f324200d967a8dde013cc68e53eff8ce7d7b9edb
[WebKit-https.git] / JSTests / ChangeLog
1 2019-11-01  Alexey Shvayka  <shvaikalesh@gmail.com>
2
3         [[HasProperty]] result of Proxy in prototype chain is ignored
4         https://bugs.webkit.org/show_bug.cgi?id=203560
5
6         Reviewed by Ross Kirsling.
7
8         * stress/proxy-get-prototype-of.js: Correct Proxy "has" trap test.
9         * test262/expectations.yaml: Mark 6 test cases as passing.
10
11 2019-11-01  Caio Lima  <ticaiolima@gmail.com>
12
13         [JSC][MIPS] Skip tests failing in RELEASE_ASSERT_NOT_REACHED() at CallFrame.cpp:81
14         https://bugs.webkit.org/show_bug.cgi?id=203738
15
16         Unreviewed gardening.
17
18         * stress/allocation-sinking-hints-are-valid-ssa.js:
19         * stress/has-instance-exception-check.js:
20         * stress/regress-176485.js:
21
22 2019-10-31  Caio Lima  <ticaiolima@gmail.com>
23
24         Temporary skip broken tests on MIPS that is broken due to OSR exit to LLInt
25         https://bugs.webkit.org/show_bug.cgi?id=203710
26
27         Unreviewed gardening.
28
29         * microbenchmarks/call-spread-call.js:
30         * microbenchmarks/throw.js:
31         * stress/allocation-sinking-hints-are-valid-ssa-2.js:
32         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js:
33         * stress/arrowfunction-lexical-bind-supercall-4.js:
34         * stress/arrowfunction-tdz-3.js:
35         * stress/function-constructor-semantics.js:
36         * stress/stress-cleared-calllinkinfo.js:
37         * stress/typedarray-configure-index.js:
38         * stress/v8-deltablue-strict.js:
39
40 2019-10-31  Saam Barati  <sbarati@apple.com>
41
42         Don't use memmove/memcpy/memset for memory that can be scanned concurrently
43         https://bugs.webkit.org/show_bug.cgi?id=203228
44         <rdar://problem/56401852>
45
46         Reviewed by Robin Morisset.
47
48         * stress/torn-js-value-concurrent-collector.js: Added.
49         (foo):
50
51 2019-10-30  Yusuke Suzuki  <ysuzuki@apple.com>
52
53         [JSC] Date functions should have intrinsic
54         https://bugs.webkit.org/show_bug.cgi?id=202187
55
56         Reviewed by Keith Miller.
57
58         * stress/date-cse.js: Added.
59         (shouldBe):
60         (test):
61         (test2):
62         (test3):
63         * stress/date-get-date-jit.js: Added.
64         (shouldBe):
65         (test):
66         * stress/date-get-day-jit.js: Added.
67         (shouldBe):
68         (test):
69         * stress/date-get-full-year-jit.js: Added.
70         (shouldBe):
71         (test):
72         * stress/date-get-hours-jit.js: Added.
73         (shouldBe):
74         (test):
75         * stress/date-get-milliseconds-jit.js: Added.
76         (shouldBe):
77         (test):
78         * stress/date-get-minutes-jit.js: Added.
79         (shouldBe):
80         (test):
81         * stress/date-get-month-jit.js: Added.
82         (shouldBe):
83         (test):
84         * stress/date-get-seconds-jit.js: Added.
85         (shouldBe):
86         (test):
87         * stress/date-get-time-jit.js: Added.
88         (shouldBe):
89         (test):
90         * stress/date-get-timezone-offset-jit.js: Added.
91         (shouldBe):
92         (test):
93         * stress/date-get-utc-date-jit.js: Added.
94         (shouldBe):
95         (test):
96         * stress/date-get-utc-day-jit.js: Added.
97         (shouldBe):
98         (test):
99         * stress/date-get-utc-full-year-jit.js: Added.
100         (shouldBe):
101         (test):
102         * stress/date-get-utc-hours-jit.js: Added.
103         (shouldBe):
104         (test):
105         * stress/date-get-utc-milliseconds-jit.js: Added.
106         (shouldBe):
107         (test):
108         * stress/date-get-utc-minutes-jit.js: Added.
109         (shouldBe):
110         (test):
111         * stress/date-get-utc-month-jit.js: Added.
112         (shouldBe):
113         (test):
114         * stress/date-get-utc-seconds-jit.js: Added.
115         (shouldBe):
116         (test):
117         * stress/date-get-year-jit.js: Added.
118         (shouldBe):
119         (test):
120         * stress/date-value-of-jit.js: Added.
121         (shouldBe):
122         (test):
123
124 2019-10-30  Guillaume Emont  <guijemont@igalia.com>
125
126         Temporarily skip ChakraCore/test/Math/max.js on arm and mips
127
128         Unreviewed gardening.
129
130         * ChakraCore.yaml:
131
132 2019-10-30  Ross Kirsling  <ross.kirsling@sony.com>
133
134         Intl.DateTimeFormat returns resolvedOptions in the wrong order
135         https://bugs.webkit.org/show_bug.cgi?id=203297
136
137         Reviewed by Yusuke Suzuki.
138
139         * test262/expectations.yaml:
140         Mark two test cases as passing.
141
142 2019-10-30  Tadeu Zagallo  <tzagallo@apple.com>
143
144         tryCachePutToScopeGlobal should hold the lock to update metadata.m_getPutInfo
145         https://bugs.webkit.org/show_bug.cgi?id=203628
146         <rdar://problem/56705353>
147
148         Reviewed by Yusuke Suzuki.
149
150         * stress/property-move-from-global-object-to-global-lexical-environment.js: Added.
151         (foo):
152
153 2019-10-29  Yusuke Suzuki  <ysuzuki@apple.com>
154
155         [JSC] Add fast path for String#localeCompare
156         https://bugs.webkit.org/show_bug.cgi?id=202676
157
158         Reviewed by Mark Lam.
159
160         * stress/locale-compare-bits.js: Added.
161         (shouldBe):
162
163 2019-10-28  Yusuke Suzuki  <ysuzuki@apple.com>
164
165         [JSC] Optimize Promise runtime functions
166         https://bugs.webkit.org/show_bug.cgi?id=203454
167
168         Reviewed by Keith Miller.
169
170         * microbenchmarks/promise-reject.js: Added.
171         * microbenchmarks/promise-resolve.js: Added.
172
173 2019-10-25  Ross Kirsling  <ross.kirsling@sony.com>
174
175         test262-runner should be able to pass JSC a feature flag
176         https://bugs.webkit.org/show_bug.cgi?id=203301
177
178         Reviewed by Keith Miller.
179
180         * test262/config.yaml:
181         Add feature flag mapping.
182         Also skip a few forgotten features as well as BigInt TypedArray tests.
183
184         * test262/expectations.yaml:
185         Regenerate expectations.
186
187 2019-10-23  Keith Miller  <keith_miller@apple.com>
188
189         Undo incidental change from BytecodeIndex class patch
190         https://bugs.webkit.org/show_bug.cgi?id=203339
191
192         Reviewed by Mark Lam.
193
194         * stress/error-source-location-assertion.js: Added.
195
196 2019-10-23  Ross Kirsling  <ross.kirsling@sony.com>
197
198         String.prototype.matchAll should throw on non-global regex
199         https://bugs.webkit.org/show_bug.cgi?id=202838
200
201         Reviewed by Keith Miller.
202
203         * stress/string-matchall.js: Added.
204
205         * test262/expectations.yaml:
206         Mark four test cases as passing.
207
208 2019-10-23  Ross Kirsling  <ross.kirsling@sony.com>
209
210         Update test262 (2019.10.11)
211         https://bugs.webkit.org/show_bug.cgi?id=202861
212
213         Reviewed by Keith Miller.
214
215         * test262/config.yaml:
216         * test262/expectations.yaml:
217         * test262/harness/:
218         * test262/latest-changes-summary.txt:
219         * test262/test/:
220         * test262/test262-Revision.txt:
221
222 2019-10-22  Zhifei Fang  <zhifei_fang@apple.com>
223
224         [JSC tests] Skip slow tests on Watch S3 and Watch S4
225         https://bugs.webkit.org/show_bug.cgi?id=203268
226
227         Reviewed by Saam Barati.
228
229         * microbenchmarks/ArrayBuffer-DataView-alloc-large-long-lived.js:
230         * microbenchmarks/ArrayBuffer-DataView-alloc-long-lived.js:
231         * microbenchmarks/ArrayBuffer-Int32Array-byteOffset.js:
232         * microbenchmarks/ArrayBuffer-Int8Array-alloc-large-long-lived.js:
233         * microbenchmarks/ArrayBuffer-Int8Array-alloc-long-lived-buffer.js:
234         * microbenchmarks/ArrayBuffer-Int8Array-alloc-long-lived.js:
235         * microbenchmarks/ArrayBuffer-Int8Array-alloc.js:
236         * microbenchmarks/DataView-custom-properties.js:
237         * microbenchmarks/Float32Array-matrix-mult.js:
238         * microbenchmarks/Float32Array-to-Float64Array-set.js:
239         * microbenchmarks/Float64Array-alloc-long-lived.js:
240         * microbenchmarks/Float64Array-to-Int16Array-set.js:
241         * microbenchmarks/HashMap-put-get-iterate-keys.js:
242         * microbenchmarks/HashMap-put-get-iterate.js:
243         * microbenchmarks/HashMap-string-put-get-iterate.js:
244         * microbenchmarks/Int16Array-alloc-long-lived.js:
245         * microbenchmarks/Int16Array-bubble-sort-with-byteLength.js:
246         * microbenchmarks/Int16Array-bubble-sort.js:
247         * microbenchmarks/Int16Array-load-int-mul.js:
248         * microbenchmarks/Int16Array-to-Int32Array-set.js:
249         * microbenchmarks/Int32Array-Int8Array-view-alloc.js:
250         * microbenchmarks/Int32Array-alloc-large.js:
251         * microbenchmarks/Int32Array-alloc-long-lived.js:
252         * microbenchmarks/Int32Array-alloc.js:
253         * microbenchmarks/Int8Array-alloc-long-lived.js:
254         * microbenchmarks/Int8Array-load-with-byteLength.js:
255         * microbenchmarks/Int8Array-load.js:
256         * microbenchmarks/JSONP-negative-0.js:
257         * microbenchmarks/Number-isNaN.js:
258         * microbenchmarks/abc-forward-loop-equal.js:
259         * microbenchmarks/abc-postfix-backward-loop.js:
260         * microbenchmarks/abc-simple-backward-loop.js:
261         * microbenchmarks/abc-simple-forward-loop.js:
262         * microbenchmarks/abc-skippy-loop.js:
263         * microbenchmarks/abs-boolean.js:
264         * microbenchmarks/adapt-to-double-divide.js:
265         * microbenchmarks/add-tree.js:
266         * microbenchmarks/aliased-arguments-getbyval.js:
267         * microbenchmarks/allocate-big-object.js:
268         * microbenchmarks/apply-not-apply.js:
269         * microbenchmarks/arguments-named-and-reflective.js:
270         * microbenchmarks/arguments-out-of-bounds.js:
271         * microbenchmarks/arguments-strict-mode.js:
272         * microbenchmarks/arguments.js:
273         * microbenchmarks/arity-mismatch-inlining.js:
274         * microbenchmarks/array-access-polymorphic-structure.js:
275         * microbenchmarks/array-nonarray-polymorhpic-access.js:
276         * microbenchmarks/array-prototype-every.js:
277         * microbenchmarks/array-prototype-forEach.js:
278         * microbenchmarks/array-prototype-join-uninitialized.js:
279         * microbenchmarks/array-prototype-map.js:
280         * microbenchmarks/array-prototype-reduce.js:
281         * microbenchmarks/array-prototype-reduceRight.js:
282         * microbenchmarks/array-prototype-some.js:
283         * microbenchmarks/array-push-0.js:
284         * microbenchmarks/array-push-1.js:
285         * microbenchmarks/array-push-2.js:
286         * microbenchmarks/array-splice-contiguous.js:
287         * microbenchmarks/array-with-double-add.js:
288         * microbenchmarks/array-with-double-increment.js:
289         * microbenchmarks/array-with-double-mul-add.js:
290         * microbenchmarks/array-with-double-sum.js:
291         * microbenchmarks/array-with-int32-add-sub.js:
292         * microbenchmarks/array-with-int32-or-double-sum.js:
293         * microbenchmarks/arrowfunciton-direct-arguments.js:
294         * microbenchmarks/arrowfunciton-reference-arguments.js:
295         * microbenchmarks/arrowfunction-call-in-class-constructor.js:
296         * microbenchmarks/arrowfunction-call-in-class-method.js:
297         * microbenchmarks/arrowfunction-call-in-function.js:
298         * microbenchmarks/arrowfunction-call.js:
299         * microbenchmarks/asmjs_bool_bug.js:
300         * microbenchmarks/assign-custom-setter-polymorphic.js:
301         * microbenchmarks/assign-custom-setter.js:
302         * microbenchmarks/basic-set.js:
303         * microbenchmarks/big-int-mul.js:
304         * microbenchmarks/bigswitch-indirect-symbol.js:
305         * microbenchmarks/bigswitch-indirect.js:
306         * microbenchmarks/bigswitch.js:
307         * microbenchmarks/bit-or-tree.js:
308         * microbenchmarks/bit-test-constant.js:
309         * microbenchmarks/bit-test-load.js:
310         * microbenchmarks/bit-test-nonconstant.js:
311         * microbenchmarks/bit-xor-tree.js:
312         * microbenchmarks/boolean-test.js:
313         * microbenchmarks/bound-function-call.js:
314         * microbenchmarks/bound-function-construction-performance.js:
315         * microbenchmarks/branch-fold.js:
316         * microbenchmarks/branch-on-string-as-boolean.js:
317         * microbenchmarks/bug-153431.js:
318         * microbenchmarks/build-large-object.js:
319         * microbenchmarks/by-val-generic.js:
320         * microbenchmarks/cache-get-variables-under-tdz-in-bytecode-generator.js:
321         * microbenchmarks/call-or-not-call.js:
322         * microbenchmarks/call-spread-apply.js:
323         * microbenchmarks/call-spread-call.js:
324         * microbenchmarks/call-using-spread.js:
325         * microbenchmarks/captured-assignments.js:
326         * microbenchmarks/cast-int-to-double.js:
327         * microbenchmarks/cell-argument.js:
328         * microbenchmarks/cfg-simplify.js:
329         * microbenchmarks/chain-getter-access.js:
330         * microbenchmarks/check-mul-constant.js:
331         * microbenchmarks/check-mul-no-constant.js:
332         * microbenchmarks/check-mul-power-of-two.js:
333         * microbenchmarks/cmpeq-obj-to-obj-other.js:
334         * microbenchmarks/concat-append-one.js:
335         * microbenchmarks/constant-fold-check-type-info-flags.js:
336         * microbenchmarks/constant-test.js:
337         * microbenchmarks/construct-poly-proto-object.js:
338         * microbenchmarks/contiguous-array-to-string.js:
339         * microbenchmarks/create-lots-of-functions.js:
340         * microbenchmarks/create-many-weak-map.js:
341         * microbenchmarks/cse-new-array-buffer.js:
342         * microbenchmarks/cse-new-array.js:
343         * microbenchmarks/custom-accessor-materialized.js:
344         * microbenchmarks/custom-accessor-thin-air.js:
345         * microbenchmarks/custom-accessor.js:
346         * microbenchmarks/custom-setter-getter-as-put-get-by-id.js:
347         * microbenchmarks/custom-value-2.js:
348         * microbenchmarks/custom-value.js:
349         * microbenchmarks/data-view-accesses-2.js:
350         * microbenchmarks/data-view-accesses.js:
351         * microbenchmarks/dataview-cse.js:
352         * microbenchmarks/delay-tear-off-arguments-strictmode.js:
353         * microbenchmarks/delta-blue-try-catch.js:
354         * microbenchmarks/deltablue-for-of.js:
355         * microbenchmarks/deltablue-varargs.js:
356         * microbenchmarks/destructuring-arguments.js:
357         * microbenchmarks/destructuring-parameters-overridden-by-function.js:
358         * microbenchmarks/destructuring-swap.js:
359         * microbenchmarks/dfg-internal-function-call.js:
360         * microbenchmarks/dfg-internal-function-construct.js:
361         * microbenchmarks/dfg-internal-function-not-handled-call.js:
362         * microbenchmarks/dfg-internal-function-not-handled-construct.js:
363         * microbenchmarks/direct-arguments-getbyval.js:
364         * microbenchmarks/direct-arguments-length.js:
365         * microbenchmarks/direct-arguments-overridden-length.js:
366         * microbenchmarks/direct-arguments-possibly-overridden-length.js:
367         * microbenchmarks/direct-call-arity-mismatch.js:
368         * microbenchmarks/direct-call.js:
369         * microbenchmarks/direct-construct-arity-mismatch.js:
370         * microbenchmarks/direct-construct.js:
371         * microbenchmarks/direct-tail-call-arity-mismatch.js:
372         * microbenchmarks/direct-tail-call-inlined-caller-arity-mismatch.js:
373         * microbenchmarks/direct-tail-call-inlined-caller.js:
374         * microbenchmarks/direct-tail-call.js:
375         * microbenchmarks/div-boolean-double.js:
376         * microbenchmarks/div-boolean.js:
377         * microbenchmarks/dont-confuse-structures-from-different-executable-as-poly-proto.js:
378         * microbenchmarks/double-array-to-string.js:
379         * microbenchmarks/double-get-by-val-out-of-bounds.js:
380         * microbenchmarks/double-pollution-getbyval.js:
381         * microbenchmarks/double-pollution-putbyoffset.js:
382         * microbenchmarks/double-real-use.js:
383         * microbenchmarks/double-to-int32-typed-array-no-inline.js:
384         * microbenchmarks/double-to-int32-typed-array.js:
385         * microbenchmarks/double-to-uint32-typed-array-no-inline.js:
386         * microbenchmarks/double-to-uint32-typed-array.js:
387         * microbenchmarks/elidable-new-object-dag.js:
388         * microbenchmarks/elidable-new-object-roflcopter.js:
389         * microbenchmarks/elidable-new-object-then-call.js:
390         * microbenchmarks/elidable-new-object-tree.js:
391         * microbenchmarks/empty-string-plus-int.js:
392         * microbenchmarks/emscripten-cube2hash.js:
393         * microbenchmarks/eval-cached.js:
394         * microbenchmarks/eval-code-ftl-reentry.js:
395         * microbenchmarks/eval-code-ftl.js:
396         * microbenchmarks/eval-compute.js:
397         * microbenchmarks/eval-not-eval-compute-args.js:
398         * microbenchmarks/eval-not-eval-compute.js:
399         * microbenchmarks/exit-length-on-plain-object.js:
400         * microbenchmarks/external-arguments-getbyval.js:
401         * microbenchmarks/external-arguments-putbyval.js:
402         * microbenchmarks/fixed-typed-array-storage-var-index.js:
403         * microbenchmarks/fixed-typed-array-storage.js:
404         * microbenchmarks/fold-double-to-int.js:
405         * microbenchmarks/fold-get-by-id-to-multi-get-by-offset-rare-int.js:
406         * microbenchmarks/fold-get-by-id-to-multi-get-by-offset.js:
407         * microbenchmarks/fold-multi-get-by-offset-to-get-by-offset.js:
408         * microbenchmarks/fold-multi-get-by-offset-to-poly-get-by-offset.js:
409         * microbenchmarks/fold-multi-put-by-offset-to-poly-put-by-offset.js:
410         * microbenchmarks/fold-multi-put-by-offset-to-put-by-offset.js:
411         * microbenchmarks/fold-multi-put-by-offset-to-replace-or-transition-put-by-offset.js:
412         * microbenchmarks/fold-put-by-id-to-multi-put-by-offset.js:
413         * microbenchmarks/fold-put-by-val-with-string-to-multi-put-by-offset.js:
414         * microbenchmarks/fold-put-by-val-with-symbol-to-multi-put-by-offset.js:
415         * microbenchmarks/fold-put-structure.js:
416         * microbenchmarks/for-in-on-object-with-lazily-materialized-properties.js:
417         * microbenchmarks/for-of-array.js:
418         * microbenchmarks/for-of-iterate-array-entries.js:
419         * microbenchmarks/for-of-iterate-array-keys.js:
420         * microbenchmarks/for-of-iterate-array-values.js:
421         * microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js:
422         * microbenchmarks/freeze-and-do-work.js:
423         * microbenchmarks/fround.js:
424         * microbenchmarks/ftl-library-inlining-dataview.js:
425         * microbenchmarks/ftl-library-inlining.js:
426         * microbenchmarks/ftl-polymorphic-StringFromCharCode.js:
427         * microbenchmarks/function-call.js:
428         * microbenchmarks/function-dot-apply.js:
429         * microbenchmarks/function-test.js:
430         * microbenchmarks/function-with-eval.js:
431         * microbenchmarks/gcse-poly-get-less-obvious.js:
432         * microbenchmarks/gcse-poly-get.js:
433         * microbenchmarks/gcse.js:
434         * microbenchmarks/generate-multiple-llint-entrypoints.js:
435         * microbenchmarks/generator-create.js:
436         * microbenchmarks/generator-fib.js:
437         * microbenchmarks/generator-function-create.js:
438         * microbenchmarks/generator-sunspider-access-nsieve.js:
439         * microbenchmarks/generator-with-several-types.js:
440         * microbenchmarks/get-by-id-bimorphic-check-structure-elimination-simple.js:
441         * microbenchmarks/get-by-id-bimorphic-check-structure-elimination.js:
442         * microbenchmarks/get-by-id-chain-from-try-block.js:
443         * microbenchmarks/get-by-id-check-structure-elimination.js:
444         * microbenchmarks/get-by-id-proto-or-self.js:
445         * microbenchmarks/get-by-id-quadmorphic-check-structure-elimination-simple.js:
446         * microbenchmarks/get-by-id-self-or-proto.js:
447         * microbenchmarks/get-by-val-negative-array-index.js:
448         * microbenchmarks/get-by-val-out-of-bounds.js:
449         * microbenchmarks/get-by-val-with-string-bimorphic-check-structure-elimination-simple.js:
450         * microbenchmarks/get-by-val-with-string-bimorphic-check-structure-elimination.js:
451         * microbenchmarks/get-by-val-with-string-chain-from-try-block.js:
452         * microbenchmarks/get-by-val-with-string-check-structure-elimination.js:
453         * microbenchmarks/get-by-val-with-string-proto-or-self.js:
454         * microbenchmarks/get-by-val-with-string-quadmorphic-check-structure-elimination-simple.js:
455         * microbenchmarks/get-by-val-with-string-self-or-proto.js:
456         * microbenchmarks/get-by-val-with-symbol-bimorphic-check-structure-elimination-simple.js:
457         * microbenchmarks/get-by-val-with-symbol-bimorphic-check-structure-elimination.js:
458         * microbenchmarks/get-by-val-with-symbol-chain-from-try-block.js:
459         * microbenchmarks/get-by-val-with-symbol-check-structure-elimination.js:
460         * microbenchmarks/get-by-val-with-symbol-proto-or-self.js:
461         * microbenchmarks/get-by-val-with-symbol-quadmorphic-check-structure-elimination-simple.js:
462         * microbenchmarks/get-by-val-with-symbol-self-or-proto.js:
463         * microbenchmarks/get-custom-getter.js:
464         * microbenchmarks/get_by_val-Int32Array.js:
465         * microbenchmarks/get_callee_monomorphic.js:
466         * microbenchmarks/get_callee_polymorphic.js:
467         * microbenchmarks/getter-no-activation.js:
468         * microbenchmarks/getter-prototype.js:
469         * microbenchmarks/getter-richards-try-catch.js:
470         * microbenchmarks/getter-richards.js:
471         * microbenchmarks/getter.js:
472         * microbenchmarks/global-code-ftl.js:
473         * microbenchmarks/global-isNaN.js:
474         * microbenchmarks/global-object-access-with-mutating-structure.js:
475         * microbenchmarks/global-var-const-infer-fire-from-opt.js:
476         * microbenchmarks/global-var-const-infer.js:
477         * microbenchmarks/hard-overflow-check-equal.js:
478         * microbenchmarks/hard-overflow-check.js:
479         * microbenchmarks/has-own-property-name-cache.js:
480         * microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js:
481         * microbenchmarks/hoist-make-rope.js:
482         * microbenchmarks/hoist-poly-check-structure-effectful-loop.js:
483         * microbenchmarks/hoist-poly-check-structure.js:
484         * microbenchmarks/implicit-bigswitch-indirect-symbol.js:
485         * microbenchmarks/imul-double-only.js:
486         * microbenchmarks/imul-int-only.js:
487         * microbenchmarks/imul-mixed.js:
488         * microbenchmarks/in-by-id-match.js:
489         * microbenchmarks/in-by-id-removed.js:
490         * microbenchmarks/in-four-cases.js:
491         * microbenchmarks/in-one-case-false.js:
492         * microbenchmarks/in-one-case-true.js:
493         * microbenchmarks/in-two-cases.js:
494         * microbenchmarks/indexed-properties-in-objects.js:
495         * microbenchmarks/infer-closure-const-then-mov-no-inline.js:
496         * microbenchmarks/infer-closure-const-then-mov.js:
497         * microbenchmarks/infer-closure-const-then-put-to-scope-no-inline.js:
498         * microbenchmarks/infer-closure-const-then-put-to-scope.js:
499         * microbenchmarks/infer-closure-const-then-reenter-no-inline.js:
500         * microbenchmarks/infer-closure-const-then-reenter.js:
501         * microbenchmarks/infer-constant-global-property.js:
502         * microbenchmarks/infer-constant-property.js:
503         * microbenchmarks/infer-one-time-closure-ten-vars.js:
504         * microbenchmarks/infer-one-time-closure-two-vars.js:
505         * microbenchmarks/infer-one-time-closure.js:
506         * microbenchmarks/infer-one-time-deep-closure.js:
507         * microbenchmarks/inline-arguments-access.js:
508         * microbenchmarks/inline-arguments-aliased-access.js:
509         * microbenchmarks/inline-arguments-local-escape.js:
510         * microbenchmarks/inline-get-scoped-var.js:
511         * microbenchmarks/inlined-put-by-id-transition.js:
512         * microbenchmarks/inlined-put-by-val-with-string-transition.js:
513         * microbenchmarks/inlined-put-by-val-with-symbol-transition.js:
514         * microbenchmarks/instanceof-always-hit-one.js:
515         * microbenchmarks/instanceof-always-hit-two.js:
516         * microbenchmarks/instanceof-bound.js:
517         * microbenchmarks/instanceof-dynamic.js:
518         * microbenchmarks/instanceof-sometimes-hit.js:
519         * microbenchmarks/instanceof-tricky-dynamic.js:
520         * microbenchmarks/int-or-other-abs-then-get-by-val.js:
521         * microbenchmarks/int-or-other-abs-zero-then-get-by-val.js:
522         * microbenchmarks/int-or-other-add-then-get-by-val.js:
523         * microbenchmarks/int-or-other-add.js:
524         * microbenchmarks/int-or-other-div-then-get-by-val.js:
525         * microbenchmarks/int-or-other-max-then-get-by-val.js:
526         * microbenchmarks/int-or-other-min-then-get-by-val.js:
527         * microbenchmarks/int-or-other-mod-then-get-by-val.js:
528         * microbenchmarks/int-or-other-mul-then-get-by-val.js:
529         * microbenchmarks/int-or-other-neg-then-get-by-val.js:
530         * microbenchmarks/int-or-other-neg-zero-then-get-by-val.js:
531         * microbenchmarks/int-or-other-sub-then-get-by-val.js:
532         * microbenchmarks/int-or-other-sub.js:
533         * microbenchmarks/int-overflow-local.js:
534         * microbenchmarks/int32-array-to-string.js:
535         * microbenchmarks/int52-back-and-forth.js:
536         * microbenchmarks/int52-rand-function.js:
537         * microbenchmarks/int52-spill.js:
538         * microbenchmarks/int8-out-of-bounds.js:
539         * microbenchmarks/integer-divide.js:
540         * microbenchmarks/integer-modulo.js:
541         * microbenchmarks/is-array-for-array.js:
542         * microbenchmarks/is-array-for-mixed-case.js:
543         * microbenchmarks/is-array-for-non-array-object.js:
544         * microbenchmarks/is-array-for-proxy.js:
545         * microbenchmarks/is-boolean-fold-tricky.js:
546         * microbenchmarks/is-boolean-fold.js:
547         * microbenchmarks/is-function-fold-tricky-internal-function.js:
548         * microbenchmarks/is-function-fold-tricky.js:
549         * microbenchmarks/is-function-fold.js:
550         * microbenchmarks/is-not-cell-speculation-for-empty-value.js:
551         * microbenchmarks/is-number-fold-tricky.js:
552         * microbenchmarks/is-number-fold.js:
553         * microbenchmarks/is-object-or-null-fold-functions.js:
554         * microbenchmarks/is-object-or-null-fold-less-tricky.js:
555         * microbenchmarks/is-object-or-null-fold-tricky.js:
556         * microbenchmarks/is-object-or-null-fold.js:
557         * microbenchmarks/is-object-or-null-trickier-function.js:
558         * microbenchmarks/is-object-or-null-trickier-internal-function.js:
559         * microbenchmarks/is-object-or-null-tricky-function.js:
560         * microbenchmarks/is-object-or-null-tricky-internal-function.js:
561         * microbenchmarks/is-string-fold-tricky.js:
562         * microbenchmarks/is-string-fold.js:
563         * microbenchmarks/is-symbol-mixed.js:
564         * microbenchmarks/is-symbol.js:
565         * microbenchmarks/is-undefined-fold-tricky.js:
566         * microbenchmarks/is-undefined-fold.js:
567         * microbenchmarks/json-parse-array-reviver-same-value.js:
568         * microbenchmarks/json-parse-array-reviver.js:
569         * microbenchmarks/json-parse-object-reviver-same-value.js:
570         * microbenchmarks/json-parse-object-reviver.js:
571         * microbenchmarks/large-empty-array-join-resolve-rope.js:
572         * microbenchmarks/large-empty-array-join.js:
573         * microbenchmarks/large-int-captured.js:
574         * microbenchmarks/large-int-neg.js:
575         * microbenchmarks/large-int.js:
576         * microbenchmarks/large-map-iteration.js:
577         * microbenchmarks/lazy-array-species-watchpoints.js:
578         * microbenchmarks/let-for-in.js:
579         * microbenchmarks/licm-dragons-out-of-bounds.js:
580         * microbenchmarks/licm-dragons-overflow.js:
581         * microbenchmarks/licm-dragons-two-structures.js:
582         * microbenchmarks/licm-dragons.js:
583         * microbenchmarks/load-varargs-elimination.js:
584         * microbenchmarks/locale-compare.js:
585         * microbenchmarks/logical-not-weird-types.js:
586         * microbenchmarks/logical-not.js:
587         * microbenchmarks/loop-osr-with-arity-mismatch.js:
588         * microbenchmarks/lots-of-fields.js:
589         * microbenchmarks/make-indexed-storage.js:
590         * microbenchmarks/make-rope-cse.js:
591         * microbenchmarks/make-rope.js:
592         * microbenchmarks/many-foreach-calls.js:
593         * microbenchmarks/many-repeat-stores.js:
594         * microbenchmarks/map-for-each.js:
595         * microbenchmarks/map-for-of.js:
596         * microbenchmarks/map-has-and-set.js:
597         * microbenchmarks/map-has-get-cse-opportunity.js:
598         * microbenchmarks/map-key-well-typed.js:
599         * microbenchmarks/map-rehash.js:
600         * microbenchmarks/marsaglia-larger-ints.js:
601         * microbenchmarks/marsaglia-osr-entry.js:
602         * microbenchmarks/math-random.js:
603         * microbenchmarks/math-trunc.js:
604         * microbenchmarks/math-with-out-of-bounds-array-values.js:
605         * microbenchmarks/max-boolean.js:
606         * microbenchmarks/megamorphic-load.js:
607         * microbenchmarks/memcpy-loop.js:
608         * microbenchmarks/memcpy-typed-loop-large.js:
609         * microbenchmarks/memcpy-typed-loop-small.js:
610         * microbenchmarks/memcpy-typed-loop-speculative.js:
611         * microbenchmarks/memcpy-typed-loop.js:
612         * microbenchmarks/memcpy-wasm-large.js:
613         * microbenchmarks/memcpy-wasm-medium.js:
614         * microbenchmarks/memcpy-wasm-small.js:
615         * microbenchmarks/memcpy-wasm.js:
616         * microbenchmarks/method-on-number.js:
617         * microbenchmarks/min-boolean.js:
618         * microbenchmarks/minus-boolean-double.js:
619         * microbenchmarks/minus-boolean.js:
620         * microbenchmarks/misc-strict-eq.js:
621         * microbenchmarks/mod-boolean-double.js:
622         * microbenchmarks/mod-boolean.js:
623         * microbenchmarks/mod-untyped.js:
624         * microbenchmarks/mul-boolean-double.js:
625         * microbenchmarks/mul-boolean.js:
626         * microbenchmarks/mul-immediate-sub.js:
627         * microbenchmarks/neg-boolean.js:
628         * microbenchmarks/negative-zero-divide.js:
629         * microbenchmarks/negative-zero-modulo.js:
630         * microbenchmarks/negative-zero-negate.js:
631         * microbenchmarks/new-array-buffer-dead.js:
632         * microbenchmarks/new-array-buffer-push.js:
633         * microbenchmarks/new-array-buffer-vector-profile.js:
634         * microbenchmarks/new-array-dead.js:
635         * microbenchmarks/new-array-push.js:
636         * microbenchmarks/new-error.js:
637         * microbenchmarks/no-inline-constructor.js:
638         * microbenchmarks/number-test.js:
639         * microbenchmarks/number-to-string-strength-reduction.js:
640         * microbenchmarks/number-to-string-with-add-empty.js:
641         * microbenchmarks/number-to-string-with-add-in-loop.js:
642         * microbenchmarks/number-to-string-with-add.js:
643         * microbenchmarks/number-to-string-with-radix-10.js:
644         * microbenchmarks/number-to-string-with-radix-cse.js:
645         * microbenchmarks/number-to-string-with-radix.js:
646         * microbenchmarks/object-and.js:
647         * microbenchmarks/object-closure-call.js:
648         * microbenchmarks/object-create-constant-prototype.js:
649         * microbenchmarks/object-create-null.js:
650         * microbenchmarks/object-create-unknown-object-prototype.js:
651         * microbenchmarks/object-create-untyped-prototype.js:
652         * microbenchmarks/object-entries.js:
653         * microbenchmarks/object-get-own-property-symbols-on-large-array.js:
654         * microbenchmarks/object-get-own-property-symbols.js:
655         * microbenchmarks/object-int-add-array.js:
656         * microbenchmarks/object-int-add.js:
657         * microbenchmarks/object-int-and-array.js:
658         * microbenchmarks/object-int-mul-array.js:
659         * microbenchmarks/object-int-sub-array.js:
660         * microbenchmarks/object-int-sub.js:
661         * microbenchmarks/object-is.js:
662         * microbenchmarks/object-iterate-symbols.js:
663         * microbenchmarks/object-iterate.js:
664         * microbenchmarks/object-keys-map-values.js:
665         * microbenchmarks/object-keys.js:
666         * microbenchmarks/object-lshift.js:
667         * microbenchmarks/object-or.js:
668         * microbenchmarks/object-rshift.js:
669         * microbenchmarks/object-test.js:
670         * microbenchmarks/object-urshift.js:
671         * microbenchmarks/object-values.js:
672         * microbenchmarks/object-xor.js:
673         * microbenchmarks/obvious-sink-pathology-taken.js:
674         * microbenchmarks/obvious-sink-pathology.js:
675         * microbenchmarks/obviously-elidable-new-object.js:
676         * microbenchmarks/plus-boolean-arith.js:
677         * microbenchmarks/plus-boolean-double.js:
678         * microbenchmarks/plus-boolean.js:
679         * microbenchmarks/poly-chain-access-different-prototypes-simple.js:
680         * microbenchmarks/poly-chain-access-different-prototypes.js:
681         * microbenchmarks/poly-chain-access-simpler.js:
682         * microbenchmarks/poly-chain-access.js:
683         * microbenchmarks/poly-proto-access.js:
684         * microbenchmarks/poly-proto-and-non-poly-proto-same-ic.js:
685         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js:
686         * microbenchmarks/poly-proto-put-transition-speed.js:
687         * microbenchmarks/poly-proto-setter-speed.js:
688         * microbenchmarks/poly-stricteq.js:
689         * microbenchmarks/polymorphic-array-call.js:
690         * microbenchmarks/polymorphic-get-by-id.js:
691         * microbenchmarks/polymorphic-put-by-id.js:
692         * microbenchmarks/polymorphic-put-by-val-with-string.js:
693         * microbenchmarks/polymorphic-put-by-val-with-symbol.js:
694         * microbenchmarks/polymorphic-structure.js:
695         * microbenchmarks/polyvariant-get-by-id-shorter-tower.js:
696         * microbenchmarks/polyvariant-get-by-id-tower.js:
697         * microbenchmarks/polyvariant-monomorphic-get-by-id.js:
698         * microbenchmarks/prevent-extensions-and-do-work.js:
699         * microbenchmarks/promise-creation-many.js:
700         * microbenchmarks/proto-getter-access.js:
701         * microbenchmarks/prototype-access-with-mutating-prototype.js:
702         * microbenchmarks/put-by-id-replace-and-transition.js:
703         * microbenchmarks/put-by-id-slightly-polymorphic.js:
704         * microbenchmarks/put-by-id-transition-with-indexing-header.js:
705         * microbenchmarks/put-by-id.js:
706         * microbenchmarks/put-by-val-direct-large-index.js:
707         * microbenchmarks/put-by-val-direct.js:
708         * microbenchmarks/put-by-val-large-index-blank-indexing-type.js:
709         * microbenchmarks/put-by-val-machine-int.js:
710         * microbenchmarks/put-by-val-negative-array-index.js:
711         * microbenchmarks/put-by-val-with-string-replace-and-transition.js:
712         * microbenchmarks/put-by-val-with-string-slightly-polymorphic.js:
713         * microbenchmarks/put-by-val-with-string.js:
714         * microbenchmarks/put-by-val-with-symbol-replace-and-transition.js:
715         * microbenchmarks/put-by-val-with-symbol-slightly-polymorphic.js:
716         * microbenchmarks/put-by-val-with-symbol.js:
717         * microbenchmarks/rare-osr-exit-on-local.js:
718         * microbenchmarks/raytrace-with-empty-try-catch.js:
719         * microbenchmarks/raytrace-with-try-catch.js:
720         * microbenchmarks/regexp-exec.js:
721         * microbenchmarks/regexp-last-index.js:
722         * microbenchmarks/regexp-nested-nonzero-min-counted-parens.js:
723         * microbenchmarks/regexp-prototype-is-not-instance.js:
724         * microbenchmarks/regexp-prototype-search-observable-side-effects.js:
725         * microbenchmarks/regexp-prototype-search-observable-side-effects2.js:
726         * microbenchmarks/regexp-prototype-split-observable-side-effects.js:
727         * microbenchmarks/regexp-prototype-split-observable-side-effects2.js:
728         * microbenchmarks/regexp-prototype-split-observable-side-effects3-flags.js:
729         * microbenchmarks/regexp-prototype-split-observable-side-effects3-global.js:
730         * microbenchmarks/regexp-prototype-split-observable-side-effects3-ignoreCase.js:
731         * microbenchmarks/regexp-prototype-split-observable-side-effects3-multiline.js:
732         * microbenchmarks/regexp-prototype-split-observable-side-effects3-sticky.js:
733         * microbenchmarks/regexp-prototype-split-observable-side-effects3-unicode.js:
734         * microbenchmarks/regexp-prototype-split-observable-side-effects4.js:
735         * microbenchmarks/regexp-prototype-test-observable-side-effects.js:
736         * microbenchmarks/regexp-prototype-test-observable-side-effects2.js:
737         * microbenchmarks/regexp-set-last-index.js:
738         * microbenchmarks/regexp-u-global-es5.js:
739         * microbenchmarks/regexp-u-global-es6.js:
740         * microbenchmarks/register-pressure-from-osr.js:
741         * microbenchmarks/repeat-multi-get-by-offset.js:
742         * microbenchmarks/rest-parameter-construction-performance.js:
743         * microbenchmarks/richards-empty-try-catch.js:
744         * microbenchmarks/richards-try-catch.js:
745         * microbenchmarks/scoped-arguments-length.js:
746         * microbenchmarks/scoped-arguments-overridden-length.js:
747         * microbenchmarks/scoped-arguments-possibly-overridden-length.js:
748         * microbenchmarks/seal-and-do-work.js:
749         * microbenchmarks/set-for-each.js:
750         * microbenchmarks/set-for-of.js:
751         * microbenchmarks/setter-prototype.js:
752         * microbenchmarks/setter.js:
753         * microbenchmarks/simple-activation-demo.js:
754         * microbenchmarks/simple-getter-access.js:
755         * microbenchmarks/simple-poly-call-nested.js:
756         * microbenchmarks/simple-poly-call.js:
757         * microbenchmarks/simple-regexp-exec-folding-fail.js:
758         * microbenchmarks/simple-regexp-exec-folding.js:
759         * microbenchmarks/simple-regexp-test-folding-fail-with-hoisted-regexp.js:
760         * microbenchmarks/simple-regexp-test-folding-fail.js:
761         * microbenchmarks/simple-regexp-test-folding-with-hoisted-regexp.js:
762         * microbenchmarks/simple-regexp-test-folding.js:
763         * microbenchmarks/sin-boolean.js:
764         * microbenchmarks/singleton-scope.js:
765         * microbenchmarks/sink-function.js:
766         * microbenchmarks/sink-huge-activation.js:
767         * microbenchmarks/sinkable-new-object-dag.js:
768         * microbenchmarks/sinkable-new-object-taken.js:
769         * microbenchmarks/sinkable-new-object-with-builtin-constructor.js:
770         * microbenchmarks/sinkable-new-object.js:
771         * microbenchmarks/slow-array-profile-convergence.js:
772         * microbenchmarks/slow-convergence.js:
773         * microbenchmarks/slow-ternaries.js:
774         * microbenchmarks/sorting-benchmark.js:
775         * microbenchmarks/sparse-conditional.js:
776         * microbenchmarks/sparse-set.js:
777         * microbenchmarks/splice-to-remove.js:
778         * microbenchmarks/strcat-const.js:
779         * microbenchmarks/strcat-length-const.js:
780         * microbenchmarks/strict-osr-entry.js:
781         * microbenchmarks/string-char-code-at.js:
782         * microbenchmarks/string-concat-convert.js:
783         * microbenchmarks/string-concat-long-convert.js:
784         * microbenchmarks/string-concat-long.js:
785         * microbenchmarks/string-concat-object.js:
786         * microbenchmarks/string-concat-pair-object.js:
787         * microbenchmarks/string-concat-pair-simple.js:
788         * microbenchmarks/string-concat-simple.js:
789         * microbenchmarks/string-concat.js:
790         * microbenchmarks/string-cons-repeat.js:
791         * microbenchmarks/string-cons-tower.js:
792         * microbenchmarks/string-equality.js:
793         * microbenchmarks/string-from-char-code.js:
794         * microbenchmarks/string-get-by-val-big-char.js:
795         * microbenchmarks/string-get-by-val-out-of-bounds-insane.js:
796         * microbenchmarks/string-get-by-val-out-of-bounds.js:
797         * microbenchmarks/string-get-by-val.js:
798         * microbenchmarks/string-hash.js:
799         * microbenchmarks/string-long-ident-equality.js:
800         * microbenchmarks/string-object-to-string.js:
801         * microbenchmarks/string-object-value-of.js:
802         * microbenchmarks/string-out-of-bounds.js:
803         * microbenchmarks/string-prototype-search-observable-side-effects.js:
804         * microbenchmarks/string-prototype-search-observable-side-effects2.js:
805         * microbenchmarks/string-prototype-search-observable-side-effects3.js:
806         * microbenchmarks/string-prototype-search-observable-side-effects4.js:
807         * microbenchmarks/string-prototype-split-observable-side-effects.js:
808         * microbenchmarks/string-prototype-split-observable-side-effects2.js:
809         * microbenchmarks/string-prototype-split-observable-side-effects3-flags.js:
810         * microbenchmarks/string-prototype-split-observable-side-effects3-global.js:
811         * microbenchmarks/string-prototype-split-observable-side-effects3-ignoreCase.js:
812         * microbenchmarks/string-prototype-split-observable-side-effects3-multiline.js:
813         * microbenchmarks/string-prototype-split-observable-side-effects3-sticky.js:
814         * microbenchmarks/string-prototype-split-observable-side-effects3-unicode.js:
815         * microbenchmarks/string-prototype-split-observable-side-effects4.js:
816         * microbenchmarks/string-repeat-arith.js:
817         * microbenchmarks/string-repeat-not-resolving-fixed.js:
818         * microbenchmarks/string-repeat-not-resolving-no-inline.js:
819         * microbenchmarks/string-repeat-not-resolving.js:
820         * microbenchmarks/string-repeat-resolving-fixed.js:
821         * microbenchmarks/string-repeat-resolving-no-inline.js:
822         * microbenchmarks/string-repeat-resolving.js:
823         * microbenchmarks/string-repeat-single-not-resolving.js:
824         * microbenchmarks/string-repeat-single-resolving.js:
825         * microbenchmarks/string-repeat-small-not-resolving.js:
826         * microbenchmarks/string-repeat-small-resolving.js:
827         * microbenchmarks/string-replace-empty.js:
828         * microbenchmarks/string-replace-generic.js:
829         * microbenchmarks/string-replace.js:
830         * microbenchmarks/string-rope-with-object.js:
831         * microbenchmarks/string-slice-empty.js:
832         * microbenchmarks/string-slice-one-char.js:
833         * microbenchmarks/string-slice.js:
834         * microbenchmarks/string-sub.js:
835         * microbenchmarks/string-test.js:
836         * microbenchmarks/string-transcoding.js:
837         * microbenchmarks/string-var-equality.js:
838         * microbenchmarks/stringalloc.js:
839         * microbenchmarks/structure-hoist-over-transitions.js:
840         * microbenchmarks/substring-concat-weird.js:
841         * microbenchmarks/substring-concat.js:
842         * microbenchmarks/substring.js:
843         * microbenchmarks/super-get-by-id-with-this-monomorphic.js:
844         * microbenchmarks/super-get-by-id-with-this-polymorphic.js:
845         * microbenchmarks/super-get-by-val-with-this-monomorphic.js:
846         * microbenchmarks/super-get-by-val-with-this-polymorphic.js:
847         * microbenchmarks/super-getter.js:
848         * microbenchmarks/switch-char-constant.js:
849         * microbenchmarks/switch-char.js:
850         * microbenchmarks/switch-constant.js:
851         * microbenchmarks/switch-string-basic-big-var.js:
852         * microbenchmarks/switch-string-basic-big.js:
853         * microbenchmarks/switch-string-basic-var.js:
854         * microbenchmarks/switch-string-basic.js:
855         * microbenchmarks/switch-string-big-length-tower-var.js:
856         * microbenchmarks/switch-string-length-tower-var.js:
857         * microbenchmarks/switch-string-length-tower.js:
858         * microbenchmarks/switch-string-short.js:
859         * microbenchmarks/switch.js:
860         * microbenchmarks/switching-size-classes.js:
861         * microbenchmarks/symbol-creation.js:
862         * microbenchmarks/symbol-tostringtag.js:
863         * microbenchmarks/tan.js:
864         * microbenchmarks/tear-off-arguments-simple.js:
865         * microbenchmarks/tear-off-arguments.js:
866         * microbenchmarks/template-string-array.js:
867         * microbenchmarks/temporal-structure.js:
868         * microbenchmarks/throw.js:
869         * microbenchmarks/to-int32-boolean.js:
870         * microbenchmarks/to-number-boolean.js:
871         * microbenchmarks/to-number-constructor-number-string-number-string.js:
872         * microbenchmarks/to-number-constructor-only-number.js:
873         * microbenchmarks/to-number-constructor-only-string.js:
874         * microbenchmarks/to-number-constructor-string-number-string-number.js:
875         * microbenchmarks/to-number-number-string-number-string.js:
876         * microbenchmarks/to-number-only-number.js:
877         * microbenchmarks/to-number-only-string.js:
878         * microbenchmarks/to-number-string-number-string-number.js:
879         * microbenchmarks/to-string-on-cow-array.js:
880         * microbenchmarks/try-catch-get-by-val-cloned-arguments.js:
881         * microbenchmarks/try-catch-get-by-val-direct-arguments.js:
882         * microbenchmarks/try-catch-get-by-val-scoped-arguments.js:
883         * microbenchmarks/try-catch-word-count.js:
884         * microbenchmarks/try-get-by-id-basic.js:
885         * microbenchmarks/try-get-by-id-polymorphic.js:
886         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
887         * microbenchmarks/typed-array-subarray.js:
888         * microbenchmarks/typed-array-sum.js:
889         * microbenchmarks/undefined-test.js:
890         * microbenchmarks/unprofiled-licm.js:
891         * microbenchmarks/untyped-string-from-char-code.js:
892         * microbenchmarks/v8-raytrace-with-empty-try-catch.js:
893         * microbenchmarks/v8-raytrace-with-try-catch.js:
894         * microbenchmarks/v8-regexp-search.js:
895         * microbenchmarks/varargs-call.js:
896         * microbenchmarks/varargs-construct-inline.js:
897         * microbenchmarks/varargs-construct.js:
898         * microbenchmarks/varargs-inline.js:
899         * microbenchmarks/varargs-strict-mode.js:
900         * microbenchmarks/varargs.js:
901         * microbenchmarks/vector-length-hint-array-constructor.js:
902         * microbenchmarks/vector-length-hint-new-array.js:
903         * microbenchmarks/weak-map-key.js:
904         * microbenchmarks/weak-set-key.js:
905         * microbenchmarks/weird-inlining-const-prop.js:
906
907 2019-10-22  Mark Lam  <mark.lam@apple.com>
908
909         Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky().
910         https://bugs.webkit.org/show_bug.cgi?id=203230
911         <rdar://problem/56460749>
912
913         Reviewed by Robin Morisset.
914
915         * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Added.
916
917 2019-10-21  Mark Lam  <mark.lam@apple.com>
918
919         Rolling out r251411: Fix is incorrect.
920         https://bugs.webkit.org/show_bug.cgi?id=203230
921
922         Not reviewed.
923
924         * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Removed.
925
926 2019-10-21  Mark Lam  <mark.lam@apple.com>
927
928         Fix incorrect assertion in operationRegExpExecNonGlobalOrSticky().
929         https://bugs.webkit.org/show_bug.cgi?id=203230
930         <rdar://problem/56460749>
931
932         Reviewed by Robin Morisset.
933
934         * stress/incorrect-exception-assertion-in-operationRegExpExecNonGlobalOrSticky.js: Added.
935
936 2019-10-21  Saam Barati  <sbarati@apple.com>
937
938         ValuePow's constant folding rule differs from what the runtime does
939         https://bugs.webkit.org/show_bug.cgi?id=203220
940         <rdar://problem/56181441>
941
942         Reviewed by Yusuke Suzuki.
943
944         * value-pow-ai-rule-should-box-the-same-way-as-the-runtime.js: Added.
945         (foo):
946
947 2019-10-21  Mark Lam  <mark.lam@apple.com>
948
949         Fix missing exception check in JSON Stringifier.
950         https://bugs.webkit.org/show_bug.cgi?id=203227
951         <rdar://problem/56459854>
952
953         Reviewed by Keith Miller.
954
955         * stress/missing-exception-check-in-josn-stringifier.js: Added.
956
957 2019-10-21  Saam Barati  <sbarati@apple.com>
958
959         JSON.parse has bad is array assert
960         https://bugs.webkit.org/show_bug.cgi?id=203207
961         <rdar://problem/56366913>
962
963         Reviewed by Yusuke Suzuki.
964
965         * stress/json-parse-array-prototype-is-array-assert.js: Added.
966         (assert):
967
968 2019-10-21  Robin Morisset  <rmorisset@apple.com>
969
970         Throw the right exception upon memory exhaustion in Array::slice
971         https://bugs.webkit.org/show_bug.cgi?id=202650
972
973         Reviewed by Saam Barati.
974
975         * stress/array-slice-memory-exhaustion.js: Added.
976         (foo):
977
978 2019-10-21  Robin Morisset  <rmorisset@apple.com>
979
980         Post increment/decrement should only call ToNumber once
981         https://bugs.webkit.org/show_bug.cgi?id=202711
982
983         Reviewed by Saam Barati.
984
985         * stress/postinc-custom-valueOf.js: Added.
986         (postInc):
987         (postDec):
988
989 2019-10-18  Yusuke Suzuki  <ysuzuki@apple.com>
990
991         [JSC] DFG::CommonData modification by DFG reallyAdd should be guarded by CodeBlock's lock
992         https://bugs.webkit.org/show_bug.cgi?id=203177
993
994         Reviewed by Mark Lam.
995
996         * stress/dfg-really-add-locking.js: Added.
997
998 2019-10-17  Mark Lam  <mark.lam@apple.com>
999
1000         Add missing checks after calls to the sameValue() JSValue comparator.
1001         https://bugs.webkit.org/show_bug.cgi?id=203126
1002         <rdar://problem/56366561>
1003
1004         Reviewed by Saam Barati.
1005
1006         * stress/validate-exception-check-in-proxy-object-put.js: Added.
1007
1008 2019-10-17  Saam Barati  <sbarati@apple.com>
1009
1010         GetByVal and PutByVal on ArrayStorage need to use the same AbstractHeap
1011         https://bugs.webkit.org/show_bug.cgi?id=203124
1012         <rdar://problem/55988183>
1013
1014         Reviewed by Yusuke Suzuki.
1015
1016         * stress/licm-array-storage-get-and-put-by-val.js: Added.
1017         (assert):
1018         (foo):
1019
1020 2019-10-16  Keith Miller  <keith_miller@apple.com>
1021
1022         Move assert in Wasm::Plan::fail.
1023         https://bugs.webkit.org/show_bug.cgi?id=203052
1024
1025         Reviewed by Mark Lam.
1026
1027         * wasm/regress/wasm-plan-fail-bad-error-message-assert.js: Added.
1028         (Binary):
1029         (Binary.prototype.trunc_buffer):
1030         (Binary.prototype.emit_leb_u):
1031         (Binary.prototype.emit_u32v):
1032         (Binary.prototype.emit_bytes):
1033         (Binary.prototype.emit_header):
1034         (__f_576):
1035         (__f_587):
1036
1037 2019-10-15  Mark Lam  <mark.lam@apple.com>
1038
1039         operationSwitchCharWithUnknownKeyType failed to handle OOME when resolving rope string.
1040         https://bugs.webkit.org/show_bug.cgi?id=202312
1041         <rdar://problem/55782280>
1042
1043         Reviewed by Yusuke Suzuki.
1044
1045         * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings.js: Added.
1046         * stress/operationSwitchCharWithUnknownKeyType-should-avoid-resolving-rope-strings2.js: Added.
1047         * stress/switch-on-char-llint-rope.js:
1048         - Changed this test to make a new rope string for each iterations.  Otherwise,
1049           the rope will get resolved, and subsequent tiers will not be testing with a rope.
1050
1051 2019-10-14  Yusuke Suzuki  <ysuzuki@apple.com>
1052
1053         [JSC] GetterSetter should be JSCell, not JSObject
1054         https://bugs.webkit.org/show_bug.cgi?id=202656
1055
1056         Reviewed by Tadeu Zagallo and Saam Barati.
1057
1058         * stress/getter-setter-should-be-cell.js: Added.
1059         (foo.with.):
1060         (foo.with.get for):
1061         (foo.with.bar):
1062         (foo):
1063
1064 2019-10-14  Saam Barati  <sbarati@apple.com>
1065
1066         Canonicalize how we prepare the prototype chain for inline caching
1067         https://bugs.webkit.org/show_bug.cgi?id=202827
1068         <rdar://problem/56193919>
1069
1070         Reviewed by Yusuke Suzuki.
1071
1072         * stress/cache-correct-offset-after-flattening.js: Added.
1073         (assert):
1074
1075 2019-10-14  Paulo Matos  <pmatos@igalia.com>
1076
1077         Skip memcpy-typed-loop timing out on ARMv7 pending investigation
1078         https://bugs.webkit.org/show_bug.cgi?id=202923
1079
1080         Reviewed by Adrian Perez de Castro.
1081
1082         * microbenchmarks/memcpy-typed-loop.js:
1083
1084 2019-10-11  Keith Miller  <keith_miller@apple.com>
1085
1086         Wasm B3IRGenerator should use arguments for control data.
1087         https://bugs.webkit.org/show_bug.cgi?id=202855
1088
1089         Reviewed by Yusuke Suzuki.
1090
1091         * wasm/stress/loop-more-args-than-results.js: Added.
1092
1093 2019-10-10  Mark Lam  <mark.lam@apple.com>
1094
1095         Modify JSTests/stress/string-overflow-createError-*.js tests to allow an OOME result.
1096         https://bugs.webkit.org/show_bug.cgi?id=202828
1097
1098         Reviewed by Yusuke Suzuki.
1099
1100         The tests intentionally allocate a very large string.  Hence, for some memory
1101         limited configurations, it is perfectly reasonable for the test to throw an Out
1102         Of Memory error.
1103
1104         * stress/string-overflow-createError-builder.js:
1105         * stress/string-overflow-createError-fit.js:
1106
1107 2019-10-09  Yusuke Suzuki  <ysuzuki@apple.com>
1108
1109         Unreviewed, roll out r250878
1110         https://bugs.webkit.org/show_bug.cgi?id=202656
1111
1112         Breaking vimeo page.
1113
1114         * stress/getter-setter-should-be-cell.js: Removed.
1115
1116 2019-10-08  Yusuke Suzuki  <ysuzuki@apple.com>
1117
1118         [JSC] GetterSetter should be JSCell, not JSObject
1119         https://bugs.webkit.org/show_bug.cgi?id=202656
1120
1121         Reviewed by Tadeu Zagallo and Saam Barati.
1122
1123         * stress/getter-setter-should-be-cell.js: Added.
1124         (foo.with.):
1125         (foo.with.get for):
1126         (foo.with.bar):
1127         (foo):
1128
1129 2019-10-08  Alexey Shvayka  <shvaikalesh@gmail.com>
1130
1131         JSON.parse incorrectly handles array proxies
1132         https://bugs.webkit.org/show_bug.cgi?id=199292
1133
1134         Reviewed by Saam Barati.
1135
1136         * microbenchmarks/json-parse-array-reviver-same-value.js: Added.
1137         * microbenchmarks/json-parse-array-reviver.js: Added.
1138         * microbenchmarks/json-parse-object-reviver-same-value.js: Added.
1139         * microbenchmarks/json-parse-object-reviver.js: Added.
1140         * stress/json-parse-reviver-array-proxy.js: Added.
1141         * stress/json-parse-reviver-revoked-proxy.js: Added.
1142         * test262/expectations.yaml: Mark 6 test cases as passing.
1143
1144 2019-10-08  Ross Kirsling  <ross.kirsling@sony.com>
1145
1146         Update test262 (2019.10.08).
1147
1148         Rubber-stamped by Keith Miller.
1149
1150         * test262/config.yaml:
1151         * test262/expectations.yaml:
1152         * test262/latest-changes-summary.txt:
1153         * test262/test/:
1154         * test262/test262-Revision.txt:
1155
1156 2019-10-07  Saam Barati  <sbarati@apple.com>
1157
1158         Allow OSR exit to the LLInt
1159         https://bugs.webkit.org/show_bug.cgi?id=197993
1160
1161         Reviewed by Tadeu Zagallo.
1162
1163         * stress/exit-from-getter-by-val.js: Added.
1164         * stress/exit-from-setter-by-val.js: Added.
1165
1166 2019-10-07  Matt Lewis  <jlewis3@apple.com>
1167
1168         Unreviewed, rolling out r250750.
1169
1170         Reverting change as this broke interal test over the weekend.
1171
1172         Reverted changeset:
1173
1174         "Allow OSR exit to the LLInt"
1175         https://bugs.webkit.org/show_bug.cgi?id=197993
1176         https://trac.webkit.org/changeset/250750
1177
1178 2019-10-04  Saam Barati  <sbarati@apple.com>
1179
1180         Allow OSR exit to the LLInt
1181         https://bugs.webkit.org/show_bug.cgi?id=197993
1182
1183         Reviewed by Tadeu Zagallo.
1184
1185         * stress/exit-from-getter-by-val.js: Added.
1186         * stress/exit-from-setter-by-val.js: Added.
1187
1188 2019-10-04  Paulo Matos  <pmatos@igalia.com>
1189
1190         Revert regexp test skip on armv7l and mips
1191         https://bugs.webkit.org/show_bug.cgi?id=202310
1192
1193         Reviewed by Žan Doberšek.
1194
1195         Test was skipped in bug 202113 on armv7l and mips due to bug 202041.
1196         Bug 202041 is fixed and change of bug 202113 can be reverted.
1197
1198         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
1199
1200 2019-10-02  Mark Lam  <mark.lam@apple.com>
1201
1202         DoubleToStringConverter::ToExponential() should null terminate its string.
1203         https://bugs.webkit.org/show_bug.cgi?id=202492
1204         <rdar://problem/55907708>
1205
1206         Reviewed by Filip Pizlo.
1207
1208         * stress/dtoa-AddSubstring-should-uses-strnlen-in-assertion.js: Added.
1209
1210 2019-10-02  Yusuke Suzuki  <ysuzuki@apple.com>
1211
1212         [JSC] AsyncGenerator should have internal fields
1213         https://bugs.webkit.org/show_bug.cgi?id=201498
1214
1215         Reviewed by Saam Barati.
1216
1217         * stress/async-generator-construct-failure.js: Added.
1218         (shouldThrow):
1219         (async.gen):
1220         (TypeError):
1221         * stress/async-generator-prototype-change.js: Added.
1222         (shouldBe):
1223         (async.gen):
1224         * stress/async-generator-prototype-closure.js: Added.
1225         (shouldBe):
1226         (test.async.gen):
1227         (test):
1228         * stress/create-async-generator.js: Added.
1229         (shouldBe):
1230         (test.async.generator):
1231         (test):
1232
1233 2019-10-01  Saam Barati  <sbarati@apple.com>
1234
1235         ObjectAllocationSinkingPhase shouldn't insert hints for allocations which are no longer valid
1236         https://bugs.webkit.org/show_bug.cgi?id=199361
1237         <rdar://problem/52454940>
1238
1239         Reviewed by Yusuke Suzuki.
1240
1241         * stress/allocation-sinking-hints-are-valid-ssa-2.js: Added.
1242         (main.fn):
1243         (main.executor):
1244         (main):
1245         * stress/allocation-sinking-hints-are-valid-ssa.js: Added.
1246         (main.fn):
1247         (main.executor):
1248         (main):
1249
1250 2019-10-01  Keith Miller  <keith_miller@apple.com>
1251
1252         skip test until we figure out why it's timing out
1253         https://bugs.webkit.org/show_bug.cgi?id=202423
1254
1255         Reviewed by Mark Lam.
1256
1257         new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js consistently times out on the bots.
1258         Let's skip it until we figure out what's going on.
1259
1260         * stress/new_array_with_spread-should-cap-array-size-to-MIN_ARRAY_STORAGE_CONSTRUCTION_LENGTH.js:
1261
1262 2019-10-01  Keith Miller  <keith_miller@apple.com>
1263
1264         Mark toctou test as skipped on debug builds
1265         https://bugs.webkit.org/show_bug.cgi?id=202420
1266
1267         Reviewed by Saam Barati.
1268
1269         Keeps timing out... Let's just skip it.
1270
1271         * stress/toctou-having-a-bad-time-new-array.js:
1272
1273 2019-10-01  Keith Miller  <keith_miller@apple.com>
1274
1275         Test262 update
1276
1277         Rubber-stamped by Michael Saboff.
1278
1279         Note, this was too big to effectivetly put on bugzilla as it's a 10MB patch...
1280
1281         * test262/*:
1282
1283 2019-10-01  Michael Saboff  <msaboff@apple.com> and Paulo Matos  <pmatos@igalia.com>
1284
1285         [YARR] Properly handle surrogates when matching back references
1286         https://bugs.webkit.org/show_bug.cgi?id=202041
1287
1288         Reviewed by Keith Miller.
1289
1290         Unchanged from the workin progress patch posted by Paulo Matos <pmatos@igalia.com>.
1291
1292         Updated test.
1293
1294         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
1295         (testRegExpNotMatch):
1296
1297 2019-10-01  Keith Miller  <keith_miller@apple.com>
1298
1299         Add support for the Wasm multi-value proposal
1300         https://bugs.webkit.org/show_bug.cgi?id=202250
1301
1302         Reviewed by Saam Barati.
1303
1304         This patch adds a new way to run stress tests via the .wat text
1305         format. By attaching an asm.js compiled version of the wabt tool
1306         we can easily create wat files programatically and convert them
1307         into a wasm blob to compile. To make this easy there is a
1308         wabt-wrapper.js module file that exports two useful functions that
1309         correspond to WebAssembly.compile and WebAssembly.instantiate.
1310
1311         * wasm.yaml:
1312         * wasm/function-tests/if-no-else-non-void.js:
1313         * wasm/js-api/web-assembly-instantiate.js:
1314         (assert.asyncTest.async.test):
1315         (assert.asyncTest):
1316         * wasm/libwabt.js: Added.
1317         (WabtModule):
1318         (set get if):
1319         * wasm/references/func_ref.js:
1320         * wasm/references/validation.js:
1321         (assert.throws):
1322         * wasm/spec-harness/index.js:
1323         * wasm/spec-tests/block.wast.js:
1324         * wasm/spec-tests/br.wast.js:
1325         * wasm/spec-tests/br_if.wast.js:
1326         * wasm/spec-tests/call.wast.js:
1327         * wasm/spec-tests/call_indirect.wast.js:
1328         * wasm/spec-tests/func.wast.js:
1329         * wasm/spec-tests/if.wast.js:
1330         * wasm/spec-tests/loop.wast.js:
1331         * wasm/spec-tests/type.wast.js:
1332         * wasm/stress/js-wasm-call-many-return-types-on-stack-no-args.js: Added.
1333         (buildWat):
1334         * wasm/stress/js-wasm-js-varying-arities.js: Added.
1335         (paramForwarder):
1336         * wasm/stress/wasm-js-call-many-return-types-on-stack-no-args.js: Added.
1337         (buildWat):
1338         * wasm/stress/wasm-js-multi-value-exception-in-iterator.js: Added.
1339         (buildWat.throwError):
1340         (buildWat.throwErrorInIterator):
1341         (buildWat.tooManyValues):
1342         (buildWat.tooFewValues):
1343         (buildWat):
1344         * wasm/stress/wasm-wasm-call-indirect-many-return-types-on-stack.js: Added.
1345         (buildWat):
1346         * wasm/stress/wasm-wasm-call-many-return-types-on-stack-no-args.js: Added.
1347         (buildWat):
1348         * wasm/wabt-wrapper.js: Added.
1349         (export.compile):
1350         * wasm/wast-tests/br-if-at-end-of-block.wasm: Added.
1351         * wasm/wast-tests/br-if-at-end-of-block.wast: Added.
1352         * wasm/wast-tests/harness.js:
1353         (async.runWasmFile):
1354         * wasm/wast-tests/single-param-loop-signature.wasm: Added.
1355         * wasm/wast-tests/single-param-loop-signature.wast: Added.
1356
1357 2019-09-30  Tadeu Zagallo  <tzagallo@apple.com>
1358
1359         Make assertion in JSObject::putOwnDataProperty more precise
1360         https://bugs.webkit.org/show_bug.cgi?id=202379
1361         <rdar://problem/49515980>
1362
1363         Reviewed by Yusuke Suzuki.
1364
1365         * stress/object-assign-target-proto-setter.js: Added.
1366         (get Object):
1367
1368 2019-09-30  Yusuke Suzuki  <ysuzuki@apple.com>
1369
1370         [JSC] HeapSnapshotBuilder m_rootData should be protected with a lock too
1371         https://bugs.webkit.org/show_bug.cgi?id=202389
1372         <rdar://problem/50717564>
1373
1374         Reviewed by Mark Lam.
1375
1376         * stress/heap-analyzer-taking-lock.js: Added.
1377
1378 2019-09-30  Saam Barati  <sbarati@apple.com>
1379
1380         Inline caching is wrong for custom accessors and custom values
1381         https://bugs.webkit.org/show_bug.cgi?id=201994
1382         <rdar://problem/50850326>
1383
1384         Reviewed by Yusuke Suzuki.
1385
1386         * microbenchmarks/custom-accessor-materialized.js: Added.
1387         (assert):
1388         (test4.get const):
1389         * microbenchmarks/custom-accessor-thin-air.js: Added.
1390         (assert):
1391         (test5.get const):
1392         (test5.get proto):
1393         * microbenchmarks/custom-accessor.js: Added.
1394         (assert):
1395         (test3.get const):
1396         * microbenchmarks/custom-value-2.js: Added.
1397         (assert):
1398         (test1.getMultiline):
1399         (test1):
1400         * microbenchmarks/custom-value.js: Added.
1401         (assert):
1402         (test1.getMultiline):
1403         (test1):
1404         * stress/custom-accessor-delete-1.js: Added.
1405         (assert):
1406         (test3.get const):
1407         * stress/custom-accessor-delete-2.js: Added.
1408         (assert):
1409         (test4.get const):
1410         * stress/custom-accessor-delete-3.js: Added.
1411         (assert):
1412         (test5.get const):
1413         (test5.get proto):
1414         * stress/custom-value-delete-property-1.js: Added.
1415         (assert):
1416         (test1.getMultiline):
1417         (test1):
1418         * stress/custom-value-delete-property-2.js: Added.
1419         (test2.foo):
1420         (test2):
1421         * stress/custom-value-delete-property-3.js: Added.
1422         (test6.foo):
1423         (test6):
1424
1425 2019-09-30  Yusuke Suzuki  <ysuzuki@apple.com>
1426
1427         [JSC] AI folds CompareEq wrongly when it sees proven Boolean and Number
1428         https://bugs.webkit.org/show_bug.cgi?id=202382
1429         <rdar://problem/52669112>
1430
1431         Reviewed by Saam Barati.
1432
1433         * stress/compare-eq-bool-number-folding.js: Added.
1434         (test):
1435
1436 2019-09-27  Yusuke Suzuki  <ysuzuki@apple.com>
1437
1438         [JSC] Keep JSString::value(ExecState*)'s result as String instead of `const String&`
1439         https://bugs.webkit.org/show_bug.cgi?id=202330
1440
1441         Reviewed by Saam Barati.
1442
1443         * stress/to-lower-case-gc-stress.js: Added.
1444
1445 2019-09-27  Alexey Shvayka  <shvaikalesh@gmail.com>
1446
1447         Non-standard Error properties should not be enumerable
1448         https://bugs.webkit.org/show_bug.cgi?id=198975
1449
1450         Reviewed by Ross Kirsling.
1451
1452         * ChakraCore/test/Error/NativeErrors_v4.baseline-jsc: Adjust expectations.
1453         * microbenchmarks/let-for-in.js: Adjust test.
1454         * test262/expectations.yaml: Mark 6 test cases as passing.
1455
1456 2019-09-26  Yusuke Suzuki  <ysuzuki@apple.com>
1457
1458         [JSC] DFG recursive-tail-call optimization should not emit jump to call-frame with varargs
1459         https://bugs.webkit.org/show_bug.cgi?id=202299
1460         <rdar://problem/52669116>
1461
1462         Reviewed by Saam Barati.
1463
1464         * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs-simple.js: Added.
1465         (foo):
1466         (test):
1467         * stress/recursive-tail-call-optimization-should-not-jump-into-call-frame-with-varargs.js: Added.
1468         (foo):
1469         (C1.prototype.baz):
1470         (C1):
1471         (bar):
1472         (noInline.bar.goo):
1473         (C2.prototype.baz):
1474         (C2):
1475         (test):
1476
1477 2019-09-26  Alexey Shvayka  <shvaikalesh@gmail.com>
1478
1479         toExponential, toFixed, and toPrecision should allow arguments up to 100
1480         https://bugs.webkit.org/show_bug.cgi?id=199163
1481
1482         Reviewed by Ross Kirsling.
1483
1484         * ChakraCore/test/Number/toString_3.baseline-jsc:
1485         * ChakraCore/test/es5/exceptions3.baseline-jsc:
1486         * test262/expectations.yaml: Mark 6 test cases as passing.
1487
1488 2019-09-24  Alexey Shvayka  <shvaikalesh@gmail.com>
1489
1490         [ES6] Come up with a test for Proxy.[[GetOwnProperty]] that tests the isExtensible error when the  result of the trap is undefined
1491         https://bugs.webkit.org/show_bug.cgi?id=154376
1492
1493         Reviewed by Ross Kirsling.
1494
1495         Adds 2 test cases:
1496         1. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is non-extensible, TypeError is thrown.
1497         2. If [[GetOwnProperty]] trap result is `undefined` and Proxy's target is another Proxy, its "isExtensible" trap is called.
1498
1499         * stress/proxy-get-own-property.js:
1500
1501 2019-09-24  Caio Lima  <ticaiolima@gmail.com>
1502
1503         [BigInt] Add ValueBitRShift into DFG
1504         https://bugs.webkit.org/show_bug.cgi?id=192663
1505
1506         Reviewed by Robin Morisset.
1507
1508         * stress/big-int-right-shift-jit-osr.js: Added.
1509         * stress/big-int-right-shift-jit-untyped.js: Added.
1510         * stress/big-int-right-shift-jit.js: Added.
1511         * stress/value-rshift-ai-rule.js: Added.
1512
1513 2019-09-23  Ross Kirsling  <ross.kirsling@sony.com>
1514
1515         Array methods should throw TypeError upon attempting to modify a string
1516         https://bugs.webkit.org/show_bug.cgi?id=201910
1517
1518         Reviewed by Keith Miller.
1519
1520         * stress/array-methods-should-not-modify-string.js: Added.
1521
1522         * mozilla/js1_6/Array/regress-304828.js:
1523         Fix test. Original copy was changed similarly seven years ago:
1524         https://searchfox.org/mozilla-central/source/js/src/tests/non262/Array/regress-304828.js
1525
1526         * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js:
1527         Fix test. `Object.__proto__ = []; Object.shift();` shouldn't be valid JS.
1528
1529 2019-09-23  Mark Lam  <mark.lam@apple.com>
1530
1531         Lazy JSGlobalObject property materialization should not use putDirectWithoutTransition.
1532         https://bugs.webkit.org/show_bug.cgi?id=202122
1533         <rdar://problem/55535249>
1534
1535         Reviewed by Yusuke Suzuki.
1536
1537         * stress/lazy-global-object-property-materialization-should-not-putDirectWithoutTransition.js: Added.
1538
1539 2019-09-23  Caio Lima  <ticaiolima@gmail.com>
1540
1541         Skip stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js into ARMv7 and MIPS
1542         https://bugs.webkit.org/show_bug.cgi?id=202113
1543
1544         Unreviewed test gardening, skipped test in ARMv7 and MIPS.
1545
1546         It is going to be fixed in
1547         https://bugs.webkit.org/show_bug.cgi?id=202041
1548
1549         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js:
1550
1551 2019-09-22  Yusuke Suzuki  <ysuzuki@apple.com>
1552
1553         [JSC] Int52Rep(DoubleRepAnyIntUse) should not call operation function
1554         https://bugs.webkit.org/show_bug.cgi?id=202072
1555
1556         Reviewed by Mark Lam.
1557
1558         * stress/int52rep-with-double-checks-int52-range.js: Added.
1559         (shouldBe):
1560         (test):
1561
1562 2019-09-21  Caio Lima  <ticaiolima@gmail.com>
1563
1564         stress/test-out-of-memory.js is not throwing OOM into ARMv7 and MIPS
1565         https://bugs.webkit.org/show_bug.cgi?id=202011
1566
1567         Reviewed by Mark Lam.
1568
1569         We are skipping this test into MIPS and ARMv7 because some of its assumptions
1570         are not valid for them. The current behavior of the test in those architectures
1571         is that it does not throw during `new ArrayBuffer(1000)` allocation site,
1572         because eden collection keeps happening between iterations. The collection
1573         is triggered on those architectures because the amount of stress 
1574         `new Promise` generates into GC limits is not enough to avoid them
1575         while loop is executing.
1576
1577         Changing the size of `UInt8Array` from `80000000` to `160000000` can
1578         be an alternative fix to avoid collection happening during `ArrayBuffer`
1579         allocation loop, but we can't guarantee this test is always going to execute
1580         without error when Gigacage is disabled, given we can reach an OOM state in
1581         some allocations that need to succeed, making this test flaky for those
1582         architectures.
1583
1584         * stress/test-out-of-memory.js:
1585
1586 2019-09-21  Tadeu Zagallo  <tzagallo@apple.com>
1587
1588         AccessCase should strongly visit its dependencies while on stack
1589         https://bugs.webkit.org/show_bug.cgi?id=201986
1590         <rdar://problem/55521953>
1591
1592         Reviewed by Saam Barati and Yusuke Suzuki.
1593
1594         * stress/ftl-put-by-id-setter-exception-interesting-live-state-2.js: Added.
1595         (foo):
1596         (warmup):
1597
1598 2019-09-20  Saam Barati  <sbarati@apple.com>
1599
1600         Unreviewed. Make toctou-having-a-bad-time-new-array.js run for less time because it's timing out on the debug bots.
1601
1602         * stress/toctou-having-a-bad-time-new-array.js:
1603
1604 2019-09-19  Yusuke Suzuki  <ysuzuki@apple.com>
1605
1606         [JSC] DFG op_call_varargs should not assume that one-previous-local of freeReg is usable
1607         https://bugs.webkit.org/show_bug.cgi?id=202014
1608
1609         Reviewed by Saam Barati.
1610
1611         * stress/call-varargs-inlining-should-not-clobber-previous-to-free-register.js: Added.
1612         (__v0):
1613
1614 2019-09-19  Tadeu Zagallo  <tzagallo@apple.com>
1615
1616         Syntax checker should report duplicate __proto__ properties
1617         https://bugs.webkit.org/show_bug.cgi?id=201897
1618         <rdar://problem/53201788>
1619
1620         Reviewed by Mark Lam.
1621
1622         * stress/syntax-checker-duplicate-underscore-proto.js: Added.
1623         (catch):
1624
1625 2019-09-18  Saam Barati  <sbarati@apple.com>
1626
1627         TOCTOU bug in havingABadTime related assertion in DFGSpeculativeJIT
1628         https://bugs.webkit.org/show_bug.cgi?id=201953
1629         <rdar://problem/53803524>
1630
1631         Reviewed by Yusuke Suzuki.
1632
1633         * stress/toctou-having-a-bad-time-new-array.js: Added.
1634         (let.code):
1635
1636 2019-09-18  Saam Barati  <sbarati@apple.com>
1637
1638         Phantom insertion phase may disagree with arguments forwarding about live ranges
1639         https://bugs.webkit.org/show_bug.cgi?id=200715
1640         <rdar://problem/54301717>
1641
1642         Reviewed by Yusuke Suzuki.
1643
1644         * stress/phantom-insertion-live-range-should-agree-with-arguments-forwarding.js: Added.
1645         (main.v23):
1646         (main.try.v43):
1647         (main.):
1648         (main):
1649
1650 2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>
1651
1652         [JSC] Generator should have internal fields
1653         https://bugs.webkit.org/show_bug.cgi?id=201159
1654
1655         Reviewed by Keith Miller.
1656
1657         * stress/create-generator.js: Added.
1658         (shouldBe):
1659         (test.generator):
1660         (test):
1661         * stress/generator-construct-failure.js: Added.
1662         (shouldThrow):
1663         (TypeError):
1664         * stress/generator-prototype-change.js: Added.
1665         (shouldBe):
1666         (gen):
1667         * stress/generator-prototype-closure.js: Added.
1668         (shouldBe):
1669         (test.gen):
1670         (test):
1671         * stress/object-assign-fast-path.js:
1672
1673 2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>
1674
1675         Follow-up after String.codePointAt optimization
1676         https://bugs.webkit.org/show_bug.cgi?id=201889
1677
1678         Reviewed by Saam Barati.
1679
1680         * stress/string-char-at-bad-type.js: Added.
1681         (shouldBe):
1682         (object.toString):
1683         (test):
1684         * stress/string-char-code-at-bad-type.js: Added.
1685         (shouldBe):
1686         (object.toString):
1687         (test):
1688         * stress/string-code-point-at-bad-type.js: Added.
1689         (shouldBe):
1690         (object.toString):
1691         (test):
1692
1693 2019-09-17  Yusuke Suzuki  <ysuzuki@apple.com>
1694
1695         [JSC] CheckArray+NonArray is not filtering out Array in AI
1696         https://bugs.webkit.org/show_bug.cgi?id=201857
1697         <rdar://problem/54194820>
1698
1699         Reviewed by Keith Miller.
1700
1701         * stress/check-array-with-non-array-does-not-filter-arrays.js: Added.
1702         (foo):
1703
1704 2019-09-17  Saam Barati  <sbarati@apple.com>
1705
1706         CheckArray on DirectArguments/ScopedArguments does not filter out slow put array storage
1707         https://bugs.webkit.org/show_bug.cgi?id=201853
1708         <rdar://problem/53805461>
1709
1710         Reviewed by Yusuke Suzuki.
1711
1712         * stress/direct-arguments-check-array-filter-type.js: Added.
1713         (foo):
1714
1715 2019-09-16  Tadeu Zagallo  <tzagallo@apple.com>
1716
1717         Wasm StreamingParser should validate that number of functions matches number of declarations
1718         https://bugs.webkit.org/show_bug.cgi?id=201850
1719         <rdar://problem/55290186>
1720
1721         Reviewed by Yusuke Suzuki.
1722
1723         * wasm/regress/validate-number-of-functions-match-declarations.js: Added.
1724         (catch):
1725
1726 2019-09-16  Michael Saboff  <msaboff@apple.com>
1727
1728         [JSC] Perform check again when we found non-BMP characters
1729         https://bugs.webkit.org/show_bug.cgi?id=201647
1730
1731         Reviewed by Yusuke Suzuki.
1732
1733         * stress/regexp-unicode-surrogate-pair-increment-should-involve-length-check.js: Added.
1734         * stress/regexp-unicode-within-string.js: Updated test to eliminate the bogus print().
1735         (testRegExpInbounds):
1736
1737 2019-09-16  Ross Kirsling  <ross.kirsling@sony.com>
1738
1739         [JSC] Add missing syntax errors for await in function parameter default expressions
1740         https://bugs.webkit.org/show_bug.cgi?id=201615
1741
1742         Reviewed by Darin Adler.
1743
1744         * stress/async-await-reserved-word.js:
1745         * stress/async-await-syntax.js:
1746         Add test cases.
1747
1748         * test262/expectations.yaml:
1749         Mark newly-passing test cases.
1750
1751 2019-09-16  Saam Barati  <sbarati@apple.com>
1752
1753         JSObject::putInlineSlow should not ignore "__proto__" for Proxy
1754         https://bugs.webkit.org/show_bug.cgi?id=200386
1755         <rdar://problem/53854946>
1756
1757         Reviewed by Yusuke Suzuki.
1758
1759         * stress/proxy-__proto__-in-prototype-chain.js: Added.
1760         * stress/proxy-property-replace-structure-transition.js: Added.
1761
1762 2019-09-13  Alexey Shvayka  <shvaikalesh@gmail.com>
1763
1764         Date.prototype.toJSON does not execute steps 1-2
1765         https://bugs.webkit.org/show_bug.cgi?id=105282
1766
1767         Reviewed by Ross Kirsling.
1768
1769         * test262/expectations.yaml: Mark 2 test cases as passing.
1770
1771 2019-09-12  Mark Lam  <mark.lam@apple.com>
1772
1773         Harden JSC against the abuse of runtime options.
1774         https://bugs.webkit.org/show_bug.cgi?id=201597
1775         <rdar://problem/55167068>
1776
1777         Reviewed by Filip Pizlo.
1778
1779         Remove the call to forceGCSlowPaths().  This utility function will be removed.
1780         The modern way to set the required option is to use //@ requireOptions.
1781
1782         * stress/ftl-try-catch-oom-error-lazy-slow-path.js:
1783
1784 2019-09-11  Yusuke Suzuki  <ysuzuki@apple.com>
1785
1786         [JSC] Add StringCodePointAt intrinsic
1787         https://bugs.webkit.org/show_bug.cgi?id=201673
1788
1789         Reviewed by Michael Saboff.
1790
1791         * stress/string-char-at-constant-index-out-of-range.js: Added.
1792         (shouldBe):
1793         (test):
1794         * stress/string-char-code-at-constant-index-out-of-range.js: Added.
1795         (shouldBe):
1796         (test):
1797         * stress/string-code-point-at--out-of-range.js: Added.
1798         (shouldBe):
1799         (test):
1800         * stress/string-code-point-at-basic.js: Added.
1801         (test):
1802         * stress/string-code-point-at-constant-index-out-of-range.js: Added.
1803         (shouldBe):
1804         (test):
1805         * stress/string-code-point-at-constant-int32-max-index-out-of-range.js: Added.
1806         (shouldBe):
1807         (test):
1808         * stress/string-code-point-at-constant-surrogate-pair.js: Added.
1809         (shouldBe):
1810         (test):
1811         (breaking):
1812         * stress/string-code-point-at-surrogate-pair.js: Added.
1813         (shouldBe):
1814         * stress/string-code-point-at.js: Added.
1815         (shouldBe):
1816
1817 2019-09-10  Michael Saboff  <msaboff@apple.com>
1818
1819         JSC crashes due to stack overflow while building RegExp
1820         https://bugs.webkit.org/show_bug.cgi?id=201649
1821
1822         Reviewed by Yusuke Suzuki.
1823
1824         New regression test.
1825
1826         * stress/regexp-bol-optimize-out-of-stack.js: Added.
1827         (test):
1828         (catch):
1829
1830 2019-09-10  Yusuke Suzuki  <ysuzuki@apple.com>
1831
1832         [WebAssembly] Use StreamingParser in existing Wasm::BBQPlan
1833         https://bugs.webkit.org/show_bug.cgi?id=189043
1834
1835         Reviewed by Keith Miller.
1836
1837         The offset performing the validation becomes a bit different.
1838         The offset 0 is nice since it is the starting offset of the Module header signature compared to the offset 8.
1839
1840         * wasm/js-api/version.js:
1841
1842 2019-09-07  Keith Miller  <keith_miller@apple.com>
1843
1844         OSR entry into wasm misses some contexts
1845         https://bugs.webkit.org/show_bug.cgi?id=201569
1846
1847         Reviewed by Yusuke Suzuki.
1848
1849         Add a new harness and wast and the generated wasm file for
1850         testing. The idea long term is to make it easy to test by creating
1851         a C file and converting it to a wast then modify that to produce a
1852         test.
1853
1854         * wasm.yaml:
1855         * wasm/wast-tests/harness.js: Added.
1856         (async.runWasmFile):
1857         * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wasm: Added.
1858         * wasm/wast-tests/osr-entry-inner-loop-branch-above-no-consts.wast: Added.
1859         * wasm/wast-tests/osr-entry-inner-loop-branch-above.wasm: Added.
1860         * wasm/wast-tests/osr-entry-inner-loop-branch-above.wast: Added.
1861         * wasm/wast-tests/osr-entry-inner-loop.wasm: Added.
1862         * wasm/wast-tests/osr-entry-inner-loop.wast: Added.
1863         * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wasm: Added.
1864         * wasm/wast-tests/osr-entry-multiple-enclosed-contexts.wast: Added.
1865
1866 2019-09-09  Yusuke Suzuki  <ysuzuki@apple.com>
1867
1868         [JSC] Promise resolve/reject functions should be created more efficiently
1869         https://bugs.webkit.org/show_bug.cgi?id=201488
1870
1871         Reviewed by Mark Lam.
1872
1873         * microbenchmarks/promise-creation-many.js: Added.
1874         (executor):
1875
1876 2019-09-09  Zan Dobersek  <zdobersek@igalia.com>
1877
1878         Unreviewed JSC test gardening.
1879
1880         * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js:
1881         This test allocates a 2GB string before it goes out and tests
1882         out-of-memory exception when appending other strings to it. As such,
1883         skip the test on memory-limited platforms.
1884
1885 2019-09-07  Mark Lam  <mark.lam@apple.com>
1886
1887         The jsc shell should allow disabling of the Gigacage for testing purposes.
1888         https://bugs.webkit.org/show_bug.cgi?id=201579
1889
1890         Reviewed by Michael Saboff.
1891
1892         Unskip the tests now.
1893
1894         * stress/disable-gigacage-arrays.js:
1895         * stress/disable-gigacage-strings.js:
1896         * stress/disable-gigacage-typed-arrays.js:
1897
1898 2019-09-07  Mark Lam  <mark.lam@apple.com>
1899
1900         Gardening: temporarily skipping these tests until the fix can be reviewed and landed.
1901
1902         Not reviewed.
1903
1904         See https://bugs.webkit.org/show_bug.cgi?id=201579 for the fix.
1905
1906         * stress/disable-gigacage-arrays.js:
1907         * stress/disable-gigacage-strings.js:
1908         * stress/disable-gigacage-typed-arrays.js:
1909
1910 2019-09-07  Mark Lam  <mark.lam@apple.com>
1911
1912         Gardening: speculative test fix to green bots [attempt #2].
1913         https://bugs.webkit.org/show_bug.cgi?id=201529
1914         <rdar://problem/53935772>
1915
1916         Not reviewed.
1917
1918         * stress/test-out-of-memory.js:
1919
1920 2019-09-06  Mark Lam  <mark.lam@apple.com>
1921
1922         Gardening: speculative test fix to green bots.
1923         https://bugs.webkit.org/show_bug.cgi?id=201529
1924         <rdar://problem/53935772>
1925
1926         Not reviewed.
1927
1928         * stress/test-out-of-memory.js:
1929
1930 2019-09-06  Ross Kirsling  <ross.kirsling@sony.com>
1931
1932         Math.round() produces wrong result for value prior to 0.5
1933         https://bugs.webkit.org/show_bug.cgi?id=185115
1934
1935         Reviewed by Saam Barati.
1936
1937         * stress/math-round-basics.js:
1938         Add positive/negative test cases.
1939
1940         * test262/expectations.yaml:
1941         Mark test passing.
1942
1943 2019-09-06  Mark Lam  <mark.lam@apple.com>
1944
1945         Move web-assembly-constructors-should-not-override-global-object-property.js below JSTests/wasm/stress.
1946         https://bugs.webkit.org/show_bug.cgi?id=201551
1947
1948         Reviewed by Tadeu Zagallo.
1949
1950         Ports that don't support WASM will always fail this test if it stays in JSTests/stress.
1951
1952         * stress/web-assembly-constructors-should-not-override-global-object-property.js: Removed.
1953         * wasm/stress/web-assembly-constructors-should-not-override-global-object-property.js: Copied from JSTests/stress/web-assembly-constructors-should-not-override-global-object-property.js.
1954
1955 2019-09-06  Mark Lam  <mark.lam@apple.com>
1956
1957         Fix bmalloc::Allocator:tryAllocate() to return null on failure to allocate.
1958         https://bugs.webkit.org/show_bug.cgi?id=201529
1959         <rdar://problem/53935772>
1960
1961         Reviewed by Yusuke Suzuki.
1962
1963         * stress/test-out-of-memory.js: Added.
1964
1965 2019-09-05  Tadeu Zagallo  <tzagallo@apple.com>
1966
1967         LazyClassStructure::setConstructor should not store the constructor to the global object
1968         https://bugs.webkit.org/show_bug.cgi?id=201484
1969         <rdar://problem/50400451>
1970
1971         Reviewed by Yusuke Suzuki.
1972
1973         * stress/web-assembly-constructors-should-not-override-global-object-property.js: Added.
1974
1975 2019-09-05  Yusuke Suzuki  <ysuzuki@apple.com>
1976
1977         [JSC] Do not use FTLOutput::weakPointer directly
1978         https://bugs.webkit.org/show_bug.cgi?id=201495
1979
1980         Reviewed by Filip Pizlo.
1981
1982         * stress/create-promise-weak-pointer.js: Added.
1983         (foo):
1984
1985 2019-09-04  Yusuke Suzuki  <ysuzuki@apple.com>
1986
1987         [JSC] Make Promise implementation faster
1988         https://bugs.webkit.org/show_bug.cgi?id=200898
1989
1990         Reviewed by Saam Barati.
1991
1992         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
1993         (assert.assert.return.throws):
1994         * modules/breaking-builtin-promise-then-does-not-break-internal-promise.js: Added.
1995         * modules/breaking-builtin-promise-then-does-not-break-internal-promise/test.js: Added.
1996         * stress/constructor-kind-naked-should-not-be-applied-to-inner-functions.js: Added.
1997         (shouldThrow):
1998         (new.Promise):
1999         (shouldThrow.Promise):
2000         * stress/create-promise-should-respect-promise-realm.js: Added.
2001         (shouldBe):
2002         (other.new.OtherPromise):
2003         (DerivedOtherPromise):
2004         (i.promise.new.DerivedOtherPromise):
2005         (createPromise):
2006         * stress/derived-promise-constructor-class-syntax-prototype-replace-attempt.js: Added.
2007         (shouldBe):
2008         (DerivedPromise):
2009         (i.array.push.new.DerivedPromise):
2010         (promise.new.DerivedPromise):
2011         * stress/derived-promise-constructor-inlined.js: Added.
2012         (shouldBe):
2013         (DerivedPromise):
2014         (i.array.push.new.DerivedPromise):
2015         (DerivedPromise.all.array.then):
2016         * stress/derived-promise-prototype-replaced.js: Added.
2017         (shouldBe):
2018         (DerivedPromise):
2019         (i.array.push.new.DerivedPromise):
2020         (promise.new.DerivedPromise):
2021         * stress/internal-promise-constructor-not-confusing.js: Added.
2022         (shouldBe):
2023         (InternalPromise.vm.createBuiltin):
2024         (DerivedPromise):
2025         * stress/internal-promise-is-not-exposed.js: Added.
2026         (shouldBe):
2027         * stress/new-promise-should-respect-promise-realm.js: Added.
2028         (shouldBe):
2029         (other.new.OtherPromise):
2030         (createPromise):
2031         * stress/promise-cannot-be-called.js:
2032         (shouldThrow):
2033         * stress/promise-capability-fast-path.js: Added.
2034         (shouldBe):
2035         (i.array.push.new.Promise):
2036         (i.array.i.then):
2037         * stress/promise-capability-slow-path.js: Added.
2038         (shouldBe):
2039         (Promise.prototype.then):
2040         (i.array.push.new.Promise):
2041         (i.array.i.then):
2042         * stress/promise-capability-then-slow-path.js: Added.
2043         (shouldBe):
2044         (DerivedPromise):
2045         (DerivedPromise.prototype.then):
2046         (i.array.push.new.DerivedPromise):
2047         (i.array.i.then):
2048         * stress/promise-constructor-inlined.js: Added.
2049         (shouldBe):
2050         (i.array.push.new.Promise):
2051         (Promise.all.array.then):
2052         * stress/promise-constructor-transition-from-new-promise-to-create-promise.js: Added.
2053         (shouldBe):
2054         (DerivedPromise):
2055         (DerivedPromise2):
2056         (i.array.push.new.DerivedPromise):
2057         (i.array2.push.new.DerivedPromise2):
2058         * stress/without-promise-functions.js: Added.
2059         (shouldBe):
2060         (async):
2061
2062 2019-09-03  Mark Lam  <mark.lam@apple.com>
2063
2064         Assertions in JSArrayBufferView::byteOffset() are only valid for the mutator thread.
2065         https://bugs.webkit.org/show_bug.cgi?id=201309
2066         <rdar://problem/54832121>
2067
2068         Reviewed by Yusuke Suzuki.
2069
2070         * stress/JSArrayBufferView-byteOffset-is-racy-from-compiler-thread.js: Added.
2071
2072 2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>
2073
2074         [JSC] Generate new.target register only when it is used
2075         https://bugs.webkit.org/show_bug.cgi?id=201335
2076
2077         Reviewed by Mark Lam.
2078
2079         * stress/ensure-new-register-allocated.js: Added.
2080         (shouldBe):
2081         (basic):
2082         (arrow):
2083         (Base):
2084         (Derived):
2085         (evaluate):
2086
2087 2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>
2088
2089         [JSC] DFG ByteCodeParser should not copy JIT-related part of SimpleJumpTable
2090         https://bugs.webkit.org/show_bug.cgi?id=201331
2091
2092         Reviewed by Mark Lam.
2093
2094         * stress/simple-jump-table-copy.js: Added.
2095         (let.code):
2096         (g2):
2097
2098 2019-08-30  Yusuke Suzuki  <ysuzuki@apple.com>
2099
2100         [JSC] DFG inlining CheckBadCell slow path does not assume result VirtualRegister can be invalid
2101         https://bugs.webkit.org/show_bug.cgi?id=201332
2102
2103         Reviewed by Mark Lam.
2104
2105         This test is very flaky, it is hard to reproduce.
2106
2107         * stress/setter-inlining-resulting-bad-cell-result-virtual-register-should-be-invalid.js: Added.
2108         (code):
2109
2110 2019-08-29  Yusuke Suzuki  <ysuzuki@apple.com>
2111
2112         [JSC] Repatch should construct CallCases and CasesValue at the same time
2113         https://bugs.webkit.org/show_bug.cgi?id=201325
2114
2115         Reviewed by Saam Barati.
2116
2117         * stress/repatch-switch.js: Added.
2118         (main.f2.f0):
2119         (main.f2.f3):
2120         (main.f2.f1):
2121         (main.f2):
2122         (main):
2123
2124 2019-08-29  Yusuke Suzuki  <ysuzuki@apple.com>
2125
2126         [JSC] ObjectAllocationSinkingPhase wrongly deals with always-taken branches during interpretation
2127         https://bugs.webkit.org/show_bug.cgi?id=198650
2128
2129         Reviewed by Saam Barati.
2130
2131         * stress/object-allocation-sinking-interpretation-can-interpret-edges-that-can-be-proven-unreachable-in-ai.js:
2132         (main.v0):
2133         (main):
2134
2135 2019-08-28  Mark Lam  <mark.lam@apple.com>
2136
2137         DFG/FTL: We should prefetch structures and do a loadLoadFence before doing PrototypeChainIsSane checks.
2138         https://bugs.webkit.org/show_bug.cgi?id=201281
2139         <rdar://problem/54028228>
2140
2141         Reviewed by Yusuke Suzuki and Saam Barati.
2142
2143         * stress/structure-storedPrototype-should-only-assert-on-the-mutator-thread.js: Added.
2144
2145 2019-08-28  Mark Lam  <mark.lam@apple.com>
2146
2147         Placate exception check validation in DFG's operationHasGenericProperty().
2148         https://bugs.webkit.org/show_bug.cgi?id=201245
2149         <rdar://problem/54777512>
2150
2151         Reviewed by Robin Morisset.
2152
2153         * stress/missing-exception-check-in-operationHasGenericProperty.js: Added.
2154
2155 2019-08-27  Mark Lam  <mark.lam@apple.com>
2156
2157         constructFunctionSkippingEvalEnabledCheck() should use tryMakeString() and check for OOM.
2158         https://bugs.webkit.org/show_bug.cgi?id=201196
2159         <rdar://problem/54703775>
2160
2161         Reviewed by Yusuke Suzuki.
2162
2163         * stress/constructFunctionSkippingEvalEnabledCheck-should-throw-out-of-memory-error.js: Added.
2164
2165 2019-08-26  Ross Kirsling  <ross.kirsling@sony.com>
2166
2167         [JSC] Ensure x?.y ?? z is fast
2168         https://bugs.webkit.org/show_bug.cgi?id=200875
2169
2170         Reviewed by Yusuke Suzuki.
2171
2172         * stress/nullish-coalescing.js:
2173
2174 2019-08-23  Tadeu Zagallo  <tzagallo@apple.com>
2175
2176         Remove MaximalFlushInsertionPhase
2177         https://bugs.webkit.org/show_bug.cgi?id=201036
2178
2179         Reviewed by Saam Barati.
2180
2181         Remove all the references to maximal flush
2182
2183         * stress/arith-ceil-on-various-types.js:
2184         (checkCompileCountForUselessNegativeZero):
2185         * stress/arith-floor-on-various-types.js:
2186         (checkCompileCountForUselessNegativeZero):
2187         * stress/arith-negate-on-various-types.js:
2188         (checkCompileCountForUselessNegativeZero):
2189         * stress/arith-round-on-various-types.js:
2190         (checkCompileCountForUselessNegativeZero):
2191         * stress/arith-trunc-on-various-types.js:
2192         (checkCompileCountForUselessNegativeZero):
2193         * stress/dfg-compare-eq-via-nonSpeculativeNonPeepholeCompareNullOrUndefined.js:
2194         * stress/has-indexed-property-should-accept-non-int32.js:
2195         * stress/has-indexed-property-with-worsening-array-mode.js:
2196         * stress/known-int32-cant-be-used-across-bytecode-boundary.js:
2197         * stress/read-dead-bytecode-locals-in-must-handle-values1.js:
2198         * stress/read-dead-bytecode-locals-in-must-handle-values2.js:
2199         * stress/rest-parameter-many-arguments.js:
2200         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness-2.js:
2201         * stress/set-argument-maybe-maximal-flush-should-not-extend-liveness.js:
2202         * stress/to-index-string-should-not-assume-incoming-value-is-uint32.js:
2203
2204 2019-08-23  Justin Michaud  <justin_michaud@apple.com>
2205
2206         [WASM-References] Do not overwrite argument registers in jsCallEntrypoint
2207         https://bugs.webkit.org/show_bug.cgi?id=200952
2208
2209         Reviewed by Saam Barati.
2210
2211         * wasm/references/func_ref.js:
2212         (assert.throws):
2213
2214 2019-08-22  Justin Michaud  <justin_michaud@apple.com>
2215
2216         Add missing exception check in canonicalizeLocaleList
2217         https://bugs.webkit.org/show_bug.cgi?id=201021
2218
2219         Reviewed by Mark Lam.
2220
2221         * stress/missing-exception-check-in-canonicalizeLocaleList.js: Added.
2222         (catch):
2223
2224 2019-08-21  Mark Lam  <mark.lam@apple.com>
2225
2226         Wasm::FunctionParser is failing to enforce maxFunctionLocals.
2227         https://bugs.webkit.org/show_bug.cgi?id=201016
2228         <rdar://problem/54579911>
2229
2230         Reviewed by Yusuke Suzuki.
2231
2232         * wasm/stress/too-many-locals.js: Added.
2233         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.catch):
2234
2235 2019-08-21  Ross Kirsling  <ross.kirsling@sony.com>
2236
2237         JSTests/stress/optional-chaining should not call shouldThrowTypeError in a loop
2238         https://bugs.webkit.org/show_bug.cgi?id=200965
2239
2240         Reviewed by Saam Barati.
2241
2242         This has nothing to do with ?. in particular, but throwing >1M type errors takes 100s in Debug on my machine.
2243         The main idea here was to JITify the simple success cases, so let's not run the simple failures so many times.
2244
2245         * stress/optional-chaining.js:
2246
2247 2019-08-21  Michael Saboff  <msaboff@apple.com>
2248
2249         [JSC] incorrent JIT lead to StackOverflow
2250         https://bugs.webkit.org/show_bug.cgi?id=197823
2251
2252         Reviewed by Tadeu Zagallo.
2253
2254         New test.
2255
2256         * stress/bound-function-stack-overflow.js: Added.
2257         (foo):
2258         (catch):
2259
2260 2019-08-20  Justin Michaud  <justin_michaud@apple.com>
2261
2262         Identify memcpy loops in b3
2263         https://bugs.webkit.org/show_bug.cgi?id=200181
2264
2265         Reviewed by Saam Barati.
2266
2267         * microbenchmarks/memcpy-loop.js: Added.
2268         (doTest):
2269         (let.arr1):
2270         * microbenchmarks/memcpy-typed-loop-large.js: Added.
2271         (doTest):
2272         (let.arr1.new.Int32Array.1000000.let.arr2.new.Int32Array.1000000):
2273         (arr2):
2274         * microbenchmarks/memcpy-typed-loop-small.js: Added.
2275         (doTest):
2276         (16.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
2277         (16.arr2):
2278         * microbenchmarks/memcpy-typed-loop-speculative.js: Added.
2279         (doTest):
2280         (let.arr1.new.Int32Array.10.let.arr2.new.Int32Array.10):
2281         (arr2):
2282         * microbenchmarks/memcpy-wasm-large.js: Added.
2283         (typeof.WebAssembly.string_appeared_here.eq):
2284         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
2285         * microbenchmarks/memcpy-wasm-medium.js: Added.
2286         (typeof.WebAssembly.string_appeared_here.eq):
2287         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
2288         * microbenchmarks/memcpy-wasm-small.js: Added.
2289         (typeof.WebAssembly.string_appeared_here.eq):
2290         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
2291         * microbenchmarks/memcpy-wasm.js: Added.
2292         (typeof.WebAssembly.string_appeared_here.eq):
2293         (typeof.WebAssembly.string_appeared_here.const.1.new.WebAssembly.Instance.new.WebAssembly.Module.new.Uint8Array):
2294         * stress/memcpy-typed-loops.js: Added.
2295         (noLoop):
2296         (invalidStart):
2297         (const.size.10.let.arr1.new.Int32Array.size.let.arr2.new.Int32Array.size):
2298         (arr2):
2299         * wasm/function-tests/memcpy-wasm-loop.js: Added.
2300         (0.GetLocal.3.I32Const.1.I32Add.SetLocal.3.Br.1.End.End.End.WebAssembly):
2301         (string_appeared_here):
2302
2303 2019-08-20  Yusuke Suzuki  <ysuzuki@apple.com>
2304
2305         [JSC] Array.prototype.toString should not get "join" function each time
2306         https://bugs.webkit.org/show_bug.cgi?id=200905
2307
2308         Reviewed by Mark Lam.
2309
2310         * stress/array-prototype-join-change.js: Added.
2311         (shouldBe):
2312         (array2.join):
2313         (DerivedArray):
2314         (DerivedArray.prototype.join):
2315         (array3.__proto__.join):
2316         (Array.prototype.join):
2317
2318 2019-08-20  Justin Michaud  <justin_michaud@apple.com>
2319
2320         Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
2321         https://bugs.webkit.org/show_bug.cgi?id=200782
2322
2323         Reviewed by Saam Barati.
2324
2325         Skip long memcpy test on debug, and try to fix flakiness for recompilation count tests by disabling cjit.
2326
2327         * microbenchmarks/memcpy-typed-loop.js:
2328         * stress/int8-repeat-in-then-out-of-bounds.js:
2329
2330 2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>
2331
2332         Proxy constructor should throw if handler is revoked Proxy
2333         https://bugs.webkit.org/show_bug.cgi?id=198755
2334
2335         Reviewed by Saam Barati.
2336
2337         * stress/proxy-revoke.js: Adjust error message.
2338         * test262/expectations.yaml: Mark 2 test cases as passing.
2339
2340 2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>
2341
2342         [JSC] OSR entry to Wasm OMG
2343         https://bugs.webkit.org/show_bug.cgi?id=200362
2344
2345         Reviewed by Michael Saboff.
2346
2347         * wasm/stress/osr-entry-basic.js: Added.
2348         (instance.exports.loop):
2349         * wasm/stress/osr-entry-many-locals-f32.js: Added.
2350         * wasm/stress/osr-entry-many-locals-f64.js: Added.
2351         * wasm/stress/osr-entry-many-locals-i32.js: Added.
2352         * wasm/stress/osr-entry-many-locals-i64.js: Added.
2353         * wasm/stress/osr-entry-many-stacks-f32.js: Added.
2354         * wasm/stress/osr-entry-many-stacks-f64.js: Added.
2355         * wasm/stress/osr-entry-many-stacks-i32.js: Added.
2356         * wasm/stress/osr-entry-many-stacks-i64.js: Added.
2357
2358 2019-08-19  Alexey Shvayka  <shvaikalesh@gmail.com>
2359
2360         Date.prototype.toJSON throws if toISOString returns an object
2361         https://bugs.webkit.org/show_bug.cgi?id=198495
2362
2363         Reviewed by Ross Kirsling.
2364
2365         * test262/expectations.yaml: Mark 6 test cases as passing.
2366
2367 2019-08-19  Yusuke Suzuki  <ysuzuki@apple.com>
2368
2369         [JSC] DFG DataView get/set optimization should take care of the case little-endian flag is JSEmpty
2370         https://bugs.webkit.org/show_bug.cgi?id=200899
2371         <rdar://problem/54073341>
2372
2373         Reviewed by Mark Lam.
2374
2375         * stress/data-view-get-dfg-should-handle-empty-constant.js: Added.
2376         (i.new.Promise):
2377         * stress/data-view-set-dfg-should-handle-empty-constant.js: Added.
2378         (i.new.Promise):
2379
2380 2019-08-19  Michael Saboff  <msaboff@apple.com>
2381
2382         Webkit jsc Crash in RegExp::matchInline (this=<optimized out>
2383         https://bugs.webkit.org/show_bug.cgi?id=197090
2384
2385         Reviewed by Yusuke Suzuki.
2386
2387         New test.
2388
2389         * stress/regexp-nonconsuming-counted-parens.js: Added.
2390
2391 2019-08-18  Ross Kirsling  <ross.kirsling@sony.com>
2392
2393         [JSC] Correct a->an in error messages and API docblocks
2394         https://bugs.webkit.org/show_bug.cgi?id=200833
2395
2396         Reviewed by Don Olmstead.
2397
2398         * ChakraCore/test/UnitTestFramework/UnitTestFramework.js:
2399         (assert.assert.return.throws):
2400         * stress/promise-finally-should-accept-non-promise-objects.js:
2401         * wasm/js-api/table.js:
2402         (assert.throws):
2403
2404 2019-08-17  Ross Kirsling  <ross.kirsling@sony.com>
2405
2406         [ESNext] Implement optional chaining
2407         https://bugs.webkit.org/show_bug.cgi?id=200199
2408
2409         Reviewed by Yusuke Suzuki.
2410
2411         * stress/nullish-coalescing.js:
2412         * stress/optional-chaining.js: Added.
2413         * stress/tail-call-recognize.js:
2414
2415 2019-08-17  Ross Kirsling  <ross.kirsling@sony.com>
2416
2417         [ESNext] Support hashbang.
2418         https://bugs.webkit.org/show_bug.cgi?id=200865
2419
2420         Reviewed by Mark Lam.
2421
2422         * stress/hashbang.js: Added.
2423         * test262/expectations.yaml: Mark 6 cases as passing.
2424
2425 2019-08-17  Yusuke Suzuki  <ysuzuki@apple.com>
2426
2427         [JSC] DFG ToNumber should support Boolean in fixup
2428         https://bugs.webkit.org/show_bug.cgi?id=200864
2429
2430         Reviewed by Mark Lam.
2431
2432         * microbenchmarks/to-number-boolean.js: Added.
2433         (test):
2434         * stress/to-number-boolean-int32.js: Added.
2435         (shouldBe):
2436         (test):
2437         (check):
2438         * stress/to-number-boolean.js: Added.
2439         (shouldBe):
2440         (test):
2441         (check):
2442         * stress/to-number-int32.js: Added.
2443         (shouldBe):
2444         (test):
2445         (check):
2446
2447 2019-08-16  Mark Lam  <mark.lam@apple.com>
2448
2449         More missing exception checks in string comparison operators.
2450         https://bugs.webkit.org/show_bug.cgi?id=200844
2451         <rdar://problem/54378684>
2452
2453         Reviewed by Saam Barati.
2454
2455         * stress/missing-exception-check-in-string-greater-than-compare.js: Added.
2456         * stress/missing-exception-check-in-string-greater-than-or-equal-compare.js: Added.
2457         * stress/missing-exception-check-in-string-less-than-compare.js: Added.
2458         * stress/missing-exception-check-in-string-less-than-or-equal-compare.js: Added.
2459
2460 2019-08-16  Mark Lam  <mark.lam@apple.com>
2461
2462         CodeBlock destructor should clear all of its watchpoints.
2463         https://bugs.webkit.org/show_bug.cgi?id=200792
2464         <rdar://problem/53947800>
2465
2466         Reviewed by Yusuke Suzuki.
2467
2468         * stress/codeblock-should-clear-watchpoints-on-destruction.js: Added.
2469
2470 2019-08-16  Justin Michaud  <justin_michaud@apple.com>
2471
2472         Fix InBounds speculation of typed array PutByVal and add extra step to integer range optimization to search for equality relationships on the RHS value
2473         https://bugs.webkit.org/show_bug.cgi?id=200782
2474
2475         Reviewed by Saam Barati.
2476
2477         * microbenchmarks/int8-out-of-bounds.js: Added.
2478         (foo):
2479         * microbenchmarks/memcpy-typed-loop.js: Added.
2480         (doTest):
2481         (let.arr1.new.Int32Array.1000.let.arr2.new.Int32Array.1000):
2482         (arr2):
2483         * stress/int8-repeat-in-then-out-of-bounds.js: Added.
2484         (foo):
2485
2486 2019-08-16  Mark Lam  <mark.lam@apple.com>
2487
2488         [Re-land] ProxyObject should not be allow to access its target's private properties.
2489         https://bugs.webkit.org/show_bug.cgi?id=200739
2490         <rdar://problem/53972768>
2491
2492         Reviewed by Yusuke Suzuki.
2493
2494         * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Copied from JSTests/stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js.
2495         * stress/proxy-with-private-symbols.js:
2496
2497 2019-08-16  Yusuke Suzuki  <ysuzuki@apple.com>
2498
2499         [JSC] Promise.prototype.finally should accept non-promise objects
2500         https://bugs.webkit.org/show_bug.cgi?id=200829
2501
2502         Reviewed by Mark Lam.
2503
2504         * stress/promise-finally-should-accept-non-promise-objects.js: Added.
2505         (shouldBe):
2506         (Thenable):
2507         (Thenable.prototype.then):
2508
2509 2019-08-16  Alexey Shvayka  <shvaikalesh@gmail.com>
2510
2511         Promise constructor should check argument before [[Construct]]
2512         https://bugs.webkit.org/show_bug.cgi?id=198976
2513
2514         Reviewed by Ross Kirsling.
2515
2516         * stress/create-subclass-structure-may-throw-exception-when-getting-prototype.js: Fix test.
2517         * stress/create-subclass-structure-might-throw.js: Fix test.
2518         * test262/expectations.yaml: Mark 2 test cases as passing.
2519
2520 2019-08-16  Ryan Haddad  <ryanhaddad@apple.com>
2521
2522         Unreviewed, rolling out r248709.
2523
2524         Caused test/built-ins/Promise/prototype/finally/this-value-
2525         non-promise.js to fail on test262 bot
2526
2527         Reverted changeset:
2528
2529         "ProxyObject should not be allow to access its target's
2530         private properties."
2531         https://bugs.webkit.org/show_bug.cgi?id=200739
2532         https://trac.webkit.org/changeset/248709
2533
2534 2019-08-15  Alexey Shvayka  <shvaikalesh@gmail.com>
2535
2536         DateConversion::formatDateTime incorrectly formats negative years
2537         https://bugs.webkit.org/show_bug.cgi?id=199964
2538
2539         Reviewed by Ross Kirsling.
2540
2541         * test262/expectations.yaml: Mark 6 test cases as passing.
2542
2543 2019-08-15  Mark Lam  <mark.lam@apple.com>
2544
2545         More missing exception checks in String.prototype.
2546         https://bugs.webkit.org/show_bug.cgi?id=200762
2547         <rdar://problem/54333896>
2548
2549         Reviewed by Michael Saboff.
2550
2551         * stress/missing-exception-check-in-string-lastIndexOf.js: Added.
2552         * stress/missing-exception-check-in-string-toLower.js: Added.
2553         * stress/missing-exception-check-in-string-toUpper.js: Added.
2554
2555 2019-08-14  Mark Lam  <mark.lam@apple.com>
2556
2557         ProxyObject should not be allow to access its target's private properties.
2558         https://bugs.webkit.org/show_bug.cgi?id=200739
2559         <rdar://problem/53972768>
2560
2561         Reviewed by Yusuke Suzuki.
2562
2563         * stress/proxy-should-not-be-allowed-to-access-private-properties-of-target.js: Added.
2564         * stress/proxy-with-private-symbols.js: Rebased.
2565
2566 2019-08-14  Mark Lam  <mark.lam@apple.com>
2567
2568         Missing exception check in string compare.
2569         https://bugs.webkit.org/show_bug.cgi?id=200743
2570         <rdar://problem/53975356>
2571
2572         Reviewed by Michael Saboff.
2573
2574         * stress/missing-exception-check-in-string-compare.js: Added.
2575
2576 2019-08-08  Ross Kirsling  <ross.kirsling@sony.com>
2577
2578         [JSC] Add "jump if (not) undefined or null" bytecode ops
2579         https://bugs.webkit.org/show_bug.cgi?id=200480
2580
2581         Reviewed by Saam Barati.
2582
2583         * stress/destructuring-assignment-require-object-coercible.js:
2584         * stress/nullish-coalescing.js:
2585
2586 2019-08-05  Michael Saboff  <msaboff@apple.com>
2587
2588         JSC: assertion failure in SpeculativeJIT::compileGetByValOnIntTypedArray
2589         https://bugs.webkit.org/show_bug.cgi?id=199997
2590
2591         Reviewed by Saam Barati.
2592
2593         New test.
2594
2595         * stress/typedarray-no-alreadyChecked-assert.js: Added.
2596         (checkIntArray):
2597         (checkFloatArray):
2598
2599 2019-08-02  Yusuke Suzuki  <ysuzuki@apple.com>
2600
2601         [JSC] Support WebAssembly in SamplingProfiler
2602         https://bugs.webkit.org/show_bug.cgi?id=200329
2603
2604         Reviewed by Saam Barati.
2605
2606         * stress/sampling-profiler-wasm-name-section.js: Added.
2607         (const.compile):
2608         (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
2609         (platformSupportsSamplingProfiler.vm.isWasmSupported):
2610         * stress/sampling-profiler-wasm.js: Added.
2611         (platformSupportsSamplingProfiler.vm.isWasmSupported.wasmEntry):
2612         (platformSupportsSamplingProfiler.vm.isWasmSupported):
2613         * stress/sampling-profiler/loop.wasm: Added.
2614         * stress/sampling-profiler/loop.wast: Added.
2615         * stress/sampling-profiler/nameSection.wasm: Added.
2616
2617 2019-08-02  Yusuke Suzuki  <ysuzuki@apple.com>
2618
2619         [JSC] LazyJSValue should be robust for empty JSValue
2620         https://bugs.webkit.org/show_bug.cgi?id=200388
2621
2622         Reviewed by Saam Barati.
2623
2624         * stress/switch-constant-child-becomes-empty.js: Added.
2625         (foo):
2626
2627 2019-08-01  Yusuke Suzuki  <ysuzuki@apple.com>
2628
2629         GetterSetter type confusion during DFG compilation
2630         https://bugs.webkit.org/show_bug.cgi?id=199903
2631
2632         Reviewed by Mark Lam.
2633
2634         * stress/cse-propagated-constant-may-not-follow-structure-restrictions.js: Added.
2635
2636 2019-08-01  Ross Kirsling  <ross.kirsling@sony.com>
2637
2638         Update Test262 (2019.08.01)
2639         https://bugs.webkit.org/show_bug.cgi?id=200351
2640
2641         Reviewed by Keith Miller.
2642
2643         * test262/expectations.yaml:
2644         * test262/harness/testIntl.js:
2645         * test262/latest-changes-summary.txt:
2646         * test262/test/:
2647         * test262/test262-Revision.txt:
2648
2649 2019-07-30  Yusuke Suzuki  <ysuzuki@apple.com>
2650
2651         [JSC] Make StructureChain less-tricky by using Auxiliary Buffer
2652         https://bugs.webkit.org/show_bug.cgi?id=200192
2653
2654         Reviewed by Saam Barati.
2655
2656         * stress/structure-chain-stress.js: Added.
2657         (keys):
2658
2659 2019-07-29  Yusuke Suzuki  <ysuzuki@apple.com>
2660
2661         [JSC] Increment bytecode age only when SlotVisitor is first-visit
2662         https://bugs.webkit.org/show_bug.cgi?id=200196
2663
2664         Reviewed by Robin Morisset.
2665
2666         * stress/reparsing-unlinked-codeblock.js:
2667
2668 2019-07-29  Justin Michaud  <justin_michaud@apple.com>
2669
2670         [X86] Emit BT instruction for shift + mask in B3
2671         https://bugs.webkit.org/show_bug.cgi?id=199891
2672
2673         Reviewed by Robin Morisset.
2674
2675         Lower the number of iterations to fix debug timeouts.
2676
2677         * microbenchmarks/bit-test-load.js:
2678         (i):
2679
2680 2019-07-27  Justin Michaud  <justin_michaud@apple.com>
2681
2682         [X86] Emit BT instruction for shift + mask in B3
2683         https://bugs.webkit.org/show_bug.cgi?id=199891
2684
2685         Reviewed by Keith Miller.
2686
2687         * microbenchmarks/bit-test-constant.js: Added.
2688         (let.glob.0.doTest):
2689         * microbenchmarks/bit-test-load.js: Added.
2690         (let.glob.0.let.arr.new.Int32Array.8.doTest):
2691         (i):
2692         * microbenchmarks/bit-test-nonconstant.js: Added.
2693         (let.glob.0.doTest):
2694
2695 2019-07-26  Yusuke Suzuki  <ysuzuki@apple.com>
2696
2697         [JSC] Potential GC fix for JSPropertyNameEnumerator
2698         https://bugs.webkit.org/show_bug.cgi?id=200151
2699
2700         Reviewed by Mark Lam.
2701
2702         * stress/for-in-stress.js: Added.
2703         (keys):
2704
2705 2019-07-25  Ross Kirsling  <ross.kirsling@sony.com>
2706
2707         Legacy numeric literals should not permit separators or BigInt
2708         https://bugs.webkit.org/show_bug.cgi?id=199984
2709
2710         Reviewed by Keith Miller.
2711
2712         * stress/big-int-literals.js:
2713         * stress/numeric-literal-separators.js:
2714
2715 2019-07-25  Ross Kirsling  <ross.kirsling@sony.com>
2716
2717         [ESNext] Implement nullish coalescing
2718         https://bugs.webkit.org/show_bug.cgi?id=200072
2719
2720         Reviewed by Darin Adler.
2721
2722         * stress/nullish-coalescing.js: Added.
2723
2724 2019-07-24  Alexey Shvayka  <shvaikalesh@gmail.com>
2725
2726         Three checks are missing in Proxy internal methods
2727         https://bugs.webkit.org/show_bug.cgi?id=198630
2728
2729         Reviewed by Darin Adler.
2730
2731         * stress/proxy-delete.js: Assert isExtensible is called in correct order.
2732         * test262/expectations.yaml: Mark 6 test cases as passing.
2733
2734 2019-07-23  Justin Michaud  <justin_michaud@apple.com>
2735
2736         Sometimes we miss removable CheckInBounds
2737         https://bugs.webkit.org/show_bug.cgi?id=200018
2738
2739         Reviewed by Saam Barati.
2740
2741         * microbenchmarks/typed-array-sum.js: Added.
2742         (doTest):
2743
2744 2019-07-16  Mark Lam  <mark.lam@apple.com>
2745
2746         ArgumentsEliminationPhase should insert KillStack nodes before PutStack nodes that it adds.
2747         https://bugs.webkit.org/show_bug.cgi?id=199821
2748         <rdar://problem/52452328>
2749
2750         Reviewed by Filip Pizlo.
2751
2752         * stress/arguments-elimination-should-insert-KillStacks-before-added-PutStacks.js: Added.
2753
2754 2019-07-16  Keith Miller  <keith_miller@apple.com>
2755
2756         Unreviewed, test262 gardening.
2757
2758         * test262/expectations.yaml:
2759
2760 2019-07-15  Keith Miller  <keith_miller@apple.com>
2761
2762         A Possible Issue of Object.create method
2763         https://bugs.webkit.org/show_bug.cgi?id=199744
2764
2765         Reviewed by Yusuke Suzuki.
2766
2767         * stress/object-create-non-object-properties-parameter.js: Added.
2768         (catch):
2769
2770 2019-07-15  Keith Miller  <keith_miller@apple.com>
2771
2772         Update test262
2773         https://bugs.webkit.org/show_bug.cgi?id=199801
2774
2775         Rubber-stamped by Yusuke Suzuki.
2776
2777         * test262/expectations.yaml:
2778         * test262/latest-changes-summary.txt:
2779         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/Symbol.toStringTag.js: Added.
2780         (fg.new.FinalizationGroup):
2781         (callback):
2782         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-job-not-active-throws.js: Added.
2783         (fg.new.FinalizationGroup):
2784         (callback):
2785         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-length.js: Added.
2786         (fg.new.FinalizationGroup):
2787         (callback):
2788         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-missing-internal-throws.js: Added.
2789         (fg.new.FinalizationGroup):
2790         (callback):
2791         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-name.js: Added.
2792         (fg.new.FinalizationGroup):
2793         (callback):
2794         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-not-object-throws.js: Added.
2795         (fg.new.FinalizationGroup):
2796         (callback):
2797         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/next-prop-desc.js: Added.
2798         (fg.new.FinalizationGroup):
2799         (callback):
2800         * test262/test/built-ins/FinalizationGroup/FinalizationGroupCleanupIteratorPrototype/proto.js: Added.
2801         (callback):
2802         (fg.new.FinalizationGroup):
2803         * test262/test/built-ins/FinalizationGroup/constructor.js: Added.
2804         * test262/test/built-ins/FinalizationGroup/gc-has-one-chance-to-call-cleanupCallback.js: Added.
2805         (cb):
2806         (fg.new.FinalizationGroup):
2807         (emptyCells):
2808         (async.fn):
2809         (fn.then.async):
2810         * test262/test/built-ins/FinalizationGroup/instance-extensible.js: Added.
2811         (fg.new.FinalizationGroup):
2812         * test262/test/built-ins/FinalizationGroup/length.js: Added.
2813         * test262/test/built-ins/FinalizationGroup/name.js: Added.
2814         * test262/test/built-ins/FinalizationGroup/newtarget-prototype-is-not-object.js: Added.
2815         (newTarget):
2816         (fn):
2817         * test262/test/built-ins/FinalizationGroup/prop-desc.js: Added.
2818         * test262/test/built-ins/FinalizationGroup/proto-from-ctor-realm.js: Added.
2819         (fn):
2820         * test262/test/built-ins/FinalizationGroup/proto.js: Added.
2821         * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-abrupt.js: Added.
2822         (newTarget):
2823         * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget-custom.js: Added.
2824         (newTarget):
2825         * test262/test/built-ins/FinalizationGroup/prototype-from-newtarget.js: Added.
2826         (fg.new.FinalizationGroup):
2827         * test262/test/built-ins/FinalizationGroup/prototype/Symbol.toStringTag.js: Added.
2828         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-iterator-proto.js: Added.
2829         (callback):
2830         (fg.new.FinalizationGroup):
2831         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/callback-not-callable-throws.js: Added.
2832         (fg.new.FinalizationGroup):
2833         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-reference.js: Added.
2834         (cb):
2835         (fg.new.FinalizationGroup):
2836         (emptyCells):
2837         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanup-prevented-with-unregister.js: Added.
2838         (fg.new.FinalizationGroup):
2839         (fg.cleanupSome.cb):
2840         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/cleanupcallback-iterator-proto.js: Added.
2841         (callback):
2842         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/custom-this.js: Added.
2843         (fn):
2844         (cb):
2845         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/gc-cleanup-not-prevented-with-wr-deref.js: Added.
2846         (cb):
2847         (fg.new.FinalizationGroup):
2848         (emptyCells):
2849         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-dynamic.js: Added.
2850         (fg.new.FinalizationGroup):
2851         (callback):
2852         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/iterator-holdings-multiple-values.js: Added.
2853         (fg.new.FinalizationGroup):
2854         (callback):
2855         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/length.js: Added.
2856         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/name.js: Added.
2857         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-callback-throws.js: Added.
2858         (poisoned):
2859         (fg.new.FinalizationGroup):
2860         (emptyCells):
2861         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/poisoned-cleanup-callback-throws.js: Added.
2862         (poisoned):
2863         (emptyCells):
2864         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/prop-desc.js: Added.
2865         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined-with-gc.js: Added.
2866         (fn):
2867         (cb):
2868         (emptyCells):
2869         (prototype.assert.sameValue.fg.cleanupSome):
2870         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/return-undefined.js: Added.
2871         (fn):
2872         (cb):
2873         (poisoned):
2874         (assert.sameValue.fg.cleanupSome):
2875         (prototype.assert.sameValue.fg.cleanupSome):
2876         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-does-not-have-internal-cells-throws.js: Added.
2877         (cb):
2878         * test262/test/built-ins/FinalizationGroup/prototype/cleanupSome/this-not-object-throws.js: Added.
2879         (cb):
2880         * test262/test/built-ins/FinalizationGroup/prototype/constructor.js: Added.
2881         * test262/test/built-ins/FinalizationGroup/prototype/prop-desc.js: Added.
2882         * test262/test/built-ins/FinalizationGroup/prototype/proto.js: Added.
2883         * test262/test/built-ins/FinalizationGroup/prototype/register/custom-this.js: Added.
2884         (fn):
2885         * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-any-value-type.js: Added.
2886         (fn):
2887         * test262/test/built-ins/FinalizationGroup/prototype/register/holdings-same-as-target.js: Added.
2888         (fg.new.FinalizationGroup):
2889         * test262/test/built-ins/FinalizationGroup/prototype/register/length.js: Added.
2890         * test262/test/built-ins/FinalizationGroup/prototype/register/name.js: Added.
2891         * test262/test/built-ins/FinalizationGroup/prototype/register/prop-desc.js: Added.
2892         * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined-register-itself.js: Added.
2893         (fn):
2894         * test262/test/built-ins/FinalizationGroup/prototype/register/return-undefined.js: Added.
2895         (fn):
2896         * test262/test/built-ins/FinalizationGroup/prototype/register/target-not-object-throws.js: Added.
2897         (fg.new.FinalizationGroup):
2898         * test262/test/built-ins/FinalizationGroup/prototype/register/this-does-not-have-internal-target-throws.js: Added.
2899         * test262/test/built-ins/FinalizationGroup/prototype/register/this-not-object-throws.js: Added.
2900         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-not-object-or-undefined-throws.js: Added.
2901         (fg.new.FinalizationGroup):
2902         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings-and-target.js: Added.
2903         (fg.new.FinalizationGroup):
2904         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-holdings.js: Added.
2905         (fg.new.FinalizationGroup):
2906         * test262/test/built-ins/FinalizationGroup/prototype/register/unregisterToken-same-as-target.js: Added.
2907         (fg.new.FinalizationGroup):
2908         * test262/test/built-ins/FinalizationGroup/prototype/unregister/custom-this.js: Added.
2909         (fn):
2910         * test262/test/built-ins/FinalizationGroup/prototype/unregister/length.js: Added.
2911         * test262/test/built-ins/FinalizationGroup/prototype/unregister/name.js: Added.
2912         * test262/test/built-ins/FinalizationGroup/prototype/unregister/prop-desc.js: Added.
2913         * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-does-not-have-internal-cells-throws.js: Added.
2914         * test262/test/built-ins/FinalizationGroup/prototype/unregister/this-not-object-throws.js: Added.
2915         * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregister.js: Added.
2916         (fn):
2917         * test262/test/built-ins/FinalizationGroup/prototype/unregister/unregisterToken-not-object-throws.js: Added.
2918         (fg.new.FinalizationGroup):
2919         * test262/test/built-ins/FinalizationGroup/returns-new-object-from-constructor.js: Added.
2920         (cleanupCallback):
2921         (let.key.of.Object.getOwnPropertyNames):
2922         (set for):
2923         * test262/test/built-ins/FinalizationGroup/target-not-callable-throws.js: Added.
2924         * test262/test/built-ins/FinalizationGroup/undefined-newtarget-throws.js: Added.
2925         (FinalizationGroup):
2926         * test262/test/built-ins/FinalizationGroup/unnaffected-by-poisoned-cleanupCallback.js: Added.
2927         (cleanupCallback):
2928         (let.key.of.Object.getOwnPropertyNames):
2929         (set for):
2930         * test262/test/built-ins/Function/StrictFunction_restricted-properties.js:
2931         * test262/test/built-ins/Function/prototype/bind/BoundFunction_restricted-properties.js:
2932         * test262/test/built-ins/Function/prototype/restricted-property-arguments.js:
2933         * test262/test/built-ins/Function/prototype/restricted-property-caller.js:
2934         * test262/test/built-ins/Object/prototype/toString/proxy-function-async.js: Added.
2935         (asyncProxy.new.Proxy.async):
2936         * test262/test/built-ins/Object/prototype/toString/proxy-function.js:
2937         (asyncProxy.new.Proxy.async):
2938         * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-builtin.js: Added.
2939         (setIter.set Symbol):
2940         (set defaultTag):
2941         (gen):
2942         (get return):
2943         (set new):
2944         * test262/test/built-ins/Object/prototype/toString/symbol-tag-non-str-proxy-function.js: Added.
2945         (generatorProxy.new.Proxy):
2946         (asyncProxy.new.Proxy.async):
2947         * test262/test/built-ins/Object/subclass-object-arg.js:
2948         * test262/test/built-ins/Promise/all/invoke-resolve-get-error-close.js:
2949         * test262/test/built-ins/Promise/all/resolve-element-function-name.js:
2950         * test262/test/built-ins/Promise/allSettled/invoke-resolve-get-error-close.js:
2951         * test262/test/built-ins/Promise/allSettled/reject-element-function-name.js:
2952         * test262/test/built-ins/Promise/allSettled/resolve-element-function-name.js:
2953         * test262/test/built-ins/Promise/executor-function-name.js:
2954         * test262/test/built-ins/Promise/race/invoke-resolve-get-error-close.js:
2955         * test262/test/built-ins/Promise/reject-function-name.js:
2956         * test262/test/built-ins/Promise/resolve-function-name.js:
2957         * test262/test/built-ins/Set/prototype/values/does-not-have-setdata-internal-slot-weakset.js:
2958         * test262/test/built-ins/WeakRef/constructor.js: Added.
2959         * test262/test/built-ins/WeakRef/instance-extensible.js: Added.
2960         * test262/test/built-ins/WeakRef/length.js: Added.
2961         * test262/test/built-ins/WeakRef/name.js: Added.
2962         * test262/test/built-ins/WeakRef/newtarget-prototype-is-not-object.js: Added.
2963         (newTarget):
2964         * test262/test/built-ins/WeakRef/prop-desc.js: Added.
2965         * test262/test/built-ins/WeakRef/proto-from-ctor-realm.js: Added.
2966         * test262/test/built-ins/WeakRef/proto.js: Added.
2967         * test262/test/built-ins/WeakRef/prototype-from-newtarget-abrupt.js: Added.
2968         (newTarget):
2969         * test262/test/built-ins/WeakRef/prototype-from-newtarget-custom.js: Added.
2970         (newTarget):
2971         * test262/test/built-ins/WeakRef/prototype-from-newtarget.js: Added.
2972         * test262/test/built-ins/WeakRef/prototype/Symbol.toStringTag.js: Added.
2973         * test262/test/built-ins/WeakRef/prototype/constructor.js: Added.
2974         * test262/test/built-ins/WeakRef/prototype/deref/custom-this.js: Added.
2975         * test262/test/built-ins/WeakRef/prototype/deref/gc-cleanup-not-prevented-with-wr-deref.js: Added.
2976         (emptyCells):
2977         * test262/test/built-ins/WeakRef/prototype/deref/length.js: Added.
2978         * test262/test/built-ins/WeakRef/prototype/deref/name.js: Added.
2979         * test262/test/built-ins/WeakRef/prototype/deref/prop-desc.js: Added.
2980         * test262/test/built-ins/WeakRef/prototype/deref/return-target.js: Added.
2981         * test262/test/built-ins/WeakRef/prototype/deref/this-does-not-have-internal-target-throws.js: Added.
2982         (fg.new.FinalizationGroup):
2983         * test262/test/built-ins/WeakRef/prototype/deref/this-not-object-throws.js: Added.
2984         * test262/test/built-ins/WeakRef/prototype/prop-desc.js: Added.
2985         * test262/test/built-ins/WeakRef/prototype/proto.js: Added.
2986         * test262/test/built-ins/WeakRef/returns-new-object-from-constructor.js: Added.
2987         (let.key.of.Object.getOwnPropertyNames):
2988         (set for):
2989         * test262/test/built-ins/WeakRef/target-not-object-throws.js: Added.
2990         * test262/test/built-ins/WeakRef/undefined-newtarget-throws.js: Added.
2991         * test262/test/intl402/BigInt/prototype/toLocaleString/builtin.js:
2992         * test262/test/intl402/BigInt/prototype/toLocaleString/default-options-object-prototype.js:
2993         * test262/test/intl402/BigInt/prototype/toLocaleString/length.js:
2994         * test262/test/intl402/BigInt/prototype/toLocaleString/returns-same-results-as-NumberFormat.js:
2995         * test262/test/intl402/BigInt/prototype/toLocaleString/taint-Intl-NumberFormat.js:
2996         * test262/test/intl402/BigInt/prototype/toLocaleString/this-value-invalid.js:
2997         * test262/test/intl402/BigInt/prototype/toLocaleString/throws-same-exceptions-as-NumberFormat.js:
2998         * test262/test/intl402/DateTimeFormat/constructor-options-order-quarter.js: Removed.
2999         * test262/test/intl402/DateTimeFormat/constructor-options-quarter-invalid.js: Removed.
3000         * test262/test/intl402/DateTimeFormat/constructor-options-quarter-valid.js: Removed.
3001         * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-long-en.js: Added.
3002         * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-narrow-en.js: Added.
3003         * test262/test/intl402/DateTimeFormat/prototype/format/dayPeriod-short-en.js: Added.
3004         * test262/test/intl402/DateTimeFormat/prototype/format/fractionalSecondDigits.js: Added.
3005         * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-date-string.js:
3006         * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-near-time-boundaries.js:
3007         * test262/test/intl402/DateTimeFormat/prototype/formatRange/argument-to-integer.js:
3008         * test262/test/intl402/DateTimeFormat/prototype/formatRange/builtin.js:
3009         * test262/test/intl402/DateTimeFormat/prototype/formatRange/prop-desc.js:
3010         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-date-string.js:
3011         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-near-time-boundaries.js:
3012         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/argument-to-integer.js:
3013         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/builtin.js:
3014         * test262/test/intl402/DateTimeFormat/prototype/formatRangeToParts/prop-desc.js:
3015         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-long-en.js: Added.
3016         (assertParts):
3017         (assertPartsNumeric):
3018         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-narrow-en.js: Added.
3019         (assertParts):
3020         (assertPartsNumeric):
3021         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/dayPeriod-short-en.js: Added.
3022         (assertParts):
3023         (assertPartsNumeric):
3024         * test262/test/intl402/DateTimeFormat/prototype/formatToParts/fractionalSecondDigits.js: Added.
3025         (assertParts):
3026         * test262/test/intl402/DateTimeFormat/prototype/resolvedOptions/order-quarter.js: Removed.
3027         * test262/test/intl402/DateTimeFormat/taint-Object-prototype-quarter.js: Removed.
3028         * test262/test/intl402/RelativeTimeFormat/prototype/format/en-us-numeric-auto.js:
3029         * test262/test/intl402/RelativeTimeFormat/prototype/formatToParts/en-us-numeric-auto.js:
3030         * test262/test/language/expressions/arrow-function/ArrowFunction_restricted-properties.js:
3031         * test262/test/language/expressions/class/elements/private-field-access-on-inner-arrow-function.js: Added.
3032         (C.prototype.method):
3033         * test262/test/language/expressions/class/elements/private-field-access-on-inner-function.js: Added.
3034         (C.prototype.method.innerFunction):
3035         (C.prototype.method):
3036         * test262/test/language/expressions/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
3037         (C):
3038         (C.method):
3039         * test262/test/language/expressions/class/elements/private-getter-access-on-inner-function.js: Added.
3040         (C):
3041         (C.method.innerFunction):
3042         (C.method):
3043         * test262/test/language/expressions/class/elements/private-getter-is-not-a-own-property.js: Added.
3044         (C):
3045         (C.checkPrivateGetter):
3046         * test262/test/language/expressions/class/elements/private-method-access-on-inner-arrow-function.js: Added.
3047         (C):
3048         (C.method):
3049         * test262/test/language/expressions/class/elements/private-method-access-on-inner-function.js: Added.
3050         (C):
3051         (C.method.innerFunction):
3052         (C.method):
3053         * test262/test/language/expressions/class/elements/private-method-is-not-a-own-property.js: Added.
3054         (C):
3055         (C.checkPrivateMethod):
3056         * test262/test/language/expressions/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
3057         (C):
3058         (C.method):
3059         * test262/test/language/expressions/class/elements/private-setter-access-on-inner-function.js: Added.
3060         (C):
3061         (C.method.innerFunction):
3062         (C.method):
3063         * test262/test/language/expressions/class/elements/private-setter-is-not-a-own-property.js: Added.
3064         (C):
3065         (C.checkPrivateSetter):
3066         * test262/test/language/expressions/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
3067         * test262/test/language/expressions/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
3068         * test262/test/language/expressions/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
3069         * test262/test/language/expressions/class/poisoned-underscore-proto.js: Added.
3070         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3071         (let.classStringExpression):
3072         (let.classStringExpression.access):
3073         (let.createAndInstantiateClass):
3074         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3075         (let.classStringExpression):
3076         (let.classStringExpression.access):
3077         (let.createAndInstantiateClass):
3078         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3079         (const.C):
3080         (let.createAndInstantiateClass):
3081         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3082         (let.classStringExpression.return.prototype.m):
3083         (let.classStringExpression.return.prototype.access):
3084         (let.createAndInstantiateClass):
3085         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3086         (let.classStringExpression.return.prototype.m):
3087         (let.classStringExpression.return.prototype.access):
3088         (let.createAndInstantiateClass):
3089         * test262/test/language/expressions/class/private-getter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3090         (let.classStringExpression):
3091         (let.classStringExpression.access):
3092         (let.createAndInstantiateClass):
3093         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3094         (let.classStringExpression.prototype.m):
3095         (let.classStringExpression.prototype.access):
3096         (let.classStringExpression):
3097         (let.createAndInstantiateClass):
3098         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3099         (let.classStringExpression.prototype.m):
3100         (let.classStringExpression.prototype.access):
3101         (let.classStringExpression):
3102         (let.createAndInstantiateClass):
3103         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3104         (const.C):
3105         (let.createAndInstantiateClass):
3106         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3107         (let.classStringExpression.return.C.prototype.m):
3108         (let.classStringExpression.return.C.prototype.access):
3109         (let.classStringExpression.return.C):
3110         (let.createAndInstantiateClass):
3111         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3112         (let.classStringExpression.return.C.prototype.m):
3113         (let.classStringExpression.return.C.prototype.access):
3114         (let.classStringExpression.return.C):
3115         (let.createAndInstantiateClass):
3116         * test262/test/language/expressions/class/private-method-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3117         (let.classStringExpression):
3118         (let.classStringExpression.access):
3119         (let.createAndInstantiateClass):
3120         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval-indirect.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3121         (let.classStringExpression):
3122         (let.classStringExpression.access):
3123         (let.createAndInstantiateClass):
3124         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-eval.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3125         (let.classStringExpression):
3126         (let.classStringExpression.access):
3127         (let.createAndInstantiateClass):
3128         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-factory.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3129         (const.C):
3130         (let.createAndInstantiateClass):
3131         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3132         (let.classStringExpression.return.prototype.m):
3133         (let.classStringExpression.return.prototype.access):
3134         (let.createAndInstantiateClass):
3135         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm-function-ctor.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3136         (let.classStringExpression.return.prototype.m):
3137         (let.classStringExpression.return.prototype.access):
3138         (let.createAndInstantiateClass):
3139         * test262/test/language/expressions/class/private-setter-brand-check-multiple-evaluations-of-class-realm.js: Copied from JSTests/test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js.
3140         (let.classStringExpression):
3141         (let.classStringExpression.access):
3142         (let.createAndInstantiateClass):
3143         * test262/test/language/expressions/new.target/unary-expr.js: Added.
3144         (new):
3145         (async):
3146         * test262/test/language/expressions/super/call-poisoned-underscore-proto.js: Added.
3147         (A):
3148         * test262/test/language/expressions/super/prop-poisoned-underscore-proto.js: Added.
3149         * test262/test/language/identifiers/vals-cjk-escaped.js: Added.
3150         * test262/test/language/identifiers/vals-cjk.js: Added.
3151         * test262/test/language/statements/class/elements/private-class-field-on-frozen-objects.js:
3152         * test262/test/language/statements/class/elements/private-field-access-on-inner-arrow-function.js: Added.
3153         (C.prototype.method):
3154         (C):
3155         * test262/test/language/statements/class/elements/private-field-access-on-inner-function.js: Added.
3156         (C.prototype.method.innerFunction):
3157         (C.prototype.method):
3158         (C):
3159         * test262/test/language/statements/class/elements/private-field-is-not-clobbered-by-computed-property.js: Added.
3160         (C.prototype.checkPrivateField):
3161         (C):
3162         * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval-on-initializer.js: Added.
3163         (C):
3164         * test262/test/language/statements/class/elements/private-field-visible-to-direct-eval.js: Added.
3165         (C.prototype.getWithEval):
3166         (C):
3167         (D):
3168         * test262/test/language/statements/class/elements/private-getter-access-on-inner-arrow-function.js: Added.
3169         (C.prototype.get m):
3170         (C.prototype.method):
3171         (C):
3172         * test262/test/language/statements/class/elements/private-getter-access-on-inner-function.js: Added.
3173         (C.prototype.get m):
3174         (C.prototype.method.innerFunction):
3175         (C.prototype.method):
3176         (C):
3177         * test262/test/language/statements/class/elements/private-getter-brand-check-multiple-evaluations-of-class.js:
3178         (let.createAndInstantiateClass):
3179         * test262/test/language/statements/class/elements/private-getter-is-not-a-own-property.js: Added.
3180         (C.prototype.get m):
3181         (C.prototype.checkPrivateGetter):
3182         (C):
3183         * test262/test/language/statements/class/elements/private-getter-is-not-clobbered-by-computed-property.js: Added.
3184         (C.prototype.get m):
3185         (C.prototype.checkPrivateGetter):
3186         (C):
3187         * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval-on-initializer.js: Added.
3188         (C.prototype.get m):
3189         (C):
3190         * test262/test/language/statements/class/elements/private-getter-visible-to-direct-eval.js: Added.
3191         (C.prototype.get m):
3192         (C.prototype.getWithEval):
3193         (C):
3194         (D.prototype.get m):
3195         (D):
3196         * test262/test/language/statements/class/elements/private-method-access-on-inner-arrow-function.js: Added.
3197         (C.prototype.m):
3198         (C.prototype.method):
3199         (C):
3200         * test262/test/language/statements/class/elements/private-method-access-on-inner-function.js: Added.
3201         (C.prototype.m):
3202         (C.prototype.method.innerFunction):
3203         (C.prototype.method):
3204         (C):
3205         * test262/test/language/statements/class/elements/private-method-is-not-a-own-property.js: Added.
3206         (C.prototype.m):
3207         (C.prototype.checkPrivateMethod):
3208         (C):
3209         * test262/test/language/statements/class/elements/private-method-is-not-clobbered-by-computed-property.js: Added.
3210         (C.prototype.m):
3211         (C.prototype.checkPrivateMethod):
3212         (C):
3213         * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval-on-initializer.js: Added.
3214         (C.prototype.m):
3215         (C):
3216         * test262/test/language/statements/class/elements/private-method-visible-to-direct-eval.js: Added.
3217         (C.prototype.m):
3218         (C.prototype.getWithEval):
3219         (C):
3220         (D.prototype.m):
3221         (D):
3222         * test262/test/language/statements/class/elements/private-setter-access-on-inner-arrow-function.js: Added.
3223         (C.prototype.set m):
3224         (C.prototype.method):
3225         (C):
3226         * test262/test/language/statements/class/elements/private-setter-access-on-inner-function.js: Added.
3227         (C.prototype.set m):
3228         (C.prototype.method.innerFunction):
3229         (C.prototype.method):
3230         (C):
3231         * test262/test/language/statements/class/elements/private-setter-is-not-a-own-property.js: Added.
3232         (C.prototype.set m):
3233         (C.prototype.checkPrivateSetter):
3234         (C):
3235         * test262/test/language/statements/class/elements/private-setter-is-not-clobbered-by-computed-property.js: Added.
3236         (C.prototype.set m):
3237         (C.prototype.checkPrivateSetter):
3238         (C):
3239         * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval-on-initializer.js: Added.
3240         (C.prototype.set m):
3241         (C):
3242         * test262/test/language/statements/class/elements/private-setter-visible-to-direct-eval.js: Added.
3243         (C.prototype.set m):
3244         (C.prototype.setWithEval):
3245         (C):
3246         (D.prototype.set m):
3247         (D):
3248         * test262/test/language/statements/class/elements/prod-private-getter-before-super-return-in-field-initializer.js:
3249         * test262/test/language/statements/class/elements/prod-private-method-before-super-return-in-field-initializer.js:
3250         * test262/test/language/statements/class/elements/prod-private-setter-before-super-return-in-field-initializer.js:
3251         * test262/test/language/statements/class/elements/super-access-inside-a-private-getter.js: Added.
3252         (A.prototype.method):
3253         (A):
3254         (C.prototype.get m):
3255         (C.prototype.access):
3256         (C):
3257         * test262/test/language/statements/class/elements/super-access-inside-a-private-method.js: Added.
3258         (A.prototype.method):
3259         (A):
3260         (C.prototype.m):
3261         (C.prototype.access):
3262         (C):
3263         * test262/test/language/statements/class/elements/super-access-inside-a-private-setter.js: Added.
3264         (A.prototype.method):
3265         (A):
3266         (C.prototype.set m):
3267         (C.prototype.access):
3268         (C):
3269         * test262/test/language/statements/class/poisoned-underscore-proto.js: Added.
3270         (A):
3271         * test262/test/language/statements/function/13.2-30-s.js:
3272         * test262/test262-Revision.txt:
3273
3274 2019-07-15  Yusuke Suzuki  <ysuzuki@apple.com>
3275
3276         [JSC] Improve wasm wpt test results by fixing miscellaneous issues
3277         https://bugs.webkit.org/show_bug.cgi?id=199783
3278
3279         Reviewed by Mark Lam.
3280
3281         Fix our spec tests.
3282
3283         * wasm/js-api/Module-compile.js:
3284         * wasm/js-api/test_basic_api.js:
3285         (const.c.in.constructorProperties.switch):
3286         * wasm/js-api/validate.js:
3287         * wasm/js-api/web-assembly-instantiate.js:
3288         * wasm/spec-tests/jsapi.js:
3289         (testJSAPI.get test):
3290         (testJSAPI.set test):
3291
3292 2019-07-15  Michael Catanzaro  <mcatanzaro@igalia.com>
3293
3294         Unreviewed, rolling out r247440.
3295
3296         Broke builds
3297
3298         Reverted changeset:
3299
3300         "[JSC] Improve wasm wpt test results by fixing miscellaneous
3301         issues"
3302         https://bugs.webkit.org/show_bug.cgi?id=199783
3303         https://trac.webkit.org/changeset/247440
3304
3305 2019-07-15  Yusuke Suzuki  <ysuzuki@apple.com>
3306
3307         [JSC] Improve wasm wpt test results by fixing miscellaneous issues
3308         https://bugs.webkit.org/show_bug.cgi?id=199783
3309
3310         Reviewed by Mark Lam.
3311
3312         Fix our spec tests.
3313
3314         * wasm/js-api/Module-compile.js:
3315         * wasm/js-api/test_basic_api.js:
3316         (const.c.in.constructorProperties.switch):
3317         * wasm/js-api/validate.js:
3318         * wasm/js-api/web-assembly-instantiate.js:
3319         * wasm/spec-tests/jsapi.js:
3320         (testJSAPI.get test):
3321         (testJSAPI.set test):
3322
3323 2019-07-12  Justin Michaud  <justin_michaud@apple.com>
3324
3325         B3 should reduce (integer) Sub(Neg(x), y) to Neg(Add(x, y))
3326         https://bugs.webkit.org/show_bug.cgi?id=196371
3327
3328         Reviewed by Keith Miller.
3329
3330         * microbenchmarks/mul-immediate-sub.js: Added.
3331         (doTest):
3332
3333 2019-07-12  Caio Lima  <ticaiolima@gmail.com>
3334
3335         [BigInt] Add ValueBitLShift into DFG
3336         https://bugs.webkit.org/show_bug.cgi?id=192664
3337
3338         Reviewed by Saam Barati.
3339
3340         We are adding tests to cover ValueBitwise operations AI changes.
3341
3342         * stress/big-int-left-shift-untyped.js: Added.
3343         * stress/bit-op-with-object-returning-int32.js:
3344         * stress/value-bit-and-ai-rule.js: Added.
3345         * stress/value-bit-lshift-ai-rule.js: Added.
3346         * stress/value-bit-or-ai-rule.js: Added.
3347         * stress/value-bit-xor-ai-rule.js: Added.
3348
3349 2019-07-11  Justin Michaud  <justin_michaud@apple.com>
3350
3351         Add b3 macro lowering for CheckMul on arm64
3352         https://bugs.webkit.org/show_bug.cgi?id=199251
3353
3354         Reviewed by Robin Morisset.
3355
3356         * microbenchmarks/check-mul-constant.js: Added.
3357         (doTest):
3358         * microbenchmarks/check-mul-no-constant.js: Added.
3359         (doTest):
3360         * microbenchmarks/check-mul-power-of-two.js: Added.
3361         (doTest):
3362
3363 2019-07-10  Tadeu Zagallo  <tzagallo@apple.com>
3364
3365         Optimize join of large empty arrays
3366         https://bugs.webkit.org/show_bug.cgi?id=199636
3367
3368         Reviewed by Mark Lam.
3369
3370         * microbenchmarks/large-empty-array-join.js: Added.
3371         * microbenchmarks/large-empty-array-join-resolve-rope.js: Added.
3372
3373 2019-07-06  Michael Saboff  <msaboff@apple.com>
3374
3375         switch(String) needs to check for exceptions when resolving the string
3376         https://bugs.webkit.org/show_bug.cgi?id=199541
3377
3378         Reviewed by Mark Lam.
3379
3380         New tests.
3381
3382         * stress/switch-string-oom.js: Added.
3383         (test):
3384         (testLowerTiers):
3385         (testFTL):
3386
3387 2019-07-05  Mark Lam  <mark.lam@apple.com>
3388
3389         ArgumentsEliminationPhase::eliminateCandidatesThatInterfere() should not decrement nodeIndex pass zero.
3390         https://bugs.webkit.org/show_bug.cgi?id=199533
3391         <rdar://problem/52669111>
3392
3393         Reviewed by Filip Pizlo.
3394
3395         * stress/ArgumentsEliminationPhase-eliminateCandidatesThatEscape-should-not-decrement-nodeIndex-pass-zero.js: Added.
3396
3397 2019-07-05  Alexey Shvayka  <shvaikalesh@gmail.com>
3398
3399         [JSC] Clean up ArraySpeciesCreate
3400         https://bugs.webkit.org/show_bug.cgi?id=182434
3401
3402         Reviewed by Yusuke Suzuki.
3403
3404         Adjusts error message expectations in stress tests.
3405
3406         * stress/array-flatmap.js:
3407         * stress/array-flatten.js:
3408         * stress/array-species-create-should-handle-masquerader.js:
3409         * test262/expectations.yaml: Mark 4 test cases as passing.
3410
3411 2019-07-02  Michael Saboff  <msaboff@apple.com>
3412
3413         Exception from For..of loop assignment eliminates TDZ checks in subsequent code
3414         https://bugs.webkit.org/show_bug.cgi?id=199395
3415
3416         Reviewed by Filip Pizlo.
3417
3418         New regession test.
3419
3420         * stress/for-of-tdz-with-try-catch.js: Added.
3421         (test):
3422         (i.catch):
3423
3424 2019-07-02  Keith Miller  <keith_miller@apple.com>
3425
3426         Frozen Arrays length assignment should throw in strict mode
3427         https://bugs.webkit.org/show_bug.cgi?id=199365
3428
3429         Reviewed by Yusuke Suzuki.
3430
3431         * stress/frozen-array-length-should-throw-strict.js: Added.
3432         (test):
3433
3434 2019-07-01  Justin Michaud  <justin_michaud@apple.com>
3435
3436         [Wasm-References] Disable references by default
3437         https://bugs.webkit.org/show_bug.cgi?id=199390
3438
3439         Reviewed by Saam Barati.
3440
3441         * wasm/references-spec-tests/ref_is_null.js:
3442         * wasm/references-spec-tests/ref_null.js:
3443         * wasm/references/anyref_globals.js:
3444         * wasm/references/anyref_modules.js:
3445         * wasm/references/anyref_table.js:
3446         * wasm/references/anyref_table_import.js:
3447         * wasm/references/element_parsing.js:
3448         * wasm/references/func_ref.js:
3449         * wasm/references/is_null.js:
3450         * wasm/references/multitable.js:
3451         * wasm/references/table_misc.js:
3452         * wasm/references/validation.js:
3453
3454 2019-07-01  Ryan Haddad  <ryanhaddad@apple.com>
3455
3456         Unreviewed, rolling out r246946.
3457
3458         Caused JSC test crashes on arm64
3459
3460         Reverted changeset:
3461
3462         "Add b3 macro lowering for CheckMul on arm64"
3463         https://bugs.webkit.org/show_bug.cgi?id=199251
3464         https://trac.webkit.org/changeset/246946
3465
3466 2019-06-28  Justin Michaud  <justin_michaud@apple.com>
3467
3468         Add b3 macro lowering for CheckMul on arm64
3469         https://bugs.webkit.org/show_bug.cgi?id=199251
3470
3471         Reviewed by Robin Morisset.
3472
3473         * microbenchmarks/check-mul-constant.js: Added.
3474         (doTest):
3475         * microbenchmarks/check-mul-no-constant.js: Added.
3476         (doTest):
3477         * microbenchmarks/check-mul-power-of-two.js: Added.
3478         (doTest):
3479
3480 2019-06-26  Keith Miller  <keith_miller@apple.com>
3481
3482         speciesConstruct needs to throw if the result is a DataView
3483         https://bugs.webkit.org/show_bug.cgi?id=199231
3484
3485         Reviewed by Mark Lam.
3486
3487         * stress/typedarray-filter.js:
3488         (subclasses.forEach):
3489         * stress/typedarray-map.js:
3490         (subclasses.forEach):
3491         * stress/typedarray-slice.js:
3492         (typedArrays.forEach):
3493         * stress/typedarray-subarray.js:
3494         (subclasses.forEach):
3495
3496 2019-06-24  Commit Queue  <commit-queue@webkit.org>
3497
3498         Unreviewed, rolling out r246714.
3499         https://bugs.webkit.org/show_bug.cgi?id=199179
3500
3501         revert to do patch in a different way. (Requested by keith_mi_
3502         on #webkit).
3503
3504         Reverted changeset:
3505
3506         "All prototypes should call didBecomePrototype()"
3507         https://bugs.webkit.org/show_bug.cgi?id=196315
3508         https://trac.webkit.org/changeset/246714
3509
3510 2019-06-24  Alexey Shvayka  <shvaikalesh@gmail.com>
3511
3512         Add Array.prototype.{flat,flatMap} to unscopables
3513         https://bugs.webkit.org/show_bug.cgi?id=194322
3514
3515         Reviewed by Keith Miller.
3516
3517         * stress/unscopables.js: Fix test.
3518         * test262/expectations.yaml: Mark 2 test cases as passing.
3519
3520 2019-06-21  Mark Lam  <mark.lam@apple.com>
3521
3522         ArraySlice needs to keep the source array alive.
3523         https://bugs.webkit.org/show_bug.cgi?id=197374
3524         <rdar://problem/50304429>
3525
3526         Reviewed by Michael Saboff and Filip Pizlo.
3527
3528         * stress/array-slice-must-keep-source-array-alive.js: Added.
3529
3530 2019-06-22  Robin Morisset  <rmorisset@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
3531
3532         All prototypes should call didBecomePrototype()
3533         https://bugs.webkit.org/show_bug.cgi?id=196315
3534
3535         Reviewed by Saam Barati.
3536
3537         * stress/function-prototype-indexed-accessor.js: Added.
3538
3539 2019-06-22  Yusuke Suzuki  <ysuzuki@apple.com>
3540
3541         [JSC] Strict, Sloppy and Arrow functions should have different classInfo
3542         https://bugs.webkit.org/show_bug.cgi?id=197631
3543
3544         Reviewed by Saam Barati.
3545
3546         * stress/has-own-property-arguments.js: Added.
3547         (shouldBe):
3548         (A):
3549
3550 2019-06-22  Yusuke Suzuki  <ysuzuki@apple.com>
3551
3552         [JSC] ClassExpr should not store result in the middle of evaluation
3553         https://bugs.webkit.org/show_bug.cgi?id=199106
3554
3555         Reviewed by Tadeu Zagallo.
3556
3557         * stress/class-expression-should-store-result-at-last.js: Added.
3558         (shouldThrow):
3559         (shouldThrow.let.a):
3560
3561 2019-06-20  Justin Michaud  <justin_michaud@apple.com>
3562
3563         [WASM-References] Add extra tests for Wasm references + fix element parsing and subtyping bugs
3564         https://bugs.webkit.org/show_bug.cgi?id=199044
3565
3566         Reviewed by Saam Barati.
3567
3568         Add wasm references spec tests as well as a worker test.
3569
3570         * wasm.yaml:
3571         * wasm/Builder_WebAssemblyBinary.js:
3572         (const.emitters.Element):
3573         * wasm/js-api/element.js:
3574         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3575         * wasm/references-spec-tests/ref_is_null.js: Added.
3576         (hostref):
3577         (is_hostref):
3578         (is_funcref):
3579         (eq_ref):
3580         (let.handler.get target):
3581         (register):
3582         (module):
3583         (instance):
3584         (call):
3585         (get instance):
3586         (exports):
3587         (run):
3588         (assert_malformed):
3589         (assert_invalid):
3590         (assert_unlinkable):
3591         (assert_uninstantiable):
3592         (assert_trap):
3593         (try.f):
3594         (catch):
3595         (assert_exhaustion):
3596         (assert_return):
3597         (assert_return_canonical_nan):
3598         (assert_return_arithmetic_nan):
3599         (assert_return_ref):
3600         (assert_return_func):
3601         * wasm/references-spec-tests/ref_null.js: Added.
3602         (hostref):
3603         (is_hostref):
3604         (is_funcref):
3605         (eq_ref):
3606         (let.handler.get target):
3607         (register):
3608         (module):
3609         (instance):
3610         (call):
3611         (get instance):
3612         (exports):
3613         (run):
3614         (assert_malformed):
3615         (assert_invalid):
3616         (assert_unlinkable):
3617         (assert_uninstantiable):
3618         (assert_trap):
3619         (try.f):
3620         (catch):
3621         (assert_exhaustion):
3622         (assert_return):
3623         (assert_return_canonical_nan):
3624         (assert_return_arithmetic_nan):
3625         (assert_return_ref):
3626         (assert_return_func):
3627         * wasm/references/element_parsing.js: Added.
3628         (module):
3629         * wasm/references/func_ref.js:
3630         * wasm/references/multitable.js:
3631         * wasm/references/table_misc.js:
3632         (TableSize.0.End.End.WebAssembly):
3633         * wasm/references/validation.js:
3634         (assert.throws):
3635
3636 2019-06-19  Alexey Shvayka  <shvaikalesh@gmail.com>
3637
3638         Optimize `resolve` method lookup in Promise static methods
3639         https://bugs.webkit.org/show_bug.cgi?id=198864
3640
3641         Reviewed by Yusuke Suzuki.
3642
3643         * test262/expectations.yaml: Mark 18 test cases as passing.
3644
3645 2019-06-19  Justin Michaud  <justin_michaud@apple.com>
3646
3647         [WASM-References] Rename anyfunc to funcref
3648         https://bugs.webkit.org/show_bug.cgi?id=198983
3649
3650         Reviewed by Yusuke Suzuki.
3651
3652         * wasm/function-tests/basic-element.js:
3653         * wasm/function-tests/context-switch.js:
3654         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3655         (makeInstance):
3656         (assert.eq.makeInstance):
3657         * wasm/function-tests/exceptions.js:
3658         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3659         * wasm/function-tests/grow-memory-2.js:
3660         (assert.eq.instance.exports.foo):
3661         * wasm/function-tests/nameSection.js:
3662         (const.compile):
3663         * wasm/function-tests/stack-overflow.js:
3664         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3665         (assertOverflows.makeInstance):
3666         * wasm/function-tests/table-basic-2.js:
3667         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3668         * wasm/function-tests/table-basic.js:
3669         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.makeInstance):
3670         * wasm/function-tests/trap-from-start-async.js:
3671         * wasm/function-tests/trap-from-start.js:
3672         * wasm/js-api/Module.exports.js:
3673         (assert.truthy):
3674         * wasm/js-api/Module.imports.js:
3675         (assert.truthy):
3676         * wasm/js-api/call-indirect.js:
3677         (const.oneTable):
3678         (const.multiTable):
3679         (multiTable.const.makeTable):
3680         (multiTable):
3681         (multiTable.Polyphic2Import):
3682         (multiTable.VirtualImport):
3683         * wasm/js-api/element-data.js:
3684         * wasm/js-api/element.js:
3685         (assert.throws.new.WebAssembly.Module.builder.WebAssembly):
3686         (assert.throws):
3687         (badInstantiation.makeModule):
3688         (badInstantiation.test):
3689         (badInstantiation):
3690         * wasm/js-api/extension-MemoryMode.js:
3691         * wasm/js-api/table.js:
3692         (new.WebAssembly.Module):
3693         (assert.throws):
3694         (assertBadTableImport):
3695         (assert.throws.WebAssembly.Table.prototype.grow):
3696         (new.WebAssembly.Table):
3697         (assertBadTable):
3698         (assert.truthy):
3699         * wasm/js-api/test_basic_api.js:
3700         (const.c.in.constructorProperties.switch):
3701         * wasm/js-api/unique-signature.js:
3702         (CallIndirectWithDuplicateSignatures):
3703         * wasm/js-api/wrapper-function.js:
3704         * wasm/modules/table.wat:
3705         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
3706         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
3707         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
3708         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
3709         * wasm/references/anyref_table.js:
3710         * wasm/references/anyref_table_import.js:
3711         (doSet):
3712         (assert.throws):
3713         * wasm/references/func_ref.js:
3714         (makeFuncrefIdent):
3715         (assert.eq.instance.exports.fix):
3716         (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly.assert.throws):
3717         (GetLocal.0.I32Const.0.TableSet.0.End.End.WebAssembly):
3718         (let.importedFun.of):
3719         (makeAnyfuncIdent): Deleted.
3720         (makeAnyfuncIdent.fun): Deleted.
3721         * wasm/references/multitable.js:
3722         (assert.eq):
3723         (assert.throws):
3724         * wasm/references/table_misc.js:
3725         (GetLocal.0.TableFill.0.End.End.WebAssembly):
3726         * wasm/references/validation.js:
3727         (assert.throws.new.WebAssembly.Module.bin):
3728         (assert.throws):
3729         * wasm/spec-harness/index.js:
3730         * wasm/spec-harness/wasm-constants.js:
3731         * wasm/spec-harness/wasm-module-builder.js:
3732         (WasmModuleBuilder.prototype.toArray):
3733         * wasm/spec-harness/wast.js:
3734         (elem_type):
3735         (string_of_elem_type):
3736         (string_of_table_type):
3737         * wasm/spec-tests/jsapi.js:
3738         * wasm/stress/wasm-table-grow-initialize.js:
3739         * wasm/wasm.json:
3740
3741 2019-06-18  Justin Michaud  <justin_michaud@apple.com>
3742
3743         [WASM-References] Add support for Table.size, grow and fill instructions
3744         https://bugs.webkit.org/show_bug.cgi?id=198761
3745
3746         Reviewed by Yusuke Suzuki.
3747
3748         * wasm/Builder_WebAssemblyBinary.js:
3749         (const.putOp):
3750         * wasm/references/table_misc.js: Added.
3751         (TableSize.End.End.WebAssembly):
3752         (GetLocal.0.GetLocal.1.TableGrow.End.End.WebAssembly):
3753         * wasm/wasm.json:
3754
3755 2019-06-18  Justin Michaud  <justin_michaud@apple.com>
3756
3757         [WASM-References] Add support for multiple tables
3758         https://bugs.webkit.org/show_bug.cgi?id=198760
3759
3760         Reviewed by Saam Barati.
3761
3762         * wasm/Builder.js:
3763         * wasm/js-api/call-indirect.js:
3764         (const.oneTable):
3765         (const.multiTable):
3766         (multiTable):
3767         (multiTable.Polyphic2Import):
3768         (multiTable.VirtualImport):
3769         (const.wasmModuleWhichImportJS): Deleted.
3770         (const.makeTable): Deleted.
3771         (): Deleted.
3772         (Polyphic2Import): Deleted.
3773         (VirtualImport): Deleted.
3774         * wasm/js-api/table.js:
3775         (new.WebAssembly.Module):
3776         (assert.throws):
3777         (assertBadTableImport):
3778         (assert.truthy):
3779         (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
3780         * wasm/references/anyref_table.js:
3781         * wasm/references/anyref_table_import.js:
3782         (makeImport):
3783         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
3784         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
3785         * wasm/references/multitable.js: Added.
3786         (assert.throws.1.exports.set_tbl0):
3787         (assert.throws):
3788         (assert.eq):
3789         * wasm/references/validation.js:
3790         (assert.throws.new.WebAssembly.Module.bin):
3791         (assert.throws):
3792         * wasm/spec-tests/imports.wast.js:
3793         * wasm/wasm.json:
3794
3795         * wasm/Builder.js:
3796         * wasm/js-api/call-indirect.js:
3797         (const.oneTable):
3798         (const.multiTable):
3799         (multiTable):
3800         (multiTable.Polyphic2Import):
3801         (multiTable.VirtualImport):
3802         (const.wasmModuleWhichImportJS): Deleted.
3803         (const.makeTable): Deleted.
3804         (): Deleted.
3805         (Polyphic2Import): Deleted.
3806         (VirtualImport): Deleted.
3807         * wasm/js-api/table.js:
3808         (new.WebAssembly.Module):
3809         (assert.throws):
3810         (assertBadTableImport):
3811         (assert.truthy):
3812         (assert.throws.new.WebAssembly.Module.builder.WebAssembly): Deleted.
3813         * wasm/references/anyref_table.js:
3814         * wasm/references/anyref_table_import.js:
3815         (makeImport):
3816         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
3817         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
3818         * wasm/references/func_ref.js:
3819         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun): Deleted.
3820         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws): Deleted.
3821         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly): Deleted.
3822         * wasm/references/multitable.js: Added.
3823         (assert.throws.1.exports.set_tbl0):
3824         (assert.throws):
3825         (assert.eq):
3826         (string_appeared_here.tableInsanity):
3827         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly.):
3828         (I32Const.0.GetLocal.0.TableSet.1.End.End.WebAssembly):
3829         * wasm/references/validation.js:
3830         (assert.throws.new.WebAssembly.Module.bin):
3831         (assert.throws):
3832         * wasm/spec-tests/imports.wast.js:
3833         * wasm/wasm.json:
3834
3835 2019-06-18  Alexey Shvayka  <shvaikalesh@gmail.com>
3836
3837         [ESNExt] String.prototype.matchAll
3838         https://bugs.webkit.org/show_bug.cgi?id=186694
3839
3840         Reviewed by Yusuke Suzuki.
3841
3842         Implement String.prototype.matchAll.
3843         (https://tc39.es/ecma262/#sec-string.prototype.matchall)
3844
3845         * test262/config.yaml:
3846
3847 2019-06-18  Tadeu Zagallo  <tzagallo@apple.com>
3848
3849         DFG code should not reify the names of builtin functions with private names
3850         https://bugs.webkit.org/show_bug.cgi?id=198849
3851         <rdar://problem/51733890>
3852
3853         Reviewed by Filip Pizlo.
3854
3855         * stress/builtin-private-function-name.js: Added.
3856         (then):
3857         (PromiseLike):
3858
3859 2019-06-18  Keith Miller  <keith_miller@apple.com>
3860
3861         MaybeParseAsGeneratorForScope sometimes loses track of its scope ref
3862         https://bugs.webkit.org/show_bug.cgi?id=198969
3863         <rdar://problem/51620714>
3864
3865         Reviewed by Tadeu Zagallo.
3866
3867         * stress/nested-yield-in-arrow-function-should-be-a-syntax-error.js: Added.
3868         (catch):
3869
3870 2019-06-17  Justin Michaud  <justin_michaud@apple.com>
3871
3872         Validate that table element type is funcref if using an element section
3873         https://bugs.webkit.org/show_bug.cgi?id=198910
3874
3875         Reviewed by Yusuke Suzuki.
3876
3877         * wasm/references/anyref_table.js:
3878
3879 2019-06-17  Yusuke Suzuki  <ysuzuki@apple.com>
3880
3881         [JSC] Introduce DisposableCallSiteIndex to enforce type-safety
3882         https://bugs.webkit.org/show_bug.cgi?id=197378
3883
3884         Reviewed by Saam Barati.
3885
3886         * stress/disposable-call-site-index-with-call-and-this.js: Added.
3887         (foo):
3888         (bar):
3889         * stress/disposable-call-site-index.js: Added.
3890         (foo):
3891         (bar):
3892
3893 2019-06-17  Justin Michaud  <justin_michaud@apple.com>
3894
3895         [WASM-References] Add support for Funcref in parameters and return types
3896         https://bugs.webkit.org/show_bug.cgi?id=198157
3897
3898         Reviewed by Yusuke Suzuki.
3899
3900         * wasm/Builder.js:
3901         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
3902         * wasm/references/anyref_globals.js:
3903         * wasm/references/func_ref.js: Added.
3904         (fullGC.gc.makeExportedFunction):
3905         (makeExportedIdent):
3906         (makeAnyfuncIdent):
3907         (fun):
3908         (assert.eq.instance.exports.fix.fun):
3909         (assert.eq.instance.exports.fix):
3910         (string_appeared_here.End.End.Function.End.Code.End.WebAssembly.imp.ref):
3911         (string_appeared_here.End.End.Function.End.Code.End.WebAssembly):
3912         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.fun):
3913         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly.assert.throws):
3914         (GetLocal.0.I32Const.0.TableSet.End.End.WebAssembly):
3915         (assert.throws):
3916         (assert.throws.doTest):
3917         (let.importedFun.of):
3918         (makeAnyfuncIdent.fun):
3919         * wasm/references/validation.js:
3920         (assert.throws):
3921         * wasm/wasm.json:
3922
3923 2019-06-17  Ross Kirsling  <ross.kirsling@sony.com>
3924
3925         Update test262 tests (2019.06.13)
3926         https://bugs.webkit.org/show_bug.cgi?id=198821
3927
3928         Reviewed by Konstantin Tokarev.
3929
3930         * test262/expectations.yaml:
3931         * test262/harness/:
3932         * test262/latest-changes-summary.txt:
3933         * test262/test/:
3934         * test262/test262-Revision.txt:
3935
3936 2019-06-16  Yusuke Suzuki  <ysuzuki@apple.com>
3937
3938         [JSC] Grown region of WasmTable should be initialized with null
3939         https://bugs.webkit.org/show_bug.cgi?id=198903
3940
3941         Reviewed by Saam Barati.
3942
3943         * wasm/stress/wasm-table-grow-initialize.js: Added.
3944         (shouldBe):
3945
3946 2019-06-13  Yusuke Suzuki  <ysuzuki@apple.com>
3947
3948         Yarr bytecode compilation failure should be gracefully handled
3949         https://bugs.webkit.org/show_bug.cgi?id=198700
3950
3951         Reviewed by Michael Saboff.
3952
3953         * stress/regexp-bytecode-compilation-fail.js: Added.
3954         (shouldThrow):
3955
3956 2019-06-12  Yusuke Suzuki  <ysuzuki@apple.com>
3957
3958         [JSC] Polymorphic call stub's slow path should restore callee saves before performing tail call
3959         https://bugs.webkit.org/show_bug.cgi?id=198770
3960
3961         Reviewed by Saam Barati.
3962
3963         * stress/poly-call-stub-slow-path-should-restore-callee-saves-when-doing-tail-call.js: Added.
3964         (test):
3965
3966 2019-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>
3967
3968         JSC should throw if proxy set returns falsish in strict mode context
3969         https://bugs.webkit.org/show_bug.cgi?id=177398
3970
3971         Reviewed by Yusuke Suzuki.
3972
3973         1. Add coverage for Proxy `set` trap returning falsy value in strict mode.
3974         2. RegExp methods throw unless [[Set]] succeeds. Return `true` from Proxy `set` traps to fix the tests.
3975
3976         * stress/proxy-set.js: Add 2 test cases.
3977         * stress/regexp-match-proxy.js: Fix test.
3978         * stress/regexp-replace-proxy.js: Fix test.
3979
3980 2019-06-11  Alexey Shvayka  <shvaikalesh@gmail.com>
3981
3982         Error message for non-callable Proxy `construct` trap is misleading
3983         https://bugs.webkit.org/show_bug.cgi?id=198637
3984
3985         Reviewed by Saam Barati.
3986
3987         * stress/proxy-construct.js:
3988
3989 2019-06-10  Tadeu Zagallo  <tzagallo@apple.com>
3990
3991         AI BitURShift's result should not be unsigned
3992         https://bugs.webkit.org/show_bug.cgi?id=198689
3993         <rdar://problem/51550063>
3994
3995         Reviewed by Saam Barati.
3996
3997         * stress/urshift-int32-overflow.js: Added.
3998         (foo.):
3999         (foo):
4000
4001 2019-06-11  Guillaume Emont  <guijemont@igalia.com>
4002
4003         Skip stress/ftl-gettypedarrayoffset-wasteful.js on Arm/Linux
4004
4005         Unreviewed gardening.
4006
4007         * stress/ftl-gettypedarrayoffset-wasteful.js:
4008         Skipped on arm/linux as it always times out on the bot since a change
4009         between r246270 and r246278 inclusive.
4010
4011 2019-06-10  Yusuke Suzuki  <ysuzuki@apple.com>
4012
4013         [JSC] UnlinkedCodeBlock should be eventually jettisoned in VM mini mode
4014         https://bugs.webkit.org/show_bug.cgi?id=198023
4015
4016         Reviewed by Saam Barati.
4017
4018         * stress/reparsing-unlinked-codeblock.js: Added.
4019         (shouldBe):
4020         (hello):
4021
4022 2019-06-09  Yusuke Suzuki  <ysuzuki@apple.com>
4023
4024         [JSC] Use mergePrediction in ValuePow prediction propagation
4025         https://bugs.webkit.org/show_bug.cgi?id=198648
4026
4027         Reviewed by Saam Barati.
4028
4029         * stress/prediction-propagation-should-use-merge-prediction-for-value-pow.js: Added.
4030
4031 2019-06-07  Tadeu Zagallo  <tzagallo@apple.com>
4032
4033         AI should get GetterSetter structure from the base's GlobalObject for GetGetterSetterByOffset
4034         https://bugs.webkit.org/show_bug.cgi?id=198581
4035         <rdar://problem/51099753>
4036
4037         Reviewed by Saam Barati.
4038
4039         * stress/global-object-proto-getter.js: Added.
4040         (f):
4041         (test):
4042
4043 2019-06-05  Justin Michaud  <justin_michaud@apple.com>
4044
4045         [WASM-References] Add support for Anyref tables, Table.get and Table.set (for Anyref only).
4046         https://bugs.webkit.org/show_bug.cgi?id=198398
4047
4048         Reviewed by Saam Barati.
4049
4050         * wasm/references/anyref_table.js: Added.
4051         (string_appeared_here.doGCSet):
4052         (doGCTest):
4053         (doGCSet.doGCTest.let.count.0.doBarrierSet):
4054         * wasm/references/anyref_table_import.js: Added.
4055         (makeImport):
4056         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl.makeImport):
4057         (string_appeared_here.fullGC.assert.eq.1.exports.get_tbl):
4058         * wasm/references/is_null_error.js: Removed.
4059         * wasm/references/validation.js: Added.
4060         (assert.throws.new.WebAssembly.Module.bin):
4061         (assert.throws):
4062         * wasm/wasm.json:
4063
4064 2019-06-05  Justin Michaud  <justin_michaud@apple.com>
4065
4066         WebAssembly: pow functions returns 0 when exponent 1.0 or -1.0
4067         https://bugs.webkit.org/show_bug.cgi?id=198106
4068
4069         Reviewed by Saam Barati.
4070
4071         * wasm/regress/selectf64.js: Added.
4072         * wasm/regress/selectf64.wasm: Added.
4073         * wasm/regress/selectf64.wat: Added.
4074
4075 2019-06-04  Tadeu Zagallo  <tzagallo@apple.com>
4076
4077         Argument elimination should check transitive dependents for interference
4078         https://bugs.webkit.org/show_bug.cgi?id=198520
4079         <rdar://problem/50863343>
4080
4081         Reviewed by Filip Pizlo.
4082
4083         * stress/argument-elimination-inline-rest-past-kill.js: Added.
4084         (f2):
4085         (f3):
4086
4087 2019-06-04  Tadeu Zagallo  <tzagallo@apple.com>
4088
4089         Argument elimination should check for negative indices in GetByVal
4090         https://bugs.webkit.org/show_bug.cgi?id=198302
4091         <rdar://problem/51188095>
4092
4093         Reviewed by Filip Pizlo.
4094
4095         * stress/eliminate-arguments-negative-rest-access.js: Added.
4096         (inlinee):
4097         (opt):
4098
4099 2019-06-03  Caio Lima  <ticaiolima@gmail.com>
4100
4101         [ESNext][BigInt] Implement support for "**"
4102         https://bugs.webkit.org/show_bug.cgi?id=190799
4103
4104         Reviewed by Saam Barati.
4105
4106         * stress/big-int-exp-basic.js: Added.
4107         * stress/big-int-exp-jit-osr.js: Added.
4108         * stress/big-int-exp-jit-untyped.js: Added.
4109         * stress/big-int-exp-jit.js: Added.
4110         * stress/big-int-exp-negative-exponent.js: Added.
4111         * stress/big-int-exp-to-primitive.js: Added.
4112         * stress/big-int-exp-type-error.js: Added.
4113         * stress/big-int-exp-wrapped-value.js: Added.
4114         * stress/value-pow-ai-rule.js: Added.
4115
4116 2019-05-30  Tadeu Zagallo  <tzagallo@apple.com> and Yusuke Suzuki  <ysuzuki@apple.com>
4117
4118         [JSC] Implement op_wide16 / op_wide32 and introduce 16bit version bytecode
4119         https://bugs.webkit.org/show_bug.cgi?id=197979
4120
4121         Reviewed by Filip Pizlo.
4122
4123         * stress/16bit-code.js: Added.
4124         (shouldBe):
4125         * stress/32bit-code.js: Added.
4126         (shouldBe):
4127
4128 2019-05-30  Justin Michaud  <justin_michaud@apple.com>
4129
4130         oss-fuzz: jsc: Issue 15016: jsc: Abrt in JSC::Wasm::AirIRGenerator::addLocal (15016)
4131         https://bugs.webkit.org/show_bug.cgi?id=198355
4132
4133         Reviewed by Saam Barati.
4134
4135         * wasm/references/is_null.js:
4136
4137 2019-05-30  Stephan Szabo  <stephan.szabo@sony.com>
4138
4139         [PlayStation] Skip additional tests on PlayStation
4140         https://bugs.webkit.org/show_bug.cgi?id=198352
4141
4142         Reviewed by Don Olmstead.
4143
4144         Skip pow test on PlayStation due to behavior difference in standard library.
4145         Skip incremental marking test due to OOM on PlayStation systems.
4146
4147         * stress/incremental-marking-should-not-dead-lock-in-new-property-transition.js:
4148         * stress/math-pow-with-constants.js:
4149         * stress/pow-with-constants.js:
4150
4151 2019-05-28  Dean Jackson  <dino@apple.com>
4152
4153         Implement Promise.allSettled
4154         https://bugs.webkit.org/show_bug.cgi?id=197600
4155         <rdar://problem/50483885>
4156
4157         Reviewed by Keith Miller.
4158
4159         Start testing Promise.allSettled. We pass most of the tests.
4160         The ones that fail are similar to the Promise.all tests we already fail.
4161
4162         * test262/config.yaml: Remove Promise.allSettled from skipped tests.
4163         * test262/expectations.yaml: Add new expectations for allSettled tests.
4164
4165 2019-05-28  Michael Saboff  <msaboff@apple.com>
4166
4167         [YARR] Properly handle RegExp's that require large ParenContext space
4168         https://bugs.webkit.org/show_bug.cgi?id=198065
4169
4170         Reviewed by Keith Miller.
4171
4172         New test.
4173
4174         * stress/regexp-large-paren-context.js: Added.
4175         (testLargeRegExp):
4176
4177 2019-05-28  Tadeu Zagallo  <tzagallo@apple.com>
4178
4179         JITOperations putByVal should mark negative array indices as out-of-bounds
4180         https://bugs.webkit.org/show_bug.cgi?id=198271
4181
4182         Reviewed by Saam Barati.
4183
4184         * microbenchmarks/get-by-val-negative-array-index.js:
4185         (foo):
4186         Update the getByVal microbenchmark added in r245769. This now shows that r245769
4187         is 4.2x faster than the previous commit.
4188
4189         * microbenchmarks/put-by-val-negative-array-index.js: Added.
4190         (foo):
4191
4192 2019-05-25  Tadeu Zagallo  <tzagallo@apple.com>
4193
4194         JITOperations getByVal should mark negative array indices as out-of-bounds
4195         https://bugs.webkit.org/show_bug.cgi?id=198229
4196
4197         Reviewed by Saam Barati.
4198
4199         * microbenchmarks/get-by-val-negative-array-index.js: Added.
4200         (foo):
4201
4202 2019-05-24  Justin Michaud  <justin_michaud@apple.com>
4203
4204         [WASM-References] Support Anyref in globals
4205         https://bugs.webkit.org/show_bug.cgi?id=198102
4206
4207         Reviewed by Saam Barati.
4208
4209         Add test for anyrefs in globals, as well as adding a new RefNull initExpr for Builder.
4210
4211         * wasm/Builder.js:
4212         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
4213         * wasm/Builder_WebAssemblyBinary.js:
4214         (const.putInitExpr):
4215         * wasm/references/anyref_globals.js: Added.
4216         (GetGlobal.0.End.End.WebAssembly):
4217         (5.doGCSet):
4218         (doGCTest):
4219         (doGCSet.doGCTest.let.count.0.doBarrierSet):
4220
4221 2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
4222
4223         DFG::OSREntry should not perform arity check
4224         https://bugs.webkit.org/show_bug.cgi?id=198189
4225
4226         Reviewed by Saam Barati.
4227
4228         * microbenchmarks/loop-osr-with-arity-mismatch.js: Added.
4229         (foo):
4230
4231 2019-05-23  Stephan Szabo  <stephan.szabo@sony.com>
4232
4233         [PlayStation] Skip additional tests on PlayStation
4234         https://bugs.webkit.org/show_bug.cgi?id=198145
4235
4236         Reviewed by Ross Kirsling.
4237
4238         * exceptionFuzz.yaml:
4239         Add skip on hostOS playstation
4240         * executableAllocationFuzz.yaml:
4241         Add skip on hostOS playstation
4242
4243 2019-05-23  Tadeu Zagallo  <tzagallo@apple.com>
4244
4245         createListFromArrayLike should throw if value is not an object
4246         https://bugs.webkit.org/show_bug.cgi?id=198138
4247
4248         Reviewed by Yusuke Suzuki.
4249
4250         * stress/create-list-from-array-like-not-object.js: Added.
4251         (testValid):
4252         (testInvalid):
4253         * stress/proxy-get-own-property-names-should-not-clear-previous-results.js:
4254         (opt):
4255         * stress/proxy-proto-enumerator.js: Added.
4256         (main):
4257         * stress/proxy-proto-own-keys.js: Added.
4258         (assert):
4259         (ownKeys):
4260
4261 2019-05-22  Yusuke Suzuki  <ysuzuki@apple.com>
4262
4263         [JSC] ArrayAllocationProfile should not access to butterfly in concurrent compiler
4264         https://bugs.webkit.org/show_bug.cgi?id=197809
4265
4266         Reviewed by Michael Saboff.
4267
4268         * stress/array-allocation-profile-should-not-update-itself-in-concurrent-compiler.js: Added.
4269         (foo):
4270
4271 2019-05-22  Ross Kirsling  <ross.kirsling@sony.com>
4272
4273         [ESNext] Implement support for Numeric Separators
4274         https://bugs.webkit.org/show_bug.cgi?id=196351
4275
4276         Reviewed by Keith Miller.
4277
4278         * stress/numeric-literal-separators.js: Added.
4279         Add tests for feature.
4280
4281         * test262/expectations.yaml:
4282         Mark 60 test cases as passing.
4283
4284 2019-05-22  Tadeu Zagallo  <tzagallo@apple.com>
4285
4286         llint_slow_path_get_by_id needs to hold the CodeBlock's to update the metadata's mode
4287         https://bugs.webkit.org/show_bug.cgi?id=198120
4288         <rdar://problem/49668795>
4289
4290         Reviewed by Michael Saboff.
4291
4292         * stress/get-array-length-concurrently-change-mode.js: Added.
4293         (main):
4294
4295 2019-05-22  Commit Queue  <commit-queue@webkit.org>
4296
4297         Unreviewed, rolling out r245634.
4298         https://bugs.webkit.org/show_bug.cgi?id=198140
4299
4300         'This patch makes JSC crash on launch in debug builds'
4301         (Requested by tadeuzagallo on #webkit).
4302
4303         Reverted changeset:
4304
4305         "[ESNext] Implement support for Numeric Separators"
4306         https://bugs.webkit.org/show_bug.cgi?id=196351
4307         https://trac.webkit.org/changeset/245634
4308
4309 2019-05-22  Tadeu Zagallo  <tzagallo@apple.com>
4310
4311         Stack-buffer-overflow in decodeURIComponent
4312         https://bugs.webkit.org/show_bug.cgi?id=198109
4313         <rdar://problem/50397550>
4314
4315         Reviewed by Michael Saboff.