JSTests/ChangeLog

   1 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
   2
   3         [DFG][FTL] Support MapSet / SetAdd intrinsics
   4         https://bugs.webkit.org/show_bug.cgi?id=179858
   5
   6         Reviewed by Saam Barati.
   7
   8         * microbenchmarks/map-has-and-set.js: Added.
   9         (test):
  10         * stress/map-set-check-failure.js: Added.
  11         (shouldBe):
  12         (shouldThrow):
  13         (target):
  14         * stress/map-set-cse.js: Added.
  15         (shouldBe):
  16         (test):
  17         * stress/set-add-check-failure.js: Added.
  18         (shouldBe):
  19         (shouldThrow):
  20         (set shouldThrow):
  21         * stress/set-add-cse.js: Added.
  22         (shouldBe):
  23
  24 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
  25
  26         [JSC] Allow poly proto for intrinsic getters
  27         https://bugs.webkit.org/show_bug.cgi?id=179550
  28
  29         Reviewed by Saam Barati.
  30
  31         This change is also tested by existing tests.
  32
  33             1. stress/intrinsic-getter-with-poly-proto.js
  34             2. stress/poly-proto-intrinsic-getter-correctness.js
  35
  36         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
  37         (shouldBe):
  38         (makePolyProtoObject.foo.C):
  39         (makePolyProtoObject.foo):
  40         (makePolyProtoObject):
  41         (target):
  42         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
  43         (shouldBe):
  44         (makePolyProtoObject.foo.C):
  45         (makePolyProtoObject.foo):
  46         (makePolyProtoObject):
  47         (target):
  48
  49 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
  50
  51         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
  52         https://bugs.webkit.org/show_bug.cgi?id=179744
  53
  54         Reviewed by Michael Catanzaro.
  55
  56         This test uses too much memory for our buildbots on these platforms
  57         and gets OOM-killed.
  58
  59         * stress/unshiftCountSlowCase-correct-postCapacity.js:
  60         Skip if $memoryLimited and linux.
  61
  62 2017-11-17  JF Bastien  <jfbastien@apple.com>
  63
  64         WebAssembly JS API: throw when a promise can't be created
  65         https://bugs.webkit.org/show_bug.cgi?id=179826
  66         <rdar://problem/35455813>
  67
  68         Reviewed by Mark Lam.
  69
  70         Test WebAssembly.{compile,instantiate} where promise creation
  71         fails because of a stack overflow.
  72
  73         * wasm/js-api/promise-stack-overflow.js: Added.
  74         (const.runNearStackLimit.f.const.t):
  75         (async.testCompile):
  76         (async.testInstantiate):
  77
  78 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
  79
  80         Unreviewed, mark regress-178385.js as memory exhausting
  81
  82         * stress/regress-178385.js:
  83
  84 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
  85
  86         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
  87
  88         Unreviewed test gardening.
  89
  90         * test262.yaml:
  91
  92 2017-11-16  Robin Morisset  <rmorisset@apple.com>
  93
  94         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
  95         https://bugs.webkit.org/show_bug.cgi?id=179763
  96         <rdar://problem/35550513>
  97
  98         Reviewed by Keith Miller.
  99
 100         Just adding a slightly cleaned-up version of the original fuzzer-found test.
 101
 102         * stress/tdz-this-in-try-catch.js: Added.
 103         (__v_6388):
 104         (__v_6392):
 105
 106 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 107
 108         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
 109         https://bugs.webkit.org/show_bug.cgi?id=179594
 110
 111         Reviewed by Saam Barati.
 112
 113         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
 114         (shouldBe):
 115         (args):
 116         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
 117         (shouldBe):
 118         (args):
 119
 120 2017-11-14  Saam Barati  <sbarati@apple.com>
 121
 122         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
 123         https://bugs.webkit.org/show_bug.cgi?id=179639
 124         <rdar://problem/35513018>
 125
 126         Reviewed by JF Bastien.
 127
 128         * wasm/function-tests/grow-memory-cause-gc.js: Added.
 129         (escape):
 130         (i.func):
 131
 132 2017-11-13  Mark Lam  <mark.lam@apple.com>
 133
 134         Add more overflow check book-keeping for MarkedArgumentBuffer.
 135         https://bugs.webkit.org/show_bug.cgi?id=179634
 136         <rdar://problem/35492517>
 137
 138         Reviewed by Saam Barati.
 139
 140         * stress/regress-179634.js: Added.
 141
 142 2017-11-13  Mark Lam  <mark.lam@apple.com>
 143
 144         Make the jsc shell loadGetterFromGetterSetter() function more robust.
 145         https://bugs.webkit.org/show_bug.cgi?id=179619
 146         <rdar://problem/35492518>
 147
 148         Reviewed by Saam Barati.
 149
 150         * stress/regress-179619.js: Added.
 151
 152 2017-11-12  Mark Lam  <mark.lam@apple.com>
 153
 154         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
 155         https://bugs.webkit.org/show_bug.cgi?id=179562
 156         <rdar://problem/35467022>
 157
 158         Reviewed by Saam Barati.
 159
 160         * regress-179562.js: Added.
 161
 162 2017-11-08  Saam Barati  <sbarati@apple.com>
 163
 164         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
 165         https://bugs.webkit.org/show_bug.cgi?id=177792
 166
 167         Reviewed by Yusuke Suzuki.
 168
 169         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
 170         (assert):
 171         (foo.Foo.prototype.ensureX):
 172         (foo.Foo):
 173         (foo):
 174         (access):
 175
 176 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
 177
 178         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
 179         https://bugs.webkit.org/show_bug.cgi?id=178592
 180
 181         Unreviewed test gardening.
 182
 183         * test262.yaml:
 184
 185 2017-11-08  Robin Morisset  <rmorisset@apple.com>
 186
 187         Turn recursive tail calls into loops
 188         https://bugs.webkit.org/show_bug.cgi?id=176601
 189
 190         Reviewed by Saam Barati.
 191
 192         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
 193
 194         Add some simple test that computes factorial in several ways, and other trivial computations.
 195         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
 196         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
 197         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
 198         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
 199
 200         * stress/inline-call-to-recursive-tail-call.js: Added.
 201         (factorial.aux):
 202         (factorial):
 203         (factorial2.aux2):
 204         (factorial2.id):
 205         (factorial2):
 206         (factorial3.aux3):
 207         (factorial3):
 208         (aux4):
 209         (factorial4):
 210         (foo):
 211         (auxBar):
 212         (bar):
 213         (test):
 214
 215 2017-11-07  Mark Lam  <mark.lam@apple.com>
 216
 217         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
 218         https://bugs.webkit.org/show_bug.cgi?id=179355
 219         <rdar://problem/35263053>
 220
 221         Reviewed by Saam Barati.
 222
 223         * stress/regress-179355.js: Added.
 224
 225 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
 226
 227         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
 228         https://bugs.webkit.org/show_bug.cgi?id=144458
 229
 230         Reviewed by Saam Barati.
 231
 232         * microbenchmarks/dfg-internal-function-call.js: Added.
 233         (target):
 234         * microbenchmarks/dfg-internal-function-construct.js: Added.
 235         (target):
 236         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
 237         (target):
 238         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
 239         (target):
 240         * stress/dfg-internal-function-call.js: Added.
 241         (shouldBe):
 242         (target):
 243         * stress/dfg-internal-function-construct.js: Added.
 244         (shouldBe):
 245         (target):
 246         * stress/internal-function-call.js: Added.
 247         (shouldBe):
 248         * stress/internal-function-construct.js: Added.
 249         (shouldBe):
 250
 251 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
 252
 253         [Win] Skip stress/regress-178385.js.
 254         https://bugs.webkit.org/show_bug.cgi?id=179298
 255
 256         Unreviewed test gardening.
 257
 258         * stress/regress-178385.js:
 259
 260 2017-11-03  Keith Miller  <keith_miller@apple.com>
 261
 262         Add test for ic with side effects
 263         https://bugs.webkit.org/show_bug.cgi?id=179268
 264
 265         Reviewed by Saam Barati.
 266
 267         * stress/put-inline-cache-side-effects.js: Added.
 268         (let.i.of.objs.keys):
 269         (f):
 270
 271 2017-11-03  Mark Lam  <mark.lam@apple.com>
 272
 273         CachedCall (and its clients) needs overflow checks.
 274         https://bugs.webkit.org/show_bug.cgi?id=179185
 275
 276         Reviewed by JF Bastien.
 277
 278         * stress/regress-179185.js: Added.
 279
 280 2017-11-02  Michael Saboff  <msaboff@apple.com>
 281
 282         DFG needs to handle code motion of code in for..in loop bodies
 283         https://bugs.webkit.org/show_bug.cgi?id=179212
 284
 285         Reviewed by Keith Miller.
 286
 287         New regression test.
 288
 289         * stress/for-in-side-effects.js: Added.
 290         (getPrototypeOf):
 291         (reset):
 292         (testWithoutFTL.f):
 293         (testWithoutFTL):
 294         (testWithFTL.f):
 295         (testWithFTL):
 296
 297 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
 298
 299         AI does not correctly model the clobber case of ArithClz32
 300         https://bugs.webkit.org/show_bug.cgi?id=179188
 301
 302         Reviewed by Michael Saboff.
 303
 304         * stress/arith-clz32-effects.js: Added.
 305         (foo):
 306         (valueOf):
 307
 308 2017-11-01  Michael Saboff  <msaboff@apple.com>
 309
 310         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
 311         https://bugs.webkit.org/show_bug.cgi?id=179140
 312
 313         Reviewed by Saam Barati.
 314
 315         New regression test.
 316
 317         * stress/regress-179140.js: Added.
 318         (testWithoutFTL):
 319         (testWithFTL):
 320
 321 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
 322
 323         [JSC] Introduce @toObject
 324         https://bugs.webkit.org/show_bug.cgi?id=178726
 325
 326         Reviewed by Saam Barati.
 327
 328         * stress/array-copywithin.js:
 329         (shouldThrow):
 330         * stress/object-constructor-boolean-edge.js: Added.
 331         (shouldBe):
 332         (test):
 333         * stress/object-constructor-global.js: Added.
 334         (shouldBe):
 335         * stress/object-constructor-null-edge.js: Added.
 336         (shouldBe):
 337         (test):
 338         * stress/object-constructor-number-edge.js: Added.
 339         (shouldBe):
 340         (test):
 341         * stress/object-constructor-object-edge.js: Added.
 342         (shouldBe):
 343         (test):
 344         (i.arg):
 345         * stress/object-constructor-string-edge.js: Added.
 346         (shouldBe):
 347         (test):
 348         * stress/object-constructor-symbol-edge.js: Added.
 349         (shouldBe):
 350         (test):
 351         * stress/object-constructor-undefined-edge.js: Added.
 352         (shouldBe):
 353         (test):
 354         * stress/symbol-array-from.js: Added.
 355         (shouldBe):
 356         * stress/to-object-intrinsic-boolean-edge.js: Added.
 357         (shouldBe):
 358         (builtin.createBuiltin):
 359         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
 360         (shouldThrow):
 361         * stress/to-object-intrinsic-number-edge.js: Added.
 362         (shouldBe):
 363         (builtin.createBuiltin):
 364         * stress/to-object-intrinsic-object-edge.js: Added.
 365         (shouldBe):
 366         (builtin.createBuiltin):
 367         (i.arg):
 368         * stress/to-object-intrinsic-string-edge.js: Added.
 369         (shouldBe):
 370         (builtin.createBuiltin):
 371         * stress/to-object-intrinsic-symbol-edge.js: Added.
 372         (shouldBe):
 373         (builtin.createBuiltin):
 374         * stress/to-object-intrinsic.js: Added.
 375         (shouldBe):
 376         (shouldThrow):
 377         (builtin.createBuiltin):
 378
 379 2017-10-27  Yusuke Suzuki  <utatane.tea@gmail.com>
 380
 381         [DFG][FTL] Introduce StringSlice
 382         https://bugs.webkit.org/show_bug.cgi?id=178934
 383
 384         Reviewed by Saam Barati.
 385
 386         * microbenchmarks/string-slice-empty.js: Added.
 387         (slice):
 388         * microbenchmarks/string-slice-one-char.js: Added.
 389         (slice):
 390         * microbenchmarks/string-slice.js: Added.
 391         (slice):
 392
 393 2017-10-26  Michael Saboff  <msaboff@apple.com>
 394
 395         REGRESSION(r222601): We fail to properly backtrack into a sub pattern of a parenthesis with non-zero minimum
 396         https://bugs.webkit.org/show_bug.cgi?id=178890
 397
 398         Reviewed by Keith Miller.
 399
 400         New regression test.
 401
 402         * stress/regress-178890.js: Added.
 403
 404 2017-10-26  Mark Lam  <mark.lam@apple.com>
 405
 406         JSRopeString::RopeBuilder::append() should check for overflows.
 407         https://bugs.webkit.org/show_bug.cgi?id=178385
 408         <rdar://problem/35027468>
 409
 410         Reviewed by Saam Barati.
 411
 412         * stress/regress-178385.js: Added.
 413
 414 2017-10-26  Ryan Haddad  <ryanhaddad@apple.com>
 415
 416         Unreviewed, rolling out r223961.
 417
 418         The change that required this has been rolled out.
 419
 420         Reverted changeset:
 421
 422         "Mark test262.yaml/test262/test/language/statements/try/tco-
 423         catch.js as passing."
 424         https://bugs.webkit.org/show_bug.cgi?id=178592
 425         https://trac.webkit.org/changeset/223961
 426
 427 2017-10-25  Commit Queue  <commit-queue@webkit.org>
 428
 429         Unreviewed, rolling out r223691 and r223729.
 430         https://bugs.webkit.org/show_bug.cgi?id=178834
 431
 432         Broke Speedometer 2 React-Redux-TodoMVC test case (Requested
 433         by rniwa on #webkit).
 434
 435         Reverted changesets:
 436
 437         "Turn recursive tail calls into loops"
 438         https://bugs.webkit.org/show_bug.cgi?id=176601
 439         https://trac.webkit.org/changeset/223691
 440
 441         "REGRESSION(r223691): DFGByteCodeParser.cpp:1483:83: warning:
 442         comparison is always false due to limited range of data type
 443         [-Wtype-limits]"
 444         https://bugs.webkit.org/show_bug.cgi?id=178543
 445         https://trac.webkit.org/changeset/223729
 446
 447 2017-10-25  Ryan Haddad  <ryanhaddad@apple.com>
 448
 449         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
 450         https://bugs.webkit.org/show_bug.cgi?id=178592
 451
 452         Unreviewed test gardening.
 453
 454         * test262.yaml:
 455
 456 2017-10-24  Yusuke Suzuki  <utatane.tea@gmail.com>
 457
 458         [FTL] Support NewStringObject
 459         https://bugs.webkit.org/show_bug.cgi?id=178737
 460
 461         Reviewed by Saam Barati.
 462
 463         * stress/new-string-object.js: Added.
 464         (shouldBe):
 465         (test):
 466
 467 2017-10-15  Yusuke Suzuki  <utatane.tea@gmail.com>
 468
 469         [JSC] modules can be visited more than once when resolving bindings through "star" exports as long as the exportName is different each time
 470         https://bugs.webkit.org/show_bug.cgi?id=178308
 471
 472         Reviewed by Mark Lam.
 473
 474         * test262.yaml:
 475
 476 2017-10-23  Yusuke Suzuki  <utatane.tea@gmail.com>
 477
 478         [JSC] Use fastJoin in Array#toString
 479         https://bugs.webkit.org/show_bug.cgi?id=178062
 480
 481         Reviewed by Darin Adler.
 482
 483         * microbenchmarks/contiguous-array-to-string.js: Added.
 484         (target):
 485         * microbenchmarks/double-array-to-string.js: Added.
 486         (target):
 487         * microbenchmarks/int32-array-to-string.js: Added.
 488         (target):
 489
 490 2017-10-22  Zan Dobersek  <zdobersek@igalia.com>
 491
 492         stress/check-string-ident.js is improperly skipped
 493         https://bugs.webkit.org/show_bug.cgi?id=178642
 494
 495         Reviewed by Saam Barati.
 496
 497         * stress/check-string-ident.js: Drop the defaultNoEagerRun directive
 498         since it enforces the run-jsc-stress-tests script to still set up the
 499         test to run, despite the skip directive that's used before.
 500
 501 2017-10-20  Mark Lam  <mark.lam@apple.com>
 502
 503         Add a test case for r214334.
 504         https://bugs.webkit.org/show_bug.cgi?id=169941
 505         <rdar://problem/31221258>
 506
 507         Reviewed by JF Bastien.
 508
 509         * stress/regress-169941.js: Added.
 510
 511 2017-10-19  JF Bastien  <jfbastien@apple.com>
 512
 513         WebAssembly: no VM / JS version of everything but Instance
 514         https://bugs.webkit.org/show_bug.cgi?id=177473
 515
 516         Reviewed by Filip Pizlo, Saam Barati.
 517
 518         - Exceeding max on memory growth now returns a range error as per
 519         spec. This is a (very minor) breaking change: it used to throw OOM
 520         error. Update the corresponding test.
 521
 522         * wasm/js-api/memory-grow.js:
 523         (assertEq):
 524         * wasm/js-api/table.js:
 525         (assert.throws):
 526
 527 2017-10-19  Mark Lam  <mark.lam@apple.com>
 528
 529         Stringifier::appendStringifiedValue() is missing an exception check.
 530         https://bugs.webkit.org/show_bug.cgi?id=178386
 531         <rdar://problem/35027610>
 532
 533         Reviewed by Saam Barati.
 534
 535         * stress/regress-178386.js: Added.
 536
 537 2017-10-19  Michael Saboff  <msaboff@apple.com>
 538
 539         Test262: RegExp/property-escapes/generated/Emoji_Component.js fails with current RegExp Unicode Properties implementation
 540         https://bugs.webkit.org/show_bug.cgi?id=178521
 541
 542         Reviewed by JF Bastien.
 543
 544         * test262.yaml: Enabled test262/test/built-ins/RegExp/property-escapes/generated/Emoji_Component.js as it
 545         now passes with the current version (5.0) of the Emoji spec.
 546
 547 2017-10-19  Robin Morisset  <rmorisset@apple.com>
 548
 549         Turn recursive tail calls into loops
 550         https://bugs.webkit.org/show_bug.cgi?id=176601
 551
 552         Reviewed by Saam Barati.
 553
 554         Add some simple test that computes factorial in several ways, and other trivial computations.
 555         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
 556         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
 557         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
 558         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
 559
 560         * stress/inline-call-to-recursive-tail-call.js: Added.
 561         (factorial.aux):
 562         (factorial):
 563         (factorial2.aux):
 564         (factorial2.id):
 565         (factorial2):
 566         (factorial3.aux):
 567         (factorial3):
 568         (aux):
 569         (factorial4):
 570         (test):
 571
 572 2017-10-18  Mark Lam  <mark.lam@apple.com>
 573
 574         RegExpObject::defineOwnProperty() does not need to compare values if no descriptor value is specified.
 575         https://bugs.webkit.org/show_bug.cgi?id=177600
 576         <rdar://problem/34710985>
 577
 578         Reviewed by Saam Barati.
 579
 580         * stress/regress-177600.js: Added.
 581
 582 2017-10-18  Mark Lam  <mark.lam@apple.com>
 583
 584         The compiler should always register a structure when it adds its transitionWatchPointSet.
 585         https://bugs.webkit.org/show_bug.cgi?id=178420
 586         <rdar://problem/34814024>
 587
 588         Reviewed by Saam Barati and Filip Pizlo.
 589
 590         * stress/regress-178420.js: Added.
 591         (new.Array.10000.map):
 592
 593 2017-10-18  Yusuke Suzuki  <utatane.tea@gmail.com>
 594
 595         [JSC] __proto__ getter should be fast
 596         https://bugs.webkit.org/show_bug.cgi?id=178067
 597
 598         Reviewed by Saam Barati.
 599
 600         * stress/dfg-object-proto-accessor.js: Added.
 601         (shouldBe):
 602         (shouldThrow):
 603         (target):
 604         * stress/dfg-object-proto-getter.js: Added.
 605         (shouldBe):
 606         (shouldThrow):
 607         (target):
 608         * stress/dfg-object-prototype-of.js: Added.
 609         (shouldBe):
 610         (shouldThrow):
 611         (target):
 612         * stress/dfg-reflect-get-prototype-of.js: Added.
 613         (shouldBe):
 614         (shouldThrow):
 615         (target):
 616         * stress/intrinsic-getter-with-poly-proto.js: Added.
 617         (shouldBe):
 618         (makePolyProtoObject.foo.C):
 619         (makePolyProtoObject.foo):
 620         (makePolyProtoObject):
 621         (target):
 622         * stress/object-get-prototype-of-filtered.js: Added.
 623         (shouldBe):
 624         (shouldThrow):
 625         (target):
 626         (i.Cocoa):
 627         * stress/object-get-prototype-of-mono-proto.js: Added.
 628         (shouldBe):
 629         (makePolyProtoObject.foo.C):
 630         (makePolyProtoObject.foo):
 631         (makePolyProtoObject):
 632         (target):
 633         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 634         (shouldBe):
 635         (makePolyProtoObject.foo.C):
 636         (makePolyProtoObject.foo):
 637         (makePolyProtoObject):
 638         (target):
 639         * stress/object-get-prototype-of-poly-proto.js: Added.
 640         (shouldBe):
 641         (makePolyProtoObject.foo.C):
 642         (makePolyProtoObject.foo):
 643         (makePolyProtoObject):
 644         (target):
 645         * stress/object-proto-getter-filtered.js: Added.
 646         (shouldBe):
 647         (shouldThrow):
 648         (target):
 649         (i.Cocoa):
 650         * stress/object-proto-getter-poly-mono-proto.js: Added.
 651         (shouldBe):
 652         (makePolyProtoObject.foo.C):
 653         (makePolyProtoObject.foo):
 654         (makePolyProtoObject):
 655         (target):
 656         * stress/object-proto-getter-poly-proto.js: Added.
 657         (shouldBe):
 658         (makePolyProtoObject.foo.C):
 659         (makePolyProtoObject.foo):
 660         (makePolyProtoObject):
 661         (target):
 662         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 663         * stress/string-proto.js: Added.
 664         (shouldBe):
 665         (target):
 666
 667 2017-10-17  Ryan Haddad  <ryanhaddad@apple.com>
 668
 669         Unreviewed, rolling out r223523.
 670
 671         A test for this change is failing on debug JSC bots.
 672
 673         Reverted changeset:
 674
 675         "[JSC] __proto__ getter should be fast"
 676         https://bugs.webkit.org/show_bug.cgi?id=178067
 677         https://trac.webkit.org/changeset/223523
 678
 679 2017-10-10  Yusuke Suzuki  <utatane.tea@gmail.com>
 680
 681         [JSC] __proto__ getter should be fast
 682         https://bugs.webkit.org/show_bug.cgi?id=178067
 683
 684         Reviewed by Saam Barati.
 685
 686         * stress/dfg-object-proto-accessor.js: Added.
 687         (shouldBe):
 688         (shouldThrow):
 689         (target):
 690         * stress/dfg-object-proto-getter.js: Added.
 691         (shouldBe):
 692         (shouldThrow):
 693         (target):
 694         * stress/dfg-object-prototype-of.js: Added.
 695         (shouldBe):
 696         (shouldThrow):
 697         (target):
 698         * stress/dfg-reflect-get-prototype-of.js: Added.
 699         (shouldBe):
 700         (shouldThrow):
 701         (target):
 702         * stress/object-get-prototype-of-filtered.js: Added.
 703         (shouldBe):
 704         (shouldThrow):
 705         (target):
 706         (i.Cocoa):
 707         * stress/object-get-prototype-of-mono-proto.js: Added.
 708         (shouldBe):
 709         (makePolyProtoObject.foo.C):
 710         (makePolyProtoObject.foo):
 711         (makePolyProtoObject):
 712         (target):
 713         * stress/object-get-prototype-of-poly-mono-proto.js: Added.
 714         (shouldBe):
 715         (makePolyProtoObject.foo.C):
 716         (makePolyProtoObject.foo):
 717         (makePolyProtoObject):
 718         (target):
 719         * stress/object-get-prototype-of-poly-proto.js: Added.
 720         (shouldBe):
 721         (makePolyProtoObject.foo.C):
 722         (makePolyProtoObject.foo):
 723         (makePolyProtoObject):
 724         (target):
 725         * stress/object-proto-getter-filtered.js: Added.
 726         (shouldBe):
 727         (shouldThrow):
 728         (target):
 729         (i.Cocoa):
 730         * stress/object-proto-getter-poly-mono-proto.js: Added.
 731         (shouldBe):
 732         (makePolyProtoObject.foo.C):
 733         (makePolyProtoObject.foo):
 734         (makePolyProtoObject):
 735         (target):
 736         * stress/object-proto-getter-poly-proto.js: Added.
 737         (shouldBe):
 738         (makePolyProtoObject.foo.C):
 739         (makePolyProtoObject.foo):
 740         (makePolyProtoObject):
 741         (target):
 742         * stress/object-prototype-proto-accessors-should-throw-on-undefined-this.js:
 743         * stress/string-proto.js: Added.
 744         (shouldBe):
 745         (target):
 746
 747 2017-10-14  Yusuke Suzuki  <utatane.tea@gmail.com>
 748
 749         Reland "Add Above/Below comparisons for UInt32 patterns"
 750         https://bugs.webkit.org/show_bug.cgi?id=177281
 751
 752         Reviewed by Saam Barati.
 753
 754         * stress/uint32-comparison-jump.js: Added.
 755         (shouldBe):
 756         (above):
 757         (aboveOrEqual):
 758         (below):
 759         (belowOrEqual):
 760         (notAbove):
 761         (notAboveOrEqual):
 762         (notBelow):
 763         (notBelowOrEqual):
 764         * stress/uint32-comparison.js: Added.
 765         (shouldBe):
 766         (above):
 767         (aboveOrEqual):
 768         (below):
 769         (belowOrEqual):
 770         (aboveTest):
 771         (aboveOrEqualTest):
 772         (belowTest):
 773         (belowOrEqualTest):
 774
 775 2017-10-12  Yusuke Suzuki  <utatane.tea@gmail.com>
 776
 777         WebAssembly: Wasm functions should have either JSFunctionType or TypeOfShouldCallGetCallData
 778         https://bugs.webkit.org/show_bug.cgi?id=178210
 779
 780         Reviewed by Saam Barati.
 781
 782         * wasm/function-tests/trap-from-start-async.js:
 783         (async.StartTrapsAsync):
 784         * wasm/function-tests/trap-from-start.js:
 785         (StartTraps):
 786         * wasm/js-api/web-assembly-function.js:
 787         (assert.eq.Object.getPrototypeOf):
 788         * wasm/js-api/wrapper-function.js:
 789         (return.new.WebAssembly.Module):
 790         (assert.throws.makeInstance): Deleted.
 791         (assert.throws.Bar): Deleted.
 792         (assert.throws): Deleted.
 793
 794 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 795
 796         Enable gigacage on iOS
 797         https://bugs.webkit.org/show_bug.cgi?id=177586
 798
 799         Reviewed by JF Bastien.
 800
 801         Add tests for when Gigacage gets runtime disabled.
 802
 803         * stress/disable-gigacage-arrays.js: Added.
 804         (foo):
 805         * stress/disable-gigacage-strings.js: Added.
 806         (foo):
 807         * stress/disable-gigacage-typed-arrays.js: Added.
 808         (foo):
 809
 810 2017-10-11  Yusuke Suzuki  <utatane.tea@gmail.com>
 811
 812         import.meta should not be assignable
 813         https://bugs.webkit.org/show_bug.cgi?id=178202
 814
 815         Reviewed by Saam Barati.
 816
 817         * modules/import-meta-assignment.js: Added.
 818         (shouldThrow):
 819         (SyntaxError.import.meta.can.shouldThrow):
 820
 821 2017-10-11  Saam Barati  <sbarati@apple.com>
 822
 823         Unreviewed. Actually skip certain type profiler tests in debug.
 824
 825         * typeProfiler.yaml:
 826         * typeProfiler/deltablue-for-of.js:
 827         * typeProfiler/getter-richards.js:
 828
 829 2017-10-11  Commit Queue  <commit-queue@webkit.org>
 830
 831         Unreviewed, rolling out r223113 and r223121.
 832         https://bugs.webkit.org/show_bug.cgi?id=178182
 833
 834         Reintroduced 20% regression on Kraken (Requested by rniwa on
 835         #webkit).
 836
 837         Reverted changesets:
 838
 839         "Enable gigacage on iOS"
 840         https://bugs.webkit.org/show_bug.cgi?id=177586
 841         https://trac.webkit.org/changeset/223113
 842
 843         "Use one virtual allocation for all gigacages and their
 844         runways"
 845         https://bugs.webkit.org/show_bug.cgi?id=178050
 846         https://trac.webkit.org/changeset/223121
 847
 848 2017-10-11  Michael Saboff  <msaboff@apple.com>
 849
 850         Disable test262 named capture group tests with direct unicode names and with references before definitions
 851         https://bugs.webkit.org/show_bug.cgi?id=178177
 852
 853         Reviewed by Keith Miller.
 854
 855         Bugs to track fixing these test are:
 856         https://bugs.webkit.org/show_bug.cgi?id=178174 -
 857             "Add support in named capture group identifiers for direct surrogate pairs"
 858         https://bugs.webkit.org/show_bug.cgi?id=178175 -
 859             "Test262 failure with Named Capture Groups - using a reference before the group is defined"
 860
 861         * test262.yaml:
 862
 863 2017-10-11  Caio Lima  <ticaiolima@gmail.com>
 864
 865         Object properties are undefined in super.call() but not in this.call()
 866         https://bugs.webkit.org/show_bug.cgi?id=177230
 867
 868         Reviewed by Saam Barati.
 869
 870         * stress/super-call-function-subclass.js: Added.
 871         (assert):
 872         (A.prototype.t):
 873         (A):
 874         * stress/super-dot-call-and-apply.js: Added.
 875         (assert):
 876         (A):
 877         (A.prototype.call):
 878         (A.prototype.apply):
 879         (B.prototype.testSuper):
 880         (B):
 881         (const.obj.new.B.string_appeared_here.obj.testSuper.C):
 882         (D.prototype.testSuper):
 883         (D):
 884
 885 2017-10-10  Saam Barati  <sbarati@apple.com>
 886
 887         The prototype cache should be aware of the Executable it generates a Structure for
 888         https://bugs.webkit.org/show_bug.cgi?id=177907
 889
 890         Reviewed by Filip Pizlo.
 891
 892         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js: Added.
 893         (assert):
 894         (foo.C):
 895         (foo):
 896         (bar.C):
 897         (bar):
 898         (access):
 899         (makeLongChain):
 900         (accessY):
 901
 902 2017-10-09  Yusuke Suzuki  <utatane.tea@gmail.com>
 903
 904         `async` should be able to be used as an imported binding name
 905         https://bugs.webkit.org/show_bug.cgi?id=176573
 906
 907         Reviewed by Saam Barati.
 908
 909         * modules/import-default-async.js: Added.
 910         * modules/import-named-async-as.js: Added.
 911         * modules/import-named-async.js: Added.
 912         * modules/import-named-async/target.js: Added.
 913         * modules/import-namespace-async.js: Added.
 914         * test262.yaml:
 915
 916 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
 917
 918         Enable gigacage on iOS
 919         https://bugs.webkit.org/show_bug.cgi?id=177586
 920
 921         Reviewed by JF Bastien.
 922
 923         Add tests for when Gigacage gets runtime disabled.
 924
 925         * stress/disable-gigacage-arrays.js: Added.
 926         (foo):
 927         * stress/disable-gigacage-strings.js: Added.
 928         (foo):
 929         * stress/disable-gigacage-typed-arrays.js: Added.
 930         (foo):
 931
 932 2017-10-09  Michael Saboff  <msaboff@apple.com>
 933
 934         Implement RegExp Unicode property escapes
 935         https://bugs.webkit.org/show_bug.cgi?id=172069
 936
 937         Reviewed by JF Bastien.
 938
 939         Enabled Unicode Property tests.
 940
 941         * test262.yaml:
 942
 943 2017-10-09  Commit Queue  <commit-queue@webkit.org>
 944
 945         Unreviewed, rolling out r223015 and r223025.
 946         https://bugs.webkit.org/show_bug.cgi?id=178093
 947
 948         Regressed Kraken on iOS by 20% (Requested by keith_mi_ on
 949         #webkit).
 950
 951         Reverted changesets:
 952
 953         "Enable gigacage on iOS"
 954         https://bugs.webkit.org/show_bug.cgi?id=177586
 955         http://trac.webkit.org/changeset/223015
 956
 957         "Unreviewed, disable Gigacage on ARM64 Linux"
 958         https://bugs.webkit.org/show_bug.cgi?id=177586
 959         http://trac.webkit.org/changeset/223025
 960
 961 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 962
 963         Update expectations for test262 tests that pass after r223043.
 964         https://bugs.webkit.org/show_bug.cgi?id=176685
 965
 966         Unreviewed test gardening.
 967
 968         * test262.yaml:
 969
 970 2017-10-09  Ryan Haddad  <ryanhaddad@apple.com>
 971
 972         Unreviewed, rolling out r223022.
 973
 974         This change introduced 18 test262 failures.
 975
 976         Reverted changeset:
 977
 978         "`async` should be able to be used as an imported binding
 979         name"
 980         https://bugs.webkit.org/show_bug.cgi?id=176573
 981         http://trac.webkit.org/changeset/223022
 982
 983 2017-10-09  Saam Barati  <sbarati@apple.com>
 984
 985         3 poly-proto JSC tests timing out on debug after r222827
 986         https://bugs.webkit.org/show_bug.cgi?id=177880
 987         <rdar://problem/34817122>
 988
 989         Unreviewed.
 990
 991         I'm skipping these type profiler tests on debug since they are long running.
 992
 993         * typeProfiler/deltablue-for-of.js:
 994         * typeProfiler/getter-richards.js:
 995
 996 2017-10-09  Oleksandr Skachkov  <gskachkov@gmail.com>
 997
 998         Safari 10 /11 problem with if (!await get(something)).
 999         https://bugs.webkit.org/show_bug.cgi?id=176685
1000
1001         Reviewed by Saam Barati.
1002
1003         * stress/async-await-basic.js:
1004         (awaitEpression.async):
1005         * stress/async-await-syntax.js:
1006         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
1007         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
1008
1009 2017-10-08  Saam Barati  <sbarati@apple.com>
1010
1011         Unreviewed. Make some type profiler tests run for less time to avoid debug timeouts.
1012
1013         * typeProfiler/deltablue-for-of.js:
1014         * typeProfiler/getter-richards.js:
1015
1016 2017-10-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1017
1018         `async` should be able to be used as an imported binding name
1019         https://bugs.webkit.org/show_bug.cgi?id=176573
1020
1021         Reviewed by Darin Adler.
1022
1023         * modules/import-default-async.js: Added.
1024         * modules/import-named-async-as.js: Added.
1025         * modules/import-named-async.js: Added.
1026         * modules/import-named-async/target.js: Added.
1027         * modules/import-namespace-async.js: Added.
1028
1029 2017-09-29  Filip Pizlo  <fpizlo@apple.com>
1030
1031         Enable gigacage on iOS
1032         https://bugs.webkit.org/show_bug.cgi?id=177586
1033
1034         Reviewed by JF Bastien.
1035
1036         Add tests for when Gigacage gets runtime disabled.
1037
1038         * stress/disable-gigacage-arrays.js: Added.
1039         (foo):
1040         * stress/disable-gigacage-strings.js: Added.
1041         (foo):
1042         * stress/disable-gigacage-typed-arrays.js: Added.
1043         (foo):
1044
1045 2017-10-06  Commit Queue  <commit-queue@webkit.org>
1046
1047         Unreviewed, rolling out r222791 and r222873.
1048         https://bugs.webkit.org/show_bug.cgi?id=178031
1049
1050         Caused crashes with workers/wasm LayoutTests (Requested by
1051         ryanhaddad on #webkit).
1052
1053         Reverted changesets:
1054
1055         "WebAssembly: no VM / JS version of everything but Instance"
1056         https://bugs.webkit.org/show_bug.cgi?id=177473
1057         http://trac.webkit.org/changeset/222791
1058
1059         "WebAssembly: address no VM / JS follow-ups"
1060         https://bugs.webkit.org/show_bug.cgi?id=177887
1061         http://trac.webkit.org/changeset/222873
1062
1063 2017-10-05  Saam Barati  <sbarati@apple.com>
1064
1065         Make sure all prototypes under poly proto get added into the VM's prototype map
1066         https://bugs.webkit.org/show_bug.cgi?id=177909
1067
1068         Reviewed by Keith Miller.
1069
1070         * stress/poly-proto-prototype-map-having-a-bad-time.js: Added.
1071         (assert):
1072         (foo.C):
1073         (foo):
1074         (set x):
1075
1076 2017-09-30  Yusuke Suzuki  <utatane.tea@gmail.com>
1077
1078         [JSC] Introduce import.meta
1079         https://bugs.webkit.org/show_bug.cgi?id=177703
1080
1081         Reviewed by Filip Pizlo.
1082
1083         * modules/import-meta-syntax.js: Added.
1084         (shouldThrow):
1085         (shouldNotThrow):
1086         * modules/import-meta.js: Added.
1087         * modules/import-meta/cocoa.js: Added.
1088         * modules/resources/assert.js:
1089         (export.shouldNotThrow):
1090         * stress/import-syntax.js:
1091
1092 2017-10-04  Saam Barati  <sbarati@apple.com>
1093
1094         Make pertinent AccessCases watch the poly proto watchpoint
1095         https://bugs.webkit.org/show_bug.cgi?id=177765
1096
1097         Reviewed by Keith Miller.
1098
1099         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js: Added.
1100         (assert):
1101         (foo.C):
1102         (foo):
1103         (validate):
1104         * stress/poly-proto-clear-stub.js: Added.
1105         (assert):
1106         (foo.C):
1107         (foo):
1108
1109 2017-10-04  Ryan Haddad  <ryanhaddad@apple.com>
1110
1111         Remove failure expectation for async-func-decl-dstr-obj-id-put-unresolvable-no-strict.js.
1112
1113         Unreviewed test gardening.
1114
1115         * test262.yaml:
1116
1117 2017-10-04  Saam Barati  <sbarati@apple.com>
1118
1119         3 poly-proto JSC tests timing out on debug after r222827
1120         https://bugs.webkit.org/show_bug.cgi?id=177880
1121
1122         Rubber stamped by Mark Lam.
1123
1124         * microbenchmarks/poly-proto-access.js:
1125         * typeProfiler/deltablue-for-of.js:
1126         * typeProfiler/getter-richards.js:
1127
1128 2017-10-04  Joseph Pecoraro  <pecoraro@apple.com>
1129
1130         Unreviewed, marking tco-catch.js as a failure after test262 update
1131         https://bugs.webkit.org/show_bug.cgi?id=177859
1132
1133         * test262.yaml:
1134
1135 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1136
1137         Unreviewed, marking one async iterator test262 test failed
1138         https://bugs.webkit.org/show_bug.cgi?id=177859
1139
1140         * test262.yaml:
1141
1142 2017-10-04  Yusuke Suzuki  <utatane.tea@gmail.com>
1143
1144         [Test262] Update Test262 to Oct 4 version
1145         https://bugs.webkit.org/show_bug.cgi?id=177859
1146
1147         Reviewed by Sam Weinig.
1148
1149         Let's rebaseline test262. Since it includes the latest changes to ArrayIterator::next,
1150         we no longer need to mark it skip/fail. Also this update includes bunch of BigInt tests.
1151
1152         * test262.yaml:
1153         * test262/harness/promiseHelper.js: Renamed from JSTests/test262/harness/PromiseHelper.js.
1154         (checkSequence):
1155         * test262/harness/typeCoercion.js:
1156         (testCoercibleToIndexZero):
1157         (testCoercibleToIndexOne):
1158         (testCoercibleToIndexFromIndex):
1159         (testNotCoercibleToIndex.testPrimitiveValue):
1160         (testNotCoercibleToInteger):
1161         (testCoercibleToBigIntZero.testPrimitiveValue):
1162         (testCoercibleToBigIntZero):
1163         (testCoercibleToBigIntOne.testPrimitiveValue):
1164         (testCoercibleToBigIntOne):
1165         (testPrimitiveValue):
1166         (testCoercibleToBigIntFromBigInt):
1167         (testNotCoercibleToBigInt.testPrimitiveValue):
1168         (testNotCoercibleToBigInt.testStringValue):
1169         (testNotCoercibleToBigInt):
1170         * test262/test/built-ins/Array/from/proto-from-ctor-realm.js:
1171         * test262/test/built-ins/Array/length/define-own-prop-length-overflow-realm.js:
1172         * test262/test/built-ins/Array/of/proto-from-ctor-realm.js:
1173         * test262/test/built-ins/Array/proto-from-ctor-realm.js:
1174         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-array.js:
1175         * test262/test/built-ins/Array/prototype/concat/create-proto-from-ctor-realm-non-array.js:
1176         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-array.js:
1177         * test262/test/built-ins/Array/prototype/filter/create-proto-from-ctor-realm-non-array.js:
1178         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-array.js:
1179         * test262/test/built-ins/Array/prototype/map/create-proto-from-ctor-realm-non-array.js:
1180         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-array.js:
1181         * test262/test/built-ins/Array/prototype/slice/create-proto-from-ctor-realm-non-array.js:
1182         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-array.js:
1183         * test262/test/built-ins/Array/prototype/splice/create-proto-from-ctor-realm-non-array.js:
1184         * test262/test/built-ins/ArrayBuffer/proto-from-ctor-realm.js:
1185         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint.js:
1186         (testCoercibleToBigIntZero):
1187         (testCoercibleToBigIntOne):
1188         (testNotCoercibleToBigInt):
1189         (MyError): Deleted.
1190         (valueOf): Deleted.
1191         (toString): Deleted.
1192         (Symbol.toPrimitive): Deleted.
1193         * test262/test/built-ins/BigInt/asIntN/bits-toindex.js:
1194         (testCoercibleToIndexZero):
1195         (testCoercibleToIndexOne):
1196         (testNotCoercibleToIndex):
1197         (MyError): Deleted.
1198         (assert.sameValue.BigInt.asIntN.valueOf): Deleted.
1199         (assert.sameValue.BigInt.asIntN.toString): Deleted.
1200         (BigInt.asIntN.Symbol.toPrimitive): Deleted.
1201         (BigInt.asIntN.valueOf): Deleted.
1202         (BigInt.asIntN.toString): Deleted.
1203         * test262/test/built-ins/BigInt/asUintN/arithmetic.js: Added.
1204         * test262/test/built-ins/BigInt/asUintN/asUintN.js: Added.
1205         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint.js: Added.
1206         (testCoercibleToBigIntZero):
1207         (testCoercibleToBigIntOne):
1208         (testNotCoercibleToBigInt):
1209         * test262/test/built-ins/BigInt/asUintN/bits-toindex.js: Added.
1210         (testCoercibleToIndexZero):
1211         (testCoercibleToIndexOne):
1212         (testNotCoercibleToIndex):
1213         * test262/test/built-ins/BigInt/asUintN/length.js: Added.
1214         * test262/test/built-ins/BigInt/asUintN/name.js: Added.
1215         * test262/test/built-ins/BigInt/asUintN/order-of-steps.js: Added.
1216         (bits.valueOf):
1217         (bigint.valueOf):
1218         * test262/test/built-ins/BigInt/prototype/valueOf/length.js: Added.
1219         * test262/test/built-ins/BigInt/prototype/valueOf/name.js: Added.
1220         * test262/test/built-ins/BigInt/prototype/valueOf/prop-desc.js: Added.
1221         * test262/test/built-ins/BigInt/prototype/valueOf/return.js: Added.
1222         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-object-throws.js: Added.
1223         * test262/test/built-ins/BigInt/prototype/valueOf/this-value-invalid-primitive-throws.js: Added.
1224         * test262/test/built-ins/Boolean/proto-from-ctor-realm.js:
1225         * test262/test/built-ins/DataView/proto-from-ctor-realm-sab.js:
1226         * test262/test/built-ins/DataView/proto-from-ctor-realm.js:
1227         * test262/test/built-ins/Date/proto-from-ctor-realm-one.js:
1228         * test262/test/built-ins/Date/proto-from-ctor-realm-two.js:
1229         * test262/test/built-ins/Date/proto-from-ctor-realm-zero.js:
1230         * test262/test/built-ins/Error/proto-from-ctor-realm.js:
1231         * test262/test/built-ins/Function/call-bind-this-realm-undef.js:
1232         * test262/test/built-ins/Function/call-bind-this-realm-value.js:
1233         * test262/test/built-ins/Function/internals/Call/class-ctor-realm.js:
1234         * test262/test/built-ins/Function/internals/Construct/base-ctor-revoked-proxy-realm.js:
1235         * test262/test/built-ins/Function/internals/Construct/derived-return-val-realm.js:
1236         * test262/test/built-ins/Function/internals/Construct/derived-this-uninitialized-realm.js:
1237         * test262/test/built-ins/Function/proto-from-ctor-realm.js:
1238         * test262/test/built-ins/Function/prototype/bind/get-fn-realm.js:
1239         * test262/test/built-ins/Function/prototype/bind/proto-from-ctor-realm.js:
1240         * test262/test/built-ins/GeneratorFunction/proto-from-ctor-realm.js:
1241         * test262/test/built-ins/JSON/stringify/bigint-order.js: Added.
1242         (replacer):
1243         (BigInt.prototype.toJSON):
1244         * test262/test/built-ins/JSON/stringify/bigint-replacer.js: Added.
1245         (replacer):
1246         * test262/test/built-ins/JSON/stringify/bigint-tojson.js: Added.
1247         (BigInt.prototype.toJSON):
1248         * test262/test/built-ins/JSON/stringify/bigint.js:
1249         * test262/test/built-ins/Map/proto-from-ctor-realm.js:
1250         * test262/test/built-ins/Number/S9.3.1_A2_U180E.js:
1251         * test262/test/built-ins/Number/S9.3.1_A3_T1_U180E.js:
1252         * test262/test/built-ins/Number/S9.3.1_A3_T2_U180E.js:
1253         * test262/test/built-ins/Number/proto-from-ctor-realm.js:
1254         * test262/test/built-ins/Object/proto-from-ctor.js:
1255         * test262/test/built-ins/Promise/proto-from-ctor-realm.js:
1256         * test262/test/built-ins/Proxy/apply/arguments-realm.js:
1257         * test262/test/built-ins/Proxy/apply/trap-is-not-callable-realm.js:
1258         * test262/test/built-ins/Proxy/construct/arguments-realm.js:
1259         * test262/test/built-ins/Proxy/construct/trap-is-not-callable-realm.js:
1260         * test262/test/built-ins/Proxy/construct/trap-is-undefined-proto-from-ctor-realm.js:
1261         * test262/test/built-ins/Proxy/defineProperty/desc-realm.js:
1262         * test262/test/built-ins/Proxy/defineProperty/null-handler-realm.js:
1263         * test262/test/built-ins/Proxy/defineProperty/targetdesc-configurable-desc-not-configurable-realm.js:
1264         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-not-configurable-target-realm.js:
1265         * test262/test/built-ins/Proxy/defineProperty/targetdesc-not-compatible-descriptor-realm.js:
1266         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-not-configurable-descriptor-realm.js:
1267         * test262/test/built-ins/Proxy/defineProperty/targetdesc-undefined-target-is-not-extensible-realm.js:
1268         * test262/test/built-ins/Proxy/defineProperty/trap-is-not-callable-realm.js:
1269         * test262/test/built-ins/Proxy/deleteProperty/trap-is-not-callable-realm.js:
1270         * test262/test/built-ins/Proxy/get-fn-realm.js:
1271         * test262/test/built-ins/Proxy/get/trap-is-not-callable-realm.js:
1272         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/result-type-is-not-object-nor-undefined-realm.js:
1273         * test262/test/built-ins/Proxy/getOwnPropertyDescriptor/trap-is-not-callable-realm.js:
1274         * test262/test/built-ins/Proxy/getPrototypeOf/trap-is-not-callable-realm.js:
1275         * test262/test/built-ins/Proxy/has/trap-is-not-callable-realm.js:
1276         * test262/test/built-ins/Proxy/isExtensible/trap-is-not-callable-realm.js:
1277         * test262/test/built-ins/Proxy/ownKeys/return-not-list-object-throws-realm.js:
1278         * test262/test/built-ins/Proxy/ownKeys/trap-is-not-callable-realm.js:
1279         * test262/test/built-ins/Proxy/preventExtensions/trap-is-not-callable-realm.js:
1280         * test262/test/built-ins/Proxy/set/trap-is-not-callable-realm.js:
1281         * test262/test/built-ins/Proxy/setPrototypeOf/trap-is-not-callable-realm.js:
1282         * test262/test/built-ins/RegExp/S15.10.2.12_A1_T1.js:
1283         (i6.replace):
1284         (i6b.replace):
1285         * test262/test/built-ins/RegExp/dotall/with-dotall-unicode.js:
1286         * test262/test/built-ins/RegExp/dotall/with-dotall.js:
1287         * test262/test/built-ins/RegExp/dotall/without-dotall-unicode.js:
1288         * test262/test/built-ins/RegExp/dotall/without-dotall.js:
1289         * test262/test/built-ins/RegExp/proto-from-ctor-realm.js:
1290         * test262/test/built-ins/RegExp/prototype/Symbol.split/splitter-proto-from-ctor-realm.js:
1291         * test262/test/built-ins/RegExp/u180e.js: Added.
1292         * test262/test/built-ins/Set/proto-from-ctor-realm.js:
1293         * test262/test/built-ins/SharedArrayBuffer/proto-from-ctor-realm.js:
1294         * test262/test/built-ins/String/proto-from-ctor-realm.js:
1295         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail.js:
1296         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Fail_2.js:
1297         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success.js:
1298         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_2.js:
1299         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_3.js:
1300         * test262/test/built-ins/String/prototype/endsWith/String.prototype.endsWith_Success_4.js:
1301         * test262/test/built-ins/String/prototype/endsWith/coerced-values-of-position.js:
1302         * test262/test/built-ins/String/prototype/endsWith/endsWith.js:
1303         * test262/test/built-ins/String/prototype/endsWith/length.js:
1304         * test262/test/built-ins/String/prototype/endsWith/name.js:
1305         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position-as-symbol.js:
1306         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-position.js:
1307         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-as-symbol.js:
1308         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring-regexp-test.js:
1309         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-searchstring.js:
1310         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this-as-symbol.js:
1311         * test262/test/built-ins/String/prototype/endsWith/return-abrupt-from-this.js:
1312         * test262/test/built-ins/String/prototype/endsWith/return-false-if-search-start-is-less-than-zero.js:
1313         * test262/test/built-ins/String/prototype/endsWith/return-true-if-searchstring-is-empty.js:
1314         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-with-position.js:
1315         * test262/test/built-ins/String/prototype/endsWith/searchstring-found-without-position.js:
1316         * test262/test/built-ins/String/prototype/endsWith/searchstring-is-regexp-throws.js:
1317         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-with-position.js:
1318         * test262/test/built-ins/String/prototype/endsWith/searchstring-not-found-without-position.js:
1319         * test262/test/built-ins/String/prototype/endsWith/this-is-null-throws.js:
1320         * test262/test/built-ins/String/prototype/endsWith/this-is-undefined-throws.js:
1321         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailBadLocation.js:
1322         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailLocation.js:
1323         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_FailMissingLetter.js:
1324         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_Success.js:
1325         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_SuccessNoLocation.js:
1326         * test262/test/built-ins/String/prototype/includes/String.prototype.includes_lengthProp.js:
1327         * test262/test/built-ins/String/prototype/includes/coerced-values-of-position.js:
1328         * test262/test/built-ins/String/prototype/includes/includes.js:
1329         * test262/test/built-ins/String/prototype/includes/length.js:
1330         * test262/test/built-ins/String/prototype/includes/name.js:
1331         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position-as-symbol.js:
1332         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-position.js:
1333         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-as-symbol.js:
1334         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring-regexp-test.js:
1335         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-searchstring.js:
1336         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this-as-symbol.js:
1337         * test262/test/built-ins/String/prototype/includes/return-abrupt-from-this.js:
1338         * test262/test/built-ins/String/prototype/includes/return-false-with-out-of-bounds-position.js:
1339         * test262/test/built-ins/String/prototype/includes/return-true-if-searchstring-is-empty.js:
1340         * test262/test/built-ins/String/prototype/includes/searchstring-found-with-position.js:
1341         * test262/test/built-ins/String/prototype/includes/searchstring-found-without-position.js:
1342         * test262/test/built-ins/String/prototype/includes/searchstring-is-regexp-throws.js:
1343         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-with-position.js:
1344         * test262/test/built-ins/String/prototype/includes/searchstring-not-found-without-position.js:
1345         * test262/test/built-ins/String/prototype/includes/this-is-null-throws.js:
1346         * test262/test/built-ins/String/prototype/includes/this-is-undefined-throws.js:
1347         * test262/test/built-ins/String/prototype/toLocaleLowerCase/Final_Sigma_U180E.js:
1348         * test262/test/built-ins/String/prototype/toLowerCase/Final_Sigma_U180E.js:
1349         * test262/test/built-ins/String/prototype/trim/u180e.js:
1350         * test262/test/built-ins/Symbol/for/cross-realm.js:
1351         * test262/test/built-ins/Symbol/hasInstance/cross-realm.js:
1352         * test262/test/built-ins/Symbol/isConcatSpreadable/cross-realm.js:
1353         * test262/test/built-ins/Symbol/iterator/cross-realm.js:
1354         * test262/test/built-ins/Symbol/keyFor/cross-realm.js:
1355         * test262/test/built-ins/Symbol/match/cross-realm.js:
1356         * test262/test/built-ins/Symbol/replace/cross-realm.js:
1357         * test262/test/built-ins/Symbol/search/cross-realm.js:
1358         * test262/test/built-ins/Symbol/species/cross-realm.js:
1359         * test262/test/built-ins/Symbol/split/cross-realm.js:
1360         * test262/test/built-ins/Symbol/toPrimitive/cross-realm.js:
1361         * test262/test/built-ins/Symbol/toStringTag/cross-realm.js:
1362         * test262/test/built-ins/Symbol/unscopables/cross-realm.js:
1363         * test262/test/built-ins/ThrowTypeError/distinct-cross-realm.js:
1364         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm-sab.js:
1365         * test262/test/built-ins/TypedArrays/buffer-arg-proto-from-ctor-realm.js:
1366         * test262/test/built-ins/TypedArrays/internals/DefineOwnProperty/detached-buffer-realm.js:
1367         * test262/test/built-ins/TypedArrays/internals/Get/detached-buffer-realm.js:
1368         * test262/test/built-ins/TypedArrays/internals/GetOwnProperty/detached-buffer-realm.js:
1369         * test262/test/built-ins/TypedArrays/internals/HasProperty/detached-buffer-realm.js:
1370         * test262/test/built-ins/TypedArrays/internals/Set/detached-buffer-realm.js:
1371         * test262/test/built-ins/TypedArrays/length-arg-proto-from-ctor-realm.js:
1372         * test262/test/built-ins/TypedArrays/no-args-proto-from-ctor-realm.js:
1373         * test262/test/built-ins/TypedArrays/object-arg-proto-from-ctor-realm.js:
1374         * test262/test/built-ins/TypedArrays/typedarray-arg-other-ctor-buffer-ctor-custom-species-proto-from-ctor-realm.js:
1375         * test262/test/built-ins/TypedArrays/typedarray-arg-proto-from-ctor-realm.js:
1376         * test262/test/built-ins/TypedArrays/typedarray-arg-same-ctor-buffer-ctor-species-custom-proto-from-ctor-realm.js:
1377         * test262/test/built-ins/WeakMap/proto-from-ctor-realm.js:
1378         * test262/test/built-ins/WeakSet/proto-from-ctor-realm.js:
1379         * test262/test/built-ins/parseFloat/S15.1.2.3_A2_T10_U180E.js:
1380         * test262/test/built-ins/parseInt/S15.1.2.2_A2_T10_U180E.js:
1381         * test262/test/intl402/NumberFormat/prototype/formatToParts/length.js:
1382         * test262/test/language/comments/mongolian-vowel-separator-multi.js:
1383         * test262/test/language/comments/mongolian-vowel-separator-single-eval.js:
1384         * test262/test/language/comments/mongolian-vowel-separator-single.js:
1385         * test262/test/language/eval-code/indirect/realm.js:
1386         * test262/test/language/expressions/assignment/dstr-obj-rest-order.js: Added.
1387         (o.get z):
1388         (o.get a):
1389         * test262/test/language/expressions/call/eval-realm-indirect.js:
1390         * test262/test/language/expressions/generators/eval-body-proto-realm.js:
1391         * test262/test/language/expressions/greater-than-or-equal/bigint-and-bigint.js: Added.
1392         * test262/test/language/expressions/greater-than-or-equal/bigint-and-non-finite.js: Added.
1393         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number-extremes.js: Added.
1394         * test262/test/language/expressions/greater-than-or-equal/bigint-and-number.js:
1395         * test262/test/language/expressions/greater-than/bigint-and-bigint.js: Added.
1396         * test262/test/language/expressions/greater-than/bigint-and-non-finite.js: Added.
1397         * test262/test/language/expressions/greater-than/bigint-and-number-extremes.js: Added.
1398         * test262/test/language/expressions/greater-than/bigint-and-number.js:
1399         * test262/test/language/expressions/less-than-or-equal/bigint-and-bigint.js: Added.
1400         * test262/test/language/expressions/less-than-or-equal/bigint-and-non-finite.js: Added.
1401         * test262/test/language/expressions/less-than-or-equal/bigint-and-number-extremes.js: Added.
1402         * test262/test/language/expressions/less-than-or-equal/bigint-and-number.js:
1403         * test262/test/language/expressions/less-than/bigint-and-bigint.js: Added.
1404         * test262/test/language/expressions/less-than/bigint-and-non-finite.js: Added.
1405         * test262/test/language/expressions/less-than/bigint-and-number-extremes.js: Added.
1406         * test262/test/language/expressions/less-than/bigint-and-number.js:
1407         * test262/test/language/expressions/new/non-ctor-err-realm.js:
1408         * test262/test/language/expressions/super/realm.js:
1409         * test262/test/language/expressions/tagged-template/cache-realm.js:
1410         * test262/test/language/expressions/template-literal/mongolian-vowel-separator-eval.js:
1411         * test262/test/language/expressions/template-literal/mongolian-vowel-separator.js:
1412         * test262/test/language/literals/regexp/mongolian-vowel-separator-eval.js:
1413         * test262/test/language/literals/regexp/mongolian-vowel-separator.js:
1414         * test262/test/language/literals/string/mongolian-vowel-separator-eval.js:
1415         * test262/test/language/literals/string/mongolian-vowel-separator.js:
1416         * test262/test/language/statements/for-of/dstr-obj-rest-order.js: Added.
1417         (o.get z):
1418         (o.get a):
1419         * test262/test/language/statements/for-of/iterator-next-reference.js:
1420         (next):
1421         (iterator.next): Deleted.
1422         (x.of.iterable.): Deleted.
1423         (x.of.iterable.get return): Deleted.
1424         (x.of.iterable.iterator.next): Deleted.
1425         * test262/test/language/types/reference/get-value-prop-base-primitive-realm.js:
1426         * test262/test/language/types/reference/put-value-prop-base-primitive-realm.js:
1427         * test262/test/language/white-space/mongolian-vowel-separator-eval.js:
1428         * test262/test/language/white-space/mongolian-vowel-separator.js:
1429         * test262/test262-Revision.txt:
1430
1431 2017-10-03  Saam Barati  <sbarati@apple.com>
1432
1433         Implement polymorphic prototypes
1434         https://bugs.webkit.org/show_bug.cgi?id=176391
1435
1436         Reviewed by Filip Pizlo.
1437
1438         * microbenchmarks/poly-proto-access.js: Added.
1439         (assert):
1440         (foo.C):
1441         (foo.C.prototype.get bar):
1442         (foo):
1443         (bar):
1444         * microbenchmarks/poly-proto-put-transition-speed.js: Added.
1445         (assert):
1446         (makePolyProtoObject.foo.C):
1447         (makePolyProtoObject.foo):
1448         (makePolyProtoObject):
1449         (performSet):
1450         * microbenchmarks/poly-proto-setter-speed.js: Added.
1451         (assert):
1452         (makePolyProtoObject.foo.C):
1453         (makePolyProtoObject.foo.C.prototype.set p):
1454         (makePolyProtoObject.foo):
1455         (makePolyProtoObject):
1456         (performSet):
1457         * stress/constructor-with-return.js:
1458         (i.tests.forEach.Constructor):
1459         (i.tests.forEach):
1460         (tests.forEach.Constructor): Deleted.
1461         (tests.forEach): Deleted.
1462         * stress/dom-jit-with-poly-proto.js: Added.
1463         (assert):
1464         (makePolyProtoObject.foo.C):
1465         (makePolyProtoObject.foo):
1466         (makePolyProtoObject):
1467         (validate):
1468         * stress/poly-proto-custom-value-and-accessor.js: Added.
1469         (assert):
1470         (makePolyProtoObject.foo.C):
1471         (makePolyProtoObject.foo):
1472         (makePolyProtoObject):
1473         (items.forEach):
1474         (set get for):
1475         * stress/poly-proto-intrinsic-getter-correctness.js: Added.
1476         (assert):
1477         (makePolyProtoObject.foo.C):
1478         (makePolyProtoObject.foo):
1479         (makePolyProtoObject):
1480         (foo):
1481         * stress/poly-proto-miss.js: Added.
1482         (makePolyProtoInstanceWithNullPrototype.foo.C):
1483         (makePolyProtoInstanceWithNullPrototype.foo):
1484         (makePolyProtoInstanceWithNullPrototype):
1485         (assert):
1486         (validate):
1487         * stress/poly-proto-op-in-caching.js: Added.
1488         (assert):
1489         (makePolyProtoObject.foo.C):
1490         (makePolyProtoObject.foo):
1491         (makePolyProtoObject):
1492         (validate):
1493         (validate2):
1494         * stress/poly-proto-put-transition.js: Added.
1495         (assert):
1496         (makePolyProtoObject.foo.C):
1497         (makePolyProtoObject.foo):
1498         (makePolyProtoObject):
1499         (performSet):
1500         (i.obj.__proto__.set p):
1501         * stress/poly-proto-set-prototype.js: Added.
1502         (assert):
1503         (let.alternateProto.get x):
1504         (let.alternateProto2.get y):
1505         (let.alternateProto2.get x):
1506         (foo.C):
1507         (foo):
1508         (validate):
1509         * stress/poly-proto-setter.js: Added.
1510         (assert):
1511         (makePolyProtoObject.foo.C):
1512         (makePolyProtoObject.foo.C.prototype.set p):
1513         (makePolyProtoObject.foo.C.prototype.get p):
1514         (makePolyProtoObject.foo):
1515         (makePolyProtoObject):
1516         (performSet):
1517         * stress/poly-proto-using-inheritance.js: Added.
1518         (assert):
1519         (foo.C):
1520         (foo.C.prototype.get baz):
1521         (foo):
1522         (bar.C):
1523         (bar):
1524         (validate):
1525         * stress/primitive-poly-proto.js: Added.
1526         (makePolyProtoInstance.foo.C):
1527         (makePolyProtoInstance.foo):
1528         (makePolyProtoInstance):
1529         (assert):
1530         (validate):
1531         * stress/prototype-is-not-js-object.js: Added.
1532         (foo.bar):
1533         (foo):
1534         (assert):
1535         (validate):
1536         * stress/try-get-by-id-poly-proto.js: Added.
1537         (assert):
1538         (makePolyProtoObject.foo.C):
1539         (makePolyProtoObject.foo):
1540         (makePolyProtoObject):
1541         (tryGetByIdText):
1542         (x.__proto__.get bar):
1543         (validate):
1544         * typeProfiler/overflow.js:
1545
1546 2017-10-03  JF Bastien  <jfbastien@apple.com>
1547
1548         WebAssembly: no VM / JS version of everything but Instance
1549         https://bugs.webkit.org/show_bug.cgi?id=177473
1550
1551         Reviewed by Filip Pizlo.
1552
1553         - Exceeding max on memory growth now returns a range error as per
1554         spec. This is a (very minor) breaking change: it used to throw OOM
1555         error. Update the corresponding test.
1556
1557         * wasm/js-api/memory-grow.js:
1558         (assertEq):
1559         * wasm/js-api/table.js:
1560         (assert.throws):
1561
1562 2017-10-03  Ryan Haddad  <ryanhaddad@apple.com>
1563
1564         Skip JSC test stress/regress-159779-2.js on debug.
1565         https://bugs.webkit.org/show_bug.cgi?id=177204
1566
1567         Unreviewed test gardening.
1568
1569         * stress/regress-159779-2.js:
1570
1571 2017-10-02  Caio Lima  <ticaiolima@gmail.com>
1572
1573         ChakraCore/test/Function/apply3.js is resulting wrong result in x86_64
1574         https://bugs.webkit.org/show_bug.cgi?id=175642
1575
1576         Reviewed by Darin Adler.
1577
1578         * ChakraCore/test/Function/apply3.baseline-jsc:
1579
1580 2017-10-01  Commit Queue  <commit-queue@webkit.org>
1581
1582         Unreviewed, rolling out r222564.
1583         https://bugs.webkit.org/show_bug.cgi?id=177720
1584
1585         "It regressed JetStream by 2% on iOS caused by a 50%
1586         regression on the bigfib subtest" (Requested by saamyjoon on
1587         #webkit).
1588
1589         Reverted changeset:
1590
1591         "Add Above/Below comparisons for UInt32 patterns"
1592         https://bugs.webkit.org/show_bug.cgi?id=177281
1593         http://trac.webkit.org/changeset/222564
1594
1595 2017-09-29  Yusuke Suzuki  <utatane.tea@gmail.com>
1596
1597         [DFG] Support ArrayPush with multiple args
1598         https://bugs.webkit.org/show_bug.cgi?id=175823
1599
1600         Reviewed by Saam Barati.
1601
1602         * microbenchmarks/array-push-0.js: Added.
1603         (arrayPush0):
1604         * microbenchmarks/array-push-1.js: Added.
1605         (arrayPush1):
1606         * microbenchmarks/array-push-2.js: Added.
1607         (arrayPush2):
1608         * microbenchmarks/array-push-3.js: Added.
1609         (arrayPush3):
1610         * stress/array-push-multiple-contiguous.js: Added.
1611         (shouldBe):
1612         (test):
1613         * stress/array-push-multiple-double-nan.js: Added.
1614         (shouldBe):
1615         (test):
1616         * stress/array-push-multiple-double.js: Added.
1617         (shouldBe):
1618         (test):
1619         * stress/array-push-multiple-int32.js: Added.
1620         (shouldBe):
1621         (test):
1622         * stress/array-push-multiple-many-contiguous.js: Added.
1623         (shouldBe):
1624         (test):
1625         * stress/array-push-multiple-many-double.js: Added.
1626         (shouldBe):
1627         (test):
1628         * stress/array-push-multiple-many-int32.js: Added.
1629         (shouldBe):
1630         (test):
1631         * stress/array-push-multiple-many-storage.js: Added.
1632         (shouldBe):
1633         (test):
1634         * stress/array-push-multiple-storage.js: Added.
1635         (shouldBe):
1636         (test):
1637         * stress/array-push-with-force-exit.js: Added.
1638         (target.createBuiltin):
1639
1640 2017-09-29  Saam Barati  <sbarati@apple.com>
1641
1642         Custom GetterSetterAccessCase does not use the correct slotBase when making call
1643         https://bugs.webkit.org/show_bug.cgi?id=177639
1644
1645         Reviewed by Geoffrey Garen.
1646
1647         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js: Added.
1648         (assert):
1649         (Class):
1650         (items.forEach):
1651         (set get for):
1652
1653 2017-09-29  Commit Queue  <commit-queue@webkit.org>
1654
1655         Unreviewed, rolling out r222563, r222565, and r222581.
1656         https://bugs.webkit.org/show_bug.cgi?id=177675
1657
1658         "It causes a crash when playing youtube videos" (Requested by
1659         saamyjoon on #webkit).
1660
1661         Reverted changesets:
1662
1663         "[DFG] Support ArrayPush with multiple args"
1664         https://bugs.webkit.org/show_bug.cgi?id=175823
1665         http://trac.webkit.org/changeset/222563
1666
1667         "Unreviewed, build fix after r222563"
1668         https://bugs.webkit.org/show_bug.cgi?id=175823
1669         http://trac.webkit.org/changeset/222565
1670
1671         "Unreviewed, fix x86 breaking due to exhausted registers"
1672         https://bugs.webkit.org/show_bug.cgi?id=175823
1673         http://trac.webkit.org/changeset/222581
1674
1675 2017-09-28  Mark Lam  <mark.lam@apple.com>
1676
1677         test262: Unexpected passes after r222617 and r222618.
1678         https://bugs.webkit.org/show_bug.cgi?id=177622
1679         <rdar://problem/34725960>
1680
1681         Reviewed by Saam Barati.
1682
1683         Update test262.yaml for tests that are now passing.
1684
1685         * test262.yaml:
1686
1687 2017-09-27  Michael Saboff  <msaboff@apple.com>
1688
1689         REGRESSION(210837): RegExp containing failed non-zero minimum greedy groups incorrectly match
1690         https://bugs.webkit.org/show_bug.cgi?id=177570
1691
1692         Reviewed by Filip Pizlo.
1693
1694         New regression test.
1695
1696         * stress/regress-177570.js: Added.
1697
1698 2017-09-28  Michael Saboff  <msaboff@apple.com>
1699
1700         Heap out of bounds read in JSC::Yarr::Parser<JSC::Yarr::SyntaxChecker, unsigned char>::peek()
1701         https://bugs.webkit.org/show_bug.cgi?id=177423
1702
1703         Reviewed by Mark Lam.
1704
1705         Updated regression test.
1706
1707         * stress/regress-177423.js:
1708         (catch):
1709
1710 2017-09-27  Mark Lam  <mark.lam@apple.com>
1711
1712         JSArray::canFastCopy() should fail if the source and destination arrays are the same.
1713         https://bugs.webkit.org/show_bug.cgi?id=177584
1714         <rdar://problem/34463903>
1715
1716         Reviewed by Saam Barati.
1717
1718         * stress/regress-177584.js: Added.
1719         (assertEqual):
1720         (Array.prototype.Symbol.species):
1721
1722 2017-09-27  Saam Barati  <sbarati@apple.com>
1723
1724         Propagate hasBeenFlattenedBefore in Structure's transition constructor and fix our for-in caching to fail when the prototype chain has an object with a dictionary structure
1725         https://bugs.webkit.org/show_bug.cgi?id=177523
1726
1727         Reviewed by Mark Lam.
1728
1729         * stress/prototype-chain-has-dictionary-structure-for-in-caching.js: Added.
1730         (assert):
1731         (Test):
1732         (addMethods.Test.prototype.string_appeared_here.i.methodNumber):
1733         (addMethods):
1734         (i.Test.prototype.propName):
1735
1736 2017-09-27  Mark Lam  <mark.lam@apple.com>
1737
1738         Yarr::Parser::tryConsumeGroupName() should check for the end of the pattern.
1739         https://bugs.webkit.org/show_bug.cgi?id=177423
1740         <rdar://problem/34621320>
1741
1742         Reviewed by Keith Miller.
1743
1744         * stress/regress-177423.js: Added.
1745
1746 2017-09-27  Yusuke Suzuki  <utatane.tea@gmail.com>
1747
1748         Add Above/Below comparisons for UInt32 patterns
1749         https://bugs.webkit.org/show_bug.cgi?id=177281
1750
1751         Reviewed by Saam Barati.
1752
1753         * stress/uint32-comparison-jump.js: Added.
1754         (shouldBe):
1755         (above):
1756         (aboveOrEqual):
1757         (below):
1758         (belowOrEqual):
1759         (notAbove):
1760         (notAboveOrEqual):
1761         (notBelow):
1762         (notBelowOrEqual):
1763         * stress/uint32-comparison.js: Added.
1764         (shouldBe):
1765         (above):
1766         (aboveOrEqual):
1767         (below):
1768         (belowOrEqual):
1769         (aboveTest):
1770         (aboveOrEqualTest):
1771         (belowTest):
1772         (belowOrEqualTest):
1773
1774 2017-09-25  Yusuke Suzuki  <utatane.tea@gmail.com>
1775
1776         [DFG] Support ArrayPush with multiple args
1777         https://bugs.webkit.org/show_bug.cgi?id=175823
1778
1779         Reviewed by Saam Barati.
1780
1781         * microbenchmarks/array-push-0.js: Added.
1782         (arrayPush0):
1783         * microbenchmarks/array-push-1.js: Added.
1784         (arrayPush1):
1785         * microbenchmarks/array-push-2.js: Added.
1786         (arrayPush2):
1787         * microbenchmarks/array-push-3.js: Added.
1788         (arrayPush3):
1789         * stress/array-push-multiple-contiguous.js: Added.
1790         (shouldBe):
1791         (test):
1792         * stress/array-push-multiple-double-nan.js: Added.
1793         (shouldBe):
1794         (test):
1795         * stress/array-push-multiple-double.js: Added.
1796         (shouldBe):
1797         (test):
1798         * stress/array-push-multiple-int32.js: Added.
1799         (shouldBe):
1800         (test):
1801         * stress/array-push-multiple-many-contiguous.js: Added.
1802         (shouldBe):
1803         (test):
1804         * stress/array-push-multiple-many-double.js: Added.
1805         (shouldBe):
1806         (test):
1807         * stress/array-push-multiple-many-int32.js: Added.
1808         (shouldBe):
1809         (test):
1810         * stress/array-push-multiple-many-storage.js: Added.
1811         (shouldBe):
1812         (test):
1813         * stress/array-push-multiple-storage.js: Added.
1814         (shouldBe):
1815         (test):
1816
1817 2017-09-26  Commit Queue  <commit-queue@webkit.org>
1818
1819         Unreviewed, rolling out r222518.
1820         https://bugs.webkit.org/show_bug.cgi?id=177507
1821
1822         Break the High Sierra build (Requested by yusukesuzuki on
1823         #webkit).
1824
1825         Reverted changeset:
1826
1827         "Add Above/Below comparisons for UInt32 patterns"
1828         https://bugs.webkit.org/show_bug.cgi?id=177281
1829         http://trac.webkit.org/changeset/222518
1830
1831 2017-09-26  Yusuke Suzuki  <utatane.tea@gmail.com>
1832
1833         Add Above/Below comparisons for UInt32 patterns
1834         https://bugs.webkit.org/show_bug.cgi?id=177281
1835
1836         Reviewed by Saam Barati.
1837
1838         * stress/uint32-comparison-jump.js: Added.
1839         (shouldBe):
1840         (above):
1841         (aboveOrEqual):
1842         (below):
1843         (belowOrEqual):
1844         (notAbove):
1845         (notAboveOrEqual):
1846         (notBelow):
1847         (notBelowOrEqual):
1848         * stress/uint32-comparison.js: Added.
1849         (shouldBe):
1850         (above):
1851         (aboveOrEqual):
1852         (below):
1853         (belowOrEqual):
1854         (aboveTest):
1855         (aboveOrEqualTest):
1856         (belowTest):
1857         (belowOrEqualTest):
1858
1859 2017-09-23  Keith Miller  <keith_miller@apple.com>
1860
1861         Fix infinite looping test262 test
1862         https://bugs.webkit.org/show_bug.cgi?id=177412
1863
1864         Reviewed by Yusuke Suzuki.
1865
1866         This test was poorly designed since failing it would cause the vm
1867         to inifinite loop. I've fixed it locally and will fix it on github pending
1868         the results of next weeks tc39 meeting.
1869
1870         * test262.yaml:
1871         * test262/test/language/statements/for-of/iterator-next-reference.js:
1872
1873 2017-09-23  Joseph Pecoraro  <pecoraro@apple.com>
1874
1875         test262: $.agent became $262.agent in test262 update
1876         https://bugs.webkit.org/show_bug.cgi?id=177407
1877
1878         Reviewed by Yusuke Suzuki.
1879
1880         * test262.yaml:
1881         ~320 tests pass now that we correctly make $262 available.
1882
1883 2017-09-22  Keith Miller  <keith_miller@apple.com>
1884
1885         Speculatively change iteration protocall to use the same next function
1886         https://bugs.webkit.org/show_bug.cgi?id=175653
1887
1888         Reviewed by Saam Barati.
1889
1890         Change test to match the new iteration behavior.
1891
1892         * stress/spread-optimized-properly.js:
1893
1894 2017-09-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1895
1896         [DFG][FTL] Profile array vector length for array allocation
1897         https://bugs.webkit.org/show_bug.cgi?id=177051
1898
1899         Reviewed by Saam Barati.
1900
1901         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1902         (target):
1903
1904 2017-09-22  Commit Queue  <commit-queue@webkit.org>
1905
1906         Unreviewed, rolling out r222380.
1907         https://bugs.webkit.org/show_bug.cgi?id=177352
1908
1909         Octane/box2d shows 8% regression (Requested by yusukesuzuki on
1910         #webkit).
1911
1912         Reverted changeset:
1913
1914         "[DFG][FTL] Profile array vector length for array allocation"
1915         https://bugs.webkit.org/show_bug.cgi?id=177051
1916         http://trac.webkit.org/changeset/222380
1917
1918 2017-09-21  Yusuke Suzuki  <utatane.tea@gmail.com>
1919
1920         [DFG][FTL] Profile array vector length for array allocation
1921         https://bugs.webkit.org/show_bug.cgi?id=177051
1922
1923         Reviewed by Saam Barati.
1924
1925         * microbenchmarks/new-array-buffer-vector-profile.js: Added.
1926         (target):
1927
1928 2017-09-21  Joseph Pecoraro  <pecoraro@apple.com>
1929
1930         Skip new hanging test262 tests.
1931         https://bugs.webkit.org/show_bug.cgi?id=177326
1932
1933         Unreviewed test gardening.
1934
1935         * test262.yaml:
1936
1937 2017-09-21  Ryan Haddad  <ryanhaddad@apple.com>
1938
1939         Mark 6 test262 tests as passing.
1940         https://bugs.webkit.org/show_bug.cgi?id=177307
1941
1942         Unreviewed test gardening.
1943
1944         * test262.yaml:
1945
1946 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1947
1948         Unreviewed follow-up to r222311.
1949
1950         * test262/harness/sta.js:
1951         * test262/test/built-ins/Array/from/calling-from-valid-1-noStrict.js:
1952         * test262/test/built-ins/Array/from/calling-from-valid-1-onlyStrict.js:
1953         * test262/test/built-ins/Array/from/calling-from-valid-2.js:
1954         * test262/test/built-ins/Array/from/elements-added-after.js:
1955         * test262/test/built-ins/Array/from/elements-deleted-after.js:
1956         * test262/test/built-ins/Array/from/elements-updated-after.js:
1957         * test262/test/built-ins/Array/from/from-array.js:
1958         * test262/test/built-ins/Array/from/mapfn-is-not-callable-typeerror.js:
1959         * test262/test/built-ins/Array/from/mapfn-throws-exception.js:
1960         * test262/test/built-ins/Array/from/source-array-boundary.js:
1961         * test262/test/built-ins/Array/from/source-object-constructor.js:
1962         * test262/test/built-ins/Array/from/source-object-iterator-1.js:
1963         * test262/test/built-ins/Array/from/source-object-iterator-2.js:
1964         * test262/test/built-ins/Array/from/source-object-length.js:
1965         * test262/test/built-ins/Array/from/source-object-missing.js:
1966         * test262/test/built-ins/Array/from/source-object-without.js:
1967         * test262/test/built-ins/Array/from/this-null.js:
1968         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1969         * test262/test/language/line-terminators/S7.3_A3.2_T1.js:
1970         * test262/test/language/literals/numeric/7.8.3-1gs.js:
1971         * test262/test/language/literals/numeric/7.8.3-2gs.js:
1972         * test262/test/language/literals/numeric/7.8.3-3gs.js:
1973         * test262/test/language/literals/regexp/7.8.5-1gs.js:
1974         * test262/test/language/literals/string/7.8.4-1gs.js:
1975         Fix some files that I failed to update when I applied my patch.
1976
1977 2017-09-20  Joseph Pecoraro  <pecoraro@apple.com>
1978
1979         Update test262 tests
1980         https://bugs.webkit.org/show_bug.cgi?id=177220
1981
1982         Reviewed by Saam Barati and Yusuke Suzuki.
1983
1984         * test262.yaml:
1985         * test262/test262-Revision.txt:
1986         New rebaselined expectations for all tests.
1987
1988         * test262/*:
1989         Updated.
1990
1991 2017-09-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1992
1993         [DFG] Remove ToThis more aggressively
1994         https://bugs.webkit.org/show_bug.cgi?id=177056
1995
1996         Reviewed by Saam Barati.
1997
1998         * stress/generator-with-this-strict.js: Added.
1999         (shouldBe):
2000         (generator):
2001         (target):
2002         * stress/generator-with-this.js: Added.
2003         (shouldBe):
2004         (generator):
2005         (target):
2006
2007 2017-09-17  Michael Saboff  <msaboff@apple.com>
2008
2009         https://bugs.webkit.org/show_bug.cgi?id=177038
2010         Add an option to run-jsc-stress-tests to limit tests variations to a basic set
2011
2012         Reviewed by JF Bastien.
2013
2014         * stress/unshiftCountSlowCase-correct-postCapacity.js: Disabled this test on ARM64 iOS devices
2015         as it dies using too much memory.
2016
2017 2017-09-15  Saam Barati  <sbarati@apple.com>
2018
2019         Arity fixup during inlining should do a 2 phase commit so it properly recovers the frame in case of exit
2020         https://bugs.webkit.org/show_bug.cgi?id=176981
2021
2022         Reviewed by Yusuke Suzuki.
2023
2024         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js: Added.
2025         (assert):
2026         (verify):
2027         (func):
2028         (const.bar.createBuiltin):
2029
2030 2017-09-14  Saam Barati  <sbarati@apple.com>
2031
2032         It should be valid to exit before each set when doing arity fixup when inlining
2033         https://bugs.webkit.org/show_bug.cgi?id=176948
2034
2035         Reviewed by Keith Miller.
2036
2037         * stress/arity-fixup-inlining-dont-generate-invalid-use.js: Added.
2038         (baz):
2039         (bar):
2040         (foo):
2041
2042 2017-09-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2043
2044         [JSC] Add PrivateSymbolMode::{Include,Exclude} for PropertyNameArray
2045         https://bugs.webkit.org/show_bug.cgi?id=176867
2046
2047         Reviewed by Sam Weinig.
2048
2049         * microbenchmarks/object-get-own-property-symbols.js: Added.
2050         (test):
2051
2052 2017-09-13  Mark Lam  <mark.lam@apple.com>
2053
2054         Rolling out r221832: Regresses Speedometer by ~4% and Dromaeo CSS YUI by ~20%.
2055         https://bugs.webkit.org/show_bug.cgi?id=176888
2056         <rdar://problem/34381832>
2057
2058         Not reviewed.
2059
2060         * stress/op_mod-ConstVar.js:
2061         * stress/op_mod-VarConst.js:
2062         * stress/op_mod-VarVar.js:
2063
2064 2017-09-13  Ryan Haddad  <ryanhaddad@apple.com>
2065
2066         Skip 3 op_mod tests on Debug JSC bots.
2067         https://bugs.webkit.org/show_bug.cgi?id=176630
2068
2069         Unreviewed test gardening.
2070
2071         * stress/op_mod-ConstVar.js:
2072         * stress/op_mod-VarConst.js:
2073         * stress/op_mod-VarVar.js:
2074
2075 2017-09-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2076
2077         [JSC] Fix Array allocation in Object.keys
2078         https://bugs.webkit.org/show_bug.cgi?id=176826
2079
2080         Reviewed by Saam Barati.
2081
2082         * stress/object-own-property-keys.js: Added.
2083         (shouldBe):
2084
2085 2017-09-12  Yusuke Suzuki  <utatane.tea@gmail.com>
2086
2087         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2088         https://bugs.webkit.org/show_bug.cgi?id=176010
2089
2090         Reviewed by Filip Pizlo.
2091
2092         * microbenchmarks/weak-map-key.js: Added.
2093         (assert):
2094         (objectKey):
2095         (let.start.Date.now):
2096
2097 2017-09-12  Mark Lam  <mark.lam@apple.com>
2098
2099         REGRESSION: 3 stress/op_mod (and op_div) tests timing out on Debug JSC bots.
2100         https://bugs.webkit.org/show_bug.cgi?id=176630
2101
2102         Reviewed by JF Bastien.
2103
2104         Debug builds are just slow, and these tests do a lot.  They pass when I run them
2105         locally on my MacBook Pro.  So, I'm bumping their timing multiplier to 2.0x as
2106         a speculative fix for the bots that are seeing these fail.
2107
2108         I also undid the skipping of the op_mod tests for debug builds.
2109
2110         * stress/op_div-ConstVar.js:
2111         * stress/op_div-VarConst.js:
2112         * stress/op_div-VarVar.js:
2113         * stress/op_mod-ConstVar.js:
2114         * stress/op_mod-VarConst.js:
2115         * stress/op_mod-VarVar.js:
2116
2117 2017-09-12  Ryan Haddad  <ryanhaddad@apple.com>
2118
2119         Skip stress/value-to-boolean.js on Debug bots.
2120         https://bugs.webkit.org/show_bug.cgi?id=176787
2121
2122         Unreviewed test gardening.
2123
2124         * stress/value-to-boolean.js:
2125
2126 2017-09-11  Mark Lam  <mark.lam@apple.com>
2127
2128         Change test expectation for test262/test/language/statements/try/tco-catch.js
2129         https://bugs.webkit.org/show_bug.cgi?id=176749
2130
2131         Rubber stamped by Keith Miller.
2132
2133         It's been failing since at least r221821.  I'm changing the test expectation to
2134         fail to green the bots while I investigate some more.
2135
2136         * test262.yaml:
2137
2138 2017-09-11  Ryan Haddad  <ryanhaddad@apple.com>
2139
2140         Unreviewed, rolling out r221854.
2141
2142         The test added with this change fails on 32-bit JSC bots.
2143
2144         Reverted changeset:
2145
2146         "[DFG] Optimize WeakMap::get by adding intrinsic and fixup"
2147         https://bugs.webkit.org/show_bug.cgi?id=176010
2148         http://trac.webkit.org/changeset/221854
2149
2150 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2151
2152         [DFG] Optimize WeakMap::get by adding intrinsic and fixup
2153         https://bugs.webkit.org/show_bug.cgi?id=176010
2154
2155         Reviewed by Filip Pizlo.
2156
2157         * microbenchmarks/weak-map-key.js: Added.
2158         (assert):
2159         (objectKey):
2160         (let.start.Date.now):
2161
2162 2017-09-09  Yusuke Suzuki  <utatane.tea@gmail.com>
2163
2164         [JSC] Optimize Object.keys by using careful array allocation
2165         https://bugs.webkit.org/show_bug.cgi?id=176654
2166
2167         Reviewed by Darin Adler.
2168
2169         * microbenchmarks/object-keys.js: Added.
2170         (test):
2171
2172 2017-09-09  Filip Pizlo  <fpizlo@apple.com>
2173
2174         Error should compute .stack and friends lazily
2175         https://bugs.webkit.org/show_bug.cgi?id=176645
2176
2177         Reviewed by Saam Barati.
2178
2179         * ChakraCore.yaml: Skip test that was testing non-standard behavior of these fields.
2180         * microbenchmarks/new-error.js: Added.
2181         * microbenchmarks/throw.js: Added.
2182
2183 2017-09-09  Mark Lam  <mark.lam@apple.com>
2184
2185         [Re-landing] Use JIT probes for DFG OSR exit.
2186         https://bugs.webkit.org/show_bug.cgi?id=175144
2187         <rdar://problem/33437050>
2188
2189         Not reviewed.  Original patch reviewed by Saam Barati.
2190
2191         Disable these tests for debug builds because they run too slow with the new OSR exit.
2192
2193         * stress/op_mod-ConstVar.js:
2194         * stress/op_mod-VarConst.js:
2195         * stress/op_mod-VarVar.js:
2196
2197 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2198
2199         [DFG] NewArrayWithSize(size)'s size does not care negative zero
2200         https://bugs.webkit.org/show_bug.cgi?id=176300
2201
2202         Reviewed by Saam Barati.
2203
2204         * stress/new-array-with-size-div.js: Added.
2205         (shouldBe):
2206         (test):
2207         (i.i):
2208
2209 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2210
2211         [DFG] PutByVal with Array::Generic is too generic
2212         https://bugs.webkit.org/show_bug.cgi?id=176345
2213
2214         Reviewed by Filip Pizlo.
2215
2216         * stress/object-assign-symbols.js: Added.
2217         (shouldBe):
2218         (test):
2219         * stress/object-assign.js: Added.
2220         (shouldBe):
2221         (test):
2222         (i.shouldBe.JSON.stringify.test):
2223
2224 2017-09-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2225
2226         [DFG][FTL] GetByVal(ObjectUse with Array::Generic, StringUse/SymbolUse) should be supported
2227         https://bugs.webkit.org/show_bug.cgi?id=176590
2228
2229         Reviewed by Saam Barati.
2230
2231         * microbenchmarks/object-iterate-symbols.js: Added.
2232         (test):
2233         * microbenchmarks/object-iterate.js: Added.
2234         (test):
2235         * stress/object-iterate-symbols.js: Added.
2236         (shouldBe):
2237         (test):
2238         * stress/object-iterate.js: Added.
2239         (shouldBe):
2240         (test):
2241
2242 2017-09-07  Per Arne Vollan  <pvollan@apple.com>
2243
2244         [Win32] 10 JSC stress tests are failing.
2245         https://bugs.webkit.org/show_bug.cgi?id=176538
2246
2247         Reviewed by Mark Lam.
2248
2249         Skip tests on Windows to make the bots green.
2250
2251         * ChakraCore.yaml:
2252         * stress/date-relaxed.js:
2253
2254 2017-09-06  Mark Lam  <mark.lam@apple.com>
2255
2256         constructGenericTypedArrayViewWithArguments() is missing an exception check.
2257         https://bugs.webkit.org/show_bug.cgi?id=176485
2258         <rdar://problem/33898874>
2259
2260         Reviewed by Keith Miller.
2261
2262         * stress/regress-176485.js: Added.
2263
2264 2017-09-05  Saam Barati  <sbarati@apple.com>
2265
2266         isNotCellSpeculation is wrong with respect to SpecEmpty
2267         https://bugs.webkit.org/show_bug.cgi?id=176429
2268
2269         Reviewed by Michael Saboff.
2270
2271         * microbenchmarks/is-not-cell-speculation-for-empty-value.js: Added.
2272         (Foo):
2273
2274 2017-09-05  Joseph Pecoraro  <pecoraro@apple.com>
2275
2276         test262: Completion values for control flow do not match the spec
2277         https://bugs.webkit.org/show_bug.cgi?id=171265
2278
2279         Reviewed by Saam Barati.
2280
2281         * stress/completion-value.js:
2282         Condensed test for completion values in top level statements.
2283
2284         * stress/super-get-by-id.js:
2285         ClassDeclaration when evaled no longer produce values. Convert
2286         these to ClassExpressions so they produce the class value.
2287
2288         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
2289         This is a progression for currect spec behavior.
2290
2291         * mozilla/mozilla-tests.yaml:
2292         This test is now outdated, so mark it as failing for that reason.
2293
2294         * test262.yaml:
2295         Passing all "cptn" completion value tests.
2296
2297 2017-09-04  Saam Barati  <sbarati@apple.com>
2298
2299         typeCheckHoistingPhase may emit a CheckStructure on the empty value which leads to a dereference of zero on 64 bit platforms
2300         https://bugs.webkit.org/show_bug.cgi?id=176317
2301
2302         Reviewed by Keith Miller.
2303
2304         * stress/dont-crash-when-hoist-check-structure-on-tdz.js: Added.
2305         (Foo):
2306
2307 2017-09-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2308
2309         [DFG][FTL] Efficiently execute number#toString()
2310         https://bugs.webkit.org/show_bug.cgi?id=170007
2311
2312         Reviewed by Keith Miller.
2313
2314         * microbenchmarks/number-to-string-strength-reduction.js: Added.
2315         (test):
2316         * microbenchmarks/number-to-string-with-radix-10.js: Added.
2317         (test):
2318         * microbenchmarks/number-to-string-with-radix-cse.js: Added.
2319         (test):
2320         * microbenchmarks/number-to-string-with-radix.js: Added.
2321         (test):
2322         * stress/number-to-string-strength-reduction.js: Added.
2323         (shouldBe):
2324         (test):
2325         * stress/number-to-string-with-radix-10.js: Added.
2326         (shouldBe):
2327         (test):
2328         * stress/number-to-string-with-radix-cse.js: Added.
2329         (shouldBe):
2330         (test):
2331         * stress/number-to-string-with-radix-invalid.js: Added.
2332         (shouldThrow):
2333         * stress/number-to-string-with-radix-watchpoint.js: Added.
2334         (shouldBe):
2335         (test):
2336         (i.i.1e3.Number.prototype.toString):
2337         * stress/number-to-string-with-radix.js: Added.
2338         (shouldBe):
2339         (test):
2340
2341 2017-09-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2342
2343         [DFG] Relax arity requirement
2344         https://bugs.webkit.org/show_bug.cgi?id=175523
2345
2346         Reviewed by Saam Barati.
2347
2348         * stress/arity-mismatch-arguments-length.js: Added.
2349         (shouldBe):
2350         (test1):
2351         (test):
2352         * stress/arity-mismatch-get-argument.js: Added.
2353         (shouldBe):
2354         (builtin.createBuiltin):
2355         (test):
2356         * stress/arity-mismatch-inlining-extra-slots.js: Added.
2357         (shouldBe):
2358         (inlineTarget):
2359         (test):
2360         * stress/arity-mismatch-inlining.js: Added.
2361         (shouldBe):
2362         (inlineTarget):
2363         (test):
2364         * stress/arity-mismatch-rest.js: Added.
2365         (shouldBe):
2366         (test2):
2367         (test1):
2368         (test):
2369
2370 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2371
2372         [JSC] Fix "name" and "length" of Proxy revoke function
2373         https://bugs.webkit.org/show_bug.cgi?id=176155
2374
2375         Reviewed by Mark Lam.
2376
2377         * test262.yaml:
2378
2379 2017-08-31  Saam Barati  <sbarati@apple.com>
2380
2381         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
2382         https://bugs.webkit.org/show_bug.cgi?id=176206
2383
2384         Reviewed by Keith Miller.
2385
2386         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
2387         (a):
2388         (b):
2389         (foo):
2390
2391 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
2392
2393         Skip two slow JSC tests after r221422.
2394
2395         Unreviewed test gardening.
2396
2397         * stress/regexp-prototype-match-on-too-long-rope.js:
2398         * stress/regexp-prototype-test-on-too-long-rope.js:
2399
2400 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
2401
2402         Unreviewed, skipping slow tests.
2403
2404         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
2405         work differently now.
2406
2407         * stress/regexp-prototype-exec-on-too-long-rope.js:
2408         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
2409
2410 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2411
2412         [JSC] Use reifying system for "name" property of builtin JSFunction
2413         https://bugs.webkit.org/show_bug.cgi?id=175260
2414
2415         Reviewed by Saam Barati.
2416
2417         * stress/accessors-get-set-prefix.js:
2418         * stress/builtin-function-name.js: Added.
2419         (shouldBe):
2420         (shouldThrow):
2421         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2422         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2423         * stress/private-name-as-anonymous-builtin.js: Added.
2424         (shouldBe):
2425         (NotPromise):
2426
2427 2017-08-30  Saam Barati  <sbarati@apple.com>
2428
2429         Unreviewed. Make test stop printing.
2430
2431         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
2432
2433 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
2434
2435         Unreviewed, rolling out r221327.
2436
2437         This change caused test262 failures.
2438
2439         Reverted changeset:
2440
2441         "[JSC] Use reifying system for "name" property of builtin
2442         JSFunction"
2443         https://bugs.webkit.org/show_bug.cgi?id=175260
2444         http://trac.webkit.org/changeset/221327
2445
2446 2017-08-30  Saam Barati  <sbarati@apple.com>
2447
2448         semicolon is being interpreted as an = in the LiteralParser
2449         https://bugs.webkit.org/show_bug.cgi?id=176114
2450
2451         Reviewed by Oliver Hunt.
2452
2453         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
2454         * stress/resources/literal-parser-test-case.js: Added.
2455
2456 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2457
2458         [ESNext] Async iteration - Implement async iteration statement: for-await-of
2459         https://bugs.webkit.org/show_bug.cgi?id=166698
2460
2461         Reviewed by Yusuke Suzuki.
2462
2463         * stress/async-iteration-for-await-of-syntax.js: Added.
2464         (assert):
2465         (checkSyntax):
2466         (checkSyntaxError):
2467         (checkSimpleAsyncGeneratorSloppyMode):
2468         (checkSimpleAsyncGeneratorStrictMode):
2469         (checkNestedAsyncGenerators):
2470         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
2471         * stress/async-iteration-for-await-of.js: Added.
2472         (assert):
2473         (async.foo):
2474         (async.boo):
2475         (const.boo.async):
2476
2477 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2478
2479         [JSC] Use reifying system for "name" property of builtin JSFunction
2480         https://bugs.webkit.org/show_bug.cgi?id=175260
2481
2482         Reviewed by Saam Barati.
2483
2484         * stress/accessors-get-set-prefix.js:
2485         * stress/builtin-function-name.js: Added.
2486         (shouldBe):
2487         (shouldThrow):
2488         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
2489         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
2490
2491 2017-08-25  Saam Barati  <sbarati@apple.com>
2492
2493         Support compiling catch in the DFG
2494         https://bugs.webkit.org/show_bug.cgi?id=174590
2495         <rdar://problem/34047845>
2496
2497         Reviewed by Filip Pizlo.
2498
2499         * microbenchmarks/delta-blue-try-catch.js: Added.
2500         (exception):
2501         (value):
2502         (OrderedCollection):
2503         (OrderedCollection.prototype.add):
2504         (OrderedCollection.prototype.at):
2505         (OrderedCollection.prototype.size):
2506         (OrderedCollection.prototype.removeFirst):
2507         (OrderedCollection.prototype.remove):
2508         (Strength):
2509         (Strength.stronger):
2510         (Strength.weaker):
2511         (Strength.weakestOf):
2512         (Strength.strongest):
2513         (Strength.prototype.nextWeaker):
2514         (Constraint):
2515         (Constraint.prototype.addConstraint):
2516         (Constraint.prototype.satisfy):
2517         (Constraint.prototype.destroyConstraint):
2518         (Constraint.prototype.isInput):
2519         (UnaryConstraint):
2520         (UnaryConstraint.prototype.addToGraph):
2521         (UnaryConstraint.prototype.chooseMethod):
2522         (UnaryConstraint.prototype.isSatisfied):
2523         (UnaryConstraint.prototype.markInputs):
2524         (UnaryConstraint.prototype.output):
2525         (UnaryConstraint.prototype.recalculate):
2526         (UnaryConstraint.prototype.markUnsatisfied):
2527         (UnaryConstraint.prototype.inputsKnown):
2528         (UnaryConstraint.prototype.removeFromGraph):
2529         (StayConstraint):
2530         (StayConstraint.prototype.execute):
2531         (EditConstraint.prototype.isInput):
2532         (EditConstraint.prototype.execute):
2533         (BinaryConstraint):
2534         (BinaryConstraint.prototype.chooseMethod):
2535         (BinaryConstraint.prototype.addToGraph):
2536         (BinaryConstraint.prototype.isSatisfied):
2537         (BinaryConstraint.prototype.markInputs):
2538         (BinaryConstraint.prototype.input):
2539         (BinaryConstraint.prototype.output):
2540         (BinaryConstraint.prototype.recalculate):
2541         (BinaryConstraint.prototype.markUnsatisfied):
2542         (BinaryConstraint.prototype.inputsKnown):
2543         (BinaryConstraint.prototype.removeFromGraph):
2544         (ScaleConstraint):
2545         (ScaleConstraint.prototype.addToGraph):
2546         (ScaleConstraint.prototype.removeFromGraph):
2547         (ScaleConstraint.prototype.markInputs):
2548         (ScaleConstraint.prototype.execute):
2549         (ScaleConstraint.prototype.recalculate):
2550         (EqualityConstraint):
2551         (EqualityConstraint.prototype.execute):
2552         (Variable):
2553         (Variable.prototype.addConstraint):
2554         (Variable.prototype.removeConstraint):
2555         (Planner):
2556         (Planner.prototype.incrementalAdd):
2557         (Planner.prototype.incrementalRemove):
2558         (Planner.prototype.newMark):
2559         (Planner.prototype.makePlan):
2560         (Planner.prototype.extractPlanFromConstraints):
2561         (Planner.prototype.addPropagate):
2562         (Planner.prototype.removePropagateFrom):
2563         (Planner.prototype.addConstraintsConsumingTo):
2564         (Plan):
2565         (Plan.prototype.addConstraint):
2566         (Plan.prototype.size):
2567         (Plan.prototype.constraintAt):
2568         (Plan.prototype.execute):
2569         (chainTest):
2570         (projectionTest):
2571         (change):
2572         (deltaBlue):
2573         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2574         (assert):
2575         (Numbers):
2576         (Numbers.prototype.next):
2577         (return.Transpose):
2578         (return.Transpose.prototype.next):
2579         (transpose):
2580         (verifyEven):
2581         (verifyString):
2582         (foo):
2583         (runIterators):
2584         * microbenchmarks/try-catch-word-count.js: Added.
2585         (let.assert):
2586         (EOF):
2587         (let.texts):
2588         (let.o.apply):
2589         (foo):
2590         (bar):
2591         (f):
2592         (run):
2593         (test1):
2594         (test2):
2595         (test3):
2596         (fn):
2597         (A):
2598         (B):
2599         (A.prototype.getValue):
2600         (B.prototype.getParentValue):
2601         (strlen):
2602         (sum.0):
2603         (test):
2604         (result.test.o):
2605         (set add.set add):
2606         (set forEach):
2607         (stringHash):
2608         (set if):
2609         (testFunction):
2610         (set delete.set has.set add):
2611         * stress/catch-set-argument-speculation-failure.js: Added.
2612         (o):
2613         (e):
2614         (e2):
2615         (escape):
2616         (baz):
2617         (noInline.run):
2618         (noInline):
2619         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2620         (foo):
2621         (e):
2622         (baz):
2623         (bar):
2624
2625 2017-08-24  Commit Queue  <commit-queue@webkit.org>
2626
2627         Unreviewed, rolling out r221119, r221124, and r221143.
2628         https://bugs.webkit.org/show_bug.cgi?id=175973
2629
2630         "I think it regressed JSBench by 20%" (Requested by saamyjoon
2631         on #webkit).
2632
2633         Reverted changesets:
2634
2635         "Support compiling catch in the DFG"
2636         https://bugs.webkit.org/show_bug.cgi?id=174590
2637         http://trac.webkit.org/changeset/221119
2638
2639         "Unreviewed, build fix in GTK port"
2640         https://bugs.webkit.org/show_bug.cgi?id=174590
2641         http://trac.webkit.org/changeset/221124
2642
2643         "DFG::JITCode::osrEntry should get sorted since we perform a
2644         binary search on it"
2645         https://bugs.webkit.org/show_bug.cgi?id=175893
2646         http://trac.webkit.org/changeset/221143
2647
2648 2017-08-24  Michael Saboff  <msaboff@apple.com>
2649
2650         Add support for RegExp "dotAll" flag
2651         https://bugs.webkit.org/show_bug.cgi?id=175924
2652
2653         Reviewed by Keith Miller.
2654
2655         Updated tests for new dotAll ('s' flag) changes.
2656
2657         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
2658         * stress/static-getter-in-names.js:
2659
2660 2017-08-24  Mark Lam  <mark.lam@apple.com>
2661
2662         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
2663         https://bugs.webkit.org/show_bug.cgi?id=175940
2664         <rdar://problem/29003921>
2665
2666         Reviewed by Saam Barati.
2667
2668         * stress/regress-164081.js: Added.
2669         (shouldEqual):
2670         (testcase):
2671
2672 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
2673
2674         Skip flaky JSC test stress/test-finally.js.
2675         https://bugs.webkit.org/show_bug.cgi?id=160283
2676
2677         Unreviewed test gardening.
2678
2679         * stress/test-finally.js:
2680
2681 2017-08-23  Saam Barati  <sbarati@apple.com>
2682
2683         Support compiling catch in the DFG
2684         https://bugs.webkit.org/show_bug.cgi?id=174590
2685
2686         Reviewed by Filip Pizlo.
2687
2688         * microbenchmarks/delta-blue-try-catch.js: Added.
2689         (exception):
2690         (value):
2691         (OrderedCollection):
2692         (OrderedCollection.prototype.add):
2693         (OrderedCollection.prototype.at):
2694         (OrderedCollection.prototype.size):
2695         (OrderedCollection.prototype.removeFirst):
2696         (OrderedCollection.prototype.remove):
2697         (Strength):
2698         (Strength.stronger):
2699         (Strength.weaker):
2700         (Strength.weakestOf):
2701         (Strength.strongest):
2702         (Strength.prototype.nextWeaker):
2703         (Constraint):
2704         (Constraint.prototype.addConstraint):
2705         (Constraint.prototype.satisfy):
2706         (Constraint.prototype.destroyConstraint):
2707         (Constraint.prototype.isInput):
2708         (UnaryConstraint):
2709         (UnaryConstraint.prototype.addToGraph):
2710         (UnaryConstraint.prototype.chooseMethod):
2711         (UnaryConstraint.prototype.isSatisfied):
2712         (UnaryConstraint.prototype.markInputs):
2713         (UnaryConstraint.prototype.output):
2714         (UnaryConstraint.prototype.recalculate):
2715         (UnaryConstraint.prototype.markUnsatisfied):
2716         (UnaryConstraint.prototype.inputsKnown):
2717         (UnaryConstraint.prototype.removeFromGraph):
2718         (StayConstraint):
2719         (StayConstraint.prototype.execute):
2720         (EditConstraint.prototype.isInput):
2721         (EditConstraint.prototype.execute):
2722         (BinaryConstraint):
2723         (BinaryConstraint.prototype.chooseMethod):
2724         (BinaryConstraint.prototype.addToGraph):
2725         (BinaryConstraint.prototype.isSatisfied):
2726         (BinaryConstraint.prototype.markInputs):
2727         (BinaryConstraint.prototype.input):
2728         (BinaryConstraint.prototype.output):
2729         (BinaryConstraint.prototype.recalculate):
2730         (BinaryConstraint.prototype.markUnsatisfied):
2731         (BinaryConstraint.prototype.inputsKnown):
2732         (BinaryConstraint.prototype.removeFromGraph):
2733         (ScaleConstraint):
2734         (ScaleConstraint.prototype.addToGraph):
2735         (ScaleConstraint.prototype.removeFromGraph):
2736         (ScaleConstraint.prototype.markInputs):
2737         (ScaleConstraint.prototype.execute):
2738         (ScaleConstraint.prototype.recalculate):
2739         (EqualityConstraint):
2740         (EqualityConstraint.prototype.execute):
2741         (Variable):
2742         (Variable.prototype.addConstraint):
2743         (Variable.prototype.removeConstraint):
2744         (Planner):
2745         (Planner.prototype.incrementalAdd):
2746         (Planner.prototype.incrementalRemove):
2747         (Planner.prototype.newMark):
2748         (Planner.prototype.makePlan):
2749         (Planner.prototype.extractPlanFromConstraints):
2750         (Planner.prototype.addPropagate):
2751         (Planner.prototype.removePropagateFrom):
2752         (Planner.prototype.addConstraintsConsumingTo):
2753         (Plan):
2754         (Plan.prototype.addConstraint):
2755         (Plan.prototype.size):
2756         (Plan.prototype.constraintAt):
2757         (Plan.prototype.execute):
2758         (chainTest):
2759         (projectionTest):
2760         (change):
2761         (deltaBlue):
2762         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
2763         (assert):
2764         (Numbers):
2765         (Numbers.prototype.next):
2766         (return.Transpose):
2767         (return.Transpose.prototype.next):
2768         (transpose):
2769         (verifyEven):
2770         (verifyString):
2771         (foo):
2772         (runIterators):
2773         * microbenchmarks/try-catch-word-count.js: Added.
2774         (let.assert):
2775         (EOF):
2776         (let.texts):
2777         (let.o.apply):
2778         (foo):
2779         (bar):
2780         (f):
2781         (run):
2782         (test1):
2783         (test2):
2784         (test3):
2785         (fn):
2786         (A):
2787         (B):
2788         (A.prototype.getValue):
2789         (B.prototype.getParentValue):
2790         (strlen):
2791         (sum.0):
2792         (test):
2793         (result.test.o):
2794         (set add.set add):
2795         (set forEach):
2796         (stringHash):
2797         (set if):
2798         (testFunction):
2799         (set delete.set has.set add):
2800         * stress/catch-set-argument-speculation-failure.js: Added.
2801         (o):
2802         (e):
2803         (e2):
2804         (escape):
2805         (baz):
2806         (noInline.run):
2807         (noInline):
2808         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
2809         (foo):
2810         (e):
2811         (baz):
2812         (bar):
2813
2814 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2815
2816         [JSC] Optimize Map iteration with intrinsic
2817         https://bugs.webkit.org/show_bug.cgi?id=174355
2818
2819         Reviewed by Saam Barati.
2820
2821         * stress/map-iterator-result-should-have-expected-shape.js: Added.
2822         (shouldBe):
2823         (throw.new.Error):
2824         * stress/set-iterator-result-should-have-expected-shape.js: Added.
2825         (shouldBe):
2826         (throw.new.Error.let.iterator.set Symbol):
2827         (throw.new.Error.set add):
2828         (let.iterator.set Symbol):
2829
2830 2017-08-23  Robin Morisset  <rmorisset@apple.com>
2831
2832         Add a micro-benchmark for checking that accessing a variable within a 'with'
2833         block does not automatically prevent type prediction.
2834         https://bugs.webkit.org/show_bug.cgi?id=175738
2835
2836         Reviewed by Saam Barati.
2837
2838         * stress/with_and_arith.js: Added.
2839         (with):
2840
2841 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
2842
2843         [ESNext] Async iteration - Implement Async Generator - runtime
2844         https://bugs.webkit.org/show_bug.cgi?id=175240
2845
2846         Reviewed by Yusuke Suzuki.
2847
2848         * stress/async-iteration-async-from-sync.js: Added.
2849         (assert):
2850         (const.Logger):
2851         (this.fullfilled):
2852         (this.fullfilledDone):
2853         (this.rejected):
2854         (this.catched):
2855         (this.isFinal):
2856         (_assertLogger):
2857         (const.assertLogger):
2858         (const.getPromise.promiseHolder.return.new.Promise):
2859         (foo):
2860         (async.boo):
2861         (bar):
2862         (async.baz):
2863         (async.goo):
2864         * stress/async-iteration-basic.js: Added.
2865         (assert):
2866         (const.Logger):
2867         (this.fullfilled):
2868         (this.fullfilledDone):
2869         (this.rejected):
2870         (this.catched):
2871         (this.isFinal):
2872         (_assertLogger):
2873         (const.assertLogger):
2874         (const.getPromise.promiseHolder.return.new.Promise):
2875         (async.generator):
2876         (iterator.next.then):
2877         (async.baz):
2878         (async.boo):
2879         (async.foo):
2880         (async.goo):
2881         (A.prototype.async.foo):
2882         (A.prototype.async.boo):
2883         (A):
2884         (asyncGenExp.async):
2885         (async.joo):
2886         (j.next.then):
2887         (then):
2888         (async.koo):
2889         (async.loo):
2890         (async.moo):
2891         (async.noo):
2892         (async.ooo):
2893         (async.roo):
2894         (async.poo):
2895         (async.soo):
2896         (async.too):
2897         * stress/async-iteration-evaluation.js: Added.
2898         (assert):
2899         (async.foo):
2900         (catch):
2901         * stress/async-iteration-syntax.js:
2902         * stress/async-iteration-yield-promise.js: Added.
2903         (assert):
2904         (const.Logger):
2905         (this.fullfilled):
2906         (this.fullfilledDone):
2907         (this.rejected):
2908         (this.catched):
2909         (this.isFinal):
2910         (_assertLogger):
2911         (const.assertLogger):
2912         (const.getPromise.promiseHolder.return.new.Promise):
2913         (async.foo):
2914         (async.boo):
2915         (async.bar):
2916         * stress/async-iteration-yield-star-interface.js: Added.
2917         (assert):
2918         (const.getPromise.promiseHolder.return.new.Promise):
2919         (const.Logger):
2920         (this.fullfilled):
2921         (this.fullfilledDone):
2922         (this.rejected):
2923         (this.catched):
2924         (this.custom):
2925         (this.isFinal):
2926         (_assertLogger):
2927         (const.assertLogger):
2928         (let.asyncIter.Symbol.asyncIterator):
2929         (let.asyncIter.next):
2930         (let.asyncIter.throw):
2931         (let.asyncIter.return):
2932         (async.foo):
2933         (asyncIter.Symbol.asyncIterator):
2934         (asyncIter.next):
2935         (async.boo):
2936         (asyncIter.return):
2937         (async.bar):
2938         (async.baz):
2939         (async.foobar):
2940         * stress/async-iteration-yield-star.js: Added.
2941         (assert):
2942         (const.Logger):
2943         (this.fullfilled):
2944         (this.fullfilledDone):
2945         (this.rejected):
2946         (this.catched):
2947         (this.custom):
2948         (this.isFinal):
2949         (_assertLogger):
2950         (const.assertLogger):
2951         (const.getPromise.promiseHolder.return.new.Promise):
2952         (async.foo):
2953         (async.boo):
2954         (async.bar):
2955         (async.baz):
2956         (async.joo):
2957         (async.goo):
2958         (async.koo):
2959         (async.loo):
2960         (let.asyncIter.Symbol.asyncIterator):
2961         (let.asyncIter.next):
2962         (let.asyncIter.throw):
2963         (let.asyncIter.return):
2964         (async.moo):
2965         (async.noo):
2966         * test262.yaml:
2967
2968 2017-08-23  JF Bastien  <jfbastien@apple.com>
2969
2970         Fix printing in test
2971
2972         Unreviewed: fixing verbosity, shouldn't have been there.
2973
2974         * wasm/regress/175693.js:
2975         (else.else):
2976         (catch):
2977
2978 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
2979
2980         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
2981         https://bugs.webkit.org/show_bug.cgi?id=172543
2982
2983         Unreviewed test gardening.
2984
2985         * microbenchmarks/generator-with-several-types.js:
2986
2987 2017-08-17  JF Bastien  <jfbastien@apple.com>
2988
2989         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
2990         https://bugs.webkit.org/show_bug.cgi?id=175693
2991         <rdar://problem/33952443>
2992
2993         Reviewed by Saam Barati.
2994
2995         Add a regression directory for WebAssembly tests.
2996
2997         * wasm.yaml:
2998         * wasm/regress/175693.js: Added.
2999         (else.else):
3000         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
3001         (catch):
3002         * wasm/regress/175693.wasm: Added.
3003
3004 2017-08-15  Robin Morisset  <rmorisset@apple.com>
3005
3006         Support the 'with' keyword in FTL.
3007         https://bugs.webkit.org/show_bug.cgi?id=175585
3008
3009         Reviewed by Saam Barati.
3010
3011         Also improve the JSTest/stress/with.js file to test
3012         what happens when non-objects are passed to with.
3013
3014         * stress/with.js:
3015         (foo):
3016         (i.catch):
3017         (i.with): Deleted.
3018
3019 2017-08-14  Keith Miller  <keith_miller@apple.com>
3020
3021         Add testing tool to lie to the DFG about profiles
3022         https://bugs.webkit.org/show_bug.cgi?id=175487
3023
3024         Reviewed by Saam Barati.
3025
3026         * stress/compare-eq-incomplete-profile.js: Added.
3027         (const.test.createBuiltin):
3028
3029 2017-08-14  Robin Morisset  <rmorisset@apple.com>
3030
3031         Support the with keyword in DFG
3032         https://bugs.webkit.org/show_bug.cgi?id=175470
3033
3034         Reviewed by Saam Barati.
3035
3036         Added a new stress-test for the 'with' keyword, that caught a bug in a
3037         previous version of this code.
3038
3039         * stress/with.js: Added.
3040         (i.with):
3041
3042 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
3043
3044         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
3045         https://bugs.webkit.org/show_bug.cgi?id=175544
3046
3047         Unreviewed test gardening.
3048
3049         * ChakraCore.yaml:
3050
3051 2017-08-09  Caitlin Potter  <caitp@igalia.com>
3052
3053         Early error on ANY operator before new.target
3054         https://bugs.webkit.org/show_bug.cgi?id=157970
3055
3056         Reviewed by Saam Barati.
3057
3058         Instead of throwing if any unary operator precedes new.target, only
3059         throw if the unary operator updates the reference.
3060
3061         The following become legal in JSC:
3062
3063         ```
3064         !new.target
3065         ~new.target
3066         typeof new.target
3067         delete new.target
3068         void new.target
3069         ```
3070
3071         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
3072
3073         * stress/new-target-syntax-errors.js:
3074         * stress/new-target.js:
3075
3076 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
3077
3078         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
3079         https://bugs.webkit.org/show_bug.cgi?id=175255
3080
3081         Unreviewed test gardening.
3082
3083         * stress/regress-169783.js:
3084         * wasm/stress/oom.js:
3085
3086 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
3087
3088         REGRESSION: 2 test262/test/language/statements/async-function failures
3089         https://bugs.webkit.org/show_bug.cgi?id=175334
3090
3091         Reviewed by Yusuke Suzuki.
3092
3093         Add @skip parameters to tests, and remove test for async iterator from
3094         async await syntax test because it is already covered by async-iterator-syntax.js
3095
3096         * stress/async-await-syntax.js:
3097         * stress/async-iteration-syntax.js:
3098
3099 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
3100
3101         Unreviewed, gardening test262 for Promise resolve / reject function length
3102         https://bugs.webkit.org/show_bug.cgi?id=175333
3103
3104         * test262.yaml:
3105
3106 2017-08-07  Robin Morisset  <rmorisset@apple.com>
3107
3108         GetOwnProperty of TypedArray indexed fields is wrongly configurable
3109         https://bugs.webkit.org/show_bug.cgi?id=175307
3110
3111         Reviewed by Saam Barati.
3112
3113         * stress/typedarray-getownproperty-not-configurable.js: Added.
3114         (assert):
3115         (foo):
3116
3117 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3118
3119         Promise resolve and reject function should have length = 1
3120         https://bugs.webkit.org/show_bug.cgi?id=175242
3121
3122         Reviewed by Saam Barati.
3123
3124         * stress/builtin-function-length.js: Added.
3125         (shouldBe):
3126         (shouldThrow):
3127         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
3128         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
3129
3130 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
3131
3132         [ESNext] Async iteration - Implement Async Generator - parser
3133         https://bugs.webkit.org/show_bug.cgi?id=175210
3134
3135         Reviewed by Yusuke Suzuki.
3136
3137         * stress/async-await-syntax.js:
3138         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
3139         * stress/async-iteration-syntax.js: Added.
3140         (assert):
3141         (checkSyntax):
3142         (checkSyntaxError):
3143         (checkSimpleAsyncGeneratorSloppyMode):
3144         (checkSimpleAsyncGeneratorStrictMode):
3145         (checkNestedAsyncGenerators):
3146         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
3147         * stress/generator-class-methods-syntax.js:
3148
3149 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3150
3151         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
3152         https://bugs.webkit.org/show_bug.cgi?id=175150
3153
3154         Unreviewed test gardening.
3155
3156         * wasm/js-api/test_memory_constructor.js:
3157
3158 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
3159
3160         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
3161         https://bugs.webkit.org/show_bug.cgi?id=175100
3162
3163         Reviewed by Mark Lam.
3164
3165         The JSC test JSTests/wasm/stress/oom.js tries to use all the
3166         available memory until an out of memory exception happens.
3167
3168         The Linux kernel is more tuned for server workloads than for GUI
3169         responsiveness. When a process tries to use a lot of memory, Linux
3170         will do its best to serve the request. This usually translates to
3171         free physical RAM by writing to disk dirty pages and/or moving out
3172         less recently used pages to swap (disk storage).
3173         Meanwhile it does this, the system will become unresponsive and this
3174         leads to freezes that can last even some minutes on the worst cases.
3175
3176         Therefore, let's skip this test on Linux as it will cause more harm
3177         than good on the Linux bots or on the machines of Linux developers.
3178
3179         * wasm/stress/oom.js:
3180
3181 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
3182
3183         [JSC] Remove unnecessary print from stress\promise-finally.js test
3184         https://bugs.webkit.org/show_bug.cgi?id=175015
3185
3186         Reviewed by Yusuke Suzuki.
3187
3188         * stress/promise-finally.js:
3189         (p.finally):
3190         (then):
3191
3192 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3193
3194         Unreviewed, update test262 results for optional catch binding
3195
3196         * test262.yaml:
3197
3198 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
3199
3200         [JSC] Support optional catch binding
3201         https://bugs.webkit.org/show_bug.cgi?id=174981
3202
3203         Reviewed by Saam Barati.
3204
3205         * stress/optional-catch-binding-syntax.js: Added.
3206         (testSyntax):
3207         (testSyntaxError):
3208         (catch.catch):
3209         * stress/optional-catch-binding.js: Added.
3210         (shouldBe):
3211         (throwException):
3212
3213 2017-07-28  Mark Lam  <mark.lam@apple.com>
3214
3215         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
3216         https://bugs.webkit.org/show_bug.cgi?id=174948
3217         <rdar://problem/33495680>
3218
3219         Reviewed by Filip Pizlo.
3220
3221         * stress/regress-174948.js: Added.
3222
3223 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
3224
3225         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
3226         https://bugs.webkit.org/show_bug.cgi?id=174900
3227
3228         Reviewed by Saam Barati.
3229
3230         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
3231         (sideEffect):
3232         (args):
3233         (test):
3234
3235 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3236
3237         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
3238         https://bugs.webkit.org/show_bug.cgi?id=171637
3239
3240         Reviewed by Darin Adler.
3241
3242         * stress/domjit-getter-complex-with-incorrect-object.js:
3243         (i.shouldThrow):
3244         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
3245         (shouldBe):
3246         (i.shouldThrow):
3247
3248 2017-07-26  JF Bastien  <jfbastien@apple.com>
3249
3250         WebAssembly: test throwing out of the start function
3251         https://bugs.webkit.org/show_bug.cgi?id=165714
3252         <rdar://problem/29760251>
3253
3254         Reviewed by Keith Miller.
3255
3256         * wasm/assert.js:
3257         * wasm/function-tests/trap-from-start.js: Added.
3258         (StartTraps):
3259         * wasm/function-tests/trap-from-start-async.js: Added.
3260         (async.StartTrapsAsync):
3261
3262 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3263
3264         [FTL] Arguments elimination is suppressed by unreachable blocks
3265         https://bugs.webkit.org/show_bug.cgi?id=174352
3266
3267         Reviewed by Filip Pizlo.
3268
3269         * stress/arguments-elimination-force-exit.js: Added.
3270         (shouldBe):
3271         (strict):
3272         (sloppy):
3273         * stress/arguments-elimination-throw.js: Added.
3274         (shouldBe):
3275         (shouldThrow):
3276         (sloppy):
3277         (isArguments):
3278
3279 2017-07-13  Mark Lam  <mark.lam@apple.com>
3280
3281         Add some additional test cases for bug 170896.
3282         https://bugs.webkit.org/show_bug.cgi?id=174491
3283
3284         Reviewed by Filip Pizlo.
3285
3286         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
3287         * stress/regress-170896-with-double-shape-profile.js: Added.
3288         (test):
3289         * stress/regress-170896-with-int32-shape-profile.js: Added.
3290         (test):
3291         * stress/regress-170896.js: Removed.
3292
3293 2017-07-13  Saam Barati  <sbarati@apple.com>
3294
3295         Missing exception check in JSObject::hasInstance
3296         https://bugs.webkit.org/show_bug.cgi?id=174455
3297         <rdar://problem/31384608>
3298
3299         Reviewed by Mark Lam.
3300
3301         * stress/has-instance-exception-check.js: Added.
3302         (assert):
3303         (let.getter.Object.getOwnPropertyDescriptor.get foo):
3304
3305 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
3306
3307         [ESnext] Implement Object Spread
3308         https://bugs.webkit.org/show_bug.cgi?id=167963
3309
3310         Reviewed by Saam Barati.
3311
3312         * stress/obj-rest-destructuring-order.js: Added.
3313         (assert):
3314         (o.get z):
3315         (o.get a):
3316         * stress/obj-spread-order.js: Added.
3317         (assert):
3318         (o.get z):
3319         (o.get a):
3320         * stress/object-spread.js: Added.
3321         (let.assert):
3322         (assert.sameValue):
3323         (let.o.get a):
3324         (let.obj.get c):
3325         (cthulhu.get x):
3326         (let.obj.set c):
3327         (calls.o.get z):
3328         (calls.o.get a):
3329         (try.let.obj.get foo):
3330         (get calls):
3331
3332 2017-07-12  Saam Barati  <sbarati@apple.com>
3333
3334         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
3335         https://bugs.webkit.org/show_bug.cgi?id=174411
3336         <rdar://problem/31696186>
3337
3338         Reviewed by Mark Lam.
3339
3340         * stress/generic-arguments-correct-delete-behavior.js: Added.
3341         (assert):
3342         (makeTest):
3343
3344 2017-07-07  Mark Lam  <mark.lam@apple.com>
3345
3346         \n\r is not the same as \r\n.
3347         https://bugs.webkit.org/show_bug.cgi?id=173053
3348
3349         Reviewed by Keith Miller.
3350
3351         * stress/regress-173053.js: Added.
3352         * stress/template-literal-line-terminators.js:
3353
3354 2017-07-06  Saam Barati  <sbarati@apple.com>
3355
3356         We are missing places where we invalidate the for-in context
3357         https://bugs.webkit.org/show_bug.cgi?id=174184
3358
3359         Reviewed by Geoffrey Garen.
3360
3361         * stress/for-in-invalidate-context-weird-assignments.js: Added.
3362         (assert):
3363         (test):
3364
3365 2017-07-05  Saam Barati  <sbarati@apple.com>
3366
3367         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
3368         https://bugs.webkit.org/show_bug.cgi?id=174188
3369         <rdar://problem/30581423>
3370
3371         Reviewed by Mark Lam.
3372
3373         * stress/new-array-having-a-bad-time-double.js: Added.
3374         (assert):
3375         (foo):
3376
3377 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
3378
3379         WTF::StringImpl::copyChars segfaults when built with GCC 7
3380         https://bugs.webkit.org/show_bug.cgi?id=173407
3381
3382         Reviewed by Andreas Kling.
3383
3384         * stress/string-repeat-copy-chars-crash.js: Added.
3385         (shouldBe):
3386
3387 2017-07-03  Saam Barati  <sbarati@apple.com>
3388
3389         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
3390
3391         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3392
3393 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
3394
3395         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
3396
3397         It requires too much memory.
3398
3399         * stress/dont-reserve-huge-capacity-lexer.js:
3400
3401 2017-06-30  Michael Saboff  <msaboff@apple.com>
3402
3403         Skip a test on ARM64 platform since we run out of address space.
3404
3405         Rubber stamped by Saam Barati.
3406
3407         * stress/dont-reserve-huge-capacity-lexer.js:
3408
3409 2017-06-30  Michael Saboff  <msaboff@apple.com>
3410
3411         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
3412         https://bugs.webkit.org/show_bug.cgi?id=174044
3413
3414         Reviewed by Oliver Hunt.
3415
3416         New regression test.
3417
3418         * stress/regress-174044.js: Added.
3419         (test1):
3420         (test2):
3421
3422 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
3423
3424         RegExpCachedResult::setInput should reify left and right contexts
3425         https://bugs.webkit.org/show_bug.cgi?id=173818
3426
3427         Reviewed by Keith Miller.
3428
3429         * stress/right-left-context-invalidated-by-input.js: Added.
3430         (test.validateContexts):
3431         (test):
3432
3433 2017-06-29  Saam Barati  <sbarati@apple.com>
3434
3435         Calculating postCapacity in unshiftCountSlowCase is wrong
3436         https://bugs.webkit.org/show_bug.cgi?id=173992
3437         <rdar://problem/32283199>
3438
3439         Reviewed by Keith Miller.
3440
3441         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
3442         (temp):
3443
3444 2017-06-29  Commit Queue  <commit-queue@webkit.org>
3445
3446         Unreviewed, rolling out r218512.
3447         https://bugs.webkit.org/show_bug.cgi?id=173981
3448
3449         "It changes the behavior of the JS API's JSEvaluateScript
3450         which breaks TurboTax" (Requested by saamyjoon on #webkit).
3451
3452         Reverted changeset:
3453
3454         "test262: Completion values for control flow do not match the
3455         spec"
3456         https://bugs.webkit.org/show_bug.cgi?id=171265
3457         http://trac.webkit.org/changeset/218512
3458
3459 2017-06-27  JF Bastien  <jfbastien@apple.com>
3460
3461         WebAssembly: running out of executable memory should throw OoM
3462         https://bugs.webkit.org/show_bug.cgi?id=171537
3463         <rdar://problem/32963338>
3464
3465         Reviewed by Saam Barati.
3466
3467         * wasm.yaml:
3468         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
3469         (const.invoke):
3470         (failCount.0.catch):
3471         (failCount.0.module.undefined.catch):
3472         * wasm/lowExecutableMemory/exports-oom.js: Added.
3473         (const.type):
3474         (const.params):
3475         (const.randomProgram):
3476         (failCount.0.catch):
3477         (failCount.0.module.undefined.catch):
3478         * wasm/lowExecutableMemory/imports-oom.js: Added.
3479         (const.type):
3480         (const.params):
3481         (const.randomProgram):
3482         (f.imports.push):
3483         (failCount.0.catch):
3484         (failCount.0.module.undefined.catch):
3485
3486 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
3487
3488         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
3489         https://bugs.webkit.org/show_bug.cgi?id=167962
3490
3491         Reviewed by Saam Barati.
3492
3493         * stress/object-rest-deconstruct.js: Added.
3494         (let.assert):
3495         (let.assertPropDescriptor):
3496         (catch):
3497         (get 3):
3498         (foo):
3499         (let.src.get y):
3500         (let.src.set y):
3501         (let.gen):
3502
3503 2017-06-27  Saam Barati  <sbarati@apple.com>
3504
3505         Function constructor needs to follow the spec and validate parameters and body independently
3506         https://bugs.webkit.org/show_bug.cgi?id=173303
3507         <rdar://problem/32732526>
3508
3509         Reviewed by Keith Miller.
3510
3511         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
3512         * stress/function-constructor-semantics.js: Added.
3513         (assert):
3514         (hasSyntaxError):
3515         (foo):
3516         (async.foo):
3517         (testError):
3518         (testOK.toString):
3519         (toString):
3520
3521 2017-06-26  Saam Barati  <sbarati@apple.com>
3522
3523         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
3524         https://bugs.webkit.org/show_bug.cgi?id=173740
3525
3526         Reviewed by Mark Lam.
3527
3528         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
3529         (Array.prototype.Symbol.iterator):
3530
3531 2017-06-26  Saam Barati  <sbarati@apple.com>
3532
3533         Skip a test on 32-bit platforms since we run out of address space.
3534
3535         Rubber stamped by Mark Lam.
3536
3537         * stress/dont-reserve-huge-capacity-lexer.js:
3538
3539 2017-06-26  Saam Barati  <sbarati@apple.com>
3540
3541         Crash in JSC::Lexer<unsigned char>::setCode
3542         https://bugs.webkit.org/show_bug.cgi?id=172754
3543
3544         Reviewed by Mark Lam.
3545
3546         * stress/dont-reserve-huge-capacity-lexer.js: Added.
3547         (catch):
3548
3549 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3550
3551         [JSC] Clean up Object.entries implementation
3552         https://bugs.webkit.org/show_bug.cgi?id=173759
3553
3554         Reviewed by Sam Weinig.
3555
3556         * microbenchmarks/object-entries.js: Added.
3557         (test):
3558
3559 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
3560
3561         Remove Reflect.enumerate
3562         https://bugs.webkit.org/show_bug.cgi?id=173806
3563
3564         Reviewed by Yusuke Suzuki.
3565
3566         * ChakraCore.yaml:
3567         * es6.yaml:
3568         These tests now fail because they use Reflect.enumerate.
3569
3570         * test262.yaml:
3571         This test now passes, it checked that Reflect.enumerate is undefined!
3572
3573         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
3574         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
3575
3576         * stress/reflect-enumerate.js: Removed.
3577         Remove a test solely for Reflect.enumerate.
3578
3579 2017-06-22  Saam Barati  <sbarati@apple.com>
3580
3581         ValueRep(DoubleRep(@v)) can not simply convert to @v
3582         https://bugs.webkit.org/show_bug.cgi?id=173687
3583         <rdar://problem/32855563>
3584
3585         Reviewed by Mark Lam.
3586
3587         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
3588         (i.catch):
3589
3590 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
3591
3592         [JSC] Object.values should be implemented in C++
3593         https://bugs.webkit.org/show_bug.cgi?id=173703
3594
3595         Reviewed by Sam Weinig.
3596
3597         * microbenchmarks/object-keys-map-values.js: Added.
3598         (test):
3599         * microbenchmarks/object-values.js: Added.
3600         (test):
3601         * stress/object-values-changing-properties.js: Added.
3602         (shouldBe):
3603         (throw.new.Error.let.source.get x):
3604         (throw.new.Error):
3605         (shouldBe.let.handler.get order):
3606         (get let):
3607         (shouldBe.let.handler.get return):
3608         (let.handler.get order):
3609
3610 2017-06-21  Saam Barati  <sbarati@apple.com>
3611
3612         eval virtual call is incorrect in the baseline JIT
3613         https://bugs.webkit.org/show_bug.cgi?id=173587
3614         <rdar://problem/32867897>
3615
3616         Reviewed by Michael Saboff.
3617
3618         * stress/do-eval-virtual-call-correctly.js: Added.
3619         (assert):
3620         (f):
3621         (i.test):
3622         (catch):
3623
3624 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
3625
3626         Update test262 test expectations after r218581.
3627
3628         Unreviewed test gardening.
3629
3630         * test262.yaml:
3631
3632 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
3633
3634         Revert changes in bug#160417 about extending `null` not being a derived class
3635         https://bugs.webkit.org/show_bug.cgi?id=169293
3636
3637         Reviewed by Saam Barati.
3638
3639         * stress/class-derived-from-null.js:
3640         (assertThrow):
3641         (test1):
3642         (test2):
3643         (test3):
3644         (test4):
3645         (test5):
3646         (test6):
3647
3648 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
3649
3650         [DFG] More ArrayIndexOf fixups for various types
3651         https://bugs.webkit.org/show_bug.cgi?id=173176
3652
3653         Reviewed by Saam Barati.
3654
3655         * stress/array-indexof-arraystorage.js: Added.
3656         (shouldBe):
3657         (indexOfInt32Other):
3658         (indexOfInt32Cell):
3659         (indexOfInt32Boolean):
3660         (indexOfDoubleOther):
3661         (indexOfDoubleCell):
3662         (indexOfDoubleBoolean):
3663         (indexOfInt32):
3664         (indexOfDouble):
3665         * stress/array-indexof-constant-folding.js: Added.
3666         (shouldBe):
3667         (indexOfInt32Other):
3668         (indexOfInt32Cell):
3669         (indexOfInt32Boolean):
3670         (indexOfDoubleOther):
3671         (indexOfDoubleCell):
3672         (indexOfDoubleBoolean):
3673         * stress/array-indexof-hole-and-other.js: Added.
3674         (shouldBe):
3675         (indexOf):
3676         * stress/array-indexof-other.js: Added.
3677         (shouldBe):
3678         (indexOfInt32):
3679         (indexOfDouble):
3680         (indexOfString):
3681         (indexOfObject):
3682         * stress/array-indexof-symbol.js: Added.
3683         (shouldBe):
3684         (indexOfInt32):
3685         (indexOfDouble):
3686         (indexOfString):
3687         (indexOfObject):
3688
3689 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
3690
3691         test262: Completion values for control flow do not match the spec
3692         https://bugs.webkit.org/show_bug.cgi?id=171265
3693
3694         Reviewed by Saam Barati.
3695
3696         * stress/completion-value.js:
3697         Condensed test for completion values in top level statements.
3698
3699         * stress/super-get-by-id.js:
3700         ClassDeclaration when evaled no longer produce values. Convert
3701         these to ClassExpressions so they produce the class value.
3702
3703         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
3704         This is a progression for currect spec behavior.
3705
3706         * mozilla/mozilla-tests.yaml:
3707         This test is now outdated, so mark it as failing for that reason.
3708
3709         * test262.yaml:
3710         Passing all "cptn" completion value tests.
3711
3712 2017-06-17  Keith Miller  <keith_miller@apple.com>
3713
3714         ArrayBuffer constructor needs to create subclass structures before its buffer
3715         https://bugs.webkit.org/show_bug.cgi?id=173510
3716
3717         Reviewed by Yusuke Suzuki.
3718
3719         * test262.yaml:
3720
3721 2017-06-17  Keith Miller  <keith_miller@apple.com>
3722
3723         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
3724         https://bugs.webkit.org/show_bug.cgi?id=173506
3725
3726         Reviewed by Ryosuke Niwa.
3727
3728         Re-baseline tests.
3729
3730         * ChakraCore/test/Function/apply3.baseline-jsc:
3731         * test262.yaml:
3732
3733 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
3734
3735         [JSC] Add fast path for Object.assign
3736         https://bugs.webkit.org/show_bug.cgi?id=173416
3737
3738         Reviewed by Mark Lam.
3739
3740         * stress/object-assign-changing-properties.js: Added.
3741         (shouldBe):
3742         (throw.new.Error.let.source.get x):
3743         (throw.new.Error):
3744         (shouldBe.let.source.get x):
3745         (shouldBe.let.target.set x):
3746         (shouldBe.let.target.get x):