JSTests/ChangeLog

   1 2018-05-04  Dominik Infuehr  <dinfuehr@igalia.com>
   2
   3         Disable tests on systems with limited memory
   4         https://bugs.webkit.org/show_bug.cgi?id=185296
   5
   6         Reviewed by Saam Barati.
   7
   8         Test doesn't work with a limited amount of memory. I tried to reduce memory usage
   9         but then it was hard to reproduce the failure the test was originally made to test.
  10
  11         * stress/array-reverse-doesnt-clobber.js:
  12
  13 2018-05-03  Saam Barati  <sbarati@apple.com>
  14
  15         Don't prevent CreateThis being folded to NewObject when the structure is poly proto
  16         https://bugs.webkit.org/show_bug.cgi?id=185177
  17
  18         Reviewed by Filip Pizlo.
  19
  20         * microbenchmarks/construct-poly-proto-object.js: Added.
  21         (foo.A):
  22         (foo):
  23         * stress/allocation-sinking-new-object-with-poly-proto.js: Added.
  24         (foo.A):
  25         (foo):
  26         (makePolyProto):
  27         (bar):
  28         (baz):
  29
  30 2018-05-03  Michael Saboff  <msaboff@apple.com>
  31
  32         OSR entry pruning of Program Bytecodes doesn't take into account try/catch
  33         https://bugs.webkit.org/show_bug.cgi?id=185281
  34
  35         Reviewed by Saam Barati.
  36
  37         New regression test.
  38
  39         * stress/baseline-osrentry-catch-is-reachable.js: Added.
  40         (i.j.catch):
  41
  42 2018-05-03  Ryan Haddad  <ryanhaddad@apple.com>
  43
  44         Unreviewed, rolling out r231197.
  45
  46         The test added with this change crashes on the 32-bit JSC bot.
  47
  48         Reverted changeset:
  49
  50         "Correctly detect string overflow when using the 'Function'
  51         constructor"
  52         https://bugs.webkit.org/show_bug.cgi?id=184883
  53         https://trac.webkit.org/changeset/231197
  54
  55 2018-05-02  Filip Pizlo  <fpizlo@apple.com>
  56
  57         JSC should know how to cache custom getter accesses on the prototype chain
  58         https://bugs.webkit.org/show_bug.cgi?id=185213
  59
  60         Reviewed by Keith Miller.
  61
  62         * microbenchmarks/get-custom-getter.js: Added.
  63         (test):
  64
  65 2018-05-02  Robin Morisset  <rmorisset@apple.com>
  66
  67         emitCodeToGetArgumentsArrayLength should not crash on PhantomNewArrayWithSpread
  68         https://bugs.webkit.org/show_bug.cgi?id=183172
  69
  70         Reviewed by Filip Pizlo.
  71
  72         * stress/length-of-new-array-with-spread.js: Added.
  73         (foo):
  74         (bar):
  75         (baz):
  76
  77 2018-05-01  Yusuke Suzuki  <utatane.tea@gmail.com>
  78
  79         [JSC] Add SameValue DFG node
  80         https://bugs.webkit.org/show_bug.cgi?id=185065
  81
  82         Reviewed by Saam Barati.
  83
  84         * microbenchmarks/object-is.js: Added.
  85         (incognito):
  86         (sameValue):
  87         (test1):
  88         (test2):
  89         (test3):
  90         (test4):
  91         (test5):
  92         (test6):
  93         * stress/object-is.js: Added.
  94         (shouldBe):
  95         (is1):
  96         (is2):
  97         (is3):
  98         (is4):
  99         (is5):
 100         (is6):
 101         (is7):
 102         (is8):
 103         (is9):
 104         (is10):
 105         (is11):
 106         (is12):
 107         (is13):
 108         (is14):
 109         (is15):
 110
 111 2018-05-01  Robin Morisset  <rmorisset@apple.com>
 112
 113         Correctly detect string overflow when using the 'Function' constructor
 114         https://bugs.webkit.org/show_bug.cgi?id=184883
 115         <rdar://problem/36320331>
 116
 117         Reviewed by Filip Pizlo.
 118
 119         I put this regression test in the 'slowMicrobenchmarks' directory because it takes nearly 30s to run, and I am not sure where else to put it.
 120
 121         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
 122         (catch):
 123
 124 2018-05-01  Robin Morisset  <rmorisset@apple.com>
 125
 126         IntlObject.cpp::removeUnicodeLocaleExtension() should not touch locales that end in '-u'
 127         https://bugs.webkit.org/show_bug.cgi?id=185162
 128
 129         Reviewed by Filip Pizlo.
 130
 131         * stress/incomplete-unicode-locale.js: Added.
 132         (catch):
 133
 134 2018-05-01  Dominik Infuehr  <dinfuehr@igalia.com>
 135
 136         Add SetCallee as DFG-Operation
 137         https://bugs.webkit.org/show_bug.cgi?id=184582
 138
 139         Reviewed by Filip Pizlo.
 140
 141         Added test that runs into infinite loop without updating the callee and
 142         therefore emitting SetCallee in DFG for recursive tail calls.
 143
 144         * stress/closure-recursive-tail-call-infinite-loop.js: Added.
 145         (Foo):
 146         (second):
 147         (first):
 148         (return.closure):
 149         (createClosure):
 150
 151 2018-04-30  Saam Barati  <sbarati@apple.com>
 152
 153         ToString constant folds without preserving checks, causing us to break assumptions that the code would OSR exit
 154         https://bugs.webkit.org/show_bug.cgi?id=185149
 155         <rdar://problem/39455917>
 156
 157         Reviewed by Filip Pizlo.
 158
 159         * stress/keep-checks-when-converting-to-lazy-js-constant-in-strength-reduction.js: Added.
 160
 161 2018-04-29  Filip Pizlo  <fpizlo@apple.com>
 162
 163         LICM shouldn't hoist nodes if hoisted nodes exited in that code block
 164         https://bugs.webkit.org/show_bug.cgi?id=185126
 165
 166         Reviewed by Saam Barati.
 167
 168         I found this bug by accident when I was writing this test for something else.
 169
 170         This change also speeds up other benchmarks of this case that we already had. They are all called
 171         the licm-dragons tests.
 172
 173         * microbenchmarks/licm-dragons-two-structures.js: Added.
 174         (foo):
 175
 176 2018-04-29  Commit Queue  <commit-queue@webkit.org>
 177
 178         Unreviewed, rolling out r231137.
 179         https://bugs.webkit.org/show_bug.cgi?id=185118
 180
 181         It is breaking Test262 language/expressions/multiplication
 182         /order-of-evaluation.js (Requested by caiolima on #webkit).
 183
 184         Reverted changeset:
 185
 186         "[ESNext][BigInt] Implement support for "*" operation"
 187         https://bugs.webkit.org/show_bug.cgi?id=183721
 188         https://trac.webkit.org/changeset/231137
 189
 190 2018-04-28  Saam Barati  <sbarati@apple.com>
 191
 192         We don't model regexp effects properly
 193         https://bugs.webkit.org/show_bug.cgi?id=185059
 194         <rdar://problem/39736150>
 195
 196         Reviewed by Filip Pizlo.
 197
 198         * stress/regexp-exec-test-effectful-last-index.js: Added.
 199         (assert):
 200         (foo):
 201         (i.regexLastIndex.toString):
 202         (bar):
 203
 204 2018-04-28  Rick Waldron  <waldron.rick@gmail.com>
 205
 206         Token misspelled "tocken" in error message string
 207         https://bugs.webkit.org/show_bug.cgi?id=185030
 208
 209         Reviewed by Saam Barati.
 210
 211         * ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc: Fix typo "tocken" => "token"
 212         * stress/destructuring-assignment-syntax.js: Fix typo "tocken" => "token"
 213         * stress/error-messages-for-in-operator-should-not-crash.js: Fix typo "tocken" => "token"
 214         * stress/reserved-word-with-escape.js: Fix typo "tocken" => "token"
 215         (testSyntaxError.String.raw.v):
 216         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
 217         (testSyntaxError.String.raw.a):
 218
 219 2018-04-28  Caio Lima  <ticaiolima@gmail.com>
 220
 221         [ESNext][BigInt] Implement support for "*" operation
 222         https://bugs.webkit.org/show_bug.cgi?id=183721
 223
 224         Reviewed by Saam Barati.
 225
 226         * bigIntTests.yaml:
 227         * stress/big-int-mul-jit.js: Added.
 228         * stress/big-int-mul-to-primitive-precedence.js: Added.
 229         * stress/big-int-mul-to-primitive.js: Added.
 230         * stress/big-int-mul-type-error.js: Added.
 231         * stress/big-int-mul-wrapped-value.js: Added.
 232         * stress/big-int-multiplication.js: Added.
 233         * stress/big-int-multiply-memory-stress.js: Added.
 234
 235 2018-04-28  Commit Queue  <commit-queue@webkit.org>
 236
 237         Unreviewed, rolling out r231131.
 238         https://bugs.webkit.org/show_bug.cgi?id=185112
 239
 240         It is breaking Debug build due to unchecked exception
 241         (Requested by caiolima on #webkit).
 242
 243         Reverted changeset:
 244
 245         "[ESNext][BigInt] Implement support for "*" operation"
 246         https://bugs.webkit.org/show_bug.cgi?id=183721
 247         https://trac.webkit.org/changeset/231131
 248
 249 2018-04-27  Caio Lima  <ticaiolima@gmail.com>
 250
 251         [ESNext][BigInt] Implement support for "*" operation
 252         https://bugs.webkit.org/show_bug.cgi?id=183721
 253
 254         Reviewed by Saam Barati.
 255
 256         * bigIntTests.yaml:
 257         * stress/big-int-mul-jit.js: Added.
 258         * stress/big-int-mul-to-primitive-precedence.js: Added.
 259         * stress/big-int-mul-to-primitive.js: Added.
 260         * stress/big-int-mul-type-error.js: Added.
 261         * stress/big-int-mul-wrapped-value.js: Added.
 262         * stress/big-int-multiplication.js: Added.
 263         * stress/big-int-multiply-memory-stress.js: Added.
 264
 265 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
 266
 267         Unreviewed, rolling out r231086.
 268
 269         Caused JSC test failures due to an unchecked exception.
 270
 271         Reverted changeset:
 272
 273         "[ESNext][BigInt] Implement support for "*" operation"
 274         https://bugs.webkit.org/show_bug.cgi?id=183721
 275         https://trac.webkit.org/changeset/231086
 276
 277 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
 278
 279         Unreviewed test gardening, update expectations for test262/intl402/PluralRules tests after r231047.
 280
 281         * test262.yaml: Mark tests as passing.
 282
 283 2018-04-26  Caio Lima  <ticaiolima@gmail.com>
 284
 285         [ESNext][BigInt] Implement support for "*" operation
 286         https://bugs.webkit.org/show_bug.cgi?id=183721
 287
 288         Reviewed by Saam Barati.
 289
 290         * bigIntTests.yaml:
 291         * stress/big-int-mul-jit.js: Added.
 292         * stress/big-int-mul-to-primitive-precedence.js: Added.
 293         * stress/big-int-mul-to-primitive.js: Added.
 294         * stress/big-int-mul-type-error.js: Added.
 295         * stress/big-int-mul-wrapped-value.js: Added.
 296         * stress/big-int-multiplication.js: Added.
 297         * stress/big-int-multiply-memory-stress.js: Added.
 298
 299 2018-04-25  Robin Morisset  <rmorisset@apple.com>
 300
 301         In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
 302         https://bugs.webkit.org/show_bug.cgi?id=184773
 303         <rdar://problem/37773612>
 304
 305         Reviewed by Filip Pizlo.
 306
 307         This bug requires a race between the thread doing FTL compilation and the main thread, but it triggers in 100% of cases (before the fix) on my machine
 308         so I decided to add it to the stress tests nonetheless.
 309
 310         * stress/create-rest-while-having-a-bad-time.js: Added.
 311         (f):
 312         (g):
 313         (h):
 314
 315 2018-04-25  Keith Miller  <keith_miller@apple.com>
 316
 317         Add missing scope release to functionProtoFuncToString
 318         https://bugs.webkit.org/show_bug.cgi?id=184995
 319
 320         Reviewed by Saam Barati.
 321
 322         * stress/function-toString-arrow.js: Added.
 323         (async):
 324
 325 2018-04-24  Keith Miller  <keith_miller@apple.com>
 326
 327         fromCharCode is missing some exception checks
 328         https://bugs.webkit.org/show_bug.cgi?id=184952
 329
 330         Reviewed by Saam Barati.
 331
 332         * stress/fromCharCode-exception-check.js: Added.
 333         (get catch):
 334
 335 2018-04-24  Mark Lam  <mark.lam@apple.com>
 336
 337         Gardening: test fix after r230863.
 338         https://bugs.webkit.org/show_bug.cgi?id=184846
 339         <rdar://problem/39390672>
 340
 341         Not reviewed.
 342
 343         * stress/json-stringified-overflow-2.js:
 344         (catch):
 345         * stress/json-stringified-overflow.js:
 346         (catch):
 347
 348 2018-04-20  JF Bastien  <jfbastien@apple.com>
 349
 350         Handle more JSON stringify OOM
 351         https://bugs.webkit.org/show_bug.cgi?id=184846
 352         <rdar://problem/39390672>
 353
 354         Reviewed by Mark Lam.
 355
 356         * stress/json-stringified-overflow-2.js: Added. Same as the one
 357         below, but with a bigger input which will trigger a different code
 358         path.
 359         (catch):
 360         * stress/json-stringified-overflow.js: Modify the test to only
 361         catch OOM on stringification. not on string creation.
 362
 363 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 364
 365         [WebAssembly][Modules] Import tables in wasm modules
 366         https://bugs.webkit.org/show_bug.cgi?id=184738
 367
 368         Reviewed by JF Bastien.
 369
 370         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
 371         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
 372         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
 373         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
 374         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
 375         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
 376         * wasm/modules/wasm-imports-wasm-exports.js:
 377         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
 378         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
 379         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
 380         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
 381
 382 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 383
 384         [WebAssembly][Modules] Import globals from wasm modules
 385         https://bugs.webkit.org/show_bug.cgi?id=184736
 386
 387         Reviewed by JF Bastien.
 388
 389         * wasm.yaml:
 390         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
 391         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
 392         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
 393         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
 394         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
 395         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
 396         * wasm/modules/wasm-imports-wasm-exports.js:
 397         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
 398         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
 399         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
 400         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
 401
 402 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 403
 404         Unreviewed, reland r230697, r230720, and r230724.
 405         https://bugs.webkit.org/show_bug.cgi?id=184600
 406
 407         * wasm.yaml:
 408         * wasm/modules/constant.wasm: Added.
 409         * wasm/modules/constant.wat: Added.
 410         * wasm/modules/default-import-star-error.js: Added.
 411         (then):
 412         * wasm/modules/default-import-star-error/entry.wasm: Added.
 413         * wasm/modules/default-import-star-error/entry.wat: Added.
 414         * wasm/modules/default-import-star-error/t0.js: Added.
 415         * wasm/modules/default-import-star-error/t1.js: Added.
 416         * wasm/modules/default-import-star-error/t2.js: Added.
 417         (export.default.Cocoa):
 418         * wasm/modules/js-wasm-cycle.js: Added.
 419         * wasm/modules/js-wasm-cycle/entry.js: Added.
 420         (from.string_appeared_here.export.return42):
 421         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
 422         * wasm/modules/js-wasm-cycle/sum.wat: Added.
 423         * wasm/modules/js-wasm-function-namespace.js: Added.
 424         (assert.throws):
 425         * wasm/modules/js-wasm-function.js: Added.
 426         (assert.throws):
 427         * wasm/modules/js-wasm-global-namespace.js: Added.
 428         (assert.throws):
 429         * wasm/modules/js-wasm-global.js: Added.
 430         (assert.throws):
 431         * wasm/modules/js-wasm-memory-namespace.js: Added.
 432         (assert.throws):
 433         * wasm/modules/js-wasm-memory.js: Added.
 434         (assert.throws):
 435         * wasm/modules/js-wasm-start.js: Added.
 436         (then):
 437         * wasm/modules/js-wasm-table-namespace.js: Added.
 438         (assert.throws):
 439         * wasm/modules/js-wasm-table.js: Added.
 440         (assert.throws):
 441         * wasm/modules/memory.wasm: Added.
 442         * wasm/modules/memory.wat: Added.
 443         * wasm/modules/run-from-wasm.wasm: Added.
 444         * wasm/modules/run-from-wasm.wat: Added.
 445         * wasm/modules/run-from-wasm/check.js: Added.
 446         (export.check):
 447         * wasm/modules/start.wasm: Added.
 448         * wasm/modules/start.wat: Added.
 449         * wasm/modules/sum.wasm: Added.
 450         * wasm/modules/sum.wat: Added.
 451         * wasm/modules/table.wasm: Added.
 452         * wasm/modules/table.wat: Added.
 453         * wasm/modules/wasm-imports-js-exports.js: Added.
 454         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
 455         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
 456         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
 457         (export.sum):
 458         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
 459         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
 460         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
 461         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
 462         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
 463         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
 464         * wasm/modules/wasm-imports-wasm-exports.js: Added.
 465         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
 466         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
 467         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
 468         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
 469         * wasm/modules/wasm-js-cycle.js: Added.
 470         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
 471         * wasm/modules/wasm-js-cycle/entry.wat: Added.
 472         * wasm/modules/wasm-js-cycle/sum.js: Added.
 473         (from.string_appeared_here.export.sum):
 474         * wasm/modules/wasm-wasm-cycle.js: Added.
 475         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
 476         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
 477         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
 478         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
 479
 480 2018-04-17  Commit Queue  <commit-queue@webkit.org>
 481
 482         Unreviewed, rolling out r230697, r230720, and r230724.
 483         https://bugs.webkit.org/show_bug.cgi?id=184717
 484
 485         These caused multiple failures on the Test262 testers.
 486         (Requested by mlewis13 on #webkit).
 487
 488         Reverted changesets:
 489
 490         "[WebAssembly][Modules] Prototype wasm import"
 491         https://bugs.webkit.org/show_bug.cgi?id=184600
 492         https://trac.webkit.org/changeset/230697
 493
 494         "[WebAssembly][Modules] Implement function import from wasm
 495         modules"
 496         https://bugs.webkit.org/show_bug.cgi?id=184689
 497         https://trac.webkit.org/changeset/230720
 498
 499         "[JSC] Rename runWebAssembly to runWebAssemblySuite"
 500         https://bugs.webkit.org/show_bug.cgi?id=184703
 501         https://trac.webkit.org/changeset/230724
 502
 503 2018-04-17  JF Bastien  <jfbastien@apple.com>
 504
 505         A put is not an ExistingProperty put when we transition a structure because of an attributes change
 506         https://bugs.webkit.org/show_bug.cgi?id=184706
 507         <rdar://problem/38871451>
 508
 509         Reviewed by Saam Barati.
 510
 511         * stress/put-by-id-direct-strict-transition.js: Added.
 512         (const.foo):
 513         (j.const.obj.set hello):
 514         * stress/put-by-id-direct-transition.js: Added.
 515         (const.foo):
 516         (j.const.obj.set hello):
 517         * stress/put-getter-setter-by-id-strict-transition.js: Added.
 518         (const.foo):
 519         (j.const.obj.set hello):
 520         * stress/put-getter-setter-by-id-transition.js: Added.
 521         (const.foo):
 522         (j.const.obj.set hello):
 523
 524 2018-04-16  Filip Pizlo  <fpizlo@apple.com>
 525
 526         PutStackSinkingPhase should know that KillStack means ConflictingFlush
 527         https://bugs.webkit.org/show_bug.cgi?id=184672
 528
 529         Reviewed by Michael Saboff.
 530
 531         * stress/sink-put-stack-over-kill-stack.js: Added.
 532         (avocado_1):
 533         (apricot_0):
 534         (__c_0):
 535         (banana_2):
 536
 537 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
 538
 539         [JSC] Rename runWebAssembly to runWebAssemblySuite
 540         https://bugs.webkit.org/show_bug.cgi?id=184703
 541
 542         Reviewed by JF Bastien.
 543
 544         And add runWebAssembly as a command to simplely run wasm modules.
 545
 546         * wasm.yaml:
 547
 548 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
 549
 550         [WebAssembly][Modules] Implement function import from wasm modules
 551         https://bugs.webkit.org/show_bug.cgi?id=184689
 552
 553         Reviewed by JF Bastien.
 554
 555         * wasm.yaml:
 556         * wasm/modules/js-wasm-cycle.js: Added.
 557         * wasm/modules/js-wasm-cycle/entry.js: Added.
 558         (from.string_appeared_here.export.return42):
 559         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
 560         * wasm/modules/js-wasm-cycle/sum.wat: Added.
 561         * wasm/modules/run-from-wasm.wasm: Added.
 562         * wasm/modules/run-from-wasm.wat: Added.
 563         * wasm/modules/run-from-wasm/check.js: Added.
 564         (export.check):
 565         * wasm/modules/wasm-imports-js-exports.js: Added.
 566         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
 567         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
 568         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
 569         (export.sum):
 570         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
 571         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
 572         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
 573         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
 574         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
 575         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
 576         * wasm/modules/wasm-imports-wasm-exports.js: Added.
 577         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
 578         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
 579         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
 580         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
 581         * wasm/modules/wasm-js-cycle.js: Added.
 582         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
 583         * wasm/modules/wasm-js-cycle/entry.wat: Added.
 584         * wasm/modules/wasm-js-cycle/sum.js: Added.
 585         (from.string_appeared_here.export.sum):
 586         * wasm/modules/wasm-wasm-cycle.js: Added.
 587         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
 588         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
 589         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
 590         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
 591
 592 2018-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>
 593
 594         [WebAssembly][Modules] Prototype wasm import
 595         https://bugs.webkit.org/show_bug.cgi?id=184600
 596
 597         Reviewed by JF Bastien.
 598
 599         Add wasm and wat files since module loader want to load wasm files from FS.
 600         Currently, importing the other modules from wasm is not supported.
 601
 602         * wasm.yaml:
 603         * wasm/modules/constant.wasm: Added.
 604         * wasm/modules/constant.wat: Added.
 605         * wasm/modules/js-wasm-function-namespace.js: Added.
 606         (assert.throws):
 607         * wasm/modules/js-wasm-function.js: Added.
 608         (assert.throws):
 609         * wasm/modules/js-wasm-global-namespace.js: Added.
 610         (assert.throws):
 611         * wasm/modules/js-wasm-global.js: Added.
 612         (assert.throws):
 613         * wasm/modules/js-wasm-memory-namespace.js: Added.
 614         (assert.throws):
 615         * wasm/modules/js-wasm-memory.js: Added.
 616         (assert.throws):
 617         * wasm/modules/js-wasm-start.js: Added.
 618         (then):
 619         * wasm/modules/js-wasm-table-namespace.js: Added.
 620         (assert.throws):
 621         * wasm/modules/js-wasm-table.js: Added.
 622         (assert.throws):
 623         * wasm/modules/memory.wasm: Added.
 624         * wasm/modules/memory.wat: Added.
 625         * wasm/modules/start.wasm: Added.
 626         * wasm/modules/start.wat: Added.
 627         * wasm/modules/sum.wasm: Added.
 628         * wasm/modules/sum.wat: Added.
 629         * wasm/modules/table.wasm: Added.
 630         * wasm/modules/table.wat: Added.
 631
 632 2018-04-14  Filip Pizlo  <fpizlo@apple.com>
 633
 634         Function.prototype.caller shouldn't return generator bodies
 635         https://bugs.webkit.org/show_bug.cgi?id=184630
 636
 637         Reviewed by Yusuke Suzuki.
 638
 639         * stress/function-caller-async-arrow-function-body.js: Added.
 640         * stress/function-caller-async-function-body.js: Added.
 641         * stress/function-caller-async-generator-body.js: Added.
 642         * stress/function-caller-generator-body.js: Added.
 643         * stress/function-caller-generator-method-body.js: Added.
 644
 645 2018-04-12  Tomas Popela  <tpopela@redhat.com>
 646
 647         Unreviewed, skip JIT tests if it isn't enabled
 648
 649         See https://bugs.webkit.org/show_bug.cgi?id=182730.
 650
 651         * stress/big-int-spec-to-primitive.js:
 652         * stress/big-int-spec-to-this.js:
 653
 654 2018-04-10  Caio Lima  <ticaiolima@gmail.com>
 655
 656         [ESNext][BigInt] Add support for BigInt in SpeculatedType
 657         https://bugs.webkit.org/show_bug.cgi?id=182470
 658
 659         Reviewed by Saam Barati.
 660
 661         * stress/big-int-spec-to-primitive.js: Added.
 662         * stress/big-int-spec-to-this.js: Added.
 663         * stress/big-int-strict-equals-jit.js: Added.
 664         * stress/big-int-strict-spec-to-this.js: Added.
 665         * stress/big-int-type-of-proven-type.js: Added.
 666
 667 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
 668
 669         DFG AI and clobberize should agree with each other
 670         https://bugs.webkit.org/show_bug.cgi?id=184440
 671
 672         Reviewed by Saam Barati.
 673
 674         Add tests for all of the bugs I fixed.
 675
 676         * stress/direct-arguments-out-of-bounds-change-structure.js: Added.
 677         (foo):
 678         * stress/new-typed-array-cse-effects.js: Added.
 679         (foo):
 680         * stress/scoped-arguments-out-of-bounds-change-structure.js: Added.
 681         (foo.theO):
 682         (foo):
 683         * stress/string-from-char-code-change-structure-not-dead.js: Added.
 684         (foo):
 685         (i.valueOf):
 686         (weirdValue.valueOf):
 687         * stress/string-from-char-code-change-structure.js: Added.
 688         (foo):
 689         (i.valueOf):
 690         (weirdValue.valueOf):
 691
 692 2018-04-09  Leo Balter  <leonardo.balter@gmail.com>
 693
 694         Fix errant Test262 files CRLF to LF for consistency with the original source
 695         https://bugs.webkit.org/show_bug.cgi?id=184425
 696
 697         Reviewed by Yusuke Suzuki.
 698
 699         * test262/test/built-ins/Math/acosh/nan-returns.js:
 700         * test262/test/built-ins/Math/asinh/asinh-specialVals.js:
 701         * test262/test/built-ins/Math/atanh/atanh-specialVals.js:
 702         * test262/test/built-ins/Math/cbrt/cbrt-specialValues.js:
 703         * test262/test/built-ins/Math/cbrt/prop-desc.js:
 704         * test262/test/built-ins/Math/cosh/cosh-specialVals.js:
 705         * test262/test/built-ins/Math/expm1/expm1-specialVals.js:
 706         * test262/test/built-ins/Math/log10/Log10-specialVals.js:
 707         * test262/test/built-ins/Math/log2/log2-basicTests.js:
 708         * test262/test/built-ins/Math/sign/sign-specialVals.js:
 709         * test262/test/built-ins/Math/sinh/sinh-specialVals.js:
 710         * test262/test/built-ins/Math/tanh/tanh-specialVals.js:
 711         * test262/test/built-ins/Math/trunc/trunc-sampleTests.js:
 712         * test262/test/built-ins/Math/trunc/trunc-specialVals.js:
 713
 714 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 715
 716         Unreviewed, remove incorrect entry in test262.yaml
 717         https://bugs.webkit.org/show_bug.cgi?id=184266
 718
 719         * test262.yaml:
 720
 721 2018-04-08  Valerie Young  <valerie@bocoup.com>
 722
 723         [JSC] Update Test262 to April 6 version
 724         https://bugs.webkit.org/show_bug.cgi?id=184266
 725
 726         Rubber stamped by Yusuke Suzuki.
 727
 728 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
 729
 730         [JSC] Introduce op_get_by_id_direct
 731         https://bugs.webkit.org/show_bug.cgi?id=183970
 732
 733         Reviewed by Filip Pizlo.
 734
 735         * stress/generator-prototype-copy.js: Added.
 736         (gen):
 737         (catch):
 738         Adopted JF's tests.
 739
 740         * stress/generator-type-check.js: Added.
 741         (shouldThrow):
 742         (foo2):
 743         (i.shouldThrow):
 744         * stress/get-by-id-direct-getter.js: Added.
 745         (shouldBe):
 746         (shouldThrow):
 747         (obj.get hello):
 748         (builtin.createBuiltin):
 749         (obj2.get length):
 750         * stress/get-by-id-direct.js: Added.
 751         (shouldBe):
 752         (shouldThrow):
 753         (builtin.createBuiltin):
 754         * test262.yaml:
 755         We fixed long-standing spec compatibility issue.
 756         As a result, this patch makes several test262 tests passed!
 757
 758
 759 2018-04-07  Yusuke Suzuki  <utatane.tea@gmail.com>
 760
 761         Unreviewed, annotate test with @skip if $memoryLimited
 762         https://bugs.webkit.org/show_bug.cgi?id=183894
 763
 764         * stress/json-stringified-overflow.js:
 765
 766 2018-04-06  Alexey Proskuryakov  <ap@apple.com>
 767
 768         Add svn:eol-style to line-terminator-normalisation-CR.js
 769         https://bugs.webkit.org/show_bug.cgi?id=184341
 770
 771         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js: Added property svn:eol-style.
 772
 773 2018-04-06  Ross Kirsling  <ross.kirsling@sony.com>
 774
 775         Unreviewed, remove errant LF from existing test262 test for CR line endings.
 776
 777         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
 778
 779 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
 780
 781         Unreviewed, rolling out r230320.
 782
 783         Revert fix, as the root cause lies elsewhere.
 784
 785         Reverted changeset:
 786
 787         "[test262] Mark line-terminator-normalisation-CR.js as a
 788         binary file."
 789         https://bugs.webkit.org/show_bug.cgi?id=184341
 790         https://trac.webkit.org/changeset/230320
 791
 792 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
 793
 794         [test262] Mark line-terminator-normalisation-CR.js as a binary file.
 795         https://bugs.webkit.org/show_bug.cgi?id=184341
 796
 797         Reviewed by Yusuke Suzuki.
 798
 799         This test is all about CR line endings, but `svn-apply` can't deal with them.
 800         Treating the file as binary ensures that its contents never are never shown in a diff.
 801
 802         * .gitattributes: Added.
 803
 804 2018-04-05  Robin Morisset  <rmorisset@apple.com>
 805
 806         Fix testcase (missing try/catch).
 807         https://bugs.webkit.org/show_bug.cgi?id=183657
 808
 809         Unreviewed.
 810
 811         * stress/large-unshift-splice.js
 812
 813 2018-04-04  Filip Pizlo  <fpizlo@apple.com>
 814
 815         REGRESSION(r222563): removed DoubleReal type check causes tons of crashes because CSE has never known how to handle SaneChain
 816         https://bugs.webkit.org/show_bug.cgi?id=184319
 817
 818         Reviewed by Saam Barati.
 819
 820         * stress/array-push-nan-to-double-array-cse-sane-and-insane-chain.js: Added.
 821         (foo):
 822         (bar):
 823         * stress/array-push-nan-to-double-array.js: Added.
 824         (foo):
 825         (bar):
 826
 827 2018-04-03  Mark Lam  <mark.lam@apple.com>
 828
 829         Test js-fixed-array-out-of-memory.js should be excluded for memory limited devices.
 830         https://bugs.webkit.org/show_bug.cgi?id=184284
 831
 832         Reviewed by Saam Barati.
 833
 834         * stress/js-fixed-array-out-of-memory.js:
 835
 836 2018-03-31  Filip Pizlo  <fpizlo@apple.com>
 837
 838         JSC crash in JIT code with for-of loop and Array/Set iterators
 839         https://bugs.webkit.org/show_bug.cgi?id=183174
 840
 841         Reviewed by Saam Barati.
 842
 843         * microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: Added. This test shows that fixing the bug didn't break hoisting of GetByOffset with inferred types. I confirmed that if I did break it, this test slows down by >7x.
 844         (foo):
 845         * stress/hoist-get-by-offset-with-control-dependent-inferred-type.js: Added. This test shows that the bug is fixed.
 846         (f):
 847
 848 2018-03-30  JF Bastien  <jfbastien@apple.com>
 849
 850         WebAssembly: support DataView compilation
 851         https://bugs.webkit.org/show_bug.cgi?id=183342
 852
 853         Reviewed by Mark Lam.
 854
 855         Test WebAssembly compilation using a DataView with offset.
 856
 857         * wasm/regress/183342.js: Added.
 858         (attempt.catch):
 859
 860 2018-03-30  Filip Pizlo  <fpizlo@apple.com>
 861
 862         Bytecode generator should not get_from_scope something that may be a hole into a variable that is already live
 863         https://bugs.webkit.org/show_bug.cgi?id=184189
 864
 865         Reviewed by JF Bastien.
 866
 867         * stress/load-hole-from-scope-into-live-var.js: Added.
 868         (result.eval.try.switch):
 869         (catch):
 870
 871 2018-03-30  Ryan Haddad  <ryanhaddad@apple.com>
 872
 873         Unreviewed, rolling out r230102.
 874
 875         Caused assertion failures on JSC bots.
 876
 877         Reverted changeset:
 878
 879         "A stack overflow in the parsing of a builtin (called by
 880         createExecutable) cause a crash instead of a catchable js
 881         exception"
 882         https://bugs.webkit.org/show_bug.cgi?id=184074
 883         https://trac.webkit.org/changeset/230102
 884
 885 2018-03-30  Robin Morisset  <rmorisset@apple.com>
 886
 887         Inlining of a function that ends in op_unreachable in a non-tail position triggers an ASSERT
 888         https://bugs.webkit.org/show_bug.cgi?id=183812
 889
 890         Reviewed by Keith Miller.
 891
 892         * stress/inlining-unreachable-non-tail.js: Added.
 893         (foo.):
 894         (foo):
 895
 896 2018-03-30  Robin Morisset  <rmorisset@apple.com>
 897
 898         A stack overflow in the parsing of a builtin (called by createExecutable) cause a crash instead of a catchable js exception
 899         https://bugs.webkit.org/show_bug.cgi?id=184074
 900         <rdar://problem/37165897>
 901
 902         Reviewed by Keith Miller.
 903
 904         * stress/stack-overflow-while-parsing-builtin.js: Added.
 905         (f):
 906
 907 2018-03-30  Robin Morisset  <rmorisset@apple.com>
 908
 909         Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType
 910         https://bugs.webkit.org/show_bug.cgi?id=183657
 911
 912         Reviewed by Keith Miller.
 913
 914         * stress/large-unshift-splice.js: Added.
 915         (make_contig_arr):
 916
 917 2018-03-28  Robin Morisset  <rmorisset@apple.com>
 918
 919         appendQuotedJSONString stops on arithmetic overflow instead of propagating it upwards
 920         https://bugs.webkit.org/show_bug.cgi?id=183894
 921
 922         Reviewed by Saam Barati.
 923
 924         * stress/json-stringified-overflow.js: Added.
 925         (catch):
 926
 927 2018-03-26  Filip Pizlo  <fpizlo@apple.com>
 928
 929         DFG should know that CreateThis can be effectful
 930         https://bugs.webkit.org/show_bug.cgi?id=184013
 931
 932         Reviewed by Saam Barati.
 933
 934         * stress/create-this-property-change.js: Added.
 935         (Foo):
 936         (RealBar):
 937         (get if):
 938         * stress/create-this-structure-change-without-cse.js: Added.
 939         (Foo):
 940         (RealBar):
 941         (get if):
 942         * stress/create-this-structure-change.js: Added.
 943         (Foo):
 944         (RealBar):
 945         (get if):
 946
 947 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
 948
 949         [DFG] Introduces fused compare and jump
 950         https://bugs.webkit.org/show_bug.cgi?id=177100
 951
 952         Reviewed by Mark Lam.
 953
 954         * stress/fused-jeq-slow.js: Added.
 955         (shouldBe):
 956         (testJEQ):
 957         (testJNEQB):
 958         (testJEQB):
 959         (testJNEQF):
 960         (testJEQF):
 961         * stress/fused-jeq.js: Added.
 962         (shouldBe):
 963         (testJEQ):
 964         (testJNEQB):
 965         (testJEQB):
 966         (testJNEQF):
 967         (testJEQF):
 968         * stress/fused-jstricteq-slow.js: Added.
 969         (shouldBe):
 970         (testJSTRICTEQ):
 971         (testJNSTRICTEQB):
 972         (testJSTRICTEQB):
 973         (testJNSTRICTEQF):
 974         (testJSTRICTEQF):
 975         * stress/fused-jstricteq.js: Added.
 976         (shouldBe):
 977         (testJSTRICTEQ):
 978         (testJNSTRICTEQB):
 979         (testJSTRICTEQB):
 980         (testJNSTRICTEQF):
 981         (testJSTRICTEQF):
 982
 983 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
 984
 985         [JSC] Clear MustGenerate for ToString(Number) converted from NumberToStringWithRadix
 986         https://bugs.webkit.org/show_bug.cgi?id=183559
 987
 988         Reviewed by Mark Lam.
 989
 990         * stress/double-to-string-in-loop-removed.js: Added.
 991         (test):
 992         * stress/int32-to-string-in-loop-removed.js: Added.
 993         (test):
 994         * stress/int52-to-string-in-loop-removed.js: Added.
 995         (test):
 996
 997 2018-03-22  Michael Saboff  <msaboff@apple.com>
 998
 999         Race Condition in arrayProtoFuncReverse() causes wrong results or crash
1000         https://bugs.webkit.org/show_bug.cgi?id=183901
1001
1002         Reviewed by Keith Miller.
1003
1004         New test.
1005
1006         * stress/array-reverse-doesnt-clobber.js: Added.
1007         (testArrayReverse):
1008         (createArrayOfArrays):
1009         (createArrayStorage):
1010
1011 2018-03-21  Filip Pizlo  <fpizlo@apple.com>
1012
1013         ScopedArguments should do poisoning and index masking
1014         https://bugs.webkit.org/show_bug.cgi?id=183863
1015
1016         Reviewed by Mark Lam.
1017
1018         Adds another stress test of scoped arguments.
1019
1020         * stress/scoped-arguments-test.js: Added.
1021         (foo):
1022
1023 2018-03-20  Saam Barati  <sbarati@apple.com>
1024
1025         We need to do proper bookkeeping of exitOK when inserting constants when sinking NewArrayBuffer
1026         https://bugs.webkit.org/show_bug.cgi?id=183795
1027         <rdar://problem/38298694>
1028
1029         Reviewed by JF Bastien.
1030
1031         * stress/sink-phantom-new-array-buffer-exit-ok.js: Added.
1032         (foo):
1033         (bar):
1034
1035 2018-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1036
1037         [DFG][FTL] Add vectorLengthHint for NewArray
1038         https://bugs.webkit.org/show_bug.cgi?id=183694
1039
1040         Reviewed by Saam Barati.
1041
1042         * stress/vector-length-hint-array-constructor.js: Added.
1043         (shouldBe):
1044         (test):
1045         * stress/vector-length-hint-new-array.js: Added.
1046         (shouldBe):
1047         (test):
1048
1049 2018-03-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1050
1051         [DFG][FTL] Make ArraySlice(0) code tight
1052         https://bugs.webkit.org/show_bug.cgi?id=183590
1053
1054         Reviewed by Saam Barati.
1055
1056         * stress/array-slice-with-zero.js: Added.
1057         (shouldBe):
1058         (test):
1059         (test2):
1060         * stress/array-slice-zero-args.js: Added.
1061         (shouldBe):
1062         (test):
1063
1064 2018-03-14  Caitlin Potter  <caitp@igalia.com>
1065
1066         [JSC] fix order of evaluation for ClassDefinitionEvaluation
1067         https://bugs.webkit.org/show_bug.cgi?id=183523
1068
1069         Reviewed by Keith Miller.
1070
1071         Computed property names need to be evaluated in source order during class
1072         definition evaluation, as it's observable (and specified to work this way).
1073
1074         This change improves compatibility with Chromium.
1075
1076         * stress/class_elements.js: Added.
1077         (test):
1078         (test.C.prototype.effect):
1079         (test.C.effect):
1080         (test.C.prototype.get effect):
1081         (test.C.prototype.set effect):
1082         (test.C):
1083
1084 2018-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1085
1086         [DFG] AI should convert CreateThis to NewObject if the prototype object is proved
1087         https://bugs.webkit.org/show_bug.cgi?id=183310
1088
1089         Reviewed by Filip Pizlo.
1090
1091         * stress/ai-create-this-to-new-object-fire.js: Added.
1092         (assert):
1093         (test):
1094         (func):
1095         (check):
1096         (test.body.A):
1097         (test.body.B):
1098         (test.body):
1099         * stress/ai-create-this-to-new-object.js: Added.
1100         (assert):
1101         (test):
1102         (func):
1103         (check):
1104         (test.body.A):
1105         (test.body.B):
1106         (test.body):
1107
1108 2018-03-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1109
1110         [FTL] Drop NewRegexp for String.prototype.match with RegExp + global flag
1111         https://bugs.webkit.org/show_bug.cgi?id=181848
1112
1113         Reviewed by Sam Weinig.
1114
1115         * microbenchmarks/regexp-u-global-es5.js: Added.
1116         (fn):
1117         * microbenchmarks/regexp-u-global-es6.js: Added.
1118         (fn):
1119         * stress/materialized-regexp-has-correct-last-index-set-by-match-at-osr-exit.js: Added.
1120         (shouldBe):
1121         (test):
1122         (i.switch):
1123         * stress/materialized-regexp-has-correct-last-index-set-by-match.js: Added.
1124         (shouldBe):
1125         (test):
1126
1127 2018-03-07  Dominik Infuehr  <dinfuehr@igalia.com>
1128
1129         Disable test stress/var-injection-cache-invalidation.js on systems with limited memory
1130         https://bugs.webkit.org/show_bug.cgi?id=183334
1131
1132         Reviewed by Žan Doberšek.
1133
1134         * stress/var-injection-cache-invalidation.js:
1135
1136 2018-03-06  Dominik Infuehr  <dinfuehr@igalia.com>
1137
1138         [ARM] Disable tests that run out of memory
1139         https://bugs.webkit.org/show_bug.cgi?id=182699
1140
1141         Reviewed by Žan Doberšek.
1142
1143         Skip tests that run of of memory. Do not run
1144         modules/module-jit-reachability.js without LLInt to prevent
1145         running out of executable memory.
1146
1147         * modules.yaml:
1148         * modules/module-jit-reachability.js:
1149         * stress/has-own-property-name-cache-string-keys.js:
1150         * stress/has-own-property-name-cache-symbol-keys.js:
1151
1152 2018-03-01  Yusuke Suzuki  <utatane.tea@gmail.com>
1153
1154         ASSERTION FAILED: matchContextualKeyword(m_vm->propertyNames->async)
1155         https://bugs.webkit.org/show_bug.cgi?id=183173
1156
1157         Reviewed by Saam Barati.
1158
1159         * stress/async-arrow-function-in-class-heritage.js: Added.
1160         (testSyntax):
1161         (testSyntaxError):
1162         (SyntaxError):
1163
1164 2018-03-01  Saam Barati  <sbarati@apple.com>
1165
1166         We need to clear cached structures when having a bad time
1167         https://bugs.webkit.org/show_bug.cgi?id=183256
1168         <rdar://problem/36245022>
1169
1170         Reviewed by Mark Lam.
1171
1172         * stress/having-a-bad-time-with-derived-arrays.js: Added.
1173         (assert):
1174         (defineSetter):
1175         (iterate):
1176         (doSlice):
1177
1178 2018-02-28  Yusuke Suzuki  <utatane.tea@gmail.com>
1179
1180         JSC crash with `import("")`
1181         https://bugs.webkit.org/show_bug.cgi?id=183175
1182
1183         Reviewed by Saam Barati.
1184
1185         * stress/import-with-empty-string.js: Added.
1186
1187 2018-02-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1188
1189         Unreviewed, skip FTL tests if FTL is disabled
1190         https://bugs.webkit.org/show_bug.cgi?id=183071
1191
1192         * stress/has-indexed-property-array-storage-ftl.js:
1193         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
1194
1195 2018-02-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1196
1197         [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
1198         https://bugs.webkit.org/show_bug.cgi?id=182965
1199
1200         Reviewed by Saam Barati.
1201
1202         * stress/put-by-val-array-storage.js: Added.
1203         (shouldBe):
1204         (testArrayStorageInBounds):
1205         * stress/put-by-val-direct-out-of-bounds-setter.js: Added.
1206         (shouldBe):
1207         (testInt32.createBuiltin):
1208         (set for):
1209         * stress/put-by-val-slow-put-array-storage.js: Added.
1210         (shouldBe):
1211         (testArrayStorageInBounds):
1212
1213 2018-02-26  Saam Barati  <sbarati@apple.com>
1214
1215         validateStackAccess should not validate if the offset is within the stack bounds
1216         https://bugs.webkit.org/show_bug.cgi?id=183067
1217         <rdar://problem/37749988>
1218
1219         Reviewed by Mark Lam.
1220
1221         * stress/dont-validate-stack-offset-in-b3-because-it-might-be-guarded-by-control-flow.js: Added.
1222         (assert):
1223         (test.a):
1224         (test.b):
1225         (test):
1226
1227 2018-02-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1228
1229         Unreviewed, skip FTL tests if FTL is disabled
1230         https://bugs.webkit.org/show_bug.cgi?id=183071
1231
1232         * stress/has-indexed-property-array-storage-ftl.js:
1233         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
1234
1235 2018-02-23  Saam Barati  <sbarati@apple.com>
1236
1237         Make Number.isInteger an intrinsic
1238         https://bugs.webkit.org/show_bug.cgi?id=183088
1239
1240         Reviewed by JF Bastien.
1241
1242         * stress/number-is-integer-intrinsic.js: Added.
1243
1244 2018-02-23  Oleksandr Skachkov  <gskachkov@gmail.com>
1245
1246         WebAssembly: cache memory address / size on instance
1247         https://bugs.webkit.org/show_bug.cgi?id=177305
1248
1249         Reviewed by JF Bastien.
1250
1251         * wasm/function-tests/memory-reuse.js: Added.
1252         (createWasmInstance):
1253         (doCheckTrap):
1254         (doMemoryGrow):
1255         (doCheck):
1256         (checkWasmInstancesWithSharedMemory):
1257
1258 2018-02-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1259
1260         [JSC] Implement $vm.ftlTrue function for FTL testing
1261         https://bugs.webkit.org/show_bug.cgi?id=183071
1262
1263         Reviewed by Mark Lam.
1264
1265         * stress/dead-fiat-value-to-int52-then-exit-not-double.js:
1266         (foo):
1267         * stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
1268         (foo):
1269         * stress/dead-fiat-value-to-int52.js:
1270         (foo):
1271         * stress/dead-osr-entry-value.js:
1272         (foo):
1273         * stress/fiat-value-to-int52-then-exit-not-double.js:
1274         (foo):
1275         * stress/fiat-value-to-int52-then-exit-not-int52.js:
1276         (foo):
1277         * stress/fiat-value-to-int52-then-fail-to-fold.js:
1278         (foo):
1279         * stress/fiat-value-to-int52-then-fold.js:
1280         (foo):
1281         * stress/fiat-value-to-int52.js:
1282         (foo):
1283         * stress/fold-based-on-int32-proof-mul-branch.js:
1284         (foo):
1285         * stress/fold-profiled-call-to-call.js:
1286         (foo):
1287         * stress/fold-to-double-constant-then-exit.js:
1288         (foo):
1289         * stress/fold-to-int52-constant-then-exit.js:
1290         (foo):
1291         * stress/fold-to-primitive-in-cfa.js:
1292         (foo):
1293         * stress/fold-to-primitive-to-identity-in-cfa.js:
1294         (foo):
1295         * stress/has-indexed-property-array-storage-ftl.js: Added.
1296         (shouldBe):
1297         (test1):
1298         (test2):
1299         * stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
1300         (shouldBe):
1301         (test1):
1302         (test2):
1303         * stress/int52-ai-add-then-filter-int32.js:
1304         (foo):
1305         * stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
1306         (foo):
1307         * stress/int52-ai-mul-then-filter-int32.js:
1308         (foo):
1309         * stress/int52-ai-neg-then-filter-int32.js:
1310         (foo):
1311         * stress/int52-ai-sub-then-filter-int32.js:
1312         (foo):
1313         * stress/licm-pre-header-cannot-exit-nested.js:
1314         (foo):
1315         * stress/licm-pre-header-cannot-exit.js:
1316         (foo):
1317         * stress/sparse-array-entry-update-144067.js:
1318         (useMemoryToTriggerGCs):
1319         * stress/test-spec-misc.js:
1320         (foo):
1321         * stress/tricky-array-bounds-checks.js:
1322         (foo):
1323
1324 2018-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1325
1326         [FTL] Support HasIndexedProperty for ArrayStorage and SlowPutArrayStorage
1327         https://bugs.webkit.org/show_bug.cgi?id=182792
1328
1329         Reviewed by Mark Lam.
1330
1331         * stress/has-indexed-property-array-storage.js: Added.
1332         (shouldBe):
1333         (test1):
1334         (test2):
1335         * stress/has-indexed-property-slow-put-array-storage.js: Added.
1336         (shouldBe):
1337         (test1):
1338         (test2):
1339
1340 2018-02-20  Saam Barati  <sbarati@apple.com>
1341
1342         DFG::VarargsForwardingPhase should eliminate getting argument length
1343         https://bugs.webkit.org/show_bug.cgi?id=182959
1344
1345         Reviewed by Keith Miller.
1346
1347         * microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js: Added.
1348
1349 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1350
1351         [FTL] Support ArrayPush for ArrayStorage
1352         https://bugs.webkit.org/show_bug.cgi?id=182782
1353
1354         Reviewed by Saam Barati.
1355
1356         Existing array-push-multiple-storage.js covers ArrayPush(ArrayStorage) multiple arguments case.
1357
1358         * stress/array-push-array-storage-beyond-int32.js: Added.
1359         (shouldBe):
1360         (test):
1361         * stress/array-push-array-storage.js: Added.
1362         (shouldBe):
1363         (test):
1364         * stress/array-push-multiple-array-storage-beyond-int32.js: Added.
1365         (shouldBe):
1366         (test):
1367         * stress/array-push-multiple-storage-continuous.js: Added.
1368         (shouldBe):
1369         (test):
1370
1371 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1372
1373         [FTL] Support ArrayPop for ArrayStorage
1374         https://bugs.webkit.org/show_bug.cgi?id=182783
1375
1376         Reviewed by Saam Barati.
1377
1378         * stress/array-pop-array-storage.js: Added.
1379         (shouldBe):
1380         (test):
1381
1382 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
1383
1384         [FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
1385         https://bugs.webkit.org/show_bug.cgi?id=182731
1386
1387         Reviewed by Saam Barati.
1388
1389         * stress/arrayify-array-storage-array.js: Added.
1390         (shouldBe):
1391         (testArrayStorage):
1392         * stress/arrayify-array-storage-non-array.js: Added.
1393         (shouldBe):
1394         (testArrayStorage):
1395         * stress/arrayify-array-storage.js: Added.
1396         (shouldBe):
1397         (testArrayStorage):
1398         * stress/arrayify-slow-put-array-storage-pass-array-storage.js: Added.
1399         (shouldBe):
1400         (testArrayStorage):
1401         * stress/arrayify-slow-put-array-storage.js: Added.
1402         (shouldBe):
1403         (testArrayStorage):
1404
1405 2018-02-19  Saam Barati  <sbarati@apple.com>
1406
1407         Don't use JSFunction's allocation profile when getting the prototype can be effectful
1408         https://bugs.webkit.org/show_bug.cgi?id=182942
1409         <rdar://problem/37584764>
1410
1411         Reviewed by Mark Lam.
1412
1413         * stress/get-prototype-create-this-effectful.js: Added.
1414
1415 2018-02-16  Saam Barati  <sbarati@apple.com>
1416
1417         Fix bugs from r228411
1418         https://bugs.webkit.org/show_bug.cgi?id=182851
1419         <rdar://problem/37577732>
1420
1421         Reviewed by JF Bastien.
1422
1423         * stress/constant-folding-phase-insert-check-handle-varargs.js: Added.
1424
1425 2018-02-15  Filip Pizlo  <fpizlo@apple.com>
1426
1427         Unreviewed, roll out r228366 since it did not progress anything.
1428
1429         * stress/gc-error-stack.js: Removed.
1430         * stress/no-gc-error-stack.js: Removed.
1431
1432 2018-02-15  Tomas Popela  <tpopela@redhat.com>
1433
1434         Many stress tests fail with JIT disabled
1435         https://bugs.webkit.org/show_bug.cgi?id=182730
1436
1437         Reviewed by Saam Barati.
1438
1439         These tests are broken by design if the JIT is disabled - they test
1440         the return value of numberOfDFGCompiles(), which is always set to
1441         1000000.0 in TestRunnerUtils.cpp and makes the tests to fail.
1442
1443         * stress/arith-abs-on-various-types.js:
1444         * stress/arith-abs-to-arith-negate-range-optimizaton.js:
1445         * stress/arith-acos-on-various-types.js:
1446         * stress/arith-acosh-on-various-types.js:
1447         * stress/arith-asin-on-various-types.js:
1448         * stress/arith-asinh-on-various-types.js:
1449         * stress/arith-atan-on-various-types.js:
1450         * stress/arith-atanh-on-various-types.js:
1451         * stress/arith-cbrt-on-various-types.js:
1452         * stress/arith-ceil-on-various-types.js:
1453         * stress/arith-clz32-on-various-types.js:
1454         * stress/arith-cos-on-various-types.js:
1455         * stress/arith-cosh-on-various-types.js:
1456         * stress/arith-expm1-on-various-types.js:
1457         * stress/arith-floor-on-various-types.js:
1458         * stress/arith-fround-on-various-types.js:
1459         * stress/arith-log-on-various-types.js:
1460         * stress/arith-log10-on-various-types.js:
1461         * stress/arith-log2-on-various-types.js:
1462         * stress/arith-negate-on-various-types.js:
1463         * stress/arith-round-on-various-types.js:
1464         * stress/arith-sin-on-various-types.js:
1465         * stress/arith-sinh-on-various-types.js:
1466         * stress/arith-sqrt-on-various-types.js:
1467         * stress/arith-tan-on-various-types.js:
1468         * stress/arith-tanh-on-various-types.js:
1469         * stress/arith-trunc-on-various-types.js:
1470         * stress/compare-strict-eq-on-various-types.js:
1471
1472 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
1473
1474         Skip stress/new-largeish-contiguous-array-with-size.js on arm.
1475
1476         Unreviewed test gardening.
1477
1478         * stress/new-largeish-contiguous-array-with-size.js:
1479
1480 2018-02-14  Saam Barati  <sbarati@apple.com>
1481
1482         Setting a VMTrap shouldn't look at topCallFrame since that may imply we're in C code and holding the malloc lock
1483         https://bugs.webkit.org/show_bug.cgi?id=182801
1484
1485         Reviewed by Keith Miller.
1486
1487         * stress/watchdog-dont-malloc-when-in-c-code.js: Added.
1488
1489 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
1490
1491         Skip JSC test stress/activation-sink-default-value-tdz-error.js on debug.
1492         https://bugs.webkit.org/show_bug.cgi?id=182526
1493
1494         Unreviewed test gardening.
1495
1496         * stress/activation-sink-default-value-tdz-error.js:
1497
1498 2018-02-13  Saam Barati  <sbarati@apple.com>
1499
1500         putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
1501         https://bugs.webkit.org/show_bug.cgi?id=182755
1502         <rdar://problem/37080864>
1503
1504         Reviewed by Keith Miller.
1505
1506         * stress/always-enter-dictionary-indexing-mode-with-getter.js: Added.
1507         (test1.o.get 10005):
1508         (test1):
1509         (test2.o.get 1000):
1510         (test2):
1511
1512 2018-02-13  Caitlin Potter  <caitp@igalia.com>
1513
1514         [JSC] cache TaggedTemplate arrays by callsite rather than by contents
1515         https://bugs.webkit.org/show_bug.cgi?id=182717
1516
1517         Reviewed by Yusuke Suzuki.
1518
1519         https://github.com/tc39/ecma262/pull/890 imposes a change to template
1520         literals, to allow template callsite arrays to be collected when the
1521         code containing the tagged template call is collected. This spec change
1522         has received concensus and been ratified.
1523
1524         This change eliminates the eternal map associating template contents
1525         with arrays.
1526
1527         * stress/tagged-template-object-collect.js: Renamed from JSTests/stress/tagged-template-registry-key-collect.js.
1528         * stress/tagged-template-object.js: Renamed from JSTests/stress/tagged-template-registry-key.js.
1529         * stress/tagged-templates-identity.js:
1530         * stress/template-string-tags-eval.js:
1531         * test262.yaml:
1532
1533 2018-02-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1534
1535         Support GetArrayLength on ArrayStorage in the FTL
1536         https://bugs.webkit.org/show_bug.cgi?id=182625
1537
1538         Reviewed by Saam Barati.
1539
1540         * stress/array-storage-length.js: Added.
1541         (shouldBe):
1542         (testInBound):
1543         (testUncountable):
1544         (testSlowPutInBound):
1545         (testSlowPutUncountable):
1546         * stress/undecided-length.js: Added.
1547         (shouldBe):
1548         (test2):
1549
1550 2018-02-12  Saam Barati  <sbarati@apple.com>
1551
1552         DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
1553         https://bugs.webkit.org/show_bug.cgi?id=182706
1554         <rdar://problem/36833681>
1555
1556         Reviewed by Filip Pizlo.
1557
1558         * stress/get-array-length-phantom-new-array-buffer.js: Added.
1559         (effects):
1560         (foo):
1561
1562 2018-02-09  Filip Pizlo  <fpizlo@apple.com>
1563
1564         Don't waste memory for error.stack
1565         https://bugs.webkit.org/show_bug.cgi?id=182656
1566
1567         Reviewed by Saam Barati.
1568
1569         Tests the policy.
1570
1571         * stress/gc-error-stack.js: Added. Shows that the GC forgets frames now.
1572         * stress/no-gc-error-stack.js: Added. Shows that the GC won't forget things if you ask for the stack.
1573
1574 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1575
1576         [JSC] Update Test262 to Feb 9 version
1577         https://bugs.webkit.org/show_bug.cgi?id=182468
1578
1579         Reviewed by Saam Barati.
1580
1581 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1582
1583         Unreviewed, fix invalid line terminator in old test262 file part 2
1584         https://bugs.webkit.org/show_bug.cgi?id=182468
1585
1586         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1587
1588 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1589
1590         Unreviewed, fix invalid line terminator in old test262 file
1591         https://bugs.webkit.org/show_bug.cgi?id=182468
1592
1593         * test262/test/language/literals/regexp/7.8.5-1.js:
1594
1595 2018-02-06  Yusuke Suzuki  <utatane.tea@gmail.com>
1596
1597         [JSC] Implement Array.prototype.flatMap and Array.prototype.flatten
1598         https://bugs.webkit.org/show_bug.cgi?id=182440
1599
1600         Reviewed by Darin Adler.
1601
1602         * stress/array-flatmap.js: Added.
1603         (shouldBe):
1604         (shouldBeArray):
1605         (shouldThrow):
1606         (var):
1607         * stress/array-flatten.js: Added.
1608         (shouldBe):
1609         (shouldBeArray):
1610         * test262.yaml:
1611         * test262/test/built-ins/Array/prototype/flatMap/depth-always-one.js:
1612         (3.flatMap):
1613         Pick test262 82c6148980332febe92a544a1fb653718e9fdb57 change.
1614
1615 2018-02-06  Keith Miller  <keith_miller@apple.com>
1616
1617         put_to_scope/get_from_scope should not cache lexical scopes when expecting a global object
1618         https://bugs.webkit.org/show_bug.cgi?id=182549
1619         <rdar://problem/36189995>
1620
1621         Reviewed by Saam Barati.
1622
1623         * stress/var-injection-cache-invalidation.js: Added.
1624         (allocateLotsOfThings):
1625         (test):
1626
1627 2018-02-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1628
1629         Unreviewed, follow up for test262 update
1630         https://bugs.webkit.org/show_bug.cgi?id=182288
1631
1632         * test262.yaml:
1633
1634 2018-02-02  Ryan Haddad  <ryanhaddad@apple.com>
1635
1636         Update test262 to Jan 30 version
1637         https://bugs.webkit.org/show_bug.cgi?id=182288
1638
1639         Unreviewed test gardening.
1640
1641         * test262.yaml: Remove entry for missing test language/expressions/assignment/white-space.js
1642
1643 2018-02-02  Saam Barati  <sbarati@apple.com>
1644
1645         When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
1646         https://bugs.webkit.org/show_bug.cgi?id=182368
1647         <rdar://problem/36932466>
1648
1649         Reviewed by Mark Lam.
1650
1651         * stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js: Added.
1652         (runNearStackLimit.t):
1653         (runNearStackLimit):
1654         (try.runNearStackLimit):
1655         (catch):
1656
1657 2018-02-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1658
1659         Update test262 to Jan 30 version
1660         https://bugs.webkit.org/show_bug.cgi?id=182288
1661
1662         Rubber stamped by Saam Barati.
1663
1664         This patch updates test262 to the latest one, Jan 30 version.
1665         Since added and changed files are too many, we cannot create ChangeLog.
1666         The following files are changed.
1667
1668         Several files are intentionally omitted due to merge failures. We should investigate how to merge files
1669         including some special line terminators (like u2028, u2029).
1670
1671         * test262.yaml:
1672         * test262/test262-Revision.txt:
1673         * test262/*:
1674
1675 2018-02-02  Guillaume Emont  <guijemont@igalia.com>
1676
1677         JSTests: Skip mozilla/js1_5/Array/regress-157652.js on all memory limited platforms
1678         https://bugs.webkit.org/show_bug.cgi?id=182411
1679
1680         Reviewed by Carlos Alberto Lopez Perez.
1681
1682         This is skipped only on arm memory limited platforms. Until recently
1683         it was not a problem on MIPS as the butterfly was not initialized. But
1684         since r227435, the butterfly is initialized in that test and therefore
1685         memory is allocated, and the test typically takes around 512M, which
1686         means it generally gets OOM-killed on the MIPS buildbot.
1687
1688         * mozilla/mozilla-tests.yaml:
1689
1690 2018-02-01  Mark Lam  <mark.lam@apple.com>
1691
1692         Fix broken bounds check in FTL's compileGetMyArgumentByVal().
1693         https://bugs.webkit.org/show_bug.cgi?id=182419
1694         <rdar://problem/37044945>
1695
1696         Reviewed by Saam Barati.
1697
1698         * stress/regress-182419.js: Added.
1699
1700 2018-02-01  Keith Miller  <keith_miller@apple.com>
1701
1702         Fix crashes due to mishandling custom sections.
1703         https://bugs.webkit.org/show_bug.cgi?id=182404
1704         <rdar://problem/36935863>
1705
1706         Reviewed by Saam Barati.
1707
1708         * wasm/Builder.js:
1709         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
1710         * wasm/js-api/validate.js:
1711         (assert.truthy):
1712
1713 2018-01-31  Saam Barati  <sbarati@apple.com>
1714
1715         JSC incorrectly interpreting script, sets Global Property instead of Global Lexical variable (LiteralParser / JSONP path)
1716         https://bugs.webkit.org/show_bug.cgi?id=182074
1717         <rdar://problem/36846261>
1718
1719         Reviewed by Mark Lam.
1720
1721         * stress/jsonp-program-evaluate-path-must-consider-global-lexical-environment.js: Added.
1722         (assert):
1723         (let.func):
1724         (let.o.foo):
1725         (varFunc):
1726
1727 2018-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1728
1729         Unreviewed, update test262 expects
1730         https://bugs.webkit.org/show_bug.cgi?id=182232
1731
1732         * test262.yaml:
1733
1734 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1735
1736         [JSC] Implement trimStart and trimEnd
1737         https://bugs.webkit.org/show_bug.cgi?id=182233
1738
1739         Reviewed by Mark Lam.
1740
1741         * stress/trim.js: Added.
1742         (shouldBe):
1743         (startTest):
1744         (endTest):
1745         (trimTest):
1746
1747 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1748
1749         [JSC] Relax line terminators in String to make JSON subset of JS
1750         https://bugs.webkit.org/show_bug.cgi?id=182232
1751
1752         Reviewed by Keith Miller.
1753
1754         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
1755         * stress/relaxed-line-terminators-in-string.js: Added.
1756         (shouldBe):
1757
1758 2018-01-29  Michael Saboff  <msaboff@apple.com>
1759
1760         REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
1761         https://bugs.webkit.org/show_bug.cgi?id=182249
1762
1763         Reviewed by Keith Miller.
1764
1765         New regression test.
1766
1767         * stress/compare-clobber-untypeduse.js: Added.
1768
1769 2018-01-29  Matt Lewis  <jlewis3@apple.com>
1770
1771         Unreviewed, rolling out r227725.
1772
1773         This caused internal failures.
1774
1775         Reverted changeset:
1776
1777         "JSC Sampling Profiler: Detect tester and testee when sampling
1778         in RegExp JIT"
1779         https://bugs.webkit.org/show_bug.cgi?id=152729
1780         https://trac.webkit.org/changeset/227725
1781
1782 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1783
1784         JSC Sampling Profiler: Detect tester and testee when sampling in RegExp JIT
1785         https://bugs.webkit.org/show_bug.cgi?id=152729
1786
1787         Reviewed by Saam Barati.
1788
1789         * stress/sampling-profiler-regexp.js: Added.
1790         (platformSupportsSamplingProfiler.test):
1791         (platformSupportsSamplingProfiler.baz):
1792         (platformSupportsSamplingProfiler):
1793
1794 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1795
1796         [DFG][FTL] WeakMap#set should have DFG node
1797         https://bugs.webkit.org/show_bug.cgi?id=180015
1798
1799         Reviewed by Saam Barati.
1800
1801         * stress/weakmap-set-change-get.js: Added.
1802         (shouldBe):
1803         (test):
1804         * stress/weakmap-set-cse.js: Added.
1805         (shouldBe):
1806         (test):
1807         * stress/weakset-add-change-get.js: Added.
1808         (shouldBe):
1809         * stress/weakset-add-cse.js: Added.
1810         (shouldBe):
1811
1812 2018-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1813
1814         DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
1815         https://bugs.webkit.org/show_bug.cgi?id=182213
1816
1817         Reviewed by Mark Lam.
1818
1819         * stress/int32-min-to-string.js: Added.
1820         (shouldBe):
1821         (test2):
1822         (test4):
1823         (test8):
1824         (test16):
1825         (test32):
1826         * stress/zero-to-string.js: Added.
1827         (shouldBe):
1828         (test2):
1829         (test4):
1830         (test8):
1831         (test16):
1832         (test32):
1833
1834 2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>
1835
1836         Add more module scope related tests with code evaluation by string
1837         https://bugs.webkit.org/show_bug.cgi?id=181983
1838
1839         Reviewed by Sam Weinig.
1840
1841         Add more module scope related tests. When the original tests are landed,
1842         we do not have browser integration. This patch adds more module scope tests
1843         with dynamically created script evaluation. We add tests with Function
1844         constructor, direct eval, indirect eval, setTimeout, setInterval, and event handlers.
1845
1846         * modules/scopes-eval.js: Added.
1847         (shouldBe):
1848         * modules/scopes.js:
1849         (shouldBe):
1850
1851 2018-01-23  Filip Pizlo  <fpizlo@apple.com>
1852
1853         Unreviewed, retire some microbenchmarks that are proportionately very slow. Benchmark running time should be proportional to their value. Microbenchmarks have little value, so they should be very fast.
1854
1855         * microbenchmarks/array-push-3.js: Removed.
1856         * microbenchmarks/bigswitch-indirect-symbol-or-undefined.js: Removed.
1857         * microbenchmarks/double-to-int32.js: Removed.
1858         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Removed.
1859         * microbenchmarks/ftl-polymorphic-bitand.js: Removed.
1860         * microbenchmarks/ftl-polymorphic-bitor.js: Removed.
1861         * microbenchmarks/ftl-polymorphic-bitxor.js: Removed.
1862         * microbenchmarks/ftl-polymorphic-lshift.js: Removed.
1863         * microbenchmarks/ftl-polymorphic-rshift.js: Removed.
1864         * microbenchmarks/ftl-polymorphic-sub.js: Removed.
1865         * microbenchmarks/ftl-polymorphic-urshift.js: Removed.
1866         * microbenchmarks/map-constant-key.js: Removed.
1867         * microbenchmarks/nested-function-parsing.js: Removed.
1868         * microbenchmarks/rest-parameter-allocation-elimination.js: Removed.
1869         * microbenchmarks/spread-large-array.js: Removed.
1870         * microbenchmarks/string-add-constant-folding.js: Removed.
1871         * microbenchmarks/to-lower-case.js: Removed.
1872         * microbenchmarks/undefined-property-access.js: Removed.
1873         * slowMicrobenchmarks/array-push-3.js: Copied from JSTests/microbenchmarks/array-push-3.js.
1874         * slowMicrobenchmarks/bigswitch-indirect-symbol-or-undefined.js: Copied from JSTests/microbenchmarks/bigswitch-indirect-symbol-or-undefined.js.
1875         * slowMicrobenchmarks/double-to-int32.js: Copied from JSTests/microbenchmarks/double-to-int32.js.
1876         * slowMicrobenchmarks/fake-iterators-that-throw-when-finished.js: Copied from JSTests/microbenchmarks/fake-iterators-that-throw-when-finished.js.
1877         * slowMicrobenchmarks/ftl-polymorphic-bitand.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitand.js.
1878         * slowMicrobenchmarks/ftl-polymorphic-bitor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitor.js.
1879         * slowMicrobenchmarks/ftl-polymorphic-bitxor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitxor.js.
1880         * slowMicrobenchmarks/ftl-polymorphic-lshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-lshift.js.
1881         * slowMicrobenchmarks/ftl-polymorphic-rshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-rshift.js.
1882         * slowMicrobenchmarks/ftl-polymorphic-sub.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-sub.js.
1883         * slowMicrobenchmarks/ftl-polymorphic-urshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-urshift.js.
1884         * slowMicrobenchmarks/map-constant-key.js: Copied from JSTests/microbenchmarks/map-constant-key.js.
1885         * slowMicrobenchmarks/nested-function-parsing.js: Copied from JSTests/microbenchmarks/nested-function-parsing.js.
1886         * slowMicrobenchmarks/rest-parameter-allocation-elimination.js: Copied from JSTests/microbenchmarks/rest-parameter-allocation-elimination.js.
1887         * slowMicrobenchmarks/spread-large-array.js: Copied from JSTests/microbenchmarks/spread-large-array.js.
1888         * slowMicrobenchmarks/string-add-constant-folding.js: Copied from JSTests/microbenchmarks/string-add-constant-folding.js.
1889         * slowMicrobenchmarks/to-lower-case.js: Copied from JSTests/microbenchmarks/to-lower-case.js.
1890         * slowMicrobenchmarks/undefined-property-access.js: Copied from JSTests/microbenchmarks/undefined-property-access.js.
1891
1892 2018-01-23  Robin Morisset  <rmorisset@apple.com>
1893
1894         Update the argument count in DFGByteCodeParser::handleRecursiveCall
1895         https://bugs.webkit.org/show_bug.cgi?id=181739
1896         <rdar://problem/36627662>
1897
1898         Reviewed by Saam Barati.
1899
1900         * stress/recursive-tail-call-with-different-argument-count.js: Added.
1901         (foo):
1902         (bar):
1903
1904 2018-01-22  Michael Saboff  <msaboff@apple.com>
1905
1906         DFG abstract interpreter needs to properly model effects of some Math ops
1907         https://bugs.webkit.org/show_bug.cgi?id=181886
1908
1909         Reviewed by Saam Barati.
1910
1911         New regression test.
1912
1913         * stress/arith-nodes-abstract-interpreter-untypeduse.js: Added.
1914         (test):
1915
1916 2018-01-20  Caio Lima  <ticaiolima@gmail.com>
1917
1918         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
1919         https://bugs.webkit.org/show_bug.cgi?id=181182
1920
1921         Reviewed by Darin Adler.
1922
1923         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
1924         * stress/big-int-prototype-to-string-exception.js: Added.
1925         * stress/big-int-prototype-to-string-wrong-values.js: Added.
1926         * stress/number-prototype-to-string-cast-overflow.js: Added.
1927         * stress/number-prototype-to-string-exception.js: Added.
1928         * stress/number-prototype-to-string-wrong-values.js: Added.
1929
1930 2018-01-19  Ryan Haddad  <ryanhaddad@apple.com>
1931
1932         Disable Atomics when SharedArrayBuffer isn’t enabled
1933         https://bugs.webkit.org/show_bug.cgi?id=181572
1934
1935         Unreviewed test gardening.
1936
1937         * test262.yaml: Skip tests that fail after this change.
1938
1939 2018-01-19  Saam Barati  <sbarati@apple.com>
1940
1941         Kill ArithNegate's ArithProfile assert inside BytecodeParser
1942         https://bugs.webkit.org/show_bug.cgi?id=181877
1943         <rdar://problem/36630552>
1944
1945         Reviewed by Mark Lam.
1946
1947         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js: Added.
1948         (runNearStackLimit):
1949         (f1):
1950         (f2):
1951         (f3):
1952         (i.catch):
1953         (i.try.runNearStackLimit):
1954         (catch):
1955
1956 2018-01-19  Saam Barati  <sbarati@apple.com>
1957
1958         Spread's effects are modeled incorrectly both in AI and in Clobberize
1959         https://bugs.webkit.org/show_bug.cgi?id=181867
1960         <rdar://problem/36290415>
1961
1962         Reviewed by Michael Saboff.
1963
1964         * stress/ai-needs-to-model-spreads-effects.js: Added.
1965         (try.p.Symbol.iterator):
1966         (try.go):
1967         (catch):
1968         * stress/clobberize-needs-to-model-spread-effects.js: Added.
1969         (assert):
1970         (foo):
1971         (a.Symbol.iterator):
1972
1973 2018-01-19  Yusuke Suzuki  <utatane.tea@gmail.com>
1974
1975         Unreviewed, reduce count of iteration to fix timing out debug JSC test
1976         https://bugs.webkit.org/show_bug.cgi?id=181535
1977
1978         * stress/inserted-recovery-with-set-last-index.js:
1979
1980 2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1981
1982         [DFG][FTL] Introduce PhantomNewRegexp and RegExpExecNonGlobalOrSticky
1983         https://bugs.webkit.org/show_bug.cgi?id=181535
1984
1985         Reviewed by Saam Barati.
1986
1987         * stress/inserted-recovery-with-set-last-index.js: Added.
1988         (shouldBe):
1989         (foo):
1990         * stress/materialize-regexp-at-osr-exit.js: Added.
1991         (shouldBe):
1992         (test):
1993         * stress/materialize-regexp-cyclic-regexp-at-osr-exit.js: Added.
1994         (shouldBe):
1995         (test):
1996         * stress/materialize-regexp-cyclic-regexp.js: Added.
1997         (shouldBe):
1998         (test):
1999         (i.switch):
2000         * stress/materialize-regexp-cyclic.js: Added.
2001         (shouldBe):
2002         (test):
2003         (i.switch):
2004         * stress/materialize-regexp-referenced-from-phantom-regexp-cyclic.js: Added.
2005         (bar):
2006         (foo):
2007         (test):
2008         * stress/materialize-regexp-referenced-from-phantom-regexp.js: Added.
2009         (bar):
2010         (foo):
2011         (test):
2012         * stress/materialize-regexp.js: Added.
2013         (shouldBe):
2014         (test):
2015         * stress/phantom-regexp-regexp-exec.js: Added.
2016         (shouldBe):
2017         (test):
2018         * stress/phantom-regexp-string-match.js: Added.
2019         (shouldBe):
2020         (test):
2021         * stress/regexp-last-index-sinking.js: Added.
2022         (shouldBe):
2023         (test):
2024
2025 2018-01-17  Saam Barati  <sbarati@apple.com>
2026
2027         Disable Atomics when SharedArrayBuffer isn’t enabled
2028         https://bugs.webkit.org/show_bug.cgi?id=181572
2029         <rdar://problem/36553206>
2030
2031         Reviewed by Michael Saboff.
2032
2033         * stress/isLockFree.js:
2034
2035 2018-01-17  Saam Barati  <sbarati@apple.com>
2036
2037         DFG::Node::convertToConstant needs to clear the varargs flags
2038         https://bugs.webkit.org/show_bug.cgi?id=181697
2039         <rdar://problem/36497332>
2040
2041         Reviewed by Yusuke Suzuki.
2042
2043         * stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
2044         (doIndexOf):
2045         (bar):
2046         (i.bar):
2047
2048 2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>
2049
2050         Unreviewed, rolling out r226937.
2051
2052         Tests added with this change are failing due to a missing
2053         exception check.
2054
2055         Reverted changeset:
2056
2057         "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
2058         double to int32_t"
2059         https://bugs.webkit.org/show_bug.cgi?id=181182
2060         https://trac.webkit.org/changeset/226937
2061
2062 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
2063
2064         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
2065         https://bugs.webkit.org/show_bug.cgi?id=181182
2066
2067         Reviewed by Darin Adler.
2068
2069         * bigIntTests.yaml:
2070         * stress/big-int-constructor.js:
2071         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
2072         (assert):
2073         (assertThrowRangeError):
2074         * stress/number-prototype-to-string-cast-overflow.js: Added.
2075         (assert):
2076         (assertThrowRangeError):
2077
2078 2018-01-12  Saam Barati  <sbarati@apple.com>
2079
2080         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
2081         https://bugs.webkit.org/show_bug.cgi?id=181177
2082         <rdar://problem/36205704>
2083
2084         Reviewed by Yusuke Suzuki.
2085
2086         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
2087         (runNearStackLimit.t):
2088         (runNearStackLimit):
2089         (test.f):
2090         (test):
2091
2092 2018-01-12  Saam Barati  <sbarati@apple.com>
2093
2094         Each variant of a polymorphic inlined call should be exitOK at the top of the block
2095         https://bugs.webkit.org/show_bug.cgi?id=181562
2096         <rdar://problem/36445624>
2097
2098         Reviewed by Yusuke Suzuki.
2099
2100         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
2101         (f):
2102         (foo):
2103
2104 2018-01-11  Saam Barati  <sbarati@apple.com>
2105
2106         When inserting Unreachable in byte code parser we need to flush all the right things
2107         https://bugs.webkit.org/show_bug.cgi?id=181509
2108         <rdar://problem/36423110>
2109
2110         Reviewed by Mark Lam.
2111
2112         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
2113
2114 2018-01-11  Saam Barati  <sbarati@apple.com>
2115
2116         JITMathIC code in the FTL is wrong when code gets duplicated
2117         https://bugs.webkit.org/show_bug.cgi?id=181525
2118         <rdar://problem/36351993>
2119
2120         Reviewed by Michael Saboff and Keith Miller.
2121
2122         * stress/allow-math-ic-b3-code-duplication.js: Added.
2123
2124 2018-01-11  Saam Barati  <sbarati@apple.com>
2125
2126         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
2127         https://bugs.webkit.org/show_bug.cgi?id=181508
2128
2129         Reviewed by Yusuke Suzuki.
2130
2131         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
2132         (assert):
2133         (test1.foo):
2134         (test1):
2135         (test2.foo):
2136         (test2):
2137
2138 2018-01-09  Mark Lam  <mark.lam@apple.com>
2139
2140         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
2141         https://bugs.webkit.org/show_bug.cgi?id=181388
2142         <rdar://problem/36349351>
2143
2144         Reviewed by Saam Barati.
2145
2146         * stress/regress-181388.js: Added.
2147
2148 2018-01-08  JF Bastien  <jfbastien@apple.com>
2149
2150         WebAssembly: mask indexed accesses to Table
2151         https://bugs.webkit.org/show_bug.cgi?id=181412
2152         <rdar://problem/36363236>
2153
2154         Reviewed by Saam Barati.
2155
2156         Update error messages.
2157
2158         * wasm/js-api/table.js:
2159         (assert.throws.WebAssembly.Table.prototype.grow):
2160
2161 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
2162
2163         Disable SharedArrayBuffer tests missed in r226386.
2164         https://bugs.webkit.org/show_bug.cgi?id=181266
2165
2166         Unreviewed test gardening.
2167
2168         * test262.yaml:
2169
2170 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2171
2172         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
2173         https://bugs.webkit.org/show_bug.cgi?id=181321
2174
2175         Reviewed by Saam Barati.
2176
2177         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
2178         (shouldBe):
2179         (testFunction):
2180         * test262.yaml:
2181
2182 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
2183
2184         Unreviewed, attempt to fix test262 after r226386.
2185
2186         * test262.yaml:
2187
2188 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2189
2190         [DFG] Define defs for MapSet/SetAdd to participate in CSE
2191         https://bugs.webkit.org/show_bug.cgi?id=179911
2192
2193         Reviewed by Saam Barati.
2194
2195         In addition to these tests, map-set-cse.js and set-add-cse.js work.
2196
2197         * stress/map-set-change-get.js: Added.
2198         (shouldBe):
2199         (test):
2200         * stress/map-set-create-bucket.js: Added.
2201         (shouldBe):
2202         (test):
2203         * stress/set-add-create-bucket.js: Added.
2204         (shouldBe):
2205
2206 2018-01-03  Michael Saboff  <msaboff@apple.com>
2207
2208         Disable SharedArrayBuffers from Web API
2209         https://bugs.webkit.org/show_bug.cgi?id=181266
2210
2211         Reviewed by Saam Barati.
2212
2213         Disabled SharedArrayBuffer tests.
2214
2215         * stress/SharedArrayBuffer-opt.js:
2216         * stress/SharedArrayBuffer.js:
2217         * stress/array-buffer-byte-length.js:
2218         * stress/atomics-add-uint32.js:
2219         * stress/atomics-known-int-use.js:
2220         * stress/atomics-neg-zero.js:
2221         * stress/atomics-store-return.js:
2222         * stress/lars-sab-workers.js:
2223         * stress/regress-159779-1.js:
2224         * stress/regress-159779-2.js:
2225         * stress/regress-170473.js:
2226         * test262.yaml:
2227
2228 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
2229
2230         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
2231         https://bugs.webkit.org/show_bug.cgi?id=181258
2232
2233         Reviewed by Antonio Gomes.
2234
2235         * stress/big-int-constructor-gc.js:
2236         * stress/big-int-constructor-oom.js:
2237
2238 2018-01-03  Robin Morisset  <rmorisset@apple.com>
2239
2240         Inlining of a function that ends in op_unreachable crashes
2241         https://bugs.webkit.org/show_bug.cgi?id=181027
2242
2243         Reviewed by Filip Pizlo.
2244
2245         * stress/inlining-unreachable.js: Added.
2246         (bar):
2247         (baz):
2248         (i.catch):
2249
2250 2018-01-02  Saam Barati  <sbarati@apple.com>
2251
2252         Incorrect assertion inside AccessCase
2253         https://bugs.webkit.org/show_bug.cgi?id=181200
2254         <rdar://problem/35494754>
2255
2256         Reviewed by Yusuke Suzuki.
2257
2258         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
2259         (ctor):
2260         (theFunc):
2261         (run):
2262
2263 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
2264
2265         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
2266         https://bugs.webkit.org/show_bug.cgi?id=175359
2267
2268         Reviewed by Yusuke Suzuki.
2269
2270         * bigIntTests.yaml:
2271         * stress/big-int-as-key.js: Added.
2272         * stress/big-int-constructor-gc.js: Added.
2273         * stress/big-int-constructor-oom.js: Added.
2274         * stress/big-int-constructor-properties.js: Added.
2275         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
2276         * stress/big-int-constructor-prototype.js: Added.
2277         * stress/big-int-constructor.js: Added.
2278         * stress/big-int-function-apply.js:
2279         * stress/big-int-length.js: Added.
2280         * stress/big-int-prop-descriptor.js: Added.
2281         * stress/big-int-proto-constructor.js: Added.
2282         * stress/big-int-proto-name.js: Added.
2283         * stress/big-int-prototype-properties.js: Added.
2284         * stress/big-int-prototype-proto.js: Added.
2285         * stress/big-int-prototype-value-of.js: Added.
2286         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
2287         * stress/big-int-prototype-to-string-apply.js: Added.
2288         * stress/big-int-to-object.js: Added.
2289         * stress/big-int-to-string.js: Added.
2290
2291 2017-12-28  Saam Barati  <sbarati@apple.com>
2292
2293         Assertion used to determine if something is an async generator is wrong
2294         https://bugs.webkit.org/show_bug.cgi?id=181168
2295         <rdar://problem/35640560>
2296
2297         Reviewed by Yusuke Suzuki.
2298
2299         * stress/async-generator-assertion.js: Added.
2300
2301 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
2302
2303         Skip stress/splay-flash-access tests on memory limited platforms
2304         https://bugs.webkit.org/show_bug.cgi?id=181086
2305
2306         Reviewed by Carlos Alberto Lopez Perez.
2307
2308         These tests use about 185M of memory, and occasionally get OOM-killed
2309         on memory limited platforms.
2310
2311         * stress/splay-flash-access-1ms.js:
2312         * stress/splay-flash-access.js:
2313
2314 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
2315
2316         Skip slow jsc tests on embedded platforms
2317         https://bugs.webkit.org/show_bug.cgi?id=180937
2318
2319         Reviewed by Carlos Alberto Lopez Perez.
2320
2321         The tests typeProfiler/deltablue-for-of.js and
2322         typeProfiler/getter-richards.js take a very long time in the
2323         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
2324         thus always timeout. They should be skipped on these platforms.
2325
2326         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
2327         * typeProfiler/getter-richards.js: Skip on arm*/mips.
2328
2329 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2330
2331         [JSC] Do not check isValid() in op_new_regexp
2332         https://bugs.webkit.org/show_bug.cgi?id=180970
2333
2334         Reviewed by Saam Barati.
2335
2336         * stress/regexp-syntax-error-invalid-flags.js: Added.
2337         (shouldThrow):
2338
2339 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
2340
2341         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
2342         https://bugs.webkit.org/show_bug.cgi?id=180712
2343
2344         Reviewed by Michael Catanzaro.
2345
2346         stress/call-apply-exponential-bytecode-size.js crashes if the
2347         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
2348         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
2349         should skip the test on other platforms.
2350
2351         * stress/call-apply-exponential-bytecode-size.js:
2352
2353 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2354
2355         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
2356         https://bugs.webkit.org/show_bug.cgi?id=179762
2357
2358         Reviewed by Saam Barati.
2359
2360         * stress/call-varargs-double-new-array-buffer.js: Added.
2361         (assert):
2362         (bar):
2363         (foo):
2364         * stress/call-varargs-spread-new-array-buffer.js: Added.
2365         (assert):
2366         (bar):
2367         (foo):
2368         * stress/call-varargs-spread-new-array-buffer2.js: Added.
2369         (assert):
2370         (bar):
2371         (foo):
2372         * stress/forward-varargs-double-new-array-buffer.js: Added.
2373         (assert):
2374         (test.baz):
2375         (test.bar):
2376         (test.foo):
2377         (test):
2378         * stress/new-array-buffer-sinking-osrexit.js: Added.
2379         (target):
2380         (test):
2381         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
2382         (shouldBe):
2383         (test):
2384         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
2385         (shouldBe):
2386         (target):
2387         (test):
2388         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
2389         (assert):
2390         (test1.bar):
2391         (test1.foo):
2392         (test1):
2393         (test2.bar):
2394         (test2.foo):
2395         (test3.baz):
2396         (test3.bar):
2397         (test3.foo):
2398         (test4.baz):
2399         (test4.bar):
2400         (test4.foo):
2401         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
2402         (assert):
2403         (test.baz):
2404         (test.bar):
2405         (test.foo):
2406         (test):
2407         * stress/phantom-new-array-buffer-osr-exit.js: Added.
2408         (assert):
2409         (baz):
2410         (bar):
2411         (effects):
2412         (foo):
2413
2414 2017-12-14  Saam Barati  <sbarati@apple.com>
2415
2416         The CleanUp after LICM is erroneously removing a Check
2417         https://bugs.webkit.org/show_bug.cgi?id=180852
2418         <rdar://problem/36063494>
2419
2420         Reviewed by Filip Pizlo.
2421
2422         * stress/dont-run-cleanup-after-licm.js: Added.
2423
2424 2017-12-14  Michael Saboff  <msaboff@apple.com>
2425
2426         REGRESSION (r225695): Repro crash on yahoo login page
2427         https://bugs.webkit.org/show_bug.cgi?id=180761
2428
2429         Reviewed by JF Bastien.
2430
2431         New regression test.
2432
2433         * stress/regress-180761.js: Added.
2434
2435 2017-12-13  Keith Miller  <keith_miller@apple.com>
2436
2437         JSObjects should have a mask for loading indexed properties
2438         https://bugs.webkit.org/show_bug.cgi?id=180768
2439
2440         Reviewed by Mark Lam.
2441
2442         * stress/int16-put-by-val-in-and-out-of-bounds.js:
2443         (test):
2444
2445 2017-12-13  Saam Barati  <sbarati@apple.com>
2446
2447         Arrow functions need their own structure because they have different properties than sloppy functions
2448         https://bugs.webkit.org/show_bug.cgi?id=180779
2449         <rdar://problem/35814591>
2450
2451         Reviewed by Mark Lam.
2452
2453         * stress/arrow-function-needs-its-own-structure.js: Added.
2454         (assert):
2455         (readPrototype):
2456         (noInline.let.f1):
2457         (noInline):
2458
2459 2017-12-13  Saam Barati  <sbarati@apple.com>
2460
2461         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
2462         https://bugs.webkit.org/show_bug.cgi?id=163579
2463         <rdar://problem/35455798>
2464
2465         Reviewed by Mark Lam.
2466
2467         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
2468         (assert):
2469         (test1):
2470         (i.test1):
2471         (i.test1.C):
2472         (i.test1.async.foo):
2473         (i.test1.foo):
2474         (test2):
2475
2476 2017-12-13  Saam Barati  <sbarati@apple.com>
2477
2478         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
2479         https://bugs.webkit.org/show_bug.cgi?id=180734
2480         <rdar://problem/35640547>
2481
2482         Reviewed by Yusuke Suzuki.
2483
2484         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
2485         (__isPropertyOfType):
2486         (__getProperties):
2487         (__getObjects):
2488         (__getRandomObject):
2489         (theClass.):
2490         (theClass):
2491         (childClass):
2492         (counter.catch):
2493
2494 2017-12-12  Saam Barati  <sbarati@apple.com>
2495
2496         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
2497         https://bugs.webkit.org/show_bug.cgi?id=180725
2498         <rdar://problem/35970511>
2499
2500         Reviewed by Michael Saboff.
2501
2502         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
2503         (f1):
2504         (f2):
2505         (let.o2.valueOf):
2506
2507 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2508
2509         [JSC] Implement optimized WeakMap and WeakSet
2510         https://bugs.webkit.org/show_bug.cgi?id=179929
2511
2512         Reviewed by Saam Barati.
2513
2514         * microbenchmarks/weak-map-key.js:
2515         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
2516         (assert):
2517         (objectKey):
2518         (let.start.Date.now):
2519         * stress/basic-weakmap.js: Added.
2520         (shouldBe):
2521         (test):
2522         * stress/basic-weakset.js: Added.
2523         (shouldBe):
2524         (test.set new):
2525         * stress/weakmap-cse-set-break.js: Added.
2526         (shouldBe):
2527         (test):
2528         * stress/weakmap-cse.js: Added.
2529         (shouldBe):
2530         (test):
2531         * stress/weakmap-gc.js: Added.
2532         (test):
2533         * stress/weakset-cse-add-break.js: Added.
2534         (shouldBe):
2535         (test.set new):
2536         * stress/weakset-cse.js: Added.
2537         (shouldBe):
2538         (test.set new):
2539         * stress/weakset-gc.js: Added.
2540         (test.set add):
2541         (test.set new):
2542         (test):
2543
2544 2017-12-12  Saam Barati  <sbarati@apple.com>
2545
2546         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
2547         https://bugs.webkit.org/show_bug.cgi?id=180723
2548         <rdar://problem/35859726>
2549
2550         Reviewed by JF Bastien.
2551
2552         * stress/get-my-argument-by-val-constant-folding.js: Added.
2553         (test):
2554         (catch):
2555
2556 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
2557
2558         [ESNext][BigInt] Implement BigInt literals and JSBigInt
2559         https://bugs.webkit.org/show_bug.cgi?id=179000
2560
2561         Reviewed by Darin Adler and Yusuke Suzuki.
2562
2563         * bigIntTests.yaml: Added.
2564         * stress/big-int-literal-line-terminator.js: Added.
2565         * stress/big-int-literals.js: Added.
2566         * stress/big-int-operations-error.js: Added.
2567         * stress/big-int-type-of.js: Added.
2568         * stress/big-int-white-space-trailing-leading.js: Added.
2569         * stress/big-int-function-apply.js: Added.
2570
2571 2017-12-11  Saam Barati  <sbarati@apple.com>
2572
2573         We need to disableCaching() in ErrorInstance when we materialize properties
2574         https://bugs.webkit.org/show_bug.cgi?id=180343
2575         <rdar://problem/35833002>
2576
2577         Reviewed by Mark Lam.
2578
2579         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
2580         (assert):
2581         (makeError):
2582         (storeToStack):
2583         (storeToStackAlreadyMaterialized):
2584
2585 2017-12-05  JF Bastien  <jfbastien@apple.com>
2586
2587         WebAssembly: don't eagerly checksum
2588         https://bugs.webkit.org/show_bug.cgi?id=180441
2589         <rdar://problem/35156628>
2590
2591         Reviewed by Saam Barati.
2592
2593         Checksum is now disabled, so tests only have <?> as the module
2594         name.
2595
2596         * wasm/function-tests/nameSection.js:
2597         * wasm/function-tests/stack-overflow.js:
2598         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2599         (assertOverflows.assertThrows):
2600         (assertOverflows):
2601         * wasm/function-tests/stack-trace.js:
2602
2603 2017-12-04  JF Bastien  <jfbastien@apple.com>
2604
2605         Proxy all functions, except the $ objects
2606         https://bugs.webkit.org/show_bug.cgi?id=180375
2607
2608         Reviewed by Saam Barati.
2609
2610         It looks like this test may have broken some executions because I
2611         call some internal objects. Explicitly ignore objects whose name
2612         starts with "$" because it's a bad idea anyways.
2613
2614         * stress/proxy-all-the-parameters.js:
2615         (generateObjects):
2616         (get throw):
2617
2618 2017-12-04  Saam Barati  <sbarati@apple.com>
2619
2620         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
2621         https://bugs.webkit.org/show_bug.cgi?id=180366
2622         <rdar://problem/35685877>
2623
2624         Reviewed by Michael Saboff.
2625
2626         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
2627         (theParent):
2628         (test1.base.getParentStaticValue):
2629         (test1.base):
2630         (test1.__v_24888.prototype.set prop):
2631         (test1.__v_24888):
2632         (test2.base.getParentStaticValue):
2633         (test2.base):
2634         (test2.__v_24888.prototype.set prop):
2635         (test2.__v_24888):
2636         (test2):
2637
2638 2017-12-01  JF Bastien  <jfbastien@apple.com>
2639
2640         Try proxying all function arguments
2641         https://bugs.webkit.org/show_bug.cgi?id=180306
2642
2643         Reviewed by Saam Barati.
2644
2645         * stress/proxy-all-the-parameters.js: Added.
2646         (isPropertyOfType):
2647         (getProperties):
2648         (generateObjects):
2649         (getObjects):
2650         (getFunctions):
2651         (get throw):
2652         (let.o.of.getObjects.let.f.of.getFunctions.catch):
2653
2654 2017-12-01  JF Bastien  <jfbastien@apple.com>
2655
2656         JavaScriptCore: missing exception checks in Math functions that take more than one argument
2657         https://bugs.webkit.org/show_bug.cgi?id=180297
2658         <rdar://problem/35745556>
2659
2660         Reviewed by Mark Lam.
2661
2662         * stress/math-exceptions.js: Added.
2663         (get try):
2664         (catch):
2665
2666 2017-12-01  JF Bastien  <jfbastien@apple.com>
2667
2668         JavaScriptCore: add test for weird class static getters
2669         https://bugs.webkit.org/show_bug.cgi?id=180281
2670         <rdar://problem/35592139>
2671
2672         Reviewed by Mark Lam.
2673
2674         I fixed a bug for it in r224927 and didn't add a test. Do so.
2675
2676         * stress/class-static-get-weird.js: Added.
2677         (c.prototype.get name):
2678         (c):
2679         (c.prototype.get arguments):
2680         (c.prototype.get caller):
2681         (c.prototype.get length):
2682
2683 2017-12-01  Saam Barati  <sbarati@apple.com>
2684
2685         Having a bad time needs to handle ArrayClass indexing type as well
2686         https://bugs.webkit.org/show_bug.cgi?id=180274
2687         <rdar://problem/35667869>
2688
2689         Reviewed by Keith Miller and Mark Lam.
2690
2691         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
2692         (assert):
2693         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
2694         (assert):
2695
2696 2017-12-01  JF Bastien  <jfbastien@apple.com>
2697
2698         WebAssembly: restore cached stack limit after out-call
2699         https://bugs.webkit.org/show_bug.cgi?id=179106
2700         <rdar://problem/35337525>
2701
2702         Reviewed by Saam Barati.
2703
2704         * wasm/function-tests/double-instance.js: Added.
2705         (const.imp.boom):
2706         (const.imp.get callAnother):
2707
2708 2017-11-30  JF Bastien  <jfbastien@apple.com>
2709
2710         WebAssembly: improve stack trace
2711         https://bugs.webkit.org/show_bug.cgi?id=179343
2712
2713         Reviewed by Saam Barati.
2714
2715         Update the tests to follow the new format. Notably, SHA1 module
2716         hash is now included in traces, and stubs are properly identified.
2717
2718         * wasm/assert.js: Add an assertion which matches regular expressions.
2719         * wasm/function-tests/nameSection.js:
2720         * wasm/function-tests/stack-overflow.js:
2721         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2722         (assertOverflows.assertThrows.wasm.1):
2723         (assertOverflows.assertThrows.wasm.0):
2724         (assertOverflows.assertThrows):
2725         (assertOverflows):
2726         * wasm/function-tests/stack-trace.js:
2727         (import.Builder.from.string_appeared_here.assert): Deleted.
2728         * wasm/function-tests/trap-after-cross-instance-call.js:
2729         (wasmFrameCountFromError):
2730         * wasm/function-tests/trap-load-2.js:
2731         (wasmFrameCountFromError):
2732         * wasm/function-tests/trap-load.js:
2733         (wasmFrameCountFromError):
2734
2735 2017-11-30  Mark Lam  <mark.lam@apple.com>
2736
2737         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
2738         https://bugs.webkit.org/show_bug.cgi?id=180219
2739         <rdar://problem/35696536>
2740
2741         Reviewed by Filip Pizlo.
2742
2743         * stress/regress-180219.js: Added.
2744
2745 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2746
2747         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
2748         https://bugs.webkit.org/show_bug.cgi?id=180190
2749
2750         Reviewed by Mark Lam.
2751
2752         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
2753         (shouldBe):
2754         (test1):
2755         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
2756         (shouldBe):
2757         (test1):
2758         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
2759         (shouldBe):
2760         (test1):
2761         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
2762         (shouldBe):
2763         (test1):
2764         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
2765         (shouldBe):
2766         (test1):
2767         * stress/operation-in-may-have-negative-int32.js: Added.
2768         (shouldBe):
2769         (test2):
2770         * stress/operation-in-negative-int32-cast.js: Added.
2771         (shouldBe):
2772         (test1):
2773
2774 2017-11-28  JF Bastien  <jfbastien@apple.com>
2775
2776         Strict and sloppy functions shouldn't share structure
2777         https://bugs.webkit.org/show_bug.cgi?id=180103
2778         <rdar://problem/35667847>
2779
2780         Reviewed by Saam Barati.
2781
2782         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
2783         because the IC was wrong.
2784         (foo):
2785         (bar):
2786         (baz):
2787         (catch):
2788         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
2789         in this patch, but may as well test odd strict mode corner cases.
2790         (bar):
2791         (baz):
2792         (catch):
2793         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
2794         (foo):
2795         (bar):
2796         (baz):
2797         (catch):
2798         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
2799         next file, but with invalidation of the FunctionExecutable's
2800         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
2801         slower path.
2802         (foo):
2803         (bar.const.x):
2804         (bar.const.y):
2805         (bar):
2806         (catch):
2807         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
2808         strict nesting works correctly.
2809         (foo):
2810         (bar.baz):
2811         (bar):
2812         * stress/strict-function-structure.js: Added. The test used to
2813         assert in objectProtoFuncHasOwnProperty.
2814         (foo):
2815         (bar):
2816         (baz):
2817         * stress/strict-nested-function-structure.js: Added. Nesting.
2818         (foo):
2819         (bar):
2820         (baz.boo):
2821         (baz):
2822
2823 2017-11-29  Robin Morisset  <rmorisset@apple.com>
2824
2825         The recursive tail call optimisation is wrong on closures
2826         https://bugs.webkit.org/show_bug.cgi?id=179835
2827
2828         Reviewed by Saam Barati.
2829
2830         * stress/closure-recursive-tail-call.js: Added.
2831         (makeClosure):
2832
2833 2017-11-27  JF Bastien  <jfbastien@apple.com>
2834
2835         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
2836         https://bugs.webkit.org/show_bug.cgi?id=180051
2837         <rdar://problem/35614371>
2838
2839         Reviewed by Saam Barati.
2840
2841         * stress/rest-parameter-negative.js: Added.
2842         (__f_5484):
2843         (catch):
2844         (__f_5485):
2845         (__v_22598.catch):
2846
2847 2017-11-27  Saam Barati  <sbarati@apple.com>
2848
2849         Spread can escape when CreateRest does not
2850         https://bugs.webkit.org/show_bug.cgi?id=180057
2851         <rdar://problem/35676119>
2852
2853         Reviewed by JF Bastien.
2854
2855         * stress/spread-escapes-but-create-rest-does-not.js: Added.
2856         (assert):
2857         (getProperties):
2858         (theFunc):
2859         (let.obj.valueOf):
2860
2861 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2862
2863         [DFG] Add NormalizeMapKey DFG IR
2864         https://bugs.webkit.org/show_bug.cgi?id=179912
2865
2866         Reviewed by Saam Barati.
2867
2868         * stress/map-untyped-normalize-cse.js: Added.
2869         (shouldBe):
2870         (test):
2871         * stress/map-untyped-normalize.js: Added.
2872         (shouldBe):
2873         (test):
2874         * stress/set-untyped-normalize-cse.js: Added.
2875         (shouldBe):
2876         (set return.set has.set has):
2877         * stress/set-untyped-normalize.js: Added.
2878         (shouldBe):
2879         (set return.set has):
2880
2881 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2882
2883         [FTL] Support DeleteById and DeleteByVal
2884         https://bugs.webkit.org/show_bug.cgi?id=180022
2885
2886         Reviewed by Saam Barati.
2887
2888         * stress/delete-by-id.js: Added.
2889         (shouldBe):
2890         (test1):
2891         (test2):
2892         * stress/delete-by-val-ftl.js: Added.
2893         (shouldBe):
2894         (test1):
2895         (test2):
2896
2897 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2898
2899         [DFG] Introduce {Set,Map,WeakMap}Fields
2900         https://bugs.webkit.org/show_bug.cgi?id=179925
2901
2902         Reviewed by Saam Barati.
2903
2904         * stress/map-set-clobber-map-get.js: Added.
2905         (shouldBe):
2906         (test):
2907         * stress/map-set-does-not-clobber-set-has.js: Added.
2908         (shouldBe):
2909         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
2910         (shouldBe):
2911         (test):
2912         * stress/set-add-clobber-set-has.js: Added.
2913         (shouldBe):
2914         * stress/set-add-does-not-clobber-map-get.js: Added.
2915         (shouldBe):
2916
2917 2017-11-24  Mark Lam  <mark.lam@apple.com>
2918
2919         Move unsafe jsc shell test functions to the $vm object.
2920         https://bugs.webkit.org/show_bug.cgi?id=179980
2921
2922         Reviewed by Yusuke Suzuki.
2923
2924         * controlFlowProfiler/driver/driver.js:
2925         * controlFlowProfiler/execution-count.js:
2926         * controlFlowProfiler/if-statement.js:
2927         * controlFlowProfiler/loop-statements.js:
2928         * controlFlowProfiler/switch-statements.js:
2929         * controlFlowProfiler/test-jit.js:
2930         * exceptionFuzz/3d-cube.js:
2931         * exceptionFuzz/date-format-xparb.js:
2932         * exceptionFuzz/earley-boyer.js:
2933         * heapProfiler/basic-edges.js:
2934         * heapProfiler/property-edge-types.js:
2935         * microbenchmarks/try-get-by-id-basic.js:
2936         * microbenchmarks/try-get-by-id-polymorphic.js:
2937         * modules/namespace-object-try-get.js:
2938         * stress/argument-count-bytecode.js:
2939         * stress/argument-intrinsic-basic.js:
2940         * stress/argument-intrinsic-inlining-use-caller-arg.js:
2941         * stress/argument-intrinsic-inlining-with-result-escape.js:
2942         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
2943         * stress/argument-intrinsic-inlining-with-vararg.js:
2944         * stress/argument-intrinsic-nested-inlining.js:
2945         * stress/argument-intrinsic-not-convert-to-get-argument.js:
2946         * stress/argument-intrinsic-with-stack-write.js:
2947         * stress/arity-mismatch-get-argument.js:
2948         * stress/array-message-passing.js:
2949         * stress/array-push-with-force-exit.js:
2950         * stress/check-dom-with-signature.js:
2951         * stress/check-sub-class.js:
2952         * stress/compare-eq-incomplete-profile.js:
2953         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
2954         * stress/do-eval-virtual-call-correctly.js:
2955         * stress/dom-jit-with-poly-proto.js:
2956         * stress/domjit-exception-ic.js:
2957         * stress/domjit-exception.js:
2958         * stress/domjit-getter-complex-with-incorrect-object.js:
2959         * stress/domjit-getter-complex.js:
2960         * stress/domjit-getter-poly.js:
2961         * stress/domjit-getter-proto.js:
2962         * stress/domjit-getter-super-poly.js:
2963         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
2964         * stress/domjit-getter-type-check.js:
2965         * stress/domjit-getter.js:
2966         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
2967         * stress/for-in-proxy-target-changed-structure.js:
2968         * stress/for-in-proxy.js:
2969         * stress/generational-opaque-roots.js:
2970         * stress/global-const-redeclaration-setting-2.js:
2971         * stress/global-const-redeclaration-setting-3.js:
2972         * stress/global-const-redeclaration-setting-4.js:
2973         * stress/global-const-redeclaration-setting-5.js:
2974         * stress/global-const-redeclaration-setting.js:
2975         * stress/import-basic.js:
2976         * stress/import-from-eval.js:
2977         * stress/import-reject-with-exception.js:
2978         * stress/import-syntax.js:
2979         * stress/impure-get-own-property-slot-inline-cache.js:
2980         * stress/is-constructor.js:
2981         * stress/istypedarrayview-intrinsic.js:
2982         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
2983         * stress/jsc-test-functions-should-be-more-robust.js:
2984         * stress/object-toString-with-proxy.js:
2985         * stress/poly-proto-custom-value-and-accessor.js:
2986         * stress/proxy-inline-cache.js:
2987         * stress/re-execute-error-module.js:
2988         * stress/regress-150532.js:
2989         * stress/regress-156992.js:
2990         * stress/regress-179619.js:
2991         * stress/resources/shadow-chicken-support.js:
2992         * stress/runtime-array.js:
2993         * stress/sampling-profiler-microtasks.js:
2994         * stress/shadow-chicken-enabled.js:
2995         * stress/spread-correct-global-object-on-exception.js:
2996         * stress/super-get-by-id.js:
2997         * stress/tailCallForwardArguments.js:
2998         * stress/to-object-intrinsic-boolean-edge.js:
2999         * stress/to-object-intrinsic-null-or-undefined-edge.js:
3000         * stress/to-object-intrinsic-number-edge.js:
3001         * stress/to-object-intrinsic-object-edge.js:
3002         * stress/to-object-intrinsic-string-edge.js:
3003         * stress/to-object-intrinsic-symbol-edge.js:
3004         * stress/to-object-intrinsic.js:
3005         * stress/try-catch-custom-getter-as-get-by-id.js:
3006         * stress/try-get-by-id-poly-proto.js:
3007         * stress/try-get-by-id-should-spill-registers-dfg.js:
3008         * stress/try-get-by-id.js:
3009         * typeProfiler/arrow-functions.js:
3010         * typeProfiler/basic.js:
3011         * typeProfiler/captured.js:
3012         * typeProfiler/classes.js:
3013         * typeProfiler/dfg-jit-optimizations.js:
3014         * typeProfiler/dictionary-mode.js:
3015         * typeProfiler/es6-block-scoping.js:
3016         * typeProfiler/es6-classes.js:
3017         * typeProfiler/inheritance.js:
3018         * typeProfiler/int52-dfg.js:
3019         * typeProfiler/loop.js:
3020         * typeProfiler/optional-fields.js:
3021         * typeProfiler/overflow.js:
3022         * typeProfiler/return.js:
3023         * typeProfiler/symbol.js:
3024         * typeProfiler/weird-prototype-chain.js:
3025
3026 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3027
3028         [DFG][FTL] Support MapSet / SetAdd intrinsics
3029         https://bugs.webkit.org/show_bug.cgi?id=179858
3030
3031         Reviewed by Saam Barati.
3032
3033         * microbenchmarks/map-has-and-set.js: Added.
3034         (test):
3035         * stress/map-set-check-failure.js: Added.
3036         (shouldBe):
3037         (shouldThrow):
3038         (target):
3039         * stress/map-set-cse.js: Added.
3040         (shouldBe):
3041         (test):
3042         * stress/set-add-check-failure.js: Added.
3043         (shouldBe):
3044         (shouldThrow):
3045         (set shouldThrow):
3046         * stress/set-add-cse.js: Added.
3047         (shouldBe):
3048
3049 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3050
3051         [JSC] Allow poly proto for intrinsic getters
3052         https://bugs.webkit.org/show_bug.cgi?id=179550
3053
3054         Reviewed by Saam Barati.
3055
3056         This change is also tested by existing tests.
3057
3058             1. stress/intrinsic-getter-with-poly-proto.js
3059             2. stress/poly-proto-intrinsic-getter-correctness.js
3060
3061         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
3062         (shouldBe):
3063         (makePolyProtoObject.foo.C):
3064         (makePolyProtoObject.foo):
3065         (makePolyProtoObject):
3066         (target):
3067         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
3068         (shouldBe):
3069         (makePolyProtoObject.foo.C):
3070         (makePolyProtoObject.foo):
3071         (makePolyProtoObject):
3072         (target):
3073
3074 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
3075
3076         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
3077         https://bugs.webkit.org/show_bug.cgi?id=179744
3078
3079         Reviewed by Michael Catanzaro.
3080
3081         This test uses too much memory for our buildbots on these platforms
3082         and gets OOM-killed.
3083
3084         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3085         Skip if $memoryLimited and linux.
3086
3087 2017-11-17  JF Bastien  <jfbastien@apple.com>
3088
3089         WebAssembly JS API: throw when a promise can't be created
3090         https://bugs.webkit.org/show_bug.cgi?id=179826
3091         <rdar://problem/35455813>
3092
3093         Reviewed by Mark Lam.
3094
3095         Test WebAssembly.{compile,instantiate} where promise creation
3096         fails because of a stack overflow.
3097
3098         * wasm/js-api/promise-stack-overflow.js: Added.
3099         (const.runNearStackLimit.f.const.t):
3100         (async.testCompile):
3101         (async.testInstantiate):
3102
3103 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3104
3105         Unreviewed, mark regress-178385.js as memory exhausting
3106
3107         * stress/regress-178385.js:
3108
3109 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
3110
3111         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
3112
3113         Unreviewed test gardening.
3114
3115         * test262.yaml:
3116
3117 2017-11-16  Robin Morisset  <rmorisset@apple.com>
3118
3119         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
3120         https://bugs.webkit.org/show_bug.cgi?id=179763
3121         <rdar://problem/35550513>
3122
3123         Reviewed by Keith Miller.
3124
3125         Just adding a slightly cleaned-up version of the original fuzzer-found test.
3126
3127         * stress/tdz-this-in-try-catch.js: Added.
3128         (__v_6388):
3129         (__v_6392):
3130
3131 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
3132
3133         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
3134         https://bugs.webkit.org/show_bug.cgi?id=179594
3135
3136         Reviewed by Saam Barati.
3137
3138         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
3139         (shouldBe):
3140         (args):
3141         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
3142         (shouldBe):
3143         (args):
3144
3145 2017-11-14  Saam Barati  <sbarati@apple.com>
3146
3147         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
3148         https://bugs.webkit.org/show_bug.cgi?id=179639
3149         <rdar://problem/35513018>
3150
3151         Reviewed by JF Bastien.
3152
3153         * wasm/function-tests/grow-memory-cause-gc.js: Added.
3154         (escape):
3155         (i.func):
3156
3157 2017-11-13  Mark Lam  <mark.lam@apple.com>
3158
3159         Add more overflow check book-keeping for MarkedArgumentBuffer.
3160         https://bugs.webkit.org/show_bug.cgi?id=179634
3161         <rdar://problem/35492517>
3162
3163         Reviewed by Saam Barati.
3164
3165         * stress/regress-179634.js: Added.
3166
3167 2017-11-13  Mark Lam  <mark.lam@apple.com>
3168
3169         Make the jsc shell loadGetterFromGetterSetter() function more robust.
3170         https://bugs.webkit.org/show_bug.cgi?id=179619
3171         <rdar://problem/35492518>
3172
3173         Reviewed by Saam Barati.
3174
3175         * stress/regress-179619.js: Added.
3176
3177 2017-11-12  Mark Lam  <mark.lam@apple.com>
3178
3179         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
3180         https://bugs.webkit.org/show_bug.cgi?id=179562
3181         <rdar://problem/35467022>
3182
3183         Reviewed by Saam Barati.
3184
3185         * regress-179562.js: Added.
3186
3187 2017-11-08  Saam Barati  <sbarati@apple.com>
3188
3189         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
3190         https://bugs.webkit.org/show_bug.cgi?id=177792
3191
3192         Reviewed by Yusuke Suzuki.
3193
3194         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
3195         (assert):
3196         (foo.Foo.prototype.ensureX):
3197         (foo.Foo):
3198         (foo):
3199         (access):
3200
3201 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
3202
3203         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
3204         https://bugs.webkit.org/show_bug.cgi?id=178592
3205
3206         Unreviewed test gardening.
3207
3208         * test262.yaml:
3209
3210 2017-11-08  Robin Morisset  <rmorisset@apple.com>
3211
3212         Turn recursive tail calls into loops
3213         https://bugs.webkit.org/show_bug.cgi?id=176601
3214
3215         Reviewed by Saam Barati.
3216
3217         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
3218
3219         Add some simple test that computes factorial in several ways, and other trivial computations.
3220         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
3221         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
3222         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
3223         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
3224
3225         * stress/inline-call-to-recursive-tail-call.js: Added.
3226         (factorial.aux):
3227         (factorial):
3228         (factorial2.aux2):
3229         (factorial2.id):
3230         (factorial2):
3231         (factorial3.aux3):
3232         (factorial3):
3233         (aux4):
3234         (factorial4):
3235         (foo):
3236         (auxBar):
3237         (bar):
3238         (test):
3239
3240 2017-11-07  Mark Lam  <mark.lam@apple.com>
3241
3242         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
3243         https://bugs.webkit.org/show_bug.cgi?id=179355
3244         <rdar://problem/35263053>
3245
3246         Reviewed by Saam Barati.
3247
3248         * stress/regress-179355.js: Added.
3249
3250 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3251
3252         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
3253         https://bugs.webkit.org/show_bug.cgi?id=144458
3254
3255         Reviewed by Saam Barati.
3256
3257         * microbenchmarks/dfg-internal-function-call.js: Added.
3258         (target):
3259         * microbenchmarks/dfg-internal-function-construct.js: Added.
3260         (target):
3261         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
3262         (target):
3263         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
3264         (target):
3265         * stress/dfg-internal-function-call.js: Added.
3266         (shouldBe):
3267         (target):
3268         * stress/dfg-internal-function-construct.js: Added.
3269         (shouldBe):
3270         (target):
3271         * stress/internal-function-call.js: Added.
3272         (shouldBe):
3273         * stress/internal-function-construct.js: Added.
3274         (shouldBe):
3275
3276 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
3277
3278         [Win] Skip stress/regress-178385.js.
3279         https://bugs.webkit.org/show_bug.cgi?id=179298
3280
3281         Unreviewed test gardening.
3282
3283         * stress/regress-178385.js:
3284
3285 2017-11-03  Keith Miller  <keith_miller@apple.com>
3286
3287         Add test for ic with side effects
3288         https://bugs.webkit.org/show_bug.cgi?id=179268
3289
3290         Reviewed by Saam Barati.
3291
3292         * stress/put-inline-cache-side-effects.js: Added.
3293         (let.i.of.objs.keys):
3294         (f):
3295
3296 2017-11-03  Mark Lam  <mark.lam@apple.com>
3297
3298         CachedCall (and its clients) needs overflow checks.
3299         https://bugs.webkit.org/show_bug.cgi?id=179185
3300
3301         Reviewed by JF Bastien.
3302
3303         * stress/regress-179185.js: Added.
3304
3305 2017-11-02  Michael Saboff  <msaboff@apple.com>
3306
3307         DFG needs to handle code motion of code in for..in loop bodies
3308         https://bugs.webkit.org/show_bug.cgi?id=179212
3309
3310         Reviewed by Keith Miller.
3311
3312         New regression test.
3313
3314         * stress/for-in-side-effects.js: Added.
3315         (getPrototypeOf):
3316         (reset):
3317         (testWithoutFTL.f):
3318         (testWithoutFTL):
3319         (testWithFTL.f):
3320         (testWithFTL):
3321
3322 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
3323
3324         AI does not correctly model the clobber case of ArithClz32
3325         https://bugs.webkit.org/show_bug.cgi?id=179188
3326
3327         Reviewed by Michael Saboff.
3328
3329         * stress/arith-clz32-effects.js: Added.
3330         (foo):
3331         (valueOf):
3332
3333 2017-11-01  Michael Saboff  <msaboff@apple.com>
3334
3335         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
3336         https://bugs.webkit.org/show_bug.cgi?id=179140
3337
3338         Reviewed by Saam Barati.
3339
3340         New regression test.
3341
3342         * stress/regress-179140.js: Added.
3343         (testWithoutFTL):
3344         (testWithFTL):
3345
3346 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
3347
3348         [JSC] Introduce @toObject
3349         https://bugs.webkit.org/show_bug.cgi?id=178726
3350
3351         Reviewed by Saam Barati.
3352
3353         * stress/array-copywithin.js:
3354         (shouldThrow):
3355         * stress/object-constructor-boolean-edge.js: Added.
3356         (shouldBe):
3357         (test):
3358         * stress/object-constructor-global.js: Added.
3359         (shouldBe):
3360         * stress/object-constructor-null-edge.js: Added.
3361         (shouldBe):
3362         (test):
3363         * stress/object-constructor-number-edge.js: Added.
3364         (shouldBe):
3365         (test):
3366         * stress/object-constructor-object-edge.js: Added.
3367         (shouldBe):
3368         (test):
3369         (i.arg):
3370         * stress/object-constructor-string-edge.js: Added.
3371         (shouldBe):
3372         (test):
3373         * stress/object-constructor-symbol-edge.js: Added.
3374         (shouldBe):
3375         (test):
3376         * stress/object-constructor-undefined-edge.js: Added.
3377         (shouldBe):
3378         (test):
3379         * stress/symbol-array-from.js: Added.
3380         (shouldBe):
3381         * stress/to-object-intrinsic-boolean-edge.js: Added.
3382         (shouldBe):
3383         (builtin.createBuiltin):
3384         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
3385         (shouldThrow):
3386         * stress/to-object-intrinsic-number-edge.js: Added.
3387         (shouldBe):
3388         (builtin.createBuiltin):
3389         * stress/to-object-intrinsic-object-edge.js: Added.
3390         (shouldBe):
3391         (builtin.createBuiltin):
3392         (i.arg):
3393         * stress/to-object-intrinsic-string-edge.js: Added.
3394         (shouldBe):
3395         (builtin.createBuiltin):
3396         * stress/to-object-intrinsic-symbol-edge.js: Added.
3397         (shouldBe):
3398         (builtin.createBuiltin):
3399         * stress/to-object-intrinsic.js: Added.
3400         (shouldBe):
3401         (shouldThrow):
3402         (builtin.createBuiltin):
3403
3404 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3405
3406         [DFG][FTL] Introduce StringSlice
3407         https://bugs.webkit.org/show_bug.cgi?id=178934
3408
3409         Reviewed by Saam Barati.
3410
3411         * microbenchmarks/string-slice-empty.js: Added.
3412         (slice):
3413         * microbenchmarks/string-slice-one-char.js: Added.
3414         (slice):
3415         * microbenchmarks/string-slice.js: Added.
3416         (slice):
3417
3418 2017-10-26  Michael Saboff  <msaboff@apple.com>
3419
3420         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
3421         https://bugs.webkit.org/show_bug.cgi?id=178890
3422
3423         Reviewed by Keith Miller.
3424
3425         New regression test.
3426
3427         * stress/regress-178890.js: Added.
3428
3429 2017-10-26  Mark Lam  <mark.lam@apple.com>
3430
3431         JSRopeString::RopeBuilder::append() should check for overflows.
3432         https://bugs.webkit.org/show_bug.cgi?id=178385
3433         <rdar://problem/35027468>
3434
3435         Reviewed by Saam Barati.
3436
3437         * stress/regress-178385.js: Added.
3438
3439 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
3440
3441         Unreviewed, rolling out r223961.
3442
3443         The change that required this has been rolled out.
3444
3445         Reverted changeset:
3446
3447         "Mark test262.yaml/test262/test/language/statements/try/tco-
3448         catch.js as passing."
3449         https://bugs.webkit.org/show_bug.cgi?id=178592
3450         https://trac.webkit.org/changeset/223961
3451
3452 2017-10-25  Commit Queue  <commit-queue@webkit.org>
3453
3454         Unreviewed, rolling out r223691 and r223729.
3455         https://bugs.webkit.org/show_bug.cgi?id=178834
3456
3457         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
3458         by rniwa on #webkit).
3459
3460         Reverted changesets:
3461
3462         "Turn recursive tail calls into loops"
3463         https://bugs.webkit.org/show_bug.cgi?id=176601
3464         https://trac.webkit.org/changeset/223691
3465
3466         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
3467         comparison is always false due to limited range of data type
3468         [-Wtype-limits]"
3469         https://bugs.webkit.org/show_bug.cgi?id=178543
3470         https://trac.webkit.org/changeset/223729
3471
3472 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
3473
3474         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
3475         https://bugs.webkit.org/show_bug.cgi?id=178592
3476
3477         Unreviewed test gardening.
3478
3479         * test262.yaml:
3480
3481 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3482
3483         [FTL] Support NewStringObject
3484         https://bugs.webkit.org/show_bug.cgi?id=178737
3485
3486         Reviewed by Saam Barati.
3487
3488         * stress/new-string-object.js: Added.
3489         (shouldBe):
3490         (test):
3491
3492 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
3493
3494         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
3495         https://bugs.webkit.org/show_bug.cgi?id=178308
3496
3497         Reviewed by Mark Lam.
3498
3499         * test262.yaml:
3500
3501 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
3502
3503         [JSC] Use fastJoin in Array#toString
3504         https://bugs.webkit.org/show_bug.cgi?id=178062
3505
3506         Reviewed by Darin Adler.
3507
3508         * microbenchmarks/contiguous-array-to-string.js: Added.
3509         (target):
3510         * microbenchmarks/double-array-to-string.js: Added.
3511         (target):
3512         * microbenchmarks/int32-array-to-string.js: Added.
3513         (target):
3514
3515 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
3516
3517         stress/check-string-ident.js is improperly skipped
3518         https://bugs.webkit.org/show_bug.cgi?id=178642
3519
3520         Reviewed by Saam Barati.
3521
3522         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
3523         since it enforces the run-jsc-stress-tests script to still set up the
3524         test to run, despite the skip directive that's used before.
3525
3526 2017-10-20  Mark Lam  <mark.lam@apple.com>
3527
3528         Add a test case for r214334.
3529         https://bugs.webkit.org/show_bug.cgi?id=169941
3530         <rdar://problem/31221258>
3531
3532         Reviewed by JF Bastien.
3533
3534         * stress/regress-169941.js: Added.
3535
3536 2017-10-19  JF Bastien  <jfbastien@apple.com>
3537
3538         WebAssembly: no VM / JS version of everything but Instance
3539         https://bugs.webkit.org/show_bug.cgi?id=177473
3540
3541         Reviewed by Filip Pizlo, Saam Barati.
3542
3543         - Exceeding max on memory growth now returns a range error as per
3544         spec. This is a (very minor) breaking change: it used to throw OOM
3545         error. Update the corresponding test.
3546
3547         * wasm/js-api/memory-grow.js:
3548         (assertEq):
3549         * wasm/js-api/table.js:
3550         (assert.throws):
3551
3552 2017-10-19  Mark Lam  <mark.lam@apple.com>
3553
3554         Stringifier::appendStringifiedValue() is missing an exception check.
3555         https://bugs.webkit.org/show_bug.cgi?id=178386
3556         <rdar://problem/35027610>
3557
3558         Reviewed by Saam Barati.
3559
3560         * stress/regress-178386.js: Added.
3561
3562 2017-10-19  Michael Saboff  <msaboff@apple.com>
3563
3564         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
3565         https://bugs.webkit.org/show_bug.cgi?id=178521
3566
3567         Reviewed by JF Bastien.
3568
3569         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
3570         now passes with the current version (5.0) of the Emoji spec.
3571
3572 2017-10-19  Robin Morisset  <rmorisset@apple.com>
3573
3574         Turn recursive tail calls into loops
3575         https://bugs.webkit.org/show_bug.cgi?id=176601
3576
3577         Reviewed by Saam Barati.
3578
3579         Add some simple test that computes factorial in several ways, and other trivial computations.
3580         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
3581         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
3582         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
3583         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
3584
3585         * stress/inline-call-to-recursive-tail-call.js: Added.
3586         (factorial.aux):
3587         (factorial):
3588         (factorial2.aux):
3589         (factorial2.id):
3590         (factorial2):
3591         (factorial3.aux):
3592         (factorial3):
3593         (aux):
3594         (factorial4):
3595         (test):
3596
3597 2017-10-18  Mark Lam  <mark.lam@apple.com>
3598
3599         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
3600         https://bugs.webkit.org/show_bug.cgi?id=177600
3601         <rdar://problem/34710985>
3602
3603         Reviewed by Saam Barati.
3604
3605         * stress/regress-177600.js: Added.
3606
3607 2017-10-18  Mark Lam  <mark.lam@apple.com>
3608
3609         The compiler should always register a structure when it adds its transitionWatchPointSet.
3610         https://bugs.webkit.org/show_bug.cgi?id=178420
3611         <rdar://problem/34814024>
3612
3613         Reviewed by Saam Barati and Filip Pizlo.
3614
3615         * stress/regress-178420.js: Added.
3616         (new.Array.10000.map):
3617
3618 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3619
3620         [JSC] __proto__ getter should be fast
3621         https://bugs.webkit.org/show_bug.cgi?id=178067
3622
3623         Reviewed by Saam Barati.
3624
3625         * stress/dfg-object-proto-accessor.js: Added.
3626         (shouldBe):
3627         (shouldThrow):
3628         (target):
3629         * stress/dfg-object-proto-getter.js: Added.
3630         (shouldBe):
3631         (shouldThrow):
3632         (target):
3633         * stress/dfg-object-prototype-of.js: Added.
3634         (shouldBe):
3635         (shouldThrow):
3636         (target):
3637         * stress/dfg-reflect-get-prototype-of.js: Added.
3638         (shouldBe):
3639         (shouldThrow):
3640         (target):
3641         * stress/intrinsic-getter-with-poly-proto.js: Added.
3642         (shouldBe):
3643         (makePolyProtoObject.foo.C):
3644         (makePolyProtoObject.foo):
3645         (makePolyProtoObject):
3646         (target):
3647         * stress/object-get-prototype-of-filtered.js: Added.
3648         (shouldBe):
3649         (shouldThrow):
3650         (target):
3651         (i.Cocoa):
3652         * stress/object-get-prototype-of-mono-proto.js: Added.
3653         (shouldBe):
3654         (makePolyProtoObject.foo.C):
3655         (makePolyProtoObject.foo):
3656         (makePolyProtoObject):
3657         (target):
3658         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
3659         (shouldBe):
3660         (makePolyProtoObject.foo.C):
3661         (makePolyProtoObject.foo):
3662         (makePolyProtoObject):
3663         (target):
3664         * stress/object-get-prototype-of-poly-proto.js: Added.
3665         (shouldBe):
3666         (makePolyProtoObject.foo.C):
3667         (makePolyProtoObject.foo):
3668         (makePolyProtoObject):
3669         (target):
3670         * stress/object-proto-getter-filtered.js: Added.
3671         (shouldBe):
3672         (shouldThrow):
3673         (target):
3674         (i.Cocoa):
3675         * stress/object-proto-getter-poly-mono-proto.js: Added.
3676         (shouldBe):
3677         (makePolyProtoObject.foo.C):
3678         (makePolyProtoObject.foo):
3679         (makePolyProtoObject):
3680         (target):
3681         * stress/object-proto-getter-poly-proto.js: Added.
3682         (shouldBe):
3683         (makePolyProtoObject.foo.C):
3684         (makePolyProtoObject.foo):
3685         (makePolyProtoObject):
3686         (target):
3687         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
3688         * stress/string-proto.js: Added.
3689         (shouldBe):
3690         (target):
3691
3692 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
3693
3694         Unreviewed, rolling out r223523.
3695
3696         A test for this change is failing on debug JSC bots.
3697
3698         Reverted changeset:
3699
3700         "[JSC] __proto__ getter should be fast"
3701         https://bugs.webkit.org/show_bug.cgi?id=178067
3702         https://trac.webkit.org/changeset/223523
3703
3704 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
3705
3706         [JSC] __proto__ getter should be fast
3707         https://bugs.webkit.org/show_bug.cgi?id=178067
3708
3709         Reviewed by Saam Barati.
3710
3711         * stress/dfg-object-proto-accessor.js: Added.
3712         (shouldBe):
3713         (shouldThrow):
3714         (target):
3715         * stress/dfg-object-proto-getter.js: Added.
3716         (shouldBe):
3717         (shouldThrow):
3718         (target):
3719         * stress/dfg-object-prototype-of.js: Added.
3720         (shouldBe):
3721         (shouldThrow):
3722         (target):
3723         * stress/dfg-reflect-get-prototype-of.js: Added.
3724         (shouldBe):
3725         (shouldThrow):
3726         (target):
3727         * stress/object-get-prototype-of-filtered.js: Added.
3728         (shouldBe):
3729         (shouldThrow):
3730         (target):
3731         (i.Cocoa):
3732         * stress/object-get-prototype-of-mono-proto.js: Added.
3733         (shouldBe):
3734         (makePolyProtoObject.foo.C):
3735         (makePolyProtoObject.foo):
3736         (makePolyProtoObject):
3737         (target):
3738         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
3739         (shouldBe):
3740         (makePolyProtoObject.foo.C):
3741         (makePolyProtoObject.foo):
3742         (makePolyProtoObject):
3743         (target):
3744         * stress/object-get-prototype-of-poly-proto.js: Added.
3745         (shouldBe):
3746         (makePolyProtoObject.foo.C):
3747         (makePolyProtoObject.foo):
3748         (makePolyProtoObject):
3749         (target):
3750         * stress/object-proto-getter-filtered.js: Added.
3751         (shouldBe):
3752         (shouldThrow):
3753         (target):
3754         (i.Cocoa):
3755         * stress/object-proto-getter-poly-mono-proto.js: Added.
3756         (shouldBe):
3757         (makePolyProtoObject.foo.C):
3758         (makePolyProtoObject.foo):
3759         (makePolyProtoObject):
3760         (target):
3761         * stress/object-proto-getter-poly-proto.js: Added.
3762         (shouldBe):
3763         (makePolyProtoObject.foo.C):
3764         (makePolyProtoObject.foo):
3765         (makePolyProtoObject):
3766         (target):
3767         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
3768         * stress/string-proto.js: Added.
3769         (shouldBe):
3770         (target):
3771
3772 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
3773
3774         Reland "Add Above/Below comparisons for UInt32 patterns"
3775         https://bugs.webkit.org/show_bug.cgi?id=177281
3776
3777         Reviewed by Saam Barati.
3778
3779         * stress/uint32-comparison-jump.js: Added.
3780         (shouldBe):
3781         (above):
3782         (aboveOrEqual):
3783         (below):
3784         (belowOrEqual):
3785         (notAbove):
3786         (notAboveOrEqual):
3787         (notBelow):
3788         (notBelowOrEqual):
3789         * stress/uint32-comparison.js: Added.
3790         (shouldBe):
3791         (above):
3792         (aboveOrEqual):
3793         (below):
3794         (belowOrEqual):
3795         (aboveTest):
3796         (aboveOrEqualTest):
3797         (belowTest):
3798         (belowOrEqualTest):
3799
3800 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3801
3802         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
3803         https://bugs.webkit.org/show_bug.cgi?id=178210
3804
3805         Reviewed by Saam Barati.
3806
3807         * wasm/function-tests/trap-from-start-async.js:
3808         (async.StartTrapsAsync):
3809         * wasm/function-tests/trap-from-start.js:
3810         (StartTraps):
3811         * wasm/js-api/web-assembly-function.js:
3812         (assert.eq.Object.getPrototypeOf):
3813         * wasm/js-api/wrapper-function.js:
3814         (return.new.WebAssembly.Module):
3815         (assert.throws.makeInstance): Deleted.
3816         (assert.throws.Bar): Deleted.
3817         (assert.throws): Deleted.
3818
3819 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
3820
3821         Enable gigacage on iOS
3822         https://bugs.webkit.org/show_bug.cgi?id=177586
3823
3824         Reviewed by JF Bastien.
3825
3826         Add tests for when Gigacage gets runtime disabled.
3827
3828         * stress/disable-gigacage-arrays.js: Added.
3829         (foo):
3830         * stress/disable-gigacage-strings.js: Added.
3831         (foo):
3832         * stress/disable-gigacage-typed-arrays.js: Added.
3833         (foo):
3834
3835 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
3836
3837         import.meta should not be assignable
3838         https://bugs.webkit.org/show_bug.cgi?id=178202
3839
3840         Reviewed by Saam Barati.
3841
3842         * modules/import-meta-assignment.js: Added.
3843         (shouldThrow):
3844         (SyntaxError.import.meta.can.shouldThrow):
3845
3846 2017-10-11  Saam Barati  <sbarati@apple.com>
3847
3848         Unreviewed. Actually skip certain type profiler tests in debug.
3849
3850         * typeProfiler.yaml:
3851         * typeProfiler/deltablue-for-of.js:
3852         * typeProfiler/getter-richards.js:
3853
3854 2017-10-11  Commit Queue  <commit-queue@webkit.org>
3855
3856         Unreviewed, rolling out r223113 and r223121.
3857         https://bugs.webkit.org/show_bug.cgi?id=178182
3858
3859         Reintroduced 20% regression on Kraken (Requested by rniwa on
3860         #webkit).
3861
3862         Reverted changesets:
3863
3864         "Enable gigacage on iOS"
3865         https://bugs.webkit.org/show_bug.cgi?id=177586
3866         https://trac.webkit.org/changeset/223113
3867
3868         "Use one virtual allocation for all gigacages and their
3869         runways"
3870         https://bugs.webkit.org/show_bug.cgi?id=178050
3871         https://trac.webkit.org/changeset/223121
3872
3873 2017-10-11  Michael Saboff  <msaboff@apple.com>
3874
3875         Disable test262 named capture group tests with direct unicode names and with references before definitions
3876         https://bugs.webkit.org/show_bug.cgi?id=178177
3877
3878         Reviewed by Keith Miller.
3879
3880         Bugs to track fixing these test are:
3881         https://bugs.webkit.org/show_bug.cgi?id=178174 -
3882             "Add support in named capture group identifiers for direct surrogate pairs"
3883         https://bugs.webkit.org/show_bug.cgi?id=178175 -
3884             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
3885
3886         * test262.yaml:
3887
3888 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
3889
3890         Object properties are undefined in super.call() but not in this.call()
3891         https://bugs.webkit.org/show_bug.cgi?id=177230
3892
3893         Reviewed by Saam Barati.
3894
3895         * stress/super-call-function-subclass.js: Added.
3896         (assert):
3897         (A.prototype.t):
3898         (A):
3899         * stress/super-dot-call-and-apply.js: Added.
3900         (assert):
3901         (A):
3902         (A.prototype.call):
3903         (A.prototype.apply):
3904         (B.prototype.testSuper):
3905         (B):
3906         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
3907         (D.prototype.testSuper):
3908         (D):
3909
3910 2017-10-10  Saam Barati  <sbarati@apple.com>
3911
3912         The prototype cache should be aware of the Executable it generates a Structure for
3913         https://bugs.webkit.org/show_bug.cgi?id=177907
3914
3915         Reviewed by Filip Pizlo.
3916
3917         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
3918         (assert):
3919         (foo.C):
3920         (foo):
3921         (bar.C):
3922         (bar):
3923         (access):
3924         (makeLongChain):
3925         (accessY):
3926
3927 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
3928
3929         `async` should be able to be used as an imported binding name
3930         https://bugs.webkit.org/show_bug.cgi?id=176573
3931
3932         Reviewed by Saam Barati.
3933
3934         * modules/import-default-async.js: Added.
3935         * modules/import-named-async-as.js: Added.
3936         * modules/import-named-async.js: Added.
3937         * modules/import-named-async/target.js: Added.
3938         * modules/import-namespace-async.js: Added.
3939         * test262.yaml:
3940
3941 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
3942
3943         Enable gigacage on iOS
3944         https://bugs.webkit.org/show_bug.cgi?id=177586
3945
3946         Reviewed by JF Bastien.
3947
3948         Add tests for when Gigacage gets runtime disabled.
3949
3950         * stress/disable-gigacage-arrays.js: Added.
3951         (foo):
3952         * stress/disable-gigacage-strings.js: Added.
3953         (foo):
3954         * stress/disable-gigacage-typed-arrays.js: Added.
3955         (foo):
3956
3957 2017-10-09  Michael Saboff  <msaboff@apple.com>
3958
3959         Implement RegExp Unicode property escapes
3960         https://bugs.webkit.org/show_bug.cgi?id=172069
3961
3962         Reviewed by JF Bastien.
3963
3964         Enabled Unicode Property tests.
3965
3966         * test262.yaml:
3967
3968 2017-10-09  Commit Queue  <commit-queue@webkit.org>
3969
3970         Unreviewed, rolling out r223015 and r223025.
3971         https://bugs.webkit.org/show_bug.cgi?id=178093
3972
3973         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
3974         #webkit).
3975
3976         Reverted changesets:
3977
3978         "Enable gigacage on iOS"
3979         https://bugs.webkit.org/show_bug.cgi?id=177586
3980         http://trac.webkit.org/changeset/223015
3981
3982         "Unreviewed, disable Gigacage on ARM64 Linux"
3983         https://bugs.webkit.org/show_bug.cgi?id=177586
3984         http://trac.webkit.org/changeset/223025
3985
3986 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
3987
3988         Update expectations for test262 tests that pass after r223043.
3989         https://bugs.webkit.org/show_bug.cgi?id=176685
3990
3991         Unreviewed test gardening.
3992
3993         * test262.yaml:
3994
3995 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
3996
3997         Unreviewed, rolling out r223022.
3998
3999         This change introduced 18 test262 failures.
4000
4001         Reverted changeset:
4002
4003         "`async` should be able to be used as an imported binding
4004         name"
4005         https://bugs.webkit.org/show_bug.cgi?id=176573
4006         http://trac.webkit.org/changeset/223022
4007
4008 2017-10-09  Saam Barati  <sbarati@apple.com>
4009
4010         3 poly-proto JSC tests timing out on debug after r222827
4011         https://bugs.webkit.org/show_bug.cgi?id=177880
4012         <rdar://problem/34817122>
4013
4014         Unreviewed.
4015
4016         I'm skipping these type profiler tests on debug since they are long running.
4017
4018         * typeProfiler/deltablue-for-of.js:
4019         * typeProfiler/getter-richards.js:
4020
4021 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
4022
4023         Safari 10 /11 problem with if (!await get(something)).
4024         https://bugs.webkit.org/show_bug.cgi?id=176685
4025
4026         Reviewed by Saam Barati.
4027
4028         * stress/async-await-basic.js:
4029         (awaitEpression.async):
4030         * stress/async-await-syntax.js:
4031         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
4032         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
4033
4034 2017-10-08  Saam Barati  <sbarati@apple.com>
4035
4036         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
4037
4038         * typeProfiler/deltablue-for-of.js:
4039         * typeProfiler/getter-richards.js:
4040
4041 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
4042
4043         `async` should be able to be used as an imported binding name
4044         https://bugs.webkit.org/show_bug.cgi?id=176573
4045
4046         Reviewed by Darin Adler.
4047
4048         * modules/import-default-async.js: Added.
4049         * modules/import-named-async-as.js: Added.
4050         * modules/import-named-async.js: Added.
4051         * modules/import-named-async/target.js: Added.
4052         * modules/import-namespace-async.js: Added.
4053
4054 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
4055
4056         Enable gigacage on iOS
4057         https://bugs.webkit.org/show_bug.cgi?id=177586
4058
4059         Reviewed by JF Bastien.
4060
4061         Add tests for when Gigacage gets runtime disabled.
4062
4063         * stress/disable-gigacage-arrays.js: Added.
4064         (foo):
4065         * stress/disable-gigacage-strings.js: Added.
4066         (foo):
4067         * stress/disable-gigacage-typed-arrays.js: Added.
4068         (foo):
4069
4070 2017-10-06  Commit Queue  <commit-queue@webkit.org>
4071
4072         Unreviewed, rolling out r222791 and r222873.
4073         https://bugs.webkit.org/show_bug.cgi?id=178031
4074
4075         Caused crashes with workers/wasm LayoutTests (Requested by
4076         ryanhaddad on #webkit).
4077
4078         Reverted changesets:
4079
4080         "WebAssembly: no VM / JS version of everything but Instance"
4081         https://bugs.webkit.org/show_bug.cgi?id=177473
4082         http://trac.webkit.org/changeset/222791
4083
4084         "WebAssembly: address no VM / JS follow-ups"
4085         https://bugs.webkit.org/show_bug.cgi?id=177887
4086         http://trac.webkit.org/changeset/222873
4087
4088 2017-10-05  Saam Barati  <sbarati@apple.com>
4089
4090         Make sure all prototypes under poly proto get added into the VM's prototype map
4091         https://bugs.webkit.org/show_bug.cgi?id=177909
4092
4093         Reviewed by Keith Miller.
4094
4095         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
4096         (assert):
4097         (foo.C):
4098         (foo):
4099         (set x):
4100
4101 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
4102
4103         [JSC] Introduce import.meta
4104         https://bugs.webkit.org/show_bug.cgi?id=177703
4105
4106         Reviewed by Filip Pizlo.
4107
4108         * modules/import-meta-syntax.js: Added.
4109         (shouldThrow):
4110         (shouldNotThrow):
4111         * modules/import-meta.js: Added.
4112         * modules/import-meta/cocoa.js: Added.
4113         * modules/resources/assert.js:
4114         (export.shouldNotThrow):
4115         * stress/import-syntax.js:
4116
4117 2017-10-04  Saam Barati  <sbarati@apple.com>
4118
4119         Make pertinent AccessCases watch the poly proto watchpoint
4120         https://bugs.webkit.org/show_bug.cgi?id=177765
4121
4122         Reviewed by Keith Miller.
4123
4124         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
4125         (assert):
4126         (foo.C):
4127         (foo):
4128         (validate):
4129         * stress/poly-proto-clear-stub.js: Added.
4130         (assert):
4131         (foo.C):
4132         (foo):
4133
4134 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
4135
4136         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
4137
4138         Unreviewed test gardening.
4139
4140         * test262.yaml:
4141
4142 2017-10-04  Saam Barati  <sbarati@apple.com>
4143
4144         3 poly-proto JSC tests timing out on debug after r222827
4145         https://bugs.webkit.org/show_bug.cgi?id=177880
4146
4147         Rubber stamped by Mark Lam.
4148
4149         * microbenchmarks/poly-proto-access.js:
4150         * typeProfiler/deltablue-for-of.js:
4151         * typeProfiler/getter-richards.js:
4152
4153 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
4154
4155         Unreviewed, marking tco-catch.js as a failure after test262 update
4156         https://bugs.webkit.org/show_bug.cgi?id=177859
4157
4158         * test262.yaml:
4159
4160 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
4161
4162         Unreviewed, marking one async iterator test262 test failed
4163         https://bugs.webkit.org/show_bug.cgi?id=177859
4164
4165         * test262.yaml:
4166
4167 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
4168
4169         [Test262] Update Test262 to Oct 4 version
4170         https://bugs.webkit.org/show_bug.cgi?id=177859
4171
4172         Reviewed by Sam Weinig.
4173
4174         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
4175         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
4176
4177         * test262.yaml:
4178         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
4179         (checkSequence):
4180         * test262/harness/typeCoercion.js:
4181         (testCoercibleToIndexZero):
4182         (testCoercibleToIndexOne):
4183         (testCoercibleToIndexFromIndex):
4184         (testNotCoercibleToIndex.testPrimitiveValue):
4185         (testNotCoercibleToInteger):
4186         (testCoercibleToBigIntZero.testPrimitiveValue):
4187         (testCoercibleToBigIntZero):
4188         (testCoercibleToBigIntOne.testPrimitiveValue):
4189         (testCoercibleToBigIntOne):
4190         (testPrimitiveValue):
4191         (testCoercibleToBigIntFromBigInt):
4192         (testNotCoercibleToBigInt.testPrimitiveValue):
4193         (testNotCoercibleToBigInt.testStringValue):
4194         (testNotCoercibleToBigInt):
4195         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
4196         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
4197         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
4198         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
4199         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
4200         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
4201         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
4202         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
4203         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
4204         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
4205         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
4206         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
4207         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
4208         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
4209         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
4210         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
4211         (testCoercibleToBigIntZero):
4212         (testCoercibleToBigIntOne):
4213         (testNotCoercibleToBigInt):
4214         (MyError): Deleted.
4215         (valueOf): Deleted.
4216         (toString): Deleted.
4217         (Symbol.toPrimitive): Deleted.
4218         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
4219         (testCoercibleToIndexZero):
4220         (testCoercibleToIndexOne):
4221         (testNotCoercibleToIndex):
4222         (MyError): Deleted.
4223         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
4224         (assert.sameValue.BigInt.asIntN.toString): Deleted.
4225         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
4226         (BigInt.asIntN.valueOf): Deleted.
4227         (BigInt.asIntN.toString): Deleted.
4228         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
4229         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
4230         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
4231         (testCoercibleToBigIntZero):
4232         (testCoercibleToBigIntOne):
4233         (testNotCoercibleToBigInt):
4234         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
4235         (testCoercibleToIndexZero):
4236         (testCoercibleToIndexOne):
4237         (testNotCoercibleToIndex):
4238         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
4239         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
4240         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
4241         (bits.valueOf):
4242         (bigint.valueOf):
4243         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
4244         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
4245         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
4246         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
4247         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
4248         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
4249         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
4250         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
4251         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
4252         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
4253         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
4254         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
4255         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
4256         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
4257         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
4258         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
4259         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
4260         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
4261         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
4262         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
4263         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
4264         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
4265         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
4266         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
4267         (replacer):
4268         (BigInt.prototype.toJSON):
4269         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
4270         (replacer):
4271         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
4272         (BigInt.prototype.toJSON):
4273         * test262/test/built-ins/JSON/stringify/bigint.js:
4274         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
4275         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
4276         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
4277         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
4278         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
4279         * test262/test/built-ins/Object/proto-from-ctor.js:
4280         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
4281         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
4282         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
4283         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
4284         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
4285         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
4286         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
4287         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
4288         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
4289         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
4290         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
4291         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
4292         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
4293         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
4294         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
4295         * test262/test/built-ins/Proxy/get-fn-realm.js:
4296         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
4297         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
4298         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
4299         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
4300         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
4301         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
4302         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
4303         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
4304         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
4305         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
4306         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
4307         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
4308         (i6.replace):
4309         (i6b.replace):
4310         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
4311         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
4312         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
4313         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
4314         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
4315         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
4316         * test262/test/built-ins/RegExp/u180e.js: Added.
4317         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
4318         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
4319         * test262/test/built-ins/String/proto-from-ctor-realm.js:
4320         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
4321         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
4322         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
4323         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
4324         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
4325         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
4326         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
4327         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
4328         * test262/test/built-ins/String/prototype/endsWith/length.js:
4329         * test262/test/built-ins/String/prototype/endsWith/name.js:
4330         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
4331         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
4332         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
4333         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
4334         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
4335         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
4336         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
4337         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
4338         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
4339         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
4340         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
4341         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
4342         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
4343         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
4344         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
4345         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
4346         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
4347         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
4348         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
4349         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
4350         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
4351         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
4352         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
4353         * test262/test/built-ins/String/prototype/includes/includes.js:
4354         * test262/test/built-ins/String/prototype/includes/length.js:
4355         * test262/test/built-ins/String/prototype/includes/name.js:
4356         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
4357         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
4358         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
4359         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
4360         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
4361         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
4362         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
4363         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
4364         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
4365         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
4366         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
4367         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
4368         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
4369         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
4370         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
4371         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
4372         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
4373         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
4374         * test262/test/built-ins/String/prototype/trim/u180e.js:
4375         * test262/test/built-ins/Symbol/for/cross-realm.js:
4376         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
4377         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
4378         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
4379         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
4380         * test262/test/built-ins/Symbol/match/cross-realm.js:
4381         * test262/test/built-ins/Symbol/replace/cross-realm.js:
4382         * test262/test/built-ins/Symbol/search/cross-realm.js:
4383         * test262/test/built-ins/Symbol/species/cross-realm.js:
4384         * test262/test/built-ins/Symbol/split/cross-realm.js:
4385         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
4386         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
4387         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
4388         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
4389         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
4390         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
4391         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
4392         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
4393         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
4394         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
4395         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
4396         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
4397         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
4398         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
4399         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
4400         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
4401         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
4402         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
4403         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
4404         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
4405         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
4406         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
4407         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
4408         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
4409         * test262/test/language/comments/mongolian-vowel-separator-single.js:
4410         * test262/test/language/eval-code/indirect/realm.js:
4411         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
4412         (o.get z):
4413         (o.get a):
4414         * test262/test/language/expressions/call/eval-realm-indirect.js:
4415         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
4416         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
4417         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
4418         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
4419         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
4420         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.