Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
[WebKit-https.git] / JSTests / ChangeLog
1 2018-12-17  Mark Lam  <mark.lam@apple.com>
2
3         Skip the stress/materialize-regexp-cyclic-regexp.js test on 32-bit.
4         https://bugs.webkit.org/show_bug.cgi?id=191373
5         <rdar://problem/46525458>
6
7         Reviewed by Yusuke Suzuki.
8
9         The test is already slow running with a JIT on 64-bit.  It will always timeout
10         on 32-bit without a JIT.
11
12         * stress/materialize-regexp-cyclic-regexp.js:
13
14 2018-12-17  Mark Lam  <mark.lam@apple.com>
15
16         Array unshift/shift should not race against the AI in the compiler thread.
17         https://bugs.webkit.org/show_bug.cgi?id=192795
18         <rdar://problem/46724263>
19
20         Reviewed by Saam Barati.
21
22         * stress/array-unshift-should-not-race-against-compiler-thread.js: Added.
23
24 2018-12-16  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
25
26         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
27         https://bugs.webkit.org/show_bug.cgi?id=190047
28
29         Reviewed by Saam Barati.
30
31         * stress/object-keys-cached-zero.js: Added.
32         (shouldBe):
33         (test):
34         * stress/object-keys-changed-attribute.js: Added.
35         (shouldBe):
36         (test):
37         * stress/object-keys-changed-index.js: Added.
38         (shouldBe):
39         (test):
40         * stress/object-keys-changed.js: Added.
41         (shouldBe):
42         (test):
43         * stress/object-keys-indexed-non-cache.js: Added.
44         (shouldBe):
45         (test):
46         * stress/object-keys-overrides-get-property-names.js: Added.
47         (shouldBe):
48         (test):
49         (noInline):
50
51 2018-12-17  Mark Lam  <mark.lam@apple.com>
52
53         SamplingProfiler's isValidFramePointer() should reject address at stack origin.
54         https://bugs.webkit.org/show_bug.cgi?id=192779
55         <rdar://problem/46775869>
56
57         Reviewed by Saam Barati.
58
59         * stress/sampling-profiler-should-not-sample-beyond-stack-bounds.js: Added.
60
61 2018-12-17  Ryan Haddad  <ryanhaddad@apple.com>
62
63         Unreviewed test gardening, address a syntax error in a new test.
64
65         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js:
66
67 2018-12-17  Mark Lam  <mark.lam@apple.com>
68
69         Suppress ASAN on valid stack accesses in Probe-based OSRExit::executeOSRExit().
70         https://bugs.webkit.org/show_bug.cgi?id=192776
71         <rdar://problem/46772368>
72
73         Reviewed by Keith Miller.
74
75         * stress/out-of-frame-stack-accesses-due-to-probe-based-osr-exits.js: Added.
76
77 2018-12-17  Mark Lam  <mark.lam@apple.com>
78
79         Fix stale assertion in attemptToForceStringArrayModeByToStringConversion().
80         https://bugs.webkit.org/show_bug.cgi?id=192770
81         <rdar://problem/46449037>
82
83         Reviewed by Keith Miller.
84
85         * stress/force-string-arrayMode-on-originalNonArray-array-class.js: Added.
86
87 2018-12-14  Mark Lam  <mark.lam@apple.com>
88
89         CallFrame::convertToStackOverflowFrame() needs to keep the top CodeBlock alive.
90         https://bugs.webkit.org/show_bug.cgi?id=192717
91         <rdar://problem/46660677>
92
93         Reviewed by Saam Barati.
94
95         * stress/regress-192717.js: Added.
96
97 2018-12-14  Commit Queue  <commit-queue@webkit.org>
98
99         Unreviewed, rolling out r239153, r239154, and r239155.
100         https://bugs.webkit.org/show_bug.cgi?id=192715
101
102         Caused flaky GC-related crashes seen with layout tests
103         (Requested by ryanhaddad on #webkit).
104
105         Reverted changesets:
106
107         "[JSC] Optimize Object.keys by caching own keys results in
108         StructureRareData"
109         https://bugs.webkit.org/show_bug.cgi?id=190047
110         https://trac.webkit.org/changeset/239153
111
112         "Unreviewed, build fix after r239153"
113         https://bugs.webkit.org/show_bug.cgi?id=190047
114         https://trac.webkit.org/changeset/239154
115
116         "Unreviewed, build fix after r239153, part 2"
117         https://bugs.webkit.org/show_bug.cgi?id=190047
118         https://trac.webkit.org/changeset/239155
119
120 2018-12-14  Keith Miller  <keith_miller@apple.com>
121
122         Callers of JSString::getIndex should check for OOM exceptions
123         https://bugs.webkit.org/show_bug.cgi?id=192709
124
125         Reviewed by Mark Lam.
126
127         * stress/StringObject-define-length-getter-rope-string-oom.js: Added.
128
129 2018-12-13  Mark Lam  <mark.lam@apple.com>
130
131         Add a missing exception check.
132         https://bugs.webkit.org/show_bug.cgi?id=192626
133         <rdar://problem/46662163>
134
135         Reviewed by Keith Miller.
136
137         * stress/regress-192626.js: Added.
138
139 2018-12-13  Caio Lima  <ticaiolima@gmail.com>
140
141         [BigInt] Add ValueDiv into DFG
142         https://bugs.webkit.org/show_bug.cgi?id=186178
143
144         Reviewed by Yusuke Suzuki.
145
146         * stress/big-int-div-jit-osr.js: Added.
147         * stress/big-int-div-jit-untyped.js: Added.
148         * stress/value-div-fixup-int32-big-int.js: Added.
149
150 2018-12-10  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
151
152         [JSC] Optimize Object.keys by caching own keys results in StructureRareData
153         https://bugs.webkit.org/show_bug.cgi?id=190047
154
155         Reviewed by Keith Miller.
156
157         * stress/object-keys-cached-zero.js: Added.
158         (shouldBe):
159         (test):
160         * stress/object-keys-changed-attribute.js: Added.
161         (shouldBe):
162         (test):
163         * stress/object-keys-changed-index.js: Added.
164         (shouldBe):
165         (test):
166         * stress/object-keys-changed.js: Added.
167         (shouldBe):
168         (test):
169         * stress/object-keys-indexed-non-cache.js: Added.
170         (shouldBe):
171         (test):
172         * stress/object-keys-overrides-get-property-names.js: Added.
173         (shouldBe):
174         (test):
175         (noInline):
176
177 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
178
179         [DFG][FTL] Add NewSymbol
180         https://bugs.webkit.org/show_bug.cgi?id=192620
181
182         Reviewed by Saam Barati.
183
184         * microbenchmarks/symbol-creation.js: Added.
185         (test):
186         * stress/symbol-description-identity.js: Added.
187         (shouldBe):
188         (test):
189         * stress/symbol-identity.js: Added.
190         (shouldBe):
191         (test):
192         * stress/symbol-with-description-throw-error.js: Added.
193         (shouldBe):
194         (shouldThrow):
195         (test):
196         (object.toString):
197
198 2018-12-12  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
199
200         [BigInt] Implement DFG/FTL typeof for BigInt
201         https://bugs.webkit.org/show_bug.cgi?id=192619
202
203         Reviewed by Keith Miller.
204
205         * stress/big-int-boolean-proven-type.js: Added.
206         (assert):
207         (bool):
208         * stress/big-int-type-of-proven-type-non-constant-including-symbol.js: Added.
209         (assert):
210         (typeOf):
211         (i.switch):
212         * stress/big-int-type-of-proven-type-non-constant.js: Added.
213         (assert):
214         (typeOf):
215         * stress/big-int-type-of.js:
216         (typeOf):
217         (func):
218
219 2018-12-10  Mark Lam  <mark.lam@apple.com>
220
221         PropertyAttribute needs a CustomValue bit.
222         https://bugs.webkit.org/show_bug.cgi?id=191993
223         <rdar://problem/46264467>
224
225         Reviewed by Saam Barati.
226
227         * stress/regress-191993.js: Added.
228
229 2018-12-10  Caio Lima  <ticaiolima@gmail.com>
230
231         [BigInt] Add ValueMul into DFG
232         https://bugs.webkit.org/show_bug.cgi?id=186175
233
234         Reviewed by Yusuke Suzuki.
235
236         * stress/big-int-mul-jit-osr.js: Added.
237         * stress/big-int-mul-jit-untyped.js: Added.
238         * stress/value-mul-fixup-int32-big-int.js: Added.
239
240 2018-12-06  Keith Miller  <keith_miller@apple.com>
241
242         stress/big-wasm-memory tests failing on 32-bit JSC bot
243         https://bugs.webkit.org/show_bug.cgi?id=192020
244
245         Reviewed by Saam Barati.
246
247         Not every platform has WebAssembly, e.g. 32-bit, so we should exit
248         the wasm stress tests if the WebAssembly object does not exist.
249
250         * stress/big-wasm-memory-grow-no-max.js:
251         (test.foo):
252         (test):
253         (foo): Deleted.
254         (catch): Deleted.
255         * stress/big-wasm-memory-grow.js:
256         (test.foo):
257         (test):
258         (foo): Deleted.
259         (catch): Deleted.
260         * stress/big-wasm-memory.js:
261         (test.foo):
262         (test):
263         (foo): Deleted.
264         (catch): Deleted.
265
266 2018-12-05  Mark Lam  <mark.lam@apple.com>
267
268         speculationFromCell() should speculate non-Identifier strings as SpecString instead of SpecStringVar.
269         https://bugs.webkit.org/show_bug.cgi?id=192441
270         <rdar://problem/46480355>
271
272         Reviewed by Saam Barati.
273
274         * stress/regress-192441.js: Added.
275
276 2018-12-04  Mark Lam  <mark.lam@apple.com>
277
278         DFG's StrengthReduction phase should not reduce Construct into DirectContruct when the executable does not have constructAbility.
279         https://bugs.webkit.org/show_bug.cgi?id=192386
280         <rdar://problem/46445516>
281
282         Reviewed by Saam Barati.
283
284         * stress/regress-192386.js: Added.
285
286 2018-12-04  Caio Lima  <ticaiolima@gmail.com>
287
288         [ESNext][BigInt] Support logic operations
289         https://bugs.webkit.org/show_bug.cgi?id=179903
290
291         Reviewed by Yusuke Suzuki.
292
293         * stress/big-int-branch-usage.js: Added.
294         * stress/big-int-logical-and.js: Added.
295         * stress/big-int-logical-not.js: Added.
296         * stress/big-int-logical-or.js: Added.
297
298 2018-12-03  Ryan Haddad  <ryanhaddad@apple.com>
299
300         Unreviewed, rolling out r238833.
301
302         Breaks macOS and iOS debug builds.
303
304         Reverted changeset:
305
306         "[ESNext][BigInt] Support logic operations"
307         https://bugs.webkit.org/show_bug.cgi?id=179903
308         https://trac.webkit.org/changeset/238833
309
310 2018-12-03  Caio Lima  <ticaiolima@gmail.com>
311
312         [ESNext][BigInt] Support logic operations
313         https://bugs.webkit.org/show_bug.cgi?id=179903
314
315         Reviewed by Yusuke Suzuki.
316
317         * stress/big-int-branch-usage.js: Added.
318         * stress/big-int-logical-and.js: Added.
319         * stress/big-int-logical-not.js: Added.
320         * stress/big-int-logical-or.js: Added.
321
322 2018-12-02  Caio Lima  <ticaiolima@gmail.com>
323
324         [ESNext][BigInt] Implement support for "<<" and ">>"
325         https://bugs.webkit.org/show_bug.cgi?id=186233
326
327         Reviewed by Yusuke Suzuki.
328
329         * stress/big-int-left-shift-general.js: Added.
330         * stress/big-int-left-shift-range-error.js: Added.
331         * stress/big-int-left-shift-type-error.js: Added.
332         * stress/big-int-left-shift-wrapped-value.js: Added.
333         * stress/big-int-right-shift-general.js: Added.
334         * stress/big-int-right-shift-type-error.js: Added.
335         * stress/big-int-right-shift-wrapped-value.js: Added.
336         * stress/left-shift-to-primitive-precedence.js: Added.
337         * stress/right-shift-to-primitive-precedence.js: Added.
338
339 2018-11-30  Dean Jackson  <dino@apple.com>
340
341         Add first-class support for .mjs files in jsc binary
342         https://bugs.webkit.org/show_bug.cgi?id=192190
343         <rdar://problem/46375715>
344
345         Reviewed by Keith Miller.
346
347         * stress/simple-module.mjs: Added.
348         * stress/simple-script.js: Added.
349
350 2018-11-30  Caio Lima  <ticaiolima@gmail.com>
351
352         [BigInt] Implement ValueBitXor into DFG
353         https://bugs.webkit.org/show_bug.cgi?id=190264
354
355         Reviewed by Yusuke Suzuki.
356
357         * stress/big-int-bitwise-xor-jit.js: Added.
358         * stress/big-int-bitwise-xor-memory-stress.js: Added.
359         * stress/big-int-bitwise-xor-untyped.js: Added.
360
361 2018-11-27  Saam barati  <sbarati@apple.com>
362
363         r238510 broke scopes of size zero
364         https://bugs.webkit.org/show_bug.cgi?id=192033
365         <rdar://problem/46281734>
366
367         Reviewed by Keith Miller.
368
369         * stress/r238510-bad-loop.js: Added.
370         (foo):
371
372 2018-11-27  Mark Lam  <mark.lam@apple.com>
373
374         [Re-landing] NaNs read from Wasm code needs to be be purified.
375         https://bugs.webkit.org/show_bug.cgi?id=191056
376         <rdar://problem/45660341>
377
378         Reviewed by Filip Pizlo.
379
380         * wasm/regress/regress-191056.js: Added.
381
382 2018-11-27  Ryan Haddad  <ryanhaddad@apple.com>
383
384         Unreviewed, rolling out r238509.
385
386         Causes JSC tests to fail on iOS.
387
388         Reverted changeset:
389
390         "NaNs read from Wasm code needs to be be purified."
391         https://bugs.webkit.org/show_bug.cgi?id=191056
392         https://trac.webkit.org/changeset/238509
393
394 2018-11-26  Caio Lima  <ticaiolima@gmail.com>
395
396         Re-introduce op_bitnot
397         https://bugs.webkit.org/show_bug.cgi?id=190923
398
399         Reviewed by Yusuke Suzuki.
400
401         * stress/bit-not-must-generate.js: Added.
402         * stress/bitwise-not-no-int32.js: Added.
403
404 2018-11-26  Saam barati  <sbarati@apple.com>
405
406         InPlaceAbstractState::endBasicBlock rule for SetLocal should filter the value based on the flush format
407         https://bugs.webkit.org/show_bug.cgi?id=191956
408         <rdar://problem/45665806>
409
410         Reviewed by Yusuke Suzuki.
411
412         * stress/end-basic-block-set-local-should-filter-type.js: Added.
413         (bar):
414         (foo):
415
416 2018-11-26  Saam barati  <sbarati@apple.com>
417
418         Object allocation sinking phase needs to iterate each scope offset instead of just iterating the symbol table's hashmap when handling an activation
419         https://bugs.webkit.org/show_bug.cgi?id=191958
420         <rdar://problem/46221877>
421
422         Reviewed by Yusuke Suzuki.
423
424         * stress/object-allocation-sinking-phase-needs-to-write-to-each-scope-offset.js: Added.
425         (x):
426         (foo):
427
428 2018-11-26  Mark Lam  <mark.lam@apple.com>
429
430         NaNs read from Wasm code needs to be be purified.
431         https://bugs.webkit.org/show_bug.cgi?id=191056
432         <rdar://problem/45660341>
433
434         Reviewed by Filip Pizlo.
435
436         * wasm/regress/regress-191056.js: Added.
437
438 2018-11-26  Michael Saboff  <msaboff@apple.com>
439
440         32-bit JSC test failure: stress/regexp-compile-oom.js
441         https://bugs.webkit.org/show_bug.cgi?id=191375
442
443         Reviewed by Mark Lam.
444
445         Disabled the test for 32 bit platforms.
446
447         * stress/regexp-compile-oom.js:
448
449 2018-11-26  Tadeu Zagallo  <tzagallo@apple.com>
450
451         ASSERTION FAILED: m_outOfLineJumpTargets.contains(bytecodeOffset)
452         https://bugs.webkit.org/show_bug.cgi?id=191716
453         <rdar://problem/45723878>
454
455         Reviewed by Saam Barati.
456
457         * stress/regress-187373.js: Added.
458         (async.fn):
459
460 2018-11-21  Saam barati  <sbarati@apple.com>
461
462         DFGSpeculativeJIT should not &= exitOK with mayExit(node)
463         https://bugs.webkit.org/show_bug.cgi?id=191897
464         <rdar://problem/45871998>
465
466         Reviewed by Mark Lam.
467
468         * stress/exitok-is-not-the-same-as-mayExit.js: Added.
469         (bar):
470         (foo):
471
472 2018-11-21  Saam barati  <sbarati@apple.com>
473
474         Fix assertion in KnownCellUse inside SpeculativeJIT::speculate
475         https://bugs.webkit.org/show_bug.cgi?id=191895
476         <rdar://problem/46167406>
477
478         Reviewed by Mark Lam.
479
480         * stress/known-cell-use-needs-type-check-assertion.js: Added.
481         (foo):
482         (bar):
483
484 2018-11-21  Mark Lam  <mark.lam@apple.com>
485
486         Creating a wasm memory that is bigger than the ArrayBuffer limit but smaller than the spec limit should throw OOME not RangeError.
487         https://bugs.webkit.org/show_bug.cgi?id=191776
488         <rdar://problem/46152851>
489
490         Reviewed by Saam Barati.
491
492         * stress/big-wasm-memory-grow-no-max.js:
493         * stress/big-wasm-memory-grow.js:
494         * stress/big-wasm-memory.js:
495         - updated these to expect an OutOfMemoryError.
496
497         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE-2.js: Added.
498         (Binary.prototype.emit_u8):
499         (Binary.prototype.emit_u32v):
500         (Binary.prototype.emit_header):
501         (Binary.prototype.emit_section):
502         (Binary):
503         (WasmModuleBuilder):
504         (WasmModuleBuilder.prototype.addMemory):
505         (WasmModuleBuilder.prototype.toArray):
506         (WasmModuleBuilder.prototype.toBuffer):
507         (WasmModuleBuilder.prototype.instantiate):
508         (catch):
509         * wasm/regress/wasm-memory-requested-more-than-MAX_ARRAY_BUFFER_SIZE.js: Added.
510         (catch):
511
512 2018-11-21  Caio Lima  <ticaiolima@gmail.com>
513
514         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
515         https://bugs.webkit.org/show_bug.cgi?id=190836
516
517         Reviewed by Saam Barati and Yusuke Suzuki.
518
519         * stress/big-int-out-of-memory-tests.js: Added.
520
521 2018-11-20  Mark Lam  <mark.lam@apple.com>
522
523         Remove invalid assertion in VMTraps::SignalSender's SignalAction.
524         https://bugs.webkit.org/show_bug.cgi?id=191856
525         <rdar://problem/46089992>
526
527         Reviewed by Yusuke Suzuki.
528
529         * stress/regress-191856.js: Added.
530         - this test is skipped for now until we have a fix for webkit.org/b/191855.
531
532 2018-11-21  Dominik Infuehr  <dinfuehr@igalia.com>
533
534         Enable JIT on ARM/Linux
535         https://bugs.webkit.org/show_bug.cgi?id=191548
536
537         Reviewed by Yusuke Suzuki.
538
539         Disable test on system with limited memory. Program was killed by
540         the OS before the exception was thrown.
541
542         * slowMicrobenchmarks/function-constructor-with-huge-strings.js:
543
544 2018-11-20  Saam barati  <sbarati@apple.com>
545
546         Merging an IC variant may lead to the IC status containing overlapping structure sets
547         https://bugs.webkit.org/show_bug.cgi?id=191869
548         <rdar://problem/45403453>
549
550         Reviewed by Mark Lam.
551
552         * stress/merging-ic-variants-should-bail-if-structures-overlap.js: Added.
553
554 2018-11-19  Mark Lam  <mark.lam@apple.com>
555
556         globalFuncImportModule() should return a promise when it clears exceptions.
557         https://bugs.webkit.org/show_bug.cgi?id=191792
558         <rdar://problem/46090763>
559
560         Reviewed by Michael Saboff.
561
562         * stress/global-import-function-should-return-a-promise-when-clearing-exceptions.js: Added.
563
564 2018-11-19  Guillaume Emont  <guijemont@igalia.com>
565
566         Skip new memory-hungry tests on memory limited devices
567
568         Unreviewed gardening.
569
570         * stress/big-wasm-memory-grow-no-max.js:
571         * stress/big-wasm-memory-grow.js:
572         * stress/big-wasm-memory.js:
573
574 2018-11-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
575
576         Unreviewed, rolling in the rest of r237254
577         https://bugs.webkit.org/show_bug.cgi?id=190340
578
579         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
580         * stress/function-cache-with-parameters-end-position.js: Added.
581         (shouldBe):
582         (shouldThrow):
583         (i.anonymous):
584         * stress/function-constructor-name.js: Added.
585         (shouldBe):
586         (GeneratorFunction):
587         (AsyncFunction.async):
588         (AsyncGeneratorFunction.async):
589         (anonymous):
590         (async.anonymous):
591         * test262/expectations.yaml:
592
593 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
594
595         All users of ArrayBuffer should agree on the same max size
596         https://bugs.webkit.org/show_bug.cgi?id=191771
597
598         Reviewed by Mark Lam.
599
600         * stress/big-wasm-memory-grow-no-max.js: Added.
601         (foo):
602         (catch):
603         * stress/big-wasm-memory-grow.js: Added.
604         (foo):
605         (catch):
606         * stress/big-wasm-memory.js: Added.
607         (foo):
608         (catch):
609
610 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
611
612         Unreviewed, make some more tests not crash my computer by only running on instance of it. These tests do not need to
613         run for each JSC config since they're regression tests for runtime bugs.
614
615         * stress/json-stringified-overflow-2.js:
616         * stress/json-stringified-overflow.js:
617
618 2018-11-16  Filip Pizlo  <fpizlo@apple.com>
619
620         Unreviewed, make some tests not crash my computer by only running on instance of it. These tests do not need to run for each JSC
621         config since they're regression tests for runtime bugs.
622
623         * stress/large-unshift-splice.js:
624         * stress/regress-185888.js:
625
626 2018-11-16  Saam Barati  <sbarati@apple.com>
627
628         KnownCellUse should also have SpecCellCheck as its type filter
629         https://bugs.webkit.org/show_bug.cgi?id=191729
630         <rdar://problem/45872852>
631
632         Reviewed by Filip Pizlo.
633
634         * stress/known-cell-type-check-should-allow-empty-value-to-flow-through.js: Added.
635         (C):
636
637 2018-11-16  Tadeu Zagallo  <tzagallo@apple.com>
638
639         Fix assertion failure on BytecodeGenerator::recordOpcode
640         https://bugs.webkit.org/show_bug.cgi?id=191724
641         <rdar://problem/45724395>
642
643         Reviewed by Saam Barati.
644
645         * stress/regress-187373-2.js: Added.
646         (foo):
647
648 2018-11-15  Mark Lam  <mark.lam@apple.com>
649
650         RegExpObject's collectMatches should not be using JSArray::push to fill in its match results.
651         https://bugs.webkit.org/show_bug.cgi?id=191730
652         <rdar://problem/46048517>
653
654         Reviewed by Saam Barati.
655
656         * stress/regress-187006.js: Removed.
657           - this test is invalid because its sole purpose is to test for the non-spec
658             compliant behavior that we just fixed.
659
660         * stress/regress-191730.js: Added.
661
662 2018-11-15  Mark Lam  <mark.lam@apple.com>
663
664         RegExp operations should not take fast patch if lastIndex is not numeric.
665         https://bugs.webkit.org/show_bug.cgi?id=191731
666         <rdar://problem/46017305>
667
668         Reviewed by Saam Barati.
669
670         * stress/regress-191731.js: Added.
671
672 2018-11-13  Saam Barati  <sbarati@apple.com>
673
674         TypeProfileLog::processLogEntries should stash away any pending exceptions and re-apply them to the VM
675         https://bugs.webkit.org/show_bug.cgi?id=191600
676
677         Reviewed by Mark Lam.
678
679         * stress/type-profiler-log-should-defer-pending-exceptions.js: Added.
680         (foo):
681         (test):
682         (bar):
683
684 2018-11-13  Ryan Haddad  <ryanhaddad@apple.com>
685
686         Unreviewed, rolling out r238132.
687
688         The test added with this change is timing out on Debug JSC
689         bots.
690
691         Reverted changeset:
692
693         "[BigInt] JSBigInt::createWithLength should throw when length
694         is greater than JSBigInt::maxLength"
695         https://bugs.webkit.org/show_bug.cgi?id=190836
696         https://trac.webkit.org/changeset/238132
697
698 2018-11-13  Mark Lam  <mark.lam@apple.com>
699
700         Add OOM detection to StringPrototype's substituteBackreferences().
701         https://bugs.webkit.org/show_bug.cgi?id=191563
702         <rdar://problem/45720428>
703
704         Reviewed by Saam Barati.
705
706         * stress/regress-191563.js: Added.
707
708 2018-11-13  Mark Lam  <mark.lam@apple.com>
709
710         LLIntSlowPath's llint_loop_osr and llint_replace should set the topCallFrame.
711         https://bugs.webkit.org/show_bug.cgi?id=191579
712         <rdar://problem/45942472>
713
714         Reviewed by Saam Barati.
715
716         * stress/regress-191579.js: Added.
717
718 2018-11-13  Caio Lima  <ticaiolima@gmail.com>
719
720         [BigInt] JSBigInt::createWithLength should throw when length is greater than JSBigInt::maxLength
721         https://bugs.webkit.org/show_bug.cgi?id=190836
722
723         Reviewed by Saam Barati.
724
725         * stress/big-int-out-of-memory-tests.js: Added.
726
727 2018-11-08  Ross Kirsling  <ross.kirsling@sony.com>
728
729         U+180E is no longer a whitespace character
730         https://bugs.webkit.org/show_bug.cgi?id=191415
731
732         Reviewed by Saam Barati.
733
734         * ChakraCore/test/es5/regexSpace.baseline:
735         * ChakraCore/test/es6/unicode_whitespace.js:
736         Update tests to latest version.
737         (See https://github.com/Microsoft/ChakraCore/commit/7c097b698de1e400286f9b957597b2a81fc6f80b.)
738
739         * test262.yaml:
740         * test262/config.yaml:
741         * test262/expectations.yaml:
742         Update expectations.
743
744 2018-11-07  Caio Lima  <ticaiolima@gmail.com>
745
746         [BigInt] Add support to BigInt into ValueAdd
747         https://bugs.webkit.org/show_bug.cgi?id=186177
748
749         Reviewed by Keith Miller.
750
751         * stress/big-int-negate-jit.js:
752         * stress/value-add-big-int-and-string.js: Added.
753         * stress/value-add-big-int-prediction-propagation.js: Added.
754         * stress/value-add-big-int-untyped.js: Added.
755
756 2018-11-07  Tadeu Zagallo  <tzagallo@apple.com>
757
758         REGRESSION(r237547): Test failures on 32-bit JSC since the JIT was disabled
759         https://bugs.webkit.org/show_bug.cgi?id=191184
760
761         Reviewed by Saam Barati.
762
763         Most tests were failing due to timeouts, since they are too slow to
764         run on CLoop. The exceptions are:
765
766         proxy-get-set-correct-receiver.js: Had to reduce the recursion depth not to overflow on CLoop
767         dont-crash-on-stack-overflow-when-parsing-builtin.js and
768         dont-crash-on-stack-overflow-when-parsing-default-constructor.js: had
769         to change the stack size since CLoop requires it to be page aligned.
770
771         * microbenchmarks/array-push-1.js:
772         * microbenchmarks/array-push-2.js:
773         * microbenchmarks/elidable-new-object-dag.js:
774         * microbenchmarks/elidable-new-object-roflcopter.js:
775         * microbenchmarks/elidable-new-object-tree.js:
776         * microbenchmarks/getter-richards.js:
777         * microbenchmarks/sinkable-new-object-dag.js:
778         * microbenchmarks/string-concat-long-convert.js:
779         * microbenchmarks/typed-array-get-set-by-val-profiling.js:
780         * slowMicrobenchmarks/array-push-3.js:
781         * slowMicrobenchmarks/large-map-iteration-with-additions.js:
782         * slowMicrobenchmarks/spread-small-array.js:
783         * slowMicrobenchmarks/undefined-property-access.js:
784         * stress/activation-sink-default-value-tdz-error.js:
785         * stress/activation-sink-default-value.js:
786         * stress/activation-sink-osrexit-default-value-tdz-error.js:
787         * stress/activation-sink-osrexit-default-value.js:
788         * stress/activation-sink-osrexit.js:
789         * stress/activation-sink.js:
790         * stress/allow-math-ic-b3-code-duplication.js:
791         * stress/array-push-multiple-int32.js:
792         * stress/arrowfunction-activation-sink-osrexit-default-value-tdz-error.js:
793         * stress/arrowfunction-lexical-this-activation-sink-osrexit.js:
794         * stress/arrowfunction-lexical-this-activation-sink.js:
795         * stress/dont-crash-on-stack-overflow-when-parsing-builtin.js:
796         * stress/dont-crash-on-stack-overflow-when-parsing-default-constructor.js:
797         * stress/elide-new-object-dag-then-exit.js:
798         * stress/materialize-regexp-cyclic.js:
799         * stress/new-regex-inline.js:
800         * stress/op_add.js:
801         * stress/op_bitand.js:
802         * stress/op_bitor.js:
803         * stress/op_bitxor.js:
804         * stress/op_div-ConstVar.js:
805         * stress/op_div-VarConst.js:
806         * stress/op_div-VarVar.js:
807         * stress/op_lshift-ConstVar.js:
808         * stress/op_lshift-VarConst.js:
809         * stress/op_lshift-VarVar.js:
810         * stress/op_mod-ConstVar.js:
811         * stress/op_mod-VarConst.js:
812         * stress/op_mod-VarVar.js:
813         * stress/op_mul-ConstVar.js:
814         * stress/op_mul-VarConst.js:
815         * stress/op_mul-VarVar.js:
816         * stress/op_rshift-ConstVar.js:
817         * stress/op_rshift-VarConst.js:
818         * stress/op_rshift-VarVar.js:
819         * stress/op_sub-ConstVar.js:
820         * stress/op_sub-VarConst.js:
821         * stress/op_sub-VarVar.js:
822         * stress/op_urshift-ConstVar.js:
823         * stress/op_urshift-VarConst.js:
824         * stress/op_urshift-VarVar.js:
825         * stress/proxy-get-set-correct-receiver.js:
826         * stress/regress-179562.js:
827         * stress/rest-parameter-many-arguments.js:
828         * stress/sampling-profiler-richards.js:
829         * stress/splay-flash-access-1ms.js:
830         * stress/tailCallForwardArguments.js:
831         * stress/typed-array-get-by-val-profiling.js:
832         * typeProfiler/getter-richards.js:
833
834 2018-11-06  Michael Saboff  <msaboff@apple.com>
835
836         Multiple stress/regexp-compile-oom.js tests are failing on High Sierra Debug and Release JSC testers.
837         https://bugs.webkit.org/show_bug.cgi?id=191271
838
839         Reviewed by Saam Barati.
840
841         Added more test cases and made all test cases run with the same deeply recursive stack
842         instead of finding that same point for each test case.
843
844         * stress/regexp-compile-oom.js:
845         (prototype.runTest):
846         (recurseAndTest):
847         (testList.push.new.TestAndExpectedException):
848
849 2018-11-05  Michael Saboff  <msaboff@apple.com>
850
851         Unreviewed build fix for linux.
852
853         * stress/regexp-compile-oom.js: Disabled for non-darwin OSes.
854
855 2018-11-02  Michael Saboff  <msaboff@apple.com>
856
857         Rolling in r237753 with unreviewed build fix.
858
859         Fixed issues with DECLARE_THROW_SCOPE placement.
860
861 2018-11-02  Ryan Haddad  <ryanhaddad@apple.com>
862
863         Unreviewed, rolling out r237753.
864
865         Introduced JSC test failures
866
867         Reverted changeset:
868
869         "Running out of stack space not properly handled in
870         RegExp::compile() and its callers"
871         https://bugs.webkit.org/show_bug.cgi?id=191206
872         https://trac.webkit.org/changeset/237753
873
874 2018-11-02  Michael Saboff  <msaboff@apple.com>
875
876         Running out of stack space not properly handled in RegExp::compile() and its callers
877         https://bugs.webkit.org/show_bug.cgi?id=191206
878
879         Reviewed by Filip Pizlo.
880
881         New regression test.
882
883         * stress/regexp-compile-oom.js: Added.
884         (recurseAndTest):
885
886 2018-11-01  Guillaume Emont  <guijemont@igalia.com>
887
888         Skip tests on arm/mips that time out now we're running on CLoop
889
890         Unreviewed gardening.
891
892         Since the JIT is temporarily disabled on 32-bit platforms, these tests
893         time out on the bots and need to be disabled. There's more tests
894         disabled on arm because the timeout is longer on the mips bot (as the
895         device is slower to start with), so many of the tests don't time out
896         there.
897
898         * microbenchmarks/getter-richards.js: disable on arm and mips.
899         * stress/op_add.js: disable on arm.
900         * stress/op_bitand.js: disable on arm.
901         * stress/op_bitor.js: disable on arm.
902         * stress/op_bitxor.js: disable on arm.
903         * stress/op_lshift-ConstVar.js: disable on arm.
904         * stress/op_lshift-VarConst.js: disable on arm.
905         * stress/op_lshift-VarVar.js: disable on arm.
906         * stress/op_mod-ConstVar.js: disable on arm.
907         * stress/op_mod-VarConst.js: disable on arm.
908         * stress/op_mod-VarVar.js: disable on arm.
909         * stress/op_mul-ConstVar.js: disable on arm.
910         * stress/op_mul-VarConst.js: disable on arm.
911         * stress/op_mul-VarVar.js: disable on arm.
912         * stress/op_rshift-ConstVar.js: disable on arm.
913         * stress/op_rshift-VarConst.js: disable on arm.
914         * stress/op_rshift-VarVar.js: disable on arm.
915         * stress/op_sub-ConstVar.js: disable on arm.
916         * stress/op_sub-VarConst.js: disable on arm.
917         * stress/op_sub-VarVar.js: disable on arm.
918         * stress/op_urshift-ConstVar.js: disable on arm.
919         * stress/op_urshift-VarConst.js: disable on arm.
920         * stress/op_urshift-VarVar.js: disable on arm.
921         * stress/spread-forward-call-varargs-stack-overflow.js: disable on arm.
922         * stress/value-to-boolean.js: disable on arm and mips.
923
924 2018-10-31  Tadeu Zagallo  <tzagallo@apple.com>
925
926         REGRESSION(r237547): Exception handlers should be aware of wide opcodes
927         https://bugs.webkit.org/show_bug.cgi?id=191108
928         <rdar://problem/45690700>
929
930         Reviewed by Saam Barati.
931
932         * stress/wide-op_catch.js: Added.
933         (catch):
934
935 2018-10-29  Mark Lam  <mark.lam@apple.com>
936
937         Correctly detect string overflow when using the 'Function' constructor.
938         https://bugs.webkit.org/show_bug.cgi?id=184883
939         <rdar://problem/36320331>
940
941         Reviewed by Saam Barati.
942
943         I've verified that this passes on 32-bit as well.
944
945         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
946
947 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
948
949         Add support for GetStack FlushedDouble
950         https://bugs.webkit.org/show_bug.cgi?id=191012
951         <rdar://problem/45265141>
952
953         Reviewed by Saam Barati.
954
955         * stress/get-stack-double.js: Added.
956         (bar):
957         (noInline):
958
959 2018-10-29  Tadeu Zagallo  <tzagallo@apple.com>
960
961         New bytecode format for JSC
962         https://bugs.webkit.org/show_bug.cgi?id=187373
963         <rdar://problem/44186758>
964
965         Reviewed by Filip Pizlo.
966
967         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
968
969         * stress/maximum-inline-capacity.js: Added.
970         (test1):
971         (test3.Foo):
972         (test3):
973
974 2018-10-26  Commit Queue  <commit-queue@webkit.org>
975
976         Unreviewed, rolling out r237479 and r237484.
977         https://bugs.webkit.org/show_bug.cgi?id=190978
978
979         broke JSC on iOS (Requested by tadeuzagallo on #webkit).
980
981         Reverted changesets:
982
983         "New bytecode format for JSC"
984         https://bugs.webkit.org/show_bug.cgi?id=187373
985         https://trac.webkit.org/changeset/237479
986
987         "Gardening: Build fix after r237479."
988         https://bugs.webkit.org/show_bug.cgi?id=187373
989         https://trac.webkit.org/changeset/237484
990
991 2018-10-26  Tadeu Zagallo  <tzagallo@apple.com>
992
993         New bytecode format for JSC
994         https://bugs.webkit.org/show_bug.cgi?id=187373
995         <rdar://problem/44186758>
996
997         Reviewed by Filip Pizlo.
998
999         Add tests to ensure that the inferred inline capacity for a narrow op_new_object will be capped at 255.
1000
1001         * stress/maximum-inline-capacity.js: Added.
1002         (test1):
1003         (test3.Foo):
1004         (test3):
1005
1006 2018-10-26  Mark Lam  <mark.lam@apple.com>
1007
1008         Fix missing edge cases with JSGlobalObjects having a bad time.
1009         https://bugs.webkit.org/show_bug.cgi?id=189028
1010         <rdar://problem/45204939>
1011
1012         Reviewed by Saam Barati.
1013
1014         * stress/regress-189028.js: Added.
1015
1016 2018-10-22  Mark Lam  <mark.lam@apple.com>
1017
1018         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1019         https://bugs.webkit.org/show_bug.cgi?id=190515
1020         <rdar://problem/45222379>
1021
1022         Rubber-stamped by Saam Barati.
1023
1024         Adding another test.
1025
1026         * stress/regress-190515-2.js: Added.
1027
1028 2018-10-22  Mark Lam  <mark.lam@apple.com>
1029
1030         DFGAbstractValue::m_arrayModes expects IndexingMode values, not IndexingType.
1031         https://bugs.webkit.org/show_bug.cgi?id=190515
1032         <rdar://problem/45222379>
1033
1034         Reviewed by Saam Barati.
1035
1036         * stress/regress-190515.js: Added.
1037
1038 2018-10-19  Commit Queue  <commit-queue@webkit.org>
1039
1040         Unreviewed, rolling out r237254.
1041         https://bugs.webkit.org/show_bug.cgi?id=190760
1042
1043         "It regresses JetStream 2 by 5% on some iOS devices"
1044         (Requested by saamyjoon on #webkit).
1045
1046         Reverted changeset:
1047
1048         "[JSC] JSC should have "parseFunction" to optimize Function
1049         constructor"
1050         https://bugs.webkit.org/show_bug.cgi?id=190340
1051         https://trac.webkit.org/changeset/237254
1052
1053 2018-10-19  Saam Barati  <sbarati@apple.com>
1054
1055         vmCall should check if we exit before emitting an OSR exit due to exceptions
1056         https://bugs.webkit.org/show_bug.cgi?id=190740
1057         <rdar://problem/45220139>
1058
1059         Reviewed by Mark Lam.
1060
1061         * stress/dont-emit-osr-exits-for-every-call-ftl.js: Added.
1062         (foo):
1063
1064 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1065
1066         [ESNext][BigInt] Implement support for "^"
1067         https://bugs.webkit.org/show_bug.cgi?id=186235
1068
1069         Reviewed by Yusuke Suzuki.
1070
1071         * stress/big-int-bitwise-xor-general.js: Added.
1072         * stress/big-int-bitwise-xor-to-primitive-precedence.js: Added.
1073         * stress/big-int-bitwise-xor-type-error.js: Added.
1074         * stress/big-int-bitwise-xor-wrapped-value.js: Added.
1075
1076 2018-10-19  Caio Lima  <ticaiolima@gmail.com>
1077
1078         [BigInt] Add ValueSub into DFG
1079         https://bugs.webkit.org/show_bug.cgi?id=186176
1080
1081         Reviewed by Yusuke Suzuki.
1082
1083         * stress/big-int-subtraction-jit.js:
1084         * stress/value-sub-big-int-prediction-propagation.js: Added.
1085         * stress/value-sub-big-int-untyped.js: Added.
1086         * stress/value-sub-spec-none-case.js: Added.
1087
1088 2018-10-18  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1089
1090         [JSC] JSC should have "parseFunction" to optimize Function constructor
1091         https://bugs.webkit.org/show_bug.cgi?id=190340
1092
1093         Reviewed by Mark Lam.
1094
1095         This patch fixes the line number of syntax errors raised by the Function constructor,
1096         since we now parse the final code only once. And we no longer use block statement
1097         for Function constructor's parsing.
1098
1099         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1100         * stress/function-cache-with-parameters-end-position.js: Added.
1101         (shouldBe):
1102         (shouldThrow):
1103         (i.anonymous):
1104         * stress/function-constructor-name.js: Added.
1105         (shouldBe):
1106         (GeneratorFunction):
1107         (AsyncFunction.async):
1108         (AsyncGeneratorFunction.async):
1109         (anonymous):
1110         (async.anonymous):
1111         * test262/expectations.yaml:
1112
1113 2018-10-18  Commit Queue  <commit-queue@webkit.org>
1114
1115         Unreviewed, rolling out r237242.
1116         https://bugs.webkit.org/show_bug.cgi?id=190701
1117
1118         it breaks "stress/sampling-profiler-basic.js" (Requested by
1119         caiolima on #webkit).
1120
1121         Reverted changeset:
1122
1123         "[BigInt] Add ValueSub into DFG"
1124         https://bugs.webkit.org/show_bug.cgi?id=186176
1125         https://trac.webkit.org/changeset/237242
1126
1127 2018-10-17  Keith Miller  <keith_miller@apple.com>
1128
1129         AI does not clear Phantom allocation nodes.
1130         https://bugs.webkit.org/show_bug.cgi?id=190694
1131
1132         Reviewed by Saam Barati.
1133
1134         * stress/ftl-ai-filter-phantoms-should-clear-clear-value.js: Added.
1135         (Day):
1136         (DaysInYear):
1137         (TimeInYear):
1138         (TimeFromYear):
1139         (DayFromYear):
1140         (InLeapYear):
1141         (YearFromTime):
1142         (WeekDay):
1143         (DaylightSavingTA):
1144         (GetSecondSundayInMarch):
1145         (TimeInMonth):
1146
1147 2018-10-17  Caio Lima  <ticaiolima@gmail.com>
1148
1149         [BigInt] Add ValueSub into DFG
1150         https://bugs.webkit.org/show_bug.cgi?id=186176
1151
1152         Reviewed by Yusuke Suzuki.
1153
1154         * stress/big-int-subtraction-jit.js:
1155         * stress/value-sub-big-int-prediction-propagation.js: Added.
1156         * stress/value-sub-big-int-untyped.js: Added.
1157
1158 2018-10-16  Dominik Infuehr  <dinfuehr@igalia.com>
1159
1160         [JSC] stress/array-prototype-concat-of-long-spliced-arrays2.js times out on arm and mips
1161         https://bugs.webkit.org/show_bug.cgi?id=190611
1162
1163         Reviewed by Saam Barati.
1164
1165         Reduce array length just like in array-prototype-concat-of-long-spliced-arrays.js
1166         to improve test runtime. On ARM/MIPS this test even timed out when running all
1167         tests.
1168
1169         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1170         (test):
1171
1172 2018-10-15  Guillaume Emont  <guijemont@igalia.com>
1173
1174         Skip stress/array-prototype-concat-of-long-spliced-arrays2.js on arm and mips/linux
1175
1176         Unreviewed gardening.
1177
1178         * stress/array-prototype-concat-of-long-spliced-arrays2.js:
1179
1180 2018-10-15  Saam barati  <sbarati@apple.com>
1181
1182         Emit fjcvtzs on ARM64E on Darwin
1183         https://bugs.webkit.org/show_bug.cgi?id=184023
1184
1185         Reviewed by Yusuke Suzuki and Filip Pizlo.
1186
1187         * stress/double-to-int32-NaN.js: Added.
1188         (assert):
1189         (foo):
1190
1191 2018-10-15  Saam Barati  <sbarati@apple.com>
1192
1193         JSArray::shiftCountWithArrayStorage is wrong when an array has holes
1194         https://bugs.webkit.org/show_bug.cgi?id=190262
1195         <rdar://problem/44986241>
1196
1197         Reviewed by Mark Lam.
1198
1199         * stress/array-prototype-concat-of-long-spliced-arrays.js:
1200         (test):
1201         * stress/slice-array-storage-with-holes.js: Added.
1202         (main):
1203
1204 2018-10-15  Commit Queue  <commit-queue@webkit.org>
1205
1206         Unreviewed, rolling out r237054.
1207         https://bugs.webkit.org/show_bug.cgi?id=190593
1208
1209         "this regressed JetStream 2 by 6% on iOS" (Requested by
1210         saamyjoon on #webkit).
1211
1212         Reverted changeset:
1213
1214         "[JSC] JSC should have "parseFunction" to optimize Function
1215         constructor"
1216         https://bugs.webkit.org/show_bug.cgi?id=190340
1217         https://trac.webkit.org/changeset/237054
1218
1219 2018-10-13  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1220
1221         [JSC] JSON.stringify can accept call-with-no-arguments
1222         https://bugs.webkit.org/show_bug.cgi?id=190343
1223
1224         Reviewed by Mark Lam.
1225
1226         * stress/json-stringify-no-arguments.js: Added.
1227         (shouldBe):
1228
1229 2018-10-08  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1230
1231         [JSC] JSC should have "parseFunction" to optimize Function constructor
1232         https://bugs.webkit.org/show_bug.cgi?id=190340
1233
1234         Reviewed by Mark Lam.
1235
1236         This patch fixes the line number of syntax errors raised by the Function constructor,
1237         since we now parse the final code only once. And we no longer use block statement
1238         for Function constructor's parsing.
1239
1240         * ChakraCore/test/Function/FuncBodyES5.baseline-jsc:
1241         * stress/function-cache-with-parameters-end-position.js: Added.
1242         (shouldBe):
1243         (shouldThrow):
1244         (i.anonymous):
1245         * stress/function-constructor-name.js: Added.
1246         (shouldBe):
1247         (GeneratorFunction):
1248         (AsyncFunction.async):
1249         (AsyncGeneratorFunction.async):
1250         (anonymous):
1251         (async.anonymous):
1252         * test262/expectations.yaml:
1253
1254 2018-10-10  Guillaume Emont  <guijemont@igalia.com>
1255
1256         Skip JSC test stress/sampling-profiler-richards.js on armv7/linux
1257         https://bugs.webkit.org/show_bug.cgi?id=190426
1258
1259         Unreviewed gardening.
1260
1261         * stress/sampling-profiler-richards.js:
1262
1263 2018-10-06  Caio Lima  <ticaiolima@gmail.com>
1264
1265         [ESNext][BigInt] Implement support for "|"
1266         https://bugs.webkit.org/show_bug.cgi?id=186229
1267
1268         Reviewed by Yusuke Suzuki.
1269
1270         * stress/big-int-bitwise-and-jit.js:
1271         * stress/big-int-bitwise-or-general.js: Added.
1272         * stress/big-int-bitwise-or-jit-untyped.js: Added.
1273         * stress/big-int-bitwise-or-jit.js: Added.
1274         * stress/big-int-bitwise-or-memory-stress.js: Added.
1275         * stress/big-int-bitwise-or-to-primitive-precedence.js: Added.
1276         * stress/big-int-bitwise-or-type-error.js: Added.
1277         * stress/big-int-bitwise-or-wrapped-value.js: Added.
1278
1279 2018-10-05  Dominik Infuehr  <dominik.infuehr@gmail.com>
1280
1281         Skip test on systems with limited memory
1282         https://bugs.webkit.org/show_bug.cgi?id=190310
1283
1284         Invoking runDefault adds test to runlist, skipping the test in the next
1285         line does not prevent the test from executing. Change order of lines such
1286         that runDefault is only executed if test is not executed.
1287
1288         Reviewed by Mark Lam.
1289
1290         * stress/regress-190187.js:
1291
1292 2018-10-03  Saam barati  <sbarati@apple.com>
1293
1294         lowXYZ in FTLLower should always filter the type of the incoming edge
1295         https://bugs.webkit.org/show_bug.cgi?id=189939
1296         <rdar://problem/44407030>
1297
1298         Reviewed by Michael Saboff.
1299
1300         * stress/ftl-should-always-filter-for-low-type-check-functions.js: Added.
1301         (foo):
1302         (test):
1303
1304 2018-10-03  Mark Lam  <mark.lam@apple.com>
1305
1306         Make string MaxLength for all WTF and JS strings consistently equal to INT_MAX.
1307         https://bugs.webkit.org/show_bug.cgi?id=190187
1308         <rdar://problem/42512909>
1309
1310         Reviewed by Michael Saboff.
1311
1312         * stress/regress-190187.js: Added.
1313
1314 2018-10-02  Caio Lima  <ticaiolima@gmail.com>
1315
1316         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1317         https://bugs.webkit.org/show_bug.cgi?id=190033
1318
1319         Reviewed by Yusuke Suzuki.
1320
1321         * stress/big-int-to-string.js:
1322
1323 2018-10-01  Mark Lam  <mark.lam@apple.com>
1324
1325         Function.toString() should also copy the source code Functions that are class definitions.
1326         https://bugs.webkit.org/show_bug.cgi?id=190186
1327         <rdar://problem/44733360>
1328
1329         Reviewed by Saam Barati.
1330
1331         * stress/regress-190186.js: Added.
1332
1333 2018-10-01  Dominik Infuehr  <dinfuehr@igalia.com>
1334
1335         Split NaN-check into separate test
1336         https://bugs.webkit.org/show_bug.cgi?id=190010
1337
1338         Reviewed by Saam Barati.
1339
1340         DataView exposes NaN-representation, which is not necessarily the same on each
1341         architecture. Therefore move the check of the NaN-representation into its own
1342         file such that we can disable this test on MIPS where NaN-representation can be
1343         different on older CPUs.
1344
1345         * stress/dataview-jit-set-nan.js: Added.
1346         (assert):
1347         (test.storeLittleEndian):
1348         (test.storeBigEndian):
1349         (test.store):
1350         (test):
1351         * stress/dataview-jit-set.js:
1352         (test5):
1353
1354 2018-10-01  Commit Queue  <commit-queue@webkit.org>
1355
1356         Unreviewed, rolling out r236647.
1357         https://bugs.webkit.org/show_bug.cgi?id=190124
1358
1359         Breaking test stress/big-int-to-string.js (Requested by
1360         caiolima_ on #webkit).
1361
1362         Reverted changeset:
1363
1364         "[BigInt] BigInt.proptotype.toString is broken when radix is
1365         power of 2"
1366         https://bugs.webkit.org/show_bug.cgi?id=190033
1367         https://trac.webkit.org/changeset/236647
1368
1369 2018-09-30  Caio Lima  <ticaiolima@gmail.com>
1370
1371         [BigInt] BigInt.proptotype.toString is broken when radix is power of 2
1372         https://bugs.webkit.org/show_bug.cgi?id=190033
1373
1374         Reviewed by Yusuke Suzuki.
1375
1376         * stress/big-int-to-string.js:
1377
1378 2018-09-28  Caio Lima  <ticaiolima@gmail.com>
1379
1380         [ESNext][BigInt] Implement support for "&"
1381         https://bugs.webkit.org/show_bug.cgi?id=186228
1382
1383         Reviewed by Yusuke Suzuki.
1384
1385         * stress/big-int-bitwise-and-general.js: Added.
1386         (assert):
1387         (assert.sameValue):
1388         * stress/big-int-bitwise-and-jit.js: Added.
1389         (let.assert.sameValue):
1390         (bigIntBitAnd):
1391         * stress/big-int-bitwise-and-memory-stress.js: Added.
1392         (assert):
1393         * stress/big-int-bitwise-and-to-primitive-precedence.js: Added.
1394         (assert.sameValue):
1395         (let.o.Symbol.toPrimitive):
1396         (catch):
1397         * stress/big-int-bitwise-and-type-error.js: Added.
1398         (assert):
1399         (assertThrowTypeError):
1400         (let.o.valueOf):
1401         (o.valueOf):
1402         (o.toString):
1403         (o.Symbol.toPrimitive):
1404         * stress/big-int-bitwise-and-wrapped-value.js: Added.
1405         (assert.sameValue):
1406         (testBitAnd):
1407         (let.o.Symbol.toPrimitive):
1408         (o.valueOf):
1409         (o.toString):
1410
1411 2018-09-28  Ross Kirsling  <ross.kirsling@sony.com>
1412
1413         JSC test stress/jsc-read.js doesn't support CRLF
1414         https://bugs.webkit.org/show_bug.cgi?id=190063
1415
1416         Reviewed by Yusuke Suzuki.
1417
1418         In order to run this test via Windows command prompt, we can't assume that the final newline will be LF.
1419
1420         * stress/jsc-read.js:
1421         (test):
1422
1423 2018-09-27  Saam barati  <sbarati@apple.com>
1424
1425         Verify the contents of AssemblerBuffer on arm64e
1426         https://bugs.webkit.org/show_bug.cgi?id=190057
1427         <rdar://problem/38916630>
1428
1429         Reviewed by Mark Lam.
1430
1431         * stress/regress-189132.js:
1432
1433 2018-09-27  Dominik Infuehr  <dinfuehr@igalia.com>
1434
1435         Disable test without LLInt on ARMv7
1436         https://bugs.webkit.org/show_bug.cgi?id=190037
1437
1438         Reviewed by Mark Lam.
1439
1440         Test runs out of executable memory on ARMv7, do not run
1441         this test without LLInt enabled.
1442
1443         * stress/regress-169445.js:
1444
1445 2018-09-26  Keith Miller  <keith_miller@apple.com>
1446
1447         We should zero unused property storage when rebalancing array storage.
1448         https://bugs.webkit.org/show_bug.cgi?id=188151
1449
1450         Reviewed by Michael Saboff.
1451
1452         * stress/splice-should-zero-property-storage-when-rebalancing.js: Added.
1453
1454 2018-09-20  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1455
1456         [JSC] Optimize Array#lastIndexOf
1457         https://bugs.webkit.org/show_bug.cgi?id=189780
1458
1459         Reviewed by Saam Barati.
1460
1461         * stress/array-lastindexof-array-prototype-trap.js: Added.
1462         (shouldBe):
1463         (AncestorArray.prototype.get 2):
1464         (AncestorArray):
1465         * stress/array-lastindexof-have-a-bad-time-c-runtime.js: Added.
1466         (shouldBe):
1467         * stress/array-lastindexof-hole-nan.js: Added.
1468         (shouldBe):
1469         (throw.new.Error):
1470         * stress/array-lastindexof-infinity.js: Added.
1471         (shouldBe):
1472         (throw.new.Error):
1473         * stress/array-lastindexof-negative-zero.js: Added.
1474         (shouldBe):
1475         (throw.new.Error):
1476         * stress/array-lastindexof-own-getter.js: Added.
1477         (shouldBe):
1478         (throw.new.Error.get array):
1479         (get array):
1480         * stress/array-lastindexof-prototype-trap.js: Added.
1481         (shouldBe):
1482         (DerivedArray.prototype.get 2):
1483         (DerivedArray):
1484
1485 2018-09-25  Saam Barati  <sbarati@apple.com>
1486
1487         Calls to baselineCodeBlockForOriginAndBaselineCodeBlock in operationMaterializeObjectInOSR should actually pass in the baseline CodeBlock
1488         https://bugs.webkit.org/show_bug.cgi?id=189940
1489         <rdar://problem/43640987>
1490
1491         Reviewed by Mark Lam.
1492
1493         * stress/use-baseline-codeblock-materialize-osr-exit.js: Added.
1494
1495 2018-09-24  Saam Barati  <sbarati@apple.com>
1496
1497         Array.prototype.indexOf fast path needs to ensure the length is still valid after performing effects
1498         https://bugs.webkit.org/show_bug.cgi?id=189922
1499         <rdar://problem/44651275>
1500
1501         Reviewed by Mark Lam.
1502
1503         * stress/array-indexof-fast-path-effects.js: Added.
1504         * stress/array-indexof-cached-length.js: Added.
1505
1506 2018-09-24  Saam barati  <sbarati@apple.com>
1507
1508         ArgumentsEliminationPhase should snip basic blocks after proven OSR exits
1509         https://bugs.webkit.org/show_bug.cgi?id=189682
1510         <rdar://problem/43557315>
1511
1512         Reviewed by Mark Lam.
1513
1514         * stress/arguments-elimination-will-generate-edge-without-result.js: Added.
1515         (foo):
1516
1517 2018-09-22  Saam barati  <sbarati@apple.com>
1518
1519         The sampling should not use Strong<CodeBlock> in its machineLocation field
1520         https://bugs.webkit.org/show_bug.cgi?id=189319
1521
1522         Reviewed by Filip Pizlo.
1523
1524         * stress/sampling-profiler-richards.js: Added.
1525
1526 2018-09-19  Yusuke Suzuki  <yusukesuzuki@slowstart.org>
1527
1528         [JSC] Optimize Array#indexOf in C++ runtime
1529         https://bugs.webkit.org/show_bug.cgi?id=189507
1530
1531         Reviewed by Saam Barati.
1532
1533         * stress/array-indexof-array-prototype-trap.js: Added.
1534         (shouldBe):
1535         (AncestorArray.prototype.get 2):
1536         (AncestorArray):
1537         * stress/array-indexof-have-a-bad-time-c-runtime.js: Added.
1538         (shouldBe):
1539         * stress/array-indexof-hole-nan.js: Added.
1540         (shouldBe):
1541         (throw.new.Error):
1542         * stress/array-indexof-infinity.js: Added.
1543         (shouldBe):
1544         (throw.new.Error):
1545         * stress/array-indexof-negative-zero.js: Added.
1546         (shouldBe):
1547         (throw.new.Error):
1548         * stress/array-indexof-own-getter.js: Added.
1549         (shouldBe):
1550         (throw.new.Error.get array):
1551         (get array):
1552         * stress/array-indexof-prototype-trap.js: Added.
1553         (shouldBe):
1554         (DerivedArray.prototype.get 2):
1555         (DerivedArray):
1556
1557 2018-09-19  Saam barati  <sbarati@apple.com>
1558
1559         AI rule for MultiPutByOffset executes its effects in the wrong order
1560         https://bugs.webkit.org/show_bug.cgi?id=189757
1561         <rdar://problem/43535257>
1562
1563         Reviewed by Michael Saboff.
1564
1565         * stress/multi-put-by-offset-must-filter-value-before-filtering-base.js: Added.
1566         (foo):
1567         (Foo):
1568         (g):
1569
1570 2018-09-17  Mark Lam  <mark.lam@apple.com>
1571
1572         Ensure that ForInContexts are invalidated if their loop local is over-written.
1573         https://bugs.webkit.org/show_bug.cgi?id=189571
1574         <rdar://problem/44402277>
1575
1576         Reviewed by Saam Barati.
1577
1578         * stress/regress-189571.js: Added.
1579
1580 2018-09-17  Saam barati  <sbarati@apple.com>
1581
1582         We must convert ProfileType to CheckStructureOrEmpty instead of CheckStructure
1583         https://bugs.webkit.org/show_bug.cgi?id=189676
1584         <rdar://problem/39682897>
1585
1586         Reviewed by Michael Saboff.
1587
1588         * typeProfiler/check-structure-or-empty-in-fixup.js: Added.
1589         (A):
1590         (K):
1591         (i.catch):
1592
1593 2018-09-14  Saam barati  <sbarati@apple.com>
1594
1595         Don't dump OSRAvailabilityData in Graph::dump because a stale Availability may point to a Node that is already freed
1596         https://bugs.webkit.org/show_bug.cgi?id=189628
1597         <rdar://problem/39481690>
1598
1599         Reviewed by Mark Lam.
1600
1601         * stress/verbose-failure-dont-graph-dump-availability-already-freed.js: Added.
1602         (foo):
1603
1604 2018-09-11  Mark Lam  <mark.lam@apple.com>
1605
1606         Test for array initialization in arrayProtoFuncSplice.
1607         https://bugs.webkit.org/show_bug.cgi?id=170253
1608         <rdar://problem/31328773>
1609
1610         Rubber-stamped by Saam Barati.
1611
1612         * stress/regress-170253.js: Added.
1613
1614 2018-09-11  Mark Lam  <mark.lam@apple.com>
1615
1616         Test for IntlObject initialization.
1617         https://bugs.webkit.org/show_bug.cgi?id=170251
1618         <rdar://problem/31328419>
1619
1620         Rubber-stamped by Saam Barati.
1621
1622         * stress/regress-170251.js: Added.
1623
1624 2018-09-11  Mark Lam  <mark.lam@apple.com>
1625
1626         Test for array memcpy'ing when JSGlobalObject::haveABadTime.
1627         https://bugs.webkit.org/show_bug.cgi?id=169889
1628         <rdar://problem/31155607>
1629
1630         Reviewed by Saam Barati.
1631
1632         * stress/regress-169889-array-concat.js: Added.
1633         * stress/regress-169889-array-concat1.js: Added.
1634         * stress/regress-169889-array-slice.js: Added.
1635
1636 2018-09-11  Mark Lam  <mark.lam@apple.com>
1637
1638         Test for incorrect check in emitPutDerivedConstructorToArrowFunctionContextScope.
1639         https://bugs.webkit.org/show_bug.cgi?id=169445
1640         <rdar://problem/30957435>
1641
1642         Reviewed by Saam Barati.
1643
1644         * stress/regress-169445.js: Added.
1645         (let.gun.eval.A):
1646         (let.gun.eval.B.C):
1647         (let.gun.eval.B.C.prototype.trigger):
1648         (let.gun.eval.B.C.prototype.triggerWithRestParameters):
1649         (let.gun.eval.B):
1650         (let.gun.eval):
1651
1652 == Rolled over to ChangeLog-2018-09-11 ==