[JSC] report unexpected token when "async" is followed by identifier
[WebKit-https.git] / JSTests / ChangeLog
1 2016-12-05  Caitlin Potter  <caitp@igalia.com>
2
3         [JSC] report unexpected token when "async" is followed by identifier 
4         https://bugs.webkit.org/show_bug.cgi?id=165091
5
6         Reviewed by Mark Lam.
7
8         * stress/bug-165091.js:
9
10 2016-12-05  Keith Miller  <keith_miller@apple.com>
11
12         Add Wasm i64 to i32 conversion.
13         https://bugs.webkit.org/show_bug.cgi?id=165378
14
15         Reviewed by Filip Pizlo.
16
17         It turns out the wrap operation is just B3's Trunc.
18
19         * wasm/wasm.json:
20
21 2016-12-04  Keith Miller  <keith_miller@apple.com>
22
23         Add support for Wasm ctz and popcnt
24         https://bugs.webkit.org/show_bug.cgi?id=165369
25
26         Reviewed by Saam Barati.
27
28         * wasm/function-tests/ctz.js: Added.
29         * wasm/function-tests/popcnt.js: Added.
30
31 2016-12-03  JF Bastien  <jfbastien@apple.com>
32
33         WebAssembly: update binary format to 0xD version
34         https://bugs.webkit.org/show_bug.cgi?id=165345
35
36         Reviewed by Keith Miller.
37
38         As described in the following PR: https://github.com/WebAssembly/design/pull/836
39         Originally committed in r209175, reverted in r209242, and fixed in r209284.
40
41         * wasm/Builder.js:
42         (const._normalizeFunctionSignature):
43         * wasm/Builder_WebAssemblyBinary.js:
44         (const.emitters.Type):
45         (const.emitters.Code):
46         * wasm/LowLevelBinary.js:
47         (export.default.LowLevelBinary.prototype.block_type):
48         (export.default.LowLevelBinary.prototype.inline_signature_type): Deleted.
49         * wasm/WASM.js:
50         * wasm/js-api/test_basic_api.js:
51         * wasm/self-test/test_BuilderWebAssembly.js:
52         (EmptyModule):
53         (CustomSection):
54         * wasm/self-test/test_WASM.js:
55         * wasm/wasm.json:
56
57 2016-12-02  Keith Miller  <keith_miller@apple.com>
58
59         Add Wasm copysign
60         https://bugs.webkit.org/show_bug.cgi?id=165355
61
62         Reviewed by Filip Pizlo.
63
64         * wasm/function-tests/copysign.js: Added.
65
66 2016-12-03  Commit Queue  <commit-queue@webkit.org>
67
68         Unreviewed, rolling out r209298.
69         https://bugs.webkit.org/show_bug.cgi?id=165359
70
71         broke the build (Requested by smfr on #webkit).
72
73         Reverted changeset:
74
75         "Add Wasm copysign"
76         https://bugs.webkit.org/show_bug.cgi?id=165355
77         http://trac.webkit.org/changeset/209298
78
79 2016-12-02  Keith Miller  <keith_miller@apple.com>
80
81         Add Wasm copysign
82         https://bugs.webkit.org/show_bug.cgi?id=165355
83
84         Reviewed by Filip Pizlo.
85
86         * wasm/function-tests/copysign.js: Added.
87
88 2016-12-02  Keith Miller  <keith_miller@apple.com>
89
90         Unreviewed, fix git having a breakdown over trying to reland a rollout.
91
92 2016-12-02  Keith Miller  <keith_miller@apple.com>
93
94         Add Wasm floating point nearest and trunc
95         https://bugs.webkit.org/show_bug.cgi?id=165339
96
97         Reviewed by Saam Barati.
98
99         * wasm/function-tests/nearest.js: Added.
100         * wasm/function-tests/trunc.js: Added.
101
102 2016-12-02  Caitlin Potter  <caitp@igalia.com>
103
104 [JSC] add additional bit to JSTokenType bitfield
105         https://bugs.webkit.org/show_bug.cgi?id=165091
106
107         Reviewed by Geoffrey Garen.
108
109         * stress/bug-165091.js: Added.
110         (shouldThrowSyntaxError):
111
112 2016-12-02  Commit Queue  <commit-queue@webkit.org>
113
114         Unreviewed, rolling out r209275 and r209276.
115         https://bugs.webkit.org/show_bug.cgi?id=165348
116
117         "broke the arm build" (Requested by keith_miller on #webkit).
118
119         Reverted changesets:
120
121         "Add Wasm floating point nearest and trunc"
122         https://bugs.webkit.org/show_bug.cgi?id=165339
123         http://trac.webkit.org/changeset/209275
124
125         "Unreviewed, forgot to change instruction after renaming."
126         http://trac.webkit.org/changeset/209276
127
128 2016-12-02  Keith Miller  <keith_miller@apple.com>
129
130         Add Wasm floating point nearest and trunc
131         https://bugs.webkit.org/show_bug.cgi?id=165339
132
133         Reviewed by Filip Pizlo.
134
135         * wasm/function-tests/nearest.js: Added.
136         * wasm/function-tests/trunc.js: Added.
137
138 2016-12-02  JF Bastien  <jfbastien@apple.com>
139
140         WebAssembly: revert patch causing odd breakage
141         https://bugs.webkit.org/show_bug.cgi?id=165308
142
143         Unreviewed.
144
145         Bug #164724 seems to cause build issues which I haven't tracked down yet. WasmOps.h can't be found:
146         ./Source/JavaScriptCore/wasm/WasmFormat.h:34:10: fatal error: 'WasmOps.h' file not found
147
148         It's weird since the file is auto-generated and has been for a while. #164724 merely includes it in WasmFormat.h.
149
150         * wasm/Builder.js:
151         (const._normalizeFunctionSignature):
152         * wasm/Builder_WebAssemblyBinary.js:
153         (const.emitters.Type):
154         (const.emitters.Code):
155         * wasm/LowLevelBinary.js:
156         (export.default.LowLevelBinary.prototype.inline_signature_type):
157         (export.default.LowLevelBinary.prototype.block_type): Deleted.
158         * wasm/WASM.js:
159         * wasm/js-api/test_basic_api.js:
160         * wasm/self-test/test_BuilderWebAssembly.js:
161         (EmptyModule):
162         (CustomSection):
163         * wasm/self-test/test_WASM.js:
164         * wasm/wasm.json:
165
166 2016-12-01  Ryan Haddad  <ryanhaddad@apple.com>
167
168         Skip flaky test ChakraCore/test/fieldopts/objtypespec-newobj-invalidation.1.js
169         https://bugs.webkit.org/show_bug.cgi?id=162567
170
171         Reviewed by Saam Barati.
172
173         * ChakraCore.yaml:
174
175 2016-12-01  Keith Miller  <keith_miller@apple.com>
176
177         Add wasm int to floating point opcodes
178         https://bugs.webkit.org/show_bug.cgi?id=165252
179
180         Reviewed by Geoffrey Garen.
181
182         Add tests for Wasm integral to floating point conversion opcodes.
183
184         * wasm/function-tests/int-to-floating-point.js: Added.
185         * wasm/wasm.json:
186
187 2016-12-01  Geoffrey Garen  <ggaren@apple.com>
188
189         Land a test case for <rdar://problem/27889416>
190         https://bugs.webkit.org/show_bug.cgi?id=165272
191
192         Reviewed by Saam Barati.
193
194         * stress/marked-argument-buffer.js: Added.
195         (allocate):
196         (test.o.toString):
197         (test):
198
199 2016-11-29  Per Arne Vollan  <pvollan@apple.com>
200
201         [Win] Skip failing JSC tests.
202         https://bugs.webkit.org/show_bug.cgi?id=165140
203
204         Reviewed by Mark Lam.
205
206         * ChakraCore.yaml:
207         * microbenchmarks/tan.js:
208
209 2016-11-30  JF Bastien  <jfbastien@apple.com>
210
211         WebAssembly builder: don't throw when checker not implemented
212         https://bugs.webkit.org/show_bug.cgi?id=165219
213
214         Reviewed by Mark Lam.
215
216         We should perform whichever checks we've implemented, and assume the rest are OK until bug #163421 is fixed.
217
218         * wasm/Builder.js:
219         * wasm/README.md:
220         * wasm/function-tests/add-12.js:
221         * wasm/function-tests/br-if-loop-less-than.js:
222         * wasm/function-tests/brTableAsIf.js:
223         * wasm/function-tests/brTableManyValues.js:
224         * wasm/function-tests/brTableWithLoop.js:
225         * wasm/function-tests/dumb-eq-if-then-else.js:
226         * wasm/function-tests/dumb-less-than-fallthrough.js:
227         * wasm/function-tests/dumb-less-than-ite.js:
228         * wasm/function-tests/eqz.js:
229         * wasm/function-tests/factorial.js:
230         * wasm/function-tests/float-sub.js:
231         * wasm/function-tests/i32-load.js:
232         * wasm/function-tests/i32-load8-s.js:
233         * wasm/function-tests/if-then-else-fallthrough.js:
234         * wasm/function-tests/if-then-fallthrough.js:
235         * wasm/function-tests/loop-mult.js:
236         * wasm/function-tests/loop-sum.js:
237         * wasm/function-tests/max.js:
238         * wasm/function-tests/min.js:
239         * wasm/function-tests/ret5.js:
240         * wasm/function-tests/select.js:
241         * wasm/self-test/test_BuilderJSON.js:
242
243 2016-11-29  JF Bastien  <jfbastien@apple.com>
244
245         WebAssembly JS API: improve Instance
246         https://bugs.webkit.org/show_bug.cgi?id=164757
247
248         Reviewed by Keith Miller.
249
250         An Instance's `exports` property wasn't populated with exports.
251
252         A follow-up patch will do imports.
253
254         A few things of note:
255
256          - LowLevelBinary: support 3-byte integers.
257          - LowLevelBinary: support proper UTF-8 2003 code points (instead of UTF-16).
258
259         * wasm/Builder.js:
260         * wasm/Builder_WebAssemblyBinary.js: wire up exports, stub other things out some more
261         (const.emitters.Export):
262         * wasm/LowLevelBinary.js:
263         (export.default.LowLevelBinary.prototype.uint24): add, used for UTF-8
264         (export.default.LowLevelBinary.prototype.string): support UTF-8
265         (export.default.LowLevelBinary.prototype.getUint24): add, used for UTF-8
266         (export.default.LowLevelBinary.prototype.getVaruint1): was missing
267         (export.default.LowLevelBinary.prototype.getString): support UTF-8
268         (export.default.LowLevelBinary):
269         * wasm/js-api/test_Instance.js: instance.exports.answer() // <-- this is where the magic of this entire patch is
270         (ExportedAnswerI32):
271         * wasm/js-api/test_basic_api.js: punt test to later
272         (const.c.in.constructorProperties.switch):
273         * wasm/self-test/test_BuilderWebAssembly.js: UTF-8
274         (CustomSection):
275         * wasm/self-test/test_LowLevelBinary_string.js: UTF-8 now works
276         * wasm/self-test/test_LowLevelBinary_uint16.js: was missing one value
277         * wasm/self-test/test_LowLevelBinary_uint24.js: Copied from JSTests/wasm/self-test/test_LowLevelBinary_uint8.js.
278         * wasm/self-test/test_LowLevelBinary_uint8.js: was missing one value
279         * wasm/self-test/test_LowLevelBinary_varuint1.js: Added.
280         * wasm/utilities.js: this `dump` thing was useful
281         (const._dump):
282
283 2016-11-29  Saam Barati  <sbarati@apple.com>
284
285         We should be able optimize the pattern where we spread a function's rest parameter to another call
286         https://bugs.webkit.org/show_bug.cgi?id=163865
287
288         Reviewed by Filip Pizlo.
289
290         * microbenchmarks/default-derived-constructor.js: Added.
291         (createClassHierarchy.let.currentClass):
292         (createClassHierarchy):
293         * stress/call-varargs-spread.js: Added.
294         (assert):
295         (bar):
296         (foo):
297         * stress/load-varargs-on-new-array-with-spread-convert-to-static-loads.js: Added.
298         (assert):
299         (baz):
300         (bar):
301         (foo):
302         * stress/new-array-with-spread-with-normal-spread-and-phantom-spread.js: Added.
303         (assert):
304         (foo):
305         (escape):
306         (bar):
307         * stress/phantom-new-array-with-spread-osr-exit.js: Added.
308         (assert):
309         (baz):
310         (bar):
311         (effects):
312         (foo):
313         * stress/phantom-spread-forward-varargs.js: Added.
314         (assert):
315         (test1.bar):
316         (test1.foo):
317         (test1):
318         (test2.bar):
319         (test2.foo):
320         (test3.baz):
321         (test3.bar):
322         (test3.foo):
323         (test4.baz):
324         (test4.bar):
325         (test4.foo):
326         (test5.baz):
327         (test5.bar):
328         (test5.foo):
329         * stress/phantom-spread-osr-exit.js: Added.
330         (assert):
331         (baz):
332         (bar):
333         (effects):
334         (foo):
335         * stress/spread-call-convert-to-static-call.js: Added.
336         (assert):
337         (baz):
338         (bar):
339         (foo):
340         * stress/spread-forward-call-varargs-stack-overflow.js: Added.
341         (assert):
342         (identity):
343         (bar):
344         (foo):
345         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol-2.js: Added.
346         (assert):
347         (baz.Array.prototype.Symbol.iterator):
348         (baz):
349         (bar):
350         (foo):
351         (test):
352         * stress/spread-forward-varargs-rest-parameter-change-iterator-protocol.js: Added.
353         (assert):
354         (baz.Array.prototype.Symbol.iterator):
355         (baz):
356         (bar):
357         (foo):
358         * stress/spread-forward-varargs-stack-overflow.js: Added.
359         (assert):
360         (bar):
361         (foo):
362
363 2016-11-29  Caitlin Potter  <caitp@igalia.com>
364
365         [JSC] always wrap AwaitExpression operand in a new Promise
366         https://bugs.webkit.org/show_bug.cgi?id=165181
367
368         Reviewed by Yusuke Suzuki.
369
370         * stress/async-await-basic.js:
371         (async.awaitedPromisesAreWrapped):
372
373 2016-11-29  Keith Miller  <keith_miller@apple.com>
374
375         Add simple way to implement Wasm ops that require more than one B3 opcode
376         https://bugs.webkit.org/show_bug.cgi?id=165129
377
378         Reviewed by Geoffrey Garen.
379
380         * wasm/function-tests/eqz.js: Added.
381         * wasm/function-tests/max.js: Added.
382         * wasm/function-tests/min.js: Added.
383         * wasm/wasm.json:
384
385 2016-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
386
387         Crash in com.apple.JavaScriptCore: WTF::ThreadSpecific<WTF::WTFThreadData, + 142
388         https://bugs.webkit.org/show_bug.cgi?id=164898
389
390         Reviewed by Darin Adler.
391
392         * stress/tagged-template-registry-key-collect.js: Added.
393         (shouldBe):
394         (tag):
395         (i.eval):
396         * stress/tagged-template-registry-key.js: Added.
397         (shouldBe):
398         (tag):
399         (a):
400         (b):
401
402 2016-11-20  Caitlin Potter  <caitp@igalia.com>
403
404         [JSC] speed up parsing of async functions
405         https://bugs.webkit.org/show_bug.cgi?id=164808
406
407         Reviewed by Yusuke Suzuki.
408
409         Add tests for line terminator following "async" keyword in async
410         function syntax.
411
412         * stress/async-await-syntax.js:
413         (shouldBe):
414
415 2016-11-19  Mark Lam  <mark.lam@apple.com>
416
417         op_mod-* JSC tests needs a longer timeout too.
418         https://bugs.webkit.org/show_bug.cgi?id=164994
419
420         Reviewed by Yusuke Suzuki.
421
422         * stress/op_mod-ConstVar.js:
423         * stress/op_mod-VarConst.js:
424         * stress/op_mod-VarVar.js:
425
426 2016-11-19  Mark Lam  <mark.lam@apple.com>
427
428         Add --timeoutMultiplier option to allow some tests more time to run.
429         https://bugs.webkit.org/show_bug.cgi?id=164951
430
431         Reviewed by Yusuke Suzuki.
432
433         Extended the timeout for these tests by 50% more because they run quite slow on
434         low-end machines.
435
436         * stress/op_div-ConstVar.js:
437         * stress/op_div-VarConst.js:
438         * stress/op_div-VarVar.js:
439
440 2016-11-18  Yusuke Suzuki  <utatane.tea@gmail.com>
441
442         REGRESSION(r208867): JSC test failure: ChakraCore.yaml/ChakraCore/test/strict/05.arguments_sm.js.default
443         https://bugs.webkit.org/show_bug.cgi?id=164929
444
445         Reviewed by Mark Lam.
446
447         ES2017 drops arguments.caller and JavaScriptCore is updated to meet the spec.
448         This patch rebaselines the result of ChakraCore test for JSC.
449
450         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
451
452 2016-11-18  Joseph Pecoraro  <pecoraro@apple.com>
453
454         Web Inspector: Generator functions should have a displayable name when shown in stack traces
455         https://bugs.webkit.org/show_bug.cgi?id=164844
456         <rdar://problem/29300697>
457
458         Reviewed by Yusuke Suzuki.
459
460         * stress/generator-function-name.js:
461         Add another test now that we name the inner generator function
462         that we do not break the lexical resolution of names.
463
464 2016-11-17  Yusuke Suzuki  <utatane.tea@gmail.com>
465
466         [JSC] Drop arguments.caller
467         https://bugs.webkit.org/show_bug.cgi?id=164859
468
469         Reviewed by Saam Barati.
470
471         * stress/strict-mode-arguments-caller.js: Added.
472         (strictArguments):
473         (shouldBe):
474
475 2016-11-17  Keith Miller  <keith_miller@apple.com>
476
477         Add rotate to Wasm
478         https://bugs.webkit.org/show_bug.cgi?id=164871
479
480         Reviewed by Filip Pizlo.
481
482         * wasm/wasm.json:
483
484 2016-11-17  Keith Miller  <keith_miller@apple.com>
485
486         Add sqrt to Wasm
487         https://bugs.webkit.org/show_bug.cgi?id=164877
488
489         Reviewed by Mark Lam.
490
491         B3 already has a Sqrt opcode we just need to map Wasm to it.
492
493         * wasm/wasm.json:
494
495 2016-11-17  Saam Barati  <sbarati@apple.com>
496
497         Remove async/await compile time flag and enable tests
498         https://bugs.webkit.org/show_bug.cgi?id=164828
499         <rdar://problem/28639334>
500
501         Reviewed by Yusuke Suzuki.
502
503         * stress/async-arrow-functions-lexical-arguments-binding.js:
504         * stress/async-arrow-functions-lexical-new.target-binding.js:
505         * stress/async-arrow-functions-lexical-super-binding.js:
506         * stress/async-arrow-functions-lexical-this-binding.js:
507         * stress/async-await-basic.js:
508         * stress/async-await-long-loop.js:
509         * stress/async-await-module-reserved-word.js:
510         * stress/async-await-mozilla.js:
511         (mozSyntaxErrors):
512         * stress/async-await-reserved-word.js:
513         * stress/async-await-syntax.js:
514         * stress/async-await-throw-loop.js:
515         * stress/async-function-create-nobaseline.js:
516         * stress/async-function-create-optimized.js:
517         * stress/async-function-declaration-sinking-no-double-allocate.js:
518         * stress/async-function-declaration-sinking-osrexit.js:
519         * stress/async-function-declaration-sinking-put.js:
520         * stress/async-function-expression-sinking-no-double-allocate.js:
521         * stress/async-function-expression-sinking-osrexit.js:
522         * stress/async-function-expression-sinking-put.js:
523         * test262.yaml:
524
525 2016-11-15  Mark Lam  <mark.lam@apple.com>
526
527         Make JSC test functions more robust.
528         https://bugs.webkit.org/show_bug.cgi?id=164807
529
530         Reviewed by Keith Miller.
531
532         * stress/jsc-test-functions-should-be-more-robust.js: Added.
533
534 2016-11-15  Keith Miller  <keith_miller@apple.com>
535
536         B3 should support UDiv/UMod
537         https://bugs.webkit.org/show_bug.cgi?id=164811
538
539         Reviewed by Filip Pizlo.
540
541         Link new instructions to wasm.
542
543         * wasm/wasm.json:
544
545 2016-11-15  Saam Barati  <sbarati@apple.com>
546
547         Debug JSC test timeout: stress/has-own-property-name-cache-symbols-and-strings.js.ftl-no-cjit-small-pool
548         https://bugs.webkit.org/show_bug.cgi?id=163012
549
550         Unreviewed. This patch makes a test run for less time because it's timing out on the bots.
551
552         * stress/has-own-property-name-cache-symbols-and-strings.js:
553
554 2016-11-15  Mark Lam  <mark.lam@apple.com>
555
556         The jsc shell's setImpureGetterDelegate() should ensure that the set value is an ImpureGetter.
557         https://bugs.webkit.org/show_bug.cgi?id=164781
558         <rdar://problem/28418590>
559
560         Reviewed by Geoffrey Garen and Michael Saboff.
561
562         * stress/jsc-setImpureGetterDelegate-on-bad-type.js: Added.
563
564 2016-11-15  Yusuke Suzuki  <utatane.tea@gmail.com>
565
566         [DOMJIT] Allow using macro assembler scratches in FTL CheckDOM
567         https://bugs.webkit.org/show_bug.cgi?id=164727
568
569         Reviewed by Filip Pizlo.
570
571         * stress/check-dom-with-signature.js: Added.
572         (shouldBe):
573         (calling):
574         (i.array.forEach):
575
576 2016-11-14  Caitlin Potter  <caitp@igalia.com>
577
578         [JSC] do not reference AwaitExpression Promises in async function Promise chain
579         https://bugs.webkit.org/show_bug.cgi?id=164753
580
581         Reviewed by Yusuke Suzuki.
582
583         * asyncFunctionTests.yaml:
584         * stress/async-await-long-loop.js: Added.
585         (shouldBe):
586         (async.longLoop):
587         * stress/async-await-throw-loop.js: Added.
588         (shouldBe):
589         (async.thrower):
590         (async.throwLoop):
591
592 2016-11-14  Keith Miller  <keith_miller@apple.com>
593
594         Add Wasm select
595         https://bugs.webkit.org/show_bug.cgi?id=164743
596
597         Reviewed by Saam Barati.
598
599         * wasm/function-tests/select.js: Added.
600
601 2016-11-14  Caitlin Potter  <caitp@igalia.com>
602
603         [JSC] Handle new_async_func / new_async_func_exp in DFG / FTL
604         https://bugs.webkit.org/show_bug.cgi?id=164037
605
606         Reviewed by Yusuke Suzuki.
607
608         Add tests based on tests from https://trac.webkit.org/changeset/194216.
609
610         * asyncFunctionTests.yaml:
611         * stress/async-function-create-nobaseline.js: Added.
612         * stress/async-function-create-optimized.js: Added.
613         * stress/async-function-declaration-sinking-no-double-allocate.js: Added.
614         * stress/async-function-declaration-sinking-osrexit.js: Added.
615         * stress/async-function-declaration-sinking-put.js: Added.
616         * stress/async-function-expression-sinking-no-double-allocate.js: Added.
617         * stress/async-function-expression-sinking-osrexit.js: Added.
618         * stress/async-function-expression-sinking-put.js: Added.
619
620 2016-11-14  Mark Lam  <mark.lam@apple.com>
621
622         Some of JSStringView::SafeView methods are not idiomatically safe for JSString to StringView conversions.
623         https://bugs.webkit.org/show_bug.cgi?id=164701
624         <rdar://problem/27462104>
625
626         Reviewed by Darin Adler.
627
628         * stress/string-prototype-charCodeAt-on-too-long-rope.js: Added.
629
630 2016-11-14  Mark Lam  <mark.lam@apple.com>
631
632         RegExpObject::exec/match should handle errors gracefully.
633         https://bugs.webkit.org/show_bug.cgi?id=155145
634         <rdar://problem/27435934>
635
636         Reviewed by Keith Miller.
637
638         * stress/regexp-prototype-exec-on-too-long-rope.js: Added.
639         * stress/regexp-prototype-match-on-too-long-rope.js: Added.
640         * stress/regexp-prototype-test-on-too-long-rope.js: Added.
641
642 2016-11-14  Mark Lam  <mark.lam@apple.com>
643
644         Enhance run-jsc-stress-test script to allow optional test specific options to be added for all test run configurations.
645         https://bugs.webkit.org/show_bug.cgi?id=164695
646
647         Reviewed by Keith Miller.
648
649         Replace use of runMisc* test run configurations with equivalents.
650
651         * stress/licm-no-pre-header-nested.js:
652         * stress/licm-no-pre-header.js:
653         * stress/licm-pre-header-cannot-exit-nested.js:
654         * stress/licm-pre-header-cannot-exit.js:
655         * stress/make-dictionary-repatch.js:
656         * stress/retry-cache-later.js:
657         * stress/shadow-chicken-reading-from-scope-after-ftl-osr-exit-bytecode-liveness.js:
658         * stress/slow-path-generator-updating-current-node-dfg.js:
659         * stress/unshift-array-storage.js:
660
661 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
662
663         test262: DataView with explicit undefined byteLength should be the same as it not being present
664         https://bugs.webkit.org/show_bug.cgi?id=164453
665
666         Reviewed by Darin Adler.
667
668         * stress/dataview-construct.js: Added.
669         (assert):
670         (shouldThrow):
671         * test262.yaml:
672
673 2016-11-11  Joseph Pecoraro  <pecoraro@apple.com>
674
675         test262: DataView get methods should allow for missing offset, set methods should allow for missing value
676         https://bugs.webkit.org/show_bug.cgi?id=164451
677
678         Reviewed by Darin Adler.
679
680         * test262.yaml:
681
682 2016-11-11  Saam Barati  <sbarati@apple.com>
683
684         We should have a more concise way of determining when we're varargs calling a function using rest parameters
685         https://bugs.webkit.org/show_bug.cgi?id=164258
686
687         Reviewed by Yusuke Suzuki.
688
689         * microbenchmarks/call-using-spread.js: Added.
690         (bar):
691         (foo):
692         * microbenchmarks/spread-large-array.js: Added.
693         (foo):
694         (arrays.push):
695         * microbenchmarks/spread-small-array.js: Added.
696         (foo):
697         * stress/spread-array-iterator-watchpoint-2.js: Added.
698         (foo):
699         (arrayIterator.next):
700         * stress/spread-array-iterator-watchpoint.js: Added.
701         (foo):
702         (Array.prototype.Symbol.iterator):
703         * stress/spread-non-array.js: Added.
704         (assert):
705         (foo):
706         (let.customIterator.Symbol.iterator):
707         (bar):
708
709 2016-11-11  Keith Miller  <keith_miller@apple.com>
710
711         Relocate wasm tests and actually add them to the test runner
712         https://bugs.webkit.org/show_bug.cgi?id=164668
713
714         Reviewed by Yusuke Suzuki.
715
716         This moves the Wasm tests from their current location down a level.
717         Without relocating, the tests cannot properly be run by the wasm test runner.
718
719         * wasm.yaml:
720         * wasm/Builder.js: Fix typos, yay lazy synatx checking!
721         * wasm/LowLevelBinary.js: Fix typos, yay lazy synatx checking!
722         (export.default.LowLevelBinary.prototype.get return):
723         * wasm/function-tests/add-12.js: Renamed from JSTests/wasm/js-api/function-tests/add-12.js.
724         * wasm/function-tests/br-if-loop-less-than.js: Renamed from JSTests/wasm/js-api/function-tests/br-if-loop-less-than.js.
725         * wasm/function-tests/brTableAsIf.js: Renamed from JSTests/wasm/js-api/function-tests/brTableAsIf.js.
726         * wasm/function-tests/brTableManyValues.js: Renamed from JSTests/wasm/js-api/function-tests/brTableManyValues.js.
727         * wasm/function-tests/brTableWithLoop.js: Renamed from JSTests/wasm/js-api/function-tests/brTableWithLoop.js.
728         * wasm/function-tests/dumb-eq-if-then-else.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-eq-if-then-else.js.
729         * wasm/function-tests/dumb-less-than-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-fallthrough.js.
730         * wasm/function-tests/dumb-less-than-ite.js: Renamed from JSTests/wasm/js-api/function-tests/dumb-less-than-ite.js.
731         * wasm/function-tests/factorial.js: Renamed from JSTests/wasm/js-api/function-tests/factorial.js.
732         * wasm/function-tests/float-sub.js: Renamed from JSTests/wasm/js-api/function-tests/float-sub.js.
733         * wasm/function-tests/i32-load.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load.js.
734         * wasm/function-tests/i32-load8-s.js: Renamed from JSTests/wasm/js-api/function-tests/i32-load8-s.js.
735         * wasm/function-tests/if-then-else-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-else-fallthrough.js.
736         * wasm/function-tests/if-then-fallthrough.js: Renamed from JSTests/wasm/js-api/function-tests/if-then-fallthrough.js.
737         * wasm/function-tests/loop-mult.js: Renamed from JSTests/wasm/js-api/function-tests/loop-mult.js.
738         * wasm/function-tests/loop-sum.js: Renamed from JSTests/wasm/js-api/function-tests/loop-sum.js.
739         * wasm/function-tests/ret5.js: Renamed from JSTests/wasm/js-api/function-tests/ret5.js.
740         * wasm/self-test/test_BuilderJSON.js: Rebasline
741
742 2016-11-11  Keith Miller  <keith_miller@apple.com>
743
744         Move Wasm tests to JS
745         https://bugs.webkit.org/show_bug.cgi?id=164611
746
747         Reviewed by Geoffrey Garen.
748
749         This patch translates most of the tests from testWasm.cpp to the JS testing api. Most of the
750         ommited tests were earliest tests, which tested trivial things, like adding two
751         constants. Some tests are ommited for other reasons, however. These are:
752
753         1) Tests using I64 since the testing api does not yet know how to handle 64-bit numbers.  2)
754         Tests that would validate the memory of the module once wasm was done with it since that's
755         not really possible in JS.
756
757         In order to make such a translation easier this patch also adds some features to the JS
758         testing api:
759
760         1) Blocks can now be done lexically by adding a lambda as the last argument of the block
761         opcode. For example one can do:
762             ...
763             .Block("i32", b => b.I32Const(1) )
764
765         and the nested lambda will automatically have an end attached.
766
767         2) The JS testing api can now handle inline signature types.
768
769         3) Relocate some code to make it easier to follow and prevent 44 space indentation.
770
771         4) Rename varuint/varint to varuint32/varint32, this lets them be directly called from the
772         wasm.json without being remapped.
773
774         5) Add support for Memory and Function sections to the Builder.
775
776         6) Add support for local variables.
777
778         On the JSC side, we needed to expose a new function to validate the compiled wasm code
779         behaves the way we expect. At least until the JS Wasm API is finished. The new validation
780         function, testWasmModuleFunctions, takes an array buffer containing the wasm binary, the
781         number of functions in the blob and tests for each of those functions.
782
783         * wasm/Builder.js:
784         (const._maybeRegisterType):
785         (const): Deleted.
786         (switch.typeof): Deleted.
787         * wasm/Builder_WebAssemblyBinary.js:
788         (const.emitters.Type):
789         (const.emitters.Import):
790         (const.emitters.Function):
791         (const.emitters.Memory):
792         (const.emitters.Code):
793         (export.const.Binary):
794         * wasm/LowLevelBinary.js:
795         (export.default.LowLevelBinary.prototype.get return):
796         (export.default.LowLevelBinary.prototype.varuint32):
797         (export.default.LowLevelBinary.prototype.varint32):
798         (export.default.LowLevelBinary.prototype.varuint1):
799         (export.default.LowLevelBinary.prototype.varint7):
800         (export.default.LowLevelBinary.prototype.varuint7):
801         (export.default.LowLevelBinary.prototype.inline_signature_type):
802         (export.default.LowLevelBinary.prototype.string):
803         (export.default.LowLevelBinary.prototype.getVaruint32):
804         (export.default.LowLevelBinary.prototype.getVarint32):
805         (export.default.LowLevelBinary.prototype.getVaruint7):
806         (export.default.LowLevelBinary.prototype.getString):
807         (export.default.LowLevelBinary):
808         (export.default.LowLevelBinary.prototype.varuint): Deleted.
809         (export.default.LowLevelBinary.prototype.varint): Deleted.
810         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
811         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
812         * wasm/js-api/test_old_tests.js: Added.
813         (ret5):
814         (brTableWithLoop):
815         (brTableManyValues):
816         (run.brTableManyValues.brTableAsIf):
817         (ifThenFallthrough):
818         (ifThenElseFallthrough):
819         (dumbLessThanFallthrough):
820         (run.dumbLessThanFallthrough.floatSub):
821         (run.floatSub.add12):
822         (run.add12.factorial):
823         (i32load):
824         (run.i32load.i32load8s):
825         (run.i32load8s.dumbEqIfThenElse):
826         (run.dumbEqIfThenElse.dumbEqIfThenElse):
827         (run.dumbEqIfThenElse.dumbLessThanIfThenElse):
828         (run.dumbLessThanIfThenElse.loopSum):
829         (run.loopSum.loopMult):
830         (brIfLoopLessThan):
831         (run.brIfLoopLessThan.run):
832         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
833         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
834
835         * wasm/Builder.js:
836         (const._maybeRegisterType):
837         (const): Deleted.
838         (switch.typeof): Deleted.
839         * wasm/Builder_WebAssemblyBinary.js:
840         (const.emitters.Type):
841         (const.emitters.Import):
842         (const.emitters.Function):
843         (const.emitters.Memory):
844         (const.emitters.Code):
845         (export.const.Binary):
846         * wasm/LowLevelBinary.js:
847         (export.default.LowLevelBinary.prototype.get return):
848         (export.default.LowLevelBinary.prototype.varuint32):
849         (export.default.LowLevelBinary.prototype.varint32):
850         (export.default.LowLevelBinary.prototype.varuint1):
851         (export.default.LowLevelBinary.prototype.varint7):
852         (export.default.LowLevelBinary.prototype.varuint7):
853         (export.default.LowLevelBinary.prototype.inline_signature_type):
854         (export.default.LowLevelBinary.prototype.string):
855         (export.default.LowLevelBinary.prototype.getVaruint32):
856         (export.default.LowLevelBinary.prototype.getVarint32):
857         (export.default.LowLevelBinary.prototype.getVaruint7):
858         (export.default.LowLevelBinary.prototype.getString):
859         (export.default.LowLevelBinary):
860         (export.default.LowLevelBinary.prototype.varuint): Deleted.
861         (export.default.LowLevelBinary.prototype.varint): Deleted.
862         (export.default.LowLevelBinary.prototype.getVaruint): Deleted.
863         (export.default.LowLevelBinary.prototype.getVarint): Deleted.
864         * wasm/js-api/function-tests/add-12.js: Added.
865         * wasm/js-api/function-tests/br-if-loop-less-than.js: Added.
866         * wasm/js-api/function-tests/brTableAsIf.js: Added.
867         * wasm/js-api/function-tests/brTableManyValues.js: Added.
868         * wasm/js-api/function-tests/brTableWithLoop.js: Added.
869         * wasm/js-api/function-tests/dumb-eq-if-then-else.js: Added.
870         * wasm/js-api/function-tests/dumb-less-than-fallthrough.js: Added.
871         * wasm/js-api/function-tests/dumb-less-than-ite.js: Added.
872         * wasm/js-api/function-tests/factorial.js: Added.
873         * wasm/js-api/function-tests/float-sub.js: Added.
874         * wasm/js-api/function-tests/i32-load.js: Added.
875         * wasm/js-api/function-tests/i32-load8-s.js: Added.
876         * wasm/js-api/function-tests/if-then-else-fallthrough.js: Added.
877         * wasm/js-api/function-tests/if-then-fallthrough.js: Added.
878         * wasm/js-api/function-tests/loop-mult.js: Added.
879         * wasm/js-api/function-tests/loop-sum.js: Added.
880         * wasm/js-api/function-tests/ret5.js: Added.
881         * wasm/self-test/test_LowLevelBinary_varint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varint.js.
882         * wasm/self-test/test_LowLevelBinary_varuint32.js: Renamed from JSTests/wasm/self-test/test_LowLevelBinary_varuint.js.
883
884 2016-11-11  Saam Barati  <sbarati@apple.com>
885
886         We recursively grab a lock in the DFGBytecodeParser causing us to deadlock
887         https://bugs.webkit.org/show_bug.cgi?id=164650
888
889         Reviewed by Geoffrey Garen.
890
891         * stress/dont-dead-lock-put-by-val-as-put-by-id.js: Added.
892         (ident):
893         (let.o.set foo):
894         (foo):
895
896 2016-11-11  Chris Dumez  <cdumez@apple.com>
897
898         Unreviewed, rolling out r208584.
899
900         Seems to have regressed Speedometer by 1% on Mac
901
902         Reverted changeset:
903
904         "We should have a more concise way of determining when we're
905         varargs calling a function using rest parameters"
906         https://bugs.webkit.org/show_bug.cgi?id=164258
907         http://trac.webkit.org/changeset/208584
908
909 2016-11-11  Chris Dumez  <cdumez@apple.com>
910
911         Unreviewed, rolling out r208117 and r208160.
912
913         Regressed Speedometer by >1.5%
914
915         Reverted changesets:
916
917         "We should have a way of profiling when a get_by_id is pure
918         and to emit a PureGetById in the DFG/FTL"
919         https://bugs.webkit.org/show_bug.cgi?id=163305
920         http://trac.webkit.org/changeset/208117
921
922         "Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing
923         out"
924         https://bugs.webkit.org/show_bug.cgi?id=164227
925         http://trac.webkit.org/changeset/208160
926
927 2016-11-11  Saam Barati  <sbarati@apple.com>
928
929         We should have a more concise way of determining when we're varargs calling a function using rest parameters
930         https://bugs.webkit.org/show_bug.cgi?id=164258
931
932         Reviewed by Yusuke Suzuki.
933
934         * microbenchmarks/call-using-spread.js: Added.
935         (bar):
936         (foo):
937         * microbenchmarks/spread-large-array.js: Added.
938         (foo):
939         (arrays.push):
940         * microbenchmarks/spread-small-array.js: Added.
941         (foo):
942         * stress/spread-array-iterator-watchpoint-2.js: Added.
943         (foo):
944         (arrayIterator.next):
945         * stress/spread-array-iterator-watchpoint.js: Added.
946         (foo):
947         (Array.prototype.Symbol.iterator):
948         * stress/spread-non-array.js: Added.
949         (assert):
950         (foo):
951         (let.customIterator.Symbol.iterator):
952         (bar):
953
954 2016-11-10  Mark Lam  <mark.lam@apple.com>
955
956         Fix broken have-a-bad-time-with-arguments.js test.
957         https://bugs.webkit.org/show_bug.cgi?id=164626
958
959         Reviewed by Filip Pizlo.
960
961         But also saved a copy of the broken one as broken-have-a-bad-time-with-arguments-for-gc-testing.js
962         because coincidentally, it stresses the GC in ways that help reveal bugs.
963
964         * stress/broken-have-a-bad-time-with-arguments-for-gc-testing.js: Added.
965         (testFunction):
966         (warmupFunction):
967         (let.argsDeclIndex.in.argumentsDecls.let.indexToReturnIndex.in.indicesToReturn.let.insertElementActionIndex.in.insertElementActions.let.tierWarmupCountIndex.in.tierWarmupCounts.let.testArgsIndex.in.testArgsList.catch):
968         * stress/have-a-bad-time-with-arguments.js:
969
970 2016-11-10  JF Bastien  <jfbastien@apple.com>
971
972         ASSERTION FAILED: length > offset encountered with wasm.yaml/wasm/js-api/test_Module.js.default-wasm
973         https://bugs.webkit.org/show_bug.cgi?id=164597
974
975         Reviewed by Keith Miller.
976
977         Trim the array buffer before returning it: it's optimistically
978         over-allocated to avoid growing all the time, but when parsed it
979         can't have extra content.
980
981         * wasm/Builder_WebAssemblyBinary.js:
982         (export.const.Binary):
983         * wasm/LowLevelBinary.js:
984         (export.default.LowLevelBinary.prototype.get return):
985
986 2016-11-10  Joseph Pecoraro  <pecoraro@apple.com>
987
988         test262: DataView / TypedArray methods should throw RangeErrors for negative numbers (ToIndex)
989         https://bugs.webkit.org/show_bug.cgi?id=164450
990
991         Reviewed by Darin Adler.
992
993         * stress/dataview-typedarray-toindex.js: Added.
994         Tests for all cases where ToIndex should be used.
995
996         * test262.yaml:
997         New passing tests.
998
999 2016-11-10  Mark Lam  <mark.lam@apple.com>
1000
1001         Graph::methodOfGettingAValueProfileFor() should be returning the profile for the operand node.
1002         https://bugs.webkit.org/show_bug.cgi?id=164600
1003         <rdar://problem/28828676>
1004
1005         Reviewed by Filip Pizlo.
1006
1007         * stress/osr-exit-on-op-negate-should-no-fail-assertions.js: Added.
1008
1009 2016-11-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1010
1011         [JSC] Avoid cloned arguments allocation in ArrayPrototype methods
1012         https://bugs.webkit.org/show_bug.cgi?id=164502
1013
1014         Reviewed by Saam Barati.
1015
1016         * stress/argument-intrinsic-basic.js: Added.
1017         (shouldBe):
1018         (builtin.createBuiltin):
1019         * stress/argument-intrinsic-inlining-with-result-escape.js: Added.
1020         (shouldBe):
1021         (builtin.createBuiltin):
1022         (escape):
1023         * stress/argument-intrinsic-nested-inlining.js: Added.
1024         (shouldBe):
1025         (builtin.createBuiltin):
1026         (builtinCaller1):
1027         (builtinCaller2):
1028         (escape):
1029         * stress/argument-intrinsic-not-convert-to-get-argument.js: Added.
1030         (shouldBe):
1031         (builtin.createBuiltin):
1032         * stress/argument-intrinsic-with-stack-write.js: Added.
1033         (shouldBe):
1034         (builtin.createBuiltin):
1035
1036 2016-11-09  Saam Barati  <sbarati@apple.com>
1037
1038         Math.min()/Math.max() with no arguments is lowered incorrectly in the BytecodeParser
1039         https://bugs.webkit.org/show_bug.cgi?id=164464
1040         <rdar://problem/29131452>
1041
1042         Reviewed by Darin Adler.
1043
1044         * stress/math-max-min-no-arguments.js: Added.
1045         (assert):
1046         (min):
1047         (max):
1048         (test):
1049
1050 2016-11-09  Saam Barati  <sbarati@apple.com>
1051
1052         TypeProfiler and running GC collection on another thread don't play nicely with each other
1053         https://bugs.webkit.org/show_bug.cgi?id=164441
1054         <rdar://problem/29132174>
1055
1056         Reviewed by Geoffrey Garen.
1057
1058         * typeProfiler/type-profiler-gc.js: Added.
1059         (bar):
1060         (foo):
1061
1062 2016-11-04  Mark Lam  <mark.lam@apple.com>
1063
1064         Error description code should be able to handle Symbol values.
1065         https://bugs.webkit.org/show_bug.cgi?id=164436
1066         <rdar://problem/29115583>
1067
1068         Reviewed by Filip Pizlo and Saam Barati.
1069
1070         * stress/error-description-on-symbols-should-not-crash.js: Added.
1071
1072 2016-11-03  Geoffrey Garen  <ggaren@apple.com>
1073
1074         EvalCodeCache should not give up in strict mode and other cases
1075         https://bugs.webkit.org/show_bug.cgi?id=164357
1076
1077         Reviewed by Michael Saboff.
1078
1079         * microbenchmarks/eval-cached.js: Added. 45x faster now.
1080         * stress/eval-cached.js: Added. Try running the same eval text in a bunch
1081         of different scopes and verify that we access the right scope.
1082
1083 2016-11-04  JF Bastien  <jfbastien@apple.com>
1084
1085         WebAssembly JS API: implement more sections
1086         https://bugs.webkit.org/show_bug.cgi?id=164023
1087
1088         Reviewed by Keith Miller.
1089
1090         On the JSC side:
1091
1092          - Put in parser stubs for all WebAssembly sections.
1093          - Parse Import, Export sections.
1094          - Use tryReserveCapacity instead of reserve, and bail out of the parser if it fails. This prevents the parser from bringing everything down when faced with a malicious input.
1095          - Encapsulate all parsed module information into its own structure, making it easier to pass around (from parser to Plan to Module to Instance).
1096          - Create WasmFormat.cpp to hold parsed module information's dtor to avoid including WasmMemory.h needlessly.
1097          - parseCode: avoid overflow through function size.
1098          - Remove all remainders of polyfill-prototype-1, and update license.
1099          - Add missing WasmOps.h and WasmValidateInlines.h auto-generation for cmake build.
1100
1101         On the Builder.js testing side:
1102
1103          - Implement Type, Import (function only), Export (function only) sections.
1104          - Check section order and uniqueness.
1105          - Optionally auto-generate the Type section from subsequent Export / Import / Code entries.
1106          - Allow re-exporting an import.
1107
1108         * wasm/Builder.js: build type, import, and export sections
1109         (const._normalizeFunctionSignature):
1110         * wasm/Builder_WebAssemblyBinary.js: Added. Forked from Builder.js
1111         (const.emitters.Type):
1112         (const.emitters.Import):
1113         (const.emitters.Function):
1114         (const.emitters.Table):
1115         (const.emitters.Memory):
1116         (const.emitters.Global):
1117         (const.emitters.Export):
1118         (const.emitters.Start):
1119         (const.emitters.Element):
1120         (const.emitters.Code):
1121         (const.emitters.Data):
1122         (export.const.Binary):
1123         * wasm/LowLevelBinary.js: Add a few useful outputs
1124         (export.default.LowLevelBinary.prototype.varuint1):
1125         (export.default.LowLevelBinary.prototype.varint7):
1126         * wasm/WASM.js: value type and external kind helpers
1127         * wasm/assert.js: array element-wise equality comparison
1128         (const._eq):
1129         * wasm/js-api/test_Module.js:
1130         (ModuleWithImports):
1131         * wasm/self-test/test_BuilderJSON.js: many more tests for all the new Builder APIs, and update to some older tests which now require a Type section or rejiggered Function signature
1132         (const.assertOpThrows):
1133         (SectionsWithSameCustomName):
1134         (TwoTypeSections):
1135         (EmptyImportSection):
1136         (ImportBeforeTypeSections):
1137         * wasm/self-test/test_BuilderWebAssembly.js: remove a test which wasn't helpful and is now obsolete
1138         (CustomSection):
1139
1140 2016-11-03  Mark Lam  <mark.lam@apple.com>
1141
1142         ClonedArguments need to also support haveABadTime mode.
1143         https://bugs.webkit.org/show_bug.cgi?id=164200
1144         <rdar://problem/27211336>
1145
1146         Reviewed by Geoffrey Garen.
1147
1148         * stress/have-a-bad-time-with-arguments.js: Added.
1149
1150 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1151
1152         DFG plays fast and loose with the shadow values of a Phi
1153         https://bugs.webkit.org/show_bug.cgi?id=164309
1154
1155         Reviewed by Saam Barati.
1156         
1157         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1158
1159         * stress/dfg-ssa-swap.js: Added.
1160         (foo):
1161
1162 2016-11-03  Commit Queue  <commit-queue@webkit.org>
1163
1164         Unreviewed, rolling out r208364.
1165         https://bugs.webkit.org/show_bug.cgi?id=164402
1166
1167         broke the build (Requested by smfr on #webkit).
1168
1169         Reverted changeset:
1170
1171         "DFG plays fast and loose with the shadow values of a Phi"
1172         https://bugs.webkit.org/show_bug.cgi?id=164309
1173         http://trac.webkit.org/changeset/208364
1174
1175 2016-11-03  Filip Pizlo  <fpizlo@apple.com>
1176
1177         DFG plays fast and loose with the shadow values of a Phi
1178         https://bugs.webkit.org/show_bug.cgi?id=164309
1179
1180         Reviewed by Saam Barati.
1181         
1182         This test demonstrates why the DFG needs to recognize the shadow value of a Phi.
1183
1184         * stress/dfg-ssa-swap.js: Added.
1185         (foo):
1186
1187 2016-11-03  Saam Barati  <sbarati@apple.com>
1188
1189         Asking for a value profile prediction should be defensive against not finding a value profile
1190         https://bugs.webkit.org/show_bug.cgi?id=164306
1191
1192         Reviewed by Mark Lam.
1193
1194         * stress/inlined-tail-call-in-inlined-setter-should-not-crash-when-getting-value-profile.js: Added.
1195         (let.o.set foo):
1196         (bar):
1197
1198 2016-11-02  Saam Barati  <sbarati@apple.com>
1199
1200         Allocation elimination of rest parameter doesn't take into account indexed properties on Array.prototype/Object.prototype
1201         https://bugs.webkit.org/show_bug.cgi?id=164301
1202
1203         Reviewed by Geoffrey Garen.
1204
1205         * stress/rest-parameter-allocation-elimination-watchpoints-2.js: Added.
1206         (assert):
1207         (foo):
1208         * stress/rest-parameter-allocation-elimination-watchpoints-3.js: Added.
1209         (assert):
1210         (foo):
1211         * stress/rest-parameter-allocation-elimination-watchpoints-4.js: Added.
1212         (assert):
1213         (foo):
1214         * stress/rest-parameter-allocation-elimination-watchpoints-5.js: Added.
1215         (assert):
1216         (foo):
1217         * stress/rest-parameter-allocation-elimination-watchpoints-6.js: Added.
1218         (assert):
1219         (foo):
1220         * stress/rest-parameter-allocation-elimination-watchpoints.js: Added.
1221         (assert):
1222         (foo):
1223
1224 2016-11-01  Saam Barati  <sbarati@apple.com>
1225
1226         We should be able to eliminate rest parameter allocations
1227         https://bugs.webkit.org/show_bug.cgi?id=163925
1228
1229         Reviewed by Filip Pizlo.
1230
1231         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1232         (assert):
1233         (test1.bar):
1234         (test1):
1235         (test2.jaz):
1236         (test2.jaz2.kaz):
1237         (test2.jaz2):
1238         (test2):
1239         (test3.foo):
1240         (test3.baz):
1241         (test3.jaz):
1242         (test3):
1243         (test4.baz):
1244         (test4.jaz):
1245         (test4):
1246         (test5.baz):
1247         (test5.jaz):
1248         (test5):
1249         (test6.baz):
1250         (test6.jaz):
1251         (test6):
1252         (test7.baz):
1253         (test7.jaz):
1254         (test7.check):
1255         (test7):
1256         (test8.baz):
1257         (test8.jaz):
1258         (test8.check):
1259         (test8):
1260         (test9.baz):
1261         (test9.jaz):
1262         (test9.check):
1263         (test9):
1264         (test10.baz):
1265         (test10.jaz):
1266         (test10):
1267         (test11.bar):
1268         (test11.foo):
1269         (test11.makeArguments):
1270         (test11.):
1271         (test12):
1272         (test12.bar):
1273         (test12.foo):
1274         (test12.makeArguments):
1275         (test12.):
1276         (test13.bar):
1277         (test13.top):
1278         (test13.foo):
1279         (test13.makeArguments):
1280         (test13.):
1281         (test13):
1282         (test14.bar):
1283         (test14.top):
1284         (test14.foo):
1285         (test14.makeArguments):
1286         (test14.):
1287         (test14):
1288         (test15.bar):
1289         (test15.top):
1290         (test15.foo):
1291         (test15.makeArguments):
1292         (test15.):
1293         (test15):
1294
1295 2016-11-01  Commit Queue  <commit-queue@webkit.org>
1296
1297         Unreviewed, rolling out r208208 and r208210.
1298         https://bugs.webkit.org/show_bug.cgi?id=164276
1299
1300         This change caused 28 JSC test failures. (Requested by
1301         ryanhaddad on #webkit).
1302
1303         Reverted changesets:
1304
1305         "We should be able to eliminate rest parameter allocations"
1306         https://bugs.webkit.org/show_bug.cgi?id=163925
1307         http://trac.webkit.org/changeset/208208
1308
1309         "Fix the EFL build."
1310         http://trac.webkit.org/changeset/208210
1311
1312 2016-10-31  Filip Pizlo  <fpizlo@apple.com>
1313
1314         JSC should support SharedArrayBuffer
1315         https://bugs.webkit.org/show_bug.cgi?id=163986
1316
1317         Reviewed by Keith Miller.
1318         
1319         This adds our own test for the various corner cases of SharedArrayBuffer. This test is meant to
1320         check all of the things that don't require concurrency.
1321
1322         * stress/SharedArrayBuffer.js: Added.
1323         (checkAtomics):
1324         (shouldFail):
1325         (Symbol):
1326         (runAtomic):
1327
1328 2016-10-31  Saam Barati  <sbarati@apple.com>
1329
1330         We should be able to eliminate rest parameter allocations
1331         https://bugs.webkit.org/show_bug.cgi?id=163925
1332
1333         Reviewed by Filip Pizlo.
1334
1335         * microbenchmarks/rest-parameter-allocation-elimination.js: Added.
1336         (assert):
1337         (test1.bar):
1338         (test1):
1339         (test2.jaz):
1340         (test2.jaz2.kaz):
1341         (test2.jaz2):
1342         (test2):
1343         (test3.foo):
1344         (test3.baz):
1345         (test3.jaz):
1346         (test3):
1347         (test4.baz):
1348         (test4.jaz):
1349         (test4):
1350         (test5.baz):
1351         (test5.jaz):
1352         (test5):
1353         (test6.baz):
1354         (test6.jaz):
1355         (test6):
1356         (test7.baz):
1357         (test7.jaz):
1358         (test7.check):
1359         (test7):
1360         (test8.baz):
1361         (test8.jaz):
1362         (test8.check):
1363         (test8):
1364         (test9.baz):
1365         (test9.jaz):
1366         (test9.check):
1367         (test9):
1368         (test10.baz):
1369         (test10.jaz):
1370         (test10):
1371         (test11.bar):
1372         (test11.foo):
1373         (test11.makeArguments):
1374         (test11.):
1375         (test12):
1376         (test12.bar):
1377         (test12.foo):
1378         (test12.makeArguments):
1379         (test12.):
1380         (test13.bar):
1381         (test13.top):
1382         (test13.foo):
1383         (test13.makeArguments):
1384         (test13.):
1385         (test13):
1386         (test14.bar):
1387         (test14.top):
1388         (test14.foo):
1389         (test14.makeArguments):
1390         (test14.):
1391         (test14):
1392         (test15.bar):
1393         (test15.top):
1394         (test15.foo):
1395         (test15.makeArguments):
1396         (test15.):
1397         (test15):
1398
1399 2016-10-31  Saam Barati  <sbarati@apple.com>
1400
1401         Debug JSC test microbenchmarks/pure-get-by-id-cse-2.js timing out
1402         https://bugs.webkit.org/show_bug.cgi?id=164227
1403
1404         Unreviewed timeout fix.
1405
1406         * microbenchmarks/pure-get-by-id-cse-2.js:
1407
1408 2016-10-31  Keith Miller  <keith_miller@apple.com>
1409
1410         autogenerated files from wasm.json should be in derived sources.
1411         https://bugs.webkit.org/show_bug.cgi?id=164152
1412
1413         Reviewed by Filip Pizlo.
1414
1415         Delete generation script since it is no longer used.
1416
1417         * wasm/generate-wasmops-header.js: Removed.
1418
1419 2016-10-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1420
1421         [JSC] JSON.stringify should handle Proxy which is non JSArray but isArray is true
1422         https://bugs.webkit.org/show_bug.cgi?id=164123
1423
1424         Reviewed by Mark Lam.
1425
1426         * stress/json-stringify-with-non-jsarray-array.js: Added.
1427         (shouldBe):
1428         (shouldBe.JSON.stringify.new.Proxy):
1429
1430 2016-10-29  Saam Barati  <sbarati@apple.com>
1431
1432         We should have a way of profiling when a get_by_id is pure and to emit a PureGetById in the DFG/FTL
1433         https://bugs.webkit.org/show_bug.cgi?id=163305
1434
1435         Reviewed by Keith Miller.
1436
1437         * microbenchmarks/pure-get-by-id-cse-2.js: Added.
1438         (foo):
1439         * microbenchmarks/pure-get-by-id-cse.js: Added.
1440         (foo):
1441         * stress/pure-get-by-id-cse-correctness.js: Added.
1442         (assert):
1443         (foo):
1444         * stress/pure-get-by-id-on-non-object.js: Added.
1445         (assert):
1446         (foo):
1447
1448 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1449
1450         Skip JSTests/microbenchmarks/dense-set.js on memory limited devices
1451         https://bugs.webkit.org/show_bug.cgi?id=164128
1452
1453         Reviewed by Mark Lam.
1454
1455         * microbenchmarks/dense-set.js:
1456
1457 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1458
1459         [JSC] implement runtime for async functions
1460         https://bugs.webkit.org/show_bug.cgi?id=163760
1461
1462         Reviewed by Yusuke Suzuki.
1463
1464         * stress/async-await-basic.js: Added.
1465         (shouldBe):
1466         (shouldBeAsync):
1467         (shouldThrow):
1468         (shouldThrowAsync):
1469         (shouldThrowSyntaxError):
1470         (let.AsyncFunction.async):
1471         (async.asyncFunctionForProto):
1472         (Object.getPrototypeOf.async):
1473         (Object.getPrototypeOf.async.method):
1474         (async):
1475         (async.method):
1476         (async.asyncNonConstructorDecl):
1477         (shouldThrow.new.async):
1478         (shouldThrow.new.async.nonConstructor):
1479         (async.asyncDecl):
1480         (async.f):
1481         (MyError):
1482         (async.asyncDeclThrower):
1483         (shouldThrowAsync.async):
1484         (resolveLater):
1485         (rejectLater):
1486         (async.resumeAfterNormal):
1487         (O.async.resumeAfterNormal):
1488         (resumeAfterNormalArrow.async):
1489         (async.resumeAfterThrow):
1490         (O.async.resumeAfterThrow):
1491         (resumeAfterThrowArrow.async):
1492         (catch):
1493         * stress/async-await-module-reserved-word.js: Added.
1494         (shouldThrow):
1495         (SyntaxError.Canstring_appeared_hereawait.checkModuleSyntaxError.String.raw.await):
1496         (checkModuleSyntaxError.String.raw.await):
1497         (checkModuleSyntaxError.String.raw.async.await):
1498         (SyntaxError.Cannot.declare.named):
1499         * stress/async-await-mozilla.js: Added.
1500         (shouldBe):
1501         (shouldBeAsync):
1502         (shouldThrow):
1503         (shouldThrowAsync):
1504         (assert):
1505         (shouldThrowSyntaxError):
1506         (mozSemantics.async.empty):
1507         (mozSemantics.async.simpleReturn):
1508         (mozSemantics.async.simpleAwait):
1509         (mozSemantics.async.simpleAwaitAsync):
1510         (mozSemantics.async.returnOtherAsync):
1511         (mozSemantics.async.simpleThrower):
1512         (mozSemantics.async.delegatedThrower):
1513         (mozSemantics.async.tryCatch):
1514         (mozSemantics.async.tryCatchThrow):
1515         (mozSemantics.async.wellFinally):
1516         (mozSemantics.async.finallyMayFail):
1517         (mozSemantics.async.embedded.async.inner):
1518         (mozSemantics.async.embedded):
1519         (mozSemantics.async.fib):
1520         (mozSemantics.async.isOdd.async.isEven):
1521         (mozSemantics.async.isOdd):
1522         (mozSemantics.hardcoreFib.async.fib2):
1523         (mozSemantics.namedAsyncExpr.async.simple):
1524         (mozSemantics.async.executionOrder.async.first):
1525         (mozSemantics.async.executionOrder.async.second):
1526         (mozSemantics.async.executionOrder.async.third):
1527         (mozSemantics.async.executionOrder):
1528         (mozSemantics.async.miscellaneous):
1529         (mozSemantics.thrower):
1530         (mozSemantics.async.defaultArgs):
1531         (mozSemantics.shouldThrow):
1532         (mozSemantics):
1533         (mozMethods.X):
1534         (mozMethods.X.prototype.async.getValue):
1535         (mozMethods.X.prototype.setValue):
1536         (mozMethods.X.prototype.async.increment):
1537         (mozMethods.X.prototype.async.getBaseClassName):
1538         (mozMethods.X.async.getStaticValue):
1539         (mozMethods.Y.prototype.async.getBaseClassName):
1540         (mozMethods.Y):
1541         (mozFunctionNameInferrence.async.test):
1542         (mozSyntaxErrors):
1543         * stress/async-await-reserved-word.js: Added.
1544         (assert):
1545         (shouldThrowSyntaxError):
1546         (AsyncFunction.async):
1547         * stress/async_arrow_functions_lexical_arguments_binding.js: Added.
1548         (shouldBe):
1549         (shouldBeAsync):
1550         (shouldThrowAsync):
1551         (noArgumentsArrow2.async):
1552         * stress/async_arrow_functions_lexical_new.target_binding.js: Added.
1553         (shouldBe):
1554         (shouldBeAsync):
1555         (shouldThrowAsync):
1556         (C1):
1557         (C2):
1558         (shouldThrowAsync.async):
1559         * stress/async_arrow_functions_lexical_super_binding.js: Added.
1560         (shouldBe):
1561         (shouldBeAsync):
1562         (BaseClass.prototype.baseClassValue):
1563         (BaseClass.prototype.get property):
1564         (BaseClass):
1565         (ChildClass.prototype.asyncSuperProp):
1566         (ChildClass.prototype.asyncSuperProp2):
1567         (ChildClass):
1568         (ChildClass2):
1569         * stress/async_arrow_functions_lexical_this_binding.js: Added.
1570         (shouldBe):
1571         (shouldBeAsync):
1572         (d.y):
1573
1574 2016-10-28  Csaba Osztrogonác  <ossy@webkit.org>
1575
1576         Skip 2 JS stress tests on memory limited devices
1577         https://bugs.webkit.org/show_bug.cgi?id=164125
1578
1579         Unreviewed quick fix to unbreak JSCOnly ARM bots as soon as possible.
1580
1581         * stress/joined-strings-should-not-exceed-max-string-length.js:
1582         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js:
1583
1584 2016-10-27  Caitlin Potter  <caitp@igalia.com>
1585
1586         [JSC] forbid lexical redeclaration of generator formal parameters
1587         https://bugs.webkit.org/show_bug.cgi?id=163930
1588
1589         Reviewed by Yusuke Suzuki.
1590
1591         * stress/async-await-syntax.js:
1592         * stress/generator-syntax.js:
1593         (testSyntaxError.gen):
1594         (testSyntaxError.arguments):
1595         (testSyntaxError.eval):
1596         * test262.yaml:
1597
1598 2016-10-26  JF Bastien  <jfbastien@apple.com>
1599
1600         WebAssembly API: implement Instance
1601
1602         As described in: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblyinstance-objects
1603
1604          - Take ownership of Wasm::Plan's compilation result when successfully creating a JSWebAssemblyModule object.
1605          - Construct a basic Instance with a Module.
1606          - Handle second argument (importObject) of WebAssembly.Instance.
1607          - Add reference text from the spec to WebAssembly.Module's code.
1608          - Expose and test an empty 'exports' ModuleNamespaceObject on WebAssembly.Instance.
1609
1610         The implementation isn't complete yet: it relies on further work for which I've filed bugs.
1611
1612         WebAssembly API: implement Instance
1613         https://bugs.webkit.org/show_bug.cgi?id=163998
1614
1615         Reviewed by Keith Miller.
1616
1617         * wasm/js-api/test_Instance.js: Added.
1618         (EmptyModule): use the Builder, create the simplest Module possible, and create an Instance from it
1619         * wasm/js-api/test_basic_api.js:
1620         (const.c.in.constructorProperties.switch): basic tests of the API
1621
1622 2016-10-26  Mark Lam  <mark.lam@apple.com>
1623
1624         JSGenericTypedArrayView::set() should check for exceptions.
1625         https://bugs.webkit.org/show_bug.cgi?id=164007
1626         <rdar://problem/28853775>
1627
1628         Reviewed by Filip Pizlo.
1629
1630         * stress/typed-array-view-set-should-not-crash-on-exception.js: Added.
1631
1632 2016-10-25  Mark Lam  <mark.lam@apple.com>
1633
1634         String.prototype.replace() should throw an OutOfMemoryError when using too much memory.
1635         https://bugs.webkit.org/show_bug.cgi?id=163996
1636         <rdar://problem/28263117>
1637
1638         Reviewed by Geoffrey Garen.
1639
1640         * stress/string-prototype-replace-should-throw-out-of-memory-error-when-using-too-much-memory.js: Added.
1641
1642 2016-10-25  Mark Lam  <mark.lam@apple.com>
1643
1644         JSStringJoiner::joinedLength() should limit joined string lengths to INT_MAX.
1645         https://bugs.webkit.org/show_bug.cgi?id=163937
1646         <rdar://problem/28642990>
1647
1648         Reviewed by Geoffrey Garen.
1649
1650         * stress/joined-strings-should-not-exceed-max-string-length.js: Added.
1651
1652 2016-10-25  JF Bastien  <jfbastien@apple.com>
1653
1654         WebAssembly JS API: simple Module test
1655         https://bugs.webkit.org/show_bug.cgi?id=163963
1656
1657         Reviewed by Filip Pizlo.
1658
1659         * wasm/LowLevelBinary.js:
1660         (export.default.LowLevelBinary.prototype.get return): get the ArrayBuffer
1661         (export.default.LowLevelBinary.prototype.hexdump): Deleted.
1662         (export.default.LowLevelBinary.prototype._maybeGrow): Deleted.
1663         * wasm/js-api/test_Module.js: Added.
1664         (EmptyModule): The most basic module possible
1665
1666 2016-10-25  JF Bastien  <jfbastien@apple.com>
1667
1668         WebAssembly JS API: implement Module
1669
1670         This implementation allows us to:
1671          - Syncrhonously create a WebAssembly.Module with a typed array.
1672          - Creates a compilation plan.
1673          - Parse the Module and creates corresponding code.
1674          - Throw WebAssembly.CompileError with mildly helpful [*] error messages on
1675            failure.
1676
1677         Consult the API documentation for expected behavior: https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymodule-constructor
1678
1679         For now the implementation discards the generated code.
1680
1681         The next steps will be:
1682          - Expose a Module's exports.
1683          - Implement WebAssembly.Instance, which allows instantiating and running a
1684            compiled Module.
1685          - Beef up the testing infrastructure under JSTests/wasm so that more complex
1686            modules can be created and tested (instead of writing the bits by hand).
1687
1688         This patch also:
1689          - Adds assert.instanceof in assert.js.
1690          - Refactors Wasm::Parser and friends to accept const uint8_t* as well as a
1691            Vector, to avoid copying when invoked synchronously.
1692          - Remove useless Structure from some of the wasm constructors: they're already
1693            on the JSGlobalObject, visited properly and all.
1694          - Fix off-by-one error in parsing: Parser::parseUInt32 failed if the integer
1695            was exactly at end of file.
1696
1697          [*] On error messages while parsing: I filed https://bugs.webkit.org/show_bug.cgi?id=163919
1698
1699         WebAssembly JS API: implement Module
1700         https://bugs.webkit.org/show_bug.cgi?id=163903
1701
1702         Reviewed by Keith Miller.
1703
1704         * wasm/assert.js: use underscore in name, and remove when exporting to avoid clasing with builtin names
1705         (const._notUndef):
1706         (const._isUndef):
1707         (const._eq):
1708         (const._ge):
1709         (const._throws):
1710         * wasm/js-api/test_basic_api.js: test the WebAssembly.Module API
1711         (const.c.in.constructorProperties.switch):
1712
1713 2016-10-25  Keith Miller  <keith_miller@apple.com>
1714
1715         Add trivial Wasm conversion opcodes
1716         https://bugs.webkit.org/show_bug.cgi?id=163950
1717
1718         Reviewed by Filip Pizlo.
1719
1720         This patch differentiates between Wasm opcodes that are trivially mapped to a B3 opcode and
1721         those that are not.  Some of the Wasm opcodes that are currently a non-simple opcode will
1722         become simple as we add B3 opcodes for Wasm operations.  The remaining opcodes will need to
1723         be added via patchpoints in a later patch.
1724
1725         * wasm/generate-wasmops-header.js:
1726         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.Wasm.inline.bool.isSimple):
1727         * wasm/wasm.json:
1728
1729 2016-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1730
1731         Arrow functions with concise bodies cannot return regular expressions
1732         https://bugs.webkit.org/show_bug.cgi?id=163162
1733
1734         Reviewed by Filip Pizlo.
1735
1736         * ChakraCore/test/Operators/instanceof.baseline-jsc:
1737         * ChakraCore/test/Regex/nul_character.baseline-jsc:
1738         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
1739         * stress/parse-regexp-as-token.js: Added.
1740         (shouldBe):
1741
1742 2016-10-24  Keith Miller  <keith_miller@apple.com>
1743
1744         Wasm should support floating point operations.
1745         https://bugs.webkit.org/show_bug.cgi?id=163770
1746
1747         Reviewed by Michael Saboff.
1748
1749         Add appropriate b3op names for floating point wasm bytecodes, where they exist.
1750         Also, fix some WASM => Wasm in WasmOps.h generator script that I missed
1751         the first time I made the change.
1752
1753         * wasm/generate-wasmops-header.js:
1754         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.template.typename.Int.inline.bool.isValidOpType): Deleted.
1755         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.BinaryOpType): Deleted.
1756         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.UnaryOpType): Deleted.
1757         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType): Deleted.
1758         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType): Deleted.
1759         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.undef.CREATE_ENUM_VALUE.inline.bool.isControlOp): Deleted.
1760         * wasm/wasm.json:
1761
1762 2016-10-21  Saam Barati  <sbarati@apple.com>
1763
1764         SpeculativeJIT::compileTryGetById needs to pass in NeedsToSpill along both the cell speculation and untyped speculation path
1765         https://bugs.webkit.org/show_bug.cgi?id=163622
1766
1767         Reviewed by Yusuke Suzuki.
1768
1769         * stress/try-get-by-id-should-spill-registers-dfg.js: Added.
1770         (let.f.createBuiltin):
1771
1772 2016-10-21  Caitlin Potter  <caitp@igalia.com>
1773
1774         [JSC] don't crash when arguments to `new Function()` produce unexpected AST
1775         https://bugs.webkit.org/show_bug.cgi?id=163748
1776
1777         Reviewed by Mark Lam.
1778
1779         * stress/regress-163748.js: Added.
1780         (assert):
1781         (shouldThrowSyntaxError):
1782         (GeneratorFunction):
1783
1784 2016-10-20  Keith Miller  <keith_miller@apple.com>
1785
1786         Add support for WASM calls
1787         https://bugs.webkit.org/show_bug.cgi?id=161727
1788
1789         Reviewed by Filip Pizlo and Michael Saboff.
1790
1791         Add members of the Call category to the WASMOps special group.
1792
1793         * wasm/generate-wasmops-header.js:
1794
1795 2016-10-20  Yusuke Suzuki  <utatane.tea@gmail.com>
1796
1797         [JSC] Drop isEnvironmentRecord type info flag and use JSType information instead
1798         https://bugs.webkit.org/show_bug.cgi?id=163761
1799
1800         Reviewed by Keith Miller.
1801
1802         * modules/string-prototype-module-scope.js: Added.
1803         (shouldBe):
1804         (catch):
1805         (refer):
1806         * stress/string-prototype-scopes-global-lexical-environment-strict.js: Added.
1807         (shouldBe):
1808         (catch):
1809         * stress/string-prototype-scopes-global-lexical-environment.js: Added.
1810         (shouldBe):
1811         (catch):
1812         * stress/string-prototype-scopes-strict.js: Added.
1813         (shouldBe):
1814         (catch):
1815         (try.refer):
1816         (refer):
1817         * stress/string-prototype-scopes.js: Added.
1818         (shouldBe):
1819         (catch):
1820         (try.refer):
1821         (refer):
1822         (object.toString):
1823         (with):
1824
1825 2016-10-20  JF Bastien  <jfbastien@apple.com>
1826
1827         WebAssembly API: implement exception constructors properly
1828
1829          - Rename WebAssemblyObject to JSWebAssembly for consistency.
1830          - WebAssembly object now has its own prototype: add WebAssemblyPrototype, and
1831            use it to register JSWebAssembly's function properties through auto-generated
1832            .lut.h, instead of manually.
1833          - The error constructors used to throw (e.g. `new WebAssembly.CompileError()`).
1834          - Register WebAssembly's constructors from the global object, and hold a
1835            reference to their structure and prototype so that invoking the constructor
1836            can use the structure directly from the global object.
1837          - Add a prototype base field to global object creation. Previous ones all had
1838            Object's prototype as their base, but WebAssembly's error constructors have
1839            Error as their base.
1840          - Test for the error object's correctness.
1841          - Add missing #if ENABLE(WEBASSEMBLY)
1842
1843         WebAssembly API: implement exception constructors properly
1844         https://bugs.webkit.org/show_bug.cgi?id=163699
1845
1846         Reviewed by Keith Miller.
1847
1848         * wasm/js-api/test_basic_api.js:
1849         (const.c.in.constructorProperties): more tests
1850
1851 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1852
1853         [JSC] disallow references to `await` in AsyncFunction formal parameters
1854         https://bugs.webkit.org/show_bug.cgi?id=163694
1855
1856         Reviewed by Saam Barati.
1857
1858         * stress/async-await-syntax.js:
1859
1860 2016-10-20  Keith Miller  <keith_miller@apple.com>
1861
1862         Invalid assertion in arguments elimination
1863         https://bugs.webkit.org/show_bug.cgi?id=163740
1864         <rdar://problem/27911462>
1865
1866         Reviewed by Michael Saboff.
1867
1868         * stress/direct-arguments-osr-entry.js: Added.
1869         (foo.):
1870         (foo):
1871
1872 2016-10-20  Caitlin Potter  <caitp@igalia.com>
1873
1874         [JSC] throw TypeError when constructing dynamically created JSGeneratorFunction
1875         https://bugs.webkit.org/show_bug.cgi?id=163714
1876
1877         Reviewed by Mark Lam.
1878
1879         Add missing test coverage that dynamically created
1880         JSGeneratorFunctions can not be constructed.
1881
1882         * stress/generator-function-constructor.js:
1883         (shouldThrow):
1884
1885 2016-10-19  JF Bastien  <jfbastien@apple.com>
1886
1887         JavaScript WebAssembly API: baby steps
1888
1889          - Expand WebAssembly constructors into their own files. This requires a lot of
1890            boilerplate, as well as adding the .lut.h files. All of the
1891            JSWebAssembly*.{h,cpp}, as well as Constructor and Prototype files, are
1892            currently the same between the 4 specified WebAssembly constructors. It'll be
1893            easy to implement individual functions on constructed objects as per the
1894            spec, and have each of these files diverge. The error constructors are also
1895            similar, except that their instance derives from ErrorInstance.
1896          - Use constructor macro when initializing the global object.
1897          - Dramatically improve testing of the WebAssembly API by checking for
1898            properties specified in the spec [*].
1899          - Clean up assert.js' exception testing.
1900          - Fix a copy-paste bug in wasm.json: floating-point const return values were
1901            swapped.
1902
1903         [*] https://github.com/WebAssembly/design/blob/master/JS.md
1904
1905         Implement more of the JavaScript WebAssembly API
1906         https://bugs.webkit.org/show_bug.cgi?id=163571
1907
1908         Reviewed by Keith Miller.
1909
1910         * wasm/assert.js:
1911         (export.const.isUndef): add this useful helper
1912         (export.const.throws): fold other throw checks into this one, and check message as well
1913         * wasm/js-api/test_basic_api.js:
1914         (const.checkOwnPropertyDescriptor): check own property descriptor follows the spec
1915         * wasm/self-test/test_BuilderJSON.js:
1916         (const.assertOpThrows): use new assert API
1917         (CheckedOpcodeArgumentsTooMany): ditto
1918         (CheckedOpcodeArgumentsNotEnough): ditto
1919         (CallInvalid): ditto
1920         (I32ConstInvalid): ditto
1921         (F32ConstInvalid): ditto (and this caugth the JSON copy-paste bug)
1922         (F64ConstInvalid): ditto
1923         * wasm/self-test/test_LowLevelBinary_varint.js: use new assert API
1924         * wasm/self-test/test_LowLevelBinary_varuint.js: use new assert API
1925         * wasm/utilities.js: add "global" object, used in basic API test (to access global.WebAssembly).
1926         * wasm/wasm.json: fix copy-paste
1927
1928 2016-10-19  Caitlin Potter  <caitp@igalia.com>
1929
1930         [JSC] forbid "use strict" directive in generator functions with non-simple parameters
1931         https://bugs.webkit.org/show_bug.cgi?id=163683
1932
1933         Reviewed by Geoffrey Garen.
1934
1935         Update various generator*-non-simple-param.js tests to be passing.
1936
1937         * test262.yaml:
1938
1939 2016-10-18  Mark Lam  <mark.lam@apple.com>
1940
1941         Invoking Object.prototype.__proto__ accessors directly should throw a TypeError.
1942         https://bugs.webkit.org/show_bug.cgi?id=154377
1943         <rdar://problem/27330808>
1944
1945         Reviewed by Filip Pizlo and Saam Barati.
1946
1947         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js: Added.
1948
1949 2016-10-18  Keith Miller  <keith_miller@apple.com>
1950
1951         GetByVal to GetById conversion in the DFG is incorrect for getters with control flow
1952         https://bugs.webkit.org/show_bug.cgi?id=163629
1953
1954         Reviewed by Yusuke Suzuki.
1955
1956         * stress/get-by-val-to-id-with-getter.js: Added.
1957         (foo):
1958         (o.get hello):
1959
1960 2016-10-15  Filip Pizlo  <fpizlo@apple.com>
1961
1962         DFG and FTL should be able to use DirectCall ICs when they proved the callee or its executable
1963         https://bugs.webkit.org/show_bug.cgi?id=163371
1964
1965         Reviewed by Geoffrey Garen and Saam Barati.
1966         
1967         Add microbenchmarks for all of the cases that this patch optimizes.
1968
1969         * microbenchmarks/direct-call-arity-mismatch.js: Added.
1970         (foo):
1971         (bar):
1972         * microbenchmarks/direct-call.js: Added.
1973         (foo):
1974         (bar):
1975         * microbenchmarks/direct-construct-arity-mismatch.js: Added.
1976         (Foo):
1977         (bar):
1978         * microbenchmarks/direct-construct.js: Added.
1979         (Foo):
1980         (bar):
1981         * microbenchmarks/direct-tail-call-arity-mismatch.js: Added.
1982         (foo):
1983         (bar):
1984         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js: Added.
1985         (foo):
1986         (bar):
1987         (baz):
1988         * microbenchmarks/direct-tail-call-inlined-caller.js: Added.
1989         (foo):
1990         (bar):
1991         (baz):
1992         * microbenchmarks/direct-tail-call.js: Added.
1993         (foo):
1994         (bar):
1995
1996 2016-10-18  Caitlin Potter  <caitp@igalia.com>
1997
1998         [JSC] ES6 Method functions should not have prototype
1999         https://bugs.webkit.org/show_bug.cgi?id=162530
2000
2001         Reviewed by Saam Barati.
2002
2003         Fix test262 expectations about MethodDefinitions
2004
2005         * ChakraCore/test/strict/05.arguments_sm.baseline-jsc:
2006         * stress/reflect-set.js:
2007         * test262.yaml:
2008
2009 2016-10-17  Keith Miller  <keith_miller@apple.com>
2010
2011         Add support for WASM Memory.
2012         https://bugs.webkit.org/show_bug.cgi?id=161710
2013
2014         Reviewed by Geoffrey Garen.
2015
2016         Add store and load opcodes to wasm.json. Additionally, add new
2017         enums for those opcodes in the generator.
2018
2019         * stress/wasm/generate-wasmops-header.js:
2020         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.LoadOpType):
2021         (const.template.pragma.once.ENABLE.WEBASSEMBLY.include.cstdint.namespace.JSC.namespace.WASM.enum.StoreOpType):
2022
2023 2016-10-17  Saam Barati  <sbarati@apple.com>
2024
2025         Add more tests for the double->String conversion in ValueAdd constant folding
2026         https://bugs.webkit.org/show_bug.cgi?id=163517
2027
2028         Reviewed by Yusuke Suzuki.
2029
2030         * microbenchmarks/string-add-constant-folding.js:
2031         (test):
2032
2033 2016-10-17  JF Bastien  <jfbastien@apple.com>
2034
2035         WebAssembly JS API: implement basic stub
2036
2037         Implement the global WebAssembly JavaScript object, and its constructor +
2038         function properties as described in:
2039           https://github.com/WebAssembly/design/blob/master/JS.md
2040
2041         These don't do anything at the moment, the parent bug will take care of adding
2042         more functionality and associated tests.
2043
2044         WebAssembly JS API: implement basic stub
2045         https://bugs.webkit.org/show_bug.cgi?id=163404
2046
2047         Reviewed by Keith Miller.
2048
2049         * wasm.yaml:
2050         * wasm/js-api/test_basic_api.js: Added.
2051         (const.f.of.functionProperties.WebAssembly.f.undefined.throw.new.Error.Couldn.const.c.of.constructorProperties.WebAssembly.c.undefined.throw.new.Error.Couldn):
2052         (const.c.of.constructorProperties.catch):
2053
2054 2016-10-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2055
2056         [DOMJIT] Use DOMJIT::Patchpoint in IC
2057         https://bugs.webkit.org/show_bug.cgi?id=163223
2058
2059         Reviewed by Saam Barati.
2060
2061         * stress/domjit-exception-ic.js: Added.
2062         (shouldBe):
2063         (access):
2064         * stress/domjit-exception.js: Added.
2065         (shouldBe):
2066         (access):
2067         * stress/domjit-getter-complex-with-incorrect-object.js: Added.
2068         (shouldThrow):
2069         (access):
2070         (i.shouldThrow):
2071         * stress/domjit-getter-complex.js: Added.
2072         (shouldBe):
2073         (access):
2074         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js: Added.
2075         (assert):
2076         (bar):
2077         (foo):
2078
2079 2016-10-15  Saam Barati  <sbarati@apple.com>
2080
2081         Assertion failed under operationToLowerCase with a rope with zero length
2082         https://bugs.webkit.org/show_bug.cgi?id=163314
2083
2084         Reviewed by Mark Lam.
2085
2086         * stress/to-lower-case-intrinsic-on-empty-rope.js: Added.
2087         (assert):
2088         (returnRope.helper):
2089         (returnRope):
2090         (lower):
2091
2092 2016-10-14  Benjamin Poulain  <bpoulain@apple.com>
2093
2094         [JSC] op_negate should with any type
2095         https://bugs.webkit.org/show_bug.cgi?id=162587
2096
2097         Reviewed by Saam Barati.
2098
2099         * stress/arith-abs-to-arith-negate-range-optimizaton.js: Added.
2100         Cover OSR Exits when converting Math.abs() into ArithNegate.
2101
2102         * stress/arith-negate-on-various-types.js: Added.
2103         Cover ArithNegate with all types.
2104
2105 2016-10-14  JF Bastien  <jfbastien@apple.com>
2106
2107         Basic WebAssembly testing
2108
2109         Create a small DSL in JavaScript which can build WebAssembly binary modules based on the JSON description of the format as described in:
2110         https://github.com/WebAssembly/design/blob/master/BinaryEncoding.md
2111
2112         This DSL can then be used to write small text description of valid and invalid WebAssembly binaries, making testing the JSC implementation much easier.
2113
2114         Details and example in README.md.
2115
2116         Basic WebAssembly testing
2117         https://bugs.webkit.org/show_bug.cgi?id=163267
2118
2119         Reviewed by Keith Miller.
2120
2121         * stress/wasm/wasm.json: Removed.
2122         * wasm.yaml: Added.
2123         * wasm/Builder.js: Added.
2124         (const._isValidValue):
2125         (const._BuildWebAssemblyBinary):
2126         (export.default.Builder):
2127         (export.default.Builder.prototype.setChecked):
2128         (export.default.Builder.prototype.setPreamble):
2129         (export.default.Builder.prototype._registerSectionBuilders.switch.case.string_appeared_here.this.section):
2130         (export.default.Builder.prototype._registerSectionBuilders.this.Unknown):
2131         (export.default.Builder.prototype._registerSectionBuilders):
2132         (export.default.Builder.prototype._addSection):
2133         (export.default.Builder.prototype.optimize):
2134         (export.default.Builder.prototype.json):
2135         (export.default.Builder.prototype.AsmJS):
2136         (export.default.Builder.prototype.WebAssembly):
2137         * wasm/LowLevelBinary.js: Added.
2138         (const._getterRangeCheck):
2139         (const._hexdump):
2140         (export.default.LowLevelBinary):
2141         (export.default.LowLevelBinary.prototype.newPatchable):
2142         (export.default.LowLevelBinary.prototype.hexdump):
2143         (export.default.LowLevelBinary.prototype._maybeGrow):
2144         (export.default.LowLevelBinary.prototype._push8):
2145         (export.default.LowLevelBinary.prototype.uint8):
2146         (export.default.LowLevelBinary.prototype.uint16):
2147         (export.default.LowLevelBinary.prototype.uint32):
2148         (export.default.LowLevelBinary.prototype.varuint):
2149         (export.default.LowLevelBinary.prototype.varint):
2150         (export.default.LowLevelBinary.prototype.varuint7):
2151         (export.default.LowLevelBinary.prototype.string):
2152         (export.default.LowLevelBinary.prototype.getSize):
2153         (export.default.LowLevelBinary.prototype.getUint8):
2154         (export.default.LowLevelBinary.prototype.getUint16):
2155         (export.default.LowLevelBinary.prototype.getUint32):
2156         (export.default.LowLevelBinary.prototype.getVaruint):
2157         (export.default.LowLevelBinary.prototype.getVarint):
2158         (export.default.LowLevelBinary.prototype.getVaruint7):
2159         (export.default.LowLevelBinary.prototype.getString):
2160         (PatchableLowLevelBinary):
2161         (PatchableLowLevelBinary.prototype._push8):
2162         (PatchableLowLevelBinary.prototype.apply):
2163         * wasm/README.md: Added.
2164         * wasm/WASM.js: Added.
2165         * wasm/assert.js: Added.
2166         (export.const.notUndef):
2167         (export.const.eq):
2168         (export.const.ge):
2169         (export.const.throwsError):
2170         (export.const.throwsRangeError):
2171         * wasm/generate-wasmops-header.js: Renamed from JSTests/stress/wasm/generate-wasmops-header.js.
2172         * wasm/self-test/test_BuilderJSON.js: Added.
2173         (const.assertOpThrows):
2174         (EmptyModule):
2175         (CustomMagicNumber):
2176         (CustomVersion):
2177         (CustomSection):
2178         (CustomSectionAllBytes):
2179         (CustomSectionInvalidByte):
2180         (TwoCustomSections):
2181         (EmptyCodeSection):
2182         (CodeSectionWithEmptyFunction):
2183         (CodeSectionWithEmptyFunctionWithParameters):
2184         (InvalidFunctionParameters):
2185         (SimpleFunction):
2186         (TwoSimpleFunctions):
2187         (TwoBuildersAtTheSameTime):
2188         (CheckedOpcodeArgumentsTooMany):
2189         (CheckedOpcodeArgumentsNotEnough):
2190         (CallNoArguments):
2191         (CallInvalid):
2192         (I32ConstInvalid):
2193         (F32ConstInvalid):
2194         (F64ConstInvalid):
2195         (CallManyFromStack):
2196         (OpcodeAdd):
2197         (OpcodeUnreachable):
2198         (OpcodeUnreachableCombinations):
2199         (OpcodeSelect):
2200         * wasm/self-test/test_BuilderWebAssembly.js: Added.
2201         (EmptyModule):
2202         (CustomSection):
2203         (Basic):
2204         * wasm/self-test/test_LowLevelBinary_encode.js: Added.
2205         * wasm/self-test/test_LowLevelBinary_string.js: Added.
2206         * wasm/self-test/test_LowLevelBinary_uint16.js: Added.
2207         * wasm/self-test/test_LowLevelBinary_uint32.js: Added.
2208         * wasm/self-test/test_LowLevelBinary_uint8.js: Added.
2209         * wasm/self-test/test_LowLevelBinary_varint.js: Added.
2210         * wasm/self-test/test_LowLevelBinary_varuint.js: Added.
2211         * wasm/self-test/test_LowLevelBinary_varuint7.js: Added.
2212         * wasm/self-test/test_WASM.js: Added.
2213         * wasm/test.sh: Added.
2214         * wasm/utilities.js: Added.
2215         (const._read.filename.switch):
2216         (const._load.filename.switch):
2217         (const._json.filename.switch):
2218         * wasm/wasm.json: Added.
2219
2220 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2221
2222         test262: @isConstructor incorrectly thinks Math.cos is a constructor
2223         https://bugs.webkit.org/show_bug.cgi?id=163437
2224
2225         Reviewed by Saam Barati.
2226
2227         * stress/is-constructor.js: Added.
2228         (assert):
2229         (prototype.assert):
2230         New test to cover the @isConstructor builtin.
2231
2232         * test262.yaml:
2233         Test now passes.
2234
2235 2016-10-14  Ryan Haddad  <ryanhaddad@apple.com>
2236
2237         Unreviewed, rolling out r207322.
2238
2239         This change caused JSC test failures
2240
2241         Reverted changeset:
2242
2243         "Fix Array.prototype.splice ES6 compliance."
2244         https://bugs.webkit.org/show_bug.cgi?id=163372
2245         http://trac.webkit.org/changeset/207322
2246
2247 2016-10-14  Mark Lam  <mark.lam@apple.com>
2248
2249         JSON.parse should not modify frozen objects.
2250         https://bugs.webkit.org/show_bug.cgi?id=163430
2251
2252         Reviewed by Saam Barati.
2253
2254         * stress/json-parse-on-frozen-object.js: Added.
2255
2256 2016-10-14  Joseph Pecoraro  <pecoraro@apple.com>
2257
2258         test262: Failure with RegExp.prototype.compile when pattern is undefined
2259         https://bugs.webkit.org/show_bug.cgi?id=163431
2260
2261         Reviewed by Yusuke Suzuki.
2262
2263         * test262.yaml:
2264
2265 2016-10-13  Joseph Pecoraro  <pecoraro@apple.com>
2266
2267         Exception message for expressions with multiple bracket accesses is inconsistent / incorrect
2268         https://bugs.webkit.org/show_bug.cgi?id=163426
2269
2270         Reviewed by Geoffrey Garen.
2271
2272         * ChakraCore/test/Error/CallNonFunction_3.baseline-jsc:
2273         * ChakraCore/test/Object/null.baseline-jsc:
2274         * stress/exception-in-to-property-key-should-be-handled-early.js:
2275         Better exception messages.
2276
2277 2016-10-13  Mark Lam  <mark.lam@apple.com>
2278
2279         Fix Array.prototype.splice ES6 compliance.
2280         https://bugs.webkit.org/show_bug.cgi?id=163372
2281
2282         Reviewed by Geoffrey Garen and Yusuke Suzuki.
2283
2284         * stress/array-splice-on-frozen-object.js: Added.
2285
2286 2016-10-12  Keith Miller  <keith_miller@apple.com>
2287
2288         Handle non-function, non-undefined comparator in Array.prototype.sort
2289         https://bugs.webkit.org/show_bug.cgi?id=163085
2290
2291         Reviewed by Yusuke Suzuki.
2292
2293         * ChakraCore/test/Array/array_sort.baseline-jsc:
2294         * stress/array-sort-bad-comparator.js: Added.
2295         (test):
2296
2297 2016-10-12  Mark Lam  <mark.lam@apple.com>
2298
2299         Array.prototype.slice should not modify frozen objects.
2300         https://bugs.webkit.org/show_bug.cgi?id=163338
2301
2302         Reviewed by Filip Pizlo.
2303
2304         * stress/array-slice-on-frozen-object.js: Added.
2305
2306 2016-10-11  Mark Lam  <mark.lam@apple.com>
2307
2308         Array.prototype.concat should not modify frozen objects.
2309         https://bugs.webkit.org/show_bug.cgi?id=163302
2310
2311         Reviewed by Filip Pizlo.
2312
2313         * stress/array-concat-on-frozen-object.js: Added.
2314
2315 2016-10-11  Saam Barati  <sbarati@apple.com>
2316
2317         ValueAdd should be constant folded if the operands are constant String,Primitive or Primitive,String
2318         https://bugs.webkit.org/show_bug.cgi?id=163182
2319
2320         Reviewed by Filip Pizlo.
2321
2322         * microbenchmarks/string-add-constant-folding.js: Added.
2323         (assert):
2324         (runTests):
2325         (add):
2326         (test):
2327
2328 2016-10-07  Mark Lam  <mark.lam@apple.com>
2329
2330         Object.freeze() and seal() should throw if [[PreventExtensions]]() fails.
2331         https://bugs.webkit.org/show_bug.cgi?id=163160
2332
2333         Reviewed by Saam Barati.
2334
2335         * stress/object-freeze-with-proxy-preventExtensions.js: Added.
2336         * stress/object-seal-with-proxy-preventExtensions.js: Added.
2337
2338 2016-10-05  Yusuke Suzuki  <utatane.tea@gmail.com>
2339
2340         [DOMJIT] Add initial CheckDOM and CallDOM implementations
2341         https://bugs.webkit.org/show_bug.cgi?id=162941
2342
2343         Reviewed by Filip Pizlo.
2344
2345         * stress/domjit-getter-poly.js: Added.
2346         (shouldBe):
2347         (access):
2348         * stress/domjit-getter-proto.js: Added.
2349         (shouldBe):
2350         (access):
2351         * stress/domjit-getter-super-poly.js: Added.
2352         (shouldBe):
2353         (access):
2354         * stress/domjit-getter.js: Added.
2355         (shouldBe):
2356         (access):
2357
2358 2016-10-04  Saam Barati  <sbarati@apple.com>
2359
2360         String.prototype.toLowerCase should be a DFG/FTL intrinsic
2361         https://bugs.webkit.org/show_bug.cgi?id=162887
2362
2363         Reviewed by Filip Pizlo and Yusuke Suzuki.
2364
2365         * microbenchmarks/to-lower-case.js: Added.
2366         (assert):
2367         (foo):
2368         (bar):
2369         * stress/to-lower-case.js: Added.
2370         (assert):
2371         (foo):
2372
2373 2016-10-04  JF Bastien  <jfbastien@apple.com>
2374
2375         WebAssembly: handle a few corner cases
2376         https://bugs.webkit.org/show_bug.cgi?id=162884
2377
2378         Reviewed by Keith Miller.
2379
2380         * stress/wasm/generate-wasmops-header.js:
2381         (const.opcodeIterator): max opcode value
2382
2383 2016-10-03  JF Bastien  <jfbastien@apple.com>
2384
2385         Auto-generate WASMOps.h, share with testing JSON file
2386         https://bugs.webkit.org/show_bug.cgi?id=162870
2387
2388         Reviewed by Keith Miller.
2389
2390         * stress/wasm/to-c++.js: Added. Generates WASMOps.h, siilar to the current one but with more data.
2391         (const.opcode_iterator):
2392         (opcode_macroizer):
2393         * stress/wasm/wasm.json: Added. Data from 0xC binary format version.
2394
2395 2016-10-03  Saam Barati  <sbarati@apple.com>
2396
2397         MapHash should speculate on the type of its child node
2398         https://bugs.webkit.org/show_bug.cgi?id=161922
2399
2400         Reviewed by Filip Pizlo.
2401
2402         * microbenchmarks/map-key-well-typed.js: Added.
2403         (assert):
2404         (intKey):
2405         (doubleKey):
2406         (objectKey):
2407         (stringKey):
2408         (booleanKey):
2409         (symbolKey):
2410         (cellKey):
2411         (assert.doubleKey):
2412         (assert.booleanKey):
2413
2414 2016-10-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2415
2416         [ES6] GeneratorFunction (a.k.a. GeneratorWrapperFunction)'s prototype object does not have constructor property
2417         https://bugs.webkit.org/show_bug.cgi?id=162849
2418
2419         Reviewed by Geoffrey Garen.
2420
2421         * test262.yaml:
2422
2423 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2424
2425         [ES6] Align attributes of Generator related properties to spec
2426         https://bugs.webkit.org/show_bug.cgi?id=162839
2427
2428         Reviewed by Saam Barati.
2429
2430         * test262.yaml:
2431
2432 2016-10-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2433
2434         [ES6] GeneratorFunction constructor should instantiate generator function
2435         https://bugs.webkit.org/show_bug.cgi?id=162838
2436
2437         Reviewed by Saam Barati.
2438
2439         * stress/generator-function-constructor-is-subclassible.js: Added.
2440         (shouldBe):
2441         (GeneratorFunction):
2442         (prototype.hello):
2443         * stress/generator-function-constructor.js:
2444         * test262.yaml:
2445
2446 2016-09-30  Saam Barati  <sbarati@apple.com>
2447
2448         Arrow functions should not allow duplicate parameter names
2449         https://bugs.webkit.org/show_bug.cgi?id=162741
2450
2451         Reviewed by Filip Pizlo.
2452
2453         * test262.yaml:
2454
2455 2016-09-30  Saam Barati  <sbarati@apple.com>
2456
2457         Make some microbenchmarks run for less time.
2458
2459         Rubber stamped by Filip Pizlo.
2460
2461         * microbenchmarks/bound-function-construction-performance.js:
2462         (foo):
2463         * microbenchmarks/getter-richards-try-catch.js:
2464
2465 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2466
2467         Arrow functions do not infer name from computed property but normal functions do
2468         https://bugs.webkit.org/show_bug.cgi?id=162720
2469
2470         Reviewed by Saam Barati.
2471
2472         * stress/inferred-names.js:
2473
2474 2016-09-29  Mark Lam  <mark.lam@apple.com>
2475
2476         Break some slow running tests into smaller bits so they don't time out.
2477         https://bugs.webkit.org/show_bug.cgi?id=162743
2478
2479         Reviewed by Keith Miller.
2480
2481         The following tests have shown to be slow running:
2482             op_div.js
2483             op_lshift.js
2484             op_mod.js
2485             op_mul.js
2486             op_rshift.js
2487             op_sub.js
2488             op_urshift
2489
2490         These tests auto-generate permutations of values to apply to binary operations.
2491         They also test the operations with 3 permutations of value types:
2492             1. VarVar - both operands variables
2493             2. VarConst - variable operand 1, constant / literal operand 2
2494             3. ConstVar - constant / literal operand 1, variable operand 2
2495
2496         We can prevent these tests from timing out by breaking each up to only run 1 of
2497         the 3 permutations of value types.
2498
2499         * stress/op_div-ConstVar.js: Added.
2500         * stress/op_div-VarConst.js: Added.
2501         * stress/op_div-VarVar.js: Copied from JSTests/stress/op_div.js.
2502         (o1.valueOf): Deleted.
2503         * stress/op_div.js: Removed.
2504         * stress/op_lshift-ConstVar.js: Added.
2505         * stress/op_lshift-VarConst.js: Added.
2506         * stress/op_lshift-VarVar.js: Copied from JSTests/stress/op_lshift.js.
2507         (o1.valueOf): Deleted.
2508         * stress/op_lshift.js: Removed.
2509         * stress/op_mod-ConstVar.js: Added.
2510         * stress/op_mod-VarConst.js: Added.
2511         * stress/op_mod-VarVar.js: Copied from JSTests/stress/op_mod.js.
2512         (o1.valueOf): Deleted.
2513         * stress/op_mod.js: Removed.
2514         * stress/op_mul-ConstVar.js: Added.
2515         * stress/op_mul-VarConst.js: Added.
2516         * stress/op_mul-VarVar.js: Copied from JSTests/stress/op_mul.js.
2517         (o1.valueOf): Deleted.
2518         * stress/op_mul.js: Removed.
2519         * stress/op_rshift-ConstVar.js: Added.
2520         * stress/op_rshift-VarConst.js: Added.
2521         * stress/op_rshift-VarVar.js: Copied from JSTests/stress/op_rshift.js.
2522         (o1.valueOf): Deleted.
2523         * stress/op_rshift.js: Removed.
2524         * stress/op_sub-ConstVar.js: Added.
2525         * stress/op_sub-VarConst.js: Added.
2526         * stress/op_sub-VarVar.js: Copied from JSTests/stress/op_sub.js.
2527         (o1.valueOf): Deleted.
2528         * stress/op_sub.js: Removed.
2529         * stress/op_urshift-ConstVar.js: Added.
2530         * stress/op_urshift-VarConst.js: Added.
2531         * stress/op_urshift-VarVar.js: Copied from JSTests/stress/op_urshift.js.
2532         (o1.valueOf): Deleted.
2533         * stress/op_urshift.js: Removed.
2534         * stress/resources/binary-op-values.js: Added.
2535         (o1.valueOf):
2536
2537 2016-09-29  Joseph Pecoraro  <pecoraro@apple.com>
2538
2539         test262: class and function names should be inferred in assignment
2540         https://bugs.webkit.org/show_bug.cgi?id=146262
2541
2542         Reviewed by Saam Barati.
2543
2544         * stress/arrowfunction-name.js: Added.
2545         Quick tests for arrow function names.
2546
2547         * stress/inferred-names.js: Added.
2548         General test for inferred function names.
2549
2550         * test262.yaml:
2551         Pass many tests checking inferred function names.
2552
2553 2016-09-29  Saam Barati  <sbarati@apple.com>
2554
2555         We don't properly propagate non-simple-parameter-list when parsing a setter
2556         https://bugs.webkit.org/show_bug.cgi?id=160483
2557
2558         Reviewed by Joseph Pecoraro.
2559
2560         * test262.yaml:
2561
2562 2016-09-28  Saam Barati  <sbarati@apple.com>
2563
2564         stringProtoFuncRepeatCharacter will return `null` when it should not
2565         https://bugs.webkit.org/show_bug.cgi?id=161944
2566
2567         Reviewed by Yusuke Suzuki.
2568
2569         * stress/pad-start-calls-repeat-character-with-double.js: Added.
2570         (logLinesWithContext):
2571
2572 2016-09-27  Filip Pizlo  <fpizlo@apple.com>
2573
2574         B3::lowerMacros forgets to before->updatePredecessorsAfter() when lowering ChillMod on ARM64
2575         https://bugs.webkit.org/show_bug.cgi?id=162644
2576
2577         Reviewed by Keith Miller.
2578
2579         * stress/chill-mod-chill-mod.js: Added.
2580         (foo):
2581
2582 2016-09-26  Csaba Osztrogonác  <oszi@inf.u-szeged.hu>
2583
2584         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2585         https://bugs.webkit.org/show_bug.cgi?id=162386
2586
2587         Unreviewed, relanding r206317 after typo fix.
2588
2589         * stress/string-joining-long-strings-should-not-crash.js:
2590
2591 2016-09-24  Caitlin Potter  <caitp@igalia.com>
2592
2593         [JSTests] fix test262 expectations following r206333
2594         https://bugs.webkit.org/show_bug.cgi?id=162533
2595
2596         Reviewed by Yusuke Suzuki.
2597
2598         * test262.yaml:
2599
2600 2016-09-23  Caitlin Potter  <caitp@igalia.com>
2601
2602         [JSC] Implement parsing of Async Functions
2603         https://bugs.webkit.org/show_bug.cgi?id=161409
2604
2605         Reviewed by Yusuke Suzuki.
2606
2607         * stress/async-await-syntax.js: Added.
2608         (testSyntax):
2609         (testSyntaxError):
2610         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2611         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2612         (testTopLevelAsyncAwaitSyntaxStrictMode):
2613         (testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2614         (testNestedAsyncAwaitSyntax.async):
2615         (testNestedAsyncAwaitSyntax.foo):
2616         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2617
2618 2016-09-23  Ryan Haddad  <ryanhaddad@apple.com>
2619
2620         Unreviewed, rolling out r206317.
2621
2622         This change caused timeouts on El Capitan Release JSC tests
2623
2624         Reverted changeset:
2625
2626         "Skip stress/string-joining-long-strings-should-not-crash.js
2627         on memory limited devices"
2628         https://bugs.webkit.org/show_bug.cgi?id=162386
2629         http://trac.webkit.org/changeset/206317
2630
2631 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2632
2633         Skip mozilla-tests.yaml/js1_5/Array/regress-157652 on memory limited devices
2634         https://bugs.webkit.org/show_bug.cgi?id=162381
2635
2636         Reviewed by Mark Lam.
2637
2638         * mozilla/mozilla-tests.yaml:
2639
2640 2016-09-23  Csaba Osztrogonác  <ossy@webkit.org>
2641
2642         Skip stress/string-joining-long-strings-should-not-crash.js on memory limited devices
2643         https://bugs.webkit.org/show_bug.cgi?id=162386
2644
2645         Reviewed by Mark Lam.
2646
2647         * stress/string-joining-long-strings-should-not-crash.js:
2648
2649 2016-09-22  Benjamin Poulain  <bpoulain@apple.com>
2650
2651         [JSC] Use an inline cache to generate op_negate
2652         https://bugs.webkit.org/show_bug.cgi?id=162371
2653
2654         Reviewed by Saam Barati.
2655
2656         * stress/op-negate-inline-cache.js: Added.
2657
2658 2016-09-22  Mark Lam  <mark.lam@apple.com>
2659
2660         Array.prototype.join should do overflow checks on string joins.
2661         https://bugs.webkit.org/show_bug.cgi?id=162459
2662
2663         Reviewed by Saam Barati.
2664
2665         * stress/array-join-on-strings-need-overflow-checks.js: Added.
2666         (assert):
2667         (catch):
2668
2669 2016-09-22  Joseph Pecoraro  <pecoraro@apple.com>
2670
2671         test262: Function length should be number of parameters before parameters with default values
2672         https://bugs.webkit.org/show_bug.cgi?id=162377
2673
2674         Reviewed by Saam Barati.
2675
2676         * stress/es6-default-parameters.js:
2677         Add our own tests for function lengths with default parameters.
2678
2679         * test262.yaml:
2680         We now pass all dflt-length tests.
2681
2682 2016-09-20  Benjamin Poulain  <bpoulain@apple.com>
2683
2684         [JSC] Do not use EagerRun on tests counting recompilation
2685         https://bugs.webkit.org/show_bug.cgi?id=162248
2686
2687         Reviewed by Geoffrey Garen.
2688
2689         This patch adds defaultNoEagerRun to all the tests
2690         for which recompilation is the symptom of a bug.
2691         The reason is that an OSR Exit can be unrelated to the tested
2692         nodes when we are running in Eager mode.
2693
2694         * stress/arith-abs-on-various-types.js:
2695         * stress/arith-ceil-on-various-types.js:
2696         * stress/arith-clz32-on-various-types.js:
2697         * stress/arith-cos-on-various-types.js:
2698         * stress/arith-floor-on-various-types.js:
2699         * stress/arith-fround-on-various-types.js:
2700         * stress/arith-log-on-various-types.js:
2701         * stress/arith-round-on-various-types.js:
2702         * stress/arith-sin-on-various-types.js:
2703         * stress/arith-sqrt-on-various-types.js:
2704         * stress/arith-tan-on-various-types.js:
2705         * stress/arith-trunc-on-various-types.js:
2706
2707         * stress/compare-strict-eq-on-various-types.js:
2708         (testAllTypesCall):
2709         The value 2 came from the other tests.
2710         CompareStrictEq supports many more cases, the worst case
2711         is bool->int->int52->number->polymorphic.
2712
2713 2016-09-20  Filip Pizlo  <fpizlo@apple.com>
2714
2715         Make MarkedBlock state tracking support overlapped allocation and marking state
2716         https://bugs.webkit.org/show_bug.cgi?id=161581
2717
2718         Reviewed by Geoffrey Garen.
2719         
2720         Add a microbenchmark for why we want to reclaim empty blocks from other allocators.
2721
2722         * microbenchmarks/switching-size-classes.js: Added.
2723
2724 2016-09-20  Saam Barati  <sbarati@apple.com>
2725
2726         Unreviewed, added test for x86 32-bit failure for HasOwnProperty node in DFG.
2727
2728         * stress/has-own-property-called-on-non-object.js: Added.
2729         (let.objs):
2730         (new.String):
2731         (foo):
2732
2733 2016-09-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2734
2735         [JSC] Add `typeof value === "symbol"` handling to bytecode compiler
2736         https://bugs.webkit.org/show_bug.cgi?id=162253
2737
2738         Reviewed by Sam Weinig.
2739
2740         * microbenchmarks/is-symbol-mixed.js: Added.
2741         (isSymbol):
2742         (i.let.pair.of.list.String):
2743         * microbenchmarks/is-symbol.js: Added.
2744         (isSymbol):
2745
2746 2016-09-19  Saam Barati  <sbarati@apple.com>
2747
2748         Make HasOwnProperty faster
2749         https://bugs.webkit.org/show_bug.cgi?id=161708
2750
2751         Reviewed by Geoffrey Garen.
2752
2753         * microbenchmarks/has-own-property-name-cache.js: Added.
2754         (foo):
2755         * stress/has-own-property-cache-basics.js: Added.
2756         (assert):
2757         (foo):
2758         * stress/has-own-property-name-cache-string-keys.js: Added.
2759         (assert):
2760         (foo):
2761         * stress/has-own-property-name-cache-symbol-keys.js: Added.
2762         (assert):
2763         (foo):
2764         * stress/has-own-property-name-cache-symbols-and-strings.js: Added.
2765         (assert):
2766         (foo):
2767
2768 2016-09-19  Benjamin Poulain  <bpoulain@apple.com>
2769
2770         [JSC] Make the rounding-related nodes support any type
2771         https://bugs.webkit.org/show_bug.cgi?id=161895
2772
2773         Reviewed by Geoffrey Garen.
2774
2775         * stress/arith-ceil-on-various-types.js: Added.
2776         * stress/arith-floor-on-various-types.js: Added.
2777         * stress/arith-round-on-various-types.js: Added.
2778         * stress/arith-trunc-on-various-types.js: Added.
2779
2780 2016-09-18  Yusuke Suzuki  <utatane.tea@gmail.com>
2781
2782         [JSC] Do not need to use defineProperty to define methods for object literals
2783         https://bugs.webkit.org/show_bug.cgi?id=162111
2784
2785         Reviewed by Saam Barati.
2786
2787         * stress/object-literal-methods.js: Added.
2788         (shouldBe):
2789         (throw.new.Error.let.object.get name):
2790         (throw.new.Error):
2791         (shouldBe.let.object.get name):
2792         (shouldBe.let.object.get prototype):
2793         (shouldBe.let.object.get 42):
2794
2795 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2796
2797         [DFG] Introduce IsCellWithType node and unify IsJSArray, IsRegExpObject and newly added IsProxyObject
2798         https://bugs.webkit.org/show_bug.cgi?id=162000
2799
2800         Reviewed by Filip Pizlo.
2801
2802         * microbenchmarks/is-array-for-array.js: Added.
2803         (isArray):
2804         * microbenchmarks/is-array-for-mixed-case.js: Added.
2805         (isArray):
2806         * microbenchmarks/is-array-for-non-array-object.js: Added.
2807         (isArray):
2808         * microbenchmarks/is-array-for-proxy.js: Added.
2809         (isArray):
2810         (isArray.proxy.throw.new.Error.isArray):
2811         (isArray.proxy.throw.new.Error):
2812
2813 2016-09-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2814
2815         Unreviewed, gardening test262 results
2816
2817         Some tests are now passed with JSC, but marked as failed.
2818
2819         * test262.yaml:
2820
2821 2016-09-16  Joseph Pecoraro  <pecoraro@apple.com>
2822
2823         test262: Various Constructors length properties should be configurable
2824         https://bugs.webkit.org/show_bug.cgi?id=161998
2825
2826         Reviewed by Saam Barati.
2827
2828         * test262.yaml:
2829
2830 2016-09-15  Commit Queue  <commit-queue@webkit.org>
2831
2832         Unreviewed, rolling out r205931.
2833         https://bugs.webkit.org/show_bug.cgi?id=162021
2834
2835         Tests for this change fail on 32-bit JSC bots (Requested by
2836         ryanhaddad on #webkit).
2837
2838         Reverted changeset:
2839
2840         "[JSC] Make the rounding-related nodes support any type"
2841         https://bugs.webkit.org/show_bug.cgi?id=161895
2842         http://trac.webkit.org/changeset/205931
2843
2844 2016-09-15  Joseph Pecoraro  <pecoraro@apple.com>
2845
2846         test262: Should be a SyntaxError for duplicate parameter names in function with default parameters
2847         https://bugs.webkit.org/show_bug.cgi?id=162013
2848
2849         Reviewed by Saam Barati.
2850
2851         * stress/es6-default-parameters.js:
2852         * test262.yaml:
2853
2854 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2855
2856         ASSERT_NOT_REACHED when using spread inside an array literal with Function.prototype.apply
2857         https://bugs.webkit.org/show_bug.cgi?id=162003
2858
2859         Reviewed by Saam Barati.
2860
2861         * stress/spread-calling.js:
2862         * test262.yaml:
2863
2864 2016-09-14  Michael Saboff  <msaboff@apple.com>
2865
2866         YARR doesn't check for invalid flags for literal regular expressions
2867         https://bugs.webkit.org/show_bug.cgi?id=161995
2868
2869         Reviewed by Mark Lam.
2870
2871         New test.
2872
2873         * stress/regress-161995.js: Added.
2874         (testStatic):
2875         (catch):
2876
2877 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2878
2879         test262: TypedArray constructors length should be 3 and configurable
2880         https://bugs.webkit.org/show_bug.cgi?id=161955
2881
2882         Reviewed by Mark Lam.
2883
2884         * test262.yaml:
2885
2886 2016-09-14  Benjamin Poulain  <bpoulain@apple.com>
2887
2888         [JSC] Make the rounding-related nodes support any type
2889         https://bugs.webkit.org/show_bug.cgi?id=161895
2890
2891         Reviewed by Geoffrey Garen.
2892
2893         * stress/arith-ceil-on-various-types.js: Added.
2894         * stress/arith-floor-on-various-types.js: Added.
2895         * stress/arith-round-on-various-types.js: Added.
2896         * stress/arith-trunc-on-various-types.js: Added.
2897
2898 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2899
2900         TaggedTemplateString function calls should emit tail position calls
2901         https://bugs.webkit.org/show_bug.cgi?id=161948
2902
2903         Reviewed by Yusuke Suzuki.
2904
2905         * stress/tail-call-recognize.js:
2906         (runTests):
2907         Ensure a tagged template string function call is tail call.
2908
2909         * test262.yaml:
2910         These now pass.
2911
2912 2016-09-14  Joseph Pecoraro  <pecoraro@apple.com>
2913
2914         test262: Array.prototype.slice should always set length
2915         https://bugs.webkit.org/show_bug.cgi?id=161953
2916
2917         Reviewed by Mark Lam.
2918
2919         * test262.yaml:
2920
2921 2016-09-13  JF Bastien  <jfbastien@apple.com>
2922
2923         Support jsc shell builtin `read`
2924         https://bugs.webkit.org/show_bug.cgi?id=161662
2925
2926         Reviewed by Keith Miller.
2927
2928         * stress/jsc-read.js: Added.
2929         (test): test `read` and `readFile` shell builtins, in string and binary mode.
2930
2931 2016-09-12  Skachkov Oleksandr  <gskachkov@gmail.com>
2932
2933         ES6: Classes: Should be allowed to create a static method with name "arguments"
2934         https://bugs.webkit.org/show_bug.cgi?id=152985
2935
2936         Reviewed by Keith Miller.
2937
2938         * test262.yaml:
2939
2940 2016-09-12  Saam Barati  <sbarati@apple.com>
2941
2942         Speed up Function.prototype.bind a bit by making it a builtin
2943         https://bugs.webkit.org/show_bug.cgi?id=161879
2944
2945         Reviewed by Filip Pizlo.
2946
2947         * microbenchmarks/function-bind-inlining.js: Added.
2948         (assert):
2949         (test):
2950         (test2):
2951         (foo):
2952         * microbenchmarks/function-bind-no-inlining.js: Added.
2953         (assert):
2954         (test):
2955         (test2):
2956         (foo):
2957
2958 2016-09-12  Saam Barati  <sbarati@apple.com>
2959
2960         HashMapImpl should take into account m_deleteCount in its load factor and it should be able to rehash the table to be smaller
2961         https://bugs.webkit.org/show_bug.cgi?id=161640
2962
2963         Reviewed by Geoffrey Garen.
2964
2965         * microbenchmarks/map-rehash.js: Added.
2966         * stress/map-delete.js: Added.
2967         (assert):
2968         * stress/map-rehash-2.js: Added.
2969         (assert):
2970         * stress/map-rehash.js: Added.
2971         (assert):
2972
2973 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2974
2975         Unreviewed, fix tests for different libm environments
2976         https://bugs.webkit.org/show_bug.cgi?id=161857
2977
2978         * stress/ftl-arithtan.js:
2979
2980 2016-09-12  Benjamin Poulain  <bpoulain@apple.com>
2981
2982         [JSC] Use GetArrayLength for JSArray.length even when the array type is undecided
2983         https://bugs.webkit.org/show_bug.cgi?id=161671
2984
2985         Reviewed by Geoffrey Garen.
2986
2987         * stress/get-array-length-on-undecided.js: Added.
2988
2989 2016-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2990
2991         [DFG][FTL] Add ArithTan
2992         https://bugs.webkit.org/show_bug.cgi?id=161857
2993
2994         Reviewed by Filip Pizlo.
2995
2996         * microbenchmarks/tan.js: Added.
2997         * stress/arith-tan-on-various-types.js: Added.
2998         (let.validInputTypedTestCases.validInputTestCases.map):
2999         (isIdentical):
3000         (opaqueTanNoArgument):
3001         (testNoArgument):
3002         (opaqueAllTypesTan):
3003         (testAllTypesCall):
3004         (testTangleTypeCall):
3005         (testConstant):
3006         (opaqueTanForSideEffects):
3007         (testSideEffect.let.testObject.valueOf):
3008         (testSideEffect):
3009         (opaqueTanForCSE):
3010         (testCSE.let.testObject.valueOf):
3011         (testCSE):
3012         (opaqueTanForDCE):
3013         (testDCE.let.testObject.valueOf):
3014         (testDCE):
3015         (testException.opaqueTanWithException):
3016         (testException):
3017         * stress/ftl-arithtan.js: Added.
3018         (foo):
3019
3020 2016-09-12  Saam Barati  <sbarati@apple.com>
3021
3022         MapHash should do constant folding when it has a constant argument and its legal to hash that value
3023         https://bugs.webkit.org/show_bug.cgi?id=161639
3024
3025         Reviewed by Filip Pizlo.
3026
3027         * microbenchmarks/map-constant-key.js: Added.
3028         (assert):
3029         (test):
3030         (foo):
3031
3032 2016-09-12  Michael Saboff  <msaboff@apple.com>
3033
3034         JSC test timeout: ChakraCore.yaml/ChakraCore/test/Bugs/bug56026_trycatch.js.default
3035         https://bugs.webkit.org/show_bug.cgi?id=161863
3036
3037         Reviewed by Saam Barati.
3038
3039         * ChakraCore.yaml:
3040         Disabled Bugs/bug56026_trycatch.js.
3041
3042 2016-09-09  Michael Saboff  <msaboff@apple.com>
3043
3044         Unreviewed, rolling r205759 back in with a fix.
3045
3046         The expectation file, JSTests/ChakraCore/test/Lib/tostring.baseline-jsc,
3047         should be named "toString.baseline-jsc".
3048
3049         * ChakraCore/test/Lib/toString.baseline-jsc: Copied from JSTests/ChakraCore/test/Lib/tostring.baseline-jsc.
3050         * ChakraCore/test/Lib/tostring.baseline-jsc: Removed.
3051
3052 2016-09-09  Michael Saboff  <msaboff@apple.com>
3053
3054         Disable three flakey Chakra Tests
3055         https://bugs.webkit.org/show_bug.cgi?id=161807
3056
3057         Reviewed by Saam Barati.
3058
3059         * ChakraCore.yaml: Disabled the flakey tests
3060         ChakraCore/test/Array/protoLookup_native.js
3061         ChakraCore/test/LetConst/delete.js
3062         ChakraCore/test/fieldopts/fieldhoist_sideeffect.js
3063
3064 2016-09-08  Saam Barati  <sbarati@apple.com>
3065
3066         We should inline operationConvertJSValueToBoolean into JIT code
3067         https://bugs.webkit.org/show_bug.cgi?id=161729
3068
3069         Reviewed by Filip Pizlo.
3070
3071         * stress/value-to-boolean.js: Added.
3072         (assert):
3073         (test1):
3074         (test2):
3075         (test3):
3076
3077 2016-09-08  Mark Lam  <mark.lam@apple.com>
3078
3079         REGRESSION (r205569?): 32-bit JSC test timeout: stress/rest-parameter-many-arguments.js.dfg-maximal-flush-validate-no-cjit
3080         https://bugs.webkit.org/show_bug.cgi?id=161756
3081
3082         Reviewed by Saam Barati.
3083
3084         It looks like the 32-bit JSC bot is just too slow at running this test with the
3085         dfg-maximal-flush-validate-no-cjit configuration.  We'll try excluding that
3086         configuration.
3087
3088         * stress/rest-parameter-many-arguments.js:
3089
3090 2016-09-08  JF Bastien  <jfbastien@apple.com>
3091
3092         Delete older WebAssembly tests
3093         https://bugs.webkit.org/show_bug.cgi?id=161758
3094
3095         Reviewed by Filip Pizlo.
3096
3097         They're not running, rely on the older polyfill prototype, and the older code was deleted in: https://trac.webkit.org/changeset/204180
3098
3099         * stress/wasm-arithmetic-float32.js: Removed.
3100         * stress/wasm-arithmetic-float64.js: Removed.
3101         * stress/wasm-arithmetic-int32.js: Removed.
3102         * stress/wasm-calls.js: Removed.
3103         * stress/wasm-comma.js: Removed.
3104         * stress/wasm-control-flow.js: Removed.
3105         * stress/wasm-globals.js: Removed.
3106         * stress/wasm-linear-memory.js: Removed.
3107         * stress/wasm-locals.js: Removed.
3108         * stress/wasm-relational.js: Removed.
3109         * stress/wasm-type-conversion.js: Removed.
3110         * stress/wasm/arithmetic-float32.wasm: Removed.
3111         * stress/wasm/arithmetic-float64.wasm: Removed.
3112         * stress/wasm/arithmetic-int32.wasm: Removed.
3113         * stress/wasm/calls.wasm: Removed.
3114         * stress/wasm/comma.wasm: Removed.
3115         * stress/wasm/control-flow.wasm: Removed.
3116         * stress/wasm/globals.wasm: Removed.
3117         * stress/wasm/linear-memory.wasm: Removed.
3118         * stress/wasm/locals.wasm: Removed.
3119         * stress/wasm/relational.wasm: Removed.
3120         * stress/wasm/type-conversion.wasm: Removed.
3121
3122 2016-09-08  Per Arne Vollan  <pvollan@apple.com>
3123
3124         [Win] Exception fuzz tests fail
3125         https://bugs.webkit.org/show_bug.cgi?id=140928
3126
3127         Reviewed by Mark Lam.
3128
3129         Unskip tests.
3130
3131         * exceptionFuzz.yaml:
3132
3133 2016-09-06  Saam Barati  <sbarati@apple.com>
3134
3135         ProxyObject's structure should not have ObjectPrototype as its prototype and it should not have special behavior for intercepting "__proto__"
3136         https://bugs.webkit.org/show_bug.cgi?id=161558
3137
3138         Reviewed by Benjamin Poulain.
3139
3140         * stress/proxy-get-prototype-of.js:
3141         * stress/proxy-set-prototype-of.js:
3142         (let.handler.setPrototypeOf): Deleted.
3143         * stress/proxy-underscore-proto.js: Added.
3144         (assert):
3145
3146 2016-09-06  Saam Barati  <sbarati@apple.com>
3147
3148         Make JSMap and JSSet faster
3149         https://bugs.webkit.org/show_bug.cgi?id=160989
3150
3151         Reviewed by Filip Pizlo.
3152
3153         * microbenchmarks/dense-set.js: Added.
3154         (bench):
3155         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3156         (bar):
3157         (foo):
3158         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3159         (bar):
3160         (foo):
3161         * microbenchmarks/large-map-iteration.js: Added.
3162         (bar):
3163         (foo):
3164         * microbenchmarks/map-get-get-cse.js: Added.
3165         (bar):
3166         (foo):
3167         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3168         (bar):
3169         (foo):
3170         * microbenchmarks/sparse-set.js: Added.
3171         (bench):
3172         * stress/map-cse-correctness.js: Added.
3173         (assert):
3174         (testHas):
3175         (testGet):
3176         (foo):
3177         * stress/map-iteration.js: Added.
3178         (assert):
3179         (test1):
3180         (test2):
3181         (test3):
3182         (test4):
3183         (test5):
3184         (test6):
3185         (test7):
3186         (test8):
3187         (test9):
3188         (test10):
3189         (test11):
3190         (test12):
3191         (test13):
3192         (test14):
3193         (test15):
3194         (test16):
3195         (test17):
3196         (test18):
3197
3198 2016-09-06  Benjamin Poulain  <bpoulain@apple.com>
3199
3200         [JSC] Make ArithClz32 work with Cell arguments
3201         https://bugs.webkit.org/show_bug.cgi?id=161369
3202
3203         Reviewed by Geoffrey Garen.
3204
3205         * stress/arith-clz32-on-various-types.js: Added.
3206
3207 2016-09-06  Commit Queue  <commit-queue@webkit.org>
3208
3209         Unreviewed, rolling out r205504.
3210         https://bugs.webkit.org/show_bug.cgi?id=161645
3211
3212         Broke the iOS device build (Requested by ryanhaddad on
3213         #webkit).
3214
3215         Reverted changeset:
3216
3217         "Make JSMap and JSSet faster"
3218         https://bugs.webkit.org/show_bug.cgi?id=160989
3219         http://trac.webkit.org/changeset/205504
3220
3221 2016-09-06  Saam Barati  <sbarati@apple.com>
3222
3223         Make JSMap and JSSet faster
3224         https://bugs.webkit.org/show_bug.cgi?id=160989
3225
3226         Reviewed by Filip Pizlo.
3227
3228         * microbenchmarks/dense-set.js: Added.
3229         (bench):
3230         * microbenchmarks/large-map-iteration-with-additions.js: Added.
3231         (bar):
3232         (foo):
3233         * microbenchmarks/large-map-iteration-with-mutation.js: Added.
3234         (bar):
3235         (foo):
3236         * microbenchmarks/large-map-iteration.js: Added.
3237         (bar):
3238         (foo):
3239         * microbenchmarks/map-get-get-cse.js: Added.
3240         (bar):
3241         (foo):
3242         * microbenchmarks/map-has-get-cse-opportunity.js: Added.
3243         (bar):
3244         (foo):
3245         * microbenchmarks/sparse-set.js: Added.
3246         (bench):
3247         * stress/map-cse-correctness.js: Added.
3248         (assert):
3249         (testHas):
3250         (testGet):
3251         (foo):
3252         * stress/map-iteration.js: Added.
3253         (assert):
3254         (test1):
3255         (test2):
3256         (test3):
3257         (test4):
3258         (test5):
3259         (test6):
3260         (test7):
3261         (test8):
3262         (test9):
3263         (test10):
3264         (test11):
3265         (test12):
3266         (test13):
3267         (test14):
3268         (test15):
3269         (test16):
3270         (test17):
3271         (test18):
3272
3273 2016-08-31  Filip Pizlo  <fpizlo@apple.com>
3274
3275         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3276         https://bugs.webkit.org/show_bug.cgi?id=160125
3277
3278         Reviewed by Geoffrey Garen and Keith Miller.
3279         
3280         Most of the things I did properly covered by existing tests, but I found some simple cases of
3281         unshifting that had sketchy coverage.
3282
3283         * stress/array-storage-array-unshift.js: Added.
3284         * stress/contiguous-array-unshift.js: Added.
3285         * stress/double-array-unshift.js: Added.
3286         * stress/int32-array-unshift.js: Added.
3287
3288 2016-09-02  Michael Saboff  <msaboff@apple.com>
3289
3290         Unreviewed fix after importing Chakra test
3291
3292         * ChakraCore.yaml: Skipped ChakraCore/test/UnifiedRegex/crazy.js because the original
3293         test contained tab characters.  I removed the tabs before landing.  This test depended
3294         on the tab characters and now fails after they were removed.
3295         test.
3296
3297 2016-09-01  Michael Saboff  <msaboff@apple.com>
3298
3299         Import Chakra tests to JSC
3300         https://bugs.webkit.org/show_bug.cgi?id=154697
3301
3302         Reviewed by Saam Barati.
3303
3304         Added Chakra tests.  All these tests are under Chakra/test.  This is the same layout
3305         for tests in the Chakra tree.
3306
3307         Created a ChakraCore.yaml file to be used with run-jsc-stress-tests.  This file contains
3308         the tests that are run when the original Chakra runtests.py script is run.  That script
3309         is the test driver for *nix platforms and does not attempt to run all tests or all
3310         variations of tests.  The runtest.py driver consults rlexe.xml files in each test
3311         subdirectory to determine the test to run, the options to pass to the test and how to
3312         determine pass/fail of the test.  With runtests.py as the start, tests that didn't
3313         pass directly where either skipped, with a message describing why or through 
3314         adjustments to the test infrastructure, as described below, where made to pass.
3315         
3316         The only modification to the test infrastrucutre are:
3317
3318          1) Added simple mapping of Chakra expected exception text to JSC expected text in
3319             test/UnitTestFramework/UnitTestFramework.js.  It would make sense to also
3320             map some JSC specific exception text to more generic text for the cases where
3321             that text contains indetifier names or other source specific strings and the
3322             Chakra equivolent exception texts are generic.  
3323  
3324          2) Created JSC specific expected text files where it is clear that the text work
3325             as expected on JSC but the test output is different.  Typically the differences
3326             fall into three categories, different exception output, different output from
3327             toString() of a function, slight numeric differences, and test that rely on
3328             iteration order.
3329
3330          3) Stripped the CR's from the CR-LF line terminations of the files.  
3331
3332         No actual test .js files were modified.
3333
3334         * ChakraCore: Added.
3335         * ChakraCore.yaml: Added.
3336         * ChakraCore/CONTRIBUTING.md: Added.
3337         * ChakraCore/LICENSE.txt: Added.
3338         * ChakraCore/README.md: Added.
3339         * ChakraCore/THIRD-PARTY-NOTICES.txt: Added.
3340         * ChakraCore/test: Added this directory and the tests included therein.
3341
3342 2016-09-01  JF Bastien  <jfbastien@apple.com>
3343
3344         GetByIdWithThis/GetByValWithThis should have ValueProfiles so that they can predict their result types
3345         https://bugs.webkit.org/show_bug.cgi?id=160922
3346
3347         Reviewed by Keith Miller.
3348
3349         Benchmark GetBy{Id,Val}WithThis in monomorphic and polymorphic uses.
3350         The value profile is used by the calc functions, which do some mild math with the result.
3351         These benchmarks get ~4% faster with value profiling.
3352
3353         * microbenchmarks/super-get-by-id-with-this-monomorphic.js: Added.
3354         (A):
3355         (A.prototype.set value):
3356         (A.prototype.get value):
3357         (B.prototype.set value):
3358         (B.prototype.get value):
3359         (B):
3360         (const.bench):
3361         * microbenchmarks/super-get-by-id-with-this-polymorphic.js: Added.
3362         (A):
3363         (A.prototype.set value):
3364         (A.prototype.get value):
3365         (B.prototype.set value):
3366         (B.prototype.get value):
3367         (B):
3368         (const.bench):
3369         * microbenchmarks/super-get-by-val-with-this-monomorphic.js: Added.
3370         (value):
3371         (A):
3372         (A.prototype.set v):
3373         (A.prototype.get v):
3374         (B.prototype.set v):
3375         (B.prototype.get v):
3376         (B):
3377         (const.bench):
3378         * microbenchmarks/super-get-by-val-with-this-polymorphic.js: Added.
3379         (value):
3380         (A):
3381         (A.prototype.set v):
3382         (A.prototype.get v):
3383         (B.prototype.set v):
3384         (B.prototype.get v):
3385         (B):
3386         (const.bench):
3387
3388 2016-09-01  Benjamin Poulain  <bpoulain@apple.com>
3389
3390         arith-abs-on-various-types.js is flaky
3391
3392         Unreviewed.
3393
3394         * stress/arith-abs-on-various-types.js:
3395         Two compilation is too small for the worst case.
3396         Math.abs() can be typed integer->number->untyped if we are very unlucky.
3397
3398 2016-09-01  Filip Pizlo  <fpizlo@apple.com>
3399
3400         ObjectAllocationSinkingPhase::insertOSRHintsForUpdate() fails to emit updated hints in some cases
3401         https://bugs.webkit.org/show_bug.cgi?id=161492
3402
3403         Reviewed by Mark Lam.
3404         
3405         This bug affected function->activation references but not object->object field references,
3406         because object->object field references are !neededForMaterialization(). So, the object
3407         test always passed but the activation/function test used to always fail. It passes now.
3408
3409         * stress/materialize-activation-referenced-from-phantom-function.js: Added.
3410         (bar):
3411         (inc):
3412         (dec):
3413         (foo):
3414         (test):
3415         * stress/materialize-object-referenced-from-phantom-object.js: Added.
3416         (bar):
3417         (foo):
3418         (test):
3419
3420 2016-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3421
3422         stress/random-53bit.js.ftl-no-cjit-no-inline-validate sometimes fails
3423         https://bugs.webkit.org/show_bug.cgi?id=161436
3424
3425         Reviewed by Filip Pizlo.
3426
3427         The test checks Math.random() correctly produces 53bit random values.
3428         The test can fail by design, but this should be fairly rare.
3429
3430         However, when introducing, we wrap the `test()` with 1e4 to ensure the FTL compilation, and this
3431         increases the failure rate. By increasing the MAX in the test, we make the failures much more rare case.
3432
3433         And we also add getRandomSeed() and setRandomSeed(seed) JSC shell helpers to dump more useful information
3434         and reproduce the situation easily.
3435
3436         * stress/random-53bit.js:
3437         (test):
3438
3439 2016-08-29  Benjamin Poulain  <bpoulain@apple.com>
3440
3441         [JSC] Improve ArithAbs with polymorphic input
3442         https://bugs.webkit.org/show_bug.cgi?id=161286
3443
3444         Reviewed by Saam Barati.
3445
3446         * stress/arith-abs-on-various-types.js: Added.
3447         New tests.
3448
3449         * stress/arith-cos-on-various-types.js:
3450         * stress/arith-fround-on-various-types.js:
3451         * stress/arith-log-on-various-types.js:
3452         * stress/arith-sin-on-various-types.js:
3453         * stress/arith-sqrt-on-various-types.js:
3454         Extend the existing tests to cover the DCE case.
3455
3456 2016-08-26  Benjamin Poulain  <benjamin@webkit.org>
3457
3458         [JSC] Implement CompareStrictEq(String, Untyped) in FTL
3459         https://bugs.webkit.org/show_bug.cgi?id=161229
3460
3461         Reviewed by Geoffrey Garen.
3462
3463         * stress/compare-strict-eq-on-various-types.js: Added.
3464
3465 2016-08-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3466
3467         [ES6] newPromiseCapabilities should check the given argument is constructor
3468         https://bugs.webkit.org/show_bug.cgi?id=161226
3469
3470         Reviewed by Mark Lam.
3471
3472         The arrow function should not be a constructor. So the error should be raised.
3473
3474         * stress/new-promise-capabilities-requires-constructor.js: Added.
3475         (shouldThrow):
3476
3477 2016-08-25  Benjamin Poulain  <bpoulain@apple.com>
3478
3479         [JSC] Clean up the abstract interpreter for cos/sin/sqrt/fround/log
3480         https://bugs.webkit.org/show_bug.cgi?id=161181
3481
3482         Reviewed by Geoffrey Garen.
3483
3484         Extend the tests to constants.
3485         Add no-argument cases where needed.
3486
3487         * stress/arith-cos-on-various-types.js:
3488         * stress/arith-fround-on-various-types.js:
3489         * stress/arith-log-on-various-types.js:
3490         * stress/arith-sin-on-various-types.js:
3491         * stress/arith-sqrt-on-various-types.js:
3492
3493 2016-08-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3494
3495         [DFG][FTL] Implement ES6 Generators in DFG / FTL
3496         https://bugs.webkit.org/show_bug.cgi?id=152723
3497
3498         Reviewed by Filip Pizlo.
3499
3500         * stress/generator-fib-ftl-and-array.js: Added.
3501         (fib):
3502         * stress/generator-fib-ftl-and-object.js: Added.
3503         (fib):
3504         * stress/generator-fib-ftl-and-string.js: Added.
3505         (fib):
3506         * stress/generator-fib-ftl.js: Added.
3507         (fib):
3508         * stress/generator-frame-empty.js: Added.
3509         (shouldThrow):
3510         (shouldThrow.fib):
3511         * stress/generator-reduced-save-point-put-to-scope.js: Added.
3512         (shouldBe):
3513         (gen):
3514         * stress/generator-transfer-register-beyond-mutiple-yields.js: Added.
3515         (shouldBe):
3516         (gen):
3517
3518 2016-08-25  JF Bastien  <jfbastien@apple.com>
3519
3520         TryGetById should have a ValueProfile so that it can predict its output type
3521         https://bugs.webkit.org/show_bug.cgi?id=160921
3522
3523         Reviewed by Saam Barati.
3524
3525         * microbenchmarks/try-get-by-id-basic.js: Added.
3526         (const.check):
3527         (const.bench.f.const.fooPlusBar.createBuiltin):
3528         * microbenchmarks/try-get-by-id-polymorphic.js: Added.
3529         (const.check):
3530         (fooPlusBar.createBuiltin):
3531         (bench):
3532
3533 2016-08-25  Caio Lima  <ticaiolima@gmail.com>
3534
3535         NewRegexp should not prevent inlining
3536         https://bugs.webkit.org/show_bug.cgi?id=154808
3537
3538         Reviewed by Geoffrey Garen.
3539
3540         Added test where functions with NewRegExp can be inlined right now.
3541
3542         * stress/new-regex-inline.js: Added.
3543         (assert):
3544         (testRegexpInline):
3545         (toInlineGlobal):
3546         (withRegexp):
3547         (inlineRegexpNotGlobal):
3548         (toInlineRecursive):
3549         (regexpContainsRecursive):
3550
3551 2016-08-24  Benjamin Poulain  <benjamin@webkit.org>
3552
3553         [JSC] Make FRound work with any type
3554         https://bugs.webkit.org/show_bug.cgi?id=161129
3555
3556         Reviewed by Geoffrey Garen.
3557
3558         * stress/arith-fround-on-various-types.js: Added.
3559
3560 2016-08-24  Filip Pizlo  <fpizlo@apple.com>
3561
3562         Unreviewed, roll out r204901, r204897, r204866, r204856, r204854.
3563
3564         * stress/array-storage-array-unshift.js: Removed.
3565         * stress/contiguous-array-unshift.js: Removed.
3566         * stress/double-array-unshift.js: Removed.
3567         * stress/int32-array-unshift.js: Removed.
3568
3569 2016-08-24  Skachkov Oleksandr  <gskachkov@gmail.com>
3570
3571         [ES2016] Allow assignment in for-in head in not-strict mode
3572         https://bugs.webkit.org/show_bug.cgi?id=160955
3573
3574         Reviewed by Saam Barati.
3575
3576         * stress/for-in-tests.js:
3577         (foo):
3578         (boo):
3579         (catch):
3580
3581 2016-08-23  Benjamin Poulain  <benjamin@webkit.org>
3582
3583         [JSC] Make ArithLog works with any type
3584         https://bugs.webkit.org/show_bug.cgi?id=161110
3585
3586         Reviewed by Geoffrey Garen.
3587
3588         * stress/arith-log-on-various-types.js: Added.
3589
3590 2016-08-23  Saam Barati  <sbarati@apple.com>
3591
3592         JSC should have a "microbenchmarks" directory instead of "regress" directory
3593         https://bugs.webkit.org/show_bug.cgi?id=161096
3594
3595         Rubber stamped by Mark Lam.
3596
3597         * microbenchmarks: Copied from LayoutTests/js/regress/script-tests.
3598
3599 2016-08-23  Keith Miller  <keith_miller@apple.com>
3600
3601         %TypedArray%.prototype.slice needs to check that the source and destination have not been detached.
3602         https://bugs.webkit.org/show_bug.cgi?id=161031
3603         <rdar://problem/27937019>
3604
3605         Reviewed by Geoffrey Garen.
3606
3607         * stress/typedarray-slice.js:
3608         (get let):
3609         (get try):
3610         (testSpeciesWithTransferring):
3611
3612 2016-08-22  Filip Pizlo  <fpizlo@apple.com>
3613
3614         Butterflies should be allocated in Auxiliary MarkedSpace instead of CopiedSpace and we should rewrite as much of the GC as needed to make this not a regression
3615         https://bugs.webkit.org/show_bug.cgi?id=160125
3616
3617         Reviewed by Geoffrey Garen.
3618         
3619         Most of the things I did properly covered by existing tests, but I found some simple cases of
3620         unshifting that had sketchy coverage.
3621
3622         * stress/array-storage-array-unshift.js: Added.
3623         * stress/contiguous-array-unshift.js: Added.
3624         * stress/double-array-unshift.js: Added.
3625         * stress/int32-array-unshift.js: Added.
3626
3627 2016-08-23  Keith Miller  <keith_miller@apple.com>
3628
3629         Update/add new test262 tests
3630         https://bugs.webkit.org/show_bug.cgi?id=161098
3631
3632         Reviewed by Saam Barati.
3633
3634         * test262.yaml:
3635         * test262/test/annexB/language/statements/for-in/bare-initializer.js: Added.
3636         * test262/test/annexB/language/statements/for-in/const-initializer.js: Added.
3637         * test262/test/annexB/language/statements/for-in/let-initializer.js: Added.
3638         * test262/test/annexB/language/statements/for-in/nonstrict-initializer.js: Added.
3639         (a):
3640         * test262/test/annenxB/language/statements/for-in/strict-initializer.js: Added.
3641         * test262/test/annexB/language/statements/for-in/var-arraybindingpattern-initializer.js: Added.
3642         * test262/test/annexB/language/statements/for-in/var-objectbindingpattern-initializer.js: Added.
3643         * test262/test/built-ins/AsyncFunction/AsyncFunction-construct.js: Added.
3644         (AsyncFunction.async.foo):
3645         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-extensible.js: Added.
3646         (AsyncFunction.async):
3647         * test262/test/built-ins/AsyncFunction/AsyncFunction-is-subclass.js: Added.
3648         (async.foo):
3649         * test262/test/built-ins/AsyncFunction/AsyncFunction-length.js: Added.
3650         (AsyncFunction.async.foo):
3651         * test262/test/built-ins/AsyncFunction/AsyncFunction-name.js: Added.
3652         (AsyncFunction.async.foo):
3653         * test262/test/built-ins/AsyncFunction/AsyncFunction-prototype.js: Added.
3654         (AsyncFunction.async.foo):
3655         * test262/test/built-ins/AsyncFunction/AsyncFunction.js: Added.
3656         (AsyncFunction.async.foo):
3657         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-is-extensible.js: Added.
3658         (AsyncFunction.async.foo):
3659         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-prototype.js: Added.
3660         (AsyncFunction.async.foo):
3661         * test262/test/built-ins/AsyncFunction/AsyncFunctionPrototype-to-string.js: Added.
3662         (AsyncFunction.async.foo):
3663         * test262/test/built-ins/AsyncFunction/instance-construct.js: Added.
3664         (async.foo):
3665         * test262/test/built-ins/AsyncFunction/instance-has-name.js: Added.
3666         (async.foo):
3667         * test262/test/built-ins/AsyncFunction/instance-length.js: Added.
3668         (async.l0):
3669         (async.l1):
3670         (async.l2):
3671         * test262/test/built-ins/AsyncFunction/instance-prototype-property.js: Added.
3672         (async.foo):
3673         * test262/test/built-ins/AsyncFunction/is-not-a-global.js: Added.
3674         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-after-integer-byteoffset.js.
3675         * test262/test/built-ins/DataView/prototype/getFloat32/detached-buffer-before-outofrange-byteoffset.js:
3676         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-after-integer-byteoffset.js.
3677         * test262/test/built-ins/DataView/prototype/getFloat64/detached-buffer-before-outofrange-byteoffset.js:
3678         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-after-integer-byteoffset.js.
3679         * test262/test/built-ins/DataView/prototype/getInt16/detached-buffer-before-outofrange-byteoffset.js:
3680         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-after-integer-byteoffset.js.
3681         * test262/test/built-ins/DataView/prototype/getInt32/detached-buffer-before-outofrange-byteoffset.js:
3682         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-after-integer-byteoffset.js.
3683         * test262/test/built-ins/DataView/prototype/getInt8/detached-buffer-before-outofrange-byteoffset.js:
3684         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-after-integer-byteoffset.js.
3685         * test262/test/built-ins/DataView/prototype/getUint16/detached-buffer-before-outofrange-byteoffset.js:
3686         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-after-integer-byteoffset.js.
3687         * test262/test/built-ins/DataView/prototype/getUint32/detached-buffer-before-outofrange-byteoffset.js:
3688         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-after-integer-byteoffset.js.
3689         * test262/test/built-ins/DataView/prototype/getUint8/detached-buffer-before-outofrange-byteoffset.js:
3690         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-after-integer-byteoffset.js.
3691         * test262/test/built-ins/DataView/prototype/setFloat32/detached-buffer-before-outofrange-byteoffset.js:
3692         * test262/test/built-ins/DataView/prototype/setFloat32/index-check-before-value-conversion.js:
3693         * test262/test/built-ins/DataView/prototype/setFloat32/range-check-after-value-conversion.js:
3694         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-after-integer-byteoffset.js.
3695         * test262/test/built-ins/DataView/prototype/setFloat64/detached-buffer-before-outofrange-byteoffset.js:
3696         * test262/test/built-ins/DataView/prototype/setFloat64/index-check-before-value-conversion.js:
3697         * test262/test/built-ins/DataView/prototype/setFloat64/range-check-after-value-conversion.js:
3698         * test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-toindex-byteoffset.js: Renamed from JSTests/test262/test/built-ins/DataView/prototype/setInt16/detached-buffer-after-integer-byteoffset.js.