WSL should have more tests of type checking failures
[WebKit-https.git] / JSTests / ChangeLog
1 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2
3         [JSC] Fix "name" and "length" of Proxy revoke function
4         https://bugs.webkit.org/show_bug.cgi?id=176155
5
6         Reviewed by Mark Lam.
7
8         * test262.yaml:
9
10 2017-08-31  Saam Barati  <sbarati@apple.com>
11
12         Graph::methodOfGettingAValueProfileFor compares NodeOrigin instead of the semantic CodeOrigin
13         https://bugs.webkit.org/show_bug.cgi?id=176206
14
15         Reviewed by Keith Miller.
16
17         * stress/compare-semantic-origin-op-negate-method-of-getting-a-value-profile.js: Added.
18         (a):
19         (b):
20         (foo):
21
22 2017-08-31  Ryan Haddad  <ryanhaddad@apple.com>
23
24         Skip two slow JSC tests after r221422.
25
26         Unreviewed test gardening.
27
28         * stress/regexp-prototype-match-on-too-long-rope.js:
29         * stress/regexp-prototype-test-on-too-long-rope.js:
30
31 2017-08-31  Filip Pizlo  <fpizlo@apple.com>
32
33         Unreviewed, skipping slow tests.
34         
35         These tests are now timing out. They would have always been slow. The timeouts are probably because OOMs
36         work differently now.
37
38         * stress/regexp-prototype-exec-on-too-long-rope.js:
39         * stress/string-prototype-charCodeAt-on-too-long-rope.js:
40
41 2017-08-31  Yusuke Suzuki  <utatane.tea@gmail.com>
42
43         [JSC] Use reifying system for "name" property of builtin JSFunction
44         https://bugs.webkit.org/show_bug.cgi?id=175260
45
46         Reviewed by Saam Barati.
47
48         * stress/accessors-get-set-prefix.js:
49         * stress/builtin-function-name.js: Added.
50         (shouldBe):
51         (shouldThrow):
52         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
53         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
54         * stress/private-name-as-anonymous-builtin.js: Added.
55         (shouldBe):
56         (NotPromise):
57
58 2017-08-30  Saam Barati  <sbarati@apple.com>
59
60         Unreviewed. Make test stop printing.
61
62         * microbenchmarks/fake-iterators-that-throw-when-finished.js:
63
64 2017-08-30  Ryan Haddad  <ryanhaddad@apple.com>
65
66         Unreviewed, rolling out r221327.
67
68         This change caused test262 failures.
69
70         Reverted changeset:
71
72         "[JSC] Use reifying system for "name" property of builtin
73         JSFunction"
74         https://bugs.webkit.org/show_bug.cgi?id=175260
75         http://trac.webkit.org/changeset/221327
76
77 2017-08-30  Saam Barati  <sbarati@apple.com>
78
79         semicolon is being interpreted as an = in the LiteralParser
80         https://bugs.webkit.org/show_bug.cgi?id=176114
81
82         Reviewed by Oliver Hunt.
83
84         * stress/jsonp-literal-parser-semicolon-is-not-assignment.js: Added.
85         * stress/resources/literal-parser-test-case.js: Added.
86
87 2017-08-30  Oleksandr Skachkov  <gskachkov@gmail.com>
88
89         [ESNext] Async iteration - Implement async iteration statement: for-await-of
90         https://bugs.webkit.org/show_bug.cgi?id=166698
91
92         Reviewed by Yusuke Suzuki.
93
94         * stress/async-iteration-for-await-of-syntax.js: Added.
95         (assert):
96         (checkSyntax):
97         (checkSyntaxError):
98         (checkSimpleAsyncGeneratorSloppyMode):
99         (checkSimpleAsyncGeneratorStrictMode):
100         (checkNestedAsyncGenerators):
101         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
102         * stress/async-iteration-for-await-of.js: Added.
103         (assert):
104         (async.foo):
105         (async.boo):
106         (const.boo.async):
107
108 2017-08-29  Yusuke Suzuki  <utatane.tea@gmail.com>
109
110         [JSC] Use reifying system for "name" property of builtin JSFunction
111         https://bugs.webkit.org/show_bug.cgi?id=175260
112
113         Reviewed by Saam Barati.
114
115         * stress/accessors-get-set-prefix.js:
116         * stress/builtin-function-name.js: Added.
117         (shouldBe):
118         (shouldThrow):
119         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
120         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
121
122 2017-08-25  Saam Barati  <sbarati@apple.com>
123
124         Support compiling catch in the DFG
125         https://bugs.webkit.org/show_bug.cgi?id=174590
126         <rdar://problem/34047845>
127
128         Reviewed by Filip Pizlo.
129
130         * microbenchmarks/delta-blue-try-catch.js: Added.
131         (exception):
132         (value):
133         (OrderedCollection):
134         (OrderedCollection.prototype.add):
135         (OrderedCollection.prototype.at):
136         (OrderedCollection.prototype.size):
137         (OrderedCollection.prototype.removeFirst):
138         (OrderedCollection.prototype.remove):
139         (Strength):
140         (Strength.stronger):
141         (Strength.weaker):
142         (Strength.weakestOf):
143         (Strength.strongest):
144         (Strength.prototype.nextWeaker):
145         (Constraint):
146         (Constraint.prototype.addConstraint):
147         (Constraint.prototype.satisfy):
148         (Constraint.prototype.destroyConstraint):
149         (Constraint.prototype.isInput):
150         (UnaryConstraint):
151         (UnaryConstraint.prototype.addToGraph):
152         (UnaryConstraint.prototype.chooseMethod):
153         (UnaryConstraint.prototype.isSatisfied):
154         (UnaryConstraint.prototype.markInputs):
155         (UnaryConstraint.prototype.output):
156         (UnaryConstraint.prototype.recalculate):
157         (UnaryConstraint.prototype.markUnsatisfied):
158         (UnaryConstraint.prototype.inputsKnown):
159         (UnaryConstraint.prototype.removeFromGraph):
160         (StayConstraint):
161         (StayConstraint.prototype.execute):
162         (EditConstraint.prototype.isInput):
163         (EditConstraint.prototype.execute):
164         (BinaryConstraint):
165         (BinaryConstraint.prototype.chooseMethod):
166         (BinaryConstraint.prototype.addToGraph):
167         (BinaryConstraint.prototype.isSatisfied):
168         (BinaryConstraint.prototype.markInputs):
169         (BinaryConstraint.prototype.input):
170         (BinaryConstraint.prototype.output):
171         (BinaryConstraint.prototype.recalculate):
172         (BinaryConstraint.prototype.markUnsatisfied):
173         (BinaryConstraint.prototype.inputsKnown):
174         (BinaryConstraint.prototype.removeFromGraph):
175         (ScaleConstraint):
176         (ScaleConstraint.prototype.addToGraph):
177         (ScaleConstraint.prototype.removeFromGraph):
178         (ScaleConstraint.prototype.markInputs):
179         (ScaleConstraint.prototype.execute):
180         (ScaleConstraint.prototype.recalculate):
181         (EqualityConstraint):
182         (EqualityConstraint.prototype.execute):
183         (Variable):
184         (Variable.prototype.addConstraint):
185         (Variable.prototype.removeConstraint):
186         (Planner):
187         (Planner.prototype.incrementalAdd):
188         (Planner.prototype.incrementalRemove):
189         (Planner.prototype.newMark):
190         (Planner.prototype.makePlan):
191         (Planner.prototype.extractPlanFromConstraints):
192         (Planner.prototype.addPropagate):
193         (Planner.prototype.removePropagateFrom):
194         (Planner.prototype.addConstraintsConsumingTo):
195         (Plan):
196         (Plan.prototype.addConstraint):
197         (Plan.prototype.size):
198         (Plan.prototype.constraintAt):
199         (Plan.prototype.execute):
200         (chainTest):
201         (projectionTest):
202         (change):
203         (deltaBlue):
204         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
205         (assert):
206         (Numbers):
207         (Numbers.prototype.next):
208         (return.Transpose):
209         (return.Transpose.prototype.next):
210         (transpose):
211         (verifyEven):
212         (verifyString):
213         (foo):
214         (runIterators):
215         * microbenchmarks/try-catch-word-count.js: Added.
216         (let.assert):
217         (EOF):
218         (let.texts):
219         (let.o.apply):
220         (foo):
221         (bar):
222         (f):
223         (run):
224         (test1):
225         (test2):
226         (test3):
227         (fn):
228         (A):
229         (B):
230         (A.prototype.getValue):
231         (B.prototype.getParentValue):
232         (strlen):
233         (sum.0):
234         (test):
235         (result.test.o):
236         (set add.set add):
237         (set forEach):
238         (stringHash):
239         (set if):
240         (testFunction):
241         (set delete.set has.set add):
242         * stress/catch-set-argument-speculation-failure.js: Added.
243         (o):
244         (e):
245         (e2):
246         (escape):
247         (baz):
248         (noInline.run):
249         (noInline):
250         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
251         (foo):
252         (e):
253         (baz):
254         (bar):
255
256 2017-08-24  Commit Queue  <commit-queue@webkit.org>
257
258         Unreviewed, rolling out r221119, r221124, and r221143.
259         https://bugs.webkit.org/show_bug.cgi?id=175973
260
261         "I think it regressed JSBench by 20%" (Requested by saamyjoon
262         on #webkit).
263
264         Reverted changesets:
265
266         "Support compiling catch in the DFG"
267         https://bugs.webkit.org/show_bug.cgi?id=174590
268         http://trac.webkit.org/changeset/221119
269
270         "Unreviewed, build fix in GTK port"
271         https://bugs.webkit.org/show_bug.cgi?id=174590
272         http://trac.webkit.org/changeset/221124
273
274         "DFG::JITCode::osrEntry should get sorted since we perform a
275         binary search on it"
276         https://bugs.webkit.org/show_bug.cgi?id=175893
277         http://trac.webkit.org/changeset/221143
278
279 2017-08-24  Michael Saboff  <msaboff@apple.com>
280
281         Add support for RegExp "dotAll" flag
282         https://bugs.webkit.org/show_bug.cgi?id=175924
283
284         Reviewed by Keith Miller.
285
286         Updated tests for new dotAll ('s' flag) changes.
287
288         * es6/Proxy_internal_get_calls_RegExp.prototype.flags.js:
289         * stress/static-getter-in-names.js:
290
291 2017-08-24  Mark Lam  <mark.lam@apple.com>
292
293         Land regression test for https://bugs.webkit.org/show_bug.cgi?id=164081.
294         https://bugs.webkit.org/show_bug.cgi?id=175940
295         <rdar://problem/29003921>
296
297         Reviewed by Saam Barati.
298
299         * stress/regress-164081.js: Added.
300         (shouldEqual):
301         (testcase):
302
303 2017-08-24  Ryan Haddad  <ryanhaddad@apple.com>
304
305         Skip flaky JSC test stress/test-finally.js.
306         https://bugs.webkit.org/show_bug.cgi?id=160283
307
308         Unreviewed test gardening.
309
310         * stress/test-finally.js:
311
312 2017-08-23  Saam Barati  <sbarati@apple.com>
313
314         Support compiling catch in the DFG
315         https://bugs.webkit.org/show_bug.cgi?id=174590
316
317         Reviewed by Filip Pizlo.
318
319         * microbenchmarks/delta-blue-try-catch.js: Added.
320         (exception):
321         (value):
322         (OrderedCollection):
323         (OrderedCollection.prototype.add):
324         (OrderedCollection.prototype.at):
325         (OrderedCollection.prototype.size):
326         (OrderedCollection.prototype.removeFirst):
327         (OrderedCollection.prototype.remove):
328         (Strength):
329         (Strength.stronger):
330         (Strength.weaker):
331         (Strength.weakestOf):
332         (Strength.strongest):
333         (Strength.prototype.nextWeaker):
334         (Constraint):
335         (Constraint.prototype.addConstraint):
336         (Constraint.prototype.satisfy):
337         (Constraint.prototype.destroyConstraint):
338         (Constraint.prototype.isInput):
339         (UnaryConstraint):
340         (UnaryConstraint.prototype.addToGraph):
341         (UnaryConstraint.prototype.chooseMethod):
342         (UnaryConstraint.prototype.isSatisfied):
343         (UnaryConstraint.prototype.markInputs):
344         (UnaryConstraint.prototype.output):
345         (UnaryConstraint.prototype.recalculate):
346         (UnaryConstraint.prototype.markUnsatisfied):
347         (UnaryConstraint.prototype.inputsKnown):
348         (UnaryConstraint.prototype.removeFromGraph):
349         (StayConstraint):
350         (StayConstraint.prototype.execute):
351         (EditConstraint.prototype.isInput):
352         (EditConstraint.prototype.execute):
353         (BinaryConstraint):
354         (BinaryConstraint.prototype.chooseMethod):
355         (BinaryConstraint.prototype.addToGraph):
356         (BinaryConstraint.prototype.isSatisfied):
357         (BinaryConstraint.prototype.markInputs):
358         (BinaryConstraint.prototype.input):
359         (BinaryConstraint.prototype.output):
360         (BinaryConstraint.prototype.recalculate):
361         (BinaryConstraint.prototype.markUnsatisfied):
362         (BinaryConstraint.prototype.inputsKnown):
363         (BinaryConstraint.prototype.removeFromGraph):
364         (ScaleConstraint):
365         (ScaleConstraint.prototype.addToGraph):
366         (ScaleConstraint.prototype.removeFromGraph):
367         (ScaleConstraint.prototype.markInputs):
368         (ScaleConstraint.prototype.execute):
369         (ScaleConstraint.prototype.recalculate):
370         (EqualityConstraint):
371         (EqualityConstraint.prototype.execute):
372         (Variable):
373         (Variable.prototype.addConstraint):
374         (Variable.prototype.removeConstraint):
375         (Planner):
376         (Planner.prototype.incrementalAdd):
377         (Planner.prototype.incrementalRemove):
378         (Planner.prototype.newMark):
379         (Planner.prototype.makePlan):
380         (Planner.prototype.extractPlanFromConstraints):
381         (Planner.prototype.addPropagate):
382         (Planner.prototype.removePropagateFrom):
383         (Planner.prototype.addConstraintsConsumingTo):
384         (Plan):
385         (Plan.prototype.addConstraint):
386         (Plan.prototype.size):
387         (Plan.prototype.constraintAt):
388         (Plan.prototype.execute):
389         (chainTest):
390         (projectionTest):
391         (change):
392         (deltaBlue):
393         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Added.
394         (assert):
395         (Numbers):
396         (Numbers.prototype.next):
397         (return.Transpose):
398         (return.Transpose.prototype.next):
399         (transpose):
400         (verifyEven):
401         (verifyString):
402         (foo):
403         (runIterators):
404         * microbenchmarks/try-catch-word-count.js: Added.
405         (let.assert):
406         (EOF):
407         (let.texts):
408         (let.o.apply):
409         (foo):
410         (bar):
411         (f):
412         (run):
413         (test1):
414         (test2):
415         (test3):
416         (fn):
417         (A):
418         (B):
419         (A.prototype.getValue):
420         (B.prototype.getParentValue):
421         (strlen):
422         (sum.0):
423         (test):
424         (result.test.o):
425         (set add.set add):
426         (set forEach):
427         (stringHash):
428         (set if):
429         (testFunction):
430         (set delete.set has.set add):
431         * stress/catch-set-argument-speculation-failure.js: Added.
432         (o):
433         (e):
434         (e2):
435         (escape):
436         (baz):
437         (noInline.run):
438         (noInline):
439         * stress/osr-enter-to-catch-with-set-local-type-check-failure.js: Added.
440         (foo):
441         (e):
442         (baz):
443         (bar):
444
445 2017-08-23  Yusuke Suzuki  <utatane.tea@gmail.com>
446
447         [JSC] Optimize Map iteration with intrinsic
448         https://bugs.webkit.org/show_bug.cgi?id=174355
449
450         Reviewed by Saam Barati.
451
452         * stress/map-iterator-result-should-have-expected-shape.js: Added.
453         (shouldBe):
454         (throw.new.Error):
455         * stress/set-iterator-result-should-have-expected-shape.js: Added.
456         (shouldBe):
457         (throw.new.Error.let.iterator.set Symbol):
458         (throw.new.Error.set add):
459         (let.iterator.set Symbol):
460
461 2017-08-23  Robin Morisset  <rmorisset@apple.com>
462
463         Add a micro-benchmark for checking that accessing a variable within a 'with'
464         block does not automatically prevent type prediction.
465         https://bugs.webkit.org/show_bug.cgi?id=175738
466
467         Reviewed by Saam Barati.
468
469         * stress/with_and_arith.js: Added.
470         (with):
471
472 2017-08-23  Skachkov Oleksandr  <gskachkov@gmail.com>
473
474         [ESNext] Async iteration - Implement Async Generator - runtime
475         https://bugs.webkit.org/show_bug.cgi?id=175240
476
477         Reviewed by Yusuke Suzuki.
478
479         * stress/async-iteration-async-from-sync.js: Added.
480         (assert):
481         (const.Logger):
482         (this.fullfilled):
483         (this.fullfilledDone):
484         (this.rejected):
485         (this.catched):
486         (this.isFinal):
487         (_assertLogger):
488         (const.assertLogger):
489         (const.getPromise.promiseHolder.return.new.Promise):
490         (foo):
491         (async.boo):
492         (bar):
493         (async.baz):
494         (async.goo):
495         * stress/async-iteration-basic.js: Added.
496         (assert):
497         (const.Logger):
498         (this.fullfilled):
499         (this.fullfilledDone):
500         (this.rejected):
501         (this.catched):
502         (this.isFinal):
503         (_assertLogger):
504         (const.assertLogger):
505         (const.getPromise.promiseHolder.return.new.Promise):
506         (async.generator):
507         (iterator.next.then):
508         (async.baz):
509         (async.boo):
510         (async.foo):
511         (async.goo):
512         (A.prototype.async.foo):
513         (A.prototype.async.boo):
514         (A):
515         (asyncGenExp.async):
516         (async.joo):
517         (j.next.then):
518         (then):
519         (async.koo):
520         (async.loo):
521         (async.moo):
522         (async.noo):
523         (async.ooo):
524         (async.roo):
525         (async.poo):
526         (async.soo):
527         (async.too):
528         * stress/async-iteration-evaluation.js: Added.
529         (assert):
530         (async.foo):
531         (catch):
532         * stress/async-iteration-syntax.js:
533         * stress/async-iteration-yield-promise.js: Added.
534         (assert):
535         (const.Logger):
536         (this.fullfilled):
537         (this.fullfilledDone):
538         (this.rejected):
539         (this.catched):
540         (this.isFinal):
541         (_assertLogger):
542         (const.assertLogger):
543         (const.getPromise.promiseHolder.return.new.Promise):
544         (async.foo):
545         (async.boo):
546         (async.bar):
547         * stress/async-iteration-yield-star-interface.js: Added.
548         (assert):
549         (const.getPromise.promiseHolder.return.new.Promise):
550         (const.Logger):
551         (this.fullfilled):
552         (this.fullfilledDone):
553         (this.rejected):
554         (this.catched):
555         (this.custom):
556         (this.isFinal):
557         (_assertLogger):
558         (const.assertLogger):
559         (let.asyncIter.Symbol.asyncIterator):
560         (let.asyncIter.next):
561         (let.asyncIter.throw):
562         (let.asyncIter.return):
563         (async.foo):
564         (asyncIter.Symbol.asyncIterator):
565         (asyncIter.next):
566         (async.boo):
567         (asyncIter.return):
568         (async.bar):
569         (async.baz):
570         (async.foobar):
571         * stress/async-iteration-yield-star.js: Added.
572         (assert):
573         (const.Logger):
574         (this.fullfilled):
575         (this.fullfilledDone):
576         (this.rejected):
577         (this.catched):
578         (this.custom):
579         (this.isFinal):
580         (_assertLogger):
581         (const.assertLogger):
582         (const.getPromise.promiseHolder.return.new.Promise):
583         (async.foo):
584         (async.boo):
585         (async.bar):
586         (async.baz):
587         (async.joo):
588         (async.goo):
589         (async.koo):
590         (async.loo):
591         (let.asyncIter.Symbol.asyncIterator):
592         (let.asyncIter.next):
593         (let.asyncIter.throw):
594         (let.asyncIter.return):
595         (async.moo):
596         (async.noo):
597         * test262.yaml:
598
599 2017-08-23  JF Bastien  <jfbastien@apple.com>
600
601         Fix printing in test
602
603         Unreviewed: fixing verbosity, shouldn't have been there.
604
605         * wasm/regress/175693.js:
606         (else.else):
607         (catch):
608
609 2017-08-18  Ryan Haddad  <ryanhaddad@apple.com>
610
611         Skip flaky JSC test microbenchmarks/generator-with-several-types.js.
612         https://bugs.webkit.org/show_bug.cgi?id=172543
613
614         Unreviewed test gardening.
615
616         * microbenchmarks/generator-with-several-types.js:
617
618 2017-08-17  JF Bastien  <jfbastien@apple.com>
619
620         WebAssembly: const in unreachable code decoded incorrectly, erroneously rejects binary as invalid
621         https://bugs.webkit.org/show_bug.cgi?id=175693
622         <rdar://problem/33952443>
623
624         Reviewed by Saam Barati.
625
626         Add a regression directory for WebAssembly tests.
627
628         * wasm.yaml:
629         * wasm/regress/175693.js: Added.
630         (else.else):
631         (instance.new.WebAssembly.Instance.new.WebAssembly.Module):
632         (catch):
633         * wasm/regress/175693.wasm: Added.
634
635 2017-08-15  Robin Morisset  <rmorisset@apple.com>
636
637         Support the 'with' keyword in FTL.
638         https://bugs.webkit.org/show_bug.cgi?id=175585
639
640         Reviewed by Saam Barati.
641
642         Also improve the JSTest/stress/with.js file to test
643         what happens when non-objects are passed to with.
644
645         * stress/with.js:
646         (foo):
647         (i.catch):
648         (i.with): Deleted.
649
650 2017-08-14  Keith Miller  <keith_miller@apple.com>
651
652         Add testing tool to lie to the DFG about profiles
653         https://bugs.webkit.org/show_bug.cgi?id=175487
654
655         Reviewed by Saam Barati.
656
657         * stress/compare-eq-incomplete-profile.js: Added.
658         (const.test.createBuiltin):
659
660 2017-08-14  Robin Morisset  <rmorisset@apple.com>
661
662         Support the with keyword in DFG
663         https://bugs.webkit.org/show_bug.cgi?id=175470
664
665         Reviewed by Saam Barati.
666
667         Added a new stress-test for the 'with' keyword, that caught a bug in a
668         previous version of this code.
669
670         * stress/with.js: Added.
671         (i.with):
672
673 2017-08-14  Ryan Haddad  <ryanhaddad@apple.com>
674
675         Skip flaky JSC test test/fieldopts/objtypespec-newobj-invalidation.1.js
676         https://bugs.webkit.org/show_bug.cgi?id=175544
677
678         Unreviewed test gardening.
679
680         * ChakraCore.yaml:
681
682 2017-08-09  Caitlin Potter  <caitp@igalia.com>
683
684         Early error on ANY operator before new.target
685         https://bugs.webkit.org/show_bug.cgi?id=157970
686
687         Reviewed by Saam Barati.
688
689         Instead of throwing if any unary operator precedes new.target, only
690         throw if the unary operator updates the reference.
691
692         The following become legal in JSC:
693
694         ```
695         !new.target
696         ~new.target
697         typeof new.target
698         delete new.target
699         void new.target
700         ```
701
702         All of which are legal in v8 and SpiderMonkey in strict and sloppy mode
703
704         * stress/new-target-syntax-errors.js:
705         * stress/new-target.js:
706
707 2017-08-09  Ryan Haddad  <ryanhaddad@apple.com>
708
709         Skip failing JSC tests stress/regress-169783.js and wasm.yaml/wasm/stress/oom.js.
710         https://bugs.webkit.org/show_bug.cgi?id=175255
711
712         Unreviewed test gardening.
713
714         * stress/regress-169783.js:
715         * wasm/stress/oom.js:
716
717 2017-08-09  Oleksandr Skachkov  <gskachkov@gmail.com>
718
719         REGRESSION: 2 test262/test/language/statements/async-function failures
720         https://bugs.webkit.org/show_bug.cgi?id=175334
721
722         Reviewed by Yusuke Suzuki.
723
724         Add @skip parameters to tests, and remove test for async iterator from 
725         async await syntax test because it is already covered by async-iterator-syntax.js
726
727         * stress/async-await-syntax.js:
728         * stress/async-iteration-syntax.js:
729
730 2017-08-08  Yusuke Suzuki  <utatane.tea@gmail.com>
731
732         Unreviewed, gardening test262 for Promise resolve / reject function length
733         https://bugs.webkit.org/show_bug.cgi?id=175333
734
735         * test262.yaml:
736
737 2017-08-07  Robin Morisset  <rmorisset@apple.com>
738
739         GetOwnProperty of TypedArray indexed fields is wrongly configurable
740         https://bugs.webkit.org/show_bug.cgi?id=175307
741
742         Reviewed by Saam Barati.
743
744         * stress/typedarray-getownproperty-not-configurable.js: Added.
745         (assert):
746         (foo):
747
748 2017-08-06  Yusuke Suzuki  <utatane.tea@gmail.com>
749
750         Promise resolve and reject function should have length = 1
751         https://bugs.webkit.org/show_bug.cgi?id=175242
752
753         Reviewed by Saam Barati.
754
755         * stress/builtin-function-length.js: Added.
756         (shouldBe):
757         (shouldThrow):
758         (shouldBe.JSON.stringify.Object.getOwnPropertyDescriptor):
759         (shouldBe.JSON.stringify.Object.getOwnPropertyNames.Array.prototype.filter.sort):
760
761 2017-08-06  Oleksandr Skachkov  <gskachkov@gmail.com>
762
763         [ESNext] Async iteration - Implement Async Generator - parser
764         https://bugs.webkit.org/show_bug.cgi?id=175210
765
766         Reviewed by Yusuke Suzuki.
767
768         * stress/async-await-syntax.js:
769         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
770         * stress/async-iteration-syntax.js: Added.
771         (assert):
772         (checkSyntax):
773         (checkSyntaxError):
774         (checkSimpleAsyncGeneratorSloppyMode):
775         (checkSimpleAsyncGeneratorStrictMode):
776         (checkNestedAsyncGenerators):
777         (checkSimpleAsyncGeneratorSyntaxErrorInStrictMode):
778         * stress/generator-class-methods-syntax.js:
779
780 2017-08-03  Carlos Alberto Lopez Perez  <clopez@igalia.com>
781
782         JSC test wasm/js-api/test_memory_constructor.js should be skipped on memoryLimited
783         https://bugs.webkit.org/show_bug.cgi?id=175150
784
785         Unreviewed test gardening.
786
787         * wasm/js-api/test_memory_constructor.js:
788
789 2017-08-02  Carlos Alberto Lopez Perez  <clopez@igalia.com>
790
791         [Linux] JSTests/wasm/stress/oom.js should not run on Linux
792         https://bugs.webkit.org/show_bug.cgi?id=175100
793
794         Reviewed by Mark Lam.
795
796         The JSC test JSTests/wasm/stress/oom.js tries to use all the
797         available memory until an out of memory exception happens.
798
799         The Linux kernel is more tuned for server workloads than for GUI
800         responsiveness. When a process tries to use a lot of memory, Linux
801         will do its best to serve the request. This usually translates to
802         free physical RAM by writing to disk dirty pages and/or moving out
803         less recently used pages to swap (disk storage).
804         Meanwhile it does this, the system will become unresponsive and this
805         leads to freezes that can last even some minutes on the worst cases.
806
807         Therefore, let's skip this test on Linux as it will cause more harm
808         than good on the Linux bots or on the machines of Linux developers.
809
810         * wasm/stress/oom.js:
811
812 2017-08-01  Oleksandr Skachkov  <gskachkov@gmail.com>
813
814         [JSC] Remove unnecessary print from stress\promise-finally.js test
815         https://bugs.webkit.org/show_bug.cgi?id=175015
816
817         Reviewed by Yusuke Suzuki.
818
819         * stress/promise-finally.js:
820         (p.finally):
821         (then):
822
823 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
824
825         Unreviewed, update test262 results for optional catch binding
826
827         * test262.yaml:
828
829 2017-07-31  Yusuke Suzuki  <utatane.tea@gmail.com>
830
831         [JSC] Support optional catch binding
832         https://bugs.webkit.org/show_bug.cgi?id=174981
833
834         Reviewed by Saam Barati.
835
836         * stress/optional-catch-binding-syntax.js: Added.
837         (testSyntax):
838         (testSyntaxError):
839         (catch.catch):
840         * stress/optional-catch-binding.js: Added.
841         (shouldBe):
842         (throwException):
843
844 2017-07-28  Mark Lam  <mark.lam@apple.com>
845
846         ObjectToStringAdaptiveStructureWatchpoint should not fire if it's dying imminently.
847         https://bugs.webkit.org/show_bug.cgi?id=174948
848         <rdar://problem/33495680>
849
850         Reviewed by Filip Pizlo.
851
852         * stress/regress-174948.js: Added.
853
854 2017-07-28  Yusuke Suzuki  <utatane.tea@gmail.com>
855
856         ASSERTION FAILED: candidate->op() == PhantomCreateRest || candidate->op() == PhantomDirectArguments || candidate->op() == PhantomClonedArguments || candidate->op() == PhantomSpread || candidate->op() == PhantomNewArrayWithSpread
857         https://bugs.webkit.org/show_bug.cgi?id=174900
858
859         Reviewed by Saam Barati.
860
861         * stress/arguments-elimination-candidate-listings-should-respect-pseudo-terminals.js: Added.
862         (sideEffect):
863         (args):
864         (test):
865
866 2017-07-27  Yusuke Suzuki  <utatane.tea@gmail.com>
867
868         Hoist DOM binding attribute getter prologue into JavaScriptCore taking advantage of DOMJIT / CheckSubClass
869         https://bugs.webkit.org/show_bug.cgi?id=171637
870
871         Reviewed by Darin Adler.
872
873         * stress/domjit-getter-complex-with-incorrect-object.js:
874         (i.shouldThrow):
875         * stress/domjit-getter-type-check.js: Copied from JSTests/stress/domjit-getter-complex-with-incorrect-object.js.
876         (shouldBe):
877         (i.shouldThrow):
878
879 2017-07-26  JF Bastien  <jfbastien@apple.com>
880
881         WebAssembly: test throwing out of the start function
882         https://bugs.webkit.org/show_bug.cgi?id=165714
883         <rdar://problem/29760251>
884
885         Reviewed by Keith Miller.
886
887         * wasm/assert.js:
888         * wasm/function-tests/trap-from-start.js: Added.
889         (StartTraps):
890         * wasm/function-tests/trap-from-start-async.js: Added.
891         (async.StartTrapsAsync):
892
893 2017-07-21  Yusuke Suzuki  <utatane.tea@gmail.com>
894
895         [FTL] Arguments elimination is suppressed by unreachable blocks
896         https://bugs.webkit.org/show_bug.cgi?id=174352
897
898         Reviewed by Filip Pizlo.
899
900         * stress/arguments-elimination-force-exit.js: Added.
901         (shouldBe):
902         (strict):
903         (sloppy):
904         * stress/arguments-elimination-throw.js: Added.
905         (shouldBe):
906         (shouldThrow):
907         (sloppy):
908         (isArguments):
909
910 2017-07-13  Mark Lam  <mark.lam@apple.com>
911
912         Add some additional test cases for bug 170896.
913         https://bugs.webkit.org/show_bug.cgi?id=174491
914
915         Reviewed by Filip Pizlo.
916
917         * stress/regress-170896-with-contiguous-shape-profile.js: Copied from JSTests/stress/regress-170896.js.
918         * stress/regress-170896-with-double-shape-profile.js: Added.
919         (test):
920         * stress/regress-170896-with-int32-shape-profile.js: Added.
921         (test):
922         * stress/regress-170896.js: Removed.
923
924 2017-07-13  Saam Barati  <sbarati@apple.com>
925
926         Missing exception check in JSObject::hasInstance
927         https://bugs.webkit.org/show_bug.cgi?id=174455
928         <rdar://problem/31384608>
929
930         Reviewed by Mark Lam.
931
932         * stress/has-instance-exception-check.js: Added.
933         (assert):
934         (let.getter.Object.getOwnPropertyDescriptor.get foo):
935
936 2017-07-13  Caio Lima  <ticaiolima@gmail.com>
937
938         [ESnext] Implement Object Spread
939         https://bugs.webkit.org/show_bug.cgi?id=167963
940
941         Reviewed by Saam Barati.
942
943         * stress/obj-rest-destructuring-order.js: Added.
944         (assert):
945         (o.get z):
946         (o.get a):
947         * stress/obj-spread-order.js: Added.
948         (assert):
949         (o.get z):
950         (o.get a):
951         * stress/object-spread.js: Added.
952         (let.assert):
953         (assert.sameValue):
954         (let.o.get a):
955         (let.obj.get c):
956         (cthulhu.get x):
957         (let.obj.set c):
958         (calls.o.get z):
959         (calls.o.get a):
960         (try.let.obj.get foo):
961         (get calls):
962
963 2017-07-12  Saam Barati  <sbarati@apple.com>
964
965         GenericArguments consults the wrong state when tracking modified argument descriptors and mapped arguments
966         https://bugs.webkit.org/show_bug.cgi?id=174411
967         <rdar://problem/31696186>
968
969         Reviewed by Mark Lam.
970
971         * stress/generic-arguments-correct-delete-behavior.js: Added.
972         (assert):
973         (makeTest):
974
975 2017-07-07  Mark Lam  <mark.lam@apple.com>
976
977         \n\r is not the same as \r\n.
978         https://bugs.webkit.org/show_bug.cgi?id=173053
979
980         Reviewed by Keith Miller.
981
982         * stress/regress-173053.js: Added.
983         * stress/template-literal-line-terminators.js:
984
985 2017-07-06  Saam Barati  <sbarati@apple.com>
986
987         We are missing places where we invalidate the for-in context
988         https://bugs.webkit.org/show_bug.cgi?id=174184
989
990         Reviewed by Geoffrey Garen.
991
992         * stress/for-in-invalidate-context-weird-assignments.js: Added.
993         (assert):
994         (test):
995
996 2017-07-05  Saam Barati  <sbarati@apple.com>
997
998         NewArray in FTLLowerDFGToB3 does not handle speculating on doubles when having a bad time
999         https://bugs.webkit.org/show_bug.cgi?id=174188
1000         <rdar://problem/30581423>
1001
1002         Reviewed by Mark Lam.
1003
1004         * stress/new-array-having-a-bad-time-double.js: Added.
1005         (assert):
1006         (foo):
1007
1008 2017-07-05  Yusuke Suzuki  <utatane.tea@gmail.com>
1009
1010         WTF::StringImpl::copyChars segfaults when built with GCC 7
1011         https://bugs.webkit.org/show_bug.cgi?id=173407
1012
1013         Reviewed by Andreas Kling.
1014
1015         * stress/string-repeat-copy-chars-crash.js: Added.
1016         (shouldBe):
1017
1018 2017-07-03  Saam Barati  <sbarati@apple.com>
1019
1020         Skip unshiftCountSlowCase-correct-postCapacity.js on debug builds since it takes a long time to run.
1021
1022         * stress/unshiftCountSlowCase-correct-postCapacity.js:
1023
1024 2017-07-03  Yusuke Suzuki  <utatane.tea@gmail.com>
1025
1026         Unreviewed, annotate dont--reserve-huge-capacity-lexer.js with $memoryLimited
1027
1028         It requires too much memory.
1029
1030         * stress/dont-reserve-huge-capacity-lexer.js:
1031
1032 2017-06-30  Michael Saboff  <msaboff@apple.com>
1033
1034         Skip a test on ARM64 platform since we run out of address space.
1035
1036         Rubber stamped by Saam Barati.
1037
1038         * stress/dont-reserve-huge-capacity-lexer.js:
1039
1040 2017-06-30  Michael Saboff  <msaboff@apple.com>
1041
1042         RegExp's  anchored with .* with \g flag can return wrong match start for strings with multiple matches
1043         https://bugs.webkit.org/show_bug.cgi?id=174044
1044
1045         Reviewed by Oliver Hunt.
1046
1047         New regression test.
1048
1049         * stress/regress-174044.js: Added.
1050         (test1):
1051         (test2):
1052
1053 2017-06-30  Filip Pizlo  <fpizlo@apple.com>
1054
1055         RegExpCachedResult::setInput should reify left and right contexts
1056         https://bugs.webkit.org/show_bug.cgi?id=173818
1057
1058         Reviewed by Keith Miller.
1059
1060         * stress/right-left-context-invalidated-by-input.js: Added.
1061         (test.validateContexts):
1062         (test):
1063
1064 2017-06-29  Saam Barati  <sbarati@apple.com>
1065
1066         Calculating postCapacity in unshiftCountSlowCase is wrong
1067         https://bugs.webkit.org/show_bug.cgi?id=173992
1068         <rdar://problem/32283199>
1069
1070         Reviewed by Keith Miller.
1071
1072         * stress/unshiftCountSlowCase-correct-postCapacity.js: Added.
1073         (temp):
1074
1075 2017-06-29  Commit Queue  <commit-queue@webkit.org>
1076
1077         Unreviewed, rolling out r218512.
1078         https://bugs.webkit.org/show_bug.cgi?id=173981
1079
1080         "It changes the behavior of the JS API's JSEvaluateScript
1081         which breaks TurboTax" (Requested by saamyjoon on #webkit).
1082
1083         Reverted changeset:
1084
1085         "test262: Completion values for control flow do not match the
1086         spec"
1087         https://bugs.webkit.org/show_bug.cgi?id=171265
1088         http://trac.webkit.org/changeset/218512
1089
1090 2017-06-27  JF Bastien  <jfbastien@apple.com>
1091
1092         WebAssembly: running out of executable memory should throw OoM
1093         https://bugs.webkit.org/show_bug.cgi?id=171537
1094         <rdar://problem/32963338>
1095
1096         Reviewed by Saam Barati.
1097
1098         * wasm.yaml:
1099         * wasm/lowExecutableMemory/executable-memory-oom.js: Added.
1100         (const.invoke):
1101         (failCount.0.catch):
1102         (failCount.0.module.undefined.catch):
1103         * wasm/lowExecutableMemory/exports-oom.js: Added.
1104         (const.type):
1105         (const.params):
1106         (const.randomProgram):
1107         (failCount.0.catch):
1108         (failCount.0.module.undefined.catch):
1109         * wasm/lowExecutableMemory/imports-oom.js: Added.
1110         (const.type):
1111         (const.params):
1112         (const.randomProgram):
1113         (f.imports.push):
1114         (failCount.0.catch):
1115         (failCount.0.module.undefined.catch):
1116
1117 2017-06-27  Caio Lima  <ticaiolima@gmail.com>
1118
1119         [ESnext] Implement Object Rest - Implementing Object Rest Destructuring
1120         https://bugs.webkit.org/show_bug.cgi?id=167962
1121
1122         Reviewed by Saam Barati.
1123
1124         * stress/object-rest-deconstruct.js: Added.
1125         (let.assert):
1126         (let.assertPropDescriptor):
1127         (catch):
1128         (get 3):
1129         (foo):
1130         (let.src.get y):
1131         (let.src.set y):
1132         (let.gen):
1133
1134 2017-06-27  Saam Barati  <sbarati@apple.com>
1135
1136         Function constructor needs to follow the spec and validate parameters and body independently
1137         https://bugs.webkit.org/show_bug.cgi?id=173303
1138         <rdar://problem/32732526>
1139
1140         Reviewed by Keith Miller.
1141
1142         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1143         * stress/function-constructor-semantics.js: Added.
1144         (assert):
1145         (hasSyntaxError):
1146         (foo):
1147         (async.foo):
1148         (testError):
1149         (testOK.toString):
1150         (toString):
1151
1152 2017-06-26  Saam Barati  <sbarati@apple.com>
1153
1154         RegExpPrototype.js builtin uses for-of iteration which is almost certainly incorrect
1155         https://bugs.webkit.org/show_bug.cgi?id=173740
1156
1157         Reviewed by Mark Lam.
1158
1159         * stress/regexp-prototype-replace-builtin-should-not-use-for-of.js: Added.
1160         (Array.prototype.Symbol.iterator):
1161
1162 2017-06-26  Saam Barati  <sbarati@apple.com>
1163
1164         Skip a test on 32-bit platforms since we run out of address space.
1165
1166         Rubber stamped by Mark Lam.
1167
1168         * stress/dont-reserve-huge-capacity-lexer.js:
1169
1170 2017-06-26  Saam Barati  <sbarati@apple.com>
1171
1172         Crash in JSC::Lexer<unsigned char>::setCode
1173         https://bugs.webkit.org/show_bug.cgi?id=172754
1174
1175         Reviewed by Mark Lam.
1176
1177         * stress/dont-reserve-huge-capacity-lexer.js: Added.
1178         (catch):
1179
1180 2017-06-24  Yusuke Suzuki  <utatane.tea@gmail.com>
1181
1182         [JSC] Clean up Object.entries implementation
1183         https://bugs.webkit.org/show_bug.cgi?id=173759
1184
1185         Reviewed by Sam Weinig.
1186
1187         * microbenchmarks/object-entries.js: Added.
1188         (test):
1189
1190 2017-06-24  Joseph Pecoraro  <pecoraro@apple.com>
1191
1192         Remove Reflect.enumerate
1193         https://bugs.webkit.org/show_bug.cgi?id=173806
1194
1195         Reviewed by Yusuke Suzuki.
1196
1197         * ChakraCore.yaml:
1198         * es6.yaml:
1199         These tests now fail because they use Reflect.enumerate.
1200
1201         * test262.yaml:
1202         This test now passes, it checked that Reflect.enumerate is undefined!
1203
1204         * stress/property-name-enumerator-should-not-look-into-indexed-values-when-it-is-a-dictionary.js:
1205         Convert to for..in which presented the original issue. See bug <https://webkit.org/b/149811>
1206
1207         * stress/reflect-enumerate.js: Removed.
1208         Remove a test solely for Reflect.enumerate.
1209
1210 2017-06-22  Saam Barati  <sbarati@apple.com>
1211
1212         ValueRep(DoubleRep(@v)) can not simply convert to @v
1213         https://bugs.webkit.org/show_bug.cgi?id=173687
1214         <rdar://problem/32855563>
1215
1216         Reviewed by Mark Lam.
1217
1218         * stress/dont-strength-reduce-valuerep-of-doublerep.js: Added.
1219         (i.catch):
1220
1221 2017-06-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1222
1223         [JSC] Object.values should be implemented in C++
1224         https://bugs.webkit.org/show_bug.cgi?id=173703
1225
1226         Reviewed by Sam Weinig.
1227
1228         * microbenchmarks/object-keys-map-values.js: Added.
1229         (test):
1230         * microbenchmarks/object-values.js: Added.
1231         (test):
1232         * stress/object-values-changing-properties.js: Added.
1233         (shouldBe):
1234         (throw.new.Error.let.source.get x):
1235         (throw.new.Error):
1236         (shouldBe.let.handler.get order):
1237         (get let):
1238         (shouldBe.let.handler.get return):
1239         (let.handler.get order):
1240
1241 2017-06-21  Saam Barati  <sbarati@apple.com>
1242
1243         eval virtual call is incorrect in the baseline JIT
1244         https://bugs.webkit.org/show_bug.cgi?id=173587
1245         <rdar://problem/32867897>
1246
1247         Reviewed by Michael Saboff.
1248
1249         * stress/do-eval-virtual-call-correctly.js: Added.
1250         (assert):
1251         (f):
1252         (i.test):
1253         (catch):
1254
1255 2017-06-20  Ryan Haddad  <ryanhaddad@apple.com>
1256
1257         Update test262 test expectations after r218581.
1258
1259         Unreviewed test gardening.
1260
1261         * test262.yaml:
1262
1263 2017-06-20  Oleksandr Skachkov  <gskachkov@gmail.com>
1264
1265         Revert changes in bug#160417 about extending `null` not being a derived class
1266         https://bugs.webkit.org/show_bug.cgi?id=169293
1267
1268         Reviewed by Saam Barati.
1269
1270         * stress/class-derived-from-null.js:
1271         (assertThrow):
1272         (test1):
1273         (test2):
1274         (test3):
1275         (test4):
1276         (test5):
1277         (test6):
1278
1279 2017-06-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1280
1281         [DFG] More ArrayIndexOf fixups for various types
1282         https://bugs.webkit.org/show_bug.cgi?id=173176
1283
1284         Reviewed by Saam Barati.
1285
1286         * stress/array-indexof-arraystorage.js: Added.
1287         (shouldBe):
1288         (indexOfInt32Other):
1289         (indexOfInt32Cell):
1290         (indexOfInt32Boolean):
1291         (indexOfDoubleOther):
1292         (indexOfDoubleCell):
1293         (indexOfDoubleBoolean):
1294         (indexOfInt32):
1295         (indexOfDouble):
1296         * stress/array-indexof-constant-folding.js: Added.
1297         (shouldBe):
1298         (indexOfInt32Other):
1299         (indexOfInt32Cell):
1300         (indexOfInt32Boolean):
1301         (indexOfDoubleOther):
1302         (indexOfDoubleCell):
1303         (indexOfDoubleBoolean):
1304         * stress/array-indexof-hole-and-other.js: Added.
1305         (shouldBe):
1306         (indexOf):
1307         * stress/array-indexof-other.js: Added.
1308         (shouldBe):
1309         (indexOfInt32):
1310         (indexOfDouble):
1311         (indexOfString):
1312         (indexOfObject):
1313         * stress/array-indexof-symbol.js: Added.
1314         (shouldBe):
1315         (indexOfInt32):
1316         (indexOfDouble):
1317         (indexOfString):
1318         (indexOfObject):
1319
1320 2017-06-19  Joseph Pecoraro  <pecoraro@apple.com>
1321
1322         test262: Completion values for control flow do not match the spec
1323         https://bugs.webkit.org/show_bug.cgi?id=171265
1324
1325         Reviewed by Saam Barati.
1326
1327         * stress/completion-value.js:
1328         Condensed test for completion values in top level statements.
1329
1330         * stress/super-get-by-id.js:
1331         ClassDeclaration when evaled no longer produce values. Convert
1332         these to ClassExpressions so they produce the class value.
1333         
1334         * ChakraCore/test/GlobalFunctions/evalreturns3.baseline-jsc:
1335         This is a progression for currect spec behavior.
1336
1337         * mozilla/mozilla-tests.yaml:
1338         This test is now outdated, so mark it as failing for that reason.
1339
1340         * test262.yaml:
1341         Passing all "cptn" completion value tests.
1342
1343 2017-06-17  Keith Miller  <keith_miller@apple.com>
1344
1345         ArrayBuffer constructor needs to create subclass structures before its buffer
1346         https://bugs.webkit.org/show_bug.cgi?id=173510
1347
1348         Reviewed by Yusuke Suzuki.
1349
1350         * test262.yaml:
1351
1352 2017-06-17  Keith Miller  <keith_miller@apple.com>
1353
1354         ArrayPrototype methods should use JSValue::toLength for non-Arrays.
1355         https://bugs.webkit.org/show_bug.cgi?id=173506
1356
1357         Reviewed by Ryosuke Niwa.
1358
1359         Re-baseline tests.
1360
1361         * ChakraCore/test/Function/apply3.baseline-jsc:
1362         * test262.yaml:
1363
1364 2017-06-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1365
1366         [JSC] Add fast path for Object.assign
1367         https://bugs.webkit.org/show_bug.cgi?id=173416
1368
1369         Reviewed by Mark Lam.
1370
1371         * stress/object-assign-changing-properties.js: Added.
1372         (shouldBe):
1373         (throw.new.Error.let.source.get x):
1374         (throw.new.Error):
1375         (shouldBe.let.source.get x):
1376         (shouldBe.let.target.set x):
1377         (shouldBe.let.target.get x):
1378         * stress/object-assign-proxy.js: Added.
1379         (shouldBe):
1380         (throw.new.Error.let.handler.get order):
1381
1382 2017-06-15  Yusuke Suzuki  <utatane.tea@gmail.com>
1383
1384         [JSC] Implement Object.assign in C++
1385         https://bugs.webkit.org/show_bug.cgi?id=173414
1386
1387         Reviewed by Saam Barati.
1388
1389         * stress/object-assign-string-first.js: Added.
1390         (shouldBe):
1391         (source.get Symbol):
1392         (source.get 1):
1393         (source.get cocoa):
1394
1395 2017-06-14  JF Bastien  <jfbastien@apple.com>
1396
1397         WebAssembly: remove empty test files
1398         https://bugs.webkit.org/show_bug.cgi?id=173382
1399
1400         Reviewed by Saam Barati.
1401
1402         The following files:
1403                 JSTests/wasm/function-tests/call-indirect-params.js
1404                 JSTests/wasm/function-tests/call-indirect.js
1405                 JSTests/wasm/js-api/call-indirect-results.js
1406         Were changed to empty files in https://trac.webkit.org/changeset/209771
1407
1408         They were testing call_indirect with the wrong semantics, before
1409         we implemented tables. That change implemented tables and
1410         therefore removed the erroneous tests.
1411
1412         We have a few tests for call_indirect which already do the right thing:
1413                 JSTests/wasm/function-tests/context-switch.js
1414                 JSTests/wasm/function-tests/exceptions.js
1415                 JSTests/wasm/function-tests/grow-memory-2.js
1416                 JSTests/wasm/function-tests/stack-overflow.js
1417                 JSTests/wasm/function-tests/table-basic-2.js
1418                 JSTests/wasm/function-tests/table-basic.js
1419                 JSTests/wasm/js-api/call-indirect.js
1420                 JSTests/wasm/js-api/table.js
1421                 JSTests/wasm/js-api/unique-signature.js
1422                 JSTests/wasm/js-api/wrapper-function.js
1423
1424         I also just imported the updated spec tests which, among other
1425         things, test call_indirect:
1426                 core/br.wast
1427                 core/br_table.wast
1428                 core/call_indirect.wast
1429                 core/func.wast
1430                 core/func_ptrs.wast
1431                 core/imports.wast
1432                 core/left-to-right.wast
1433                 core/linking.wast
1434                 core/nop.wast
1435                 core/return.wast
1436                 core/typecheck.wast
1437                 core/unreachable.wast
1438
1439         So I think it's OK to just delete the tests which should just have
1440         been deleted back when tables were added.
1441
1442         * wasm/function-tests/call-indirect-params.js: Removed.
1443         * wasm/function-tests/call-indirect.js: Removed.
1444         * wasm/js-api/call-indirect-results.js: Removed.
1445
1446 2017-06-13  JF Bastien  <jfbastien@apple.com>
1447
1448         WebAssembly: import updated spec tests
1449         https://bugs.webkit.org/show_bug.cgi?id=173287
1450         <rdar://problem/32725975>
1451
1452         Reviewed by Saam Barati.
1453
1454         Import spec tests as of 31c641cc15f2aedbec2fa45a5185f68416df578b,
1455         with a few modifications so things work.
1456
1457         Fix a bunch of bugs found through this process, and punt a few tests (which I
1458         marked as blocked by this bug).
1459
1460         Fixes:
1461
1462         Fix load / store alignment: r216908 erroneously implemented it as bit alignment
1463         instead of byte alignment. It was also missing memory-alignment.js despite it
1464         being in the ChangeLog, so add it too. This allows spec-test/align.wast.js to
1465         pass.
1466
1467         Tables can be imported or in a section. There can be only one, but sections can
1468         be empty. An Elements section can exist if there's no Table, as long as it is
1469         also empty.
1470
1471         Memories can be imported or in a section. There can be only one, but sections
1472         can be empty. A Data section can exist if there's no Memory, as long as it is
1473         also empty.
1474
1475         Prototypes: stringify without .prototype. in the string.
1476
1477         WebAssembly.Table.prototype.grow was plain wrong: it takes a delta parameter,
1478         not a final size, and throws a RangeError on failure, not a TypeError.
1479
1480         Fix compile / instantiate so the reject the promise if given an argument of the
1481         wrong type (instead of failing instantly).
1482
1483         Fix async on neuter test.
1484
1485         Element section shouldn't affect any Table if any of the elements are out of
1486         bounds. We need to process it in two passes.
1487
1488         Segment section shouldn't affect any Data if any of the segments are out of
1489         bounds. We need to process it in two passes.
1490
1491         Empty data segments are valid, but only when there is no memory. Their index
1492         still gets validated, and has to be zero.
1493
1494         Punts:
1495
1496         Error messages with context, the test seems overly restrictive but this is
1497         minor.
1498
1499         compile/instantiate/validate property descriptors.
1500
1501         UTF-8 bugs.
1502
1503         Temporarily disable NaN tests. We need to go back and implement the following
1504         semantics: https://github.com/WebAssembly/spec/pull/414 This doesn't matter as
1505         much as getting all the other tests passing.
1506
1507         Worth noting for NaNs: f64.no_fold_mul_one (also a NaN test) as well as
1508         no_fold_promote_demote (an interesting corner case which we get wrong). mul by
1509         one is (assert_return (invoke \"f64.no_fold_mul_one\" (i64.const
1510         0x7ff4000000000000)) (i64.const 0x7ff8000000000000)) which means converting sNaN
1511         to qNaN, and promote/demote is (assert_return (invoke \"no_fold_promote_demote\"
1512         (i32.const 0x7fa00000)) (i32.const 0x7fc00000)) which is the same. I'm not sure
1513         why they're not allowed.
1514
1515         * wasm.yaml:
1516         * wasm/function-tests/i32-load8-s.js:
1517         * wasm/function-tests/memory-access-past-4gib.js:
1518         (const.op.of.WASM.opcodes):
1519         * wasm/function-tests/memory-alignment.js: Added.
1520         (const.op.of.WASM.opcodes):
1521         * wasm/function-tests/memory-section-and-import.js:
1522         * wasm/js-api/Module-compile.js:
1523         (async.testPromiseAPI):
1524         * wasm/js-api/dont-mmap-zero-byte-memory.js:
1525         (testMems):
1526         * wasm/js-api/element.js:
1527         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1528         * wasm/js-api/neutered-inputs.js:
1529         (const.testFunction): Deleted.
1530         (const.testConstructor): Deleted.
1531         * wasm/js-api/table.js:
1532         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
1533         (new.WebAssembly.Module):
1534         (assert.throws):
1535         (assertBadTableImport):
1536         (assert.throws.WebAssembly.Table.prototype.grow):
1537         (assertBadTableInstance): Deleted.
1538         * wasm/js-api/test_Data.js:
1539         (DataSectionWithoutMemory):
1540         * wasm/spec-harness/index.js:
1541         (module):
1542         (uniqueTest): Deleted.
1543         (assert_invalid): Deleted.
1544         (assert_soft_invalid): Deleted.
1545         (register): Deleted.
1546         (call): Deleted.
1547         (get instance): Deleted.
1548         (exports): Deleted.
1549         (run): Deleted.
1550         (assert_unlinkable): Deleted.
1551         (assert_uninstantiable): Deleted.
1552         (assert_trap): Deleted.
1553         (try.f): Deleted.
1554         (catch): Deleted.
1555         (assert_exhaustion): Deleted.
1556         (assert_return): Deleted.
1557         (assert_return_nan): Deleted.
1558         * wasm/spec-harness/testharness.css: Removed.
1559         * wasm/spec-harness/testharness.js: Removed.
1560         * wasm/spec-harness/testharnessreport.js: Removed.
1561         * wasm/spec-harness/wasm-constants.js:
1562         (assertTraps):
1563         (assertWasmThrows):
1564         * wasm/spec-harness/wasm-module-builder.js:
1565         (Binary.prototype.emit_section):
1566         (Binary):
1567         (WasmFunctionBuilder.prototype.addBody):
1568         (WasmFunctionBuilder.prototype.end):
1569         (WasmFunctionBuilder):
1570         (WasmModuleBuilder.prototype.stringToBytes):
1571         (WasmModuleBuilder.prototype.addCustomSection):
1572         (WasmModuleBuilder.prototype.addFunctionTableInit):
1573         (WasmModuleBuilder.prototype.appendToTable):
1574         (WasmModuleBuilder.prototype.toArray):
1575         (WasmModuleBuilder.prototype.toBuffer):
1576         (WasmModuleBuilder.prototype.instantiate):
1577         (WasmModuleBuilder):
1578         * wasm/spec-tests/address.wast.js:
1579         * wasm/spec-tests/align.wast.js: Added.
1580         * wasm/spec-tests/binary.wast.js:
1581         * wasm/spec-tests/block.wast.js:
1582         * wasm/spec-tests/br.wast.js:
1583         * wasm/spec-tests/br_if.wast.js:
1584         * wasm/spec-tests/br_table.wast.js:
1585         * wasm/spec-tests/call.wast.js:
1586         * wasm/spec-tests/call_indirect.wast.js:
1587         * wasm/spec-tests/comments.wast.js:
1588         * wasm/spec-tests/const.wast.js: Added.
1589         * wasm/spec-tests/conversions.wast.js: Added.
1590         * wasm/spec-tests/custom_section.wast.js:
1591         * wasm/spec-tests/exports.wast.js:
1592         * wasm/spec-tests/f32.wast.js: Added.
1593         * wasm/spec-tests/f64.wast.js: Added.
1594         * wasm/spec-tests/fac.wast.js:
1595         * wasm/spec-tests/float_exprs.wast.js: Added.
1596         * wasm/spec-tests/float_misc.wast.js: Added.
1597         * wasm/spec-tests/func.wast.js:
1598         * wasm/spec-tests/globals.wast.js:
1599         * wasm/spec-tests/if.wast.js:
1600         * wasm/spec-tests/imports.wast.js:
1601         * wasm/spec-tests/inline-module.wast.js: Added.
1602         * wasm/spec-tests/jsapi.js:
1603         (testJSAPI.test):
1604         (testJSAPI):
1605         * wasm/spec-tests/labels.wast.js:
1606         * wasm/spec-tests/loop.wast.js:
1607         * wasm/spec-tests/memory.wast.js:
1608         * wasm/spec-tests/memory_trap.wast.js: Added.
1609         * wasm/spec-tests/names.wast.js:
1610         * wasm/spec-tests/nop.wast.js:
1611         * wasm/spec-tests/return.wast.js:
1612         * wasm/spec-tests/stack.wast.js:
1613         * wasm/spec-tests/token.wast.js: Added.
1614         * wasm/spec-tests/type.wast.js: Added.
1615         * wasm/spec-tests/typecheck.wast.js:
1616         * wasm/spec-tests/unreachable.wast.js:
1617         * wasm/spec-tests/unreached-invalid.wast.js:
1618         * wasm/spec-tests/unwind.wast.js:
1619         * wasm/spec-tests/utf8-custom-section-id.wast.js: Added.
1620         * wasm/spec-tests/utf8-import-field.wast.js: Added.
1621         * wasm/spec-tests/utf8-import-module.wast.js: Added.
1622
1623 2017-06-13  Ryan Haddad  <ryanhaddad@apple.com>
1624
1625         Unreviewed JSC test gardening.
1626
1627         * stress/check-string-ident.js:
1628         * stress/new-largeish-contiguous-array-with-size.js:
1629
1630 2017-06-13  Michael Saboff  <msaboff@apple.com>
1631
1632         DFG doesn't properly handle a property that is change to read only in a prototype
1633         https://bugs.webkit.org/show_bug.cgi?id=173321
1634
1635         Reviewed by Filip Pizlo.
1636
1637         * ChakraCore.yaml: Renabled fieldopts/objtypespec-newobj-invalidation.1.js.
1638         * stress/regress-173321.js: Added new regression test.
1639         (shouldBe):
1640         (SimpleObject):
1641         (test):
1642
1643 2017-06-12  Saam Barati  <sbarati@apple.com>
1644
1645         Update test262 test expectation since r218082 makes new tests pass.
1646
1647         * test262.yaml:
1648
1649 2017-06-12  Saam Barati  <sbarati@apple.com>
1650
1651         We should not claim that SpecEmpty is filtered out of cell checks on 64 bit platforms
1652         https://bugs.webkit.org/show_bug.cgi?id=172957
1653         <rdar://problem/32602704>
1654
1655         Reviewed by Filip Pizlo.
1656
1657         * stress/spec-empty-flows-through-cell-checks.js: Added.
1658         (A):
1659         (B):
1660         (i.catch):
1661
1662 2017-06-12  Oleksandr Skachkov  <gskachkov@gmail.com>
1663
1664         We incorrectly allow escaped characters in keyword tokens
1665         https://bugs.webkit.org/show_bug.cgi?id=171310
1666
1667         Reviewed by Yusuke Suzuki.
1668
1669         * stress/destructuring-assignment-syntax.js:
1670         * stress/error-messages-for-in-operator-should-not-crash.js:
1671         (catch):
1672         * stress/reserved-word-with-escape.js:
1673         (testSyntaxError.String.raw.v):
1674         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
1675         (testSyntaxError.String.raw.a):
1676         * JSTests/ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc:
1677
1678 2017-06-09  Yusuke Suzuki  <utatane.tea@gmail.com>
1679
1680         [DFG] Add ArrayIndexOf intrinsic
1681         https://bugs.webkit.org/show_bug.cgi?id=172421
1682
1683         Reviewed by Saam Barati.
1684
1685         * stress/array-indexof-array-prototype-change.js: Added.
1686         (shouldBe):
1687         (indexOfInt32):
1688         * stress/array-indexof-have-a-bad-time-getter.js: Added.
1689         (shouldBe):
1690         (indexOfInt32):
1691         * stress/array-indexof-have-a-bad-time.js: Added.
1692         (shouldBe):
1693         (indexOfInt32):
1694         * stress/array-indexof-hole-with-prototype.js: Added.
1695         (shouldBe):
1696         (indexOf):
1697         * stress/array-indexof-hole.js: Added.
1698         (shouldBe):
1699         (indexOf):
1700         * stress/array-indexof-index.js: Added.
1701         (shouldBe):
1702         (indexOfInt32):
1703         (indexOfDouble):
1704         (indexOfString):
1705         (indexOfObject):
1706         (indexOfValue):
1707         * stress/array-indexof-negative-index.js: Added.
1708         (shouldBe):
1709         (indexOfInt32):
1710         (indexOfDouble):
1711         (indexOfString):
1712         (indexOfObject):
1713         (indexOfValue):
1714         * stress/array-indexof-non-int32-start-index.js: Added.
1715         (shouldBe):
1716         (indexOf):
1717         (object.valueOf):
1718         * stress/array-indexof-object-prototype-change.js: Added.
1719         (shouldBe):
1720         (indexOfInt32):
1721         * stress/array-indexof-object.js: Added.
1722         (shouldBe):
1723         (indexOf):
1724         * stress/array-indexof-original-array.js: Added.
1725         (shouldBe):
1726         (indexOfInt32):
1727         * stress/array-indexof-string.js: Added.
1728         (shouldBe):
1729         (indexOf):
1730         * stress/array-indexof-structure-change-convert.js: Added.
1731         (shouldBe):
1732         (indexOf):
1733         * stress/array-indexof-structure-change.js: Added.
1734         (shouldBe):
1735         (indexOf):
1736         * stress/array-indexof.js: Added.
1737         (shouldBe):
1738         (indexOf):
1739
1740 2017-06-11  Keith Miller  <keith_miller@apple.com>
1741
1742         TypedArray constructor with string shouldn't throw
1743         https://bugs.webkit.org/show_bug.cgi?id=173181
1744
1745         Reviewed by JF Bastien.
1746
1747         We should be coercing primitive arguments to numbers in the various
1748         TypedArray constructors.
1749
1750         * stress/typedarray-constructor.js:
1751
1752 2017-06-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1753
1754         Unreviewed, update test results part 3
1755         https://bugs.webkit.org/show_bug.cgi?id=173227
1756
1757         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
1758
1759 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1760
1761         Unreviewed, update test results part 2
1762         https://bugs.webkit.org/show_bug.cgi?id=173227
1763
1764         * test262.yaml:
1765
1766 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1767
1768         Unreviewed, update test results
1769         https://bugs.webkit.org/show_bug.cgi?id=173227
1770
1771         * microbenchmarks/string-prototype-search-observable-side-effects.js:
1772         * test262.yaml:
1773
1774 2017-06-10  Yusuke Suzuki  <utatane.tea@gmail.com>
1775
1776         [JSC] Update RegExp.prototype.[@@search]] implementation according to the latest spec
1777         https://bugs.webkit.org/show_bug.cgi?id=173227
1778
1779         Reviewed by Mark Lam.
1780
1781         Update the test.
1782
1783         * es6/Proxy_internal_get_calls_RegExp.prototype[Symbol.search].js:
1784
1785 2017-06-08  Keith Miller  <keith_miller@apple.com>
1786
1787         WebAssembly: We should only create wrappers for functions that can be exported
1788         https://bugs.webkit.org/show_bug.cgi?id=173088
1789
1790         Reviewed by Saam Barati.
1791
1792         Remove a bunch of old tests that are actually duplicates of the spec-tests and rely
1793         on the old testWasmModuleFunctions api, which has been removed.
1794
1795         * wasm/function-tests/copysign.js: Removed.
1796         * wasm/function-tests/ctz.js: Removed.
1797         * wasm/function-tests/drop.js: Removed.
1798         * wasm/function-tests/dumb-eq-if-then-else.js: Removed.
1799         * wasm/function-tests/dumb-less-than-fallthrough.js: Removed.
1800         * wasm/function-tests/dumb-less-than-ite.js: Removed.
1801         * wasm/function-tests/eqz.js: Removed.
1802         * wasm/function-tests/i32-trunc-s-f32.js: Removed.
1803         * wasm/function-tests/i32-trunc-s-f64.js: Removed.
1804         * wasm/function-tests/i32-trunc-u-f32.js: Removed.
1805         * wasm/function-tests/i32-trunc-u-f64.js: Removed.
1806         * wasm/function-tests/i64-trunc-s-f32.js: Removed.
1807         * wasm/function-tests/i64-trunc-s-f64.js: Removed.
1808         * wasm/function-tests/i64-trunc-u-f32.js: Removed.
1809         * wasm/function-tests/i64-trunc-u-f64.js: Removed.
1810         * wasm/function-tests/if-then-else-fallthrough.js: Removed.
1811         * wasm/function-tests/if-then-fallthrough.js: Removed.
1812         * wasm/function-tests/int-to-floating-point.js: Removed.
1813         * wasm/function-tests/loop-mult.js:
1814         * wasm/function-tests/loop-sum.js:
1815         * wasm/function-tests/max.js: Removed.
1816         * wasm/function-tests/min.js: Removed.
1817         * wasm/function-tests/nearest.js: Removed.
1818         * wasm/function-tests/nop.js: Removed.
1819         * wasm/function-tests/popcnt.js: Removed.
1820         * wasm/function-tests/ret5.js:
1821         * wasm/function-tests/select.js: Removed.
1822         * wasm/function-tests/tee-local.js: Removed.
1823         * wasm/function-tests/trunc.js: Removed.
1824
1825 2017-06-07  JF Bastien  <jfbastien@apple.com>
1826
1827         WebAssembly: test imports and exports with 16-bit characters
1828         https://bugs.webkit.org/show_bug.cgi?id=165977
1829         <rdar://problem/29760130>
1830
1831         Reviewed by Saam Barati.
1832
1833         The output for import failure was improved, so many tests need to
1834         be updated here. Only one has new tests as noted below.
1835
1836         * wasm/function-tests/memory-import-and-grow.js:
1837         * wasm/js-api/Instance.imports.exports.unicode.js: Added. Main new test.
1838         (idxModule):
1839         * wasm/js-api/global-error.js:
1840         (new.Number):
1841         (assert.throws):
1842         * wasm/js-api/table.js:
1843         (assert.throws):
1844         (new.WebAssembly.Table):
1845         * wasm/js-api/test_memory.js:
1846         (test):
1847         * wasm/js-api/wasm-to-wasm-bad-signature.js:
1848         (BadSignatureDropStartParams.):
1849         (BadSignatureDropStartParams):
1850         (BadSignatureDropEndParams.):
1851         (BadSignatureSwapParam.):
1852         (BadSignatureRet.):
1853         * wasm/js-api/web-assembly-instantiate.js:
1854         (assert.asyncTest.async.test):
1855         (assert.asyncTest):
1856         * wasm/js-api/wrapper-function.js:
1857         (return.new.WebAssembly.Module):
1858
1859 2017-06-07  Mark Lam  <mark.lam@apple.com>
1860
1861         Restrict the regress-173035.js test to only run on Darwin x86-64.
1862         https://bugs.webkit.org/show_bug.cgi?id=173075
1863
1864         Reviewed by Saam Barati.
1865
1866         This is because the 32-bit x86 build will fail to mmap the 0x3f900000 bytes that
1867         this test will require to succeed.  Here's an example of this failure:
1868         https://build.webkit.org/builders/Apple%20Sierra%2032-bit%20JSC%20%28BuildAndTest%29/builds/866/steps/webkit-32bit-jsc-test/logs/stdio
1869
1870         Since the issue is due to allocation of a very large amount of memory, the test
1871         will probably fail on iOS and other platforms as well.  Hence, we should just
1872         skip this test for any platforms that is not Darwin x86-64.
1873
1874         * stress/regress-173035.js:
1875
1876 2017-06-07  Mark Lam  <mark.lam@apple.com>
1877
1878         ASSERTION failure: !masqueradesAsUndefinedWatchpointIsStillValid() || !isKnownCell(operand.node())
1879         https://bugs.webkit.org/show_bug.cgi?id=168587
1880
1881         Not reviewed.
1882
1883         Unskipping the test because the issue has been fixed in https://bugs.webkit.org/show_bug.cgi?id=172673.
1884
1885         * stress/test-finally.js:
1886
1887 2017-06-06  Mark Lam  <mark.lam@apple.com>
1888
1889         Contiguous storage butterfly length should not exceed MAX_STORAGE_VECTOR_LENGTH.
1890         https://bugs.webkit.org/show_bug.cgi?id=173035
1891         <rdar://problem/32554593>
1892
1893         Reviewed by Geoffrey Garen and Filip Pizlo.
1894
1895         * stress/regress-173035.js: Added.
1896
1897 2017-06-06  Saam Barati  <sbarati@apple.com>
1898
1899         Make sure we restore SP when doing calls that could be to JS
1900         https://bugs.webkit.org/show_bug.cgi?id=172946
1901         <rdar://problem/32579026>
1902
1903         Reviewed by JF Bastien.
1904
1905         * wasm/function-tests/many-args-tail-call-sp-restored.js: Added.
1906         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f1):
1907         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.end):
1908         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.f2):
1909         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.let.instance.new.WebAssembly.Instance.new.WebAssembly.Module.builder.WebAssembly):
1910
1911 2017-06-06  Joseph Pecoraro  <pecoraro@apple.com>
1912
1913         Unreviewed rollout r217807. Caused a test to crash.
1914
1915         * heapProfiler/class-names.js: Removed.
1916         * heapProfiler/driver/driver.js:
1917         (CheapHeapSnapshotNode):
1918         (CheapHeapSnapshot):
1919         (createCheapHeapSnapshot):
1920         (HeapSnapshot):
1921         (createHeapSnapshot):
1922         * typeProfiler/inheritance.js:
1923         (wrapper.A):
1924         (wrapper.B):
1925         (wrapper.C):
1926         (wrapper):
1927
1928 2017-06-06  Filip Pizlo  <fpizlo@apple.com>
1929
1930         index out of bound in bytecodebasicblock
1931         https://bugs.webkit.org/show_bug.cgi?id=172963
1932
1933         Reviewed by Saam Barati and Mark Lam.
1934
1935         * stress/dfg-call-class-constructor.js: Added.
1936         (Foo):
1937         (i.catch):
1938
1939 2017-06-05  Joseph Pecoraro  <pecoraro@apple.com>
1940
1941         Web Inspector: Improve ES6 Class instances in Heap Snapshot instances view
1942         https://bugs.webkit.org/show_bug.cgi?id=172848
1943         <rdar://problem/25709212>
1944
1945         Reviewed by Saam Barati.
1946
1947         * typeProfiler/inheritance.js:
1948         Rewrite the test slightly for clarity. The hoisting was confusing.
1949
1950         * heapProfiler/class-names.js: Added.
1951         (MyES5Class):
1952         (MyES6Class):
1953         (MyES6Subclass):
1954         Test object types and improved class names.
1955
1956         * heapProfiler/driver/driver.js:
1957         (CheapHeapSnapshotNode):
1958         (CheapHeapSnapshot):
1959         (createCheapHeapSnapshot):
1960         (HeapSnapshot):
1961         (createHeapSnapshot):
1962         Update snapshot parsing from version 1 to version 2.
1963
1964 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1965
1966         ASSERTION FAILED: "We should only declare a function as a lexically scoped variable in scopes where var declarations aren't allowed. ..." for function redeclaration with async function module export
1967         https://bugs.webkit.org/show_bug.cgi?id=168844
1968
1969         Reviewed by Saam Barati.
1970
1971         * modules/async-function-export.js: Added.
1972         (f):
1973         (export.async.f):
1974
1975 2017-06-02  Yusuke Suzuki  <utatane.tea@gmail.com>
1976
1977         ES2015 modules - Export default function hoisting
1978         https://bugs.webkit.org/show_bug.cgi?id=170174
1979
1980         Reviewed by Saam Barati.
1981
1982         This issue itself is solved by fixing function declaration hoisting rules.
1983         This patch just adds the specific test to modules tests to ensure the bug
1984         is fixed.
1985
1986         * modules/export-default-function-hoisting.js: Added.
1987         * modules/export-default-function-hoisting/cappuccino.js: Added.
1988         (import.drinkCocoa.from.string_appeared_here.export.default.drinkCappuccino):
1989         * modules/export-default-function-hoisting/cocoa.js: Added.
1990         (export.default.drinkCocoa):
1991
1992 2017-06-01  Oleksandr Skachkov  <gskachkov@gmail.com>
1993
1994         Class Proxy can't be extended
1995         https://bugs.webkit.org/show_bug.cgi?id=169040
1996
1997         Reviewed by Saam Barati.
1998
1999         Adding tests that check correctness of Proxy to ES6 `class`
2000         Bug is already fixed in https://bugs.webkit.org/show_bug.cgi?id=164849
2001
2002         * stress/proxy-class.js: Added.
2003         (assert):
2004         (throw.new.Error.SuperClass):
2005         (throw.new.Error.A):
2006         (throw.new.Error):
2007
2008 2017-05-31  Yusuke Suzuki  <utatane.tea@gmail.com>
2009
2010         [JSC] Implement String.prototype.concat in JS builtins
2011         https://bugs.webkit.org/show_bug.cgi?id=172798
2012
2013         Reviewed by Sam Weinig.
2014
2015         * microbenchmarks/string-concat-convert.js: Added.
2016         (test):
2017         * microbenchmarks/string-concat-long-convert.js: Added.
2018         (test):
2019         * microbenchmarks/string-concat-long.js: Added.
2020         (test):
2021         * microbenchmarks/string-concat.js: Added.
2022         (test):
2023
2024 2017-05-31  Oleksandr Skachkov  <gskachkov@gmail.com>
2025
2026         Rolling out: Prevent async methods named 'function'
2027         https://bugs.webkit.org/show_bug.cgi?id=172776
2028
2029         Reviewed by Mark Lam.
2030
2031         * stress/async-await-syntax.js:
2032         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2033         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2034         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2035         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2036         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2037
2038 2017-05-31  Ryan Haddad  <ryanhaddad@apple.com>
2039
2040         Skip flaky JSC test stress/test-finally.js
2041         https://bugs.webkit.org/show_bug.cgi?id=168587
2042
2043         Unreviewed test gardening.
2044
2045         * stress/test-finally.js:
2046
2047 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2048
2049         Prevent async methods named 'function' in Object literal
2050         https://bugs.webkit.org/show_bug.cgi?id=172660
2051
2052         Reviewed by Saam Barati.
2053
2054         * stress/async-await-syntax.js:
2055         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2056
2057 2017-05-30  Oleksandr Skachkov  <gskachkov@gmail.com>
2058
2059         ASSERTION FAILED: generator.isConstructor() || generator.derivedContextType() == DerivedContextType::DerivedConstructorContext
2060         https://bugs.webkit.org/show_bug.cgi?id=171274
2061
2062         Reviewed by Saam Barati.
2063
2064         * stress/async-arrow-functions-lexical-binding-in-class.js:
2065         (shouldBeAsync):
2066         (shouldBeAsyncAndStoreBind):
2067         (promise.new.Promise):
2068         (ChildClass4):
2069         (ChildClass4.prototype.classValue):
2070         (ChildClass4.prototype.get classProperty):
2071         * stress/async-arrow-functions-lexical-super-binding.js:
2072         (A):
2073         (const.childA1.new.prototype.var.f.async):
2074         (const.childA1.new.var):
2075         (const.childA1.new):
2076         (const.childA2.new.prototype.var.f.async):
2077         (const.childA2.new.var):
2078         (const.childA2.new):
2079         (const.childA3.new.prototype.var.f.async):
2080         (const.childA3.new.var):
2081         (const.childA3.new):
2082         (try.childA4.new.prototype.var.f.async):
2083         (try.childA4.new.var):
2084         (try.childA4.new):
2085         (catch):
2086         (const.childA5.new.prototype.var.f.async):
2087         (const.childA5.new.var):
2088         (const.childA5.new):
2089         (checkClass):
2090         (checkClass.new.prototype.var.f.async):
2091         (checkClass.new.var):
2092         (checkClass.new):
2093         (checkClass.new.prototype.method):
2094         (checkClass.new.prototype.prop):
2095
2096 2017-05-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2097
2098         [JSC] Map and Set constructors should have fast path for cloning
2099         https://bugs.webkit.org/show_bug.cgi?id=172413
2100
2101         Reviewed by Saam Barati.
2102
2103         * stress/map-clone-instance-iterator-change.js: Added.
2104         (shouldBe):
2105         (map.Symbol.iterator):
2106         * stress/map-clone-iterator-change.js: Added.
2107         (shouldBe):
2108         (Map.prototype.Symbol.iterator):
2109         * stress/map-clone-next-change.js: Added.
2110         (shouldBe):
2111         (map.Symbol.iterator.__proto__.next):
2112         * stress/map-clone.js: Added.
2113         (shouldBe):
2114         (Map.prototype):
2115         * stress/map-inherit-set.js: Added.
2116         (shouldBe):
2117         (DerivedMap):
2118         (set for):
2119         * stress/set-clone-instance-iterator-change.js: Added.
2120         (shouldBe):
2121         (set Symbol.iterator):
2122         * stress/set-clone-iterator-change.js: Added.
2123         (shouldBe):
2124         (set Set.prototype.Symbol.iterator):
2125         * stress/set-clone-next-change.js: Added.
2126         (shouldBe):
2127         (set Symbol.iterator.__proto__.next):
2128         * stress/set-clone.js: Added.
2129         (shouldBe):
2130         (set Set.prototype.add):
2131         * stress/set-inherit-add.js: Added.
2132         (shouldBe):
2133         (DerivedSet.set add):
2134
2135 2017-05-26  Ryan Haddad  <ryanhaddad@apple.com>
2136
2137         Unreviewed, rolling out r217458.
2138
2139         This change caused 55 JSC test failures.
2140
2141         Reverted changeset:
2142
2143         "Date should use historical data if it's available."
2144         https://bugs.webkit.org/show_bug.cgi?id=172592
2145         http://trac.webkit.org/changeset/217458
2146
2147 2017-05-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2148
2149         Give ModuleProgram the same treatment that we did for ProgramCode in bug#167725
2150         https://bugs.webkit.org/show_bug.cgi?id=167805
2151
2152         Reviewed by Saam Barati.
2153
2154         * modules/module-jit-reachability.js: Added.
2155
2156 2017-05-26  Oleksandr Skachkov  <gskachkov@gmail.com>
2157
2158         Prevent async methods named 'function'
2159         https://bugs.webkit.org/show_bug.cgi?id=172598
2160
2161         Reviewed by Mark Lam.
2162
2163         * stress/async-await-syntax.js:
2164         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntax):
2165         (testTopLevelAsyncAwaitSyntaxSloppyMode):
2166         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode.testSyntax):
2167         (prototype.testTopLevelAsyncAwaitSyntaxStrictMode):
2168         (testTopLevelAsyncAwaitSyntaxSloppyMode.testSyntaxError):
2169
2170 2017-05-25  Keith Miller  <keith_miller@apple.com>
2171
2172         Date should use historical data if it's available.
2173         https://bugs.webkit.org/show_bug.cgi?id=172592
2174
2175         Reviewed by Mark Lam.
2176
2177         Remove parts of the date tests that rely on the absence of
2178         historical data in Date.
2179
2180         * mozilla/ecma/Date/15.9.5.31-1.js:
2181         (getTestCases):
2182         * mozilla/ecma/Date/15.9.5.35-1.js:
2183         (getTestCases):
2184
2185 2017-05-25  Saam Barati  <sbarati@apple.com>
2186
2187         Our for-in optimization in the bytecode generator does its static analysis incorrectly
2188         https://bugs.webkit.org/show_bug.cgi?id=172532
2189         <rdar://problem/32369452>
2190
2191         Reviewed by Mark Lam.
2192
2193         * stress/for-in-invalidation-for-any-write.js: Added.
2194         (assert):
2195         (test):
2196         (test.i):
2197
2198 2017-05-25  Mark Lam  <mark.lam@apple.com>
2199
2200         ObjectToStringAdaptiveInferredPropertyValueWatchpoint should not reinstall itself nor handleFire if it's dying shortly.
2201         https://bugs.webkit.org/show_bug.cgi?id=172548
2202         <rdar://problem/31458393>
2203
2204         Reviewed by Filip Pizlo.
2205
2206         * stress/regress-172548.patch: Added.
2207
2208 2017-05-23  Saam Barati  <sbarati@apple.com>
2209
2210         We should not mmap zero bytes for a memory in Wasm
2211         https://bugs.webkit.org/show_bug.cgi?id=172528
2212         <rdar://problem/32257076>
2213
2214         Reviewed by Mark Lam.
2215
2216         * wasm/js-api/dont-mmap-zero-byte-memory.js: Added.
2217         (testMems):
2218
2219 2017-05-23  Saam Barati  <sbarati@apple.com>
2220
2221         CFGSimplificationPhase should not merge a block with itself
2222         https://bugs.webkit.org/show_bug.cgi?id=172508
2223         <rdar://problem/28424006>
2224
2225         Reviewed by Keith Miller.
2226
2227         * stress/dont-crash-in-cfg-simplification.js: Added.
2228         (bar):
2229         (baz):
2230         (foo):
2231
2232 2017-05-20  Yusuke Suzuki  <utatane.tea@gmail.com>
2233
2234         [FTL] Support GetByVal with ArrayStorage and SlowPutArrayStorage
2235         https://bugs.webkit.org/show_bug.cgi?id=172216
2236
2237         Reviewed by Saam Barati.
2238
2239         * stress/array-storage-get-by-val.js: Added.
2240         (shouldBe):
2241         (testOutOfBound):
2242         (testInBound):
2243         (testSlowPutOutOfBound):
2244         (testSlowPutInBound):
2245
2246 2017-05-21  Yusuke Suzuki  <utatane.tea@gmail.com>
2247
2248         Unreviewed, fix commented out tests
2249         https://bugs.webkit.org/show_bug.cgi?id=172225
2250
2251         * stress/get-by-val-string.js:
2252         (object.43):
2253         (Hello):
2254         (Hello.prototype.get 42):
2255         (Hello.prototype.43):
2256         (Derived):
2257         (shouldBe):
2258         (throw.new.Error): Deleted.
2259
2260 2017-05-21  Saam Barati  <sbarati@apple.com>
2261
2262         We incorrectly throw a syntax error when declaring a top level for-loop iteration variable the same as a parameter
2263         https://bugs.webkit.org/show_bug.cgi?id=171041
2264         <rdar://problem/32082516>
2265
2266         Reviewed by Yusuke Suzuki.
2267
2268         * stress/lexical-scoping-for-loop.js: Added.
2269         (assert):
2270         (test1):
2271         (test2):
2272         (test3):
2273         (test4):
2274         (test5):
2275         (test6):
2276         (let.test7):
2277         (let.test8):
2278         (let.test9):
2279         (let.test10):
2280         (let.test11):
2281         (let.test12):
2282
2283 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2284
2285         [JSC] Make get_by_val & string "499" to number 499
2286         https://bugs.webkit.org/show_bug.cgi?id=172225
2287
2288         Reviewed by Saam Barati.
2289
2290         * stress/get-by-val-string.js: Added.
2291         (shouldBe):
2292         (shouldThrow):
2293         (object.43):
2294         (Hello):
2295         (Hello.prototype.get 42):
2296         (Hello.prototype.43):
2297         (Derived):
2298
2299 2017-05-19  Mark Lam  <mark.lam@apple.com>
2300
2301         [Re-landing] DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2302         https://bugs.webkit.org/show_bug.cgi?id=172383
2303         <rdar://problem/31418651>
2304
2305         Reviewed by Filip Pizlo.
2306
2307         * stress/regress-172383.js: Added.
2308
2309 2017-05-19  Ryan Haddad  <ryanhaddad@apple.com>
2310
2311         Unreviewed, rolling out r217156.
2312
2313         This change broke the iOS build.
2314
2315         Reverted changeset:
2316
2317         "DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring
2318         result registers."
2319         https://bugs.webkit.org/show_bug.cgi?id=172383
2320         http://trac.webkit.org/changeset/217156
2321
2322 2017-05-19  Mark Lam  <mark.lam@apple.com>
2323
2324         Add missing exception check.
2325         https://bugs.webkit.org/show_bug.cgi?id=172346
2326         <rdar://problem/32289640>
2327
2328         Reviewed by Geoffrey Garen.
2329
2330         * stress/regress-172346.js: Added.
2331
2332 2017-05-19  Mark Lam  <mark.lam@apple.com>
2333
2334         DFG::SpeculativeJIT::pickCanTrample() is wrongly ignoring result registers.
2335         https://bugs.webkit.org/show_bug.cgi?id=172383
2336         <rdar://problem/31418651>
2337
2338         Reviewed by Filip Pizlo.
2339
2340         * stress/regress-172383.js: Added.
2341
2342 2017-05-19  Filip Pizlo  <fpizlo@apple.com>
2343
2344         arrayProtoPrivateFuncConcatMemcpy needs to be down with firstArray being undecided
2345         https://bugs.webkit.org/show_bug.cgi?id=172369
2346
2347         Reviewed by Mark Lam.
2348
2349         * stress/undecided-concat.js: Added.
2350
2351 2017-05-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2352
2353         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2354         https://bugs.webkit.org/show_bug.cgi?id=172098
2355
2356         Reviewed by Saam Barati.
2357
2358         * stress/check-sub-class.js: Added.
2359         (shouldBe):
2360         (shouldThrow):
2361         (calling):
2362         (array.forEach):
2363         (i.array.forEach):
2364
2365 2017-05-18  JF Bastien  <jfbastien@apple.com>
2366
2367         WebAssembly: exports is a getter
2368         https://bugs.webkit.org/show_bug.cgi?id=172129
2369
2370         Reviewed by Saam Barati.
2371
2372         Update test to reflect new semantics.
2373
2374         * wasm/js-api/test_basic_api.js:
2375         (const.c.in.constructorProperties.switch):
2376
2377 2017-05-18  Saam Barati  <sbarati@apple.com>
2378
2379         Proxy's [[Get]] passes incorrect receiver
2380         https://bugs.webkit.org/show_bug.cgi?id=164849
2381         <rdar://problem/31767058>
2382
2383         Reviewed by Yusuke Suzuki.
2384
2385         * stress/proxy-get-set-correct-receiver.js: Added.
2386         (assert):
2387         (test):
2388         (test.let.target.set prop):
2389         (test.let.target.get prop):
2390         (test.get let):
2391         * stress/proxy-set.js:
2392         (let.target.get x):
2393         * stress/reflect-set-proxy-set.js:
2394         (let.target.get x):
2395         * stress/reflect-set-receiver-proxy-set.js:
2396         (let.target.get x):
2397
2398 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2399
2400         Constructor calls set this too early
2401         https://bugs.webkit.org/show_bug.cgi?id=172302
2402
2403         Reviewed by Saam Barati.
2404         
2405         This tests all three kinds of constructs in BytecodeGenerator. All three were previously
2406         wrong.
2407
2408         * stress/construct-overwritten-variable.js: Added.
2409         (new.x.x):
2410         * stress/construct-spread-overwritten-variable-2.js: Added.
2411         (new.x.x):
2412         * stress/construct-spread-overwritten-variable.js: Added.
2413         (new.x.x):
2414
2415 2017-05-18  Saam Barati  <sbarati@apple.com>
2416
2417         WebAssembly: perform stack checks
2418         https://bugs.webkit.org/show_bug.cgi?id=165546
2419         <rdar://problem/29760307>
2420
2421         Reviewed by Filip Pizlo.
2422
2423         * wasm.yaml:
2424         * wasm/function-tests/factorial.js:
2425         * wasm/function-tests/float-sub.js:
2426         * wasm/function-tests/stack-overflow.js: Added.
2427         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2428         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
2429         (assertOverflows.makeInstance):
2430         (assertOverflows.makeInstance2):
2431         (assertOverflows.assertThrows):
2432         (assertOverflows):
2433         (assertThrows.test.makeSignature):
2434         (assertThrows.test.makeInstance):
2435         (assertThrows.test):
2436         (assertThrows):
2437
2438 2017-05-18  Keith Miller  <keith_miller@apple.com>
2439
2440         WebAssembly API: test with neutered inputs
2441         https://bugs.webkit.org/show_bug.cgi?id=163899
2442
2443         Reviewed by JF Bastien.
2444
2445         * wasm/js-api/neutered-inputs.js: Added.
2446         (const.testFunction):
2447         (const.testConstructor):
2448         * wasm/js-api/test_basic_api.js:
2449         (const.c.in.constructorProperties.switch):
2450
2451 2017-05-18  Filip Pizlo  <fpizlo@apple.com>
2452
2453         DFG inlining should be hardened for the no-result case
2454         https://bugs.webkit.org/show_bug.cgi?id=172290
2455
2456         Reviewed by Saam Barati.
2457
2458         * stress/array-constructor-no-result.js: Added.
2459         (foo):
2460         * stress/pow-no-result.js: Added.
2461         (foo):
2462
2463 2017-05-18  Commit Queue  <commit-queue@webkit.org>
2464
2465         Unreviewed, rolling out r217031, r217032, and r217037.
2466         https://bugs.webkit.org/show_bug.cgi?id=172293
2467
2468         cause linking errors in Windows (Requested by yusukesuzuki on
2469         #webkit).
2470
2471         Reverted changesets:
2472
2473         "[JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass"
2474         https://bugs.webkit.org/show_bug.cgi?id=172098
2475         http://trac.webkit.org/changeset/217031
2476
2477         "Unreviewed, rebaseline for newly added ClassInfo"
2478         https://bugs.webkit.org/show_bug.cgi?id=172098
2479         http://trac.webkit.org/changeset/217032
2480
2481         "Unreviewed, fix debug and non-JIT build"
2482         https://bugs.webkit.org/show_bug.cgi?id=172098
2483         http://trac.webkit.org/changeset/217037
2484
2485 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2486
2487         [JSC][DFG][DOMJIT] Extend CheckDOM to CheckSubClass
2488         https://bugs.webkit.org/show_bug.cgi?id=172098
2489
2490         Reviewed by Saam Barati.
2491
2492         * stress/check-sub-class.js: Added.
2493         (shouldBe):
2494         (shouldThrow):
2495         (calling):
2496         (array.forEach):
2497         (i.array.forEach):
2498
2499 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2500
2501         Unreviewed, address mlam's review feedback.
2502
2503         * stress/arguments-elimination-varargs-too-many-args-arg-count.js:
2504
2505 2017-05-17  Saam Barati  <sbarati@apple.com>
2506
2507         We don't do context switches for Wasm->Wasm call indirect
2508         https://bugs.webkit.org/show_bug.cgi?id=172188
2509         <rdar://problem/32231828>
2510
2511         Reviewed by Keith Miller.
2512
2513         * wasm/function-tests/context-switch.js: Added.
2514         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
2515         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance2):
2516         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.const.i2.makeInstance2):
2517         (makeInstance):
2518         (makeInstance2):
2519         (assert.eq.makeInstance):
2520         (assert.eq.makeInstance2):
2521         (assert.eq):
2522
2523 2017-05-17  Filip Pizlo  <fpizlo@apple.com>
2524
2525         JSC: Incorrect LoadVarargs handling in ArgumentsEliminationPhase::transform
2526         https://bugs.webkit.org/show_bug.cgi?id=172208
2527
2528         Reviewed by Saam Barati.
2529
2530         * stress/arguments-elimination-varargs-too-many-args-arg-count.js: Added.
2531         (foo):
2532         (bar):
2533         (baz):
2534
2535 2017-05-16  Yusuke Suzuki  <utatane.tea@gmail.com>
2536
2537         [DFG] Constant Folding Phase should convert MakeRope("", String) => Identity(String)
2538         https://bugs.webkit.org/show_bug.cgi?id=172115
2539
2540         Reviewed by Saam Barati.
2541
2542         * stress/constant-folding-should-fold-make-rope-with-empty-strings.js: Added.
2543         (shouldBe):
2544         (unknown):
2545         (readWord1):
2546         (readWord2):
2547         (readWord3):
2548         (readWord4):
2549
2550 2017-05-16  JF Bastien  <jfbastien@apple.com>
2551
2552         WebAssembly: add memory fuzzer
2553         https://bugs.webkit.org/show_bug.cgi?id=169976
2554         <rdar://problem/31965328>
2555
2556         Reviewed by Keith Miller.
2557
2558         * wasm/fuzz/memory.js: Added.
2559         (const.insert):
2560         (const.action.string_appeared_here):
2561         (const.performAction):
2562         (catch):
2563
2564 2017-05-16  JF Bastien  <jfbastien@apple.com>
2565
2566         WebAssembly: validate load / store alignment
2567         https://bugs.webkit.org/show_bug.cgi?id=168836
2568         <rdar://problem/31965349>
2569
2570         Reviewed by Keith Miller.
2571
2572         * wasm/WASM.js: fix regular expression greed
2573         * wasm/function-tests/memory-alignment.js: Added.
2574         (const.op.of.WASM.opcodes):
2575         * wasm/wasm.json: fix formatting
2576
2577 2017-05-15  Mark Lam  <mark.lam@apple.com>
2578
2579         Rolling out r214038 and r213697: Crashes when using computed properties with rest destructuring and object spread.
2580         https://bugs.webkit.org/show_bug.cgi?id=172147
2581
2582         Rubber-stamped by Saam Barati.
2583
2584         * stress/object-rest-deconstruct.js: Removed.
2585         * stress/object-spread.js: Removed.
2586
2587 2017-05-11  JF Bastien  <jfbastien@apple.com>
2588
2589         WebAssembly: stop supporting 0xD
2590         https://bugs.webkit.org/show_bug.cgi?id=168788
2591         <rdar://problem/31880922>
2592
2593         Reviewed by Saam Barati.
2594
2595         Test that only version 1 is supported.
2596
2597         * wasm/js-api/version.js: Added.
2598
2599 2017-05-10  JF Bastien  <jfbastien@apple.com>
2600
2601         WebAssemby: builder doesn't do Memory section maximum correctly
2602         https://bugs.webkit.org/show_bug.cgi?id=171931
2603
2604         Reviewed by Keith Miller.
2605
2606         * wasm/Builder.js:
2607         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
2608         * wasm/Builder_WebAssemblyBinary.js:
2609         (const.emitters.Memory):
2610         * wasm/function-tests/memory-grow-invalid.js: Added.
2611
2612 2017-05-10  JF Bastien  <jfbastien@apple.com>
2613
2614         WebAssembly: support name section
2615         https://bugs.webkit.org/show_bug.cgi?id=171263
2616
2617         Reviewed by Keith Miller.
2618
2619         * wasm/function-tests/nameSection.js: Added.
2620         (const.compile):
2621         * wasm/function-tests/nameSection.wasm: Added.
2622         * wasm/function-tests/stack-trace.js: Update format
2623
2624 2017-05-10  Filip Pizlo  <fpizlo@apple.com>
2625
2626         Null pointer dereference in WTF::RefPtr<WTF::StringImpl>::operator!() under slow_path_get_direct_pname
2627         https://bugs.webkit.org/show_bug.cgi?id=171801
2628
2629         Reviewed by Michael Saboff.
2630         
2631         These tests used to crash. The prefix and postfix tests cover different paths, except
2632         postfix-ignored goes down the same path as prefix due to an optimization.
2633
2634         * stress/for-in-postfix-ignored-index.js: Added.
2635         (foo):
2636         * stress/for-in-postfix-index.js: Added.
2637         (foo):
2638         * stress/for-in-prefix-index.js: Added.
2639         (foo):
2640
2641 2017-05-08  Mark Lam  <mark.lam@apple.com>
2642
2643         op_throw_static_error's use of its first operand should be reflected in DFG BytecodeUseDef as well.
2644         https://bugs.webkit.org/show_bug.cgi?id=171786
2645         <rdar://problem/32051023>
2646
2647         Reviewed by Saam Barati.
2648
2649         * stress/bug-171786.js: Added.
2650
2651 2017-05-06  Oleksandr Skachkov  <gskachkov@gmail.com>
2652
2653         [ES6] Arrow function. Issue in access to this after eval('super()') within constructor
2654         https://bugs.webkit.org/show_bug.cgi?id=171543
2655
2656         Reviewed by Saam Barati.
2657
2658         * stress/arrowfunction-lexical-bind-supercall-4.js:
2659         (J):
2660         (K):
2661
2662 2017-05-05  Saam Barati  <sbarati@apple.com>
2663
2664         putDirectIndex does not properly do defineOwnProperty
2665         https://bugs.webkit.org/show_bug.cgi?id=171591
2666         <rdar://problem/31735695>
2667
2668         Reviewed by Geoffrey Garen.
2669
2670         * stress/array-prototype-splice-making-typed-array.js:
2671         (test):
2672         * stress/array-species-config-array-constructor.js:
2673         (shouldThrow):
2674         (test):
2675         * stress/put-direct-index-broken-2.js: Added.
2676         (assert):
2677         (test):
2678         (makeLengthWritable):
2679         (set get restoreOldDesc):
2680         * stress/put-direct-index-broken.js: Added.
2681         (whatToTest):
2682         (tryRunning):
2683         (tryItOut):
2684         * stress/put-indexed-getter-setter.js: Added.
2685         (foo.X.prototype.set 7):
2686         (foo.X.prototype.get 7):
2687         (foo.X):
2688         (foo):
2689
2690 2017-05-04  Yusuke Suzuki  <utatane.tea@gmail.com>
2691
2692         [JSC] Math unary functions should be handled by DFG
2693         https://bugs.webkit.org/show_bug.cgi?id=171269
2694
2695         Reviewed by Saam Barati.
2696
2697         * stress/arith-acos-on-various-types.js: Added.
2698         (let.validInputTypedTestCases.validInputTestCases.map):
2699         (isIdentical):
2700         (opaqueACosNoArgument):
2701         (testNoArgument):
2702         (opaqueAllTypesACos):
2703         (testAllTypesCall):
2704         (testSingleTypeCall):
2705         (testConstant):
2706         (opaqueACosForSideEffects):
2707         (testSideEffect.let.testObject.valueOf):
2708         (testSideEffect):
2709         (opaqueACosForCSE):
2710         (testCSE.let.testObject.valueOf):
2711         (testCSE):
2712         (opaqueACosForDCE):
2713         (testDCE.let.testObject.valueOf):
2714         (testDCE):
2715         (testException.opaqueACosWithException):
2716         (testException):
2717         * stress/arith-acosh-on-various-types.js: Added.
2718         (let.validInputTypedTestCases.validInputTestCases.map):
2719         (isIdentical):
2720         (opaqueACoshNoArgument):
2721         (testNoArgument):
2722         (opaqueAllTypesACosh):
2723         (testAllTypesCall):
2724         (testSingleTypeCall):
2725         (testConstant):
2726         (opaqueACoshForSideEffects):
2727         (testSideEffect.let.testObject.valueOf):
2728         (testSideEffect):
2729         (opaqueACoshForCSE):
2730         (testCSE.let.testObject.valueOf):
2731         (testCSE):
2732         (opaqueACoshForDCE):
2733         (testDCE.let.testObject.valueOf):
2734         (testDCE):
2735         (testException.opaqueACoshWithException):
2736         (testException):
2737         * stress/arith-asin-on-various-types.js: Added.
2738         (let.validInputTypedTestCases.validInputTestCases.map):
2739         (isIdentical):
2740         (opaqueASinNoArgument):
2741         (testNoArgument):
2742         (opaqueAllTypesASin):
2743         (testAllTypesCall):
2744         (testSingleTypeCall):
2745         (testConstant):
2746         (opaqueASinForSideEffects):
2747         (testSideEffect.let.testObject.valueOf):
2748         (testSideEffect):
2749         (opaqueASinForCSE):
2750         (testCSE.let.testObject.valueOf):
2751         (testCSE):
2752         (opaqueASinForDCE):
2753         (testDCE.let.testObject.valueOf):
2754         (testDCE):
2755         (testException.opaqueASinWithException):
2756         (testException):
2757         * stress/arith-asinh-on-various-types.js: Added.
2758         (let.validInputTypedTestCases.validInputTestCases.map):
2759         (isIdentical):
2760         (opaqueASinhNoArgument):
2761         (testNoArgument):
2762         (opaqueAllTypesASinh):
2763         (testAllTypesCall):
2764         (testSingleTypeCall):
2765         (testConstant):
2766         (opaqueASinhForSideEffects):
2767         (testSideEffect.let.testObject.valueOf):
2768         (testSideEffect):
2769         (opaqueASinhForCSE):
2770         (testCSE.let.testObject.valueOf):
2771         (testCSE):
2772         (opaqueASinhForDCE):
2773         (testDCE.let.testObject.valueOf):
2774         (testDCE):
2775         (testException.opaqueASinhWithException):
2776         (testException):
2777         * stress/arith-atan-on-various-types.js: Added.
2778         (let.validInputTypedTestCases.validInputTestCases.map):
2779         (isIdentical):
2780         (opaqueATanNoArgument):
2781         (testNoArgument):
2782         (opaqueAllTypesATan):
2783         (testAllTypesCall):
2784         (testSingleTypeCall):
2785         (testConstant):
2786         (opaqueATanForSideEffects):
2787         (testSideEffect.let.testObject.valueOf):
2788         (testSideEffect):
2789         (opaqueATanForCSE):
2790         (testCSE.let.testObject.valueOf):
2791         (testCSE):
2792         (opaqueATanForDCE):
2793         (testDCE.let.testObject.valueOf):
2794         (testDCE):
2795         (testException.opaqueATanWithException):
2796         (testException):
2797         * stress/arith-atanh-on-various-types.js: Added.
2798         (let.validInputTypedTestCases.validInputTestCases.map):
2799         (isIdentical):
2800         (opaqueATanhNoArgument):
2801         (testNoArgument):
2802         (opaqueAllTypesATanh):
2803         (testAllTypesCall):
2804         (testSingleTypeCall):
2805         (testConstant):
2806         (opaqueATanhForSideEffects):
2807         (testSideEffect.let.testObject.valueOf):
2808         (testSideEffect):
2809         (opaqueATanhForCSE):
2810         (testCSE.let.testObject.valueOf):
2811         (testCSE):
2812         (opaqueATanhForDCE):
2813         (testDCE.let.testObject.valueOf):
2814         (testDCE):
2815         (testException.opaqueATanhWithException):
2816         (testException):
2817         * stress/arith-cbrt-on-various-types.js: Added.
2818         (let.validInputTypedTestCases.validInputTestCases.map):
2819         (isIdentical):
2820         (opaqueCbrtNoArgument):
2821         (testNoArgument):
2822         (opaqueAllTypesCbrt):
2823         (testAllTypesCall):
2824         (testSingleTypeCall):
2825         (testConstant):
2826         (opaqueCbrtForSideEffects):
2827         (testSideEffect.let.testObject.valueOf):
2828         (testSideEffect):
2829         (opaqueCbrtForCSE):
2830         (testCSE.let.testObject.valueOf):
2831         (testCSE):
2832         (opaqueCbrtForDCE):
2833         (testDCE.let.testObject.valueOf):
2834         (testDCE):
2835         (testException.opaqueCbrtWithException):
2836         (testException):
2837         * stress/arith-cosh-on-various-types.js: Added.
2838         (let.validInputTypedTestCases.validInputTestCases.map):
2839         (isIdentical):
2840         (opaqueCoshNoArgument):
2841         (testNoArgument):
2842         (opaqueAllTypesCosh):
2843         (testAllTypesCall):
2844         (testSingleTypeCall):
2845         (testConstant):
2846         (opaqueCoshForSideEffects):
2847         (testSideEffect.let.testObject.valueOf):
2848         (testSideEffect):
2849         (opaqueCoshForCSE):
2850         (testCSE.let.testObject.valueOf):
2851         (testCSE):
2852         (opaqueCoshForDCE):
2853         (testDCE.let.testObject.valueOf):
2854         (testDCE):
2855         (testException.opaqueCoshWithException):
2856         (testException):
2857         * stress/arith-expm1-on-various-types.js: Added.
2858         (let.validInputTypedTestCases.validInputTestCases.map):
2859         (isIdentical):
2860         (opaqueExpm1NoArgument):
2861         (testNoArgument):
2862         (opaqueAllTypesExpm1):
2863         (testAllTypesCall):
2864         (testSingleTypeCall):
2865         (testConstant):
2866         (opaqueExpm1ForSideEffects):
2867         (testSideEffect.let.testObject.valueOf):
2868         (testSideEffect):
2869         (opaqueExpm1ForCSE):
2870         (testCSE.let.testObject.valueOf):
2871         (testCSE):
2872         (opaqueExpm1ForDCE):
2873         (testDCE.let.testObject.valueOf):
2874         (testDCE):
2875         (testException.opaqueExpm1WithException):
2876         (testException):
2877         * stress/arith-log10-on-various-types.js: Added.
2878         (let.validInputTypedTestCases.validInputTestCases.map):
2879         (isIdentical):
2880         (opaqueLog10NoArgument):
2881         (testNoArgument):
2882         (opaqueAllTypesLog10):
2883         (testAllTypesCall):
2884         (testSingleTypeCall):
2885         (testConstant):
2886         (opaqueLog10ForSideEffects):
2887         (testSideEffect.let.testObject.valueOf):
2888         (testSideEffect):
2889         (opaqueLog10ForCSE):
2890         (testCSE.let.testObject.valueOf):
2891         (testCSE):
2892         (opaqueLog10ForDCE):
2893         (testDCE.let.testObject.valueOf):
2894         (testDCE):
2895         (testException.opaqueLog10WithException):
2896         (testException):
2897         * stress/arith-log2-on-various-types.js: Added.
2898         (let.validInputTypedTestCases.validInputTestCases.map):
2899         (isIdentical):
2900         (opaqueLog2NoArgument):
2901         (testNoArgument):
2902         (opaqueAllTypesLog2):
2903         (testAllTypesCall):
2904         (testSingleTypeCall):
2905         (testConstant):
2906         (opaqueLog2ForSideEffects):
2907         (testSideEffect.let.testObject.valueOf):
2908         (testSideEffect):
2909         (opaqueLog2ForCSE):
2910         (testCSE.let.testObject.valueOf):
2911         (testCSE):
2912         (opaqueLog2ForDCE):
2913         (testDCE.let.testObject.valueOf):
2914         (testDCE):
2915         (testException.opaqueLog2WithException):
2916         (testException):
2917         * stress/arith-sinh-on-various-types.js: Added.
2918         (let.validInputTypedTestCases.validInputTestCases.map):
2919         (isIdentical):
2920         (opaqueSinhNoArgument):
2921         (testNoArgument):
2922         (opaqueAllTypesSinh):
2923         (testAllTypesCall):
2924         (testSingleTypeCall):
2925         (testConstant):
2926         (opaqueSinhForSideEffects):
2927         (testSideEffect.let.testObject.valueOf):
2928         (testSideEffect):
2929         (opaqueSinhForCSE):
2930         (testCSE.let.testObject.valueOf):
2931         (testCSE):
2932         (opaqueSinhForDCE):
2933         (testDCE.let.testObject.valueOf):
2934         (testDCE):
2935         (testException.opaqueSinhWithException):
2936         (testException):
2937         * stress/arith-tan-on-various-types.js:
2938         (isIdentical):
2939         * stress/arith-tanh-on-various-types.js: Added.
2940         (let.validInputTypedTestCases.validInputTestCases.map):
2941         (isIdentical):
2942         (opaqueTanhNoArgument):
2943         (testNoArgument):
2944         (opaqueAllTypesTanh):
2945         (testAllTypesCall):
2946         (testSingleTypeCall):
2947         (testConstant):
2948         (opaqueTanhForSideEffects):
2949         (testSideEffect.let.testObject.valueOf):
2950         (testSideEffect):
2951         (opaqueTanhForCSE):
2952         (testCSE.let.testObject.valueOf):
2953         (testCSE):
2954         (opaqueTanhForDCE):
2955         (testDCE.let.testObject.valueOf):
2956         (testDCE):
2957         (testException.opaqueTanhWithException):
2958         (testException):
2959
2960 2017-05-03  Keith Miller  <keith_miller@apple.com>
2961
2962         Array.prototype.sort should also allow a null comparator
2963         https://bugs.webkit.org/show_bug.cgi?id=171621
2964
2965         Reviewed by Michael Saboff.
2966
2967         Add test to make it less likely we revert to the incompatable behavior.
2968         Also, fix now incorrect tests.
2969
2970         * ChakraCore/test/Array/array_sort.baseline-jsc:
2971         * stress/array-sort-bad-comparator.js:
2972         (test):
2973         * stress/sort-null-comparator.js: Added.
2974         (assertEq):
2975
2976 2017-05-03  Caitlin Potter  <caitp@igalia.com>
2977
2978         [JSC] remove unneeded asyncFunctionTests.yaml
2979         https://bugs.webkit.org/show_bug.cgi?id=171611
2980
2981         Reviewed by Yusuke Suzuki.
2982
2983         Async functions have shipped, and those tests are run as part of
2984         JSTests/stress and JSTests/test262.yaml. The file is no longer needed.
2985
2986         * asyncFunctionTests.yaml: Removed.
2987         * stress/async-await-long-loop.js:
2988         * stress/async-await-throw-loop.js:
2989
2990 2017-05-03  Keith Miller  <keith_miller@apple.com>
2991
2992         Different behaviour with the .sort(callback) method (unlike Firefox & Chrome)
2993         https://bugs.webkit.org/show_bug.cgi?id=47825
2994
2995         Reviewed by Saam Barati.
2996
2997         * stress/sorting-boolean-result-comparator.js: Added.
2998         (checkArray):
2999
3000 2017-05-02  David Kilzer  <ddkilzer@apple.com>
3001
3002         check-webkit-style should keep JavaScript test functions in sync
3003         <https://webkit.org/b/171424>
3004
3005         Reviewed by Joseph Pecoraro.
3006
3007         This change makes shouldBe(), shouldNotBe(), shouldNotThrow()
3008         and shouldThrow() in sync with other copies of these methods.
3009
3010         * stress/resources/standalone-pre.js:
3011         (shouldBe): Fix whitespace.  Prefix 'exception' and 'quiet'
3012         variables with underscore.
3013         (shouldThrow): Fix whitespace.
3014
3015 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3016
3017         We initialize functions too early in an eval
3018         https://bugs.webkit.org/show_bug.cgi?id=161099
3019
3020         Reviewed by Saam Barati.
3021
3022         * stress/eval-func-decl-with-let-const-class.js: Added.
3023
3024 2017-04-30  Oleksandr Skachkov  <gskachkov@gmail.com>
3025
3026         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3027         https://bugs.webkit.org/show_bug.cgi?id=163208
3028
3029         Reviewed by Saam Barati.
3030
3031         * stress/eval-func-decl-block-scoping-reassign.js: Added.
3032         (assert):
3033         (throw.new.Error.f):
3034         (throw.new.Error):
3035         * stress/eval-func-decl-block-with-remove.js: Added.
3036         (assert):
3037         (foo.boo):
3038         (foo):
3039         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3040         (assert):
3041         (assertThrow):
3042         (foo):
3043         (boo):
3044         (joo):
3045         (koo):
3046         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3047         (assert):
3048         (assertThrow):
3049         (foo):
3050         (boo):
3051         (hoo):
3052         (joo):
3053         (koo):
3054         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3055         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3056         (assert):
3057         (assertThrow):
3058         (foo):
3059         (boo):
3060         (goo):
3061         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3062         (assert):
3063         (assertThrow):
3064         (foo):
3065         (boo):
3066         (boo.let.val2):
3067         (boo.let.val3):
3068         * stress/eval-func-decl-in-frozen-global.js: Added.
3069         (assert):
3070         (assertThrow):
3071         (throw.new.Error):
3072         (Object.freeze):
3073         * stress/eval-func-decl-in-global-of-eval.js: Added.
3074         (assert):
3075         (assertThrow):
3076         (bar):
3077         (baz):
3078         (foobar):
3079         * stress/eval-func-decl-in-global.js: Added.
3080         (assert):
3081         (assertThrow):
3082         * stress/eval-func-decl-in-if.js: Added.
3083         (assert):
3084         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3085         (assert):
3086         (assertThrow):
3087         (foo):
3088         (boo):
3089         (foobar):
3090         (hoo):
3091         (joo):
3092         (koo):
3093         (loo):
3094         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3095         (assert):
3096         (assertThrow):
3097         (foo):
3098         (boo):
3099         (goo):
3100         * stress/variable-under-tdz-eval-tricky.js:
3101         (assert):
3102         * test262.yaml:
3103
3104 2017-04-27  Mark Lam  <mark.lam@apple.com>
3105
3106         Fix some RELEASE_ASSERT failures caused by OutOfMemoryErrors.
3107         https://bugs.webkit.org/show_bug.cgi?id=171404
3108         <rdar://problem/31876178>
3109
3110         Reviewed by Saam Barati.
3111
3112         * stress/js-fixed-array-out-of-memory.js: Added.
3113
3114 2017-04-27  David Kilzer  <ddkilzer@apple.com>
3115
3116         Enhance shouldBe()/shouldNotBe() to accept anonymous function arguments
3117         <https://webkit.org/b/171362>
3118         <rdar://problem/31867686>
3119
3120         Reviewed by Joseph Pecoraro.
3121
3122         * stress/resources/standalone-pre.js:
3123         (shouldBe):
3124         (shouldNotThrow):
3125         (shouldThrow):
3126         - Update shouldBe() to accept anonymous function arguments.
3127           (The shouldNotBe() function was never copied over.)
3128         - Also fix shouldThrow()/shouldNotThrow() to accept anonymous
3129           function arguments (which were missed in r202609 for Bug
3130           159232).
3131
3132 2017-04-27  Yusuke Suzuki  <utatane.tea@gmail.com>
3133
3134         [JSC] Handle PhantomSpread in LoadVarargs as the same to the others
3135         https://bugs.webkit.org/show_bug.cgi?id=171262
3136
3137         Reviewed by Saam Barati.
3138
3139         * stress/spread-outer-create-rest.js: Added.
3140         (assert):
3141         (foo):
3142         (bar):
3143         (baz):
3144
3145 2017-04-26  Saam Barati  <sbarati@apple.com>
3146
3147         Print Wasm function index in stack trace
3148         https://bugs.webkit.org/show_bug.cgi?id=171349
3149
3150         Reviewed by JF Bastien.
3151
3152         * wasm/function-tests/stack-trace.js: Added.
3153         (import.Builder.from.string_appeared_here.assert):
3154         (let.imp):
3155         * wasm/function-tests/trap-after-cross-instance-call.js:
3156         (wasmFrameCountFromError):
3157         * wasm/function-tests/trap-load-2.js:
3158         (wasmFrameCountFromError):
3159         * wasm/function-tests/trap-load.js:
3160         (wasmFrameCountFromError):
3161
3162 2017-04-26  Saam Barati  <sbarati@apple.com>
3163
3164         ASSERTION FAILED: inIndex != notFound in JSC::invalidParameterInSourceAppender()
3165         https://bugs.webkit.org/show_bug.cgi?id=170924
3166         <rdar://problem/31721052>
3167
3168         Reviewed by Mark Lam.
3169
3170         * stress/error-message-for-function-base-not-found.js: Added.
3171         (assert):
3172         (throw.new.Error):
3173         * stress/error-messages-for-in-operator-should-not-crash.js: Added.
3174         (catch):
3175
3176 2017-04-26  Keith Miller  <keith_miller@apple.com>
3177
3178         WebAssembly: Implement tier up
3179         https://bugs.webkit.org/show_bug.cgi?id=170134
3180
3181         Reviewed by Filip Pizlo.
3182
3183         * wasm/function-tests/trap-after-cross-instance-call.js:
3184         * wasm/tier-up/js-to-wasm.js: Added.
3185         (async.test):
3186         * wasm/tier-up/wasm-to-wasm.js: Added.
3187         (async.test):
3188
3189 2017-04-26  Caitlin Potter  <caitp@igalia.com>
3190
3191         [JSC] Object.keys() must discard property names with no PropertyDescriptor
3192         https://bugs.webkit.org/show_bug.cgi?id=171291
3193
3194         Reviewed by Yusuke Suzuki.
3195
3196         * es6/Proxy_ownKeys_duplicates.js:
3197         * stress/proxy-own-keys.js:
3198         (let.handler.getOwnPropertyDescriptor):
3199         (let.handler.ownKeys):
3200
3201 2017-04-25  Commit Queue  <commit-queue@webkit.org>
3202
3203         Unreviewed, rolling out r215476.
3204         https://bugs.webkit.org/show_bug.cgi?id=171304
3205
3206         "It broke JSBench" (Requested by saamyjoon on #webkit).
3207
3208         Reverted changeset:
3209
3210         "[ES6]. Implement Annex B.3.3 function hoisting rules for
3211         eval"
3212         https://bugs.webkit.org/show_bug.cgi?id=163208
3213         http://trac.webkit.org/changeset/215476
3214
3215 2017-04-25  Saam Barati  <sbarati@apple.com>
3216
3217         JSArray::isArrayPrototypeIteratorProtocolFastAndNonObservable is wrong because it does not do the necessary checks on the base object
3218         https://bugs.webkit.org/show_bug.cgi?id=171150
3219         <rdar://problem/31771880>
3220
3221         Reviewed by Sam Weinig.
3222
3223         * stress/spread-optimized-properly.js: Added.
3224         (assert):
3225         (test):
3226         (shallowEq):
3227         (makeArrayIterator):
3228         (test.bar):
3229         (test.callback):
3230         (test.arr.__proto__.Symbol.iterator):
3231         (test.arr.Symbol.iterator):
3232         (test.get bar):
3233         (test.hackedNext):
3234         (test.test):
3235         (test.):
3236
3237 2017-04-25  Mark Lam  <mark.lam@apple.com>
3238
3239         [Follow up] Array.prototype.slice() should ensure that end >= begin.
3240         https://bugs.webkit.org/show_bug.cgi?id=170989
3241         <rdar://problem/31705652>
3242
3243         Not reviewed.
3244
3245         Follow up to rename a test file that was accidentally named wrongly.
3246
3247         * stress/regress-170989.js: Copied from JSTests/stress/regress-170989.patch.
3248         * stress/regress-170989.patch: Removed.
3249
3250 2017-04-25  Mark Lam  <mark.lam@apple.com>
3251
3252         Array.prototype.slice() should ensure that end >= begin.
3253         https://bugs.webkit.org/show_bug.cgi?id=170989
3254         <rdar://problem/31705652>
3255
3256         Reviewed by Saam Barati.
3257
3258         * stress/regress-170989.patch: Added.
3259
3260 2017-04-25  Mark Lam  <mark.lam@apple.com>
3261
3262         Local CSE wrongly CSEs array accesses with different result types.
3263         https://bugs.webkit.org/show_bug.cgi?id=170990
3264         <rdar://problem/31705945>
3265
3266         Reviewed by Saam Barati.
3267
3268         * stress/regress-170990.js: Added.
3269
3270 2017-04-25  Yusuke Suzuki  <utatane.tea@gmail.com>
3271
3272         WebAssembly: exporting a property with a name that's a number doesn't work
3273         https://bugs.webkit.org/show_bug.cgi?id=168857
3274
3275         Reviewed by JF Bastien.
3276
3277         r213453 allows Wasm instances to expose indexed properties. We activate the tests.
3278
3279         * wasm/js-api/test_Instance.js:
3280         (ExportedNumber):
3281
3282 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3283
3284         test262: test262/test/language/expressions/object/method-definition/early-errors-object-method-duplicate-parameters.js
3285         https://bugs.webkit.org/show_bug.cgi?id=171190
3286
3287         Reviewed by Saam Barati.
3288
3289         * stress/async-await-syntax.js:
3290         * test262.yaml:
3291
3292 2017-04-24  Yusuke Suzuki  <utatane.tea@gmail.com>
3293
3294         [JSC] Use JSFixedArray directly when using call_varargs
3295         https://bugs.webkit.org/show_bug.cgi?id=171057
3296
3297         Reviewed by Saam Barati.
3298
3299         * stress/spread-capture-rest.js: Added.
3300         (shouldBe):
3301         (capture):
3302         (a):
3303         (b):
3304         * stress/spread-multi-layers.js: Added.
3305         (shouldBe):
3306         (a):
3307         (b):
3308         (c):
3309         (d):
3310         * stress/spread-non-varargs.js: Added.
3311         (shouldBe):
3312         (a):
3313         (b):
3314
3315 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3316
3317         test262: test262/test/language/computed-property-names/class/static/getter-prototype.js
3318         https://bugs.webkit.org/show_bug.cgi?id=170897
3319
3320         Reviewed by Saam Barati.
3321
3322         * test262.yaml:
3323
3324 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3325
3326         Address some FIXMEs in JavaScript tests for bugs that have been fixed
3327         https://bugs.webkit.org/show_bug.cgi?id=171191
3328
3329         Reviewed by JF Bastien.
3330
3331         * stress/proxy-is-extensible.js:
3332
3333 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3334
3335         test262: test262/test/language/statements/for-of/dstr-array-elem-init-fn-name-arrow.js
3336         https://bugs.webkit.org/show_bug.cgi?id=171160
3337
3338         Reviewed by JF Bastien.
3339
3340         * stress/inferred-names.js:
3341         * test262.yaml:
3342
3343 2017-04-24  Joseph Pecoraro  <pecoraro@apple.com>
3344
3345         test262: test262/test/language/expressions/generators/yield-as-label.js
3346         https://bugs.webkit.org/show_bug.cgi?id=170979
3347
3348         Reviewed by Saam Barati.
3349
3350         * stress/async-await-module-reserved-word.js:
3351         * stress/async-await-reserved-word.js:
3352         Converge on "Cannot" instead of "Can't".
3353
3354         * catch-parameter-syntax.js:
3355         * yield-named-variable-generator.js:
3356         * yield-named-variable.js:
3357         * stress/yield-label-generator.js:
3358         * stress/yield-label.js:
3359         * stress/yield-reserved-word.js: Added.
3360         More complete list of when 'yield' is allowed.
3361
3362         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3363         * test262.yaml:
3364
3365 2017-04-23  Commit Queue  <commit-queue@webkit.org>
3366
3367         Unreviewed, rolling out r215674.
3368         https://bugs.webkit.org/show_bug.cgi?id=171212
3369
3370         Possible unintended commit. This patch was on the wrong bug.
3371         (Requested by JoePeck on #webkit).
3372
3373         Reverted changeset:
3374
3375         "test262: test262/test/language/expressions/generators/yield-
3376         as-label.js"
3377         https://bugs.webkit.org/show_bug.cgi?id=170979
3378         http://trac.webkit.org/changeset/215674
3379
3380 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3381
3382         test262: test262/test/built-ins/Number/prototype/toPrecision/nan.js
3383         https://bugs.webkit.org/show_bug.cgi?id=171197
3384
3385         Reviewed by Saam Barati.
3386
3387         * test262.yaml:
3388
3389 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3390
3391         test262: test262/test/language/expressions/generators/yield-as-label.js
3392         https://bugs.webkit.org/show_bug.cgi?id=170979
3393
3394         Reviewed by Saam Barati.
3395
3396         * stress/async-await-module-reserved-word.js:
3397         * stress/async-await-reserved-word.js:
3398         Converge on "Cannot" instead of "Can't".
3399
3400         * catch-parameter-syntax.js:
3401         * yield-named-variable-generator.js:
3402         * yield-named-variable.js:
3403         * stress/yield-label-generator.js:
3404         * stress/yield-label.js:
3405         * stress/yield-reserved-word.js: Added.
3406         More complete list of when 'yield' is allowed.
3407
3408         * ChakraCore/test/strict/23.reservedWords_sm.baseline-jsc:
3409         * test262.yaml:
3410
3411 2017-04-23  Joseph Pecoraro  <pecoraro@apple.com>
3412
3413         test262: test262/test/built-ins/Number/parseFloat.js
3414         https://bugs.webkit.org/show_bug.cgi?id=171193
3415
3416         Reviewed by Yusuke Suzuki.
3417
3418         * test262.yaml:
3419
3420 2017-04-22  JF Bastien  <jfbastien@apple.com>
3421
3422         WebAssembly: Module.exports, Module.imports, Module.customSections are wrong
3423         https://bugs.webkit.org/show_bug.cgi?id=171078
3424
3425         Reviewed by Saam Barati.
3426
3427         They're static properties of Module, not instance properties of a module.
3428         https://github.com/WebAssembly/design/blob/master/JS.md#webassemblymoduleexports
3429
3430         * wasm/js-api/Module.customSection.js:
3431         (assert.throws.WebAssembly.Module.customSections):
3432         (assert.eq):
3433         (assert.throws.WebAssembly.Module.prototype.customSections): Deleted.
3434         * wasm/js-api/Module.exports.js:
3435         (assert.throws.WebAssembly.Module.exports):
3436         (assert.truthy):
3437         (assert.throws.WebAssembly.Module.prototype.exports): Deleted.
3438         * wasm/js-api/Module.imports.js:
3439         (assert.throws.WebAssembly.Module.imports):
3440         (assert.truthy):
3441         (assert.throws.WebAssembly.Module.prototype.imports): Deleted.
3442
3443 2017-04-21  JF Bastien  <jfbastien@apple.com>
3444
3445         Silence noisy test
3446
3447         Unreviewed, Fil / Michael and I talked about it in the corridor. I
3448         just forgot to set verbose to false before commit.
3449
3450         * wasm/stress/oom.js:
3451
3452 2017-04-20  Yusuke Suzuki  <utatane.tea@gmail.com>
3453
3454         [JSC][FTL] FTL should support Arrayify
3455         https://bugs.webkit.org/show_bug.cgi?id=169596
3456
3457         Reviewed by Saam Barati.
3458
3459         * stress/arrayify.js: Added.
3460         (arrayifyInt32):
3461         (arrayifyDouble):
3462         (arrayifyContiguous):
3463
3464 2017-04-20  Mark Lam  <mark.lam@apple.com>
3465
3466         virtualThunkFor() needs to materialize its of tagMaskRegister for tail calls.
3467         https://bugs.webkit.org/show_bug.cgi?id=171079
3468         <rdar://problem/31684756>
3469
3470         Reviewed by Saam Barati.
3471
3472         * stress/regress-171079.js: Added.
3473
3474 2017-04-15  Filip Pizlo  <fpizlo@apple.com>
3475
3476         Optimize SharedArrayBuffer in the DFG+FTL
3477         https://bugs.webkit.org/show_bug.cgi?id=164108
3478
3479         Reviewed by Saam Barati.
3480         
3481         Added a fairly comprehensive test of the intrinsics. This creates a function for each possible
3482         combination of type and operation, and then first uses it nicely and then tries a bunch of
3483         erroneous conditions like OOB.
3484
3485         * stress/SharedArrayBuffer-opt.js: Added.
3486         (string_appeared_here.switch):
3487         (string_appeared_here.str):
3488         (runAtomic):
3489         (shouldFail):
3490         (Symbol):
3491         (string_appeared_here.a.of.arrays.m.of.atomics):
3492         * stress/SharedArrayBuffer.js:
3493
3494 2017-04-19  Mark Lam  <mark.lam@apple.com>
3495
3496         B3StackmapSpecial should handle when stackmap values are not recoverable from a Def'ed arg.
3497         https://bugs.webkit.org/show_bug.cgi?id=170973
3498         <rdar://problem/30318657>
3499
3500         Reviewed by Filip Pizlo.
3501
3502         * stress/regress-170973.js: Added.
3503
3504 2017-04-19  JF Bastien  <jfbastien@apple.com>
3505
3506         WebAssembly: limit slow memories
3507         https://bugs.webkit.org/show_bug.cgi?id=170825
3508
3509         Reviewed by Saam Barati.
3510
3511         * wasm.yaml:
3512         * wasm/stress/oom.js: Added.
3513         (try.true.WebAssemblyMemoryMode):
3514         (catch):
3515
3516 2017-04-19  JF Bastien  <jfbastien@apple.com>
3517
3518         WebAssembly: don't expose any WebAssembly JS object if JIT is off
3519         https://bugs.webkit.org/show_bug.cgi?id=170782
3520
3521         Reviewed by Saam Barati.
3522
3523         * wasm.yaml:
3524         * wasm/noJIT/noJIT.js: Added.
3525
3526 2017-04-18  Mark Lam  <mark.lam@apple.com>
3527
3528         r211670 broke double to int conversion.
3529         https://bugs.webkit.org/show_bug.cgi?id=170961
3530         <rdar://problem/31687696>
3531
3532         Reviewed by Yusuke Suzuki.
3533
3534         * microbenchmarks/double-to-int32.js: Added.
3535         * stress/to-int32-sensible2.js: Added.
3536
3537 2017-04-18  Oleksandr Skachkov  <gskachkov@gmail.com>
3538
3539         [ES6]. Implement Annex B.3.3 function hoisting rules for eval
3540         https://bugs.webkit.org/show_bug.cgi?id=163208
3541
3542         Reviewed by Saam Barati.
3543
3544         * stress/eval-func-decl-block-scoping-reassign.js: Added.
3545         (assert):
3546         (throw.new.Error.f):
3547         (throw.new.Error):
3548         * stress/eval-func-decl-block-with-remove.js: Added.
3549         (assert):
3550         (foo.boo):
3551         (foo):
3552         * stress/eval-func-decl-block-with-var-and-remove.js: Added.
3553         (assert):
3554         (assertThrow):
3555         (foo):
3556         (boo):
3557         (joo):
3558         (koo):
3559         * stress/eval-func-decl-block-with-var-sinthesize.js: Added.
3560         (assert):
3561         (assertThrow):
3562         (foo):
3563         (boo):
3564         (hoo):
3565         (joo):
3566         (koo):
3567         * stress/eval-func-decl-in-block-scope-and-bind-to-top-eval-scope.js: Added.
3568         * stress/eval-func-decl-in-eval-within-block-with-let.js: Added.
3569         (assert):
3570         (assertThrow):
3571         (foo):
3572         (boo):
3573         (goo):
3574         * stress/eval-func-decl-in-eval-within-with-scope.js: Added.
3575         (assert):
3576         (assertThrow):
3577         (foo):
3578         (boo):
3579         (boo.let.val2):
3580         (boo.let.val3):
3581         * stress/eval-func-decl-in-frozen-global.js: Added.
3582         (assert):
3583         (assertThrow):
3584         (throw.new.Error):
3585         (Object.freeze):
3586         * stress/eval-func-decl-in-global-of-eval.js: Added.
3587         (assert):
3588         (assertThrow):
3589         (bar):
3590         (baz):
3591         (foobar):
3592         * stress/eval-func-decl-in-global.js: Added.
3593         (assert):
3594         (assertThrow):
3595         * stress/eval-func-decl-in-if.js: Added.
3596         (assert):
3597         * stress/eval-func-decl-within-eval-with-reassign-to-var.js: Added.
3598         (assert):
3599         (assertThrow):
3600         (foo):
3601         (boo):
3602         (foobar):
3603         (hoo):
3604         (joo):
3605         (koo):
3606         (loo):
3607         * stress/eval-func-decl-within-eval-without-reassign-to-let.js: Added.
3608         (assert):
3609         (assertThrow):
3610         (foo):
3611         (boo):
3612         (goo):
3613         * stress/variable-under-tdz-eval-tricky.js:
3614         (assert):
3615         * test262.yaml:
3616
3617 2017-04-18  Filip Pizlo  <fpizlo@apple.com>
3618
3619         wasm/function-tests/memory-multiagent times out sometimes
3620         https://bugs.webkit.org/show_bug.cgi?id=170958
3621
3622         Reviewed by Keith Miller.
3623         
3624         Add the ability to skip tests easily. Skip the test.
3625
3626         * wasm.yaml:
3627         * wasm/function-tests/memory-multiagent.js:
3628
3629 2017-04-18  Saam Barati  <sbarati@apple.com>
3630
3631         Follow up to debug build stack overflow in test after r215453
3632
3633         Rubber stamped by Mark Lam.
3634
3635         * stress/call-apply-exponential-bytecode-size.js: Decrease the call
3636         size to prevent stack overflow errors on debug builds.
3637
3638 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3639
3640         [DFG] Convert ValueAdd(Int32, String) => MakeRope(ToString(Int32), String)
3641         https://bugs.webkit.org/show_bug.cgi?id=170943
3642
3643         Reviewed by Geoffrey Garen.
3644
3645         * microbenchmarks/number-to-string-with-add-empty.js: Added.
3646         (toStringLeft):
3647         (toStringRight):
3648         * microbenchmarks/number-to-string-with-add-in-loop.js: Added.
3649         (toStringLeft):
3650         (toStringRight):
3651         * microbenchmarks/number-to-string-with-add.js: Added.
3652         (toStringLeft):
3653         (toStringRight):
3654         * stress/number-to-string-with-add.js: Added.
3655         (shouldBe):
3656         (toStringRight):
3657         (toStringLeftEmpty):
3658         (toStringRightEmpty):
3659
3660 2017-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
3661
3662         [DFG] Drop unknown use of CheckCell's child2 to work ObjectAllocationSinking for Array iterator object
3663         https://bugs.webkit.org/show_bug.cgi?id=170940
3664
3665         Reviewed by Filip Pizlo.
3666
3667         * microbenchmarks/for-of-array.js: Added.
3668         (fn):
3669
3670 2017-04-17  Saam Barati  <sbarati@apple.com>
3671
3672         BytecodeGenerator ".call" and ".apply" is exponential in nesting depth
3673         https://bugs.webkit.org/show_bug.cgi?id=139847
3674         <rdar://problem/19321122>
3675
3676         Reviewed by Oliver Hunt.
3677
3678         * stress/call-apply-exponential-bytecode-size.js: Added.
3679         (assert):
3680         (const.inc):
3681         (const.inc2):
3682         (bar):
3683         (randomApplyOrCall):
3684         (baz):
3685         (jaz):
3686         (haz):
3687         (foo):
3688
3689 2017-04-17  Mark Lam  <mark.lam@apple.com>
3690
3691         JSArray::appendMemcpy() needs to handle copying from Undecided indexing type too.
3692         https://bugs.webkit.org/show_bug.cgi?id=170896
3693         <rdar://problem/31651319>
3694
3695         Reviewed by JF Bastien and Keith Miller.
3696
3697         * stress/regress-170896.js: Added.
3698
3699 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3700
3701         test262: test262/test/built-ins/Object/prototype/toLocaleString/primitive_this_value.js
3702         https://bugs.webkit.org/show_bug.cgi?id=170882
3703
3704         Reviewed by Saam Barati.
3705
3706         * test262.yaml:
3707
3708 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3709
3710         test262: test262/test/built-ins/isNaN/toprimitive-not-callable-throws.js
3711         https://bugs.webkit.org/show_bug.cgi?id=170888
3712
3713         Reviewed by Saam Barati.
3714
3715         * stress/computed-accessor.js:
3716         * stress/eval-in-arrow-function.js:
3717         * stress/rest-elements.js:
3718         * stress/string-object-define-own-property.js:
3719         Remove unused shouldThrow.
3720
3721         * stress/symbol-toprimitive-errors.js: Added.
3722         Check for ToPrimitive TypeErrors.
3723
3724         * test262.yaml:
3725
3726 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3727
3728         test262: test262/test/language/expressions/tagged-template/template-object.js
3729         https://bugs.webkit.org/show_bug.cgi?id=170878
3730
3731         Reviewed by Saam Barati.
3732
3733         * stress/array-length-not-writable.js: Added.
3734         (assert):
3735         * test262.yaml:
3736
3737 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3738
3739         test262: test262/test/built-ins/Object/getOwnPropertyNames/15.2.3.4-4-44.js
3740         https://bugs.webkit.org/show_bug.cgi?id=170879
3741
3742         Reviewed by Saam Barati.
3743
3744         * ChakraCore/test/es5/enumerable.baseline-jsc:
3745         * test262.yaml:
3746
3747 2017-04-16  Joseph Pecoraro  <pecoraro@apple.com>
3748
3749         test262: test262/test/built-ins/Date/prototype/Symbol.toPrimitive/name.js
3750         https://bugs.webkit.org/show_bug.cgi?id=170884
3751
3752         Reviewed by Yusuke Suzuki.
3753
3754         * test262.yaml:
3755
3756 2017-04-15  Joseph Pecoraro  <pecoraro@apple.com>
3757
3758         test262: test262/test/language/global-code/new.target-arrow.js
3759         https://bugs.webkit.org/show_bug.cgi?id=170872
3760
3761         Reviewed by Saam Barati.
3762
3763         * stress/async-arrow-functions-lexical-new.target-binding.js:
3764         (shouldThrowAsync): Deleted.
3765         (shouldThrowAsync.async): Deleted.
3766         This code should have thrown a SyntaxError. Instead it was throwing
3767         a ReferenceError for the internal @newTargetLocal variable.
3768
3769         * stress/new-target-syntax-errors.js:
3770         Cover the arrow function in global code cases.
3771