1 2017-11-21 Yusuke Suzuki <utatane.tea@gmail.com>
3 [DFG][FTL] Support MapSet / SetAdd intrinsics
4 https://bugs.webkit.org/show_bug.cgi?id=179858
6 Reviewed by Saam Barati.
8 * microbenchmarks/map-has-and-set.js: Added.
10 * stress/map-set-check-failure.js: Added.
14 * stress/map-set-cse.js: Added.
17 * stress/set-add-check-failure.js: Added.
21 * stress/set-add-cse.js: Added.
24 2017-11-21 Yusuke Suzuki <utatane.tea@gmail.com>
26 [JSC] Allow poly proto for intrinsic getters
27 https://bugs.webkit.org/show_bug.cgi?id=179550
29 Reviewed by Saam Barati.
31 This change is also tested by existing tests.
33 1. stress/intrinsic-getter-with-poly-proto.js
34 2. stress/poly-proto-intrinsic-getter-correctness.js
36 * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
38 (makePolyProtoObject.foo.C):
39 (makePolyProtoObject.foo):
40 (makePolyProtoObject):
42 * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
44 (makePolyProtoObject.foo.C):
45 (makePolyProtoObject.foo):
46 (makePolyProtoObject):
49 2017-11-20 Guillaume Emont <guijemont@igalia.com>
51 Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
52 https://bugs.webkit.org/show_bug.cgi?id=179744
54 Reviewed by Michael Catanzaro.
56 This test uses too much memory for our buildbots on these platforms
59 * stress/unshiftCountSlowCase-correct-postCapacity.js:
60 Skip if $memoryLimited and linux.
62 2017-11-17 JF Bastien <jfbastien@apple.com>
64 WebAssembly JS API: throw when a promise can't be created
65 https://bugs.webkit.org/show_bug.cgi?id=179826
66 <rdar://problem/35455813>
70 Test WebAssembly.{compile,instantiate} where promise creation
71 fails because of a stack overflow.
73 * wasm/js-api/promise-stack-overflow.js: Added.
74 (const.runNearStackLimit.f.const.t):
76 (async.testInstantiate):
78 2017-11-16 Yusuke Suzuki <utatane.tea@gmail.com>
80 Unreviewed, mark regress-178385.js as memory exhausting
82 * stress/regress-178385.js:
84 2017-11-16 Ryan Haddad <ryanhaddad@apple.com>
86 Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
88 Unreviewed test gardening.
92 2017-11-16 Robin Morisset <rmorisset@apple.com>
94 REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
95 https://bugs.webkit.org/show_bug.cgi?id=179763
96 <rdar://problem/35550513>
98 Reviewed by Keith Miller.
100 Just adding a slightly cleaned-up version of the original fuzzer-found test.
102 * stress/tdz-this-in-try-catch.js: Added.
106 2017-11-14 Yusuke Suzuki <utatane.tea@gmail.com>
108 [DFG][FTL] Support Array::DirectArguments with OutOfBounds
109 https://bugs.webkit.org/show_bug.cgi?id=179594
111 Reviewed by Saam Barati.
113 * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
116 * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
120 2017-11-14 Saam Barati <sbarati@apple.com>
122 We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
123 https://bugs.webkit.org/show_bug.cgi?id=179639
124 <rdar://problem/35513018>
126 Reviewed by JF Bastien.
128 * wasm/function-tests/grow-memory-cause-gc.js: Added.
132 2017-11-13 Mark Lam <mark.lam@apple.com>
134 Add more overflow check book-keeping for MarkedArgumentBuffer.
135 https://bugs.webkit.org/show_bug.cgi?id=179634
136 <rdar://problem/35492517>
138 Reviewed by Saam Barati.
140 * stress/regress-179634.js: Added.
142 2017-11-13 Mark Lam <mark.lam@apple.com>
144 Make the jsc shell loadGetterFromGetterSetter() function more robust.
145 https://bugs.webkit.org/show_bug.cgi?id=179619
146 <rdar://problem/35492518>
148 Reviewed by Saam Barati.
150 * stress/regress-179619.js: Added.
152 2017-11-12 Mark Lam <mark.lam@apple.com>
154 We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
155 https://bugs.webkit.org/show_bug.cgi?id=179562
156 <rdar://problem/35467022>
158 Reviewed by Saam Barati.
160 * regress-179562.js: Added.
162 2017-11-08 Saam Barati <sbarati@apple.com>
164 A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
165 https://bugs.webkit.org/show_bug.cgi?id=177792
167 Reviewed by Yusuke Suzuki.
169 * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
171 (foo.Foo.prototype.ensureX):
176 2017-11-08 Ryan Haddad <ryanhaddad@apple.com>
178 Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
179 https://bugs.webkit.org/show_bug.cgi?id=178592
181 Unreviewed test gardening.
185 2017-11-08 Robin Morisset <rmorisset@apple.com>
187 Turn recursive tail calls into loops
188 https://bugs.webkit.org/show_bug.cgi?id=176601
190 Reviewed by Saam Barati.
192 Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
194 Add some simple test that computes factorial in several ways, and other trivial computations.
195 They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
196 Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
197 I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
198 (which it doesn't if that tail call is transformed into a loop in the unsound cases).
200 * stress/inline-call-to-recursive-tail-call.js: Added.
215 2017-11-07 Mark Lam <mark.lam@apple.com>
217 AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
218 https://bugs.webkit.org/show_bug.cgi?id=179355
219 <rdar://problem/35263053>
221 Reviewed by Saam Barati.
223 * stress/regress-179355.js: Added.
225 2017-11-05 Yusuke Suzuki <utatane.tea@gmail.com>
227 JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
228 https://bugs.webkit.org/show_bug.cgi?id=144458
230 Reviewed by Saam Barati.
232 * microbenchmarks/dfg-internal-function-call.js: Added.
234 * microbenchmarks/dfg-internal-function-construct.js: Added.
236 * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
238 * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
240 * stress/dfg-internal-function-call.js: Added.
243 * stress/dfg-internal-function-construct.js: Added.
246 * stress/internal-function-call.js: Added.
248 * stress/internal-function-construct.js: Added.
251 2017-11-05 Per Arne Vollan <pvollan@apple.com>
253 [Win] Skip stress/regress-178385.js.
254 https://bugs.webkit.org/show_bug.cgi?id=179298
256 Unreviewed test gardening.
258 * stress/regress-178385.js:
260 2017-11-03 Keith Miller <keith_miller@apple.com>
262 Add test for ic with side effects
263 https://bugs.webkit.org/show_bug.cgi?id=179268
265 Reviewed by Saam Barati.
267 * stress/put-inline-cache-side-effects.js: Added.
268 (let.i.of.objs.keys):
271 2017-11-03 Mark Lam <mark.lam@apple.com>
273 CachedCall (and its clients) needs overflow checks.
274 https://bugs.webkit.org/show_bug.cgi?id=179185
276 Reviewed by JF Bastien.
278 * stress/regress-179185.js: Added.
280 2017-11-02 Michael Saboff <msaboff@apple.com>
282 DFG needs to handle code motion of code in for..in loop bodies
283 https://bugs.webkit.org/show_bug.cgi?id=179212
285 Reviewed by Keith Miller.
289 * stress/for-in-side-effects.js: Added.
297 2017-11-02 Filip Pizlo <fpizlo@apple.com>
299 AI does not correctly model the clobber case of ArithClz32
300 https://bugs.webkit.org/show_bug.cgi?id=179188
302 Reviewed by Michael Saboff.
304 * stress/arith-clz32-effects.js: Added.
308 2017-11-01 Michael Saboff <msaboff@apple.com>
310 Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
311 https://bugs.webkit.org/show_bug.cgi?id=179140
313 Reviewed by Saam Barati.
317 * stress/regress-179140.js: Added.
321 2017-11-01 Yusuke Suzuki <utatane.tea@gmail.com>
323 [JSC] Introduce @toObject
324 https://bugs.webkit.org/show_bug.cgi?id=178726
326 Reviewed by Saam Barati.
328 * stress/array-copywithin.js:
330 * stress/object-constructor-boolean-edge.js: Added.
333 * stress/object-constructor-global.js: Added.
335 * stress/object-constructor-null-edge.js: Added.
338 * stress/object-constructor-number-edge.js: Added.
341 * stress/object-constructor-object-edge.js: Added.
345 * stress/object-constructor-string-edge.js: Added.
348 * stress/object-constructor-symbol-edge.js: Added.
351 * stress/object-constructor-undefined-edge.js: Added.
354 * stress/symbol-array-from.js: Added.
356 * stress/to-object-intrinsic-boolean-edge.js: Added.
358 (builtin.createBuiltin):
359 * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
361 * stress/to-object-intrinsic-number-edge.js: Added.
363 (builtin.createBuiltin):
364 * stress/to-object-intrinsic-object-edge.js: Added.
366 (builtin.createBuiltin):
368 * stress/to-object-intrinsic-string-edge.js: Added.
370 (builtin.createBuiltin):
371 * stress/to-object-intrinsic-symbol-edge.js: Added.
373 (builtin.createBuiltin):
374 * stress/to-object-intrinsic.js: Added.
377 (builtin.createBuiltin):
379 2017-10-27 Yusuke Suzuki <utatane.tea@gmail.com>
381 [DFG][FTL] Introduce StringSlice
382 https://bugs.webkit.org/show_bug.cgi?id=178934
384 Reviewed by Saam Barati.
386 * microbenchmarks/string-slice-empty.js: Added.
388 * microbenchmarks/string-slice-one-char.js: Added.
390 * microbenchmarks/string-slice.js: Added.
393 2017-10-26 Michael Saboff <msaboff@apple.com>
395 REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
396 https://bugs.webkit.org/show_bug.cgi?id=178890
398 Reviewed by Keith Miller.
402 * stress/regress-178890.js: Added.
404 2017-10-26 Mark Lam <mark.lam@apple.com>
406 JSRopeString::RopeBuilder::append() should check for overflows.
407 https://bugs.webkit.org/show_bug.cgi?id=178385
408 <rdar://problem/35027468>
410 Reviewed by Saam Barati.
412 * stress/regress-178385.js: Added.
414 2017-10-26 Ryan Haddad <ryanhaddad@apple.com>
416 Unreviewed, rolling out r223961.
418 The change that required this has been rolled out.
422 "Mark test262.yaml/test262/test/language/statements/try/tco-
423 catch.js as passing."
424 https://bugs.webkit.org/show_bug.cgi?id=178592
425 https://trac.webkit.org/changeset/223961
427 2017-10-25 Commit Queue <commit-queue@webkit.org>
429 Unreviewed, rolling out r223691 and r223729.
430 https://bugs.webkit.org/show_bug.cgi?id=178834
432 Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
433 by rniwa on #webkit).
437 "Turn recursive tail calls into loops"
438 https://bugs.webkit.org/show_bug.cgi?id=176601
439 https://trac.webkit.org/changeset/223691
441 "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
442 comparison is always false due to limited range of data type
444 https://bugs.webkit.org/show_bug.cgi?id=178543
445 https://trac.webkit.org/changeset/223729
447 2017-10-25 Ryan Haddad <ryanhaddad@apple.com>
449 Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
450 https://bugs.webkit.org/show_bug.cgi?id=178592
452 Unreviewed test gardening.
456 2017-10-24 Yusuke Suzuki <utatane.tea@gmail.com>
458 [FTL] Support NewStringObject
459 https://bugs.webkit.org/show_bug.cgi?id=178737
461 Reviewed by Saam Barati.
463 * stress/new-string-object.js: Added.
467 2017-10-15 Yusuke Suzuki <utatane.tea@gmail.com>
469 [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
470 https://bugs.webkit.org/show_bug.cgi?id=178308
472 Reviewed by Mark Lam.
476 2017-10-23 Yusuke Suzuki <utatane.tea@gmail.com>
478 [JSC] Use fastJoin in Array#toString
479 https://bugs.webkit.org/show_bug.cgi?id=178062
481 Reviewed by Darin Adler.
483 * microbenchmarks/contiguous-array-to-string.js: Added.
485 * microbenchmarks/double-array-to-string.js: Added.
487 * microbenchmarks/int32-array-to-string.js: Added.
490 2017-10-22 Zan Dobersek <zdobersek@igalia.com>
492 stress/check-string-ident.js is improperly skipped
493 https://bugs.webkit.org/show_bug.cgi?id=178642
495 Reviewed by Saam Barati.
497 * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
498 since it enforces the run-jsc-stress-tests script to still set up the
499 test to run, despite the skip directive that's used before.
501 2017-10-20 Mark Lam <mark.lam@apple.com>
503 Add a test case for r214334.
504 https://bugs.webkit.org/show_bug.cgi?id=169941
505 <rdar://problem/31221258>
507 Reviewed by JF Bastien.
509 * stress/regress-169941.js: Added.
511 2017-10-19 JF Bastien <jfbastien@apple.com>
513 WebAssembly: no VM / JS version of everything but Instance
514 https://bugs.webkit.org/show_bug.cgi?id=177473
516 Reviewed by Filip Pizlo, Saam Barati.
518 - Exceeding max on memory growth now returns a range error as per
519 spec. This is a (very minor) breaking change: it used to throw OOM
520 error. Update the corresponding test.
522 * wasm/js-api/memory-grow.js:
524 * wasm/js-api/table.js:
527 2017-10-19 Mark Lam <mark.lam@apple.com>
529 Stringifier::appendStringifiedValue() is missing an exception check.
530 https://bugs.webkit.org/show_bug.cgi?id=178386
531 <rdar://problem/35027610>
533 Reviewed by Saam Barati.
535 * stress/regress-178386.js: Added.
537 2017-10-19 Michael Saboff <msaboff@apple.com>
539 Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
540 https://bugs.webkit.org/show_bug.cgi?id=178521
542 Reviewed by JF Bastien.
544 * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
545 now passes with the current version (5.0) of the Emoji spec.
547 2017-10-19 Robin Morisset <rmorisset@apple.com>
549 Turn recursive tail calls into loops
550 https://bugs.webkit.org/show_bug.cgi?id=176601
552 Reviewed by Saam Barati.
554 Add some simple test that computes factorial in several ways, and other trivial computations.
555 They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
556 Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
557 I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
558 (which it doesn't if that tail call is transformed into a loop in the unsound cases).
560 * stress/inline-call-to-recursive-tail-call.js: Added.
572 2017-10-18 Mark Lam <mark.lam@apple.com>
574 RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
575 https://bugs.webkit.org/show_bug.cgi?id=177600
576 <rdar://problem/34710985>
578 Reviewed by Saam Barati.
580 * stress/regress-177600.js: Added.
582 2017-10-18 Mark Lam <mark.lam@apple.com>
584 The compiler should always register a structure when it adds its transitionWatchPointSet.
585 https://bugs.webkit.org/show_bug.cgi?id=178420
586 <rdar://problem/34814024>
588 Reviewed by Saam Barati and Filip Pizlo.
590 * stress/regress-178420.js: Added.
591 (new.Array.10000.map):
593 2017-10-18 Yusuke Suzuki <utatane.tea@gmail.com>
595 [JSC] __proto__ getter should be fast
596 https://bugs.webkit.org/show_bug.cgi?id=178067
598 Reviewed by Saam Barati.
600 * stress/dfg-object-proto-accessor.js: Added.
604 * stress/dfg-object-proto-getter.js: Added.
608 * stress/dfg-object-prototype-of.js: Added.
612 * stress/dfg-reflect-get-prototype-of.js: Added.
616 * stress/intrinsic-getter-with-poly-proto.js: Added.
618 (makePolyProtoObject.foo.C):
619 (makePolyProtoObject.foo):
620 (makePolyProtoObject):
622 * stress/object-get-prototype-of-filtered.js: Added.
627 * stress/object-get-prototype-of-mono-proto.js: Added.
629 (makePolyProtoObject.foo.C):
630 (makePolyProtoObject.foo):
631 (makePolyProtoObject):
633 * stress/object-get-prototype-of-poly-mono-proto.js: Added.
635 (makePolyProtoObject.foo.C):
636 (makePolyProtoObject.foo):
637 (makePolyProtoObject):
639 * stress/object-get-prototype-of-poly-proto.js: Added.
641 (makePolyProtoObject.foo.C):
642 (makePolyProtoObject.foo):
643 (makePolyProtoObject):
645 * stress/object-proto-getter-filtered.js: Added.
650 * stress/object-proto-getter-poly-mono-proto.js: Added.
652 (makePolyProtoObject.foo.C):
653 (makePolyProtoObject.foo):
654 (makePolyProtoObject):
656 * stress/object-proto-getter-poly-proto.js: Added.
658 (makePolyProtoObject.foo.C):
659 (makePolyProtoObject.foo):
660 (makePolyProtoObject):
662 * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
663 * stress/string-proto.js: Added.
667 2017-10-17 Ryan Haddad <ryanhaddad@apple.com>
669 Unreviewed, rolling out r223523.
671 A test for this change is failing on debug JSC bots.
675 "[JSC] __proto__ getter should be fast"
676 https://bugs.webkit.org/show_bug.cgi?id=178067
677 https://trac.webkit.org/changeset/223523
679 2017-10-10 Yusuke Suzuki <utatane.tea@gmail.com>
681 [JSC] __proto__ getter should be fast
682 https://bugs.webkit.org/show_bug.cgi?id=178067
684 Reviewed by Saam Barati.
686 * stress/dfg-object-proto-accessor.js: Added.
690 * stress/dfg-object-proto-getter.js: Added.
694 * stress/dfg-object-prototype-of.js: Added.
698 * stress/dfg-reflect-get-prototype-of.js: Added.
702 * stress/object-get-prototype-of-filtered.js: Added.
707 * stress/object-get-prototype-of-mono-proto.js: Added.
709 (makePolyProtoObject.foo.C):
710 (makePolyProtoObject.foo):
711 (makePolyProtoObject):
713 * stress/object-get-prototype-of-poly-mono-proto.js: Added.
715 (makePolyProtoObject.foo.C):
716 (makePolyProtoObject.foo):
717 (makePolyProtoObject):
719 * stress/object-get-prototype-of-poly-proto.js: Added.
721 (makePolyProtoObject.foo.C):
722 (makePolyProtoObject.foo):
723 (makePolyProtoObject):
725 * stress/object-proto-getter-filtered.js: Added.
730 * stress/object-proto-getter-poly-mono-proto.js: Added.
732 (makePolyProtoObject.foo.C):
733 (makePolyProtoObject.foo):
734 (makePolyProtoObject):
736 * stress/object-proto-getter-poly-proto.js: Added.
738 (makePolyProtoObject.foo.C):
739 (makePolyProtoObject.foo):
740 (makePolyProtoObject):
742 * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
743 * stress/string-proto.js: Added.
747 2017-10-14 Yusuke Suzuki <utatane.tea@gmail.com>
749 Reland "Add Above/Below comparisons for UInt32 patterns"
750 https://bugs.webkit.org/show_bug.cgi?id=177281
752 Reviewed by Saam Barati.
754 * stress/uint32-comparison-jump.js: Added.
764 * stress/uint32-comparison.js: Added.
775 2017-10-12 Yusuke Suzuki <utatane.tea@gmail.com>
777 WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
778 https://bugs.webkit.org/show_bug.cgi?id=178210
780 Reviewed by Saam Barati.
782 * wasm/function-tests/trap-from-start-async.js:
783 (async.StartTrapsAsync):
784 * wasm/function-tests/trap-from-start.js:
786 * wasm/js-api/web-assembly-function.js:
787 (assert.eq.Object.getPrototypeOf):
788 * wasm/js-api/wrapper-function.js:
789 (return.new.WebAssembly.Module):
790 (assert.throws.makeInstance): Deleted.
791 (assert.throws.Bar): Deleted.
792 (assert.throws): Deleted.
794 2017-09-29 Filip Pizlo <fpizlo@apple.com>
796 Enable gigacage on iOS
797 https://bugs.webkit.org/show_bug.cgi?id=177586
799 Reviewed by JF Bastien.
801 Add tests for when Gigacage gets runtime disabled.
803 * stress/disable-gigacage-arrays.js: Added.
805 * stress/disable-gigacage-strings.js: Added.
807 * stress/disable-gigacage-typed-arrays.js: Added.
810 2017-10-11 Yusuke Suzuki <utatane.tea@gmail.com>
812 import.meta should not be assignable
813 https://bugs.webkit.org/show_bug.cgi?id=178202
815 Reviewed by Saam Barati.
817 * modules/import-meta-assignment.js: Added.
819 (SyntaxError.import.meta.can.shouldThrow):
821 2017-10-11 Saam Barati <sbarati@apple.com>
823 Unreviewed. Actually skip certain type profiler tests in debug.
826 * typeProfiler/deltablue-for-of.js:
827 * typeProfiler/getter-richards.js:
829 2017-10-11 Commit Queue <commit-queue@webkit.org>
831 Unreviewed, rolling out r223113 and r223121.
832 https://bugs.webkit.org/show_bug.cgi?id=178182
834 Reintroduced 20% regression on Kraken (Requested by rniwa on
839 "Enable gigacage on iOS"
840 https://bugs.webkit.org/show_bug.cgi?id=177586
841 https://trac.webkit.org/changeset/223113
843 "Use one virtual allocation for all gigacages and their
845 https://bugs.webkit.org/show_bug.cgi?id=178050
846 https://trac.webkit.org/changeset/223121
848 2017-10-11 Michael Saboff <msaboff@apple.com>
850 Disable test262 named capture group tests with direct unicode names and with references before definitions
851 https://bugs.webkit.org/show_bug.cgi?id=178177
853 Reviewed by Keith Miller.
855 Bugs to track fixing these test are:
856 https://bugs.webkit.org/show_bug.cgi?id=178174 -
857 "Add support in named capture group identifiers for direct surrogate pairs"
858 https://bugs.webkit.org/show_bug.cgi?id=178175 -
859 "Test262 failure with Named Capture Groups - using a reference before the group is defined"
863 2017-10-11 Caio Lima <ticaiolima@gmail.com>
865 Object properties are undefined in super.call() but not in this.call()
866 https://bugs.webkit.org/show_bug.cgi?id=177230
868 Reviewed by Saam Barati.
870 * stress/super-call-function-subclass.js: Added.
874 * stress/super-dot-call-and-apply.js: Added.
879 (B.prototype.testSuper):
881 (const.obj.new.B.string_appeared_here.obj.testSuper.C):
882 (D.prototype.testSuper):
885 2017-10-10 Saam Barati <sbarati@apple.com>
887 The prototype cache should be aware of the Executable it generates a Structure for
888 https://bugs.webkit.org/show_bug.cgi?id=177907
890 Reviewed by Filip Pizlo.
892 * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
902 2017-10-09 Yusuke Suzuki <utatane.tea@gmail.com>
904 `async` should be able to be used as an imported binding name
905 https://bugs.webkit.org/show_bug.cgi?id=176573
907 Reviewed by Saam Barati.
909 * modules/import-default-async.js: Added.
910 * modules/import-named-async-as.js: Added.
911 * modules/import-named-async.js: Added.
912 * modules/import-named-async/target.js: Added.
913 * modules/import-namespace-async.js: Added.
916 2017-09-29 Filip Pizlo <fpizlo@apple.com>
918 Enable gigacage on iOS
919 https://bugs.webkit.org/show_bug.cgi?id=177586
921 Reviewed by JF Bastien.
923 Add tests for when Gigacage gets runtime disabled.
925 * stress/disable-gigacage-arrays.js: Added.
927 * stress/disable-gigacage-strings.js: Added.
929 * stress/disable-gigacage-typed-arrays.js: Added.
932 2017-10-09 Michael Saboff <msaboff@apple.com>
934 Implement RegExp Unicode property escapes
935 https://bugs.webkit.org/show_bug.cgi?id=172069
937 Reviewed by JF Bastien.
939 Enabled Unicode Property tests.
943 2017-10-09 Commit Queue <commit-queue@webkit.org>
945 Unreviewed, rolling out r223015 and r223025.
946 https://bugs.webkit.org/show_bug.cgi?id=178093
948 Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
953 "Enable gigacage on iOS"
954 https://bugs.webkit.org/show_bug.cgi?id=177586
955 http://trac.webkit.org/changeset/223015
957 "Unreviewed, disable Gigacage on ARM64 Linux"
958 https://bugs.webkit.org/show_bug.cgi?id=177586
959 http://trac.webkit.org/changeset/223025
961 2017-10-09 Ryan Haddad <ryanhaddad@apple.com>
963 Update expectations for test262 tests that pass after r223043.
964 https://bugs.webkit.org/show_bug.cgi?id=176685
966 Unreviewed test gardening.
970 2017-10-09 Ryan Haddad <ryanhaddad@apple.com>
972 Unreviewed, rolling out r223022.
974 This change introduced 18 test262 failures.
978 "`async` should be able to be used as an imported binding
980 https://bugs.webkit.org/show_bug.cgi?id=176573
981 http://trac.webkit.org/changeset/223022
983 2017-10-09 Saam Barati <sbarati@apple.com>
985 3 poly-proto JSC tests timing out on debug after r222827
986 https://bugs.webkit.org/show_bug.cgi?id=177880
987 <rdar://problem/34817122>
991 I'm skipping these type profiler tests on debug since they are long running.
993 * typeProfiler/deltablue-for-of.js:
994 * typeProfiler/getter-richards.js:
996 2017-10-09 Oleksandr Skachkov <gskachkov@gmail.com>
998 Safari 10 /11 problem with if (!await get(something)).
999 https://bugs.webkit.org/show_bug.cgi?id=176685
1001 Reviewed by Saam Barati.
1003 * stress/async-await-basic.js:
1004 (awaitEpression.async):
1005 * stress/async-await-syntax.js:
1006 (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1007 (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1009 2017-10-08 Saam Barati <sbarati@apple.com>
1011 Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1013 * typeProfiler/deltablue-for-of.js:
1014 * typeProfiler/getter-richards.js:
1016 2017-10-07 Yusuke Suzuki <utatane.tea@gmail.com>
1018 `async` should be able to be used as an imported binding name
1019 https://bugs.webkit.org/show_bug.cgi?id=176573
1021 Reviewed by Darin Adler.
1023 * modules/import-default-async.js: Added.
1024 * modules/import-named-async-as.js: Added.
1025 * modules/import-named-async.js: Added.
1026 * modules/import-named-async/target.js: Added.
1027 * modules/import-namespace-async.js: Added.
1029 2017-09-29 Filip Pizlo <fpizlo@apple.com>
1031 Enable gigacage on iOS
1032 https://bugs.webkit.org/show_bug.cgi?id=177586
1034 Reviewed by JF Bastien.
1036 Add tests for when Gigacage gets runtime disabled.
1038 * stress/disable-gigacage-arrays.js: Added.
1040 * stress/disable-gigacage-strings.js: Added.
1042 * stress/disable-gigacage-typed-arrays.js: Added.
1045 2017-10-06 Commit Queue <commit-queue@webkit.org>
1047 Unreviewed, rolling out r222791 and r222873.
1048 https://bugs.webkit.org/show_bug.cgi?id=178031
1050 Caused crashes with workers/wasm LayoutTests (Requested by
1051 ryanhaddad on #webkit).
1053 Reverted changesets:
1055 "WebAssembly: no VM / JS version of everything but Instance"
1056 https://bugs.webkit.org/show_bug.cgi?id=177473
1057 http://trac.webkit.org/changeset/222791
1059 "WebAssembly: address no VM / JS follow-ups"
1060 https://bugs.webkit.org/show_bug.cgi?id=177887
1061 http://trac.webkit.org/changeset/222873
1063 2017-10-05 Saam Barati <sbarati@apple.com>
1065 Make sure all prototypes under poly proto get added into the VM's prototype map
1066 https://bugs.webkit.org/show_bug.cgi?id=177909
1068 Reviewed by Keith Miller.
1070 * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1076 2017-09-30 Yusuke Suzuki <utatane.tea@gmail.com>
1078 [JSC] Introduce import.meta
1079 https://bugs.webkit.org/show_bug.cgi?id=177703
1081 Reviewed by Filip Pizlo.
1083 * modules/import-meta-syntax.js: Added.
1086 * modules/import-meta.js: Added.
1087 * modules/import-meta/cocoa.js: Added.
1088 * modules/resources/assert.js:
1089 (export.shouldNotThrow):
1090 * stress/import-syntax.js:
1092 2017-10-04 Saam Barati <sbarati@apple.com>
1094 Make pertinent AccessCases watch the poly proto watchpoint
1095 https://bugs.webkit.org/show_bug.cgi?id=177765
1097 Reviewed by Keith Miller.
1099 * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1104 * stress/poly-proto-clear-stub.js: Added.
1109 2017-10-04 Ryan Haddad <ryanhaddad@apple.com>
1111 Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1113 Unreviewed test gardening.
1117 2017-10-04 Saam Barati <sbarati@apple.com>
1119 3 poly-proto JSC tests timing out on debug after r222827
1120 https://bugs.webkit.org/show_bug.cgi?id=177880
1122 Rubber stamped by Mark Lam.
1124 * microbenchmarks/poly-proto-access.js:
1125 * typeProfiler/deltablue-for-of.js:
1126 * typeProfiler/getter-richards.js:
1128 2017-10-04 Joseph Pecoraro <pecoraro@apple.com>
1130 Unreviewed, marking tco-catch.js as a failure after test262 update
1131 https://bugs.webkit.org/show_bug.cgi?id=177859
1135 2017-10-04 Yusuke Suzuki <utatane.tea@gmail.com>
1137 Unreviewed, marking one async iterator test262 test failed
1138 https://bugs.webkit.org/show_bug.cgi?id=177859
1142 2017-10-04 Yusuke Suzuki <utatane.tea@gmail.com>
1144 [Test262] Update Test262 to Oct 4 version
1145 https://bugs.webkit.org/show_bug.cgi?id=177859
1147 Reviewed by Sam Weinig.
1149 Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1150 we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1153 * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1155 * test262/harness/typeCoercion.js:
1156 (testCoercibleToIndexZero):
1157 (testCoercibleToIndexOne):
1158 (testCoercibleToIndexFromIndex):
1159 (testNotCoercibleToIndex.testPrimitiveValue):
1160 (testNotCoercibleToInteger):
1161 (testCoercibleToBigIntZero.testPrimitiveValue):
1162 (testCoercibleToBigIntZero):
1163 (testCoercibleToBigIntOne.testPrimitiveValue):
1164 (testCoercibleToBigIntOne):
1165 (testPrimitiveValue):
1166 (testCoercibleToBigIntFromBigInt):
1167 (testNotCoercibleToBigInt.testPrimitiveValue):
1168 (testNotCoercibleToBigInt.testStringValue):
1169 (testNotCoercibleToBigInt):
1170 * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1171 * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1172 * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1173 * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1174 * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1175 * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1176 * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1177 * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1178 * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1179 * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1180 * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1181 * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1182 * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1183 * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1184 * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1185 * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1186 (testCoercibleToBigIntZero):
1187 (testCoercibleToBigIntOne):
1188 (testNotCoercibleToBigInt):
1191 (toString): Deleted.
1192 (Symbol.toPrimitive): Deleted.
1193 * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1194 (testCoercibleToIndexZero):
1195 (testCoercibleToIndexOne):
1196 (testNotCoercibleToIndex):
1198 (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1199 (assert.sameValue.BigInt.asIntN.toString): Deleted.
1200 (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1201 (BigInt.asIntN.valueOf): Deleted.
1202 (BigInt.asIntN.toString): Deleted.
1203 * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1204 * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1205 * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1206 (testCoercibleToBigIntZero):
1207 (testCoercibleToBigIntOne):
1208 (testNotCoercibleToBigInt):
1209 * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1210 (testCoercibleToIndexZero):
1211 (testCoercibleToIndexOne):
1212 (testNotCoercibleToIndex):
1213 * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1214 * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1215 * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1218 * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1219 * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1220 * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1221 * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1222 * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1223 * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1224 * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1225 * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1226 * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1227 * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1228 * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1229 * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1230 * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1231 * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1232 * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1233 * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1234 * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1235 * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1236 * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1237 * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1238 * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1239 * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1240 * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1241 * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1243 (BigInt.prototype.toJSON):
1244 * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1246 * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1247 (BigInt.prototype.toJSON):
1248 * test262/test/built-ins/JSON/stringify/bigint.js:
1249 * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1250 * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1251 * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1252 * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1253 * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1254 * test262/test/built-ins/Object/proto-from-ctor.js:
1255 * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1256 * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1257 * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1258 * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1259 * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1260 * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1261 * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1262 * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1263 * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1264 * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1265 * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1266 * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1267 * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1268 * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1269 * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1270 * test262/test/built-ins/Proxy/get-fn-realm.js:
1271 * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1272 * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1273 * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1274 * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1275 * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1276 * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1277 * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1278 * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1279 * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1280 * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1281 * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1282 * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1285 * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1286 * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1287 * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1288 * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1289 * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1290 * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1291 * test262/test/built-ins/RegExp/u180e.js: Added.
1292 * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1293 * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1294 * test262/test/built-ins/String/proto-from-ctor-realm.js:
1295 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1296 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1297 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1298 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1299 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1300 * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1301 * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1302 * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1303 * test262/test/built-ins/String/prototype/endsWith/length.js:
1304 * test262/test/built-ins/String/prototype/endsWith/name.js:
1305 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1306 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1307 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1308 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1309 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1310 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1311 * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1312 * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1313 * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1314 * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1315 * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1316 * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1317 * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1318 * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1319 * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1320 * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1321 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1322 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1323 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1324 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1325 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1326 * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1327 * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1328 * test262/test/built-ins/String/prototype/includes/includes.js:
1329 * test262/test/built-ins/String/prototype/includes/length.js:
1330 * test262/test/built-ins/String/prototype/includes/name.js:
1331 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1332 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1333 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1334 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1335 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1336 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1337 * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1338 * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1339 * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1340 * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1341 * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1342 * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1343 * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1344 * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1345 * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1346 * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1347 * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1348 * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1349 * test262/test/built-ins/String/prototype/trim/u180e.js:
1350 * test262/test/built-ins/Symbol/for/cross-realm.js:
1351 * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1352 * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1353 * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1354 * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1355 * test262/test/built-ins/Symbol/match/cross-realm.js:
1356 * test262/test/built-ins/Symbol/replace/cross-realm.js:
1357 * test262/test/built-ins/Symbol/search/cross-realm.js:
1358 * test262/test/built-ins/Symbol/species/cross-realm.js:
1359 * test262/test/built-ins/Symbol/split/cross-realm.js:
1360 * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1361 * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1362 * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1363 * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1364 * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1365 * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1366 * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1367 * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1368 * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1369 * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1370 * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1371 * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1372 * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1373 * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1374 * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1375 * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1376 * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1377 * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1378 * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1379 * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1380 * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1381 * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1382 * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1383 * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1384 * test262/test/language/comments/mongolian-vowel-separator-single.js:
1385 * test262/test/language/eval-code/indirect/realm.js:
1386 * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1389 * test262/test/language/expressions/call/eval-realm-indirect.js:
1390 * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1391 * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1392 * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1393 * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1394 * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1395 * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1396 * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1397 * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1398 * test262/test/language/expressions/greater-than/bigint-and-number.js:
1399 * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1400 * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1401 * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1402 * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1403 * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1404 * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1405 * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1406 * test262/test/language/expressions/less-than/bigint-and-number.js:
1407 * test262/test/language/expressions/new/non-ctor-err-realm.js:
1408 * test262/test/language/expressions/super/realm.js:
1409 * test262/test/language/expressions/tagged-template/cache-realm.js:
1410 * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1411 * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1412 * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1413 * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1414 * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1415 * test262/test/language/literals/string/mongolian-vowel-separator.js:
1416 * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1419 * test262/test/language/statements/for-of/iterator-next-reference.js:
1421 (iterator.next): Deleted.
1422 (x.of.iterable.): Deleted.
1423 (x.of.iterable.get return): Deleted.
1424 (x.of.iterable.iterator.next): Deleted.
1425 * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1426 * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1427 * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1428 * test262/test/language/white-space/mongolian-vowel-separator.js:
1429 * test262/test262-Revision.txt:
1431 2017-10-03 Saam Barati <sbarati@apple.com>
1433 Implement polymorphic prototypes
1434 https://bugs.webkit.org/show_bug.cgi?id=176391
1436 Reviewed by Filip Pizlo.
1438 * microbenchmarks/poly-proto-access.js: Added.
1441 (foo.C.prototype.get bar):
1444 * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1446 (makePolyProtoObject.foo.C):
1447 (makePolyProtoObject.foo):
1448 (makePolyProtoObject):
1450 * microbenchmarks/poly-proto-setter-speed.js: Added.
1452 (makePolyProtoObject.foo.C):
1453 (makePolyProtoObject.foo.C.prototype.set p):
1454 (makePolyProtoObject.foo):
1455 (makePolyProtoObject):
1457 * stress/constructor-with-return.js:
1458 (i.tests.forEach.Constructor):
1460 (tests.forEach.Constructor): Deleted.
1461 (tests.forEach): Deleted.
1462 * stress/dom-jit-with-poly-proto.js: Added.
1464 (makePolyProtoObject.foo.C):
1465 (makePolyProtoObject.foo):
1466 (makePolyProtoObject):
1468 * stress/poly-proto-custom-value-and-accessor.js: Added.
1470 (makePolyProtoObject.foo.C):
1471 (makePolyProtoObject.foo):
1472 (makePolyProtoObject):
1475 * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1477 (makePolyProtoObject.foo.C):
1478 (makePolyProtoObject.foo):
1479 (makePolyProtoObject):
1481 * stress/poly-proto-miss.js: Added.
1482 (makePolyProtoInstanceWithNullPrototype.foo.C):
1483 (makePolyProtoInstanceWithNullPrototype.foo):
1484 (makePolyProtoInstanceWithNullPrototype):
1487 * stress/poly-proto-op-in-caching.js: Added.
1489 (makePolyProtoObject.foo.C):
1490 (makePolyProtoObject.foo):
1491 (makePolyProtoObject):
1494 * stress/poly-proto-put-transition.js: Added.
1496 (makePolyProtoObject.foo.C):
1497 (makePolyProtoObject.foo):
1498 (makePolyProtoObject):
1500 (i.obj.__proto__.set p):
1501 * stress/poly-proto-set-prototype.js: Added.
1503 (let.alternateProto.get x):
1504 (let.alternateProto2.get y):
1505 (let.alternateProto2.get x):
1509 * stress/poly-proto-setter.js: Added.
1511 (makePolyProtoObject.foo.C):
1512 (makePolyProtoObject.foo.C.prototype.set p):
1513 (makePolyProtoObject.foo.C.prototype.get p):
1514 (makePolyProtoObject.foo):
1515 (makePolyProtoObject):
1517 * stress/poly-proto-using-inheritance.js: Added.
1520 (foo.C.prototype.get baz):
1525 * stress/primitive-poly-proto.js: Added.
1526 (makePolyProtoInstance.foo.C):
1527 (makePolyProtoInstance.foo):
1528 (makePolyProtoInstance):
1531 * stress/prototype-is-not-js-object.js: Added.
1536 * stress/try-get-by-id-poly-proto.js: Added.
1538 (makePolyProtoObject.foo.C):
1539 (makePolyProtoObject.foo):
1540 (makePolyProtoObject):
1542 (x.__proto__.get bar):
1544 * typeProfiler/overflow.js:
1546 2017-10-03 JF Bastien <jfbastien@apple.com>
1548 WebAssembly: no VM / JS version of everything but Instance
1549 https://bugs.webkit.org/show_bug.cgi?id=177473
1551 Reviewed by Filip Pizlo.
1553 - Exceeding max on memory growth now returns a range error as per
1554 spec. This is a (very minor) breaking change: it used to throw OOM
1555 error. Update the corresponding test.
1557 * wasm/js-api/memory-grow.js:
1559 * wasm/js-api/table.js:
1562 2017-10-03 Ryan Haddad <ryanhaddad@apple.com>
1564 Skip JSC test stress/regress-159779-2.js on debug.
1565 https://bugs.webkit.org/show_bug.cgi?id=177204
1567 Unreviewed test gardening.
1569 * stress/regress-159779-2.js:
1571 2017-10-02 Caio Lima <ticaiolima@gmail.com>
1573 ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1574 https://bugs.webkit.org/show_bug.cgi?id=175642
1576 Reviewed by Darin Adler.
1578 * ChakraCore/test/Function/apply3.baseline-jsc:
1580 2017-10-01 Commit Queue <commit-queue@webkit.org>
1582 Unreviewed, rolling out r222564.
1583 https://bugs.webkit.org/show_bug.cgi?id=177720
1585 "It regressed JetStream by 2% on iOS caused by a 50%
1586 regression on the bigfib subtest" (Requested by saamyjoon on
1591 "Add Above/Below comparisons for UInt32 patterns"
1592 https://bugs.webkit.org/show_bug.cgi?id=177281
1593 http://trac.webkit.org/changeset/222564
1595 2017-09-29 Yusuke Suzuki <utatane.tea@gmail.com>
1597 [DFG] Support ArrayPush with multiple args
1598 https://bugs.webkit.org/show_bug.cgi?id=175823
1600 Reviewed by Saam Barati.
1602 * microbenchmarks/array-push-0.js: Added.
1604 * microbenchmarks/array-push-1.js: Added.
1606 * microbenchmarks/array-push-2.js: Added.
1608 * microbenchmarks/array-push-3.js: Added.
1610 * stress/array-push-multiple-contiguous.js: Added.
1613 * stress/array-push-multiple-double-nan.js: Added.
1616 * stress/array-push-multiple-double.js: Added.
1619 * stress/array-push-multiple-int32.js: Added.
1622 * stress/array-push-multiple-many-contiguous.js: Added.
1625 * stress/array-push-multiple-many-double.js: Added.
1628 * stress/array-push-multiple-many-int32.js: Added.
1631 * stress/array-push-multiple-many-storage.js: Added.
1634 * stress/array-push-multiple-storage.js: Added.
1637 * stress/array-push-with-force-exit.js: Added.
1638 (target.createBuiltin):
1640 2017-09-29 Saam Barati <sbarati@apple.com>
1642 Custom GetterSetterAccessCase does not use the correct slotBase when making call
1643 https://bugs.webkit.org/show_bug.cgi?id=177639
1645 Reviewed by Geoffrey Garen.
1647 * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1653 2017-09-29 Commit Queue <commit-queue@webkit.org>
1655 Unreviewed, rolling out r222563, r222565, and r222581.
1656 https://bugs.webkit.org/show_bug.cgi?id=177675
1658 "It causes a crash when playing youtube videos" (Requested by
1659 saamyjoon on #webkit).
1661 Reverted changesets:
1663 "[DFG] Support ArrayPush with multiple args"
1664 https://bugs.webkit.org/show_bug.cgi?id=175823
1665 http://trac.webkit.org/changeset/222563
1667 "Unreviewed, build fix after r222563"
1668 https://bugs.webkit.org/show_bug.cgi?id=175823
1669 http://trac.webkit.org/changeset/222565
1671 "Unreviewed, fix x86 breaking due to exhausted registers"
1672 https://bugs.webkit.org/show_bug.cgi?id=175823
1673 http://trac.webkit.org/changeset/222581
1675 2017-09-28 Mark Lam <mark.lam@apple.com>
1677 test262: Unexpected passes after r222617 and r222618.
1678 https://bugs.webkit.org/show_bug.cgi?id=177622
1679 <rdar://problem/34725960>
1681 Reviewed by Saam Barati.
1683 Update test262.yaml for tests that are now passing.
1687 2017-09-27 Michael Saboff <msaboff@apple.com>
1689 REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1690 https://bugs.webkit.org/show_bug.cgi?id=177570
1692 Reviewed by Filip Pizlo.
1694 New regression test.
1696 * stress/regress-177570.js: Added.
1698 2017-09-28 Michael Saboff <msaboff@apple.com>
1700 Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1701 https://bugs.webkit.org/show_bug.cgi?id=177423
1703 Reviewed by Mark Lam.
1705 Updated regression test.
1707 * stress/regress-177423.js:
1710 2017-09-27 Mark Lam <mark.lam@apple.com>
1712 JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1713 https://bugs.webkit.org/show_bug.cgi?id=177584
1714 <rdar://problem/34463903>
1716 Reviewed by Saam Barati.
1718 * stress/regress-177584.js: Added.
1720 (Array.prototype.Symbol.species):
1722 2017-09-27 Saam Barati <sbarati@apple.com>
1724 Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1725 https://bugs.webkit.org/show_bug.cgi?id=177523
1727 Reviewed by Mark Lam.
1729 * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1732 (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1734 (i.Test.prototype.propName):
1736 2017-09-27 Mark Lam <mark.lam@apple.com>
1738 Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1739 https://bugs.webkit.org/show_bug.cgi?id=177423
1740 <rdar://problem/34621320>
1742 Reviewed by Keith Miller.
1744 * stress/regress-177423.js: Added.
1746 2017-09-27 Yusuke Suzuki <utatane.tea@gmail.com>
1748 Add Above/Below comparisons for UInt32 patterns
1749 https://bugs.webkit.org/show_bug.cgi?id=177281
1751 Reviewed by Saam Barati.
1753 * stress/uint32-comparison-jump.js: Added.
1763 * stress/uint32-comparison.js: Added.
1774 2017-09-25 Yusuke Suzuki <utatane.tea@gmail.com>
1776 [DFG] Support ArrayPush with multiple args
1777 https://bugs.webkit.org/show_bug.cgi?id=175823
1779 Reviewed by Saam Barati.
1781 * microbenchmarks/array-push-0.js: Added.
1783 * microbenchmarks/array-push-1.js: Added.
1785 * microbenchmarks/array-push-2.js: Added.
1787 * microbenchmarks/array-push-3.js: Added.
1789 * stress/array-push-multiple-contiguous.js: Added.
1792 * stress/array-push-multiple-double-nan.js: Added.
1795 * stress/array-push-multiple-double.js: Added.
1798 * stress/array-push-multiple-int32.js: Added.
1801 * stress/array-push-multiple-many-contiguous.js: Added.
1804 * stress/array-push-multiple-many-double.js: Added.
1807 * stress/array-push-multiple-many-int32.js: Added.
1810 * stress/array-push-multiple-many-storage.js: Added.
1813 * stress/array-push-multiple-storage.js: Added.
1817 2017-09-26 Commit Queue <commit-queue@webkit.org>
1819 Unreviewed, rolling out r222518.
1820 https://bugs.webkit.org/show_bug.cgi?id=177507
1822 Break the High Sierra build (Requested by yusukesuzuki on
1827 "Add Above/Below comparisons for UInt32 patterns"
1828 https://bugs.webkit.org/show_bug.cgi?id=177281
1829 http://trac.webkit.org/changeset/222518
1831 2017-09-26 Yusuke Suzuki <utatane.tea@gmail.com>
1833 Add Above/Below comparisons for UInt32 patterns
1834 https://bugs.webkit.org/show_bug.cgi?id=177281
1836 Reviewed by Saam Barati.
1838 * stress/uint32-comparison-jump.js: Added.
1848 * stress/uint32-comparison.js: Added.
1859 2017-09-23 Keith Miller <keith_miller@apple.com>
1861 Fix infinite looping test262 test
1862 https://bugs.webkit.org/show_bug.cgi?id=177412
1864 Reviewed by Yusuke Suzuki.
1866 This test was poorly designed since failing it would cause the vm
1867 to inifinite loop. I've fixed it locally and will fix it on github pending
1868 the results of next weeks tc39 meeting.
1871 * test262/test/language/statements/for-of/iterator-next-reference.js:
1873 2017-09-23 Joseph Pecoraro <pecoraro@apple.com>
1875 test262: $.agent became $262.agent in test262 update
1876 https://bugs.webkit.org/show_bug.cgi?id=177407
1878 Reviewed by Yusuke Suzuki.
1881 ~320 tests pass now that we correctly make $262 available.
1883 2017-09-22 Keith Miller <keith_miller@apple.com>
1885 Speculatively change iteration protocall to use the same next function
1886 https://bugs.webkit.org/show_bug.cgi?id=175653
1888 Reviewed by Saam Barati.
1890 Change test to match the new iteration behavior.
1892 * stress/spread-optimized-properly.js:
1894 2017-09-22 Yusuke Suzuki <utatane.tea@gmail.com>
1896 [DFG][FTL] Profile array vector length for array allocation
1897 https://bugs.webkit.org/show_bug.cgi?id=177051
1899 Reviewed by Saam Barati.
1901 * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1904 2017-09-22 Commit Queue <commit-queue@webkit.org>
1906 Unreviewed, rolling out r222380.
1907 https://bugs.webkit.org/show_bug.cgi?id=177352
1909 Octane/box2d shows 8% regression (Requested by yusukesuzuki on
1914 "[DFG][FTL] Profile array vector length for array allocation"
1915 https://bugs.webkit.org/show_bug.cgi?id=177051
1916 http://trac.webkit.org/changeset/222380
1918 2017-09-21 Yusuke Suzuki <utatane.tea@gmail.com>
1920 [DFG][FTL] Profile array vector length for array allocation
1921 https://bugs.webkit.org/show_bug.cgi?id=177051
1923 Reviewed by Saam Barati.
1925 * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1928 2017-09-21 Joseph Pecoraro <pecoraro@apple.com>
1930 Skip new hanging test262 tests.
1931 https://bugs.webkit.org/show_bug.cgi?id=177326
1933 Unreviewed test gardening.
1937 2017-09-21 Ryan Haddad <ryanhaddad@apple.com>
1939 Mark 6 test262 tests as passing.
1940 https://bugs.webkit.org/show_bug.cgi?id=177307
1942 Unreviewed test gardening.
1946 2017-09-20 Joseph Pecoraro <pecoraro@apple.com>
1948 Unreviewed follow-up to r222311.
1950 * test262/harness/sta.js:
1951 * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
1952 * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
1953 * test262/test/built-ins/Array/from/calling-from-valid-2.js:
1954 * test262/test/built-ins/Array/from/elements-added-after.js:
1955 * test262/test/built-ins/Array/from/elements-deleted-after.js:
1956 * test262/test/built-ins/Array/from/elements-updated-after.js:
1957 * test262/test/built-ins/Array/from/from-array.js:
1958 * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
1959 * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
1960 * test262/test/built-ins/Array/from/source-array-boundary.js:
1961 * test262/test/built-ins/Array/from/source-object-constructor.js:
1962 * test262/test/built-ins/Array/from/source-object-iterator-1.js:
1963 * test262/test/built-ins/Array/from/source-object-iterator-2.js:
1964 * test262/test/built-ins/Array/from/source-object-length.js:
1965 * test262/test/built-ins/Array/from/source-object-missing.js:
1966 * test262/test/built-ins/Array/from/source-object-without.js:
1967 * test262/test/built-ins/Array/from/this-null.js:
1968 * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1969 * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
1970 * test262/test/language/literals/numeric/7.8.3-1gs.js:
1971 * test262/test/language/literals/numeric/7.8.3-2gs.js:
1972 * test262/test/language/literals/numeric/7.8.3-3gs.js:
1973 * test262/test/language/literals/regexp/7.8.5-1gs.js:
1974 * test262/test/language/literals/string/7.8.4-1gs.js:
1975 Fix some files that I failed to update when I applied my patch.
1977 2017-09-20 Joseph Pecoraro <pecoraro@apple.com>
1979 Update test262 tests
1980 https://bugs.webkit.org/show_bug.cgi?id=177220
1982 Reviewed by Saam Barati and Yusuke Suzuki.
1985 * test262/test262-Revision.txt:
1986 New rebaselined expectations for all tests.
1991 2017-09-17 Yusuke Suzuki <utatane.tea@gmail.com>
1993 [DFG] Remove ToThis more aggressively
1994 https://bugs.webkit.org/show_bug.cgi?id=177056
1996 Reviewed by Saam Barati.
1998 * stress/generator-with-this-strict.js: Added.
2002 * stress/generator-with-this.js: Added.
2007 2017-09-17 Michael Saboff <msaboff@apple.com>
2009 https://bugs.webkit.org/show_bug.cgi?id=177038
2010 Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2012 Reviewed by JF Bastien.
2014 * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2015 as it dies using too much memory.
2017 2017-09-15 Saam Barati <sbarati@apple.com>
2019 Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2020 https://bugs.webkit.org/show_bug.cgi?id=176981
2022 Reviewed by Yusuke Suzuki.
2024 * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2028 (const.bar.createBuiltin):
2030 2017-09-14 Saam Barati <sbarati@apple.com>
2032 It should be valid to exit before each set when doing arity fixup when inlining
2033 https://bugs.webkit.org/show_bug.cgi?id=176948
2035 Reviewed by Keith Miller.
2037 * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2042 2017-09-14 Yusuke Suzuki <utatane.tea@gmail.com>
2044 [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2045 https://bugs.webkit.org/show_bug.cgi?id=176867
2047 Reviewed by Sam Weinig.
2049 * microbenchmarks/object-get-own-property-symbols.js: Added.
2052 2017-09-13 Mark Lam <mark.lam@apple.com>
2054 Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2055 https://bugs.webkit.org/show_bug.cgi?id=176888
2056 <rdar://problem/34381832>
2060 * stress/op_mod-ConstVar.js:
2061 * stress/op_mod-VarConst.js:
2062 * stress/op_mod-VarVar.js:
2064 2017-09-13 Ryan Haddad <ryanhaddad@apple.com>
2066 Skip 3 op_mod tests on Debug JSC bots.
2067 https://bugs.webkit.org/show_bug.cgi?id=176630
2069 Unreviewed test gardening.
2071 * stress/op_mod-ConstVar.js:
2072 * stress/op_mod-VarConst.js:
2073 * stress/op_mod-VarVar.js:
2075 2017-09-13 Yusuke Suzuki <utatane.tea@gmail.com>
2077 [JSC] Fix Array allocation in Object.keys
2078 https://bugs.webkit.org/show_bug.cgi?id=176826
2080 Reviewed by Saam Barati.
2082 * stress/object-own-property-keys.js: Added.
2085 2017-09-12 Yusuke Suzuki <utatane.tea@gmail.com>
2087 [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2088 https://bugs.webkit.org/show_bug.cgi?id=176010
2090 Reviewed by Filip Pizlo.
2092 * microbenchmarks/weak-map-key.js: Added.
2095 (let.start.Date.now):
2097 2017-09-12 Mark Lam <mark.lam@apple.com>
2099 REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2100 https://bugs.webkit.org/show_bug.cgi?id=176630
2102 Reviewed by JF Bastien.
2104 Debug builds are just slow, and these tests do a lot. They pass when I run them
2105 locally on my MacBook Pro. So, I'm bumping their timing multiplier to 2.0x as
2106 a speculative fix for the bots that are seeing these fail.
2108 I also undid the skipping of the op_mod tests for debug builds.
2110 * stress/op_div-ConstVar.js:
2111 * stress/op_div-VarConst.js:
2112 * stress/op_div-VarVar.js:
2113 * stress/op_mod-ConstVar.js:
2114 * stress/op_mod-VarConst.js:
2115 * stress/op_mod-VarVar.js:
2117 2017-09-12 Ryan Haddad <ryanhaddad@apple.com>
2119 Skip stress/value-to-boolean.js on Debug bots.
2120 https://bugs.webkit.org/show_bug.cgi?id=176787
2122 Unreviewed test gardening.
2124 * stress/value-to-boolean.js:
2126 2017-09-11 Mark Lam <mark.lam@apple.com>
2128 Change test expectation for test262/test/language/statements/try/tco-catch.js
2129 https://bugs.webkit.org/show_bug.cgi?id=176749
2131 Rubber stamped by Keith Miller.
2133 It's been failing since at least r221821. I'm changing the test expectation to
2134 fail to green the bots while I investigate some more.
2138 2017-09-11 Ryan Haddad <ryanhaddad@apple.com>
2140 Unreviewed, rolling out r221854.
2142 The test added with this change fails on 32-bit JSC bots.
2146 "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2147 https://bugs.webkit.org/show_bug.cgi?id=176010
2148 http://trac.webkit.org/changeset/221854
2150 2017-09-03 Yusuke Suzuki <utatane.tea@gmail.com>
2152 [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2153 https://bugs.webkit.org/show_bug.cgi?id=176010
2155 Reviewed by Filip Pizlo.
2157 * microbenchmarks/weak-map-key.js: Added.
2160 (let.start.Date.now):
2162 2017-09-09 Yusuke Suzuki <utatane.tea@gmail.com>
2164 [JSC] Optimize Object.keys by using careful array allocation
2165 https://bugs.webkit.org/show_bug.cgi?id=176654
2167 Reviewed by Darin Adler.
2169 * microbenchmarks/object-keys.js: Added.
2172 2017-09-09 Filip Pizlo <fpizlo@apple.com>
2174 Error should compute .stack and friends lazily
2175 https://bugs.webkit.org/show_bug.cgi?id=176645
2177 Reviewed by Saam Barati.
2179 * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2180 * microbenchmarks/new-error.js: Added.
2181 * microbenchmarks/throw.js: Added.
2183 2017-09-09 Mark Lam <mark.lam@apple.com>
2185 [Re-landing] Use JIT probes for DFG OSR exit.
2186 https://bugs.webkit.org/show_bug.cgi?id=175144
2187 <rdar://problem/33437050>
2189 Not reviewed. Original patch reviewed by Saam Barati.
2191 Disable these tests for debug builds because they run too slow with the new OSR exit.
2193 * stress/op_mod-ConstVar.js:
2194 * stress/op_mod-VarConst.js:
2195 * stress/op_mod-VarVar.js:
2197 2017-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
2199 [DFG] NewArrayWithSize(size)'s size does not care negative zero
2200 https://bugs.webkit.org/show_bug.cgi?id=176300
2202 Reviewed by Saam Barati.
2204 * stress/new-array-with-size-div.js: Added.
2209 2017-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
2211 [DFG] PutByVal with Array::Generic is too generic
2212 https://bugs.webkit.org/show_bug.cgi?id=176345
2214 Reviewed by Filip Pizlo.
2216 * stress/object-assign-symbols.js: Added.
2219 * stress/object-assign.js: Added.
2222 (i.shouldBe.JSON.stringify.test):
2224 2017-09-08 Yusuke Suzuki <utatane.tea@gmail.com>
2226 [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2227 https://bugs.webkit.org/show_bug.cgi?id=176590
2229 Reviewed by Saam Barati.
2231 * microbenchmarks/object-iterate-symbols.js: Added.
2233 * microbenchmarks/object-iterate.js: Added.
2235 * stress/object-iterate-symbols.js: Added.
2238 * stress/object-iterate.js: Added.
2242 2017-09-07 Per Arne Vollan <pvollan@apple.com>
2244 [Win32] 10 JSC stress tests are failing.
2245 https://bugs.webkit.org/show_bug.cgi?id=176538
2247 Reviewed by Mark Lam.
2249 Skip tests on Windows to make the bots green.
2252 * stress/date-relaxed.js:
2254 2017-09-06 Mark Lam <mark.lam@apple.com>
2256 constructGenericTypedArrayViewWithArguments() is missing an exception check.
2257 https://bugs.webkit.org/show_bug.cgi?id=176485
2258 <rdar://problem/33898874>
2260 Reviewed by Keith Miller.
2262 * stress/regress-176485.js: Added.
2264 2017-09-05 Saam Barati <sbarati@apple.com>
2266 isNotCellSpeculation is wrong with respect to SpecEmpty
2267 https://bugs.webkit.org/show_bug.cgi?id=176429
2269 Reviewed by Michael Saboff.
2271 * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2274 2017-09-05 Joseph Pecoraro <pecoraro@apple.com>
2276 test262: Completion values for control flow do not match the spec
2277 https://bugs.webkit.org/show_bug.cgi?id=171265
2279 Reviewed by Saam Barati.
2281 * stress/completion-value.js:
2282 Condensed test for completion values in top level statements.
2284 * stress/super-get-by-id.js:
2285 ClassDeclaration when evaled no longer produce values. Convert
2286 these to ClassExpressions so they produce the class value.
2288 * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2289 This is a progression for currect spec behavior.
2291 * mozilla/mozilla-tests.yaml:
2292 This test is now outdated, so mark it as failing for that reason.
2295 Passing all "cptn" completion value tests.
2297 2017-09-04 Saam Barati <sbarati@apple.com>
2299 typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2300 https://bugs.webkit.org/show_bug.cgi?id=176317
2302 Reviewed by Keith Miller.
2304 * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2307 2017-09-03 Yusuke Suzuki <utatane.tea@gmail.com>
2309 [DFG][FTL] Efficiently execute number#toString()
2310 https://bugs.webkit.org/show_bug.cgi?id=170007
2312 Reviewed by Keith Miller.
2314 * microbenchmarks/number-to-string-strength-reduction.js: Added.
2316 * microbenchmarks/number-to-string-with-radix-10.js: Added.
2318 * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2320 * microbenchmarks/number-to-string-with-radix.js: Added.
2322 * stress/number-to-string-strength-reduction.js: Added.
2325 * stress/number-to-string-with-radix-10.js: Added.
2328 * stress/number-to-string-with-radix-cse.js: Added.
2331 * stress/number-to-string-with-radix-invalid.js: Added.
2333 * stress/number-to-string-with-radix-watchpoint.js: Added.
2336 (i.i.1e3.Number.prototype.toString):
2337 * stress/number-to-string-with-radix.js: Added.
2341 2017-09-02 Yusuke Suzuki <utatane.tea@gmail.com>
2343 [DFG] Relax arity requirement
2344 https://bugs.webkit.org/show_bug.cgi?id=175523
2346 Reviewed by Saam Barati.
2348 * stress/arity-mismatch-arguments-length.js: Added.
2352 * stress/arity-mismatch-get-argument.js: Added.
2354 (builtin.createBuiltin):
2356 * stress/arity-mismatch-inlining-extra-slots.js: Added.
2360 * stress/arity-mismatch-inlining.js: Added.
2364 * stress/arity-mismatch-rest.js: Added.
2370 2017-08-31 Yusuke Suzuki <utatane.tea@gmail.com>
2372 [JSC] Fix "name" and "length" of Proxy revoke function
2373 https://bugs.webkit.org/show_bug.cgi?id=176155
2375 Reviewed by Mark Lam.
2379 2017-08-31 Saam Barati <sbarati@apple.com>
2381 Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2382 https://bugs.webkit.org/show_bug.cgi?id=176206
2384 Reviewed by Keith Miller.
2386 * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2391 2017-08-31 Ryan Haddad <ryanhaddad@apple.com>
2393 Skip two slow JSC tests after r221422.
2395 Unreviewed test gardening.
2397 * stress/regexp-prototype-match-on-too-long-rope.js:
2398 * stress/regexp-prototype-test-on-too-long-rope.js:
2400 2017-08-31 Filip Pizlo <fpizlo@apple.com>
2402 Unreviewed, skipping slow tests.
2404 These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2405 work differently now.
2407 * stress/regexp-prototype-exec-on-too-long-rope.js:
2408 * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2410 2017-08-31 Yusuke Suzuki <utatane.tea@gmail.com>
2412 [JSC] Use reifying system for "name" property of builtin JSFunction
2413 https://bugs.webkit.org/show_bug.cgi?id=175260
2415 Reviewed by Saam Barati.
2417 * stress/accessors-get-set-prefix.js:
2418 * stress/builtin-function-name.js: Added.
2421 (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2422 (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2423 * stress/private-name-as-anonymous-builtin.js: Added.
2427 2017-08-30 Saam Barati <sbarati@apple.com>
2429 Unreviewed. Make test stop printing.
2431 * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2433 2017-08-30 Ryan Haddad <ryanhaddad@apple.com>
2435 Unreviewed, rolling out r221327.
2437 This change caused test262 failures.
2441 "[JSC] Use reifying system for "name" property of builtin
2443 https://bugs.webkit.org/show_bug.cgi?id=175260
2444 http://trac.webkit.org/changeset/221327
2446 2017-08-30 Saam Barati <sbarati@apple.com>
2448 semicolon is being interpreted as an = in the LiteralParser
2449 https://bugs.webkit.org/show_bug.cgi?id=176114
2451 Reviewed by Oliver Hunt.
2453 * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2454 * stress/resources/literal-parser-test-case.js: Added.
2456 2017-08-30 Oleksandr Skachkov <gskachkov@gmail.com>
2458 [ESNext] Async iteration - Implement async iteration statement: for-await-of
2459 https://bugs.webkit.org/show_bug.cgi?id=166698
2461 Reviewed by Yusuke Suzuki.
2463 * stress/async-iteration-for-await-of-syntax.js: Added.
2467 (checkSimpleAsyncGeneratorSloppyMode):
2468 (checkSimpleAsyncGeneratorStrictMode):
2469 (checkNestedAsyncGenerators):
2470 (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2471 * stress/async-iteration-for-await-of.js: Added.
2477 2017-08-29 Yusuke Suzuki <utatane.tea@gmail.com>
2479 [JSC] Use reifying system for "name" property of builtin JSFunction
2480 https://bugs.webkit.org/show_bug.cgi?id=175260
2482 Reviewed by Saam Barati.
2484 * stress/accessors-get-set-prefix.js:
2485 * stress/builtin-function-name.js: Added.
2488 (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2489 (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2491 2017-08-25 Saam Barati <sbarati@apple.com>
2493 Support compiling catch in the DFG
2494 https://bugs.webkit.org/show_bug.cgi?id=174590
2495 <rdar://problem/34047845>
2497 Reviewed by Filip Pizlo.
2499 * microbenchmarks/delta-blue-try-catch.js: Added.
2502 (OrderedCollection):
2503 (OrderedCollection.prototype.add):
2504 (OrderedCollection.prototype.at):
2505 (OrderedCollection.prototype.size):
2506 (OrderedCollection.prototype.removeFirst):
2507 (OrderedCollection.prototype.remove):
2509 (Strength.stronger):
2511 (Strength.weakestOf):
2512 (Strength.strongest):
2513 (Strength.prototype.nextWeaker):
2515 (Constraint.prototype.addConstraint):
2516 (Constraint.prototype.satisfy):
2517 (Constraint.prototype.destroyConstraint):
2518 (Constraint.prototype.isInput):
2520 (UnaryConstraint.prototype.addToGraph):
2521 (UnaryConstraint.prototype.chooseMethod):
2522 (UnaryConstraint.prototype.isSatisfied):
2523 (UnaryConstraint.prototype.markInputs):
2524 (UnaryConstraint.prototype.output):
2525 (UnaryConstraint.prototype.recalculate):
2526 (UnaryConstraint.prototype.markUnsatisfied):
2527 (UnaryConstraint.prototype.inputsKnown):
2528 (UnaryConstraint.prototype.removeFromGraph):
2530 (StayConstraint.prototype.execute):
2531 (EditConstraint.prototype.isInput):
2532 (EditConstraint.prototype.execute):
2534 (BinaryConstraint.prototype.chooseMethod):
2535 (BinaryConstraint.prototype.addToGraph):
2536 (BinaryConstraint.prototype.isSatisfied):
2537 (BinaryConstraint.prototype.markInputs):
2538 (BinaryConstraint.prototype.input):
2539 (BinaryConstraint.prototype.output):
2540 (BinaryConstraint.prototype.recalculate):
2541 (BinaryConstraint.prototype.markUnsatisfied):
2542 (BinaryConstraint.prototype.inputsKnown):
2543 (BinaryConstraint.prototype.removeFromGraph):
2545 (ScaleConstraint.prototype.addToGraph):
2546 (ScaleConstraint.prototype.removeFromGraph):
2547 (ScaleConstraint.prototype.markInputs):
2548 (ScaleConstraint.prototype.execute):
2549 (ScaleConstraint.prototype.recalculate):
2550 (EqualityConstraint):
2551 (EqualityConstraint.prototype.execute):
2553 (Variable.prototype.addConstraint):
2554 (Variable.prototype.removeConstraint):
2556 (Planner.prototype.incrementalAdd):
2557 (Planner.prototype.incrementalRemove):
2558 (Planner.prototype.newMark):
2559 (Planner.prototype.makePlan):
2560 (Planner.prototype.extractPlanFromConstraints):
2561 (Planner.prototype.addPropagate):
2562 (Planner.prototype.removePropagateFrom):
2563 (Planner.prototype.addConstraintsConsumingTo):
2565 (Plan.prototype.addConstraint):
2566 (Plan.prototype.size):
2567 (Plan.prototype.constraintAt):
2568 (Plan.prototype.execute):
2573 * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2576 (Numbers.prototype.next):
2578 (return.Transpose.prototype.next):
2584 * microbenchmarks/try-catch-word-count.js: Added.
2599 (A.prototype.getValue):
2600 (B.prototype.getParentValue):
2610 (set delete.set has.set add):
2611 * stress/catch-set-argument-speculation-failure.js: Added.
2619 * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2625 2017-08-24 Commit Queue <commit-queue@webkit.org>
2627 Unreviewed, rolling out r221119, r221124, and r221143.
2628 https://bugs.webkit.org/show_bug.cgi?id=175973
2630 "I think it regressed JSBench by 20%" (Requested by saamyjoon
2633 Reverted changesets:
2635 "Support compiling catch in the DFG"
2636 https://bugs.webkit.org/show_bug.cgi?id=174590
2637 http://trac.webkit.org/changeset/221119
2639 "Unreviewed, build fix in GTK port"
2640 https://bugs.webkit.org/show_bug.cgi?id=174590
2641 http://trac.webkit.org/changeset/221124
2643 "DFG::JITCode::osrEntry should get sorted since we perform a
2644 binary search on it"
2645 https://bugs.webkit.org/show_bug.cgi?id=175893
2646 http://trac.webkit.org/changeset/221143
2648 2017-08-24 Michael Saboff <msaboff@apple.com>
2650 Add support for RegExp "dotAll" flag
2651 https://bugs.webkit.org/show_bug.cgi?id=175924
2653 Reviewed by Keith Miller.
2655 Updated tests for new dotAll ('s' flag) changes.
2657 * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2658 * stress/static-getter-in-names.js:
2660 2017-08-24 Mark Lam <mark.lam@apple.com>
2662 Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2663 https://bugs.webkit.org/show_bug.cgi?id=175940
2664 <rdar://problem/29003921>
2666 Reviewed by Saam Barati.
2668 * stress/regress-164081.js: Added.
2672 2017-08-24 Ryan Haddad <ryanhaddad@apple.com>
2674 Skip flaky JSC test stress/test-finally.js.
2675 https://bugs.webkit.org/show_bug.cgi?id=160283
2677 Unreviewed test gardening.
2679 * stress/test-finally.js:
2681 2017-08-23 Saam Barati <sbarati@apple.com>
2683 Support compiling catch in the DFG
2684 https://bugs.webkit.org/show_bug.cgi?id=174590
2686 Reviewed by Filip Pizlo.
2688 * microbenchmarks/delta-blue-try-catch.js: Added.
2691 (OrderedCollection):
2692 (OrderedCollection.prototype.add):
2693 (OrderedCollection.prototype.at):
2694 (OrderedCollection.prototype.size):
2695 (OrderedCollection.prototype.removeFirst):
2696 (OrderedCollection.prototype.remove):
2698 (Strength.stronger):
2700 (Strength.weakestOf):
2701 (Strength.strongest):
2702 (Strength.prototype.nextWeaker):
2704 (Constraint.prototype.addConstraint):
2705 (Constraint.prototype.satisfy):
2706 (Constraint.prototype.destroyConstraint):
2707 (Constraint.prototype.isInput):
2709 (UnaryConstraint.prototype.addToGraph):
2710 (UnaryConstraint.prototype.chooseMethod):
2711 (UnaryConstraint.prototype.isSatisfied):
2712 (UnaryConstraint.prototype.markInputs):
2713 (UnaryConstraint.prototype.output):
2714 (UnaryConstraint.prototype.recalculate):
2715 (UnaryConstraint.prototype.markUnsatisfied):
2716 (UnaryConstraint.prototype.inputsKnown):
2717 (UnaryConstraint.prototype.removeFromGraph):
2719 (StayConstraint.prototype.execute):
2720 (EditConstraint.prototype.isInput):
2721 (EditConstraint.prototype.execute):
2723 (BinaryConstraint.prototype.chooseMethod):
2724 (BinaryConstraint.prototype.addToGraph):
2725 (BinaryConstraint.prototype.isSatisfied):
2726 (BinaryConstraint.prototype.markInputs):
2727 (BinaryConstraint.prototype.input):
2728 (BinaryConstraint.prototype.output):
2729 (BinaryConstraint.prototype.recalculate):
2730 (BinaryConstraint.prototype.markUnsatisfied):
2731 (BinaryConstraint.prototype.inputsKnown):
2732 (BinaryConstraint.prototype.removeFromGraph):
2734 (ScaleConstraint.prototype.addToGraph):
2735 (ScaleConstraint.prototype.removeFromGraph):
2736 (ScaleConstraint.prototype.markInputs):
2737 (ScaleConstraint.prototype.execute):
2738 (ScaleConstraint.prototype.recalculate):
2739 (EqualityConstraint):
2740 (EqualityConstraint.prototype.execute):
2742 (Variable.prototype.addConstraint):
2743 (Variable.prototype.removeConstraint):
2745 (Planner.prototype.incrementalAdd):
2746 (Planner.prototype.incrementalRemove):
2747 (Planner.prototype.newMark):
2748 (Planner.prototype.makePlan):
2749 (Planner.prototype.extractPlanFromConstraints):
2750 (Planner.prototype.addPropagate):
2751 (Planner.prototype.removePropagateFrom):
2752 (Planner.prototype.addConstraintsConsumingTo):
2754 (Plan.prototype.addConstraint):
2755 (Plan.prototype.size):
2756 (Plan.prototype.constraintAt):
2757 (Plan.prototype.execute):
2762 * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2765 (Numbers.prototype.next):
2767 (return.Transpose.prototype.next):
2773 * microbenchmarks/try-catch-word-count.js: Added.
2788 (A.prototype.getValue):
2789 (B.prototype.getParentValue):
2799 (set delete.set has.set add):
2800 * stress/catch-set-argument-speculation-failure.js: Added.
2808 * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2814 2017-08-23 Yusuke Suzuki <utatane.tea@gmail.com>
2816 [JSC] Optimize Map iteration with intrinsic
2817 https://bugs.webkit.org/show_bug.cgi?id=174355
2819 Reviewed by Saam Barati.
2821 * stress/map-iterator-result-should-have-expected-shape.js: Added.
2824 * stress/set-iterator-result-should-have-expected-shape.js: Added.
2826 (throw.new.Error.let.iterator.set Symbol):
2827 (throw.new.Error.set add):
2828 (let.iterator.set Symbol):
2830 2017-08-23 Robin Morisset <rmorisset@apple.com>
2832 Add a micro-benchmark for checking that accessing a variable within a 'with'
2833 block does not automatically prevent type prediction.
2834 https://bugs.webkit.org/show_bug.cgi?id=175738
2836 Reviewed by Saam Barati.
2838 * stress/with_and_arith.js: Added.
2841 2017-08-23 Skachkov Oleksandr <gskachkov@gmail.com>
2843 [ESNext] Async iteration - Implement Async Generator - runtime
2844 https://bugs.webkit.org/show_bug.cgi?id=175240
2846 Reviewed by Yusuke Suzuki.
2848 * stress/async-iteration-async-from-sync.js: Added.
2852 (this.fullfilledDone):
2857 (const.assertLogger):
2858 (const.getPromise.promiseHolder.return.new.Promise):
2864 * stress/async-iteration-basic.js: Added.
2868 (this.fullfilledDone):
2873 (const.assertLogger):
2874 (const.getPromise.promiseHolder.return.new.Promise):
2876 (iterator.next.then):
2881 (A.prototype.async.foo):
2882 (A.prototype.async.boo):
2884 (asyncGenExp.async):
2897 * stress/async-iteration-evaluation.js: Added.
2901 * stress/async-iteration-syntax.js:
2902 * stress/async-iteration-yield-promise.js: Added.
2906 (this.fullfilledDone):
2911 (const.assertLogger):
2912 (const.getPromise.promiseHolder.return.new.Promise):
2916 * stress/async-iteration-yield-star-interface.js: Added.
2918 (const.getPromise.promiseHolder.return.new.Promise):
2921 (this.fullfilledDone):
2927 (const.assertLogger):
2928 (let.asyncIter.Symbol.asyncIterator):
2929 (let.asyncIter.next):
2930 (let.asyncIter.throw):
2931 (let.asyncIter.return):
2933 (asyncIter.Symbol.asyncIterator):
2940 * stress/async-iteration-yield-star.js: Added.
2944 (this.fullfilledDone):
2950 (const.assertLogger):
2951 (const.getPromise.promiseHolder.return.new.Promise):
2960 (let.asyncIter.Symbol.asyncIterator):
2961 (let.asyncIter.next):
2962 (let.asyncIter.throw):
2963 (let.asyncIter.return):
2968 2017-08-23 JF Bastien <jfbastien@apple.com>
2970 Fix printing in test
2972 Unreviewed: fixing verbosity, shouldn't have been there.
2974 * wasm/regress/175693.js:
2978 2017-08-18 Ryan Haddad <ryanhaddad@apple.com>
2980 Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
2981 https://bugs.webkit.org/show_bug.cgi?id=172543
2983 Unreviewed test gardening.
2985 * microbenchmarks/generator-with-several-types.js:
2987 2017-08-17 JF Bastien <jfbastien@apple.com>
2989 WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
2990 https://bugs.webkit.org/show_bug.cgi?id=175693
2991 <rdar://problem/33952443>
2993 Reviewed by Saam Barati.
2995 Add a regression directory for WebAssembly tests.
2998 * wasm/regress/175693.js: Added.
3000 (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3002 * wasm/regress/175693.wasm: Added.
3004 2017-08-15 Robin Morisset <rmorisset@apple.com>
3006 Support the 'with' keyword in FTL.
3007 https://bugs.webkit.org/show_bug.cgi?id=175585
3009 Reviewed by Saam Barati.
3011 Also improve the JSTest/stress/with.js file to test
3012 what happens when non-objects are passed to with.
3019 2017-08-14 Keith Miller <keith_miller@apple.com>
3021 Add testing tool to lie to the DFG about profiles
3022 https://bugs.webkit.org/show_bug.cgi?id=175487
3024 Reviewed by Saam Barati.
3026 * stress/compare-eq-incomplete-profile.js: Added.
3027 (const.test.createBuiltin):
3029 2017-08-14 Robin Morisset <rmorisset@apple.com>
3031 Support the with keyword in DFG
3032 https://bugs.webkit.org/show_bug.cgi?id=175470
3034 Reviewed by Saam Barati.
3036 Added a new stress-test for the 'with' keyword, that caught a bug in a
3037 previous version of this code.
3039 * stress/with.js: Added.
3042 2017-08-14 Ryan Haddad <ryanhaddad@apple.com>
3044 Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3045 https://bugs.webkit.org/show_bug.cgi?id=175544
3047 Unreviewed test gardening.
3051 2017-08-09 Caitlin Potter <caitp@igalia.com>
3053 Early error on ANY operator before new.target
3054 https://bugs.webkit.org/show_bug.cgi?id=157970
3056 Reviewed by Saam Barati.
3058 Instead of throwing if any unary operator precedes new.target, only
3059 throw if the unary operator updates the reference.
3061 The following become legal in JSC:
3071 All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3073 * stress/new-target-syntax-errors.js:
3074 * stress/new-target.js:
3076 2017-08-09 Ryan Haddad <ryanhaddad@apple.com>
3078 Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3079 https://bugs.webkit.org/show_bug.cgi?id=175255
3081 Unreviewed test gardening.
3083 * stress/regress-169783.js:
3084 * wasm/stress/oom.js:
3086 2017-08-09 Oleksandr Skachkov <gskachkov@gmail.com>
3088 REGRESSION: 2 test262/test/language/statements/async-function failures
3089 https://bugs.webkit.org/show_bug.cgi?id=175334
3091 Reviewed by Yusuke Suzuki.
3093 Add @skip parameters to tests, and remove test for async iterator from
3094 async await syntax test because it is already covered by async-iterator-syntax.js
3096 * stress/async-await-syntax.js:
3097 * stress/async-iteration-syntax.js:
3099 2017-08-08 Yusuke Suzuki <utatane.tea@gmail.com>
3101 Unreviewed, gardening test262 for Promise resolve / reject function length
3102 https://bugs.webkit.org/show_bug.cgi?id=175333
3106 2017-08-07 Robin Morisset <rmorisset@apple.com>
3108 GetOwnProperty of TypedArray indexed fields is wrongly configurable
3109 https://bugs.webkit.org/show_bug.cgi?id=175307
3111 Reviewed by Saam Barati.
3113 * stress/typedarray-getownproperty-not-configurable.js: Added.
3117 2017-08-06 Yusuke Suzuki <utatane.tea@gmail.com>
3119 Promise resolve and reject function should have length = 1
3120 https://bugs.webkit.org/show_bug.cgi?id=175242
3122 Reviewed by Saam Barati.
3124 * stress/builtin-function-length.js: Added.
3127 (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3128 (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3130 2017-08-06 Oleksandr Skachkov <gskachkov@gmail.com>
3132 [ESNext] Async iteration - Implement Async Generator - parser
3133 https://bugs.webkit.org/show_bug.cgi?id=175210
3135 Reviewed by Yusuke Suzuki.
3137 * stress/async-await-syntax.js:
3138 (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3139 * stress/async-iteration-syntax.js: Added.
3143 (checkSimpleAsyncGeneratorSloppyMode):
3144 (checkSimpleAsyncGeneratorStrictMode):
3145 (checkNestedAsyncGenerators):
3146 (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3147 * stress/generator-class-methods-syntax.js:
3149 2017-08-03 Carlos Alberto Lopez Perez <clopez@igalia.com>
3151 JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3152 https://bugs.webkit.org/show_bug.cgi?id=175150
3154 Unreviewed test gardening.
3156 * wasm/js-api/test_memory_constructor.js:
3158 2017-08-02 Carlos Alberto Lopez Perez <clopez@igalia.com>
3160 [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3161 https://bugs.webkit.org/show_bug.cgi?id=175100
3163 Reviewed by Mark Lam.
3165 The JSC test JSTests/wasm/stress/oom.js tries to use all the
3166 available memory until an out of memory exception happens.
3168 The Linux kernel is more tuned for server workloads than for GUI
3169 responsiveness. When a process tries to use a lot of memory, Linux
3170 will do its best to serve the request. This usually translates to
3171 free physical RAM by writing to disk dirty pages and/or moving out
3172 less recently used pages to swap (disk storage).
3173 Meanwhile it does this, the system will become unresponsive and this
3174 leads to freezes that can last even some minutes on the worst cases.
3176 Therefore, let's skip this test on Linux as it will cause more harm
3177 than good on the Linux bots or on the machines of Linux developers.
3179 * wasm/stress/oom.js:
3181 2017-08-01 Oleksandr Skachkov <gskachkov@gmail.com>
3183 [JSC] Remove unnecessary print from stress\promise-finally.js test
3184 https://bugs.webkit.org/show_bug.cgi?id=175015
3186 Reviewed by Yusuke Suzuki.
3188 * stress/promise-finally.js:
3192 2017-07-31 Yusuke Suzuki <utatane.tea@gmail.com>
3194 Unreviewed, update test262 results for optional catch binding
3198 2017-07-31 Yusuke Suzuki <utatane.tea@gmail.com>
3200 [JSC] Support optional catch binding
3201 https://bugs.webkit.org/show_bug.cgi?id=174981
3203 Reviewed by Saam Barati.
3205 * stress/optional-catch-binding-syntax.js: Added.
3209 * stress/optional-catch-binding.js: Added.
3213 2017-07-28 Mark Lam <mark.lam@apple.com>
3215 ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3216 https://bugs.webkit.org/show_bug.cgi?id=174948
3217 <rdar://problem/33495680>
3219 Reviewed by Filip Pizlo.
3221 * stress/regress-174948.js: Added.
3223 2017-07-28 Yusuke Suzuki <utatane.tea@gmail.com>
3225 ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3226 https://bugs.webkit.org/show_bug.cgi?id=174900
3228 Reviewed by Saam Barati.
3230 * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3235 2017-07-27 Yusuke Suzuki <utatane.tea@gmail.com>
3237 Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3238 https://bugs.webkit.org/show_bug.cgi?id=171637
3240 Reviewed by Darin Adler.
3242 * stress/domjit-getter-complex-with-incorrect-object.js:
3244 * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3248 2017-07-26 JF Bastien <jfbastien@apple.com>
3250 WebAssembly: test throwing out of the start function
3251 https://bugs.webkit.org/show_bug.cgi?id=165714
3252 <rdar://problem/29760251>
3254 Reviewed by Keith Miller.
3257 * wasm/function-tests/trap-from-start.js: Added.
3259 * wasm/function-tests/trap-from-start-async.js: Added.
3260 (async.StartTrapsAsync):
3262 2017-07-21 Yusuke Suzuki <utatane.tea@gmail.com>
3264 [FTL] Arguments elimination is suppressed by unreachable blocks
3265 https://bugs.webkit.org/show_bug.cgi?id=174352
3267 Reviewed by Filip Pizlo.
3269 * stress/arguments-elimination-force-exit.js: Added.
3273 * stress/arguments-elimination-throw.js: Added.
3279 2017-07-13 Mark Lam <mark.lam@apple.com>
3281 Add some additional test cases for bug 170896.
3282 https://bugs.webkit.org/show_bug.cgi?id=174491
3284 Reviewed by Filip Pizlo.
3286 * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3287 * stress/regress-170896-with-double-shape-profile.js: Added.
3289 * stress/regress-170896-with-int32-shape-profile.js: Added.
3291 * stress/regress-170896.js: Removed.
3293 2017-07-13 Saam Barati <sbarati@apple.com>
3295 Missing exception check in JSObject::hasInstance
3296 https://bugs.webkit.org/show_bug.cgi?id=174455
3297 <rdar://problem/31384608>
3299 Reviewed by Mark Lam.
3301 * stress/has-instance-exception-check.js: Added.
3303 (let.getter.Object.getOwnPropertyDescriptor.get foo):
3305 2017-07-13 Caio Lima <ticaiolima@gmail.com>
3307 [ESnext] Implement Object Spread
3308 https://bugs.webkit.org/show_bug.cgi?id=167963
3310 Reviewed by Saam Barati.
3312 * stress/obj-rest-destructuring-order.js: Added.
3316 * stress/obj-spread-order.js: Added.
3320 * stress/object-spread.js: Added.
3329 (try.let.obj.get foo):
3332 2017-07-12 Saam Barati <sbarati@apple.com>
3334 GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3335 https://bugs.webkit.org/show_bug.cgi?id=174411
3336 <rdar://problem/31696186>
3338 Reviewed by Mark Lam.
3340 * stress/generic-arguments-correct-delete-behavior.js: Added.
3344 2017-07-07 Mark Lam <mark.lam@apple.com>
3346 \n\r is not the same as \r\n.
3347 https://bugs.webkit.org/show_bug.cgi?id=173053
3349 Reviewed by Keith Miller.
3351 * stress/regress-173053.js: Added.
3352 * stress/template-literal-line-terminators.js:
3354 2017-07-06 Saam Barati <sbarati@apple.com>
3356 We are missing places where we invalidate the for-in context
3357 https://bugs.webkit.org/show_bug.cgi?id=174184
3359 Reviewed by Geoffrey Garen.
3361 * stress/for-in-invalidate-context-weird-assignments.js: Added.
3365 2017-07-05 Saam Barati <sbarati@apple.com>
3367 NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3368 https://bugs.webkit.org/show_bug.cgi?id=174188
3369 <rdar://problem/30581423>
3371 Reviewed by Mark Lam.
3373 * stress/new-array-having-a-bad-time-double.js: Added.
3377 2017-07-05 Yusuke Suzuki <utatane.tea@gmail.com>
3379 WTF::StringImpl::copyChars segfaults when built with GCC 7
3380 https://bugs.webkit.org/show_bug.cgi?id=173407
3382 Reviewed by Andreas Kling.
3384 * stress/string-repeat-copy-chars-crash.js: Added.
3387 2017-07-03 Saam Barati <sbarati@apple.com>
3389 Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3391 * stress/unshiftCountSlowCase-correct-postCapacity.js:
3393 2017-07-03 Yusuke Suzuki <utatane.tea@gmail.com>
3395 Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3397 It requires too much memory.
3399 * stress/dont-reserve-huge-capacity-lexer.js:
3401 2017-06-30 Michael Saboff <msaboff@apple.com>
3403 Skip a test on ARM64 platform since we run out of address space.
3405 Rubber stamped by Saam Barati.
3407 * stress/dont-reserve-huge-capacity-lexer.js:
3409 2017-06-30 Michael Saboff <msaboff@apple.com>
3411 RegExp's anchored with .* with \g flag can return wrong match start for strings with multiple matches
3412 https://bugs.webkit.org/show_bug.cgi?id=174044
3414 Reviewed by Oliver Hunt.
3416 New regression test.
3418 * stress/regress-174044.js: Added.
3422 2017-06-30 Filip Pizlo <fpizlo@apple.com>
3424 RegExpCachedResult::setInput should reify left and right contexts
3425 https://bugs.webkit.org/show_bug.cgi?id=173818
3427 Reviewed by Keith Miller.
3429 * stress/right-left-context-invalidated-by-input.js: Added.
3430 (test.validateContexts):
3433 2017-06-29 Saam Barati <sbarati@apple.com>
3435 Calculating postCapacity in unshiftCountSlowCase is wrong
3436 https://bugs.webkit.org/show_bug.cgi?id=173992
3437 <rdar://problem/32283199>
3439 Reviewed by Keith Miller.
3441 * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3444 2017-06-29 Commit Queue <commit-queue@webkit.org>
3446 Unreviewed, rolling out r218512.
3447 https://bugs.webkit.org/show_bug.cgi?id=173981
3449 "It changes the behavior of the JS API's JSEvaluateScript
3450 which breaks TurboTax" (Requested by saamyjoon on #webkit).
3454 "test262: Completion values for control flow do not match the
3456 https://bugs.webkit.org/show_bug.cgi?id=171265
3457 http://trac.webkit.org/changeset/218512
3459 2017-06-27 JF Bastien <jfbastien@apple.com>
3461 WebAssembly: running out of executable memory should throw OoM
3462 https://bugs.webkit.org/show_bug.cgi?id=171537
3463 <rdar://problem/32963338>
3465 Reviewed by Saam Barati.
3468 * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3470 (failCount.0.catch):
3471 (failCount.0.module.undefined.catch):
3472 * wasm/lowExecutableMemory/exports-oom.js: Added.
3475 (const.randomProgram):
3476 (failCount.0.catch):
3477 (failCount.0.module.undefined.catch):
3478 * wasm/lowExecutableMemory/imports-oom.js: Added.
3481 (const.randomProgram):
3483 (failCount.0.catch):
3484 (failCount.0.module.undefined.catch):
3486 2017-06-27 Caio Lima <ticaiolima@gmail.com>
3488 [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3489 https://bugs.webkit.org/show_bug.cgi?id=167962
3491 Reviewed by Saam Barati.
3493 * stress/object-rest-deconstruct.js: Added.
3495 (let.assertPropDescriptor):
3503 2017-06-27 Saam Barati <sbarati@apple.com>
3505 Function constructor needs to follow the spec and validate parameters and body independently
3506 https://bugs.webkit.org/show_bug.cgi?id=173303
3507 <rdar://problem/32732526>
3509 Reviewed by Keith Miller.
3511 * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3512 * stress/function-constructor-semantics.js: Added.
3521 2017-06-26 Saam Barati <sbarati@apple.com>
3523 RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3524 https://bugs.webkit.org/show_bug.cgi?id=173740
3526 Reviewed by Mark Lam.
3528 * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3529 (Array.prototype.Symbol.iterator):
3531 2017-06-26 Saam Barati <sbarati@apple.com>
3533 Skip a test on 32-bit platforms since we run out of address space.
3535 Rubber stamped by Mark Lam.
3537 * stress/dont-reserve-huge-capacity-lexer.js:
3539 2017-06-26 Saam Barati <sbarati@apple.com>
3541 Crash in JSC::Lexer<unsigned char>::setCode
3542 https://bugs.webkit.org/show_bug.cgi?id=172754
3544 Reviewed by Mark Lam.
3546 * stress/dont-reserve-huge-capacity-lexer.js: Added.
3549 2017-06-24 Yusuke Suzuki <utatane.tea@gmail.com>
3551 [JSC] Clean up Object.entries implementation
3552 https://bugs.webkit.org/show_bug.cgi?id=173759
3554 Reviewed by Sam Weinig.
3556 * microbenchmarks/object-entries.js: Added.
3559 2017-06-24 Joseph Pecoraro <pecoraro@apple.com>
3561 Remove Reflect.enumerate
3562 https://bugs.webkit.org/show_bug.cgi?id=173806
3564 Reviewed by Yusuke Suzuki.
3568 These tests now fail because they use Reflect.enumerate.
3571 This test now passes, it checked that Reflect.enumerate is undefined!
3573 * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3574 Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3576 * stress/reflect-enumerate.js: Removed.
3577 Remove a test solely for Reflect.enumerate.
3579 2017-06-22 Saam Barati <sbarati@apple.com>
3581 ValueRep(DoubleRep(@v)) can not simply convert to @v
3582 https://bugs.webkit.org/show_bug.cgi?id=173687
3583 <rdar://problem/32855563>
3585 Reviewed by Mark Lam.
3587 * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3590 2017-06-22 Yusuke Suzuki <utatane.tea@gmail.com>
3592 [JSC] Object.values should be implemented in C++
3593 https://bugs.webkit.org/show_bug.cgi?id=173703
3595 Reviewed by Sam Weinig.
3597 * microbenchmarks/object-keys-map-values.js: Added.
3599 * microbenchmarks/object-values.js: Added.
3601 * stress/object-values-changing-properties.js: Added.
3603 (throw.new.Error.let.source.get x):
3605 (shouldBe.let.handler.get order):
3607 (shouldBe.let.handler.get return):
3608 (let.handler.get order):
3610 2017-06-21 Saam Barati <sbarati@apple.com>
3612 eval virtual call is incorrect in the baseline JIT
3613 https://bugs.webkit.org/show_bug.cgi?id=173587
3614 <rdar://problem/32867897>
3616 Reviewed by Michael Saboff.
3618 * stress/do-eval-virtual-call-correctly.js: Added.
3624 2017-06-20 Ryan Haddad <ryanhaddad@apple.com>
3626 Update test262 test expectations after r218581.
3628 Unreviewed test gardening.
3632 2017-06-20 Oleksandr Skachkov <gskachkov@gmail.com>
3634 Revert changes in bug#160417 about extending `null` not being a derived class
3635 https://bugs.webkit.org/show_bug.cgi?id=169293
3637 Reviewed by Saam Barati.
3639 * stress/class-derived-from-null.js:
3648 2017-06-13 Yusuke Suzuki <utatane.tea@gmail.com>
3650 [DFG] More ArrayIndexOf fixups for various types
3651 https://bugs.webkit.org/show_bug.cgi?id=173176
3653 Reviewed by Saam Barati.
3655 * stress/array-indexof-arraystorage.js: Added.
3657 (indexOfInt32Other):
3659 (indexOfInt32Boolean):
3660 (indexOfDoubleOther):
3661 (indexOfDoubleCell):
3662 (indexOfDoubleBoolean):
3665 * stress/array-indexof-constant-folding.js: Added.
3667 (indexOfInt32Other):
3669 (indexOfInt32Boolean):
3670 (indexOfDoubleOther):
3671 (indexOfDoubleCell):
3672 (indexOfDoubleBoolean):
3673 * stress/array-indexof-hole-and-other.js: Added.
3676 * stress/array-indexof-other.js: Added.
3682 * stress/array-indexof-symbol.js: Added.
3689 2017-06-19 Joseph Pecoraro <pecoraro@apple.com>
3691 test262: Completion values for control flow do not match the spec
3692 https://bugs.webkit.org/show_bug.cgi?id=171265
3694 Reviewed by Saam Barati.
3696 * stress/completion-value.js:
3697 Condensed test for completion values in top level statements.
3699 * stress/super-get-by-id.js:
3700 ClassDeclaration when evaled no longer produce values. Convert
3701 these to ClassExpressions so they produce the class value.
3703 * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3704 This is a progression for currect spec behavior.
3706 * mozilla/mozilla-tests.yaml:
3707 This test is now outdated, so mark it as failing for that reason.
3710 Passing all "cptn" completion value tests.
3712 2017-06-17 Keith Miller <keith_miller@apple.com>
3714 ArrayBuffer constructor needs to create subclass structures before its buffer
3715 https://bugs.webkit.org/show_bug.cgi?id=173510
3717 Reviewed by Yusuke Suzuki.
3721 2017-06-17 Keith Miller <keith_miller@apple.com>
3723 ArrayPrototype methods should use JSValue::toLength for non-Arrays.
3724 https://bugs.webkit.org/show_bug.cgi?id=173506
3726 Reviewed by Ryosuke Niwa.
3730 * ChakraCore/test/Function/apply3.baseline-jsc:
3733 2017-06-16 Yusuke Suzuki <utatane.tea@gmail.com>
3735 [JSC] Add fast path for Object.assign
3736 https://bugs.webkit.org/show_bug.cgi?id=173416
3738 Reviewed by Mark Lam.
3740 * stress/object-assign-changing-properties.js: Added.
3742 (throw.new.Error.let.source.get x):
3744 (shouldBe.let.source.get x):
3745 (shouldBe.let.target.set x):
3746 (shouldBe.let.target.get x):