments-correct-delete-behavior.js: Added.
1469         (assert):
1470         (makeTest):
1471
1472 2017-07-07  Mark Lam  <mark.lam@apple.com>
1473
1474         \n\r is not the same as \r\n.
1475         https://bugs.webkit.org/show_bug.cgi?id=173053
1476
1477         Reviewed by Keith Miller.
1478
1479         * stress/regress-173053.js: Added.
1480         * stress/template-literal-line-terminators.js:
1481
1482 2017-07-06  Saam Barati  <sbarati@apple.com>
1483
1484         We are missing places where we invalidate the for-in context
1485         https://bugs.webkit.org/show_bug.cgi?id=174184
1486
1487         Reviewed by Geoffrey Garen.
1488
1489         * stress/for-in-invalidate-context-weird-assignments.js: Added.
1490         (assert):
1491         (test):
1492
1493 2017-07-05  Saam Barati  <sbarati@apple.com>
1494
1495         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
1496         https://bugs.webkit.org/show_bug.cgi?id=174188
1497         <rdar://problem/30581423>
1498
1499         Reviewed by Mark Lam.
1500
1501         * stress/new-array-having-a-bad-time-double.js: Added.
1502         (assert):
1503         (foo):
1504
1505 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1506
1507         WTF::StringImpl::copyChars segfaults when built with GCC 7
1508         https://bugs.webkit.org/show_bug.cgi?id=173407
1509
1510         Reviewed by Andreas Kling.
1511
1512         * stress/string-repeat-copy-chars-crash.js: Added.
1513         (shouldBe):
1514
1515 2017-07-03  Saam Barati  <sbarati@apple.com>
1516
1517         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
1518
1519         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1520
1521 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1522
1523         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
1524
1525         It requires too much memory.
1526
1527         * stress/dont-reserve-huge-capacity-lexer.js:
1528
1529 2017-06-30  Michael Saboff  <msaboff@apple.com>
1530
1531         Skip a test on ARM64 platform since we run out of address space.
1532
1533         Rubber stamped by Saam Barati.
1534
1535         * stress/dont-reserve-huge-capacity-lexer.js:
1536
1537 2017-06-30  Michael Saboff  <msaboff@apple.com>
1538
1539         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
1540         https://bugs.webkit.org/show_bug.cgi?id=174044
1541
1542         Reviewed by Oliver Hunt.
1543
1544         New regression test.
1545
1546         * stress/regress-174044.js: Added.
1547         (test1):
1548         (test2):
1549
1550 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
1551
1552         RegExpCachedResult::setInput should reify left and right contexts
1553         https://bugs.webkit.org/show_bug.cgi?id=173818
1554
1555         Reviewed by Keith Miller.
1556
1557         * stress/right-left-context-invalidated-by-input.js: Added.
1558         (test.validateContexts):
1559         (test):
1560
1561 2017-06-29  Saam Barati  <sbarati@apple.com>
1562
1563         Calculating postCapacity in unshiftCountSlowCase is wrong
1564         https://bugs.webkit.org/show_bug.cgi?id=173992
1565         <rdar://problem/32283199>
1566
1567         Reviewed by Keith Miller.
1568
1569         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
1570         (temp):
1571
1572 2017-06-29  Commit Queue  <commit-queue@webkit.org>
1573
1574         Unreviewed, rolling out r218512.
1575         https://bugs.webkit.org/show_bug.cgi?id=173981
1576
1577         "It changes the behavior of the JS API's JSEvaluateScript
1578         which breaks TurboTax" (Requested by saamyjoon on #webkit).
1579
1580         Reverted changeset:
1581
1582         "test262: Completion values for control flow do not match the
1583         spec"
1584         https://bugs.webkit.org/show_bug.cgi?id=171265
1585         http://trac.webkit.org/changeset/218512
1586
1587 2017-06-27  JF Bastien  <jfbastien@apple.com>
1588
1589         WebAssembly: running out of executable memory should throw OoM
1590         https://bugs.webkit.org/show_bug.cgi?id=171537
1591         <rdar://problem/32963338>
1592
1593         Reviewed by Saam Barati.
1594
1595         * wasm.yaml:
1596         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
1597         (const.invoke):
1598         (failCount.0.catch):
1599         (failCount.0.module.undefined.catch):
1600         * wasm/lowExecutableMemory/exports-oom.js: Added.
1601         (const.type):
1602         (const.params):
1603         (const.randomProgram):
1604         (failCount.0.catch):
1605         (failCount.0.module.undefined.catch):
1606         * wasm/lowExecutableMemory/imports-oom.js: Added.
1607         (const.type):
1608         (const.params):
1609         (const.randomProgram):
1610         (f.imports.push):
1611         (failCount.0.catch):
1612         (failCount.0.module.undefined.catch):
1613
1614 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
1615
1616         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
1617         https://bugs.webkit.org/show_bug.cgi?id=167962
1618
1619         Reviewed by Saam Barati.
1620
1621         * stress/object-rest-deconstruct.js: Added.
1622         (let.assert):
1623         (let.assertPropDescriptor):
1624         (catch):
1625         (get 3):
1626         (foo):
1627         (let.src.get y):
1628         (let.src.set y):
1629         (let.gen):
1630
1631 2017-06-27  Saam Barati  <sbarati@apple.com>
1632
1633         Function constructor needs to follow the spec and validate parameters and body independently
1634         https://bugs.webkit.org/show_bug.cgi?id=173303
1635         <rdar://problem/32732526>
1636
1637         Reviewed by Keith Miller.
1638
1639         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1640         * stress/function-constructor-semantics.js: Added.
1641         (assert):
1642         (hasSyntaxError):
1643         (foo):
1644         (async.foo):
1645         (testError):
1646         (testOK.toString):
1647         (toString):
1648
1649 2017-06-26  Saam Barati  <sbarati@apple.com>
1650
1651         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
1652         https://bugs.webkit.org/show_bug.cgi?id=173740
1653
1654         Reviewed by Mark Lam.
1655
1656         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
1657         (Array.prototype.Symbol.iterator):
1658
1659 2017-06-26  Saam Barati  <sbarati@apple.com>
1660
1661         Skip a test on 32-bit platforms since we run out of address space.
1662
1663         Rubber stamped by Mark Lam.
1664
1665         * stress/dont-reserve-huge-capacity-lexer.js:
1666
1667 2017-06-26  Saam Barati  <sbarati@apple.com>
1668
1669         Crash in JSC::Lexer<unsigned char>::setCode
1670         https://bugs.webkit.org/show_bug.cgi?id=172754
1671
1672         Reviewed by Mark Lam.
1673
1674         * stress/dont-reserve-huge-capacity-lexer.js: Added.
1675         (catch):
1676
1677 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1678
1679         [JSC] Clean up Object.entries implementation
1680         https://bugs.webkit.org/show_bug.cgi?id=173759
1681
1682         Reviewed by Sam Weinig.
1683
1684         * microbenchmarks/object-entries.js: Added.
1685         (test):
1686
1687 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
1688
1689         Remove Reflect.enumerate
1690         https://bugs.webkit.org/show_bug.cgi?id=173806
1691
1692         Reviewed by Yusuke Suzuki.
1693
1694         * ChakraCore.yaml:
1695         * es6.yaml:
1696         These tests now fail because they use Reflect.enumerate.
1697
1698         * test262.yaml:
1699         This test now passes, it checked that Reflect.enumerate is undefined!
1700
1701         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
1702         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
1703
1704         * stress/reflect-enumerate.js: Removed.
1705         Remove a test solely for Reflect.enumerate.
1706
1707 2017-06-22  Saam Barati  <sbarati@apple.com>
1708
1709         ValueRep(DoubleRep(@v)) can not simply convert to @v
1710         https://bugs.webkit.org/show_bug.cgi?id=173687
1711         <rdar://problem/32855563>
1712
1713         Reviewed by Mark Lam.
1714
1715         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
1716         (i.catch):
1717
1718 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1719
1720         [JSC] Object.values should be implemented in C++
1721         https://bugs.webkit.org/show_bug.cgi?id=173703
1722
1723         Reviewed by Sam Weinig.
1724
1725         * microbenchmarks/object-keys-map-values.js: Added.
1726         (test):
1727         * microbenchmarks/object-values.js: Added.
1728         (test):
1729         * stress/object-values-changing-properties.js: Added.
1730         (shouldBe):
1731         (throw.new.Error.let.source.get x):
1732         (throw.new.Error):
1733         (shouldBe.let.handler.get order):
1734         (get let):
1735         (shouldBe.let.handler.get return):
1736         (let.handler.get order):
1737
1738 2017-06-21  Saam Barati  <sbarati@apple.com>
1739
1740         eval virtual call is incorrect in the baseline JIT
1741         https://bugs.webkit.org/show_bug.cgi?id=173587
1742         <rdar://problem/32867897>
1743
1744         Reviewed by Michael Saboff.
1745
1746         * stress/do-eval-virtual-call-correctly.js: Added.
1747         (assert):
1748         (f):
1749         (i.test):
1750         (catch):
1751
1752 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
1753
1754         Update test262 test expectations after r218581.
1755
1756         Unreviewed test gardening.
1757
1758         * test262.yaml:
1759
1760 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
1761
1762         Revert changes in bug#160417 about extending `null` not being a derived class
1763         https://bugs.webkit.org/show_bug.cgi?id=169293
1764
1765         Reviewed by Saam Barati.
1766
1767         * stress/class-derived-from-null.js:
1768         (assertThrow):
1769         (test1):
1770         (test2):
1771         (test3):
1772         (test4):
1773         (test5):
1774         (test6):
1775
1776 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1777
1778         [DFG] More ArrayIndexOf fixups for various types
1779         https://bugs.webkit.org/show_bug.cgi?id=173176
1780
1781         Reviewed by Saam Barati.
1782
1783         * stress/array-indexof-arraystorage.js: Added.
1784         (shouldBe):
1785         (indexOfInt32Other):
1786         (indexOfInt32Cell):
1787         (indexOfInt32Boolean):
1788         (indexOfDoubleOther):
1789         (indexOfDoubleCell):
1790         (indexOfDoubleBoolean):
1791         (indexOfInt32):
1792         (indexOfDouble):
1793         * stress/array-indexof-constant-folding.js: Added.
1794         (shouldBe):
1795         (indexOfInt32Other):
1796         (indexOfInt32Cell):
1797         (indexOfInt32Boolean):
1798         (indexOfDoubleOther):
1799         (indexOfDoubleCell):
1800         (indexOfDoubleBoolean):
1801         * stress/array-indexof-hole-and-other.js: Added.
1802         (shouldBe):
1803         (indexOf):
1804         * stress/array-indexof-other.js: Added.
1805         (shouldBe):
1806         (indexOfInt32):
1807         (indexOfDouble):
1808         (indexOfString):
1809         (indexOfObject):
1810         * stress/array-indexof-symbol.js: Added.
1811         (shouldBe):
1812         (indexOfInt32):
1813         (indexOfDouble):
1814         (indexOfString):
1815         (indexOfObject):
1816
1817 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
1818
1819         test262: Completion values for control flow do not match the spec
1820         https://bugs.webkit.org/show_bug.cgi?id=171265
1821
1822         Reviewed by Saam Barati.
1823
1824         * stress/completion-value.js:
1825         Condensed test for completion values in top level statements.
1826
1827         * stress/super-get-by-id.js:
1828         ClassDeclaration when evaled no longer produce values. Convert
1829         these to ClassExpressions so they produce the class value.
1830         
1831         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1832         This is a progression for currect spec behavior.
1833
1834         * mozilla/mozilla-tests.yaml:
1835         This test is now outdated, so mark it as failing for that reason.
1836
1837         * test262.yaml:
1838         Passing all "cptn" completion value tests.
1839
1840 2017-06-17  Keith Miller  <keith_miller@apple.com>
1841
1842         ArrayBuffer constructor needs to create subclass structures before its buffer
1843         https://bugs.webkit.org/show_bug.cgi?id=173510
1844
1845         Reviewed by Yusuke Suzuki.
1846
1847         * test262.yaml:
1848
1849 2017-06-17  Keith Miller  <keith_miller@apple.com>
1850
1851         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
1852         https://bugs.webkit.org/show_bug.cgi?id=173506
1853
1854         Reviewed by Ryosuke Niwa.
1855
1856         Re-baseline tests.
1857
1858         * ChakraCore/test/Function/apply3.baseline-jsc:
1859         * test262.yaml:
1860
1861 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1862
1863         [JSC] Add fast path for Object.assign
1864         https://bugs.webkit.org/show_bug.cgi?id=173416
1865
1866         Reviewed by Mark Lam.
1867
1868         * stress/object-assign-changing-properties.js: Added.
1869         (shouldBe):
1870         (throw.new.Error.let.source.get x):
1871         (throw.new.Error):
1872         (shouldBe.let.source.get x):
1873         (shouldBe.let.target.set x):
1874         (shouldBe.let.target.get x):
1875         * stress/object-assign-proxy.js: Added.
1876         (shouldBe):
1877         (throw.new.Error.let.handler.get order):
1878
1879 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1880
1881         [JSC] Implement Object.assign in C++
1882         https://bugs.webkit.org/show_bug.cgi?id=173414
1883
1884         Reviewed by Saam Barati.
1885
1886         * stress/object-assign-string-first.js: Added.
1887         (shouldBe):
1888         (source.get Symbol):
1889         (source.get 1):
1890         (source.get cocoa):
1891
1892 2017-06-14  JF Bastien  <jfbastien@apple.com>
1893
1894         WebAssembly: remove empty test files
1895         https://bugs.webkit.org/show_bug.cgi?id=173382
1896
1897         Reviewed by Saam Barati.
1898
1899         The following files:
1900                 JSTests/wasm/function-tests/call-indirect-params.js
1901                 JSTests/wasm/function-tests/call-indirect.js
1902                 JSTests/wasm/js-api/call-indirect-results.js
1903         Were changed to empty files in https://trac.webkit.org/changeset/209771
1904
1905         They were testing call_indirect with the wrong semantics, before
1906         we implemented tables. That change implemented tables and
1907         therefore removed the erroneous tests.
1908
1909         We have a few tests for call_indirect which already do the right thing:
1910                 JSTests/wasm/function-tests/context-switch.js
1911                 JSTests/wasm/function-tests/exceptions.js
1912                 JSTests/wasm/function-tests/grow-memory-2.js
1913                 JSTests/wasm/function-tests/stack-overflow.js
1914                 JSTests/wasm/function-tests/table-basic-2.js
1915                 JSTests/wasm/function-tests/table-basic.js
1916                 JSTests/wasm/js-api/call-indirect.js
1917                 JSTests/wasm/js-api/table.js
1918                 JSTests/wasm/js-api/unique-signature.js
1919                 JSTests/wasm/js-api/wrapper-function.js
1920
1921         I also just imported the updated spec tests which, among other
1922         things, test call_indirect:
1923                 core/br.wast
1924                 core/br_table.wast
1925                 core/call_indirect.wast
1926                 core/func.wast
1927                 core/func_ptrs.wast
1928                 core/imports.wast
1929                 core/left-to-right.wast
1930                 core/linking.wast
1931                 core/nop.wast
1932                 core/return.wast
1933                 core/typecheck.wast
1934                 core/unreachable.wast
1935
1936         So I think it's OK to just delete the tests which should just have
1937         been deleted back when tables were added.
1938
1939         * wasm/function-tests/call-indirect-params.js: Removed.
1940         * wasm/function-tests/call-indirect.js: Removed.
1941         * wasm/js-api/call-indirect-results.js: Removed.
1942
1943 2017-06-13  JF Bastien  <jfbastien@apple.com>
1944
1945         WebAssembly: import updated spec tests
1946         https://bugs.webkit.org/show_bug.cgi?id=173287
1947         <rdar://problem/32725975>
1948
1949         Reviewed by Saam Barati.
1950
1951         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
1952         with a few modifications so things work.
1953
1954         Fix a bunch of bugs found through this process, and punt a few tests (which I
1955         marked as blocked by this bug).
1956
1957         Fixes:
1958
1959         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
1960         instead of byte alignment. It was also missing memory-alignment.js despite it
1961         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
1962         pass.
1963
1964         Tables can be imported or in a section. There can be only one, but sections can
1965         be empty. An Elements section can exist if there's no Table, as long as it is
1966         also empty.
1967
1968         Memories can be imported or in a section. There can be only one, but sections
1969         can be empty. A Data section can exist if there's no Memory, as long as it is
1970         also empty.
1971
1972         Prototypes: stringify without .prototype. in the string.
1973
1974         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
1975         not a final size, and throws a RangeError on failure, not a TypeError.
1976
1977         Fix compile / instantiate so the reject the promise if given an argument of the
1978         wrong type (instead of failing instantly).
1979
1980         Fix async on neuter test.
1981
1982         Element section shouldn't affect any Table if any of the elements are out of
1983         bounds. We need to process it in two passes.
1984
1985         Segment section shouldn't affect any Data if any of the segments are out of
1986         bounds. We need to process it in two passes.
1987
1988         Empty data segments are valid, but only when there is no memory. Their index
1989         still gets validated, and has to be zero.
1990
1991         Punts:
1992
1993         Error messages with context, the test seems overly restrictive but this is
1994         minor.
1995
1996         compile/instantiate/validate property descriptors.
1997
1998         UTF-8 bugs.
1999
2000         Temporarily disable NaN tests. We need to go back and implement the following
2001         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
2002         much as getting all the other tests passing.
2003
2004         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
2005         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
2006         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
2007         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
2008         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
2009         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
2010         why they're not allowed.
2011
2012         * wasm.yaml:
2013         * wasm/function-tests/i32-load8-s.js:
2014         * wasm/function-tests/memory-access-past-4gib.js:
2015         (const.op.of.WASM.opcodes):
2016         * wasm/function-tests/memory-alignment.js: Added.
2017         (const.op.of.WASM.opcodes):
2018         * wasm/function-tests/memory-section-and-import.js:
2019         * wasm/js-api/Module-compile.js:
2020         (async.testPromiseAPI):
2021         * wasm/js-api/dont-mmap-zero-byte-memory.js:
2022         (testMems):
2023         * wasm/js-api/element.js:
2024         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2025         * wasm/js-api/neutered-inputs.js:
2026         (const.testFunction): Deleted.
2027         (const.testConstructor): Deleted.
2028         * wasm/js-api/table.js:
2029         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
2030         (new.WebAssembly.Module):
2031         (assert.throws):
2032         (assertBadTableImport):
2033         (assert.throws.WebAssembly.Table.prototype.grow):
2034         (assertBadTableInstance): Deleted.
2035         * wasm/js-api/test_Data.js:
2036         (DataSectionWithoutMemory):
2037         * wasm/spec-harness/index.js:
2038         (module):
2039         (uniqueTest): Deleted.
2040         (assert_invalid): Deleted.
2041         (assert_soft_invalid): Deleted.
2042         (register): Deleted.
2043         (call): Deleted.
2044         (get instance): Deleted.
2045         (exports): Deleted.
2046         (run): Deleted.
2047         (assert_unlinkable): Deleted.
2048         (assert_uninstantiable): Deleted.
2049         (assert_trap): Deleted.
2050         (try.f): Deleted.
2051         (catch): Deleted.
2052         (assert_exhaustion): Deleted.
2053         (assert_return): Deleted.
2054         (assert_return_nan): Deleted.
2055         * wasm/spec-harness/testharness.css: Removed.
2056         * wasm/spec-harness/testharness.js: Removed.
2057         * wasm/spec-harness/testharnessreport.js: Removed.
2058         * wasm/spec-harness/wasm-constants.js:
2059         (assertTraps):
2060         (assertWasmThrows):
2061         * wasm/spec-harness/wasm-module-builder.js:
2062         (Binary.prototype.emit_section):
2063         (Binary):
2064         (WasmFunctionBuilder.prototype.addBody):
2065         (WasmFunctionBuilder.prototype.end):
2066         (WasmFunctionBuilder):
2067         (WasmModuleBuilder.prototype.stringToBytes):
2068         (WasmModuleBuilder.prototype.addCustomSection):
2069         (WasmModuleBuilder.prototype.addFunctionTableInit):
2070         (WasmModuleBuilder.prototype.appendToTable):
2071         (WasmModuleBuilder.prototype.toArray):
2072         (WasmModuleBuilder.prototype.toBuffer):
2073         (WasmModuleBuilder.prototype.instantiate):
2074         (WasmModuleBuilder):
2075         * wasm/spec-tests/address.wast.js:
2076         * wasm/spec-tests/align.wast.js: Added.
2077         * wasm/spec-tests/binary.wast.js:
2078         * wasm/spec-tests/block.wast.js:
2079         * wasm/spec-tests/br.wast.js:
2080         * wasm/spec-tests/br_if.wast.js:
2081         * wasm/spec-tests/br_table.wast.js:
2082         * wasm/spec-tests/call.wast.js:
2083         * wasm/spec-tests/call_indirect.wast.js:
2084         * wasm/spec-tests/comments.wast.js:
2085         * wasm/spec-tests/const.wast.js: Added.
2086         * wasm/spec-tests/conversions.wast.js: Added.
2087         * wasm/spec-tests/custom_section.wast.js:
2088         * wasm/spec-tests/exports.wast.js:
2089         * wasm/spec-tests/f32.wast.js: Added.
2090         * wasm/spec-tests/f64.wast.js: Added.
2091         * wasm/spec-tests/fac.wast.js:
2092         * wasm/spec-tests/float_exprs.wast.js: Added.
2093         * wasm/spec-tests/float_misc.wast.js: Added.
2094         * wasm/spec-tests/func.wast.js:
2095         * wasm/spec-tests/globals.wast.js:
2096         * wasm/spec-tests/if.wast.js:
2097         * wasm/spec-tests/imports.wast.js:
2098         * wasm/spec-tests/inline-module.wast.js: Added.
2099         * wasm/spec-tests/jsapi.js:
2100         (testJSAPI.test):
2101         (testJSAPI):
2102         * wasm/spec-tests/labels.wast.js:
2103         * wasm/spec-tests/loop.wast.js:
2104         * wasm/spec-tests/memory.wast.js:
2105         * wasm/spec-tests/memory_trap.wast.js: Added.
2106         * wasm/spec-tests/names.wast.js:
2107         * wasm/spec-tests/nop.wast.js:
2108         * wasm/spec-tests/return.wast.js:
2109         * wasm/spec-tests/stack.wast.js:
2110         * wasm/spec-tests/token.wast.js: Added.
2111         * wasm/spec-tests/type.wast.js: Added.
2112         * wasm/spec-tests/typecheck.wast.js:
2113         * wasm/spec-tests/unreachable.wast.js:
2114         * wasm/spec-tests/unreached-invalid.wast.js:
2115         * wasm/spec-tests/unwind.wast.js:
2116         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
2117         * wasm/spec-tests/utf8-import-field.wast.js: Added.
2118         * wasm/spec-tests/utf8-import-module.wast.js: Added.
2119
2120 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
2121
2122         Unreviewed JSC test gardening.
2123
2124         * stress/check-string-ident.js:
2125         * stress/new-largeish-contiguous-array-with-size.js:
2126
2127 2017-06-13  Michael Saboff  <msaboff@apple.com>
2128
2129         DFG doesn't properly handle a property that is change to read only in a prototype
2130         https://bugs.webkit.org/show_bug.cgi?id=173321
2131
2132         Reviewed by Filip Pizlo.
2133
2134         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
2135         * stress/regress-173321.js: Added new regression test.
2136         (shouldBe):
2137         (SimpleObject):
2138         (test):
2139
2140 2017-06-12  Saam Barati  <sbarati@apple.com>
2141
2142         Update test262 test expectation since r218082 makes new tests pass.
2143
2144         * test262.yaml:
2145
2146 2017-06-12  Saam Barati  <sbarati@apple.com>
2147
2148         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
2149         https://bugs.webkit.org/show_bug.cgi?id=172957
2150         <rdar://problem/32602704>
2151
2152         Reviewed by Filip Pizlo.
2153
2154         * stress/spec-empty-flows-through-cell-checks.js: Added.
2155         (A):
2156         (B):
2157         (i.catch):
2158
2159 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
2160
2161         We incorrectly allow escaped characters in keyword tokens
2162         https://bugs.webkit.org/show_bug.cgi?id=171310
2163
2164         Reviewed by Yusuke Suzuki.
2165
2166         * stress/destructuring-assignment-syntax.js:
2167         * stress/error-messages-for-in-operator-should-not-crash.js:
2168         (catch):
2169         * stress/reserved-word-with-escape.js:
2170         (testSyntaxError.String.raw.v):
2171         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
2172         (testSyntaxError.String.raw.a):
2173         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
2174
2175 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2176
2177         [DFG] Add ArrayIndexOf intrinsic
2178         https://bugs.webkit.org/show_bug.cgi?id=172421
2179
2180         Reviewed by Saam Barati.
2181
2182         * stress/array-indexof-array-prototype-change.js: Added.
2183         (shouldBe):
2184         (indexOfInt32):
2185         * stress/array-indexof-have-a-bad-time-getter.js: Added.
2186         (shouldBe):
2187         (indexOfInt32):
2188         * stress/array-indexof-have-a-bad-time.js: Added.
2189         (shouldBe):
2190         (indexOfInt32):
2191         * stress/array-indexof-hole-with-prototype.js: Added.
2192         (shouldBe):
2193         (indexOf):
2194         * stress/array-indexof-hole.js: Added.
2195         (shouldBe):
2196         (indexOf):
2197         * stress/array-indexof-index.js: Added.
2198         (shouldBe):
2199         (indexOfInt32):
2200         (indexOfDouble):
2201         (indexOfString):
2202         (indexOfObject):
2203         (indexOfValue):
2204         * stress/array-indexof-negative-index.js: Added.
2205         (shouldBe):
2206         (indexOfInt32):
2207         (indexOfDouble):
2208         (indexOfString):
2209         (indexOfObject):
2210         (indexOfValue):
2211         * stress/array-indexof-non-int32-start-index.js: Added.
2212         (shouldBe):
2213         (indexOf):
2214         (object.valueOf):
2215         * stress/array-indexof-object-prototype-change.js: Added.
2216         (shouldBe):
2217         (indexOfInt32):
2218         * stress/array-indexof-object.js: Added.
2219         (shouldBe):
2220         (indexOf):
2221         * stress/array-indexof-original-array.js: Added.
2222         (shouldBe):
2223         (indexOfInt32):
2224         * stress/array-indexof-string.js: Added.
2225         (shouldBe):
2226         (indexOf):
2227         * stress/array-indexof-structure-change-convert.js: Added.
2228         (shouldBe):
2229         (indexOf):
2230         * stress/array-indexof-structure-change.js: Added.
2231         (shouldBe):
2232         (indexOf):
2233         * stress/array-indexof.js: Added.
2234         (shouldBe):
2235         (indexOf):
2236
2237 2017-06-11  Keith Miller  <keith_miller@apple.com>
2238
2239         TypedArray constructor with string shouldn't throw
2240         https://bugs.webkit.org/show_bug.cgi?id=173181
2241
2242         Reviewed by JF Bastien.
2243
2244         We should be coercing primitive arguments to numbers in the various
2245         TypedArray constructors.
2246
2247         * stress/typedarray-constructor.js:
2248
2249 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
2250
2251         Unreviewed, update test results part 3
2252         https://bugs.webkit.org/show_bug.cgi?id=173227
2253
2254         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
2255
2256 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2257
2258         Unreviewed, update test results part 2
2259         https://bugs.webkit.org/show_bug.cgi?id=173227
2260
2261         * test262.yaml:
2262
2263 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2264
2265         Unreviewed, update test results
2266         https://bugs.webkit.org/show_bug.cgi?id=173227
2267
2268         * microbenchmarks/string-prototype-search-observable-side-effects.js:
2269         * test262.yaml:
2270
2271 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2272
2273         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
2274         https://bugs.webkit.org/show_bug.cgi?id=173227
2275
2276         Reviewed by Mark Lam.
2277
2278         Update the test.
2279
2280         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
2281
2282 2017-06-08  Keith Miller  <keith_miller@apple.com>
2283
2284         WebAssembly: We should only create wrappers for functions that can be exported
2285         https://bugs.webkit.org/show_bug.cgi?id=173088
2286
2287         Reviewed by Saam Barati.
2288
2289         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
2290         on the old testWasmModuleFunctions api, which has been removed.
2291
2292         * wasm/function-tests/copysign.js: Removed.
2293         * wasm/function-tests/ctz.js: Removed.
2294         * wasm/function-tests/drop.js: Removed.
2295         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
2296         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
2297         * wasm/function-tests/dumb-less-than-ite.js: Removed.
2298         * wasm/function-tests/eqz.js: Removed.
2299         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
2300         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
2301         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
2302         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
2303         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
2304         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
2305         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
2306         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
2307         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
2308         * wasm/function-tests/if-then-fallthrough.js: Removed.
2309         * wasm/function-tests/int-to-floating-point.js: Removed.
2310         * wasm/function-tests/loop-mult.js:
2311         * wasm/function-tests/loop-sum.js:
2312         * wasm/function-tests/max.js: Removed.
2313         * wasm/function-tests/min.js: Removed.
2314         * wasm/function-tests/nearest.js: Removed.
2315         * wasm/function-tests/nop.js: Removed.
2316         * wasm/function-tests/popcnt.js: Removed.
2317         * wasm/function-tests/ret5.js:
2318         * wasm/function-tests/select.js: Removed.
2319         * wasm/function-tests/tee-local.js: Removed.
2320         * wasm/function-tests/trunc.js: Removed.
2321
2322 2017-06-07  JF Bastien  <jfbastien@apple.com>
2323
2324         WebAssembly: test imports and exports with 16-bit characters
2325         https://bugs.webkit.org/show_bug.cgi?id=165977
2326         <rdar://problem/29760130>
2327
2328         Reviewed by Saam Barati.
2329
2330         The output for import failure was improved, so many tests need to
2331         be updated here. Only one has new tests as noted below.
2332
2333         * wasm/function-tests/memory-import-and-grow.js:
2334         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
2335         (idxModule):
2336         * wasm/js-api/global-error.js:
2337         (new.Number):
2338         (assert.throws):
2339         * wasm/js-api/table.js:
2340         (assert.throws):
2341         (new.WebAssembly.Table):
2342         * wasm/js-api/test_memory.js:
2343         (test):
2344         * wasm/js-api/wasm-to-wasm-bad-signature.js:
2345         (BadSignatureDropStartParams.):
2346         (BadSignatureDropStartParams):
2347         (BadSignatureDropEndParams.):
2348         (BadSignatureSwapParam.):
2349         (BadSignatureRet.):
2350         * wasm/js-api/web-assembly-instantiate.js:
2351         (assert.asyncTest.async.test):
2352         (assert.asyncTest):
2353         * wasm/js-api/wrapper-function.js:
2354         (return.new.WebAssembly.Module):
2355
2356 2017-06-07  Mark Lam  <mark.lam@apple.com>
2357
2358         Restrict the regress-173035.js test to only run on Darwin x86-64.
2359         https://bugs.webkit.org/show_bug.cgi?id=173075
2360
2361         Reviewed by Saam Barati.
2362
2363         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
2364         this test will require to succeed.  Here's an example of this failure:
2365         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
2366
2367         Since the issue is due to allocation of a very large amount of memory, the test
2368         will probably fail on iOS and other platforms as well.  Hence, we should just
2369         skip this test for any platforms that is not Darwin x86-64.
2370
2371         * stress/regress-173035.js:
2372
2373 2017-06-07  Mark Lam  <mark.lam@apple.com>
2374
2375         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
2376         https://bugs.webkit.org/show_bug.cgi?id=168587
2377
2378         Not reviewed.
2379
2380         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
2381
2382         * stress/test-finally.js:
2383
2384 2017-06-06  Mark Lam  <mark.lam@apple.com>
2385
2386         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
2387         https://bugs.webkit.org/show_bug.cgi?id=173035
2388         <rdar://problem/32554593>
2389
2390         Reviewed by Geoffrey Garen and Filip Pizlo.
2391
2392         * stress/regress-173035.js: Added.
2393
2394 2017-06-06  Saam Barati  <sbarati@apple.com>
2395
2396         Make sure we restore SP when doing calls that could be to JS
2397         https://bugs.webkit.org/show_bug.cgi?id=172946
2398         <rdar://problem/32579026>
2399
2400         Reviewed by JF Bastien.
2401
2402         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
2403         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
2404         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
2405         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
2406         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
2407
2408 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
2409
2410         Unreviewed rollout r217807. Caused a test to crash.
2411
2412         * heapProfiler/class-names.js: Removed.
2413         * heapProfiler/driver/driver.js:
2414         (CheapHeapSnapshotNode):
2415         (CheapHeapSnapshot):
2416         (createCheapHeapSnapshot):
2417         (HeapSnapshot):
2418         (createHeapSnapshot):
2419         * typeProfiler/inheritance.js:
2420         (wrapper.A):
2421         (wrapper.B):
2422         (wrapper.C):
2423         (wrapper):
2424
2425 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
2426
2427         index out of bound in bytecodebasicblock
2428         https://bugs.webkit.org/show_bug.cgi?id=172963
2429
2430         Reviewed by Saam Barati and Mark Lam.
2431
2432         * stress/dfg-call-class-constructor.js: Added.
2433         (Foo):
2434         (i.catch):
2435
2436 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
2437
2438         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
2439         https://bugs.webkit.org/show_bug.cgi?id=172848
2440         <rdar://problem/25709212>
2441
2442         Reviewed by Saam Barati.
2443
2444         * typeProfiler/inheritance.js:
2445         Rewrite the test slightly for clarity. The hoisting was confusing.
2446
2447         * heapProfiler/class-names.js: Added.
2448         (MyES5Class):
2449         (MyES6Class):
2450         (MyES6Subclass):
2451         Test object types and improved class names.
2452
2453         * heapProfiler/driver/driver.js:
2454         (CheapHeapSnapshotNode):
2455         (CheapHeapSnapshot):
2456         (createCheapHeapSnapshot):
2457         (HeapSnapshot):
2458         (createHeapSnapshot):
2459         Update snapshot parsing from version 1 to version 2.
2460
2461 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2462
2463         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
2464         https://bugs.webkit.org/show_bug.cgi?id=168844
2465
2466         Reviewed by Saam Barati.
2467
2468         * modules/async-function-export.js: Added.
2469         (f):
2470         (export.async.f):
2471
2472 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2473
2474         ES2015 modules - Export default function hoisting
2475         https://bugs.webkit.org/show_bug.cgi?id=170174
2476
2477         Reviewed by Saam Barati.
2478
2479         This issue itself is solved by fixing function declaration hoisting rules.
2480         This patch just adds the specific test to modules tests to ensure the bug
2481         is fixed.
2482
2483         * modules/export-default-function-hoisting.js: Added.
2484         * modules/export-default-function-hoisting/cappuccino.js: Added.
2485         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
2486         * modules/export-default-function-hoisting/cocoa.js: Added.
2487         (export.default.drinkCocoa):
2488
2489 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
2490
2491         Class Proxy can't be extended
2492         https://bugs.webkit.org/show_bug.cgi?id=169040
2493
2494         Reviewed by Saam Barati.
2495
2496         Adding tests that check correctness of Proxy to ES6 `class`
2497         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
2498
2499         * stress/proxy-class.js: Added.
2500         (assert):
2501         (throw.new.Error.SuperClass):
2502         (throw.new.Error.A):
2503         (throw.new.Error):
2504
2505 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2506
2507         [JSC] Implement String.prototype.concat in JS builtins
2508         https://bugs.webkit.org/show_bug.cgi?id=172798
2509
2510         Reviewed by Sam Weinig.
2511
2512         * microbenchmarks/string-concat-convert.js: Added.
2513         (test):
2514         * microbenchmarks/string-concat-long-convert.js: Added.
2515         (test):
2516         * microbenchmarks/string-concat-long.js: Added.
2517         (test):
2518         * microbenchmarks/string-concat.js: Added.
2519         (test):
2520
2521 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
2522
2523         Rolling out: Prevent async methods named 'function'
2524         https://bugs.webkit.org/show_bug.cgi?id=172776
2525
2526         Reviewed by Mark Lam.
2527
2528         * stress/async-await-syntax.js:
2529         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2530         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2531         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2532         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2533         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2534
2535 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
2536
2537         Skip flaky JSC test stress/test-finally.js
2538         https://bugs.webkit.org/show_bug.cgi?id=168587
2539
2540         Unreviewed test gardening.
2541
2542         * stress/test-finally.js:
2543
2544 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2545
2546         Prevent async methods named 'function' in Object literal
2547         https://bugs.webkit.org/show_bug.cgi?id=172660
2548
2549         Reviewed by Saam Barati.
2550
2551         * stress/async-await-syntax.js:
2552         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2553
2554 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2555
2556         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
2557         https://bugs.webkit.org/show_bug.cgi?id=171274
2558
2559         Reviewed by Saam Barati.
2560
2561         * stress/async-arrow-functions-lexical-binding-in-class.js:
2562         (shouldBeAsync):
2563         (shouldBeAsyncAndStoreBind):
2564         (promise.new.Promise):
2565         (ChildClass4):
2566         (ChildClass4.prototype.classValue):
2567         (ChildClass4.prototype.get classProperty):
2568         * stress/async-arrow-functions-lexical-super-binding.js:
2569         (A):
2570         (const.childA1.new.prototype.var.f.async):
2571         (const.childA1.new.var):
2572         (const.childA1.new):
2573         (const.childA2.new.prototype.var.f.async):
2574         (const.childA2.new.var):
2575         (const.childA2.new):
2576         (const.childA3.new.prototype.var.f.async):
2577         (const.childA3.new.var):
2578         (const.childA3.new):
2579         (try.childA4.new.prototype.var.f.async):
2580         (try.childA4.new.var):
2581         (try.childA4.new):
2582         (catch):
2583         (const.childA5.new.prototype.var.f.async):
2584         (const.childA5.new.var):
2585         (const.childA5.new):
2586         (checkClass):
2587         (checkClass.new.prototype.var.f.async):
2588         (checkClass.new.var):
2589         (checkClass.new):
2590         (checkClass.new.prototype.method):
2591         (checkClass.new.prototype.prop):
2592
2593 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2594
2595         [JSC] Map and Set constructors should have fast path for cloning
2596         https://bugs.webkit.org/show_bug.cgi?id=172413
2597
2598         Reviewed by Saam Barati.
2599
2600         * stress/map-clone-instance-iterator-change.js: Added.
2601         (shouldBe):
2602         (map.Symbol.iterator):
2603         * stress/map-clone-iterator-change.js: Added.
2604         (shouldBe):
2605         (Map.prototype.Symbol.iterator):
2606         * stress/map-clone-next-change.js: Added.
2607         (shouldBe):
2608         (map.Symbol.iterator.__proto__.next):
2609         * stress/map-clone.js: Added.
2610         (shouldBe):
2611         (Map.prototype):
2612         * stress/map-inherit-set.js: Added.
2613         (shouldBe):
2614         (DerivedMap):
2615         (set for):
2616         * stress/set-clone-instance-iterator-change.js: Added.
2617         (shouldBe):
2618         (set Symbol.iterator):
2619         * stress/set-clone-iterator-change.js: Added.
2620         (shouldBe):
2621         (set Set.prototype.Symbol.iterator):
2622         * stress/set-clone-next-change.js: Added.
2623         (shouldBe):
2624         (set Symbol.iterator.__proto__.next):
2625         * stress/set-clone.js: Added.
2626         (shouldBe):
2627         (set Set.prototype.add):
2628         * stress/set-inherit-add.js: Added.
2629         (shouldBe):
2630         (DerivedSet.set add):
2631
2632 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
2633
2634         Unreviewed, rolling out r217458.
2635
2636         This change caused 55 JSC test failures.
2637
2638         Reverted changeset:
2639
2640         "Date should use historical data if it's available."
2641         https://bugs.webkit.org/show_bug.cgi?id=172592
2642         http://trac.webkit.org/changeset/217458
2643
2644 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2645
2646         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
2647         https://bugs.webkit.org/show_bug.cgi?id=167805
2648
2649         Reviewed by Saam Barati.
2650
2651         * modules/module-jit-reachability.js: Added.
2652
2653 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
2654
2655         Prevent async methods named 'function'
2656         https://bugs.webkit.org/show_bug.cgi?id=172598
2657
2658         Reviewed by Mark Lam.
2659
2660         * stress/async-await-syntax.js:
2661         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2662         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2663         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2664         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2665         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2666
2667 2017-05-25  Keith Miller  <keith_miller@apple.com>
2668
2669         Date should use historical data if it's available.
2670         https://bugs.webkit.org/show_bug.cgi?id=172592
2671
2672         Reviewed by Mark Lam.
2673
2674         Remove parts of the date tests that rely on the absence of
2675         historical data in Date.
2676
2677         * mozilla/ecma/Date/15.9.5.31-1.js:
2678         (getTestCases):
2679         * mozilla/ecma/Date/15.9.5.35-1.js:
2680         (getTestCases):
2681
2682 2017-05-25  Saam Barati  <sbarati@apple.com>
2683
2684         Our for-in optimization in the bytecode generator does its static analysis incorrectly
2685         https://bugs.webkit.org/show_bug.cgi?id=172532
2686         <rdar://problem/32369452>
2687
2688         Reviewed by Mark Lam.
2689
2690         * stress/for-in-invalidation-for-any-write.js: Added.
2691         (assert):
2692         (test):
2693         (test.i):
2694
2695 2017-05-25  Mark Lam  <mark.lam@apple.com>
2696
2697         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
2698         https://bugs.webkit.org/show_bug.cgi?id=172548
2699         <rdar://problem/31458393>
2700
2701         Reviewed by Filip Pizlo.
2702
2703         * stress/regress-172548.patch: Added.
2704
2705 2017-05-23  Saam Barati  <sbarati@apple.com>
2706
2707         We should not mmap zero bytes for a memory in Wasm
2708         https://bugs.webkit.org/show_bug.cgi?id=172528
2709         <rdar://problem/32257076>
2710
2711         Reviewed by Mark Lam.
2712
2713         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
2714         (testMems):
2715
2716 2017-05-23  Saam Barati  <sbarati@apple.com>
2717
2718         CFGSimplificationPhase should not merge a block with itself
2719         https://bugs.webkit.org/show_bug.cgi?id=172508
2720         <rdar://problem/28424006>
2721
2722         Reviewed by Keith Miller.
2723
2724         * stress/dont-crash-in-cfg-simplification.js: Added.
2725         (bar):
2726         (baz):
2727         (foo):
2728
2729 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2730
2731         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
2732         https://bugs.webkit.org/show_bug.cgi?id=172216
2733
2734         Reviewed by Saam Barati.
2735
2736         * stress/array-storage-get-by-val.js: Added.
2737         (shouldBe):
2738         (testOutOfBound):
2739         (testInBound):
2740         (testSlowPutOutOfBound):
2741         (testSlowPutInBound):
2742
2743 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2744
2745         Unreviewed, fix commented out tests
2746         https://bugs.webkit.org/show_bug.cgi?id=172225
2747
2748         * stress/get-by-val-string.js:
2749         (object.43):
2750         (Hello):
2751         (Hello.prototype.get 42):
2752         (Hello.prototype.43):
2753         (Derived):
2754         (shouldBe):
2755         (throw.new.Error): Deleted.
2756
2757 2017-05-21  Saam Barati  <sbarati@apple.com>
2758
2759         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
2760         https://bugs.webkit.org/show_bug.cgi?id=171041
2761         <rdar://problem/32082516>
2762
2763         Reviewed by Yusuke Suzuki.
2764
2765         * stress/lexical-scoping-for-loop.js: Added.
2766         (assert):
2767         (test1):
2768         (test2):
2769         (test3):
2770         (test4):
2771         (test5):
2772         (test6):
2773         (let.test7):
2774         (let.test8):
2775         (let.test9):
2776         (let.test10):
2777         (let.test11):
2778         (let.test12):
2779
2780 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2781
2782         [JSC] Make get_by_val & string "499" to number 499
2783         https://bugs.webkit.org/show_bug.cgi?id=172225
2784
2785         Reviewed by Saam Barati.
2786
2787         * stress/get-by-val-string.js: Added.
2788         (shouldBe):
2789         (shouldThrow):
2790         (object.43):
2791         (Hello):
2792         (Hello.prototype.get 42):
2793         (Hello.prototype.43):
2794         (Derived):
2795
2796 2017-05-19  Mark Lam  <mark.lam@apple.com>
2797
2798         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2799         https://bugs.webkit.org/show_bug.cgi?id=172383
2800         <rdar://problem/31418651>
2801
2802         Reviewed by Filip Pizlo.
2803
2804         * stress/regress-172383.js: Added.
2805
2806 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
2807
2808         Unreviewed, rolling out r217156.
2809
2810         This change broke the iOS build.
2811
2812         Reverted changeset:
2813
2814         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
2815         result registers."
2816         https://bugs.webkit.org/show_bug.cgi?id=172383
2817         http://trac.webkit.org/changeset/217156
2818
2819 2017-05-19  Mark Lam  <mark.lam@apple.com>
2820
2821         Add missing exception check.
2822         https://bugs.webkit.org/show_bug.cgi?id=172346
2823         <rdar://problem/32289640>
2824
2825         Reviewed by Geoffrey Garen.
2826
2827         * stress/regress-172346.js: Added.
2828
2829 2017-05-19  Mark Lam  <mark.lam@apple.com>
2830
2831         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2832         https://bugs.webkit.org/show_bug.cgi?id=172383
2833         <rdar://problem/31418651>
2834
2835         Reviewed by Filip Pizlo.
2836
2837         * stress/regress-172383.js: Added.
2838
2839 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
2840
2841         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
2842         https://bugs.webkit.org/show_bug.cgi?id=172369
2843
2844         Reviewed by Mark Lam.
2845
2846         * stress/undecided-concat.js: Added.
2847
2848 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2849
2850         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2851         https://bugs.webkit.org/show_bug.cgi?id=172098
2852
2853         Reviewed by Saam Barati.
2854
2855         * stress/check-sub-class.js: Added.
2856         (shouldBe):
2857         (shouldThrow):
2858         (calling):
2859         (array.forEach):
2860         (i.array.forEach):
2861
2862 2017-05-18  JF Bastien  <jfbastien@apple.com>
2863
2864         WebAssembly: exports is a getter
2865         https://bugs.webkit.org/show_bug.cgi?id=172129
2866
2867         Reviewed by Saam Barati.
2868
2869         Update test to reflect new semantics.
2870
2871         * wasm/js-api/test_basic_api.js:
2872         (const.c.in.constructorProperties.switch):
2873
2874 2017-05-18  Saam Barati  <sbarati@apple.com>
2875
2876         Proxy's [[Get]] passes incorrect receiver
2877         https://bugs.webkit.org/show_bug.cgi?id=164849
2878         <rdar://problem/31767058>
2879
2880         Reviewed by Yusuke Suzuki.
2881
2882         * stress/proxy-get-set-correct-receiver.js: Added.
2883         (assert):
2884         (test):
2885         (test.let.target.set prop):
2886         (test.let.target.get prop):
2887         (test.get let):
2888         * stress/proxy-set.js:
2889         (let.target.get x):
2890         * stress/reflect-set-proxy-set.js:
2891         (let.target.get x):
2892         * stress/reflect-set-receiver-proxy-set.js:
2893         (let.target.get x):
2894
2895 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2896
2897         Constructor calls set this too early
2898         https://bugs.webkit.org/show_bug.cgi?id=172302
2899
2900         Reviewed by Saam Barati.
2901         
2902         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
2903         wrong.
2904
2905         * stress/construct-overwritten-variable.js: Added.
2906         (new.x.x):
2907         * stress/construct-spread-overwritten-variable-2.js: Added.
2908         (new.x.x):
2909         * stress/construct-spread-overwritten-variable.js: Added.
2910         (new.x.x):
2911
2912 2017-05-18  Saam Barati  <sbarati@apple.com>
2913
2914         WebAssembly: perform stack checks
2915         https://bugs.webkit.org/show_bug.cgi?id=165546
2916         <rdar://problem/29760307>
2917
2918         Reviewed by Filip Pizlo.
2919
2920         * wasm.yaml:
2921         * wasm/function-tests/factorial.js:
2922         * wasm/function-tests/float-sub.js:
2923         * wasm/function-tests/stack-overflow.js: Added.
2924         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2925         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2926         (assertOverflows.makeInstance):
2927         (assertOverflows.makeInstance2):
2928         (assertOverflows.assertThrows):
2929         (assertOverflows):
2930         (assertThrows.test.makeSignature):
2931         (assertThrows.test.makeInstance):
2932         (assertThrows.test):
2933         (assertThrows):
2934
2935 2017-05-18  Keith Miller  <keith_miller@apple.com>
2936
2937         WebAssembly API: test with neutered inputs
2938         https://bugs.webkit.org/show_bug.cgi?id=163899
2939
2940         Reviewed by JF Bastien.
2941
2942         * wasm/js-api/neutered-inputs.js: Added.
2943         (const.testFunction):
2944         (const.testConstructor):
2945         * wasm/js-api/test_basic_api.js:
2946         (const.c.in.constructorProperties.switch):
2947
2948 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2949
2950         DFG inlining should be hardened for the no-result case
2951         https://bugs.webkit.org/show_bug.cgi?id=172290
2952
2953         Reviewed by Saam Barati.
2954
2955         * stress/array-constructor-no-result.js: Added.
2956         (foo):
2957         * stress/pow-no-result.js: Added.
2958         (foo):
2959
2960 2017-05-18  Commit Queue  <commit-queue@webkit.org>
2961
2962         Unreviewed, rolling out r217031, r217032, and r217037.
2963         https://bugs.webkit.org/show_bug.cgi?id=172293
2964
2965         cause linking errors in Windows (Requested by yusukesuzuki on
2966         #webkit).
2967
2968         Reverted changesets:
2969
2970         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
2971         https://bugs.webkit.org/show_bug.cgi?id=172098
2972         http://trac.webkit.org/changeset/217031
2973
2974         "Unreviewed, rebaseline for newly added ClassInfo"
2975         https://bugs.webkit.org/show_bug.cgi?id=172098
2976         http://trac.webkit.org/changeset/217032
2977
2978         "Unreviewed, fix debug and non-JIT build"
2979         https://bugs.webkit.org/show_bug.cgi?id=172098
2980         http://trac.webkit.org/changeset/217037
2981
2982 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2983
2984         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2985         https://bugs.webkit.org/show_bug.cgi?id=172098
2986
2987         Reviewed by Saam Barati.
2988
2989         * stress/check-sub-class.js: Added.
2990         (shouldBe):
2991         (shouldThrow):
2992         (calling):
2993         (array.forEach):
2994         (i.array.forEach):
2995
2996 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2997
2998         Unreviewed, address mlam's review feedback.
2999
3000         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
3001
3002 2017-05-17  Saam Barati  <sbarati@apple.com>
3003
3004         We don't do context switches for Wasm->Wasm call indirect
3005         https://bugs.webkit.org/show_bug.cgi?id=172188
3006         <rdar://problem/32231828>
3007
3008         Reviewed by Keith Miller.
3009
3010         * wasm/function-tests/context-switch.js: Added.
3011         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3012         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
3013         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
3014         (makeInstance):
3015         (makeInstance2):
3016         (assert.eq.makeInstance):
3017         (assert.eq.makeInstance2):
3018         (assert.eq):
3019
3020 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
3021
3022         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
3023         https://bugs.webkit.org/show_bug.cgi?id=172208
3024
3025         Reviewed by Saam Barati.
3026
3027         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
3028         (foo):
3029         (bar):
3030         (baz):
3031
3032 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3033
3034         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
3035         https://bugs.webkit.org/show_bug.cgi?id=172115
3036
3037         Reviewed by Saam Barati.
3038
3039         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
3040         (shouldBe):
3041         (unknown):
3042         (readWord1):
3043         (readWord2):
3044         (readWord3):
3045         (readWord4):
3046
3047 2017-05-16  JF Bastien  <jfbastien@apple.com>
3048
3049         WebAssembly: add memory fuzzer
3050         https://bugs.webkit.org/show_bug.cgi?id=169976
3051         <rdar://problem/31965328>
3052
3053         Reviewed by Keith Miller.
3054
3055         * wasm/fuzz/memory.js: Added.
3056         (const.insert):
3057         (const.action.string_appeared_here):
3058         (const.performAction):
3059         (catch):
3060
3061 2017-05-16  JF Bastien  <jfbastien@apple.com>
3062
3063         WebAssembly: validate load / store alignment
3064         https://bugs.webkit.org/show_bug.cgi?id=168836
3065         <rdar://problem/31965349>
3066
3067         Reviewed by Keith Miller.
3068
3069         * wasm/WASM.js: fix regular expression greed
3070         * wasm/function-tests/memory-alignment.js: Added.
3071         (const.op.of.WASM.opcodes):
3072         * wasm/wasm.json: fix formatting
3073
3074 2017-05-15  Mark Lam  <mark.lam@apple.com>
3075
3076         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
3077         https://bugs.webkit.org/show_bug.cgi?id=172147
3078
3079         Rubber-stamped by Saam Barati.
3080
3081         * stress/object-rest-deconstruct.js: Removed.
3082         * stress/object-spread.js: Removed.
3083
3084 2017-05-11  JF Bastien  <jfbastien@apple.com>
3085
3086         WebAssembly: stop supporting 0xD
3087         https://bugs.webkit.org/show_bug.cgi?id=168788
3088         <rdar://problem/31880922>
3089
3090         Reviewed by Saam Barati.
3091
3092         Test that only version 1 is supported.
3093
3094         * wasm/js-api/version.js: Added.
3095
3096 2017-05-10  JF Bastien  <jfbastien@apple.com>
3097
3098         WebAssemby: builder doesn't do Memory section maximum correctly
3099         https://bugs.webkit.org/show_bug.cgi?id=171931
3100
3101         Reviewed by Keith Miller.
3102
3103         * wasm/Builder.js:
3104         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3105         * wasm/Builder_WebAssemblyBinary.js:
3106         (const.emitters.Memory):
3107         * wasm/function-tests/memory-grow-invalid.js: Added.
3108
3109 2017-05-10  JF Bastien  <jfbastien@apple.com>
3110
3111         WebAssembly: support name section
3112         https://bugs.webkit.org/show_bug.cgi?id=171263
3113
3114         Reviewed by Keith Miller.
3115
3116         * wasm/function-tests/nameSection.js: Added.
3117         (const.compile):
3118         * wasm/function-tests/nameSection.wasm: Added.
3119         * wasm/function-tests/stack-trace.js: Update format
3120
3121 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
3122
3123         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
3124         https://bugs.webkit.org/show_bug.cgi?id=171801
3125
3126         Reviewed by Michael Saboff.
3127         
3128         These tests used to crash. The prefix and postfix tests cover different paths, except
3129         postfix-ignored goes down the same path as prefix due to an optimization.
3130
3131         * stress/for-in-postfix-ignored-index.js: Added.
3132         (foo):
3133         * stress/for-in-postfix-index.js: Added.
3134         (foo):
3135         * stress/for-in-prefix-index.js: Added.
3136         (foo):
3137
3138 2017-05-08  Mark Lam  <mark.lam@apple.com>
3139
3140         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
3141         https://bugs.webkit.org/show_bug.cgi?id=171786
3142         <rdar://problem/32051023>
3143
3144         Reviewed by Saam Barati.
3145
3146         * stress/bug-171786.js: Added.
3147
3148 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3149
3150         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
3151         https://bugs.webkit.org/show_bug.cgi?id=171543
3152
3153         Reviewed by Saam Barati.
3154
3155         * stress/arrowfunction-lexical-bind-supercall-4.js:
3156         (J):
3157         (K):
3158
3159 2017-05-05  Saam Barati  <sbarati@apple.com>
3160
3161         putDirectIndex does not properly do defineOwnProperty
3162         https://bugs.webkit.org/show_bug.cgi?id=171591
3163         <rdar://problem/31735695>
3164
3165         Reviewed by Geoffrey Garen.
3166
3167         * stress/array-prototype-splice-making-typed-array.js:
3168         (test):
3169         * stress/array-species-config-array-constructor.js:
3170         (shouldThrow):
3171         (test):
3172         * stress/put-direct-index-broken-2.js: Added.
3173         (assert):
3174         (test):
3175         (makeLengthWritable):
3176         (set get restoreOldDesc):
3177         * stress/put-direct-index-broken.js: Added.
3178         (whatToTest):
3179         (tryRunning):
3180         (tryItOut):
3181         * stress/put-indexed-getter-setter.js: Added.
3182         (foo.X.prototype.set 7):
3183         (foo.X.prototype.get 7):
3184         (foo.X):
3185         (foo):
3186
3187 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
3188
3189         [JSC] Math unary functions should be handled by DFG
3190         https://bugs.webkit.org/show_bug.cgi?id=171269
3191
3192         Reviewed by Saam Barati.
3193
3194         * stress/arith-acos-on-various-types.js: Added.
3195         (let.validInputTypedTestCases.validInputTestCases.map):
3196         (isIdentical):
3197         (opaqueACosNoArgument):
3198         (testNoArgument):
3199         (opaqueAllTypesACos):
3200         (testAllTypesCall):
3201         (testSingleTypeCall):
3202         (testConstant):
3203         (opaqueACosForSideEffects):
3204         (testSideEffect.let.testObject.valueOf):
3205         (testSideEffect):
3206         (opaqueACosForCSE):
3207         (testCSE.let.testObject.valueOf):
3208         (testCSE):
3209         (opaqueACosForDCE):
3210         (testDCE.let.testObject.valueOf):
3211         (testDCE):
3212         (testException.opaqueACosWithException):
3213         (testException):
3214         * stress/arith-acosh-on-various-types.js: Added.
3215         (let.validInputTypedTestCases.validInputTestCases.map):
3216         (isIdentical):
3217         (opaqueACoshNoArgument):
3218         (testNoArgument):
3219         (opaqueAllTypesACosh):
3220         (testAllTypesCall):
3221         (testSingleTypeCall):
3222         (testConstant):
3223         (opaqueACoshForSideEffects):
3224         (testSideEffect.let.testObject.valueOf):
3225         (testSideEffect):
3226         (opaqueACoshForCSE):
3227         (testCSE.let.testObject.valueOf):
3228         (testCSE):
3229         (opaqueACoshForDCE):
3230         (testDCE.let.testObject.valueOf):
3231         (testDCE):
3232         (testException.opaqueACoshWithException):
3233         (testException):
3234         * stress/arith-asin-on-various-types.js: Added.
3235         (let.validInputTypedTestCases.validInputTestCases.map):
3236         (isIdentical):
3237         (opaqueASinNoArgument):
3238         (testNoArgument):
3239         (opaqueAllTypesASin):
3240         (testAllTypesCall):
3241         (testSingleTypeCall):
3242         (testConstant):
3243         (opaqueASinForSideEffects):
3244         (testSideEffect.let.testObject.valueOf):
3245         (testSideEffect):
3246         (opaqueASinForCSE):
3247         (testCSE.let.testObject.valueOf):
3248         (testCSE):
3249         (opaqueASinForDCE):
3250         (testDCE.let.testObject.valueOf):
3251         (testDCE):
3252         (testException.opaqueASinWithException):
3253         (testException):
3254         * stress/arith-asinh-on-various-types.js: Added.
3255         (let.validInputTypedTestCases.validInputTestCases.map):
3256         (isIdentical):
3257         (opaqueASinhNoArgument):
3258         (testNoArgument):
3259         (opaqueAllTypesASinh):
3260         (testAllTypesCall):
3261         (testSingleTypeCall):
3262         (testConstant):
3263         (opaqueASinhForSideEffects):
3264         (testSideEffect.let.testObject.valueOf):
3265         (testSideEffect):
3266         (opaqueASinhForCSE):
3267         (testCSE.let.testObject.valueOf):
3268         (testCSE):
3269         (opaqueASinhForDCE):
3270         (testDCE.let.testObject.valueOf):
3271         (testDCE):
3272         (testException.opaqueASinhWithException):
3273         (testException):
3274         * stress/arith-atan-on-various-types.js: Added.
3275         (let.validInputTypedTestCases.validInputTestCases.map):
3276         (isIdentical):
3277         (opaqueATanNoArgument):
3278         (testNoArgument):
3279         (opaqueAllTypesATan):
3280         (testAllTypesCall):
3281         (testSingleTypeCall):
3282         (testConstant):
3283         (opaqueATanForSideEffects):
3284         (testSideEffect.let.testObject.valueOf):
3285         (testSideEffect):
3286         (opaqueATanForCSE):
3287         (testCSE.let.testObject.valueOf):
3288         (testCSE):
3289         (opaqueATanForDCE):
3290         (testDCE.let.testObject.valueOf):
3291         (testDCE):
3292         (testException.opaqueATanWithException):
3293         (testException):
3294         * stress/arith-atanh-on-various-types.js: Added.
3295         (let.validInputTypedTestCases.validInputTestCases.map):
3296         (isIdentical):
3297         (opaqueATanhNoArgument):
3298         (testNoArgument):
3299         (opaqueAllTypesATanh):
3300         (testAllTypesCall):
3301         (testSingleTypeCall):
3302         (testConstant):
3303         (opaqueATanhForSideEffects):
3304         (testSideEffect.let.testObject.valueOf):
3305         (testSideEffect):
3306         (opaqueATanhForCSE):
3307         (testCSE.let.testObject.valueOf):
3308         (testCSE):
3309         (opaqueATanhForDCE):
3310         (testDCE.let.testObject.valueOf):
3311         (testDCE):
3312         (testException.opaqueATanhWithException):
3313         (testException):
3314         * stress/arith-cbrt-on-various-types.js: Added.
3315         (let.validInputTypedTestCases.validInputTestCases.map):
3316         (isIdentical):
3317         (opaqueCbrtNoArgument):
3318         (testNoArgument):
3319         (opaqueAllTypesCbrt):
3320         (testAllTypesCall):
3321         (testSingleTypeCall):
3322         (testConstant):
3323         (opaqueCbrtForSideEffects):
3324         (testSideEffect.let.testObject.valueOf):
3325         (testSideEffect):
3326         (opaqueCbrtForCSE):
3327         (testCSE.let.testObject.valueOf):
3328         (testCSE):
3329         (opaqueCbrtForDCE):
3330         (testDCE.let.testObject.valueOf):
3331         (testDCE):
3332         (testException.opaqueCbrtWithException):
3333         (testException):
3334         * stress/arith-cosh-on-various-types.js: Added.
3335         (let.validInputTypedTestCases.validInputTestCases.map):
3336         (isIdentical):
3337         (opaqueCoshNoArgument):
3338         (testNoArgument):
3339         (opaqueAllTypesCosh):
3340         (testAllTypesCall):
3341         (testSingleTypeCall):
3342         (testConstant):
3343         (opaqueCoshForSideEffects):
3344         (testSideEffect.let.testObject.valueOf):
3345         (testSideEffect):
3346         (opaqueCoshForCSE):
3347         (testCSE.let.testObject.valueOf):
3348         (testCSE):
3349         (opaqueCoshForDCE):
3350         (testDCE.let.testObject.valueOf):
3351         (testDCE):
3352         (testException.opaqueCoshWithException):
3353         (testException):
3354         * stress/arith-expm1-on-various-types.js: Added.
3355         (let.validInputTypedTestCases.validInputTestCases.map):
3356         (isIdentical):
3357         (opaqueExpm1NoArgument):
3358         (testNoArgument):
3359         (opaqueAllTypesExpm1):
3360         (testAllTypesCall):
3361         (testSingleTypeCall):
3362         (testConstant):
3363         (opaqueExpm1ForSideEffects):
3364         (testSideEffect.let.testObject.valueOf):
3365         (testSideEffect):
3366         (opaqueExpm1ForCSE):
3367         (testCSE.let.testObject.valueOf):
3368         (testCSE):
3369         (opaqueExpm1ForDCE):
3370         (testDCE.let.testObject.valueOf):
3371         (testDCE):
3372         (testException.opaqueExpm1WithException):
3373         (testException):
3374         * stress/arith-log10-on-various-types.js: Added.
3375         (let.validInputTypedTestCases.validInputTestCases.map):
3376         (isIdentical):
3377         (opaqueLog10NoArgument):
3378         (testNoArgument):
3379         (opaqueAllTypesLog10):
3380         (testAllTypesCall):
3381         (testSingleTypeCall):
3382         (testConstant):
3383         (opaqueLog10ForSideEffects):
3384         (testSideEffect.let.testObject.valueOf):
3385         (testSideEffect):
3386         (opaqueLog10ForCSE):
3387         (testCSE.let.testObject.valueOf):
3388         (testCSE):
3389         (opaqueLog10ForDCE):
3390         (testDCE.let.testObject.valueOf):
3391         (testDCE):
3392         (testException.opaqueLog10WithException):
3393         (testException):
3394         * stress/arith-log2-on-various-types.js: Added.
3395         (let.validInputTypedTestCases.validInputTestCases.map):
3396         (isIdentical):
3397         (opaqueLog2NoArgument):
3398         (testNoArgument):
3399         (opaqueAllTypesLog2):
3400         (testAllTypesCall):
3401         (testSingleTypeCall):
3402         (testConstant):
3403         (opaqueLog2ForSideEffects):
3404         (testSideEffect.let.testObject.valueOf):
3405         (testSideEffect):
3406         (opaqueLog2ForCSE):
3407         (testCSE.let.testObject.valueOf):
3408         (testCSE):
3409         (opaqueLog2ForDCE):
3410         (testDCE.let.testObject.valueOf):
3411         (testDCE):
3412         (testException.opaqueLog2WithException):
3413         (testException):
3414         * stress/arith-sinh-on-various-types.js: Added.
3415         (let.validInputTypedTestCases.validInputTestCases.map):
3416         (isIdentical):
3417         (opaqueSinhNoArgument):
3418         (testNoArgument):
3419         (opaqueAllTypesSinh):
3420         (testAllTypesCall):
3421         (testSingleTypeCall):
3422         (testConstant):
3423         (opaqueSinhForSideEffects):
3424         (testSideEffect.let.testObject.valueOf):
3425         (testSideEffect):
3426         (opaqueSinhForCSE):
3427         (testCSE.let.testObject.valueOf):
3428         (testCSE):
3429         (opaqueSinhForDCE):
3430         (testDCE.let.testObject.valueOf):
3431         (testDCE):
3432         (testException.opaqueSinhWithException):
3433         (testException):
3434         * stress/arith-tan-on-various-types.js:
3435         (isIdentical):
3436         * stress/arith-tanh-on-various-types.js: Added.
3437         (let.validInputTypedTestCases.validInputTestCases.map):
3438         (isIdentical):
3439         (opaqueTanhNoArgument):
3440         (testNoArgument):
3441         (opaqueAllTypesTanh):
3442         (testAllTypesCall):
3443         (testSingleTypeCall):
3444         (testConstant):
3445         (opaqueTanhForSideEffects):
3446         (testSideEffect.let.testObject.valueOf):
3447         (testSideEffect):
3448         (opaqueTanhForCSE):
3449         (testCSE.let.testObject.valueOf):
3450         (testCSE):
3451         (opaqueTanhForDCE):
3452         (testDCE.let.testObject.valueOf):
3453         (testDCE):
3454         (testException.opaqueTanhWithException):
3455         (testException):
3456
3457 2017-05-03  Keith Miller  <keith_miller@apple.com>
3458
3459         Array.prototype.sort should also allow a null comparator
3460         https://bugs.webkit.org/show_bug.cgi?id=171621
3461
3462         Reviewed by Michael Saboff.
3463
3464         Add test to make it less likely we revert to the incompatable behavior.
3465         Also, fix now incorrect tests.
3466
3467         * ChakraCore/test/Array/array_sort.baseline-jsc:
3468         * stress/array-sort-bad-comparator.js:
3469         (test):
3470         * stress/sort-null-comparator.js: Added.
3471         (assertEq):
3472
3473 2017-05-03  Caitlin Potter  <caitp@igalia.com>
3474
3475         [JSC] remove unneeded asyncFunctionTests.yaml
3476         https://bugs.webkit.org/show_bug.cgi?id=171611
3477
3478         Reviewed by Yusuke Suzuki.
3479
3480         Async functions have shipped, and those tests are run as part of
3481         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
3482
3483         * asyncFunctionTests.yaml: Removed.
3484         * stress/async-await-long-loop.js:
3485         * stress/async-await-throw-loop.js:
3486
3487 2017-05-03  Keith Miller  <keith_miller@apple.com>
3488
3489         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
3490         https://bugs.webkit.org/show_bug.cgi?id=47825
3491
3492         Reviewed by Saam Barati.
3493
3494         * stress/sorting-boolean-result-comparator.js: Added.
3495         (checkArray):
3496
3497 2017-05-02  David Kilzer  <ddkilzer@apple.com>
3498
3499         check-webkit-style should keep JavaScript test functions in sync
3500         <https://webkit.org/b/171424>
3501
3502         Reviewed by Joseph Pecoraro.
3503
3504         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
3505         and shouldThrow() in sync with other copies of these methods.
3506
3507         * stress/resources/standalone-pre.js:
3508         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
3509         variables with underscore.
3510         (shouldThrow): Fix whitespace.
3511
3512 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3513
3514         We initialize functions too early in an eval
3515         https://bugs.webkit.org/show_bug.cgi?id=161099
3516
3517         Reviewed by Saam Barati.
3518
3519         * stress/eval-func-decl-with-let-const-class.js: Added.
3520
3521 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3522
3523         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3524         https://bugs.webkit.org/show_bug.cgi?id=163208
3525
3526         Reviewed by Saam Barati.
3527
3528         * stress/eval-func-decl-block-scoping-reassign.js: Added.
3529         (assert):
3530         (throw.new.Error.f):
3531         (throw.new.Error):
3532         * stress/eval-func-decl-block-with-remove.js: Added.
3533         (assert):
3534         (foo.boo):
3535         (foo):
3536         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3537         (assert):
3538         (assertThrow):
3539         (foo):
3540         (boo):
3541         (joo):
3542         (koo):
3543         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3544         (assert):
3545         (assertThrow):
3546         (foo):
3547         (boo):
3548         (hoo):
3549         (joo):
3550         (koo):
3551         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3552         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3553         (assert):
3554         (assertThrow):
3555         (foo):
3556         (boo):
3557         (goo):
3558         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3559         (assert):
3560         (assertThrow):
3561         (foo):
3562         (boo):
3563         (boo.let.val2):
3564         (boo.let.val3):
3565         * stress/eval-func-decl-in-frozen-global.js: Added.
3566         (assert):
3567         (assertThrow):
3568         (throw.new.Error):
3569         (Object.freeze):
3570         * stress/eval-func-decl-in-global-of-eval.js: Added.
3571         (assert):
3572         (assertThrow):
3573         (bar):
3574         (baz):
3575         (foobar):
3576         * stress/eval-func-decl-in-global.js: Added.
3577         (assert):
3578         (assertThrow):
3579         * stress/eval-func-decl-in-if.js: Added.
3580         (assert):
3581         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3582         (assert):
3583         (assertThrow):
3584         (foo):
3585         (boo):
3586         (foobar):
3587         (hoo):
3588         (joo):
3589         (koo):
3590         (loo):
3591         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3592         (assert):
3593         (assertThrow):
3594         (foo):
3595         (boo):
3596         (goo):
3597         * stress/variable-under-tdz-eval-tricky.js:
3598         (assert):
3599         * test262.yaml:
3600
3601 2017-04-27  Mark Lam  <mark.lam@apple.com>
3602
3603         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
3604         https://bugs.webkit.org/show_bug.cgi?id=171404
3605         <rdar://problem/31876178>
3606
3607         Reviewed by Saam Barati.
3608
3609         * stress/js-fixed-array-out-of-memory.js: Added.
3610
3611 2017-04-27  David Kilzer  <ddkilzer@apple.com>
3612
3613         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
3614         <https://webkit.org/b/171362>
3615         <rdar://problem/31867686>
3616
3617         Reviewed by Joseph Pecoraro.
3618
3619         * stress/resources/standalone-pre.js:
3620         (shouldBe):
3621         (shouldNotThrow):
3622         (shouldThrow):
3623         - Update shouldBe() to accept anonymous function arguments.
3624           (The shouldNotBe() function was never copied over.)
3625         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
3626           function arguments (which were missed in r202609 for Bug
3627           159232).
3628
3629 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3630
3631         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
3632         https://bugs.webkit.org/show_bug.cgi?id=171262
3633
3634         Reviewed by Saam Barati.
3635
3636         * stress/spread-outer-create-rest.js: Added.
3637         (assert):
3638         (foo):
3639         (bar):
3640         (baz):
3641
3642 2017-04-26  Saam Barati  <sbarati@apple.com>
3643
3644         Print Wasm function index in stack trace
3645         https://bugs.webkit.org/show_bug.cgi?id=171349
3646
3647         Reviewed by JF Bastien.
3648
3649         * wasm/function-tests/stack-trace.js: Added.
3650         (import.Builder.from.string_appeared_here.assert):
3651         (let.imp):
3652         * wasm/function-tests/trap-after-cross-instance-call.js:
3653         (wasmFrameCountFromError):
3654         * wasm/function-tests/trap-load-2.js:
3655         (wasmFrameCountFromError):
3656         * wasm/function-tests/trap-load.js:
3657         (wasmFrameCountFromError):
3658
3659 2017-04-26  Saam Barati  <sbarati@apple.com>
3660
3661         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
3662         https://bugs.webkit.org/show_bug.cgi?id=170924
3663         <rdar://problem/31721052>
3664
3665         Reviewed by Mark Lam.
3666
3667         * stress/error-message-for-function-base-not-found.js: Added.
3668         (assert):
3669         (throw.new.Error):
3670         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
3671         (catch):
3672
3673 2017-04-26  Keith Miller  <keith_miller@apple.com>
3674
3675         WebAssembly: Implement tier up
3676         https://bugs.webkit.org/show_bug.cgi?id=170134
3677
3678         Reviewed by Filip Pizlo.
3679
3680         * wasm/function-tests/trap-after-cross-instance-call.js:
3681         * wasm/tier-up/js-to-wasm.js: Added.
3682         (async.test):
3683         * wasm/tier-up/wasm-to-wasm.js: Added.
3684         (async.test):
3685
3686 2017-04-26  Caitlin Potter  <caitp@igalia.com>
3687
3688         [JSC] Object.keys() must discard property names with no PropertyDescriptor
3689         https://bugs.webkit.org/show_bug.cgi?id=171291
3690
3691         Reviewed by Yusuke Suzuki.
3692
3693         * es6/Proxy_ownKeys_duplicates.js:
3694         * stress/proxy-own-keys.js:
3695         (let.handler.getOwnPropertyDescriptor):
3696         (let.handler.ownKeys):
3697
3698 2017-04-25  Commit Queue  <commit-queue@webkit.org>
3699
3700         Unreviewed, rolling out r215476.
3701         https://bugs.webkit.org/show_bug.cgi?id=171304
3702
3703         "It broke JSBench" (Requested by saamyjoon on #webkit).
3704
3705         Reverted changeset:
3706
3707         "[ES6]. Implement Annex B.3.3 function hoisting rules for
3708         eval"
3709         https://bugs.webkit.org/show_bug.cgi?id=163208
3710         http://trac.webkit.org/changeset/215476
3711
3712 2017-04-25  Saam Barati  <sbarati@apple.com>
3713
3714         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
3715         https://bugs.webkit.org/show_bug.cgi?id=171150
3716         <rdar://problem/31771880>
3717
3718         Reviewed by Sam Weinig.
3719
3720         * stress/spread-optimized-properly.js: Added.
3721         (assert):
3722         (test):
3723         (shallowEq):
3724         (makeArrayIterator):
3725         (test.bar):
3726         (test.callback):
3727         (test.arr.__proto__.Symbol.iterator):
3728         (test.arr.Symbol.iterator):
3729         (test.get bar):
3730         (test.hackedNext):
3731         (test.test):
3732         (test.):
3733
3734 2017-04-25  Mark Lam  <mark.lam@apple.com>
3735
3736         [Follow up] Array.prototype.slice() should ensure that end >= begin.
3737         https://bugs.webkit.org/show_bug.cgi?id=170989
3738         <rdar://problem/31705652>
3739
3740         Not reviewed.
3741
3742         Follow up to rename a test file that was accidentally named wrongly.
3743
3744         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
3745         * stress/regress-170989.patch: Removed.
3746
3747 2017-04-25  Mark Lam  <mark.lam@apple.com>
3748
3749         Array.prototype.slice() should ensure that end >= begin.
3750         https://bugs.webkit.org/show_bug.cgi?id=170989
3751         <rdar://problem/31705652>
3752
3753         Reviewed by Saam Barati.
3754
3755         * stress/regress-170989.patch: Added.
3756
3757 2017-04-25  Mark Lam  <mark.lam@apple.com>
3758
3759         Local CSE wrongly CSEs array accesses with different result types.
3760         https://bugs.webkit.org/show_bug.cgi?id=170990
3761         <rdar://problem/31705945>
3762
3763         Reviewed by Saam Barati.
3764
3765         * stress/regress-170990.js: Added.
3766
3767 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3768