Constant fold CheckTypeInfoFlags on ImplementsDefaultHasInstance
[WebKit-https.git] / JSTests / ChangeLog
1 2018-05-16  Saam Barati  <sbarati@apple.com>
2
3         Constant fold CheckTypeInfoFlags on ImplementsDefaultHasInstance
4         https://bugs.webkit.org/show_bug.cgi?id=185670
5
6         Reviewed by Yusuke Suzuki.
7
8         * microbenchmarks/constant-fold-check-type-info-flags.js: Added.
9         * stress/dont-constant-fold-check-type-info-on-bound-function.js: Added.
10
11 2018-05-16  Commit Queue  <commit-queue@webkit.org>
12
13         Unreviewed, rolling out r231845.
14         https://bugs.webkit.org/show_bug.cgi?id=185702
15
16         it is breaking Apple High Sierra 32-bit JSC bot (Requested by
17         caiolima on #webkit).
18
19         Reverted changeset:
20
21         "[ESNext][BigInt] Implement support for "/" operation"
22         https://bugs.webkit.org/show_bug.cgi?id=183996
23         https://trac.webkit.org/changeset/231845
24
25 2018-05-16  Filip Pizlo  <fpizlo@apple.com>
26
27         DFG models InstanceOf incorrectly
28         https://bugs.webkit.org/show_bug.cgi?id=185694
29
30         Reviewed by Keith Miller.
31
32         * stress/instanceof-proxy-check-structure.js: Added.
33         (Foo):
34         (Bar):
35         (doBadThings):
36         (getPrototypeOf):
37         (foo):
38         (i.new.Bar):
39         (new.Bar):
40         * stress/instanceof-proxy-loop.js: Added.
41         (Foo):
42         (Bar):
43         (doBadThings):
44         (getPrototypeOf):
45         (foo):
46         * stress/instanceof-proxy.js: Added.
47         (Foo):
48         (Bar):
49         (doBadThings):
50         (getPrototypeOf):
51         (foo):
52
53 2018-05-16  Caio Lima  <ticaiolima@gmail.com>
54
55         [ESNext][BigInt] Implement support for "/" operation
56         https://bugs.webkit.org/show_bug.cgi?id=183996
57
58         Reviewed by Yusuke Suzuki.
59
60         * bigIntTests.yaml:
61         * stress/big-int-div-jit.js: Added.
62         * stress/big-int-div-memory-stress.js: Added.
63         * stress/big-int-div-to-primitive-precedence.js: Added.
64         * stress/big-int-div-to-primitive.js: Added.
65         * stress/big-int-div-type-error.js: Added.
66         * stress/big-int-div-wrapped-value.js: Added.
67         * stress/big-int-division.js: Added.
68
69 2018-05-14  Leo Balter  <leonardo.balter@gmail.com>
70
71         Fix a legacy CRLF eol from Test262
72         https://bugs.webkit.org/show_bug.cgi?id=185565
73
74         Reviewed by Yusuke Suzuki.
75
76         * test262/config.yaml:
77         * test262/test/built-ins/Math/cbrt/prop-desc.js:
78
79 2018-05-14  Yusuke Suzuki  <utatane.tea@gmail.com>
80
81         [JSC] timeClip(-0) should produce +0
82         https://bugs.webkit.org/show_bug.cgi?id=185589
83
84         Reviewed by Saam Barati.
85
86         Fix several test262 failures.
87
88         * stress/date-negative-zero.js: Added.
89         (shouldBe):
90         * test262/expectations.yaml:
91
92 2018-05-13  Caio Lima  <ticaiolima@gmail.com>
93
94         [BigInt] stress/big-int-spec-to-primitive.js test is failing
95         https://bugs.webkit.org/show_bug.cgi?id=185582
96
97         Reviewed by Yusuke Suzuki.
98
99         This patch is removing the use of ```numberOfDFGCompiles``` from 
100         stress/big-int-spec-to-primitive.js because it makes this est fail
101         sometimes.
102
103         * stress/big-int-spec-to-primitive.js:
104
105 2018-05-13  Andy VanWagoner  <andy@vanwagoner.family>
106
107         [INTL] Improve spec & test262 compliance for Intl APIs
108         https://bugs.webkit.org/show_bug.cgi?id=185578
109
110         Reviewed by Yusuke Suzuki.
111
112         Remove intl402 failures that have been fixed.
113
114         * test262/expectations.yaml:
115         * stress/regress-178385.js: toStringTag is configurable, but not writable.
116
117 2018-05-11  Caio Lima  <ticaiolima@gmail.com>
118
119         [ESNext][BigInt] Implement support for "*" operation
120         https://bugs.webkit.org/show_bug.cgi?id=183721
121
122         Reviewed by Yusuke Suzuki.
123
124         * bigIntTests.yaml:
125         * stress/big-int-mul-jit.js: Added.
126         * stress/big-int-mul-to-primitive-precedence.js: Added.
127         * stress/big-int-mul-to-primitive.js: Added.
128         * stress/big-int-mul-type-error.js: Added.
129         * stress/big-int-mul-wrapped-value.js: Added.
130         * stress/big-int-multiplication.js: Added.
131         * stress/big-int-multiply-memory-stress.js: Added.
132
133 2018-05-11  Michael Saboff  <msaboff@apple.com>
134
135         [DFG] Compiler uses incorrect output register for NumberIsInteger operation
136         https://bugs.webkit.org/show_bug.cgi?id=185328
137
138         Reviewed by Keith Miller.
139
140         New regression test.
141
142         * stress/isInteger-doesnt-overwrite-argument.js: Added.
143         (testIsInteger):
144
145 2018-05-09  Yusuke Suzuki  <utatane.tea@gmail.com>
146
147         [JSC] Object.assign for final objects should be faster
148         https://bugs.webkit.org/show_bug.cgi?id=185348
149
150         Reviewed by Saam Barati.
151
152         * stress/object-assign-fast-path.js: Added.
153         (shouldBe):
154         (checkProperty):
155
156 2018-05-10  Leo Balter  <leonardo.balter@gmail.com>
157
158         Update Test262 tests through the new import script - 20180509
159         https://bugs.webkit.org/show_bug.cgi?id=185482
160
161         Reviewed by Michael Saboff.
162
163         Also update the test262/expecatations.yaml with the recent imported files.
164
165         * test262/expectations.yaml:
166         * test262/harness/compareIterator.js: Added.
167         (assert.compareIterator):
168         * test262/harness/nativeFunctionMatcher.js:
169         (const.assertToStringOrNativeFunction):
170         (const.assertNativeFunction):
171         * test262/harness/regExpUtils.js:
172         * test262/harness/testIntl.js:
173         (getInvalidLanguageTags):
174         * test262/harness/testTypedArray.js:
175         * test262/harness/wellKnownIntrinsicObjects.js: Added.
176         (WellKnownIntrinsicObjects.forEach.wkio.catch):
177         * test262/latest-changes-summary.txt: Added.
178         * test262/test/annexB/language/eval-code/direct/block-decl-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/block-decl-strict-caller.js.
179         (catch):
180         * test262/test/annexB/language/eval-code/direct/switch-case-decl-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-source.js.
181         (catch):
182         * test262/test/annexB/language/eval-code/direct/switch-dflt-decl-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-caller.js.
183         (catch):
184         * test262/test/annexB/language/function-code/block-decl-nested-blocks-with-fun-decl.js: Added.
185         (g.f):
186         (g):
187         * test262/test/annexB/language/function-code/block-decl-nostrict.js: Copied from JSTests/test262/test/language/function-code/block-decl-strict.js.
188         (catch):
189         (f):
190         * test262/test/annexB/language/function-code/switch-case-decl-nostrict.js: Copied from JSTests/test262/test/language/function-code/switch-case-decl-strict.js.
191         (catch):
192         (switch.case.1):
193         (switch):
194         * test262/test/annexB/language/function-code/switch-dflt-decl-nostrict.js: Copied from JSTests/test262/test/language/function-code/switch-dflt-decl-strict.js.
195         (catch):
196         (switch.default):
197         (switch):
198         * test262/test/built-ins/Array/prototype/filter/target-array-with-non-writable-property.js: Added.
199         (a.Symbol.species):
200         (r.a.filter):
201         * test262/test/built-ins/Array/prototype/indexOf/calls-only-has-on-prototype-after-length-zeroed.js: Added.
202         (allowProxyTraps.has):
203         (fromIndex.valueOf):
204         * test262/test/built-ins/Array/prototype/lastIndexOf/calls-only-has-on-prototype-after-length-zeroed.js: Added.
205         (allowProxyTraps.has):
206         (fromIndex.valueOf):
207         * test262/test/built-ins/Array/prototype/map/target-array-with-non-writable-property.js: Added.
208         (a.Symbol.species):
209         (r.a.map):
210         * test262/test/built-ins/Array/prototype/slice/target-array-with-non-writable-property.js: Added.
211         (a.Symbol.species):
212         * test262/test/built-ins/Array/prototype/splice/property-traps-order-with-species.js: Added.
213         (a.Symbol.species):
214         * test262/test/built-ins/Array/prototype/splice/target-array-with-non-writable-property.js: Added.
215         (a.Symbol.species):
216         * test262/test/built-ins/Atomics/Symbol.toStringTag.js:
217         * test262/test/built-ins/Atomics/add/bad-range.js:
218         (testWithTypedArrayConstructors):
219         * test262/test/built-ins/Atomics/add/good-views.js:
220         (testWithTypedArrayConstructors):
221         * test262/test/built-ins/Atomics/add/non-views.js:
222         * test262/test/built-ins/Atomics/add/nonshared-int-views.js:
223         (testWithTypedArrayConstructors):
224         * test262/test/built-ins/Atomics/add/shared-nonint-views.js:
225         (testWithTypedArrayConstructors):
226         * test262/test/built-ins/Atomics/and/bad-range.js:
227         (testWithTypedArrayConstructors):
228         * test262/test/built-ins/Atomics/and/good-views.js:
229         (testWithTypedArrayConstructors):
230         * test262/test/built-ins/Atomics/and/non-views.js:
231         * test262/test/built-ins/Atomics/and/nonshared-int-views.js:
232         (testWithTypedArrayConstructors):
233         * test262/test/built-ins/Atomics/and/shared-nonint-views.js:
234         (testWithTypedArrayConstructors):
235         * test262/test/built-ins/Atomics/compareExchange/bad-range.js:
236         (testWithTypedArrayConstructors):
237         * test262/test/built-ins/Atomics/compareExchange/good-views.js:
238         (testWithTypedArrayConstructors):
239         (view): Deleted.
240         * test262/test/built-ins/Atomics/compareExchange/non-views.js:
241         * test262/test/built-ins/Atomics/compareExchange/nonshared-int-views.js:
242         (testWithTypedArrayConstructors):
243         * test262/test/built-ins/Atomics/compareExchange/shared-nonint-views.js:
244         (testWithTypedArrayConstructors):
245         * test262/test/built-ins/Atomics/exchange/bad-range.js:
246         (testWithTypedArrayConstructors):
247         * test262/test/built-ins/Atomics/exchange/good-views.js:
248         (testWithTypedArrayConstructors):
249         * test262/test/built-ins/Atomics/exchange/non-views.js:
250         * test262/test/built-ins/Atomics/exchange/nonshared-int-views.js:
251         (testWithTypedArrayConstructors):
252         * test262/test/built-ins/Atomics/exchange/shared-nonint-views.js:
253         (testWithTypedArrayConstructors):
254         * test262/test/built-ins/Atomics/isLockFree/corner-cases.js:
255         (hide):
256         * test262/test/built-ins/Atomics/isLockFree/value.js:
257         (testIsLockFree): Deleted.
258         * test262/test/built-ins/Atomics/load/bad-range.js:
259         (testWithTypedArrayConstructors):
260         * test262/test/built-ins/Atomics/load/good-views.js:
261         (testWithTypedArrayConstructors):
262         * test262/test/built-ins/Atomics/load/non-views.js:
263         * test262/test/built-ins/Atomics/load/nonshared-int-views.js:
264         (testWithTypedArrayConstructors):
265         * test262/test/built-ins/Atomics/load/shared-nonint-views.js:
266         (testWithTypedArrayConstructors):
267         * test262/test/built-ins/Atomics/or/bad-range.js:
268         (testWithTypedArrayConstructors):
269         * test262/test/built-ins/Atomics/or/good-views.js:
270         (testWithTypedArrayConstructors):
271         * test262/test/built-ins/Atomics/or/non-views.js:
272         * test262/test/built-ins/Atomics/or/nonshared-int-views.js:
273         (testWithTypedArrayConstructors):
274         * test262/test/built-ins/Atomics/or/shared-nonint-views.js:
275         (testWithTypedArrayConstructors):
276         * test262/test/built-ins/Atomics/prop-desc.js:
277         * test262/test/built-ins/Atomics/proto.js:
278         * test262/test/built-ins/Atomics/store/bad-range.js:
279         (testWithTypedArrayConstructors):
280         * test262/test/built-ins/Atomics/store/good-views.js:
281         (testWithTypedArrayConstructors):
282         (ToInteger):
283         * test262/test/built-ins/Atomics/store/non-views.js:
284         * test262/test/built-ins/Atomics/store/nonshared-int-views.js:
285         (testWithTypedArrayConstructors):
286         * test262/test/built-ins/Atomics/store/shared-nonint-views.js:
287         (testWithTypedArrayConstructors):
288         * test262/test/built-ins/Atomics/sub/bad-range.js:
289         (testWithTypedArrayConstructors):
290         * test262/test/built-ins/Atomics/sub/good-views.js:
291         (testWithTypedArrayConstructors):
292         * test262/test/built-ins/Atomics/sub/non-views.js:
293         * test262/test/built-ins/Atomics/sub/nonshared-int-views.js:
294         (testWithTypedArrayConstructors):
295         * test262/test/built-ins/Atomics/sub/shared-nonint-views.js:
296         (testWithTypedArrayConstructors):
297         * test262/test/built-ins/Atomics/wait/bad-range.js: Copied from JSTests/test262/test/built-ins/Atomics/wake/bad-range.js.
298         (testWithTypedArrayConstructors):
299         * test262/test/built-ins/Atomics/wait/cannot-suspend-throws.js:
300         * test262/test/built-ins/Atomics/wait/did-timeout.js:
301         (getReport):
302         * test262/test/built-ins/Atomics/wait/false-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/false-for-timeout.js.
303         (getReport):
304         (262.agent.start.valueOf.valueOf):
305         (toPrimitive.Symbol.toPrimitive):
306         (262.agent.receiveBroadcast):
307         * test262/test/built-ins/Atomics/wait/false-for-timeout.js:
308         (valueOf.valueOf):
309         (toPrimitive.Symbol.toPrimitive):
310         (getReport): Deleted.
311         (262.agent.start.262.agent.receiveBroadcast): Deleted.
312         * test262/test/built-ins/Atomics/wait/good-views.js:
313         (r.getReport):
314         (getReport):
315         * test262/test/built-ins/Atomics/wait/nan-for-timeout.js:
316         (getReport):
317         * test262/test/built-ins/Atomics/wait/negative-index-throws.js:
318         * test262/test/built-ins/Atomics/wait/negative-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/negative-timeout.js.
319         (getReport):
320         (262.agent.start.262.agent.receiveBroadcast):
321         * test262/test/built-ins/Atomics/wait/negative-timeout.js:
322         (262.agent.start.262.agent.receiveBroadcast): Deleted.
323         (getReport): Deleted.
324         * test262/test/built-ins/Atomics/wait/no-spurious-wakeup.js:
325         (getReport):
326         * test262/test/built-ins/Atomics/wait/non-int32-typedarray-throws.js:
327         * test262/test/built-ins/Atomics/wait/non-shared-bufferdata-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/nonshared-bufferdata-throws.js.
328         * test262/test/built-ins/Atomics/wait/not-a-typedarray-throws.js:
329         * test262/test/built-ins/Atomics/wait/not-an-object-throws.js:
330         * test262/test/built-ins/Atomics/wait/null-bufferdata-throws.js:
331         * test262/test/built-ins/Atomics/wait/null-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/false-for-timeout.js.
332         (getReport):
333         (262.agent.start.valueOf.valueOf):
334         (toPrimitive.Symbol.toPrimitive):
335         (262.agent.receiveBroadcast):
336         * test262/test/built-ins/Atomics/wait/null-for-timeout.js:
337         (valueOf.valueOf):
338         (toPrimitive.Symbol.toPrimitive):
339         (getReport): Deleted.
340         (262.agent.start.262.agent.receiveBroadcast): Deleted.
341         * test262/test/built-ins/Atomics/wait/object-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/false-for-timeout.js.
342         (getReport):
343         (262.agent.start.valueOf.valueOf):
344         (toString.toString):
345         (toPrimitive.Symbol.toPrimitive):
346         (262.agent.receiveBroadcast):
347         * test262/test/built-ins/Atomics/wait/object-for-timeout.js:
348         (valueOf.valueOf):
349         (toString.toString):
350         (toPrimitive.Symbol.toPrimitive):
351         (getReport): Deleted.
352         (262.agent.start.262.agent.receiveBroadcast): Deleted.
353         * test262/test/built-ins/Atomics/wait/out-of-range-index-throws.js:
354         * test262/test/built-ins/Atomics/wait/poisoned-object-for-timeout-throws-agent.js: Added.
355         (getReport):
356         (262.agent.start.poisonedValueOf.valueOf):
357         (poisonedToPrimitive.Symbol.toPrimitive):
358         (262.agent.receiveBroadcast):
359         * test262/test/built-ins/Atomics/wait/poisoned-object-for-timeout-throws.js:
360         (poisonedValueOf.valueOf):
361         (poisonedToPrimitive.Symbol.toPrimitive):
362         (getReport): Deleted.
363         (262.agent.start.262.agent.receiveBroadcast): Deleted.
364         * test262/test/built-ins/Atomics/wait/symbol-for-index-throws-agent.js: Added.
365         (getReport):
366         (262.agent.start.poisonedValueOf.valueOf):
367         (poisonedToPrimitive.Symbol.toPrimitive):
368         (262.agent.receiveBroadcast):
369         * test262/test/built-ins/Atomics/wait/symbol-for-index-throws.js:
370         (poisonedToPrimitive.Symbol.toPrimitive):
371         (poisoned.valueOf): Deleted.
372         (poisonedWithString.get valueOf): Deleted.
373         (poisonedToPrimitive.get Symbol): Deleted.
374         * test262/test/built-ins/Atomics/wait/symbol-for-timeout-throws-agent.js: Added.
375         (getReport):
376         (262.agent.start.262.agent.receiveBroadcast):
377         * test262/test/built-ins/Atomics/wait/symbol-for-timeout-throws.js:
378         (poisonedValueOf.valueOf):
379         (poisonedToPrimitive.Symbol.toPrimitive):
380         (getReport): Deleted.
381         (262.agent.start.262.agent.receiveBroadcast): Deleted.
382         * test262/test/built-ins/Atomics/wait/symbol-for-value-throws-agent.js: Added.
383         (getReport):
384         (262.agent.start.poisonedValueOf.valueOf):
385         (poisonedToPrimitive.Symbol.toPrimitive):
386         (262.agent.receiveBroadcast):
387         * test262/test/built-ins/Atomics/wait/symbol-for-value-throws.js: Added.
388         (poisonedValueOf.valueOf):
389         (poisonedToPrimitive.Symbol.toPrimitive):
390         * test262/test/built-ins/Atomics/wait/true-for-timeout-agent.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/null-for-timeout.js.
391         (getReport):
392         (262.agent.start.valueOf.valueOf):
393         (toPrimitive.Symbol.toPrimitive):
394         (262.agent.receiveBroadcast):
395         * test262/test/built-ins/Atomics/wait/true-for-timeout.js:
396         (valueOf.valueOf):
397         (toPrimitive.Symbol.toPrimitive):
398         (getReport): Deleted.
399         (262.agent.start.262.agent.receiveBroadcast): Deleted.
400         * test262/test/built-ins/Atomics/wait/undefined-for-timeout.js:
401         (getReport):
402         * test262/test/built-ins/Atomics/wait/undefined-index-defaults-to-zero.js:
403         (262.agent.start.262.agent.receiveBroadcast):
404         (getReport):
405         * test262/test/built-ins/Atomics/wait/value-not-equal.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/wait-index-value-not-equal.js.
406         (getReport):
407         (262.agent.start.262.agent.receiveBroadcast):
408         * test262/test/built-ins/Atomics/wait/wait-index-value-not-equal.js:
409         (262.agent.start.262.agent.receiveBroadcast):
410         * test262/test/built-ins/Atomics/wait/waiterlist-block-indexedposition-wake.js: Added.
411         (getReport):
412         (262.agent.start.262.agent.receiveBroadcast):
413         * test262/test/built-ins/Atomics/wait/waiterlist-order-of-operations-is-fifo.js: Added.
414         (getReport):
415         (262.agent.start.262.agent.receiveBroadcast):
416         * test262/test/built-ins/Atomics/wait/was-woken-before-timeout.js:
417         (getReport):
418         (262.agent.start.262.agent.receiveBroadcast):
419         * test262/test/built-ins/Atomics/wait/was-woken.js:
420         (getReport):
421         (262.agent.start.262.agent.receiveBroadcast):
422         * test262/test/built-ins/Atomics/wake/bad-range.js:
423         (testWithTypedArrayConstructors):
424         * test262/test/built-ins/Atomics/wake/count-boundary-cases.js: Renamed from JSTests/test262/test/built-ins/Atomics/wake/counts.js.
425         * test262/test/built-ins/Atomics/wake/count-defaults-to-infinity-missing.js: Added.
426         (getReport):
427         (262.agent.start.262.agent.receiveBroadcast):
428         * test262/test/built-ins/Atomics/wake/count-defaults-to-infinity-undefined.js: Added.
429         (getReport):
430         (262.agent.start.262.agent.receiveBroadcast):
431         * test262/test/built-ins/Atomics/wake/count-from-nans.js: Added.
432         * test262/test/built-ins/Atomics/wake/count-symbol-throws.js: Added.
433         * test262/test/built-ins/Atomics/wake/count-tointeger-throws-then-wake-throws.js: Added.
434         (poisoned.valueOf):
435         * test262/test/built-ins/Atomics/wake/good-views.js:
436         * test262/test/built-ins/Atomics/wake/negative-count.js: Renamed from JSTests/test262/test/built-ins/Atomics/wake/wake-negative.js.
437         * test262/test/built-ins/Atomics/wake/negative-index-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/negative-index-throws.js.
438         (poisoned.valueOf):
439         * test262/test/built-ins/Atomics/wake/non-int32-typedarray-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/non-int32-typedarray-throws.js.
440         (poisoned.valueOf):
441         * test262/test/built-ins/Atomics/wake/non-shared-bufferdata-throws.js: Renamed from JSTests/test262/test/built-ins/Atomics/wait/nonshared-bufferdata-throws.js.
442         (poisoned.valueOf):
443         * test262/test/built-ins/Atomics/wake/non-views.js:
444         * test262/test/built-ins/Atomics/wake/nonshared-int-views.js:
445         (testWithTypedArrayConstructors):
446         * test262/test/built-ins/Atomics/wake/not-a-typedarray-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/not-a-typedarray-throws.js.
447         (poisoned.valueOf):
448         * test262/test/built-ins/Atomics/wake/not-an-object-throws.js: Added.
449         (poisoned.valueOf):
450         * test262/test/built-ins/Atomics/wake/null-bufferdata-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/null-bufferdata-throws.js.
451         (poisoned.valueOf):
452         * test262/test/built-ins/Atomics/wake/out-of-range-index-throws.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/out-of-range-index-throws.js.
453         (poisoned.valueOf):
454         * test262/test/built-ins/Atomics/wake/shared-nonint-views.js:
455         (testWithTypedArrayConstructors):
456         * test262/test/built-ins/Atomics/wake/symbol-for-index-throws.js: Added.
457         (poisonedValueOf.valueOf):
458         (poisonedToPrimitive.Symbol.toPrimitive):
459         * test262/test/built-ins/Atomics/wake/undefined-index-defaults-to-zero.js: Copied from JSTests/test262/test/built-ins/Atomics/wait/undefined-index-defaults-to-zero.js.
460         (262.agent.start.262.agent.receiveBroadcast):
461         (getReport):
462         * test262/test/built-ins/Atomics/wake/wake-all-on-loc.js:
463         (262.agent.start.262.agent.receiveBroadcast):
464         (getReport):
465         (waitUntil):
466         * test262/test/built-ins/Atomics/wake/wake-all.js:
467         (262.agent.start.262.agent.receiveBroadcast):
468         (getReport):
469         (waitUntil):
470         * test262/test/built-ins/Atomics/wake/wake-in-order.js:
471         (getReport):
472         (waitUntil):
473         * test262/test/built-ins/Atomics/wake/wake-nan.js:
474         (getReport):
475         * test262/test/built-ins/Atomics/wake/wake-one.js:
476         (getReport):
477         (waitUntil):
478         * test262/test/built-ins/Atomics/wake/wake-rewake-noop.js: Added.
479         (getReport):
480         (waitUntil):
481         (262.agent.start.262.agent.receiveBroadcast):
482         * test262/test/built-ins/Atomics/wake/wake-two.js:
483         (getReport):
484         * test262/test/built-ins/Atomics/wake/wake-with-no-agents-waiting.js: Added.
485         (262.agent.start.262.agent.receiveBroadcast):
486         (waitUntil):
487         * test262/test/built-ins/Atomics/wake/wake-with-no-matching-agents-waiting.js: Added.
488         (262.agent.start.262.agent.receiveBroadcast):
489         (waitUntil):
490         * test262/test/built-ins/Atomics/wake/wake-zero.js:
491         (i.262.agent.start.262.agent.receiveBroadcast):
492         (getReport):
493         (waitUntil):
494         * test262/test/built-ins/Atomics/xor/bad-range.js:
495         (testWithTypedArrayConstructors):
496         * test262/test/built-ins/Atomics/xor/good-views.js:
497         (testWithTypedArrayConstructors):
498         * test262/test/built-ins/Atomics/xor/non-views.js:
499         * test262/test/built-ins/Atomics/xor/nonshared-int-views.js:
500         (testWithTypedArrayConstructors):
501         * test262/test/built-ins/Atomics/xor/shared-nonint-views.js:
502         (testWithTypedArrayConstructors):
503         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint-errors.js:
504         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint-toprimitive.js:
505         * test262/test/built-ins/BigInt/asIntN/bigint-tobigint-wrapped-values.js:
506         * test262/test/built-ins/BigInt/asIntN/bits-toindex-errors.js:
507         * test262/test/built-ins/BigInt/asIntN/bits-toindex-toprimitive.js:
508         * test262/test/built-ins/BigInt/asIntN/bits-toindex-wrapped-values.js:
509         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint-errors.js:
510         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint-toprimitive.js:
511         * test262/test/built-ins/BigInt/asUintN/bigint-tobigint-wrapped-values.js:
512         * test262/test/built-ins/BigInt/asUintN/bits-toindex-errors.js:
513         * test262/test/built-ins/BigInt/asUintN/bits-toindex-toprimitive.js:
514         * test262/test/built-ins/BigInt/asUintN/bits-toindex-wrapped-values.js:
515         * test262/test/built-ins/BigInt/constructor-empty-string.js:
516         * test262/test/built-ins/BigInt/constructor-from-binary-string.js:
517         * test262/test/built-ins/BigInt/constructor-from-decimal-string.js:
518         * test262/test/built-ins/BigInt/constructor-from-hex-string.js:
519         * test262/test/built-ins/BigInt/constructor-from-octal-string.js:
520         * test262/test/built-ins/BigInt/constructor-from-string-syntax-errors.js:
521         * test262/test/built-ins/BigInt/constructor-integer.js: Added.
522         * test262/test/built-ins/BigInt/constructor-trailing-leading-spaces.js:
523         * test262/test/built-ins/BigInt/issafeinteger-true.js: Removed.
524         * test262/test/built-ins/BigInt/out-of-bounds-integer-rangeerror.js: Removed.
525         * test262/test/built-ins/BigInt/prototype/Symbol.toStringTag.js:
526         * test262/test/built-ins/BigInt/prototype/toString/default-radix.js: Added.
527         * test262/test/built-ins/BigInt/prototype/toString/thisbigintvalue-not-valid-throws.js:
528         * test262/test/built-ins/BigInt/prototype/valueOf/cross-realm.js: Added.
529         * test262/test/built-ins/BigInt/tostring-throws.js: Copied from JSTests/test262/test/built-ins/BigInt/value-of-throws.js.
530         * test262/test/built-ins/BigInt/valueof-throws.js: Renamed from JSTests/test262/test/built-ins/BigInt/value-of-throws.js.
531         (BigInt.valueOf):
532         * test262/test/built-ins/DataView/prototype/setBigInt64/set-values-return-undefined.js:
533         (values.forEach):
534         * test262/test/built-ins/Function/prototype/bind/length-exceeds-int32.js: Added.
535         (f):
536         * test262/test/built-ins/Function/prototype/toString/anonymous-intrinsics.js: Removed.
537         * test262/test/built-ins/Function/prototype/toString/bound-function.js:
538         (assertNativeFunction):
539         (let.f): Deleted.
540         * test262/test/built-ins/Function/prototype/toString/built-in-function-object.js: Added.
541         * test262/test/built-ins/Function/prototype/toString/intrinsics.js: Removed.
542         * test262/test/built-ins/Function/prototype/toString/proxy-arrow-function.js: Added.
543         (assertNativeFunction.new.Proxy):
544         * test262/test/built-ins/Function/prototype/toString/proxy-async-function.js: Added.
545         (assertNativeFunction.new.Proxy.async):
546         * test262/test/built-ins/Function/prototype/toString/proxy-async-generator-function.js: Added.
547         (assertNativeFunction.new.Proxy.async):
548         * test262/test/built-ins/Function/prototype/toString/proxy-async-generator-method-definition.js: Added.
549         (assertNativeFunction.new.Proxy.async.method):
550         (apply):
551         * test262/test/built-ins/Function/prototype/toString/proxy-async-method-definition.js: Added.
552         (assertNativeFunction.new.Proxy.async.method):
553         (apply):
554         * test262/test/built-ins/Function/prototype/toString/proxy-bound-function.js: Added.
555         (assertNativeFunction.new.Proxy):
556         (bind):
557         * test262/test/built-ins/Function/prototype/toString/proxy-class.js: Added.
558         (assertNativeFunction):
559         * test262/test/built-ins/Function/prototype/toString/proxy-function-expression.js: Added.
560         (assertNativeFunction.new.Proxy):
561         * test262/test/built-ins/Function/prototype/toString/proxy-generator-function.js: Added.
562         (assertNativeFunction.new.Proxy):
563         * test262/test/built-ins/Function/prototype/toString/proxy-method-definition.js: Added.
564         (assertNativeFunction.new.Proxy.method):
565         (apply):
566         * test262/test/built-ins/Function/prototype/toString/proxy-non-callable-throws.js: Added.
567         * test262/test/built-ins/Function/prototype/toString/proxy.js: Removed.
568         * test262/test/built-ins/Function/prototype/toString/well-known-intrinsic-object-functions.js: Added.
569         (WellKnownIntrinsicObjects.forEach):
570         * test262/test/built-ins/JSON/prop-desc.js: Added.
571         * test262/test/built-ins/Math/acosh/nan-returns.js:
572         * test262/test/built-ins/Math/asinh/asinh-specialVals.js:
573         * test262/test/built-ins/Math/atanh/atanh-specialVals.js:
574         * test262/test/built-ins/Math/cbrt/cbrt-specialValues.js:
575         * test262/test/built-ins/Math/cbrt/prop-desc.js:
576         * test262/test/built-ins/Math/cosh/cosh-specialVals.js:
577         * test262/test/built-ins/Math/expm1/expm1-specialVals.js:
578         * test262/test/built-ins/Math/log10/Log10-specialVals.js:
579         * test262/test/built-ins/Math/log2/log2-basicTests.js:
580         * test262/test/built-ins/Math/prop-desc.js:
581         * test262/test/built-ins/Math/sign/sign-specialVals.js:
582         * test262/test/built-ins/Math/sinh/sinh-specialVals.js:
583         * test262/test/built-ins/Math/tanh/tanh-specialVals.js:
584         * test262/test/built-ins/Math/trunc/trunc-sampleTests.js:
585         * test262/test/built-ins/Math/trunc/trunc-specialVals.js:
586         * test262/test/built-ins/Object/assign/strings-and-symbol-order.js: Added.
587         * test262/test/built-ins/Object/keys/property-traps-order-with-proxied-array.js: Added.
588         (get t):
589         * test262/test/built-ins/Reflect/Reflect.js: Removed.
590         * test262/test/built-ins/Reflect/prop-desc.js: Added.
591         * test262/test/built-ins/Reflect/properties.js: Removed.
592         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/internal-regexp-lastindex-not-zero.js: Added.
593         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-internal-regexp-is-false.js: Added.
594         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-internal-regexp-throws.js: Added.
595         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/isregexp-this-throws.js: Added.
596         (obj.get Symbol):
597         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/length.js: Added.
598         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/name.js: Added.
599         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/prop-desc.js: Added.
600         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/regexpcreate-this-throws.js: Added.
601         (obj.toString):
602         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-get-constructor-throws.js: Added.
603         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-get-species-throws.js: Added.
604         (regexp.get Symbol):
605         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-is-not-object-throws.js: Added.
606         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-is-undefined.js: Added.
607         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-species-is-not-constructor.js: Added.
608         (callMatchAll):
609         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-species-is-null-or-undefined.js: Added.
610         (TestWithConstructor):
611         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor-species-throws.js: Added.
612         (regexp.Symbol.species):
613         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-constructor.js: Added.
614         (regexp.Symbol.species):
615         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-global-throws.js: Added.
616         (regexp.Symbol.species):
617         (get assert):
618         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-unicode-throws.js: Added.
619         (regexp.Symbol.species):
620         (get assert):
621         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/string-tostring-throws.js: Added.
622         (obj.valueOf):
623         (obj.toString):
624         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/string-tostring.js: Added.
625         (obj.toString):
626         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-get-flags-throws.js: Added.
627         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-get-flags.js: Added.
628         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-lastindex-cached.js: Added.
629         (regexp.lastIndex.valueOf):
630         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-not-object-throws.js: Added.
631         (callMatchAll):
632         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-tolength-lastindex-throws.js: Added.
633         (regexp.lastIndex.valueOf):
634         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-tostring-flags-throws.js: Added.
635         (value.valueOf):
636         (value.toString):
637         * test262/test/built-ins/RegExp/prototype/Symbol.matchAll/this-tostring-flags.js: Added.
638         (value.toString):
639         * test262/test/built-ins/RegExpStringIteratorPrototype/Symbol.toStringTag.js: Added.
640         * test262/test/built-ins/RegExpStringIteratorPrototype/ancestry.js: Added.
641         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-call-throws.js: Added.
642         (RegExp.prototype.exec):
643         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-get-throws.js: Added.
644         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-match-get-0-throws.js: Added.
645         (return.get string_appeared_here):
646         (RegExp.prototype.exec):
647         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-match-get-0-tostring-throws.js: Added.
648         (return.toString):
649         (RegExp.prototype.exec):
650         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-match-get-0-tostring.js: Added.
651         (execResult.get string_appeared_here):
652         (RegExp.prototype.exec):
653         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec-not-callable.js: Added.
654         (TestWithRegExpExec):
655         * test262/test/built-ins/RegExpStringIteratorPrototype/next/custom-regexpexec.js: Added.
656         (callNextWithExecReturnValue.RegExp.prototype.exec):
657         (callNextWithExecReturnValue):
658         * test262/test/built-ins/RegExpStringIteratorPrototype/next/length.js: Added.
659         * test262/test/built-ins/RegExpStringIteratorPrototype/next/name.js: Added.
660         * test262/test/built-ins/RegExpStringIteratorPrototype/next/next-iteration-global.js: Added.
661         * test262/test/built-ins/RegExpStringIteratorPrototype/next/next-iteration.js: Added.
662         * test262/test/built-ins/RegExpStringIteratorPrototype/next/next-missing-internal-slots.js: Added.
663         * test262/test/built-ins/RegExpStringIteratorPrototype/next/prop-desc.js: Added.
664         * test262/test/built-ins/RegExpStringIteratorPrototype/next/regexp-tolength-lastindex-throws.js: Added.
665         (RegExp.prototype.exec):
666         * test262/test/built-ins/RegExpStringIteratorPrototype/next/this-is-not-object-throws.js: Added.
667         (callNext):
668         * test262/test/built-ins/String/prototype/matchAll/length.js: Added.
669         * test262/test/built-ins/String/prototype/matchAll/name.js: Added.
670         * test262/test/built-ins/String/prototype/matchAll/prop-desc.js: Added.
671         * test262/test/built-ins/String/prototype/matchAll/regexp-get-matchAll-throws.js: Added.
672         * test262/test/built-ins/String/prototype/matchAll/regexp-is-null.js: Added.
673         * test262/test/built-ins/String/prototype/matchAll/regexp-is-undefined.js: Added.
674         * test262/test/built-ins/String/prototype/matchAll/regexp-matchAll-invocation.js: Added.
675         (obj.Symbol.matchAll):
676         * test262/test/built-ins/String/prototype/matchAll/regexp-matchAll-throws.js: Added.
677         (regexp.Symbol.matchAll):
678         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-get-matchAll-throws.js: Added.
679         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-has-no-matchAll.js: Added.
680         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-matchAll-invocation.js: Added.
681         (RegExp.prototype.Symbol.matchAll):
682         * test262/test/built-ins/String/prototype/matchAll/regexp-prototype-matchAll-throws.js: Added.
683         (RegExp.prototype.Symbol.matchAll):
684         * test262/test/built-ins/String/prototype/matchAll/this-val-non-obj-coercible.js: Added.
685         * test262/test/built-ins/Symbol/matchAll/cross-realm.js: Added.
686         * test262/test/built-ins/Symbol/matchAll/prop-desc.js: Added.
687         * test262/test/harness/testTypedArray.js:
688         * test262/test/intl402/Array/prototype/toLocaleString/calls-toLocaleString-number-elements.js: Added.
689         * test262/test/intl402/Intl/getCanonicalLocales/invalid-tags.js:
690         * test262/test/intl402/Locale/constructor-newtarget-undefined.js: Added.
691         * test262/test/intl402/Locale/constructor-options-calendar-invalid.js: Added.
692         (const.invalidCalendarOption.of.invalidCalendarOptions.new.Intl.Locale):
693         * test262/test/intl402/Locale/constructor-options-calendar-valid.js: Added.
694         * test262/test/intl402/Locale/constructor-options-language-invalid.js: Added.
695         (const.invalidLanguageOption.of.invalidLanguageOptions.new.Intl.Locale):
696         * test262/test/intl402/Locale/constructor-options-language-valid.js: Added.
697         (toString):
698         * test262/test/intl402/Locale/constructor-options-region-invalid.js: Added.
699         (const.invalidRegionOption.of.invalidRegionOptions.new.Intl.Locale):
700         * test262/test/intl402/Locale/constructor-options-region-valid.js: Added.
701         * test262/test/intl402/Locale/constructor-options-script-invalid.js: Added.
702         (const.invalidScriptOption.of.invalidScriptOptions.new.Intl.Locale):
703         * test262/test/intl402/Locale/constructor-options-script-valid.js: Added.
704         (toString):
705         * test262/test/intl402/Locale/function-prototype.js: Added.
706         * test262/test/intl402/Locale/instance-extensibility.js: Added.
707         * test262/test/intl402/Locale/instance.js: Added.
708         * test262/test/intl402/Locale/invalid-tag-throws-boolean.js: Added.
709         * test262/test/intl402/Locale/invalid-tag-throws-null.js: Added.
710         * test262/test/intl402/Locale/invalid-tag-throws-number.js: Added.
711         * test262/test/intl402/Locale/invalid-tag-throws-symbol.js: Added.
712         * test262/test/intl402/Locale/invalid-tag-throws-undefined.js: Added.
713         * test262/test/intl402/Locale/invalid-tag-throws.js: Added.
714         (const.invalidTag.of.getInvalidLanguageTags):
715         * test262/test/intl402/Locale/length.js: Added.
716         * test262/test/intl402/Locale/name.js: Added.
717         * test262/test/intl402/Locale/prop-desc.js: Added.
718         * test262/test/intl402/Locale/prototype/constructor.js: Added.
719         * test262/test/intl402/Locale/prototype/maximize/length.js: Added.
720         * test262/test/intl402/Locale/prototype/maximize/name.js: Added.
721         * test262/test/intl402/Locale/prototype/maximize/prop-desc.js: Added.
722         * test262/test/intl402/Locale/prototype/prop-desc.js: Added.
723         * test262/test/intl402/Locale/prototype/toStringTag.js: Added.
724         * test262/test/intl402/TypedArray/prototype/toLocaleString/calls-toLocaleString-number-elements.js: Added.
725         (testWithTypedArrayConstructors):
726         * test262/test/language/asi/S7.9_A11_T8.js:
727         (else.x.1): Deleted.
728         * test262/test/language/asi/S7.9_A4.js:
729         (catch):
730         * test262/test/language/asi/S7.9_A5.1_T1.js:
731         * test262/test/language/asi/S7.9_A5.3_T1.js:
732         * test262/test/language/block-scope/syntax/redeclaration/function-declaration-attempt-to-redeclare-with-var-declaration-nested-in-function.js: Added.
733         (g.f):
734         (g):
735         * test262/test/language/destructuring/binding/initialization-requires-object-coercible-null.js:
736         * test262/test/language/destructuring/binding/initialization-requires-object-coercible-undefined.js:
737         * test262/test/language/destructuring/binding/initialization-returns-normal-completion-for-empty-objects.js:
738         * test262/test/language/destructuring/binding/syntax/array-elements-with-initializer.js:
739         * test262/test/language/destructuring/binding/syntax/array-elements-with-object-patterns.js:
740         * test262/test/language/destructuring/binding/syntax/array-elements-without-initializer.js:
741         * test262/test/language/destructuring/binding/syntax/array-pattern-with-elisions.js:
742         * test262/test/language/destructuring/binding/syntax/array-pattern-with-no-elements.js:
743         * test262/test/language/destructuring/binding/syntax/array-rest-elements.js:
744         * test262/test/language/destructuring/binding/syntax/object-pattern-with-no-property-list.js:
745         * test262/test/language/destructuring/binding/syntax/property-list-bindings-elements.js:
746         * test262/test/language/destructuring/binding/syntax/property-list-followed-by-a-single-comma.js:
747         * test262/test/language/destructuring/binding/syntax/property-list-single-name-bindings.js:
748         * test262/test/language/destructuring/binding/syntax/property-list-with-property-list.js:
749         * test262/test/language/destructuring/binding/syntax/recursive-array-and-object-patterns.js:
750         * test262/test/language/eval-code/direct/block-decl-eval-source-is-strict-nostrict.js: Copied from JSTests/test262/test/language/eval-code/direct/block-decl-strict-source.js.
751         * test262/test/language/eval-code/direct/block-decl-eval-source-is-strict-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/block-decl-strict-source.js.
752         (catch):
753         * test262/test/language/eval-code/direct/block-decl-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/block-decl-strict-caller.js.
754         * test262/test/language/eval-code/direct/switch-case-decl-eval-source-is-strict-nostrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-source.js.
755         * test262/test/language/eval-code/direct/switch-case-decl-eval-source-is-strict-onlystrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-caller.js.
756         (catch):
757         * test262/test/language/eval-code/direct/switch-case-decl-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-case-decl-strict-caller.js.
758         * test262/test/language/eval-code/direct/switch-dflt-decl-eval-source-is-strict-nostrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-source.js.
759         * test262/test/language/eval-code/direct/switch-dflt-decl-eval-source-is-strict-onlystrict.js: Copied from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-caller.js.
760         (catch):
761         * test262/test/language/eval-code/direct/switch-dflt-decl-onlystrict.js: Renamed from JSTests/test262/test/language/eval-code/direct/switch-dflt-decl-strict-caller.js.
762         * test262/test/language/expressions/async-arrow-function/await-as-param-ident-nested-arrow-parameter-position.js: Added.
763         (async):
764         * test262/test/language/expressions/async-arrow-function/await-as-param-nested-arrow-body-position.js: Added.
765         (async):
766         * test262/test/language/expressions/async-arrow-function/await-as-param-nested-arrow-parameter-position.js: Added.
767         (async.a):
768         * test262/test/language/expressions/async-arrow-function/await-as-param-rest-nested-arrow-parameter-position.js: Added.
769         (async.a):
770         * test262/test/language/expressions/async-arrow-function/escaped-async-line-terminator.js: Added.
771         * test262/test/language/expressions/async-generator/generator-created-after-decl-inst.js: Added.
772         (g.async.a):
773         * test262/test/language/expressions/class/class-name-ident-await-escaped-module.js: Added.
774         (C):
775         * test262/test/language/expressions/class/class-name-ident-await-escaped.js: Added.
776         (C):
777         * test262/test/language/expressions/class/class-name-ident-await-module.js: Added.
778         (C):
779         * test262/test/language/expressions/class/class-name-ident-await.js: Added.
780         (C):
781         * test262/test/language/expressions/class/class-name-ident-let-escaped.js: Added.
782         (C):
783         * test262/test/language/expressions/class/class-name-ident-let.js: Added.
784         (C):
785         * test262/test/language/expressions/class/class-name-ident-static-escaped.js: Added.
786         (C):
787         * test262/test/language/expressions/class/class-name-ident-static.js: Added.
788         * test262/test/language/expressions/class/class-name-ident-yield-escaped.js: Added.
789         (C):
790         * test262/test/language/expressions/class/class-name-ident-yield.js: Added.
791         (C):
792         * test262/test/language/expressions/class/constructor-this-tdz-during-initializers.js: Added.
793         (Base):
794         (C):
795         * test262/test/language/expressions/class/fields-run-once-on-double-super.js: Added.
796         (Base):
797         (C):
798         * test262/test/language/expressions/generators/generator-created-after-decl-inst.js: Added.
799         (g):
800         * test262/test/language/expressions/greater-than-or-equal/bigint-and-incomparable-string.js: Added.
801         * test262/test/language/expressions/greater-than-or-equal/bigint-and-string.js: Added.
802         * test262/test/language/expressions/greater-than/bigint-and-boolean.js: Added.
803         * test262/test/language/expressions/greater-than/bigint-and-incomparable-string.js: Added.
804         * test262/test/language/expressions/greater-than/bigint-and-string.js: Added.
805         * test262/test/language/expressions/less-than-or-equal/bigint-and-incomparable-string.js: Added.
806         * test262/test/language/expressions/less-than-or-equal/bigint-and-string.js: Added.
807         * test262/test/language/expressions/less-than/bigint-and-boolean.js: Added.
808         * test262/test/language/expressions/less-than/bigint-and-incomparable-string.js: Added.
809         * test262/test/language/expressions/less-than/bigint-and-string.js: Added.
810         * test262/test/language/expressions/object/method-definition/generator-super-prop-param.js:
811         * test262/test/language/function-code/block-decl-onlystrict.js: Renamed from JSTests/test262/test/language/function-code/block-decl-strict.js.
812         * test262/test/language/function-code/switch-case-decl-onlystrict.js: Renamed from JSTests/test262/test/language/function-code/switch-case-decl-strict.js.
813         * test262/test/language/function-code/switch-dflt-decl-onlystrict.js: Renamed from JSTests/test262/test/language/function-code/switch-dflt-decl-strict.js.
814         * test262/test/language/line-terminators/S7.3_A2.3.js: Removed.
815         * test262/test/language/line-terminators/S7.3_A2.4.js: Removed.
816         * test262/test/language/literals/regexp/invalid-optional-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
817         * test262/test/language/literals/regexp/invalid-optional-negative-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
818         * test262/test/language/literals/regexp/invalid-range-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
819         * test262/test/language/literals/regexp/invalid-range-negative-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
820         * test262/test/language/literals/regexp/u-invalid-optional-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
821         * test262/test/language/literals/regexp/u-invalid-optional-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
822         * test262/test/language/literals/regexp/u-invalid-optional-negative-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
823         * test262/test/language/literals/regexp/u-invalid-optional-negative-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
824         * test262/test/language/literals/regexp/u-invalid-range-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
825         * test262/test/language/literals/regexp/u-invalid-range-lookbehind.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
826         * test262/test/language/literals/regexp/u-invalid-range-negative-lookahead.js: Copied from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
827         * test262/test/language/literals/regexp/u-invalid-range-negative-lookbehind.js: Renamed from JSTests/test262/test/language/literals/regexp/u-invalid-quantifiable-assertion.js.
828         * test262/test/language/literals/string/line-separator-eval.js: Added.
829         * test262/test/language/literals/string/line-separator.js: Added.
830         * test262/test/language/literals/string/paragraph-separator-eval.js: Added.
831         * test262/test/language/literals/string/paragraph-separator.js: Added.
832         * test262/test/language/module-code/early-strict-mode.js:
833         * test262/test/language/statements/async-generator/generator-created-after-decl-inst.js: Added.
834         (async.g):
835         * test262/test/language/statements/break/S12.8_A8_T1.js:
836         (catch):
837         * test262/test/language/statements/break/S12.8_A8_T2.js:
838         (catch):
839         * test262/test/language/statements/class/class-name-ident-await-escaped-module.js: Added.
840         (aw):
841         * test262/test/language/statements/class/class-name-ident-await-escaped.js: Added.
842         (aw):
843         * test262/test/language/statements/class/class-name-ident-await-module.js: Added.
844         (await):
845         * test262/test/language/statements/class/class-name-ident-await.js: Added.
846         (await):
847         * test262/test/language/statements/class/class-name-ident-let-escaped.js: Added.
848         (l):
849         * test262/test/language/statements/class/class-name-ident-let.js: Added.
850         (let):
851         * test262/test/language/statements/class/class-name-ident-static-escaped.js: Added.
852         (st):
853         * test262/test/language/statements/class/class-name-ident-static.js: Added.
854         * test262/test/language/statements/class/class-name-ident-yield-escaped.js: Added.
855         (yi):
856         * test262/test/language/statements/class/class-name-ident-yield.js: Added.
857         (yield):
858         * test262/test/language/statements/continue/S12.7_A8_T1.js:
859         (catch):
860         * test262/test/language/statements/continue/S12.7_A8_T2.js:
861         (catch):
862         * test262/test/language/statements/generators/generator-created-after-decl-inst.js: Added.
863         (g):
864         * test262/test/language/statements/try/early-catch-duplicates.js:
865         * test262/test/language/statements/try/early-catch-function.js: Added.
866         (f.catch.e):
867         (f):
868         * test262/test/language/statements/try/early-catch-lex.js:
869         * test262/test/language/statements/try/early-catch-var.js:
870         * test262/test262-Revision.txt:
871
872 2018-05-09  Caio Lima  <ticaiolima@gmail.com>
873
874         [ESNext][BigInt] Implement support for "==" operation
875         https://bugs.webkit.org/show_bug.cgi?id=184474
876
877         Reviewed by Yusuke Suzuki.
878
879         * stress/big-int-equals-basic.js: Added.
880         * stress/big-int-equals-to-primitive-precedence.js: Added.
881         * stress/big-int-equals-wrapped-value.js: Added.
882
883 2018-05-08  Valerie R Young  <valerie@bocoup.com>
884
885         test262/Runner.pm: move input files to JSTests/test262
886         https://bugs.webkit.org/show_bug.cgi?id=185389
887
888         Reviewed by Michael Saboff.
889
890         * test262/config.yaml: Renamed from Tools/Scripts/test262/config.yaml.
891         * test262/expectations.yaml: Renamed from Tools/Scripts/test262/expectations.yaml.
892
893 2018-05-05  Filip Pizlo  <fpizlo@apple.com>
894
895         DFG AI should have O(1) clobbering
896         https://bugs.webkit.org/show_bug.cgi?id=185287
897
898         Reviewed by Saam Barati.
899
900         * stress/simple-ai-effect.js: Added.
901         (bar):
902         (foo):
903
904 2018-05-04  Keith Miller  <keith_miller@apple.com>
905
906         isCacheableArrayLength should return true for undecided arrays
907         https://bugs.webkit.org/show_bug.cgi?id=185309
908
909         Reviewed by Michael Saboff.
910
911         * stress/get-array-length-undecided.js: Added.
912         (test):
913
914 2018-05-04  Dominik Infuehr  <dinfuehr@igalia.com>
915
916         Disable tests on systems with limited memory
917         https://bugs.webkit.org/show_bug.cgi?id=185296
918
919         Reviewed by Saam Barati.
920
921         Test doesn't work with a limited amount of memory. I tried to reduce memory usage
922         but then it was hard to reproduce the failure the test was originally made to test.
923
924         * stress/array-reverse-doesnt-clobber.js:
925
926 2018-05-03  Saam Barati  <sbarati@apple.com>
927
928         Don't prevent CreateThis being folded to NewObject when the structure is poly proto
929         https://bugs.webkit.org/show_bug.cgi?id=185177
930
931         Reviewed by Filip Pizlo.
932
933         * microbenchmarks/construct-poly-proto-object.js: Added.
934         (foo.A):
935         (foo):
936         * stress/allocation-sinking-new-object-with-poly-proto.js: Added.
937         (foo.A):
938         (foo):
939         (makePolyProto):
940         (bar):
941         (baz):
942
943 2018-05-03  Michael Saboff  <msaboff@apple.com>
944
945         OSR entry pruning of Program Bytecodes doesn't take into account try/catch
946         https://bugs.webkit.org/show_bug.cgi?id=185281
947
948         Reviewed by Saam Barati.
949
950         New regression test.
951
952         * stress/baseline-osrentry-catch-is-reachable.js: Added.
953         (i.j.catch):
954
955 2018-05-03  Ryan Haddad  <ryanhaddad@apple.com>
956
957         Unreviewed, rolling out r231197.
958
959         The test added with this change crashes on the 32-bit JSC bot.
960
961         Reverted changeset:
962
963         "Correctly detect string overflow when using the 'Function'
964         constructor"
965         https://bugs.webkit.org/show_bug.cgi?id=184883
966         https://trac.webkit.org/changeset/231197
967
968 2018-05-02  Filip Pizlo  <fpizlo@apple.com>
969
970         JSC should know how to cache custom getter accesses on the prototype chain
971         https://bugs.webkit.org/show_bug.cgi?id=185213
972
973         Reviewed by Keith Miller.
974
975         * microbenchmarks/get-custom-getter.js: Added.
976         (test):
977
978 2018-05-02  Robin Morisset  <rmorisset@apple.com>
979
980         emitCodeToGetArgumentsArrayLength should not crash on PhantomNewArrayWithSpread
981         https://bugs.webkit.org/show_bug.cgi?id=183172
982
983         Reviewed by Filip Pizlo.
984
985         * stress/length-of-new-array-with-spread.js: Added.
986         (foo):
987         (bar):
988         (baz):
989
990 2018-05-01  Yusuke Suzuki  <utatane.tea@gmail.com>
991
992         [JSC] Add SameValue DFG node
993         https://bugs.webkit.org/show_bug.cgi?id=185065
994
995         Reviewed by Saam Barati.
996
997         * microbenchmarks/object-is.js: Added.
998         (incognito):
999         (sameValue):
1000         (test1):
1001         (test2):
1002         (test3):
1003         (test4):
1004         (test5):
1005         (test6):
1006         * stress/object-is.js: Added.
1007         (shouldBe):
1008         (is1):
1009         (is2):
1010         (is3):
1011         (is4):
1012         (is5):
1013         (is6):
1014         (is7):
1015         (is8):
1016         (is9):
1017         (is10):
1018         (is11):
1019         (is12):
1020         (is13):
1021         (is14):
1022         (is15):
1023
1024 2018-05-01  Robin Morisset  <rmorisset@apple.com>
1025
1026         Correctly detect string overflow when using the 'Function' constructor
1027         https://bugs.webkit.org/show_bug.cgi?id=184883
1028         <rdar://problem/36320331>
1029
1030         Reviewed by Filip Pizlo.
1031
1032         I put this regression test in the 'slowMicrobenchmarks' directory because it takes nearly 30s to run, and I am not sure where else to put it.
1033
1034         * slowMicrobenchmarks/function-constructor-with-huge-strings.js: Added.
1035         (catch):
1036
1037 2018-05-01  Robin Morisset  <rmorisset@apple.com>
1038
1039         IntlObject.cpp::removeUnicodeLocaleExtension() should not touch locales that end in '-u'
1040         https://bugs.webkit.org/show_bug.cgi?id=185162
1041
1042         Reviewed by Filip Pizlo.
1043
1044         * stress/incomplete-unicode-locale.js: Added.
1045         (catch):
1046
1047 2018-05-01  Dominik Infuehr  <dinfuehr@igalia.com>
1048
1049         Add SetCallee as DFG-Operation
1050         https://bugs.webkit.org/show_bug.cgi?id=184582
1051
1052         Reviewed by Filip Pizlo.
1053
1054         Added test that runs into infinite loop without updating the callee and
1055         therefore emitting SetCallee in DFG for recursive tail calls.
1056
1057         * stress/closure-recursive-tail-call-infinite-loop.js: Added.
1058         (Foo):
1059         (second):
1060         (first):
1061         (return.closure):
1062         (createClosure):
1063
1064 2018-04-30  Saam Barati  <sbarati@apple.com>
1065
1066         ToString constant folds without preserving checks, causing us to break assumptions that the code would OSR exit
1067         https://bugs.webkit.org/show_bug.cgi?id=185149
1068         <rdar://problem/39455917>
1069
1070         Reviewed by Filip Pizlo.
1071
1072         * stress/keep-checks-when-converting-to-lazy-js-constant-in-strength-reduction.js: Added.
1073
1074 2018-04-29  Filip Pizlo  <fpizlo@apple.com>
1075
1076         LICM shouldn't hoist nodes if hoisted nodes exited in that code block
1077         https://bugs.webkit.org/show_bug.cgi?id=185126
1078
1079         Reviewed by Saam Barati.
1080         
1081         I found this bug by accident when I was writing this test for something else.
1082         
1083         This change also speeds up other benchmarks of this case that we already had. They are all called
1084         the licm-dragons tests.
1085
1086         * microbenchmarks/licm-dragons-two-structures.js: Added.
1087         (foo):
1088
1089 2018-04-29  Commit Queue  <commit-queue@webkit.org>
1090
1091         Unreviewed, rolling out r231137.
1092         https://bugs.webkit.org/show_bug.cgi?id=185118
1093
1094         It is breaking Test262 language/expressions/multiplication
1095         /order-of-evaluation.js (Requested by caiolima on #webkit).
1096
1097         Reverted changeset:
1098
1099         "[ESNext][BigInt] Implement support for "*" operation"
1100         https://bugs.webkit.org/show_bug.cgi?id=183721
1101         https://trac.webkit.org/changeset/231137
1102
1103 2018-04-28  Saam Barati  <sbarati@apple.com>
1104
1105         We don't model regexp effects properly
1106         https://bugs.webkit.org/show_bug.cgi?id=185059
1107         <rdar://problem/39736150>
1108
1109         Reviewed by Filip Pizlo.
1110
1111         * stress/regexp-exec-test-effectful-last-index.js: Added.
1112         (assert):
1113         (foo):
1114         (i.regexLastIndex.toString):
1115         (bar):
1116
1117 2018-04-28  Rick Waldron  <waldron.rick@gmail.com>
1118
1119         Token misspelled "tocken" in error message string
1120         https://bugs.webkit.org/show_bug.cgi?id=185030
1121
1122         Reviewed by Saam Barati.
1123
1124         * ChakraCore/test/Basics/IdsWithEscapes.baseline-jsc: Fix typo "tocken" => "token"
1125         * stress/destructuring-assignment-syntax.js: Fix typo "tocken" => "token"
1126         * stress/error-messages-for-in-operator-should-not-crash.js: Fix typo "tocken" => "token"
1127         * stress/reserved-word-with-escape.js: Fix typo "tocken" => "token"
1128         (testSyntaxError.String.raw.v):
1129         (String.raw.SyntaxError.Cannot.use.the.keyword.string_appeared_here.as.a.name):
1130         (testSyntaxError.String.raw.a):
1131
1132 2018-04-28  Caio Lima  <ticaiolima@gmail.com>
1133
1134         [ESNext][BigInt] Implement support for "*" operation
1135         https://bugs.webkit.org/show_bug.cgi?id=183721
1136
1137         Reviewed by Saam Barati.
1138
1139         * bigIntTests.yaml:
1140         * stress/big-int-mul-jit.js: Added.
1141         * stress/big-int-mul-to-primitive-precedence.js: Added.
1142         * stress/big-int-mul-to-primitive.js: Added.
1143         * stress/big-int-mul-type-error.js: Added.
1144         * stress/big-int-mul-wrapped-value.js: Added.
1145         * stress/big-int-multiplication.js: Added.
1146         * stress/big-int-multiply-memory-stress.js: Added.
1147
1148 2018-04-28  Commit Queue  <commit-queue@webkit.org>
1149
1150         Unreviewed, rolling out r231131.
1151         https://bugs.webkit.org/show_bug.cgi?id=185112
1152
1153         It is breaking Debug build due to unchecked exception
1154         (Requested by caiolima on #webkit).
1155
1156         Reverted changeset:
1157
1158         "[ESNext][BigInt] Implement support for "*" operation"
1159         https://bugs.webkit.org/show_bug.cgi?id=183721
1160         https://trac.webkit.org/changeset/231131
1161
1162 2018-04-27  Caio Lima  <ticaiolima@gmail.com>
1163
1164         [ESNext][BigInt] Implement support for "*" operation
1165         https://bugs.webkit.org/show_bug.cgi?id=183721
1166
1167         Reviewed by Saam Barati.
1168
1169         * bigIntTests.yaml:
1170         * stress/big-int-mul-jit.js: Added.
1171         * stress/big-int-mul-to-primitive-precedence.js: Added.
1172         * stress/big-int-mul-to-primitive.js: Added.
1173         * stress/big-int-mul-type-error.js: Added.
1174         * stress/big-int-mul-wrapped-value.js: Added.
1175         * stress/big-int-multiplication.js: Added.
1176         * stress/big-int-multiply-memory-stress.js: Added.
1177
1178 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
1179
1180         Unreviewed, rolling out r231086.
1181
1182         Caused JSC test failures due to an unchecked exception.
1183
1184         Reverted changeset:
1185
1186         "[ESNext][BigInt] Implement support for "*" operation"
1187         https://bugs.webkit.org/show_bug.cgi?id=183721
1188         https://trac.webkit.org/changeset/231086
1189
1190 2018-04-27  Ryan Haddad  <ryanhaddad@apple.com>
1191
1192         Unreviewed test gardening, update expectations for test262/intl402/PluralRules tests after r231047.
1193
1194         * test262.yaml: Mark tests as passing.
1195
1196 2018-04-26  Caio Lima  <ticaiolima@gmail.com>
1197
1198         [ESNext][BigInt] Implement support for "*" operation
1199         https://bugs.webkit.org/show_bug.cgi?id=183721
1200
1201         Reviewed by Saam Barati.
1202
1203         * bigIntTests.yaml:
1204         * stress/big-int-mul-jit.js: Added.
1205         * stress/big-int-mul-to-primitive-precedence.js: Added.
1206         * stress/big-int-mul-to-primitive.js: Added.
1207         * stress/big-int-mul-type-error.js: Added.
1208         * stress/big-int-mul-wrapped-value.js: Added.
1209         * stress/big-int-multiplication.js: Added.
1210         * stress/big-int-multiply-memory-stress.js: Added.
1211
1212 2018-04-25  Robin Morisset  <rmorisset@apple.com>
1213
1214         In FTLLowerDFGToB3.cpp::compileCreateRest, always use a contiguous array as the indexing type when under isWatchingHavingABadTimeWatchpoint
1215         https://bugs.webkit.org/show_bug.cgi?id=184773
1216         <rdar://problem/37773612>
1217
1218         Reviewed by Filip Pizlo.
1219
1220         This bug requires a race between the thread doing FTL compilation and the main thread, but it triggers in 100% of cases (before the fix) on my machine
1221         so I decided to add it to the stress tests nonetheless.
1222
1223         * stress/create-rest-while-having-a-bad-time.js: Added.
1224         (f):
1225         (g):
1226         (h):
1227
1228 2018-04-25  Keith Miller  <keith_miller@apple.com>
1229
1230         Add missing scope release to functionProtoFuncToString
1231         https://bugs.webkit.org/show_bug.cgi?id=184995
1232
1233         Reviewed by Saam Barati.
1234
1235         * stress/function-toString-arrow.js: Added.
1236         (async):
1237
1238 2018-04-24  Keith Miller  <keith_miller@apple.com>
1239
1240         fromCharCode is missing some exception checks
1241         https://bugs.webkit.org/show_bug.cgi?id=184952
1242
1243         Reviewed by Saam Barati.
1244
1245         * stress/fromCharCode-exception-check.js: Added.
1246         (get catch):
1247
1248 2018-04-24  Mark Lam  <mark.lam@apple.com>
1249
1250         Gardening: test fix after r230863.
1251         https://bugs.webkit.org/show_bug.cgi?id=184846
1252         <rdar://problem/39390672>
1253
1254         Not reviewed.
1255
1256         * stress/json-stringified-overflow-2.js:
1257         (catch):
1258         * stress/json-stringified-overflow.js:
1259         (catch):
1260
1261 2018-04-20  JF Bastien  <jfbastien@apple.com>
1262
1263         Handle more JSON stringify OOM
1264         https://bugs.webkit.org/show_bug.cgi?id=184846
1265         <rdar://problem/39390672>
1266
1267         Reviewed by Mark Lam.
1268
1269         * stress/json-stringified-overflow-2.js: Added. Same as the one
1270         below, but with a bigger input which will trigger a different code
1271         path.
1272         (catch):
1273         * stress/json-stringified-overflow.js: Modify the test to only
1274         catch OOM on stringification. not on string creation.
1275
1276 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1277
1278         [WebAssembly][Modules] Import tables in wasm modules
1279         https://bugs.webkit.org/show_bug.cgi?id=184738
1280
1281         Reviewed by JF Bastien.
1282
1283         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
1284         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
1285         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
1286         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
1287         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
1288         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
1289         * wasm/modules/wasm-imports-wasm-exports.js:
1290         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
1291         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
1292         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
1293         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
1294
1295 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1296
1297         [WebAssembly][Modules] Import globals from wasm modules
1298         https://bugs.webkit.org/show_bug.cgi?id=184736
1299
1300         Reviewed by JF Bastien.
1301
1302         * wasm.yaml:
1303         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js:
1304         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm:
1305         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat:
1306         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js:
1307         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm:
1308         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat:
1309         * wasm/modules/wasm-imports-wasm-exports.js:
1310         * wasm/modules/wasm-imports-wasm-exports/imports.wasm:
1311         * wasm/modules/wasm-imports-wasm-exports/imports.wat:
1312         * wasm/modules/wasm-imports-wasm-exports/sum.wasm:
1313         * wasm/modules/wasm-imports-wasm-exports/sum.wat:
1314
1315 2018-04-18  Yusuke Suzuki  <utatane.tea@gmail.com>
1316
1317         Unreviewed, reland r230697, r230720, and r230724.
1318         https://bugs.webkit.org/show_bug.cgi?id=184600
1319
1320         * wasm.yaml:
1321         * wasm/modules/constant.wasm: Added.
1322         * wasm/modules/constant.wat: Added.
1323         * wasm/modules/default-import-star-error.js: Added.
1324         (then):
1325         * wasm/modules/default-import-star-error/entry.wasm: Added.
1326         * wasm/modules/default-import-star-error/entry.wat: Added.
1327         * wasm/modules/default-import-star-error/t0.js: Added.
1328         * wasm/modules/default-import-star-error/t1.js: Added.
1329         * wasm/modules/default-import-star-error/t2.js: Added.
1330         (export.default.Cocoa):
1331         * wasm/modules/js-wasm-cycle.js: Added.
1332         * wasm/modules/js-wasm-cycle/entry.js: Added.
1333         (from.string_appeared_here.export.return42):
1334         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
1335         * wasm/modules/js-wasm-cycle/sum.wat: Added.
1336         * wasm/modules/js-wasm-function-namespace.js: Added.
1337         (assert.throws):
1338         * wasm/modules/js-wasm-function.js: Added.
1339         (assert.throws):
1340         * wasm/modules/js-wasm-global-namespace.js: Added.
1341         (assert.throws):
1342         * wasm/modules/js-wasm-global.js: Added.
1343         (assert.throws):
1344         * wasm/modules/js-wasm-memory-namespace.js: Added.
1345         (assert.throws):
1346         * wasm/modules/js-wasm-memory.js: Added.
1347         (assert.throws):
1348         * wasm/modules/js-wasm-start.js: Added.
1349         (then):
1350         * wasm/modules/js-wasm-table-namespace.js: Added.
1351         (assert.throws):
1352         * wasm/modules/js-wasm-table.js: Added.
1353         (assert.throws):
1354         * wasm/modules/memory.wasm: Added.
1355         * wasm/modules/memory.wat: Added.
1356         * wasm/modules/run-from-wasm.wasm: Added.
1357         * wasm/modules/run-from-wasm.wat: Added.
1358         * wasm/modules/run-from-wasm/check.js: Added.
1359         (export.check):
1360         * wasm/modules/start.wasm: Added.
1361         * wasm/modules/start.wat: Added.
1362         * wasm/modules/sum.wasm: Added.
1363         * wasm/modules/sum.wat: Added.
1364         * wasm/modules/table.wasm: Added.
1365         * wasm/modules/table.wat: Added.
1366         * wasm/modules/wasm-imports-js-exports.js: Added.
1367         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
1368         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
1369         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
1370         (export.sum):
1371         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
1372         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
1373         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
1374         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
1375         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
1376         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
1377         * wasm/modules/wasm-imports-wasm-exports.js: Added.
1378         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
1379         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
1380         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
1381         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
1382         * wasm/modules/wasm-js-cycle.js: Added.
1383         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
1384         * wasm/modules/wasm-js-cycle/entry.wat: Added.
1385         * wasm/modules/wasm-js-cycle/sum.js: Added.
1386         (from.string_appeared_here.export.sum):
1387         * wasm/modules/wasm-wasm-cycle.js: Added.
1388         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
1389         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
1390         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
1391         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
1392
1393 2018-04-17  Commit Queue  <commit-queue@webkit.org>
1394
1395         Unreviewed, rolling out r230697, r230720, and r230724.
1396         https://bugs.webkit.org/show_bug.cgi?id=184717
1397
1398         These caused multiple failures on the Test262 testers.
1399         (Requested by mlewis13 on #webkit).
1400
1401         Reverted changesets:
1402
1403         "[WebAssembly][Modules] Prototype wasm import"
1404         https://bugs.webkit.org/show_bug.cgi?id=184600
1405         https://trac.webkit.org/changeset/230697
1406
1407         "[WebAssembly][Modules] Implement function import from wasm
1408         modules"
1409         https://bugs.webkit.org/show_bug.cgi?id=184689
1410         https://trac.webkit.org/changeset/230720
1411
1412         "[JSC] Rename runWebAssembly to runWebAssemblySuite"
1413         https://bugs.webkit.org/show_bug.cgi?id=184703
1414         https://trac.webkit.org/changeset/230724
1415
1416 2018-04-17  JF Bastien  <jfbastien@apple.com>
1417
1418         A put is not an ExistingProperty put when we transition a structure because of an attributes change
1419         https://bugs.webkit.org/show_bug.cgi?id=184706
1420         <rdar://problem/38871451>
1421
1422         Reviewed by Saam Barati.
1423
1424         * stress/put-by-id-direct-strict-transition.js: Added.
1425         (const.foo):
1426         (j.const.obj.set hello):
1427         * stress/put-by-id-direct-transition.js: Added.
1428         (const.foo):
1429         (j.const.obj.set hello):
1430         * stress/put-getter-setter-by-id-strict-transition.js: Added.
1431         (const.foo):
1432         (j.const.obj.set hello):
1433         * stress/put-getter-setter-by-id-transition.js: Added.
1434         (const.foo):
1435         (j.const.obj.set hello):
1436
1437 2018-04-16  Filip Pizlo  <fpizlo@apple.com>
1438
1439         PutStackSinkingPhase should know that KillStack means ConflictingFlush
1440         https://bugs.webkit.org/show_bug.cgi?id=184672
1441
1442         Reviewed by Michael Saboff.
1443
1444         * stress/sink-put-stack-over-kill-stack.js: Added.
1445         (avocado_1):
1446         (apricot_0):
1447         (__c_0):
1448         (banana_2):
1449
1450 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1451
1452         [JSC] Rename runWebAssembly to runWebAssemblySuite
1453         https://bugs.webkit.org/show_bug.cgi?id=184703
1454
1455         Reviewed by JF Bastien.
1456
1457         And add runWebAssembly as a command to simplely run wasm modules.
1458
1459         * wasm.yaml:
1460
1461 2018-04-17  Yusuke Suzuki  <utatane.tea@gmail.com>
1462
1463         [WebAssembly][Modules] Implement function import from wasm modules
1464         https://bugs.webkit.org/show_bug.cgi?id=184689
1465
1466         Reviewed by JF Bastien.
1467
1468         * wasm.yaml:
1469         * wasm/modules/js-wasm-cycle.js: Added.
1470         * wasm/modules/js-wasm-cycle/entry.js: Added.
1471         (from.string_appeared_here.export.return42):
1472         * wasm/modules/js-wasm-cycle/sum.wasm: Added.
1473         * wasm/modules/js-wasm-cycle/sum.wat: Added.
1474         * wasm/modules/run-from-wasm.wasm: Added.
1475         * wasm/modules/run-from-wasm.wat: Added.
1476         * wasm/modules/run-from-wasm/check.js: Added.
1477         (export.check):
1478         * wasm/modules/wasm-imports-js-exports.js: Added.
1479         * wasm/modules/wasm-imports-js-exports/imports.wasm: Added.
1480         * wasm/modules/wasm-imports-js-exports/imports.wat: Added.
1481         * wasm/modules/wasm-imports-js-exports/sum.js: Added.
1482         (export.sum):
1483         * wasm/modules/wasm-imports-js-re-exports-wasm-exports.js: Added.
1484         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wasm: Added.
1485         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/imports.wat: Added.
1486         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/re-export.js: Added.
1487         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wasm: Added.
1488         * wasm/modules/wasm-imports-js-re-exports-wasm-exports/sum.wat: Added.
1489         * wasm/modules/wasm-imports-wasm-exports.js: Added.
1490         * wasm/modules/wasm-imports-wasm-exports/imports.wasm: Added.
1491         * wasm/modules/wasm-imports-wasm-exports/imports.wat: Added.
1492         * wasm/modules/wasm-imports-wasm-exports/sum.wasm: Added.
1493         * wasm/modules/wasm-imports-wasm-exports/sum.wat: Added.
1494         * wasm/modules/wasm-js-cycle.js: Added.
1495         * wasm/modules/wasm-js-cycle/entry.wasm: Added.
1496         * wasm/modules/wasm-js-cycle/entry.wat: Added.
1497         * wasm/modules/wasm-js-cycle/sum.js: Added.
1498         (from.string_appeared_here.export.sum):
1499         * wasm/modules/wasm-wasm-cycle.js: Added.
1500         * wasm/modules/wasm-wasm-cycle/entry.wasm: Added.
1501         * wasm/modules/wasm-wasm-cycle/entry.wat: Added.
1502         * wasm/modules/wasm-wasm-cycle/sum.wasm: Added.
1503         * wasm/modules/wasm-wasm-cycle/sum.wat: Added.
1504
1505 2018-04-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1506
1507         [WebAssembly][Modules] Prototype wasm import
1508         https://bugs.webkit.org/show_bug.cgi?id=184600
1509
1510         Reviewed by JF Bastien.
1511
1512         Add wasm and wat files since module loader want to load wasm files from FS.
1513         Currently, importing the other modules from wasm is not supported.
1514
1515         * wasm.yaml:
1516         * wasm/modules/constant.wasm: Added.
1517         * wasm/modules/constant.wat: Added.
1518         * wasm/modules/js-wasm-function-namespace.js: Added.
1519         (assert.throws):
1520         * wasm/modules/js-wasm-function.js: Added.
1521         (assert.throws):
1522         * wasm/modules/js-wasm-global-namespace.js: Added.
1523         (assert.throws):
1524         * wasm/modules/js-wasm-global.js: Added.
1525         (assert.throws):
1526         * wasm/modules/js-wasm-memory-namespace.js: Added.
1527         (assert.throws):
1528         * wasm/modules/js-wasm-memory.js: Added.
1529         (assert.throws):
1530         * wasm/modules/js-wasm-start.js: Added.
1531         (then):
1532         * wasm/modules/js-wasm-table-namespace.js: Added.
1533         (assert.throws):
1534         * wasm/modules/js-wasm-table.js: Added.
1535         (assert.throws):
1536         * wasm/modules/memory.wasm: Added.
1537         * wasm/modules/memory.wat: Added.
1538         * wasm/modules/start.wasm: Added.
1539         * wasm/modules/start.wat: Added.
1540         * wasm/modules/sum.wasm: Added.
1541         * wasm/modules/sum.wat: Added.
1542         * wasm/modules/table.wasm: Added.
1543         * wasm/modules/table.wat: Added.
1544
1545 2018-04-14  Filip Pizlo  <fpizlo@apple.com>
1546
1547         Function.prototype.caller shouldn't return generator bodies
1548         https://bugs.webkit.org/show_bug.cgi?id=184630
1549
1550         Reviewed by Yusuke Suzuki.
1551
1552         * stress/function-caller-async-arrow-function-body.js: Added.
1553         * stress/function-caller-async-function-body.js: Added.
1554         * stress/function-caller-async-generator-body.js: Added.
1555         * stress/function-caller-generator-body.js: Added.
1556         * stress/function-caller-generator-method-body.js: Added.
1557
1558 2018-04-12  Tomas Popela  <tpopela@redhat.com>
1559
1560         Unreviewed, skip JIT tests if it isn't enabled
1561
1562         See https://bugs.webkit.org/show_bug.cgi?id=182730.
1563
1564         * stress/big-int-spec-to-primitive.js:
1565         * stress/big-int-spec-to-this.js:
1566
1567 2018-04-10  Caio Lima  <ticaiolima@gmail.com>
1568
1569         [ESNext][BigInt] Add support for BigInt in SpeculatedType
1570         https://bugs.webkit.org/show_bug.cgi?id=182470
1571
1572         Reviewed by Saam Barati.
1573
1574         * stress/big-int-spec-to-primitive.js: Added.
1575         * stress/big-int-spec-to-this.js: Added.
1576         * stress/big-int-strict-equals-jit.js: Added.
1577         * stress/big-int-strict-spec-to-this.js: Added.
1578         * stress/big-int-type-of-proven-type.js: Added.
1579
1580 2018-04-10  Filip Pizlo  <fpizlo@apple.com>
1581
1582         DFG AI and clobberize should agree with each other
1583         https://bugs.webkit.org/show_bug.cgi?id=184440
1584
1585         Reviewed by Saam Barati.
1586         
1587         Add tests for all of the bugs I fixed.
1588
1589         * stress/direct-arguments-out-of-bounds-change-structure.js: Added.
1590         (foo):
1591         * stress/new-typed-array-cse-effects.js: Added.
1592         (foo):
1593         * stress/scoped-arguments-out-of-bounds-change-structure.js: Added.
1594         (foo.theO):
1595         (foo):
1596         * stress/string-from-char-code-change-structure-not-dead.js: Added.
1597         (foo):
1598         (i.valueOf):
1599         (weirdValue.valueOf):
1600         * stress/string-from-char-code-change-structure.js: Added.
1601         (foo):
1602         (i.valueOf):
1603         (weirdValue.valueOf):
1604
1605 2018-04-09  Leo Balter  <leonardo.balter@gmail.com>
1606
1607         Fix errant Test262 files CRLF to LF for consistency with the original source
1608         https://bugs.webkit.org/show_bug.cgi?id=184425
1609
1610         Reviewed by Yusuke Suzuki.
1611
1612         * test262/test/built-ins/Math/acosh/nan-returns.js:
1613         * test262/test/built-ins/Math/asinh/asinh-specialVals.js:
1614         * test262/test/built-ins/Math/atanh/atanh-specialVals.js:
1615         * test262/test/built-ins/Math/cbrt/cbrt-specialValues.js:
1616         * test262/test/built-ins/Math/cbrt/prop-desc.js:
1617         * test262/test/built-ins/Math/cosh/cosh-specialVals.js:
1618         * test262/test/built-ins/Math/expm1/expm1-specialVals.js:
1619         * test262/test/built-ins/Math/log10/Log10-specialVals.js:
1620         * test262/test/built-ins/Math/log2/log2-basicTests.js:
1621         * test262/test/built-ins/Math/sign/sign-specialVals.js:
1622         * test262/test/built-ins/Math/sinh/sinh-specialVals.js:
1623         * test262/test/built-ins/Math/tanh/tanh-specialVals.js:
1624         * test262/test/built-ins/Math/trunc/trunc-sampleTests.js:
1625         * test262/test/built-ins/Math/trunc/trunc-specialVals.js:
1626
1627 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1628
1629         Unreviewed, remove incorrect entry in test262.yaml
1630         https://bugs.webkit.org/show_bug.cgi?id=184266
1631
1632         * test262.yaml:
1633
1634 2018-04-08  Valerie Young  <valerie@bocoup.com>
1635
1636         [JSC] Update Test262 to April 6 version
1637         https://bugs.webkit.org/show_bug.cgi?id=184266
1638
1639         Rubber stamped by Yusuke Suzuki.
1640
1641 2018-04-08  Yusuke Suzuki  <utatane.tea@gmail.com>
1642
1643         [JSC] Introduce op_get_by_id_direct
1644         https://bugs.webkit.org/show_bug.cgi?id=183970
1645
1646         Reviewed by Filip Pizlo.
1647
1648         * stress/generator-prototype-copy.js: Added.
1649         (gen):
1650         (catch):
1651         Adopted JF's tests.
1652
1653         * stress/generator-type-check.js: Added.
1654         (shouldThrow):
1655         (foo2):
1656         (i.shouldThrow):
1657         * stress/get-by-id-direct-getter.js: Added.
1658         (shouldBe):
1659         (shouldThrow):
1660         (obj.get hello):
1661         (builtin.createBuiltin):
1662         (obj2.get length):
1663         * stress/get-by-id-direct.js: Added.
1664         (shouldBe):
1665         (shouldThrow):
1666         (builtin.createBuiltin):
1667         * test262.yaml:
1668         We fixed long-standing spec compatibility issue.
1669         As a result, this patch makes several test262 tests passed!
1670
1671
1672 2018-04-07  Yusuke Suzuki  <utatane.tea@gmail.com>
1673
1674         Unreviewed, annotate test with @skip if $memoryLimited
1675         https://bugs.webkit.org/show_bug.cgi?id=183894
1676
1677         * stress/json-stringified-overflow.js:
1678
1679 2018-04-06  Alexey Proskuryakov  <ap@apple.com>
1680
1681         Add svn:eol-style to line-terminator-normalisation-CR.js
1682         https://bugs.webkit.org/show_bug.cgi?id=184341
1683
1684         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js: Added property svn:eol-style.
1685
1686 2018-04-06  Ross Kirsling  <ross.kirsling@sony.com>
1687
1688         Unreviewed, remove errant LF from existing test262 test for CR line endings.
1689
1690         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
1691
1692 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
1693
1694         Unreviewed, rolling out r230320.
1695
1696         Revert fix, as the root cause lies elsewhere.
1697
1698         Reverted changeset:
1699
1700         "[test262] Mark line-terminator-normalisation-CR.js as a
1701         binary file."
1702         https://bugs.webkit.org/show_bug.cgi?id=184341
1703         https://trac.webkit.org/changeset/230320
1704
1705 2018-04-05  Ross Kirsling  <ross.kirsling@sony.com>
1706
1707         [test262] Mark line-terminator-normalisation-CR.js as a binary file.
1708         https://bugs.webkit.org/show_bug.cgi?id=184341
1709
1710         Reviewed by Yusuke Suzuki.
1711
1712         This test is all about CR line endings, but `svn-apply` can't deal with them.
1713         Treating the file as binary ensures that its contents never are never shown in a diff.
1714
1715         * .gitattributes: Added.
1716
1717 2018-04-05  Robin Morisset  <rmorisset@apple.com>
1718
1719         Fix testcase (missing try/catch).
1720         https://bugs.webkit.org/show_bug.cgi?id=183657
1721
1722         Unreviewed.
1723
1724         * stress/large-unshift-splice.js
1725
1726 2018-04-04  Filip Pizlo  <fpizlo@apple.com>
1727
1728         REGRESSION(r222563): removed DoubleReal type check causes tons of crashes because CSE has never known how to handle SaneChain
1729         https://bugs.webkit.org/show_bug.cgi?id=184319
1730
1731         Reviewed by Saam Barati.
1732
1733         * stress/array-push-nan-to-double-array-cse-sane-and-insane-chain.js: Added.
1734         (foo):
1735         (bar):
1736         * stress/array-push-nan-to-double-array.js: Added.
1737         (foo):
1738         (bar):
1739
1740 2018-04-03  Mark Lam  <mark.lam@apple.com>
1741
1742         Test js-fixed-array-out-of-memory.js should be excluded for memory limited devices.
1743         https://bugs.webkit.org/show_bug.cgi?id=184284
1744
1745         Reviewed by Saam Barati.
1746
1747         * stress/js-fixed-array-out-of-memory.js:
1748
1749 2018-03-31  Filip Pizlo  <fpizlo@apple.com>
1750
1751         JSC crash in JIT code with for-of loop and Array/Set iterators
1752         https://bugs.webkit.org/show_bug.cgi?id=183174
1753
1754         Reviewed by Saam Barati.
1755
1756         * microbenchmarks/hoist-get-by-offset-tower-with-inferred-types.js: Added. This test shows that fixing the bug didn't break hoisting of GetByOffset with inferred types. I confirmed that if I did break it, this test slows down by >7x.
1757         (foo):
1758         * stress/hoist-get-by-offset-with-control-dependent-inferred-type.js: Added. This test shows that the bug is fixed.
1759         (f):
1760
1761 2018-03-30  JF Bastien  <jfbastien@apple.com>
1762
1763         WebAssembly: support DataView compilation
1764         https://bugs.webkit.org/show_bug.cgi?id=183342
1765
1766         Reviewed by Mark Lam.
1767
1768         Test WebAssembly compilation using a DataView with offset.
1769
1770         * wasm/regress/183342.js: Added.
1771         (attempt.catch):
1772
1773 2018-03-30  Filip Pizlo  <fpizlo@apple.com>
1774
1775         Bytecode generator should not get_from_scope something that may be a hole into a variable that is already live
1776         https://bugs.webkit.org/show_bug.cgi?id=184189
1777
1778         Reviewed by JF Bastien.
1779
1780         * stress/load-hole-from-scope-into-live-var.js: Added.
1781         (result.eval.try.switch):
1782         (catch):
1783
1784 2018-03-30  Ryan Haddad  <ryanhaddad@apple.com>
1785
1786         Unreviewed, rolling out r230102.
1787
1788         Caused assertion failures on JSC bots.
1789
1790         Reverted changeset:
1791
1792         "A stack overflow in the parsing of a builtin (called by
1793         createExecutable) cause a crash instead of a catchable js
1794         exception"
1795         https://bugs.webkit.org/show_bug.cgi?id=184074
1796         https://trac.webkit.org/changeset/230102
1797
1798 2018-03-30  Robin Morisset  <rmorisset@apple.com>
1799
1800         Inlining of a function that ends in op_unreachable in a non-tail position triggers an ASSERT
1801         https://bugs.webkit.org/show_bug.cgi?id=183812
1802
1803         Reviewed by Keith Miller.
1804
1805         * stress/inlining-unreachable-non-tail.js: Added.
1806         (foo.):
1807         (foo):
1808
1809 2018-03-30  Robin Morisset  <rmorisset@apple.com>
1810
1811         A stack overflow in the parsing of a builtin (called by createExecutable) cause a crash instead of a catchable js exception
1812         https://bugs.webkit.org/show_bug.cgi?id=184074
1813         <rdar://problem/37165897>
1814
1815         Reviewed by Keith Miller.
1816
1817         * stress/stack-overflow-while-parsing-builtin.js: Added.
1818         (f):
1819
1820 2018-03-30  Robin Morisset  <rmorisset@apple.com>
1821
1822         Out-of-bounds accesses due to a missing check for MAX_STORAGE_VECTOR_LENGTH in unshiftCountForAnyIndexingType
1823         https://bugs.webkit.org/show_bug.cgi?id=183657
1824
1825         Reviewed by Keith Miller.
1826
1827         * stress/large-unshift-splice.js: Added.
1828         (make_contig_arr):
1829
1830 2018-03-28  Robin Morisset  <rmorisset@apple.com>
1831
1832         appendQuotedJSONString stops on arithmetic overflow instead of propagating it upwards
1833         https://bugs.webkit.org/show_bug.cgi?id=183894
1834
1835         Reviewed by Saam Barati.
1836
1837         * stress/json-stringified-overflow.js: Added.
1838         (catch):
1839
1840 2018-03-26  Filip Pizlo  <fpizlo@apple.com>
1841
1842         DFG should know that CreateThis can be effectful
1843         https://bugs.webkit.org/show_bug.cgi?id=184013
1844
1845         Reviewed by Saam Barati.
1846
1847         * stress/create-this-property-change.js: Added.
1848         (Foo):
1849         (RealBar):
1850         (get if):
1851         * stress/create-this-structure-change-without-cse.js: Added.
1852         (Foo):
1853         (RealBar):
1854         (get if):
1855         * stress/create-this-structure-change.js: Added.
1856         (Foo):
1857         (RealBar):
1858         (get if):
1859
1860 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1861
1862         [DFG] Introduces fused compare and jump
1863         https://bugs.webkit.org/show_bug.cgi?id=177100
1864
1865         Reviewed by Mark Lam.
1866
1867         * stress/fused-jeq-slow.js: Added.
1868         (shouldBe):
1869         (testJEQ):
1870         (testJNEQB):
1871         (testJEQB):
1872         (testJNEQF):
1873         (testJEQF):
1874         * stress/fused-jeq.js: Added.
1875         (shouldBe):
1876         (testJEQ):
1877         (testJNEQB):
1878         (testJEQB):
1879         (testJNEQF):
1880         (testJEQF):
1881         * stress/fused-jstricteq-slow.js: Added.
1882         (shouldBe):
1883         (testJSTRICTEQ):
1884         (testJNSTRICTEQB):
1885         (testJSTRICTEQB):
1886         (testJNSTRICTEQF):
1887         (testJSTRICTEQF):
1888         * stress/fused-jstricteq.js: Added.
1889         (shouldBe):
1890         (testJSTRICTEQ):
1891         (testJNSTRICTEQB):
1892         (testJSTRICTEQB):
1893         (testJNSTRICTEQF):
1894         (testJSTRICTEQF):
1895
1896 2018-03-22  Yusuke Suzuki  <utatane.tea@gmail.com>
1897
1898         [JSC] Clear MustGenerate for ToString(Number) converted from NumberToStringWithRadix
1899         https://bugs.webkit.org/show_bug.cgi?id=183559
1900
1901         Reviewed by Mark Lam.
1902
1903         * stress/double-to-string-in-loop-removed.js: Added.
1904         (test):
1905         * stress/int32-to-string-in-loop-removed.js: Added.
1906         (test):
1907         * stress/int52-to-string-in-loop-removed.js: Added.
1908         (test):
1909
1910 2018-03-22  Michael Saboff  <msaboff@apple.com>
1911
1912         Race Condition in arrayProtoFuncReverse() causes wrong results or crash
1913         https://bugs.webkit.org/show_bug.cgi?id=183901
1914
1915         Reviewed by Keith Miller.
1916
1917         New test.
1918
1919         * stress/array-reverse-doesnt-clobber.js: Added.
1920         (testArrayReverse):
1921         (createArrayOfArrays):
1922         (createArrayStorage):
1923
1924 2018-03-21  Filip Pizlo  <fpizlo@apple.com>
1925
1926         ScopedArguments should do poisoning and index masking
1927         https://bugs.webkit.org/show_bug.cgi?id=183863
1928
1929         Reviewed by Mark Lam.
1930         
1931         Adds another stress test of scoped arguments.
1932
1933         * stress/scoped-arguments-test.js: Added.
1934         (foo):
1935
1936 2018-03-20  Saam Barati  <sbarati@apple.com>
1937
1938         We need to do proper bookkeeping of exitOK when inserting constants when sinking NewArrayBuffer
1939         https://bugs.webkit.org/show_bug.cgi?id=183795
1940         <rdar://problem/38298694>
1941
1942         Reviewed by JF Bastien.
1943
1944         * stress/sink-phantom-new-array-buffer-exit-ok.js: Added.
1945         (foo):
1946         (bar):
1947
1948 2018-03-16  Yusuke Suzuki  <utatane.tea@gmail.com>
1949
1950         [DFG][FTL] Add vectorLengthHint for NewArray
1951         https://bugs.webkit.org/show_bug.cgi?id=183694
1952
1953         Reviewed by Saam Barati.
1954
1955         * stress/vector-length-hint-array-constructor.js: Added.
1956         (shouldBe):
1957         (test):
1958         * stress/vector-length-hint-new-array.js: Added.
1959         (shouldBe):
1960         (test):
1961
1962 2018-03-13  Yusuke Suzuki  <utatane.tea@gmail.com>
1963
1964         [DFG][FTL] Make ArraySlice(0) code tight
1965         https://bugs.webkit.org/show_bug.cgi?id=183590
1966
1967         Reviewed by Saam Barati.
1968
1969         * stress/array-slice-with-zero.js: Added.
1970         (shouldBe):
1971         (test):
1972         (test2):
1973         * stress/array-slice-zero-args.js: Added.
1974         (shouldBe):
1975         (test):
1976
1977 2018-03-14  Caitlin Potter  <caitp@igalia.com>
1978
1979         [JSC] fix order of evaluation for ClassDefinitionEvaluation
1980         https://bugs.webkit.org/show_bug.cgi?id=183523
1981
1982         Reviewed by Keith Miller.
1983
1984         Computed property names need to be evaluated in source order during class
1985         definition evaluation, as it's observable (and specified to work this way).
1986
1987         This change improves compatibility with Chromium.
1988
1989         * stress/class_elements.js: Added.
1990         (test):
1991         (test.C.prototype.effect):
1992         (test.C.effect):
1993         (test.C.prototype.get effect):
1994         (test.C.prototype.set effect):
1995         (test.C):
1996
1997 2018-03-11  Yusuke Suzuki  <utatane.tea@gmail.com>
1998
1999         [DFG] AI should convert CreateThis to NewObject if the prototype object is proved
2000         https://bugs.webkit.org/show_bug.cgi?id=183310
2001
2002         Reviewed by Filip Pizlo.
2003
2004         * stress/ai-create-this-to-new-object-fire.js: Added.
2005         (assert):
2006         (test):
2007         (func):
2008         (check):
2009         (test.body.A):
2010         (test.body.B):
2011         (test.body):
2012         * stress/ai-create-this-to-new-object.js: Added.
2013         (assert):
2014         (test):
2015         (func):
2016         (check):
2017         (test.body.A):
2018         (test.body.B):
2019         (test.body):
2020
2021 2018-03-10  Yusuke Suzuki  <utatane.tea@gmail.com>
2022
2023         [FTL] Drop NewRegexp for String.prototype.match with RegExp + global flag
2024         https://bugs.webkit.org/show_bug.cgi?id=181848
2025
2026         Reviewed by Sam Weinig.
2027
2028         * microbenchmarks/regexp-u-global-es5.js: Added.
2029         (fn):
2030         * microbenchmarks/regexp-u-global-es6.js: Added.
2031         (fn):
2032         * stress/materialized-regexp-has-correct-last-index-set-by-match-at-osr-exit.js: Added.
2033         (shouldBe):
2034         (test):
2035         (i.switch):
2036         * stress/materialized-regexp-has-correct-last-index-set-by-match.js: Added.
2037         (shouldBe):
2038         (test):
2039
2040 2018-03-07  Dominik Infuehr  <dinfuehr@igalia.com>
2041
2042         Disable test stress/var-injection-cache-invalidation.js on systems with limited memory
2043         https://bugs.webkit.org/show_bug.cgi?id=183334
2044
2045         Reviewed by Žan Doberšek.
2046
2047         * stress/var-injection-cache-invalidation.js:
2048
2049 2018-03-06  Dominik Infuehr  <dinfuehr@igalia.com>
2050
2051         [ARM] Disable tests that run out of memory
2052         https://bugs.webkit.org/show_bug.cgi?id=182699
2053
2054         Reviewed by Žan Doberšek.
2055
2056         Skip tests that run of of memory. Do not run
2057         modules/module-jit-reachability.js without LLInt to prevent
2058         running out of executable memory.
2059
2060         * modules.yaml:
2061         * modules/module-jit-reachability.js:
2062         * stress/has-own-property-name-cache-string-keys.js:
2063         * stress/has-own-property-name-cache-symbol-keys.js:
2064
2065 2018-03-01  Yusuke Suzuki  <utatane.tea@gmail.com>
2066
2067         ASSERTION FAILED: matchContextualKeyword(m_vm->propertyNames->async)
2068         https://bugs.webkit.org/show_bug.cgi?id=183173
2069
2070         Reviewed by Saam Barati.
2071
2072         * stress/async-arrow-function-in-class-heritage.js: Added.
2073         (testSyntax):
2074         (testSyntaxError):
2075         (SyntaxError):
2076
2077 2018-03-01  Saam Barati  <sbarati@apple.com>
2078
2079         We need to clear cached structures when having a bad time
2080         https://bugs.webkit.org/show_bug.cgi?id=183256
2081         <rdar://problem/36245022>
2082
2083         Reviewed by Mark Lam.
2084
2085         * stress/having-a-bad-time-with-derived-arrays.js: Added.
2086         (assert):
2087         (defineSetter):
2088         (iterate):
2089         (doSlice):
2090
2091 2018-02-28  Yusuke Suzuki  <utatane.tea@gmail.com>
2092
2093         JSC crash with `import("")`
2094         https://bugs.webkit.org/show_bug.cgi?id=183175
2095
2096         Reviewed by Saam Barati.
2097
2098         * stress/import-with-empty-string.js: Added.
2099
2100 2018-02-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2101
2102         Unreviewed, skip FTL tests if FTL is disabled
2103         https://bugs.webkit.org/show_bug.cgi?id=183071
2104
2105         * stress/has-indexed-property-array-storage-ftl.js:
2106         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
2107
2108 2018-02-25  Yusuke Suzuki  <utatane.tea@gmail.com>
2109
2110         [FTL] Support PutByVal(ArrayStorage/SlowPutArrayStorage)
2111         https://bugs.webkit.org/show_bug.cgi?id=182965
2112
2113         Reviewed by Saam Barati.
2114
2115         * stress/put-by-val-array-storage.js: Added.
2116         (shouldBe):
2117         (testArrayStorageInBounds):
2118         * stress/put-by-val-direct-out-of-bounds-setter.js: Added.
2119         (shouldBe):
2120         (testInt32.createBuiltin):
2121         (set for):
2122         * stress/put-by-val-slow-put-array-storage.js: Added.
2123         (shouldBe):
2124         (testArrayStorageInBounds):
2125
2126 2018-02-26  Saam Barati  <sbarati@apple.com>
2127
2128         validateStackAccess should not validate if the offset is within the stack bounds
2129         https://bugs.webkit.org/show_bug.cgi?id=183067
2130         <rdar://problem/37749988>
2131
2132         Reviewed by Mark Lam.
2133
2134         * stress/dont-validate-stack-offset-in-b3-because-it-might-be-guarded-by-control-flow.js: Added.
2135         (assert):
2136         (test.a):
2137         (test.b):
2138         (test):
2139
2140 2018-02-26  Yusuke Suzuki  <utatane.tea@gmail.com>
2141
2142         Unreviewed, skip FTL tests if FTL is disabled
2143         https://bugs.webkit.org/show_bug.cgi?id=183071
2144
2145         * stress/has-indexed-property-array-storage-ftl.js:
2146         * stress/has-indexed-property-slow-put-array-storage-ftl.js:
2147
2148 2018-02-23  Saam Barati  <sbarati@apple.com>
2149
2150         Make Number.isInteger an intrinsic
2151         https://bugs.webkit.org/show_bug.cgi?id=183088
2152
2153         Reviewed by JF Bastien.
2154
2155         * stress/number-is-integer-intrinsic.js: Added.
2156
2157 2018-02-23  Oleksandr Skachkov  <gskachkov@gmail.com>
2158
2159         WebAssembly: cache memory address / size on instance
2160         https://bugs.webkit.org/show_bug.cgi?id=177305
2161
2162         Reviewed by JF Bastien.
2163
2164         * wasm/function-tests/memory-reuse.js: Added.
2165         (createWasmInstance):
2166         (doCheckTrap):
2167         (doMemoryGrow):
2168         (doCheck):
2169         (checkWasmInstancesWithSharedMemory):
2170
2171 2018-02-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2172
2173         [JSC] Implement $vm.ftlTrue function for FTL testing
2174         https://bugs.webkit.org/show_bug.cgi?id=183071
2175
2176         Reviewed by Mark Lam.
2177
2178         * stress/dead-fiat-value-to-int52-then-exit-not-double.js:
2179         (foo):
2180         * stress/dead-fiat-value-to-int52-then-exit-not-int52.js:
2181         (foo):
2182         * stress/dead-fiat-value-to-int52.js:
2183         (foo):
2184         * stress/dead-osr-entry-value.js:
2185         (foo):
2186         * stress/fiat-value-to-int52-then-exit-not-double.js:
2187         (foo):
2188         * stress/fiat-value-to-int52-then-exit-not-int52.js:
2189         (foo):
2190         * stress/fiat-value-to-int52-then-fail-to-fold.js:
2191         (foo):
2192         * stress/fiat-value-to-int52-then-fold.js:
2193         (foo):
2194         * stress/fiat-value-to-int52.js:
2195         (foo):
2196         * stress/fold-based-on-int32-proof-mul-branch.js:
2197         (foo):
2198         * stress/fold-profiled-call-to-call.js:
2199         (foo):
2200         * stress/fold-to-double-constant-then-exit.js:
2201         (foo):
2202         * stress/fold-to-int52-constant-then-exit.js:
2203         (foo):
2204         * stress/fold-to-primitive-in-cfa.js:
2205         (foo):
2206         * stress/fold-to-primitive-to-identity-in-cfa.js:
2207         (foo):
2208         * stress/has-indexed-property-array-storage-ftl.js: Added.
2209         (shouldBe):
2210         (test1):
2211         (test2):
2212         * stress/has-indexed-property-slow-put-array-storage-ftl.js: Added.
2213         (shouldBe):
2214         (test1):
2215         (test2):
2216         * stress/int52-ai-add-then-filter-int32.js:
2217         (foo):
2218         * stress/int52-ai-mul-and-clean-neg-zero-then-filter-int32.js:
2219         (foo):
2220         * stress/int52-ai-mul-then-filter-int32.js:
2221         (foo):
2222         * stress/int52-ai-neg-then-filter-int32.js:
2223         (foo):
2224         * stress/int52-ai-sub-then-filter-int32.js:
2225         (foo):
2226         * stress/licm-pre-header-cannot-exit-nested.js:
2227         (foo):
2228         * stress/licm-pre-header-cannot-exit.js:
2229         (foo):
2230         * stress/sparse-array-entry-update-144067.js:
2231         (useMemoryToTriggerGCs):
2232         * stress/test-spec-misc.js:
2233         (foo):
2234         * stress/tricky-array-bounds-checks.js:
2235         (foo):
2236
2237 2018-02-22  Yusuke Suzuki  <utatane.tea@gmail.com>
2238
2239         [FTL] Support HasIndexedProperty for ArrayStorage and SlowPutArrayStorage
2240         https://bugs.webkit.org/show_bug.cgi?id=182792
2241
2242         Reviewed by Mark Lam.
2243
2244         * stress/has-indexed-property-array-storage.js: Added.
2245         (shouldBe):
2246         (test1):
2247         (test2):
2248         * stress/has-indexed-property-slow-put-array-storage.js: Added.
2249         (shouldBe):
2250         (test1):
2251         (test2):
2252
2253 2018-02-20  Saam Barati  <sbarati@apple.com>
2254
2255         DFG::VarargsForwardingPhase should eliminate getting argument length
2256         https://bugs.webkit.org/show_bug.cgi?id=182959
2257
2258         Reviewed by Keith Miller.
2259
2260         * microbenchmarks/forward-arguments-dont-escape-on-arguments-length.js: Added.
2261
2262 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2263
2264         [FTL] Support ArrayPush for ArrayStorage
2265         https://bugs.webkit.org/show_bug.cgi?id=182782
2266
2267         Reviewed by Saam Barati.
2268
2269         Existing array-push-multiple-storage.js covers ArrayPush(ArrayStorage) multiple arguments case.
2270
2271         * stress/array-push-array-storage-beyond-int32.js: Added.
2272         (shouldBe):
2273         (test):
2274         * stress/array-push-array-storage.js: Added.
2275         (shouldBe):
2276         (test):
2277         * stress/array-push-multiple-array-storage-beyond-int32.js: Added.
2278         (shouldBe):
2279         (test):
2280         * stress/array-push-multiple-storage-continuous.js: Added.
2281         (shouldBe):
2282         (test):
2283
2284 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2285
2286         [FTL] Support ArrayPop for ArrayStorage
2287         https://bugs.webkit.org/show_bug.cgi?id=182783
2288
2289         Reviewed by Saam Barati.
2290
2291         * stress/array-pop-array-storage.js: Added.
2292         (shouldBe):
2293         (test):
2294
2295 2018-02-14  Yusuke Suzuki  <utatane.tea@gmail.com>
2296
2297         [FTL] Add Arrayify for ArrayStorage and SlowPutArrayStorage
2298         https://bugs.webkit.org/show_bug.cgi?id=182731
2299
2300         Reviewed by Saam Barati.
2301
2302         * stress/arrayify-array-storage-array.js: Added.
2303         (shouldBe):
2304         (testArrayStorage):
2305         * stress/arrayify-array-storage-non-array.js: Added.
2306         (shouldBe):
2307         (testArrayStorage):
2308         * stress/arrayify-array-storage.js: Added.
2309         (shouldBe):
2310         (testArrayStorage):
2311         * stress/arrayify-slow-put-array-storage-pass-array-storage.js: Added.
2312         (shouldBe):
2313         (testArrayStorage):
2314         * stress/arrayify-slow-put-array-storage.js: Added.
2315         (shouldBe):
2316         (testArrayStorage):
2317
2318 2018-02-19  Saam Barati  <sbarati@apple.com>
2319
2320         Don't use JSFunction's allocation profile when getting the prototype can be effectful
2321         https://bugs.webkit.org/show_bug.cgi?id=182942
2322         <rdar://problem/37584764>
2323
2324         Reviewed by Mark Lam.
2325
2326         * stress/get-prototype-create-this-effectful.js: Added.
2327
2328 2018-02-16  Saam Barati  <sbarati@apple.com>
2329
2330         Fix bugs from r228411
2331         https://bugs.webkit.org/show_bug.cgi?id=182851
2332         <rdar://problem/37577732>
2333
2334         Reviewed by JF Bastien.
2335
2336         * stress/constant-folding-phase-insert-check-handle-varargs.js: Added.
2337
2338 2018-02-15  Filip Pizlo  <fpizlo@apple.com>
2339
2340         Unreviewed, roll out r228366 since it did not progress anything.
2341
2342         * stress/gc-error-stack.js: Removed.
2343         * stress/no-gc-error-stack.js: Removed.
2344
2345 2018-02-15  Tomas Popela  <tpopela@redhat.com>
2346
2347         Many stress tests fail with JIT disabled
2348         https://bugs.webkit.org/show_bug.cgi?id=182730
2349
2350         Reviewed by Saam Barati.
2351
2352         These tests are broken by design if the JIT is disabled - they test
2353         the return value of numberOfDFGCompiles(), which is always set to
2354         1000000.0 in TestRunnerUtils.cpp and makes the tests to fail.
2355
2356         * stress/arith-abs-on-various-types.js:
2357         * stress/arith-abs-to-arith-negate-range-optimizaton.js:
2358         * stress/arith-acos-on-various-types.js:
2359         * stress/arith-acosh-on-various-types.js:
2360         * stress/arith-asin-on-various-types.js:
2361         * stress/arith-asinh-on-various-types.js:
2362         * stress/arith-atan-on-various-types.js:
2363         * stress/arith-atanh-on-various-types.js:
2364         * stress/arith-cbrt-on-various-types.js:
2365         * stress/arith-ceil-on-various-types.js:
2366         * stress/arith-clz32-on-various-types.js:
2367         * stress/arith-cos-on-various-types.js:
2368         * stress/arith-cosh-on-various-types.js:
2369         * stress/arith-expm1-on-various-types.js:
2370         * stress/arith-floor-on-various-types.js:
2371         * stress/arith-fround-on-various-types.js:
2372         * stress/arith-log-on-various-types.js:
2373         * stress/arith-log10-on-various-types.js:
2374         * stress/arith-log2-on-various-types.js:
2375         * stress/arith-negate-on-various-types.js:
2376         * stress/arith-round-on-various-types.js:
2377         * stress/arith-sin-on-various-types.js:
2378         * stress/arith-sinh-on-various-types.js:
2379         * stress/arith-sqrt-on-various-types.js:
2380         * stress/arith-tan-on-various-types.js:
2381         * stress/arith-tanh-on-various-types.js:
2382         * stress/arith-trunc-on-various-types.js:
2383         * stress/compare-strict-eq-on-various-types.js:
2384
2385 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
2386
2387         Skip stress/new-largeish-contiguous-array-with-size.js on arm.
2388
2389         Unreviewed test gardening.
2390
2391         * stress/new-largeish-contiguous-array-with-size.js:
2392
2393 2018-02-14  Saam Barati  <sbarati@apple.com>
2394
2395         Setting a VMTrap shouldn't look at topCallFrame since that may imply we're in C code and holding the malloc lock
2396         https://bugs.webkit.org/show_bug.cgi?id=182801
2397
2398         Reviewed by Keith Miller.
2399
2400         * stress/watchdog-dont-malloc-when-in-c-code.js: Added.
2401
2402 2018-02-14  Ryan Haddad  <ryanhaddad@apple.com>
2403
2404         Skip JSC test stress/activation-sink-default-value-tdz-error.js on debug.
2405         https://bugs.webkit.org/show_bug.cgi?id=182526
2406
2407         Unreviewed test gardening.
2408
2409         * stress/activation-sink-default-value-tdz-error.js:
2410
2411 2018-02-13  Saam Barati  <sbarati@apple.com>
2412
2413         putDirectIndexSlowOrBeyondVectorLength needs to convert to dictionary indexing mode always if attributes are present
2414         https://bugs.webkit.org/show_bug.cgi?id=182755
2415         <rdar://problem/37080864>
2416
2417         Reviewed by Keith Miller.
2418
2419         * stress/always-enter-dictionary-indexing-mode-with-getter.js: Added.
2420         (test1.o.get 10005):
2421         (test1):
2422         (test2.o.get 1000):
2423         (test2):
2424
2425 2018-02-13  Caitlin Potter  <caitp@igalia.com>
2426
2427         [JSC] cache TaggedTemplate arrays by callsite rather than by contents
2428         https://bugs.webkit.org/show_bug.cgi?id=182717
2429
2430         Reviewed by Yusuke Suzuki.
2431
2432         https://github.com/tc39/ecma262/pull/890 imposes a change to template
2433         literals, to allow template callsite arrays to be collected when the
2434         code containing the tagged template call is collected. This spec change
2435         has received concensus and been ratified.
2436
2437         This change eliminates the eternal map associating template contents
2438         with arrays.
2439
2440         * stress/tagged-template-object-collect.js: Renamed from JSTests/stress/tagged-template-registry-key-collect.js.
2441         * stress/tagged-template-object.js: Renamed from JSTests/stress/tagged-template-registry-key.js.
2442         * stress/tagged-templates-identity.js:
2443         * stress/template-string-tags-eval.js:
2444         * test262.yaml:
2445
2446 2018-02-13  Yusuke Suzuki  <utatane.tea@gmail.com>
2447
2448         Support GetArrayLength on ArrayStorage in the FTL
2449         https://bugs.webkit.org/show_bug.cgi?id=182625
2450
2451         Reviewed by Saam Barati.
2452
2453         * stress/array-storage-length.js: Added.
2454         (shouldBe):
2455         (testInBound):
2456         (testUncountable):
2457         (testSlowPutInBound):
2458         (testSlowPutUncountable):
2459         * stress/undecided-length.js: Added.
2460         (shouldBe):
2461         (test2):
2462
2463 2018-02-12  Saam Barati  <sbarati@apple.com>
2464
2465         DFG::emitCodeToGetArgumentsArrayLength needs to handle NewArrayBuffer/PhantomNewArrayBuffer
2466         https://bugs.webkit.org/show_bug.cgi?id=182706
2467         <rdar://problem/36833681>
2468
2469         Reviewed by Filip Pizlo.
2470
2471         * stress/get-array-length-phantom-new-array-buffer.js: Added.
2472         (effects):
2473         (foo):
2474
2475 2018-02-09  Filip Pizlo  <fpizlo@apple.com>
2476
2477         Don't waste memory for error.stack
2478         https://bugs.webkit.org/show_bug.cgi?id=182656
2479
2480         Reviewed by Saam Barati.
2481         
2482         Tests the policy.
2483
2484         * stress/gc-error-stack.js: Added. Shows that the GC forgets frames now.
2485         * stress/no-gc-error-stack.js: Added. Shows that the GC won't forget things if you ask for the stack.
2486
2487 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2488
2489         [JSC] Update Test262 to Feb 9 version
2490         https://bugs.webkit.org/show_bug.cgi?id=182468
2491
2492         Reviewed by Saam Barati.
2493
2494 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2495
2496         Unreviewed, fix invalid line terminator in old test262 file part 2
2497         https://bugs.webkit.org/show_bug.cgi?id=182468
2498
2499         * test262/test/built-ins/Function/prototype/toString/line-terminator-normalisation-CR.js:
2500
2501 2018-02-08  Yusuke Suzuki  <utatane.tea@gmail.com>
2502
2503         Unreviewed, fix invalid line terminator in old test262 file
2504         https://bugs.webkit.org/show_bug.cgi?id=182468
2505
2506         * test262/test/language/literals/regexp/7.8.5-1.js:
2507
2508 2018-02-06  Yusuke Suzuki  <utatane.tea@gmail.com>
2509
2510         [JSC] Implement Array.prototype.flatMap and Array.prototype.flatten
2511         https://bugs.webkit.org/show_bug.cgi?id=182440
2512
2513         Reviewed by Darin Adler.
2514
2515         * stress/array-flatmap.js: Added.
2516         (shouldBe):
2517         (shouldBeArray):
2518         (shouldThrow):
2519         (var):
2520         * stress/array-flatten.js: Added.
2521         (shouldBe):
2522         (shouldBeArray):
2523         * test262.yaml:
2524         * test262/test/built-ins/Array/prototype/flatMap/depth-always-one.js:
2525         (3.flatMap):
2526         Pick test262 82c6148980332febe92a544a1fb653718e9fdb57 change.
2527
2528 2018-02-06  Keith Miller  <keith_miller@apple.com>
2529
2530         put_to_scope/get_from_scope should not cache lexical scopes when expecting a global object
2531         https://bugs.webkit.org/show_bug.cgi?id=182549
2532         <rdar://problem/36189995>
2533
2534         Reviewed by Saam Barati.
2535
2536         * stress/var-injection-cache-invalidation.js: Added.
2537         (allocateLotsOfThings):
2538         (test):
2539
2540 2018-02-03  Yusuke Suzuki  <utatane.tea@gmail.com>
2541
2542         Unreviewed, follow up for test262 update
2543         https://bugs.webkit.org/show_bug.cgi?id=182288
2544
2545         * test262.yaml:
2546
2547 2018-02-02  Ryan Haddad  <ryanhaddad@apple.com>
2548
2549         Update test262 to Jan 30 version
2550         https://bugs.webkit.org/show_bug.cgi?id=182288
2551
2552         Unreviewed test gardening.
2553
2554         * test262.yaml: Remove entry for missing test language/expressions/assignment/white-space.js
2555
2556 2018-02-02  Saam Barati  <sbarati@apple.com>
2557
2558         When BytecodeParser inserts Unreachable after ForceOSRExit it needs to update ArgumentPositions for Flushes it inserts
2559         https://bugs.webkit.org/show_bug.cgi?id=182368
2560         <rdar://problem/36932466>
2561
2562         Reviewed by Mark Lam.
2563
2564         * stress/flush-after-force-exit-in-bytecodeparser-needs-to-update-argument-positions.js: Added.
2565         (runNearStackLimit.t):
2566         (runNearStackLimit):
2567         (try.runNearStackLimit):
2568         (catch):
2569
2570 2018-02-02  Yusuke Suzuki  <utatane.tea@gmail.com>
2571
2572         Update test262 to Jan 30 version
2573         https://bugs.webkit.org/show_bug.cgi?id=182288
2574
2575         Rubber stamped by Saam Barati.
2576
2577         This patch updates test262 to the latest one, Jan 30 version.
2578         Since added and changed files are too many, we cannot create ChangeLog.
2579         The following files are changed.
2580
2581         Several files are intentionally omitted due to merge failures. We should investigate how to merge files
2582         including some special line terminators (like u2028, u2029).
2583
2584         * test262.yaml:
2585         * test262/test262-Revision.txt:
2586         * test262/*:
2587
2588 2018-02-02  Guillaume Emont  <guijemont@igalia.com>
2589
2590         JSTests: Skip mozilla/js1_5/Array/regress-157652.js on all memory limited platforms
2591         https://bugs.webkit.org/show_bug.cgi?id=182411
2592
2593         Reviewed by Carlos Alberto Lopez Perez.
2594
2595         This is skipped only on arm memory limited platforms. Until recently
2596         it was not a problem on MIPS as the butterfly was not initialized. But
2597         since r227435, the butterfly is initialized in that test and therefore
2598         memory is allocated, and the test typically takes around 512M, which
2599         means it generally gets OOM-killed on the MIPS buildbot.
2600
2601         * mozilla/mozilla-tests.yaml:
2602
2603 2018-02-01  Mark Lam  <mark.lam@apple.com>
2604
2605         Fix broken bounds check in FTL's compileGetMyArgumentByVal().
2606         https://bugs.webkit.org/show_bug.cgi?id=182419
2607         <rdar://problem/37044945>
2608
2609         Reviewed by Saam Barati.
2610
2611         * stress/regress-182419.js: Added.
2612
2613 2018-02-01  Keith Miller  <keith_miller@apple.com>
2614
2615         Fix crashes due to mishandling custom sections.
2616         https://bugs.webkit.org/show_bug.cgi?id=182404
2617         <rdar://problem/36935863>
2618
2619         Reviewed by Saam Barati.
2620
2621         * wasm/Builder.js:
2622         (export.default.Builder.prototype._registerSectionBuilders.const.section.in.WASM.description.section.switch.section.case.string_appeared_here.this.section):
2623         * wasm/js-api/validate.js:
2624         (assert.truthy):
2625
2626 2018-01-31  Saam Barati  <sbarati@apple.com>
2627
2628         JSC incorrectly interpreting script, sets Global Property instead of Global Lexical variable (LiteralParser / JSONP path)
2629         https://bugs.webkit.org/show_bug.cgi?id=182074
2630         <rdar://problem/36846261>
2631
2632         Reviewed by Mark Lam.
2633
2634         * stress/jsonp-program-evaluate-path-must-consider-global-lexical-environment.js: Added.
2635         (assert):
2636         (let.func):
2637         (let.o.foo):
2638         (varFunc):
2639
2640 2018-01-30  Yusuke Suzuki  <utatane.tea@gmail.com>
2641
2642         Unreviewed, update test262 expects
2643         https://bugs.webkit.org/show_bug.cgi?id=182232
2644
2645         * test262.yaml:
2646
2647 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2648
2649         [JSC] Implement trimStart and trimEnd
2650         https://bugs.webkit.org/show_bug.cgi?id=182233
2651
2652         Reviewed by Mark Lam.
2653
2654         * stress/trim.js: Added.
2655         (shouldBe):
2656         (startTest):
2657         (endTest):
2658         (trimTest):
2659
2660 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2661
2662         [JSC] Relax line terminators in String to make JSON subset of JS
2663         https://bugs.webkit.org/show_bug.cgi?id=182232
2664
2665         Reviewed by Keith Miller.
2666
2667         * ChakraCore/test/es5/Lex_u3.baseline-jsc:
2668         * stress/relaxed-line-terminators-in-string.js: Added.
2669         (shouldBe):
2670
2671 2018-01-29  Michael Saboff  <msaboff@apple.com>
2672
2673         REGRESSION (r227341): DFG_ASSERT failure at JSC::DFG::AtTailAbstractState::forNode()
2674         https://bugs.webkit.org/show_bug.cgi?id=182249
2675
2676         Reviewed by Keith Miller.
2677
2678         New regression test.
2679
2680         * stress/compare-clobber-untypeduse.js: Added.
2681
2682 2018-01-29  Matt Lewis  <jlewis3@apple.com>
2683
2684         Unreviewed, rolling out r227725.
2685
2686         This caused internal failures.
2687
2688         Reverted changeset:
2689
2690         "JSC Sampling Profiler: Detect tester and testee when sampling
2691         in RegExp JIT"
2692         https://bugs.webkit.org/show_bug.cgi?id=152729
2693         https://trac.webkit.org/changeset/227725
2694
2695 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2696
2697         JSC Sampling Profiler: Detect tester and testee when sampling in RegExp JIT
2698         https://bugs.webkit.org/show_bug.cgi?id=152729
2699
2700         Reviewed by Saam Barati.
2701
2702         * stress/sampling-profiler-regexp.js: Added.
2703         (platformSupportsSamplingProfiler.test):
2704         (platformSupportsSamplingProfiler.baz):
2705         (platformSupportsSamplingProfiler):
2706
2707 2018-01-29  Yusuke Suzuki  <utatane.tea@gmail.com>
2708
2709         [DFG][FTL] WeakMap#set should have DFG node
2710         https://bugs.webkit.org/show_bug.cgi?id=180015
2711
2712         Reviewed by Saam Barati.
2713
2714         * stress/weakmap-set-change-get.js: Added.
2715         (shouldBe):
2716         (test):
2717         * stress/weakmap-set-cse.js: Added.
2718         (shouldBe):
2719         (test):
2720         * stress/weakset-add-change-get.js: Added.
2721         (shouldBe):
2722         * stress/weakset-add-cse.js: Added.
2723         (shouldBe):
2724
2725 2018-01-27  Yusuke Suzuki  <utatane.tea@gmail.com>
2726
2727         DFG strength reduction fails to convert NumberToStringWithValidRadixConstant for 0 to constant '0'
2728         https://bugs.webkit.org/show_bug.cgi?id=182213
2729
2730         Reviewed by Mark Lam.
2731
2732         * stress/int32-min-to-string.js: Added.
2733         (shouldBe):
2734         (test2):
2735         (test4):
2736         (test8):
2737         (test16):
2738         (test32):
2739         * stress/zero-to-string.js: Added.
2740         (shouldBe):
2741         (test2):
2742         (test4):
2743         (test8):
2744         (test16):
2745         (test32):
2746
2747 2018-01-23  Yusuke Suzuki  <utatane.tea@gmail.com>
2748
2749         Add more module scope related tests with code evaluation by string
2750         https://bugs.webkit.org/show_bug.cgi?id=181983
2751
2752         Reviewed by Sam Weinig.
2753
2754         Add more module scope related tests. When the original tests are landed,
2755         we do not have browser integration. This patch adds more module scope tests
2756         with dynamically created script evaluation. We add tests with Function
2757         constructor, direct eval, indirect eval, setTimeout, setInterval, and event handlers.
2758
2759         * modules/scopes-eval.js: Added.
2760         (shouldBe):
2761         * modules/scopes.js:
2762         (shouldBe):
2763
2764 2018-01-23  Filip Pizlo  <fpizlo@apple.com>
2765
2766         Unreviewed, retire some microbenchmarks that are proportionately very slow. Benchmark running time should be proportional to their value. Microbenchmarks have little value, so they should be very fast.
2767
2768         * microbenchmarks/array-push-3.js: Removed.
2769         * microbenchmarks/bigswitch-indirect-symbol-or-undefined.js: Removed.
2770         * microbenchmarks/double-to-int32.js: Removed.
2771         * microbenchmarks/fake-iterators-that-throw-when-finished.js: Removed.
2772         * microbenchmarks/ftl-polymorphic-bitand.js: Removed.
2773         * microbenchmarks/ftl-polymorphic-bitor.js: Removed.
2774         * microbenchmarks/ftl-polymorphic-bitxor.js: Removed.
2775         * microbenchmarks/ftl-polymorphic-lshift.js: Removed.
2776         * microbenchmarks/ftl-polymorphic-rshift.js: Removed.
2777         * microbenchmarks/ftl-polymorphic-sub.js: Removed.
2778         * microbenchmarks/ftl-polymorphic-urshift.js: Removed.
2779         * microbenchmarks/map-constant-key.js: Removed.
2780         * microbenchmarks/nested-function-parsing.js: Removed.
2781         * microbenchmarks/rest-parameter-allocation-elimination.js: Removed.
2782         * microbenchmarks/spread-large-array.js: Removed.
2783         * microbenchmarks/string-add-constant-folding.js: Removed.
2784         * microbenchmarks/to-lower-case.js: Removed.
2785         * microbenchmarks/undefined-property-access.js: Removed.
2786         * slowMicrobenchmarks/array-push-3.js: Copied from JSTests/microbenchmarks/array-push-3.js.
2787         * slowMicrobenchmarks/bigswitch-indirect-symbol-or-undefined.js: Copied from JSTests/microbenchmarks/bigswitch-indirect-symbol-or-undefined.js.
2788         * slowMicrobenchmarks/double-to-int32.js: Copied from JSTests/microbenchmarks/double-to-int32.js.
2789         * slowMicrobenchmarks/fake-iterators-that-throw-when-finished.js: Copied from JSTests/microbenchmarks/fake-iterators-that-throw-when-finished.js.
2790         * slowMicrobenchmarks/ftl-polymorphic-bitand.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitand.js.
2791         * slowMicrobenchmarks/ftl-polymorphic-bitor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitor.js.
2792         * slowMicrobenchmarks/ftl-polymorphic-bitxor.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-bitxor.js.
2793         * slowMicrobenchmarks/ftl-polymorphic-lshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-lshift.js.
2794         * slowMicrobenchmarks/ftl-polymorphic-rshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-rshift.js.
2795         * slowMicrobenchmarks/ftl-polymorphic-sub.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-sub.js.
2796         * slowMicrobenchmarks/ftl-polymorphic-urshift.js: Copied from JSTests/microbenchmarks/ftl-polymorphic-urshift.js.
2797         * slowMicrobenchmarks/map-constant-key.js: Copied from JSTests/microbenchmarks/map-constant-key.js.
2798         * slowMicrobenchmarks/nested-function-parsing.js: Copied from JSTests/microbenchmarks/nested-function-parsing.js.
2799         * slowMicrobenchmarks/rest-parameter-allocation-elimination.js: Copied from JSTests/microbenchmarks/rest-parameter-allocation-elimination.js.
2800         * slowMicrobenchmarks/spread-large-array.js: Copied from JSTests/microbenchmarks/spread-large-array.js.
2801         * slowMicrobenchmarks/string-add-constant-folding.js: Copied from JSTests/microbenchmarks/string-add-constant-folding.js.
2802         * slowMicrobenchmarks/to-lower-case.js: Copied from JSTests/microbenchmarks/to-lower-case.js.
2803         * slowMicrobenchmarks/undefined-property-access.js: Copied from JSTests/microbenchmarks/undefined-property-access.js.
2804
2805 2018-01-23  Robin Morisset  <rmorisset@apple.com>
2806
2807         Update the argument count in DFGByteCodeParser::handleRecursiveCall
2808         https://bugs.webkit.org/show_bug.cgi?id=181739
2809         <rdar://problem/36627662>
2810
2811         Reviewed by Saam Barati.
2812
2813         * stress/recursive-tail-call-with-different-argument-count.js: Added.
2814         (foo):
2815         (bar):
2816
2817 2018-01-22  Michael Saboff  <msaboff@apple.com>
2818
2819         DFG abstract interpreter needs to properly model effects of some Math ops
2820         https://bugs.webkit.org/show_bug.cgi?id=181886
2821
2822         Reviewed by Saam Barati.
2823
2824         New regression test.
2825
2826         * stress/arith-nodes-abstract-interpreter-untypeduse.js: Added.
2827         (test):
2828
2829 2018-01-20  Caio Lima  <ticaiolima@gmail.com>
2830
2831         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
2832         https://bugs.webkit.org/show_bug.cgi?id=181182
2833
2834         Reviewed by Darin Adler.
2835
2836         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
2837         * stress/big-int-prototype-to-string-exception.js: Added.
2838         * stress/big-int-prototype-to-string-wrong-values.js: Added.
2839         * stress/number-prototype-to-string-cast-overflow.js: Added.
2840         * stress/number-prototype-to-string-exception.js: Added.
2841         * stress/number-prototype-to-string-wrong-values.js: Added.
2842
2843 2018-01-19  Ryan Haddad  <ryanhaddad@apple.com>
2844
2845         Disable Atomics when SharedArrayBuffer isn’t enabled
2846         https://bugs.webkit.org/show_bug.cgi?id=181572
2847
2848         Unreviewed test gardening.
2849
2850         * test262.yaml: Skip tests that fail after this change.
2851
2852 2018-01-19  Saam Barati  <sbarati@apple.com>
2853
2854         Kill ArithNegate's ArithProfile assert inside BytecodeParser
2855         https://bugs.webkit.org/show_bug.cgi?id=181877
2856         <rdar://problem/36630552>
2857
2858         Reviewed by Mark Lam.
2859
2860         * stress/arith-profile-for-negate-can-see-non-number-due-to-dfg-osr-exit-profiling.js: Added.
2861         (runNearStackLimit):
2862         (f1):
2863         (f2):
2864         (f3):
2865         (i.catch):
2866         (i.try.runNearStackLimit):
2867         (catch):
2868
2869 2018-01-19  Saam Barati  <sbarati@apple.com>
2870
2871         Spread's effects are modeled incorrectly both in AI and in Clobberize
2872         https://bugs.webkit.org/show_bug.cgi?id=181867
2873         <rdar://problem/36290415>
2874
2875         Reviewed by Michael Saboff.
2876
2877         * stress/ai-needs-to-model-spreads-effects.js: Added.
2878         (try.p.Symbol.iterator):
2879         (try.go):
2880         (catch):
2881         * stress/clobberize-needs-to-model-spread-effects.js: Added.
2882         (assert):
2883         (foo):
2884         (a.Symbol.iterator):
2885
2886 2018-01-19  Yusuke Suzuki  <utatane.tea@gmail.com>
2887
2888         Unreviewed, reduce count of iteration to fix timing out debug JSC test
2889         https://bugs.webkit.org/show_bug.cgi?id=181535
2890
2891         * stress/inserted-recovery-with-set-last-index.js:
2892
2893 2018-01-17  Yusuke Suzuki  <utatane.tea@gmail.com>
2894
2895         [DFG][FTL] Introduce PhantomNewRegexp and RegExpExecNonGlobalOrSticky
2896         https://bugs.webkit.org/show_bug.cgi?id=181535
2897
2898         Reviewed by Saam Barati.
2899
2900         * stress/inserted-recovery-with-set-last-index.js: Added.
2901         (shouldBe):
2902         (foo):
2903         * stress/materialize-regexp-at-osr-exit.js: Added.
2904         (shouldBe):
2905         (test):
2906         * stress/materialize-regexp-cyclic-regexp-at-osr-exit.js: Added.
2907         (shouldBe):
2908         (test):
2909         * stress/materialize-regexp-cyclic-regexp.js: Added.
2910         (shouldBe):
2911         (test):
2912         (i.switch):
2913         * stress/materialize-regexp-cyclic.js: Added.
2914         (shouldBe):
2915         (test):
2916         (i.switch):
2917         * stress/materialize-regexp-referenced-from-phantom-regexp-cyclic.js: Added.
2918         (bar):
2919         (foo):
2920         (test):
2921         * stress/materialize-regexp-referenced-from-phantom-regexp.js: Added.
2922         (bar):
2923         (foo):
2924         (test):
2925         * stress/materialize-regexp.js: Added.
2926         (shouldBe):
2927         (test):
2928         * stress/phantom-regexp-regexp-exec.js: Added.
2929         (shouldBe):
2930         (test):
2931         * stress/phantom-regexp-string-match.js: Added.
2932         (shouldBe):
2933         (test):
2934         * stress/regexp-last-index-sinking.js: Added.
2935         (shouldBe):
2936         (test):
2937
2938 2018-01-17  Saam Barati  <sbarati@apple.com>
2939
2940         Disable Atomics when SharedArrayBuffer isn’t enabled
2941         https://bugs.webkit.org/show_bug.cgi?id=181572
2942         <rdar://problem/36553206>
2943
2944         Reviewed by Michael Saboff.
2945
2946         * stress/isLockFree.js:
2947
2948 2018-01-17  Saam Barati  <sbarati@apple.com>
2949
2950         DFG::Node::convertToConstant needs to clear the varargs flags
2951         https://bugs.webkit.org/show_bug.cgi?id=181697
2952         <rdar://problem/36497332>
2953
2954         Reviewed by Yusuke Suzuki.
2955
2956         * stress/dfg-node-convert-to-constant-must-clear-varargs-flags.js: Added.
2957         (doIndexOf):
2958         (bar):
2959         (i.bar):
2960
2961 2018-01-16  Ryan Haddad  <ryanhaddad@apple.com>
2962
2963         Unreviewed, rolling out r226937.
2964
2965         Tests added with this change are failing due to a missing
2966         exception check.
2967
2968         Reverted changeset:
2969
2970         "[JSC] NumberPrototype::extractRadixFromArgs incorrectly cast
2971         double to int32_t"
2972         https://bugs.webkit.org/show_bug.cgi?id=181182
2973         https://trac.webkit.org/changeset/226937
2974
2975 2018-01-13  Caio Lima  <ticaiolima@gmail.com>
2976
2977         [JSC] NumberPrototype::extractRadixFromArgs incorrectly cast double to int32_t
2978         https://bugs.webkit.org/show_bug.cgi?id=181182
2979
2980         Reviewed by Darin Adler.
2981
2982         * bigIntTests.yaml:
2983         * stress/big-int-constructor.js:
2984         * stress/big-int-prototype-to-string-cast-overflow.js: Added.
2985         (assert):
2986         (assertThrowRangeError):
2987         * stress/number-prototype-to-string-cast-overflow.js: Added.
2988         (assert):
2989         (assertThrowRangeError):
2990
2991 2018-01-12  Saam Barati  <sbarati@apple.com>
2992
2993         CheckStructure can be incorrectly subsumed by CheckStructureOrEmpty
2994         https://bugs.webkit.org/show_bug.cgi?id=181177
2995         <rdar://problem/36205704>
2996
2997         Reviewed by Yusuke Suzuki.
2998
2999         * stress/check-structure-ir-ensures-empty-does-not-flow-through.js: Added.
3000         (runNearStackLimit.t):
3001         (runNearStackLimit):
3002         (test.f):
3003         (test):
3004
3005 2018-01-12  Saam Barati  <sbarati@apple.com>
3006
3007         Each variant of a polymorphic inlined call should be exitOK at the top of the block
3008         https://bugs.webkit.org/show_bug.cgi?id=181562
3009         <rdar://problem/36445624>
3010
3011         Reviewed by Yusuke Suzuki.
3012
3013         * stress/each-block-at-top-of-polymorphic-call-inlining-should-be-exitOK.js: Added.
3014         (f):
3015         (foo):
3016
3017 2018-01-11  Saam Barati  <sbarati@apple.com>
3018
3019         When inserting Unreachable in byte code parser we need to flush all the right things
3020         https://bugs.webkit.org/show_bug.cgi?id=181509
3021         <rdar://problem/36423110>
3022
3023         Reviewed by Mark Lam.
3024
3025         * stress/proper-flushing-when-we-insert-unreachable-after-force-exit-in-bytecode-parser.js: Added.
3026
3027 2018-01-11  Saam Barati  <sbarati@apple.com>
3028
3029         JITMathIC code in the FTL is wrong when code gets duplicated
3030         https://bugs.webkit.org/show_bug.cgi?id=181525
3031         <rdar://problem/36351993>
3032
3033         Reviewed by Michael Saboff and Keith Miller.
3034
3035         * stress/allow-math-ic-b3-code-duplication.js: Added.
3036
3037 2018-01-11  Saam Barati  <sbarati@apple.com>
3038
3039         Our for-in caching is wrong when we add indexed properties on things in the prototype chain
3040         https://bugs.webkit.org/show_bug.cgi?id=181508
3041
3042         Reviewed by Yusuke Suzuki.
3043
3044         * stress/for-in-prototype-with-indexed-properties-should-prevent-caching.js: Added.
3045         (assert):
3046         (test1.foo):
3047         (test1):
3048         (test2.foo):
3049         (test2):
3050
3051 2018-01-09  Mark Lam  <mark.lam@apple.com>
3052
3053         ASSERTION FAILED: pair.second->m_type & PropertyNode::Getter
3054         https://bugs.webkit.org/show_bug.cgi?id=181388
3055         <rdar://problem/36349351>
3056
3057         Reviewed by Saam Barati.
3058
3059         * stress/regress-181388.js: Added.
3060
3061 2018-01-08  JF Bastien  <jfbastien@apple.com>
3062
3063         WebAssembly: mask indexed accesses to Table
3064         https://bugs.webkit.org/show_bug.cgi?id=181412
3065         <rdar://problem/36363236>
3066
3067         Reviewed by Saam Barati.
3068
3069         Update error messages.
3070
3071         * wasm/js-api/table.js:
3072         (assert.throws.WebAssembly.Table.prototype.grow):
3073
3074 2018-01-08  Ryan Haddad  <ryanhaddad@apple.com>
3075
3076         Disable SharedArrayBuffer tests missed in r226386.
3077         https://bugs.webkit.org/show_bug.cgi?id=181266
3078
3079         Unreviewed test gardening.
3080
3081         * test262.yaml:
3082
3083 2018-01-06  Yusuke Suzuki  <utatane.tea@gmail.com>
3084
3085         Object.getOwnPropertyNames includes "arguments" and "caller" for bound functions
3086         https://bugs.webkit.org/show_bug.cgi?id=181321
3087
3088         Reviewed by Saam Barati.
3089
3090         * stress/bound-function-does-not-have-caller-and-arguments.js: Added.
3091         (shouldBe):
3092         (testFunction):
3093         * test262.yaml:
3094
3095 2018-01-05  Ryan Haddad  <ryanhaddad@apple.com>
3096
3097         Unreviewed, attempt to fix test262 after r226386.
3098
3099         * test262.yaml:
3100
3101 2018-01-04  Yusuke Suzuki  <utatane.tea@gmail.com>
3102
3103         [DFG] Define defs for MapSet/SetAdd to participate in CSE
3104         https://bugs.webkit.org/show_bug.cgi?id=179911
3105
3106         Reviewed by Saam Barati.
3107
3108         In addition to these tests, map-set-cse.js and set-add-cse.js work.
3109
3110         * stress/map-set-change-get.js: Added.
3111         (shouldBe):
3112         (test):
3113         * stress/map-set-create-bucket.js: Added.
3114         (shouldBe):
3115         (test):
3116         * stress/set-add-create-bucket.js: Added.
3117         (shouldBe):
3118
3119 2018-01-03  Michael Saboff  <msaboff@apple.com>
3120
3121         Disable SharedArrayBuffers from Web API
3122         https://bugs.webkit.org/show_bug.cgi?id=181266
3123
3124         Reviewed by Saam Barati.
3125
3126         Disabled SharedArrayBuffer tests.
3127
3128         * stress/SharedArrayBuffer-opt.js:
3129         * stress/SharedArrayBuffer.js:
3130         * stress/array-buffer-byte-length.js:
3131         * stress/atomics-add-uint32.js:
3132         * stress/atomics-known-int-use.js:
3133         * stress/atomics-neg-zero.js:
3134         * stress/atomics-store-return.js:
3135         * stress/lars-sab-workers.js:
3136         * stress/regress-159779-1.js:
3137         * stress/regress-159779-2.js:
3138         * stress/regress-170473.js:
3139         * test262.yaml:
3140
3141 2018-01-03  Caio Lima  <ticaiolima@gmail.com>
3142
3143         [ESNext][BigInt] Failing test stress/big-int-constructor-oom.js into MIPS
3144         https://bugs.webkit.org/show_bug.cgi?id=181258
3145
3146         Reviewed by Antonio Gomes.
3147
3148         * stress/big-int-constructor-gc.js:
3149         * stress/big-int-constructor-oom.js:
3150
3151 2018-01-03  Robin Morisset  <rmorisset@apple.com>
3152
3153         Inlining of a function that ends in op_unreachable crashes
3154         https://bugs.webkit.org/show_bug.cgi?id=181027
3155
3156         Reviewed by Filip Pizlo.
3157
3158         * stress/inlining-unreachable.js: Added.
3159         (bar):
3160         (baz):
3161         (i.catch):
3162
3163 2018-01-02  Saam Barati  <sbarati@apple.com>
3164
3165         Incorrect assertion inside AccessCase
3166         https://bugs.webkit.org/show_bug.cgi?id=181200
3167         <rdar://problem/35494754>
3168
3169         Reviewed by Yusuke Suzuki.
3170
3171         * stress/setter-same-base-and-rhs-invalid-assertion-inside-access-case.js: Added.
3172         (ctor):
3173         (theFunc):
3174         (run):
3175
3176 2018-01-02  Caio Lima  <ticaiolima@gmail.com>
3177
3178         [ESNext][BigInt] Implement BigIntConstructor and BigIntPrototype
3179         https://bugs.webkit.org/show_bug.cgi?id=175359
3180
3181         Reviewed by Yusuke Suzuki.
3182
3183         * bigIntTests.yaml:
3184         * stress/big-int-as-key.js: Added.
3185         * stress/big-int-constructor-gc.js: Added.
3186         * stress/big-int-constructor-oom.js: Added.
3187         * stress/big-int-constructor-properties.js: Added.
3188         * stress/big-int-constructor-prototype-prop-descriptor.js: Added.
3189         * stress/big-int-constructor-prototype.js: Added.
3190         * stress/big-int-constructor.js: Added.
3191         * stress/big-int-function-apply.js:
3192         * stress/big-int-length.js: Added.
3193         * stress/big-int-prop-descriptor.js: Added.
3194         * stress/big-int-proto-constructor.js: Added.
3195         * stress/big-int-proto-name.js: Added.
3196         * stress/big-int-prototype-properties.js: Added.
3197         * stress/big-int-prototype-proto.js: Added.
3198         * stress/big-int-prototype-value-of.js: Added.
3199         * stress/big-int-prototype-symbol-to-string-tag.js: Added.
3200         * stress/big-int-prototype-to-string-apply.js: Added.
3201         * stress/big-int-to-object.js: Added.
3202         * stress/big-int-to-string.js: Added.
3203
3204 2017-12-28  Saam Barati  <sbarati@apple.com>
3205
3206         Assertion used to determine if something is an async generator is wrong
3207         https://bugs.webkit.org/show_bug.cgi?id=181168
3208         <rdar://problem/35640560>
3209
3210         Reviewed by Yusuke Suzuki.
3211
3212         * stress/async-generator-assertion.js: Added.
3213
3214 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
3215
3216         Skip stress/splay-flash-access tests on memory limited platforms
3217         https://bugs.webkit.org/show_bug.cgi?id=181086
3218
3219         Reviewed by Carlos Alberto Lopez Perez.
3220
3221         These tests use about 185M of memory, and occasionally get OOM-killed
3222         on memory limited platforms.
3223
3224         * stress/splay-flash-access-1ms.js:
3225         * stress/splay-flash-access.js:
3226
3227 2017-12-21  Guillaume Emont  <guijemont@igalia.com>
3228
3229         Skip slow jsc tests on embedded platforms
3230         https://bugs.webkit.org/show_bug.cgi?id=180937
3231
3232         Reviewed by Carlos Alberto Lopez Perez.
3233
3234         The tests typeProfiler/deltablue-for-of.js and
3235         typeProfiler/getter-richards.js take a very long time in the
3236         ftl-no-cjit-type-profiler-force-poly-proto on embedded platform, and
3237         thus always timeout. They should be skipped on these platforms.
3238
3239         * typeProfiler/deltablue-for-of.js: Skip on arm*/mips.
3240         * typeProfiler/getter-richards.js: Skip on arm*/mips.
3241
3242 2017-12-19  Yusuke Suzuki  <utatane.tea@gmail.com>
3243
3244         [JSC] Do not check isValid() in op_new_regexp
3245         https://bugs.webkit.org/show_bug.cgi?id=180970
3246
3247         Reviewed by Saam Barati.
3248
3249         * stress/regexp-syntax-error-invalid-flags.js: Added.
3250         (shouldThrow):
3251
3252 2017-12-18  Guillaume Emont  <guijemont@igalia.com>
3253
3254         Skip stress/call-apply-exponential-bytecode-size.js unless x86-64 or arm64
3255         https://bugs.webkit.org/show_bug.cgi?id=180712
3256
3257         Reviewed by Michael Catanzaro.
3258
3259         stress/call-apply-exponential-bytecode-size.js crashes if the
3260         ExecutableAllocator's fixedExecutableMemoryPoolSize is less than 64
3261         MB. Currently it is 64 MB or more only on x86-64 and arm64, so we
3262         should skip the test on other platforms.
3263
3264         * stress/call-apply-exponential-bytecode-size.js:
3265
3266 2017-12-17  Yusuke Suzuki  <utatane.tea@gmail.com>
3267
3268         [FTL] NewArrayBuffer should be sinked if it is only used for spreading
3269         https://bugs.webkit.org/show_bug.cgi?id=179762
3270
3271         Reviewed by Saam Barati.
3272
3273         * stress/call-varargs-double-new-array-buffer.js: Added.
3274         (assert):
3275         (bar):
3276         (foo):
3277         * stress/call-varargs-spread-new-array-buffer.js: Added.
3278         (assert):
3279         (bar):
3280         (foo):
3281         * stress/call-varargs-spread-new-array-buffer2.js: Added.
3282         (assert):
3283         (bar):
3284         (foo):
3285         * stress/forward-varargs-double-new-array-buffer.js: Added.
3286         (assert):
3287         (test.baz):
3288         (test.bar):
3289         (test.foo):
3290         (test):
3291         * stress/new-array-buffer-sinking-osrexit.js: Added.
3292         (target):
3293         (test):
3294         * stress/new-array-with-spread-double-new-array-buffer.js: Added.
3295         (shouldBe):
3296         (test):
3297         * stress/new-array-with-spread-with-phantom-new-array-buffer.js: Added.
3298         (shouldBe):
3299         (target):
3300         (test):
3301         * stress/phantom-new-array-buffer-forward-varargs.js: Added.
3302         (assert):
3303         (test1.bar):
3304         (test1.foo):
3305         (test1):
3306         (test2.bar):
3307         (test2.foo):
3308         (test3.baz):
3309         (test3.bar):
3310         (test3.foo):
3311         (test4.baz):
3312         (test4.bar):
3313         (test4.foo):
3314         * stress/phantom-new-array-buffer-forward-varargs2.js: Added.
3315         (assert):
3316         (test.baz):
3317         (test.bar):
3318         (test.foo):
3319         (test):
3320         * stress/phantom-new-array-buffer-osr-exit.js: Added.
3321         (assert):
3322         (baz):
3323         (bar):
3324         (effects):
3325         (foo):
3326
3327 2017-12-14  Saam Barati  <sbarati@apple.com>
3328
3329         The CleanUp after LICM is erroneously removing a Check
3330         https://bugs.webkit.org/show_bug.cgi?id=180852
3331         <rdar://problem/36063494>
3332
3333         Reviewed by Filip Pizlo.
3334
3335         * stress/dont-run-cleanup-after-licm.js: Added.
3336
3337 2017-12-14  Michael Saboff  <msaboff@apple.com>
3338
3339         REGRESSION (r225695): Repro crash on yahoo login page
3340         https://bugs.webkit.org/show_bug.cgi?id=180761
3341
3342         Reviewed by JF Bastien.
3343
3344         New regression test.
3345
3346         * stress/regress-180761.js: Added.
3347
3348 2017-12-13  Keith Miller  <keith_miller@apple.com>
3349
3350         JSObjects should have a mask for loading indexed properties
3351         https://bugs.webkit.org/show_bug.cgi?id=180768
3352
3353         Reviewed by Mark Lam.
3354
3355         * stress/int16-put-by-val-in-and-out-of-bounds.js:
3356         (test):
3357
3358 2017-12-13  Saam Barati  <sbarati@apple.com>
3359
3360         Arrow functions need their own structure because they have different properties than sloppy functions
3361         https://bugs.webkit.org/show_bug.cgi?id=180779
3362         <rdar://problem/35814591>
3363
3364         Reviewed by Mark Lam.
3365
3366         * stress/arrow-function-needs-its-own-structure.js: Added.
3367         (assert):
3368         (readPrototype):
3369         (noInline.let.f1):
3370         (noInline):
3371
3372 2017-12-13  Saam Barati  <sbarati@apple.com>
3373
3374         Fix how JSFunction handles "caller" and "arguments" for functions that don't have those properties
3375         https://bugs.webkit.org/show_bug.cgi?id=163579
3376         <rdar://problem/35455798>
3377
3378         Reviewed by Mark Lam.
3379
3380         * stress/caller-and-arguments-properties-for-functions-that-dont-have-them.js: Added.
3381         (assert):
3382         (test1):
3383         (i.test1):
3384         (i.test1.C):
3385         (i.test1.async.foo):
3386         (i.test1.foo):
3387         (test2):
3388
3389 2017-12-13  Saam Barati  <sbarati@apple.com>
3390
3391         TypeCheckHoistingPhase needs to emit a CheckStructureOrEmpty if it's doing it for |this|
3392         https://bugs.webkit.org/show_bug.cgi?id=180734
3393         <rdar://problem/35640547>
3394
3395         Reviewed by Yusuke Suzuki.
3396
3397         * stress/type-check-hoisting-phase-hoist-check-structure-on-tdz-this-value.js: Added.
3398         (__isPropertyOfType):
3399         (__getProperties):
3400         (__getObjects):
3401         (__getRandomObject):
3402         (theClass.):
3403         (theClass):
3404         (childClass):
3405         (counter.catch):
3406
3407 2017-12-12  Saam Barati  <sbarati@apple.com>
3408
3409         We need to model effects of Spread(@PhantomCreateRest) in Clobberize/PreciseLocalClobberize
3410         https://bugs.webkit.org/show_bug.cgi?id=180725
3411         <rdar://problem/35970511>
3412
3413         Reviewed by Michael Saboff.
3414
3415         * stress/model-effects-properly-of-spread-over-phantom-create-rest.js: Added.
3416         (f1):
3417         (f2):
3418         (let.o2.valueOf):
3419
3420 2017-12-12  Yusuke Suzuki  <utatane.tea@gmail.com>
3421
3422         [JSC] Implement optimized WeakMap and WeakSet
3423         https://bugs.webkit.org/show_bug.cgi?id=179929
3424
3425         Reviewed by Saam Barati.
3426
3427         * microbenchmarks/weak-map-key.js:
3428         * microbenchmarks/weak-set-key.js: Copied from JSTests/microbenchmarks/weak-map-key.js.
3429         (assert):
3430         (objectKey):
3431         (let.start.Date.now):
3432         * stress/basic-weakmap.js: Added.
3433         (shouldBe):
3434         (test):
3435         * stress/basic-weakset.js: Added.
3436         (shouldBe):
3437         (test.set new):
3438         * stress/weakmap-cse-set-break.js: Added.
3439         (shouldBe):
3440         (test):
3441         * stress/weakmap-cse.js: Added.
3442         (shouldBe):
3443         (test):
3444         * stress/weakmap-gc.js: Added.
3445         (test):
3446         * stress/weakset-cse-add-break.js: Added.
3447         (shouldBe):
3448         (test.set new):
3449         * stress/weakset-cse.js: Added.
3450         (shouldBe):
3451         (test.set new):
3452         * stress/weakset-gc.js: Added.
3453         (test.set add):
3454         (test.set new):
3455         (test):
3456
3457 2017-12-12  Saam Barati  <sbarati@apple.com>
3458
3459         ConstantFoldingPhase rule for GetMyArgumentByVal must check for negative indices
3460         https://bugs.webkit.org/show_bug.cgi?id=180723
3461         <rdar://problem/35859726>
3462
3463         Reviewed by JF Bastien.
3464
3465         * stress/get-my-argument-by-val-constant-folding.js: Added.
3466         (test):
3467         (catch):
3468
3469 2017-12-12  Caio Lima  <ticaiolima@gmail.com>
3470
3471         [ESNext][BigInt] Implement BigInt literals and JSBigInt
3472         https://bugs.webkit.org/show_bug.cgi?id=179000
3473
3474         Reviewed by Darin Adler and Yusuke Suzuki.
3475
3476         * bigIntTests.yaml: Added.
3477         * stress/big-int-literal-line-terminator.js: Added.
3478         * stress/big-int-literals.js: Added.
3479         * stress/big-int-operations-error.js: Added.
3480         * stress/big-int-type-of.js: Added.
3481         * stress/big-int-white-space-trailing-leading.js: Added.
3482         * stress/big-int-function-apply.js: Added.
3483
3484 2017-12-11  Saam Barati  <sbarati@apple.com>
3485
3486         We need to disableCaching() in ErrorInstance when we materialize properties
3487         https://bugs.webkit.org/show_bug.cgi?id=180343
3488         <rdar://problem/35833002>
3489
3490         Reviewed by Mark Lam.
3491
3492         * stress/disable-caching-when-lazy-materializing-error-property-on-put.js: Added.
3493         (assert):
3494         (makeError):
3495         (storeToStack):
3496         (storeToStackAlreadyMaterialized):
3497
3498 2017-12-05  JF Bastien  <jfbastien@apple.com>
3499
3500         WebAssembly: don't eagerly checksum
3501         https://bugs.webkit.org/show_bug.cgi?id=180441
3502         <rdar://problem/35156628>
3503
3504         Reviewed by Saam Barati.
3505
3506         Checksum is now disabled, so tests only have <?> as the module
3507         name.
3508
3509         * wasm/function-tests/nameSection.js:
3510         * wasm/function-tests/stack-overflow.js:
3511         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
3512         (assertOverflows.assertThrows):
3513         (assertOverflows):
3514         * wasm/function-tests/stack-trace.js:
3515
3516 2017-12-04  JF Bastien  <jfbastien@apple.com>
3517
3518         Proxy all functions, except the $ objects
3519         https://bugs.webkit.org/show_bug.cgi?id=180375
3520
3521         Reviewed by Saam Barati.
3522
3523         It looks like this test may have broken some executions because I
3524         call some internal objects. Explicitly ignore objects whose name
3525         starts with "$" because it's a bad idea anyways.
3526
3527         * stress/proxy-all-the-parameters.js:
3528         (generateObjects):
3529         (get throw):
3530
3531 2017-12-04  Saam Barati  <sbarati@apple.com>
3532
3533         We need to leave room on the top of the stack for the FTL TailCall slow path so it doesn't overwrite things we want to retrieve when doing a stack walk when throwing an exception
3534         https://bugs.webkit.org/show_bug.cgi?id=180366
3535         <rdar://problem/35685877>
3536
3537         Reviewed by Michael Saboff.
3538
3539         * stress/ftl-tail-call-throw-exception-from-slow-path-recover-stack-values.js: Added.
3540         (theParent):
3541         (test1.base.getParentStaticValue):
3542         (test1.base):
3543         (test1.__v_24888.prototype.set prop):
3544         (test1.__v_24888):
3545         (test2.base.getParentStaticValue):
3546         (test2.base):
3547         (test2.__v_24888.prototype.set prop):
3548         (test2.__v_24888):
3549         (test2):
3550
3551 2017-12-01  JF Bastien  <jfbastien@apple.com>
3552
3553         Try proxying all function arguments
3554         https://bugs.webkit.org/show_bug.cgi?id=180306
3555
3556         Reviewed by Saam Barati.
3557
3558         * stress/proxy-all-the-parameters.js: Added.
3559         (isPropertyOfType):
3560         (getProperties):
3561         (generateObjects):
3562         (getObjects):
3563         (getFunctions):
3564         (get throw):
3565         (let.o.of.getObjects.let.f.of.getFunctions.catch):
3566
3567 2017-12-01  JF Bastien  <jfbastien@apple.com>
3568
3569         JavaScriptCore: missing exception checks in Math functions that take more than one argument
3570         https://bugs.webkit.org/show_bug.cgi?id=180297
3571         <rdar://problem/35745556>
3572
3573         Reviewed by Mark Lam.
3574
3575         * stress/math-exceptions.js: Added.
3576         (get try):
3577         (catch):
3578
3579 2017-12-01  JF Bastien  <jfbastien@apple.com>
3580
3581         JavaScriptCore: add test for weird class static getters
3582         https://bugs.webkit.org/show_bug.cgi?id=180281
3583         <rdar://problem/35592139>
3584
3585         Reviewed by Mark Lam.
3586
3587         I fixed a bug for it in r224927 and didn't add a test. Do so.
3588
3589         * stress/class-static-get-weird.js: Added.
3590         (c.prototype.get name):
3591         (c):
3592         (c.prototype.get arguments):
3593         (c.prototype.get caller):
3594         (c.prototype.get length):
3595
3596 2017-12-01  Saam Barati  <sbarati@apple.com>
3597
3598         Having a bad time needs to handle ArrayClass indexing type as well
3599         https://bugs.webkit.org/show_bug.cgi?id=180274
3600         <rdar://problem/35667869>
3601
3602         Reviewed by Keith Miller and Mark Lam.
3603
3604         * stress/array-prototype-slow-put-having-a-bad-time-2.js: Added.
3605         (assert):
3606         * stress/array-prototype-slow-put-having-a-bad-time.js: Added.
3607         (assert):
3608
3609 2017-12-01  JF Bastien  <jfbastien@apple.com>
3610
3611         WebAssembly: restore cached stack limit after out-call
3612         https://bugs.webkit.org/show_bug.cgi?id=179106
3613         <rdar://problem/35337525>
3614
3615         Reviewed by Saam Barati.
3616
3617         * wasm/function-tests/double-instance.js: Added.
3618         (const.imp.boom):
3619         (const.imp.get callAnother):
3620
3621 2017-11-30  JF Bastien  <jfbastien@apple.com>
3622
3623         WebAssembly: improve stack trace
3624         https://bugs.webkit.org/show_bug.cgi?id=179343
3625
3626         Reviewed by Saam Barati.
3627
3628         Update the tests to follow the new format. Notably, SHA1 module
3629         hash is now included in traces, and stubs are properly identified.
3630
3631         * wasm/assert.js: Add an assertion which matches regular expressions.
3632         * wasm/function-tests/nameSection.js:
3633         * wasm/function-tests/stack-overflow.js:
3634         (import.Builder.from.string_appeared_here.import.as.assert.from.string_appeared_here.assertOverflows):
3635         (assertOverflows.assertThrows.wasm.1):
3636         (assertOverflows.assertThrows.wasm.0):
3637         (assertOverflows.assertThrows):
3638         (assertOverflows):
3639         * wasm/function-tests/stack-trace.js:
3640         (import.Builder.from.string_appeared_here.assert): Deleted.
3641         * wasm/function-tests/trap-after-cross-instance-call.js:
3642         (wasmFrameCountFromError):
3643         * wasm/function-tests/trap-load-2.js:
3644         (wasmFrameCountFromError):
3645         * wasm/function-tests/trap-load.js:
3646         (wasmFrameCountFromError):
3647
3648 2017-11-30  Mark Lam  <mark.lam@apple.com>
3649
3650         jsc shell's flashHeapAccess() should not do JS work after releasing access to the heap.
3651         https://bugs.webkit.org/show_bug.cgi?id=180219
3652         <rdar://problem/35696536>
3653
3654         Reviewed by Filip Pizlo.
3655
3656         * stress/regress-180219.js: Added.
3657
3658 2017-11-30  Yusuke Suzuki  <utatane.tea@gmail.com>
3659
3660         [DFG][FTL] operationHasIndexedProperty does not consider negative int32_t
3661         https://bugs.webkit.org/show_bug.cgi?id=180190
3662
3663         Reviewed by Mark Lam.
3664
3665         * stress/operation-in-may-have-negative-int32-array-storage.js: Added.
3666         (shouldBe):
3667         (test1):
3668         * stress/operation-in-may-have-negative-int32-contiguous-array.js: Added.
3669         (shouldBe):
3670         (test1):
3671         * stress/operation-in-may-have-negative-int32-double-array.js: Added.
3672         (shouldBe):
3673         (test1):
3674         * stress/operation-in-may-have-negative-int32-generic-array.js: Added.
3675         (shouldBe):
3676         (test1):
3677         * stress/operation-in-may-have-negative-int32-int32-array.js: Added.
3678         (shouldBe):
3679         (test1):
3680         * stress/operation-in-may-have-negative-int32.js: Added.
3681         (shouldBe):
3682         (test2):
3683         * stress/operation-in-negative-int32-cast.js: Added.
3684         (shouldBe):
3685         (test1):
3686
3687 2017-11-28  JF Bastien  <jfbastien@apple.com>
3688
3689         Strict and sloppy functions shouldn't share structure
3690         https://bugs.webkit.org/show_bug.cgi?id=180103
3691         <rdar://problem/35667847>
3692
3693         Reviewed by Saam Barati.
3694
3695         * stress/get-by-id-strict-arguments.js: Added. Used to not throw
3696         because the IC was wrong.
3697         (foo):
3698         (bar):
3699         (baz):
3700         (catch):
3701         * stress/get-by-id-strict-callee.js: Added. Not strictly necessary
3702         in this patch, but may as well test odd strict mode corner cases.
3703         (bar):
3704         (baz):
3705         (catch):
3706         * stress/get-by-id-strict-caller.js: Added. Also IC'd wrong.
3707         (foo):
3708         (bar):
3709         (baz):
3710         (catch):
3711         * stress/get-by-id-strict-nested-arguments-2.js: Added. Same as
3712         next file, but with invalidation of the FunctionExecutable's
3713         singletonFunction() to hit SpeculativeJIT::compileNewFunction's
3714         slower path.
3715         (foo):
3716         (bar.const.x):
3717         (bar.const.y):
3718         (bar):
3719         (catch):
3720         * stress/get-by-id-strict-nested-arguments.js: Added. Make sure
3721         strict nesting works correctly.
3722         (foo):
3723         (bar.baz):
3724         (bar):
3725         * stress/strict-function-structure.js: Added. The test used to
3726         assert in objectProtoFuncHasOwnProperty.
3727         (foo):
3728         (bar):
3729         (baz):
3730         * stress/strict-nested-function-structure.js: Added. Nesting.
3731         (foo):
3732         (bar):
3733         (baz.boo):
3734         (baz):
3735
3736 2017-11-29  Robin Morisset  <rmorisset@apple.com>
3737
3738         The recursive tail call optimisation is wrong on closures
3739         https://bugs.webkit.org/show_bug.cgi?id=179835
3740
3741         Reviewed by Saam Barati.
3742
3743         * stress/closure-recursive-tail-call.js: Added.
3744         (makeClosure):
3745
3746 2017-11-27  JF Bastien  <jfbastien@apple.com>
3747
3748         JavaScript rest function parameter with negative index leads to bad DFG abstract interpretation
3749         https://bugs.webkit.org/show_bug.cgi?id=180051
3750         <rdar://problem/35614371>
3751
3752         Reviewed by Saam Barati.
3753
3754         * stress/rest-parameter-negative.js: Added.
3755         (__f_5484):
3756         (catch):
3757         (__f_5485):
3758         (__v_22598.catch):
3759
3760 2017-11-27  Saam Barati  <sbarati@apple.com>
3761
3762         Spread can escape when CreateRest does not
3763         https://bugs.webkit.org/show_bug.cgi?id=180057
3764         <rdar://problem/35676119>
3765
3766         Reviewed by JF Bastien.
3767
3768         * stress/spread-escapes-but-create-rest-does-not.js: Added.
3769         (assert):
3770         (getProperties):
3771         (theFunc):
3772         (let.obj.valueOf):
3773
3774 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3775
3776         [DFG] Add NormalizeMapKey DFG IR
3777         https://bugs.webkit.org/show_bug.cgi?id=179912
3778
3779         Reviewed by Saam Barati.
3780
3781         * stress/map-untyped-normalize-cse.js: Added.
3782         (shouldBe):
3783         (test):
3784         * stress/map-untyped-normalize.js: Added.
3785         (shouldBe):
3786         (test):
3787         * stress/set-untyped-normalize-cse.js: Added.
3788         (shouldBe):
3789         (set return.set has.set has):
3790         * stress/set-untyped-normalize.js: Added.
3791         (shouldBe):
3792         (set return.set has):
3793
3794 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3795
3796         [FTL] Support DeleteById and DeleteByVal
3797         https://bugs.webkit.org/show_bug.cgi?id=180022
3798
3799         Reviewed by Saam Barati.
3800
3801         * stress/delete-by-id.js: Added.
3802         (shouldBe):
3803         (test1):
3804         (test2):
3805         * stress/delete-by-val-ftl.js: Added.
3806         (shouldBe):
3807         (test1):
3808         (test2):
3809
3810 2017-11-26  Yusuke Suzuki  <utatane.tea@gmail.com>
3811
3812         [DFG] Introduce {Set,Map,WeakMap}Fields
3813         https://bugs.webkit.org/show_bug.cgi?id=179925
3814
3815         Reviewed by Saam Barati.
3816
3817         * stress/map-set-clobber-map-get.js: Added.
3818         (shouldBe):
3819         (test):
3820         * stress/map-set-does-not-clobber-set-has.js: Added.
3821         (shouldBe):
3822         * stress/map-set-does-not-clobber-weak-map-get.js: Added.
3823         (shouldBe):
3824         (test):
3825         * stress/set-add-clobber-set-has.js: Added.
3826         (shouldBe):
3827         * stress/set-add-does-not-clobber-map-get.js: Added.
3828         (shouldBe):
3829
3830 2017-11-24  Mark Lam  <mark.lam@apple.com>
3831
3832         Move unsafe jsc shell test functions to the $vm object.
3833         https://bugs.webkit.org/show_bug.cgi?id=179980
3834
3835         Reviewed by Yusuke Suzuki.
3836
3837         * controlFlowProfiler/driver/driver.js:
3838         * controlFlowProfiler/execution-count.js:
3839         * controlFlowProfiler/if-statement.js:
3840         * controlFlowProfiler/loop-statements.js:
3841         * controlFlowProfiler/switch-statements.js:
3842         * controlFlowProfiler/test-jit.js:
3843         * exceptionFuzz/3d-cube.js:
3844         * exceptionFuzz/date-format-xparb.js:
3845         * exceptionFuzz/earley-boyer.js:
3846         * heapProfiler/basic-edges.js:
3847         * heapProfiler/property-edge-types.js:
3848         * microbenchmarks/try-get-by-id-basic.js:
3849         * microbenchmarks/try-get-by-id-polymorphic.js:
3850         * modules/namespace-object-try-get.js:
3851         * stress/argument-count-bytecode.js:
3852         * stress/argument-intrinsic-basic.js:
3853         * stress/argument-intrinsic-inlining-use-caller-arg.js:
3854         * stress/argument-intrinsic-inlining-with-result-escape.js:
3855         * stress/argument-intrinsic-inlining-with-vararg-with-enough-arguments.js:
3856         * stress/argument-intrinsic-inlining-with-vararg.js:
3857         * stress/argument-intrinsic-nested-inlining.js:
3858         * stress/argument-intrinsic-not-convert-to-get-argument.js:
3859         * stress/argument-intrinsic-with-stack-write.js:
3860         * stress/arity-mismatch-get-argument.js:
3861         * stress/array-message-passing.js:
3862         * stress/array-push-with-force-exit.js:
3863         * stress/check-dom-with-signature.js:
3864         * stress/check-sub-class.js:
3865         * stress/compare-eq-incomplete-profile.js:
3866         * stress/custom-get-set-inline-caching-one-level-up-proto-chain.js:
3867         * stress/do-eval-virtual-call-correctly.js:
3868         * stress/dom-jit-with-poly-proto.js:
3869         * stress/domjit-exception-ic.js:
3870         * stress/domjit-exception.js:
3871         * stress/domjit-getter-complex-with-incorrect-object.js:
3872         * stress/domjit-getter-complex.js:
3873         * stress/domjit-getter-poly.js:
3874         * stress/domjit-getter-proto.js:
3875         * stress/domjit-getter-super-poly.js:
3876         * stress/domjit-getter-try-catch-getter-as-get-by-id-register-restoration.js:
3877         * stress/domjit-getter-type-check.js:
3878         * stress/domjit-getter.js:
3879         * stress/exit-during-inlined-arity-fixup-recover-proper-frame.js:
3880         * stress/for-in-proxy-target-changed-structure.js:
3881         * stress/for-in-proxy.js:
3882         * stress/generational-opaque-roots.js:
3883         * stress/global-const-redeclaration-setting-2.js:
3884         * stress/global-const-redeclaration-setting-3.js:
3885         * stress/global-const-redeclaration-setting-4.js:
3886         * stress/global-const-redeclaration-setting-5.js:
3887         * stress/global-const-redeclaration-setting.js:
3888         * stress/import-basic.js:
3889         * stress/import-from-eval.js:
3890         * stress/import-reject-with-exception.js:
3891         * stress/import-syntax.js:
3892         * stress/impure-get-own-property-slot-inline-cache.js:
3893         * stress/is-constructor.js:
3894         * stress/istypedarrayview-intrinsic.js:
3895         * stress/jsc-setImpureGetterDelegate-on-bad-type.js:
3896         * stress/jsc-test-functions-should-be-more-robust.js:
3897         * stress/object-toString-with-proxy.js:
3898         * stress/poly-proto-custom-value-and-accessor.js:
3899         * stress/proxy-inline-cache.js:
3900         * stress/re-execute-error-module.js:
3901         * stress/regress-150532.js:
3902         * stress/regress-156992.js:
3903         * stress/regress-179619.js:
3904         * stress/resources/shadow-chicken-support.js:
3905         * stress/runtime-array.js:
3906         * stress/sampling-profiler-microtasks.js:
3907         * stress/shadow-chicken-enabled.js:
3908         * stress/spread-correct-global-object-on-exception.js:
3909         * stress/super-get-by-id.js:
3910         * stress/tailCallForwardArguments.js:
3911         * stress/to-object-intrinsic-boolean-edge.js:
3912         * stress/to-object-intrinsic-null-or-undefined-edge.js:
3913         * stress/to-object-intrinsic-number-edge.js:
3914         * stress/to-object-intrinsic-object-edge.js:
3915         * stress/to-object-intrinsic-string-edge.js:
3916         * stress/to-object-intrinsic-symbol-edge.js:
3917         * stress/to-object-intrinsic.js:
3918         * stress/try-catch-custom-getter-as-get-by-id.js:
3919         * stress/try-get-by-id-poly-proto.js:
3920         * stress/try-get-by-id-should-spill-registers-dfg.js:
3921         * stress/try-get-by-id.js:
3922         * typeProfiler/arrow-functions.js:
3923         * typeProfiler/basic.js:
3924         * typeProfiler/captured.js:
3925         * typeProfiler/classes.js:
3926         * typeProfiler/dfg-jit-optimizations.js:
3927         * typeProfiler/dictionary-mode.js:
3928         * typeProfiler/es6-block-scoping.js:
3929         * typeProfiler/es6-classes.js:
3930         * typeProfiler/inheritance.js:
3931         * typeProfiler/int52-dfg.js:
3932         * typeProfiler/loop.js:
3933         * typeProfiler/optional-fields.js:
3934         * typeProfiler/overflow.js:
3935         * typeProfiler/return.js:
3936         * typeProfiler/symbol.js:
3937         * typeProfiler/weird-prototype-chain.js:
3938
3939 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3940
3941         [DFG][FTL] Support MapSet / SetAdd intrinsics
3942         https://bugs.webkit.org/show_bug.cgi?id=179858
3943
3944         Reviewed by Saam Barati.
3945
3946         * microbenchmarks/map-has-and-set.js: Added.
3947         (test):
3948         * stress/map-set-check-failure.js: Added.
3949         (shouldBe):
3950         (shouldThrow):
3951         (target):
3952         * stress/map-set-cse.js: Added.
3953         (shouldBe):
3954         (test):
3955         * stress/set-add-check-failure.js: Added.
3956         (shouldBe):
3957         (shouldThrow):
3958         (set shouldThrow):
3959         * stress/set-add-cse.js: Added.
3960         (shouldBe):
3961
3962 2017-11-21  Yusuke Suzuki  <utatane.tea@gmail.com>
3963
3964         [JSC] Allow poly proto for intrinsic getters
3965         https://bugs.webkit.org/show_bug.cgi?id=179550
3966
3967         Reviewed by Saam Barati.
3968
3969         This change is also tested by existing tests.
3970
3971             1. stress/intrinsic-getter-with-poly-proto.js
3972             2. stress/poly-proto-intrinsic-getter-correctness.js
3973
3974         * stress/intrinsic-getter-with-poly-proto-getter-change.js: Added.
3975         (shouldBe):
3976         (makePolyProtoObject.foo.C):
3977         (makePolyProtoObject.foo):
3978         (makePolyProtoObject):
3979         (target):
3980         * stress/intrinsic-getter-with-poly-proto-proto-change.js: Added.
3981         (shouldBe):
3982         (makePolyProtoObject.foo.C):
3983         (makePolyProtoObject.foo):
3984         (makePolyProtoObject):
3985         (target):
3986
3987 2017-11-20  Guillaume Emont  <guijemont@igalia.com>
3988
3989         Skip stress/unshiftCountSlowCase-correct-postCapacity.js on embedded Linux
3990         https://bugs.webkit.org/show_bug.cgi?id=179744
3991
3992         Reviewed by Michael Catanzaro.
3993
3994         This test uses too much memory for our buildbots on these platforms
3995         and gets OOM-killed.
3996
3997         * stress/unshiftCountSlowCase-correct-postCapacity.js:
3998         Skip if $memoryLimited and linux.
3999
4000 2017-11-17  JF Bastien  <jfbastien@apple.com>
4001
4002         WebAssembly JS API: throw when a promise can't be created
4003         https://bugs.webkit.org/show_bug.cgi?id=179826
4004         <rdar://problem/35455813>
4005
4006         Reviewed by Mark Lam.
4007
4008         Test WebAssembly.{compile,instantiate} where promise creation
4009         fails because of a stack overflow.
4010
4011         * wasm/js-api/promise-stack-overflow.js: Added.
4012         (const.runNearStackLimit.f.const.t):
4013         (async.testCompile):
4014         (async.testInstantiate):
4015
4016 2017-11-16  Yusuke Suzuki  <utatane.tea@gmail.com>
4017
4018         Unreviewed, mark regress-178385.js as memory exhausting
4019
4020         * stress/regress-178385.js:
4021
4022 2017-11-16  Ryan Haddad  <ryanhaddad@apple.com>
4023
4024         Mark test262/test/language/statements/class/definition/fn-name-static-precedence.js as passing after r224927.
4025
4026         Unreviewed test gardening.
4027
4028         * test262.yaml:
4029
4030 2017-11-16  Robin Morisset  <rmorisset@apple.com>
4031
4032         REGRESSION (r224592): oss-fuzz: jsc: Null-dereference READ in JSC::JSCell::isObject (4216)
4033         https://bugs.webkit.org/show_bug.cgi?id=179763
4034         <rdar://problem/35550513>
4035
4036         Reviewed by Keith Miller.
4037
4038         Just adding a slightly cleaned-up version of the original fuzzer-found test.
4039
4040         * stress/tdz-this-in-try-catch.js: Added.
4041         (__v_6388):
4042         (__v_6392):
4043
4044 2017-11-14  Yusuke Suzuki  <utatane.tea@gmail.com>
4045
4046         [DFG][FTL] Support Array::DirectArguments with OutOfBounds
4047         https://bugs.webkit.org/show_bug.cgi?id=179594
4048
4049         Reviewed by Saam Barati.
4050
4051         * stress/direct-arguments-in-bounds-to-out-of-bounds.js: Added.
4052         (shouldBe):
4053         (args):
4054         * stress/direct-arguments-out-of-bounds-watchpoint.js: Added.
4055         (shouldBe):
4056         (args):
4057
4058 2017-11-14  Saam Barati  <sbarati@apple.com>
4059
4060         We need to set topCallFrame when calling Wasm::Memory::grow from the JIT
4061         https://bugs.webkit.org/show_bug.cgi?id=179639
4062         <rdar://problem/35513018>
4063
4064         Reviewed by JF Bastien.
4065
4066         * wasm/function-tests/grow-memory-cause-gc.js: Added.
4067         (escape):
4068         (i.func):
4069
4070 2017-11-13  Mark Lam  <mark.lam@apple.com>
4071
4072         Add more overflow check book-keeping for MarkedArgumentBuffer.
4073         https://bugs.webkit.org/show_bug.cgi?id=179634
4074         <rdar://problem/35492517>
4075
4076         Reviewed by Saam Barati.
4077
4078         * stress/regress-179634.js: Added.
4079
4080 2017-11-13  Mark Lam  <mark.lam@apple.com>
4081
4082         Make the jsc shell loadGetterFromGetterSetter() function more robust.
4083         https://bugs.webkit.org/show_bug.cgi?id=179619
4084         <rdar://problem/35492518>
4085
4086         Reviewed by Saam Barati.
4087
4088         * stress/regress-179619.js: Added.
4089
4090 2017-11-12  Mark Lam  <mark.lam@apple.com>
4091
4092         We should ensure that operationStrCat2 and operationStrCat3 are never passed Symbols as arguments.
4093         https://bugs.webkit.org/show_bug.cgi?id=179562
4094         <rdar://problem/35467022>
4095
4096         Reviewed by Saam Barati.
4097
4098         * regress-179562.js: Added.
4099
4100 2017-11-08  Saam Barati  <sbarati@apple.com>
4101
4102         A JSFunction's ObjectAllocationProfile should watch the poly prototype watchpoint so it can clear its object allocation profile
4103         https://bugs.webkit.org/show_bug.cgi?id=177792
4104
4105         Reviewed by Yusuke Suzuki.
4106
4107         * microbenchmarks/poly-proto-clear-js-function-allocation-profile.js: Added.
4108         (assert):
4109         (foo.Foo.prototype.ensureX):
4110         (foo.Foo):
4111         (foo):
4112         (access):
4113
4114 2017-11-08  Ryan Haddad  <ryanhaddad@apple.com>
4115
4116         Mark test262.yaml/test262/test/language/statements/try/tco-catch.js as passing.
4117         https://bugs.webkit.org/show_bug.cgi?id=178592
4118
4119         Unreviewed test gardening.
4120
4121         * test262.yaml:
4122
4123 2017-11-08  Robin Morisset  <rmorisset@apple.com>
4124
4125         Turn recursive tail calls into loops
4126         https://bugs.webkit.org/show_bug.cgi?id=176601
4127
4128         Reviewed by Saam Barati.
4129
4130         Relanding after https://bugs.webkit.org/show_bug.cgi?id=178834.
4131
4132         Add some simple test that computes factorial in several ways, and other trivial computations.
4133         They all tests the case where foo calls bar (in an inlineable way) that then does a tail call.
4134         Depending on the nature of both calls, it is possible or not to turn the tail call into a loop.
4135         I have no clear way of checking that the call was indeed transformed, but I can check that the code computes the right result
4136         (which it doesn't if that tail call is transformed into a loop in the unsound cases).
4137
4138         * stress/inline-call-to-recursive-tail-call.js: Added.
4139         (factorial.aux):
4140         (factorial):
4141         (factorial2.aux2):
4142         (factorial2.id):
4143         (factorial2):
4144         (factorial3.aux3):
4145         (factorial3):
4146         (aux4):
4147         (factorial4):
4148         (foo):
4149         (auxBar):
4150         (bar):
4151         (test):
4152
4153 2017-11-07  Mark Lam  <mark.lam@apple.com>
4154
4155         AccessCase::generateImpl() should exclude the result register when restoring registers after a call.
4156         https://bugs.webkit.org/show_bug.cgi?id=179355
4157         <rdar://problem/35263053>
4158
4159         Reviewed by Saam Barati.
4160
4161         * stress/regress-179355.js: Added.
4162
4163 2017-11-05  Yusuke Suzuki  <utatane.tea@gmail.com>
4164
4165         JIT call inline caches should cache calls to objects with getCallData/getConstructData traps
4166         https://bugs.webkit.org/show_bug.cgi?id=144458
4167
4168         Reviewed by Saam Barati.
4169
4170         * microbenchmarks/dfg-internal-function-call.js: Added.
4171         (target):
4172         * microbenchmarks/dfg-internal-function-construct.js: Added.
4173         (target):
4174         * microbenchmarks/dfg-internal-function-not-handled-call.js: Added.
4175         (target):
4176         * microbenchmarks/dfg-internal-function-not-handled-construct.js: Added.
4177         (target):
4178         * stress/dfg-internal-function-call.js: Added.
4179         (shouldBe):
4180         (target):
4181         * stress/dfg-internal-function-construct.js: Added.
4182         (shouldBe):
4183         (target):
4184         * stress/internal-function-call.js: Added.
4185         (shouldBe):
4186         * stress/internal-function-construct.js: Added.
4187         (shouldBe):
4188
4189 2017-11-05  Per Arne Vollan  <pvollan@apple.com>
4190
4191         [Win] Skip stress/regress-178385.js.
4192         https://bugs.webkit.org/show_bug.cgi?id=179298
4193
4194         Unreviewed test gardening.
4195
4196         * stress/regress-178385.js:
4197
4198 2017-11-03  Keith Miller  <keith_miller@apple.com>
4199
4200         Add test for ic with side effects
4201         https://bugs.webkit.org/show_bug.cgi?id=179268
4202
4203         Reviewed by Saam Barati.
4204
4205         * stress/put-inline-cache-side-effects.js: Added.
4206         (let.i.of.objs.keys):
4207         (f):
4208
4209 2017-11-03  Mark Lam  <mark.lam@apple.com>
4210
4211         CachedCall (and its clients) needs overflow checks.
4212         https://bugs.webkit.org/show_bug.cgi?id=179185
4213
4214         Reviewed by JF Bastien.
4215
4216         * stress/regress-179185.js: Added.
4217
4218 2017-11-02  Michael Saboff  <msaboff@apple.com>
4219
4220         DFG needs to handle code motion of code in for..in loop bodies
4221         https://bugs.webkit.org/show_bug.cgi?id=179212
4222
4223         Reviewed by Keith Miller.
4224
4225         New regression test.
4226
4227         * stress/for-in-side-effects.js: Added.
4228         (getPrototypeOf):
4229         (reset):
4230         (testWithoutFTL.f):
4231         (testWithoutFTL):
4232         (testWithFTL.f):
4233         (testWithFTL):
4234
4235 2017-11-02  Filip Pizlo  <fpizlo@apple.com>
4236
4237         AI does not correctly model the clobber case of ArithClz32
4238         https://bugs.webkit.org/show_bug.cgi?id=179188
4239
4240         Reviewed by Michael Saboff.
4241
4242         * stress/arith-clz32-effects.js: Added.
4243         (foo):
4244         (valueOf):
4245
4246 2017-11-01  Michael Saboff  <msaboff@apple.com>
4247
4248         Integer overflow in code generated by LoadVarargs processing in DFG and FTL.
4249         https://bugs.webkit.org/show_bug.cgi?id=179140
4250
4251         Reviewed by Saam Barati.
4252
4253         New regression test.
4254
4255         * stress/regress-179140.js: Added.
4256         (testWithoutFTL):
4257         (testWithFTL):
4258
4259 2017-11-01  Yusuke Suzuki  <utatane.tea@gmail.com>
4260
4261         [JSC] Introduce @toObject
4262         https://bugs.webkit.org/show_bug.cgi?id=178726
4263
4264         Reviewed by Saam Barati.
4265
4266         * stress/array-copywithin.js:
4267         (shouldThrow):
4268         * stress/object-constructor-boolean-edge.js: Added.
4269         (shouldBe):
4270         (test):
4271         * stress/object-constructor-global.js: Added.
4272         (shouldBe):
4273         * stress/object-constructor-null-edge.js: Added.
4274         (shouldBe):
4275         (test):
4276         * stress/object-constructor-number-edge.js: Added.
4277         (shouldBe):
4278         (test):
4279         * stress/object-constructor-object-edge.js: Added.
4280         (shouldBe):
4281         (test):
4282         (i.arg):
4283         * stress/object-constructor-string-edge.js: Added.
4284         (shouldBe):
4285         (test):
4286         * stress/object-constructor-symbol-edge.js: Added.
4287         (shouldBe):
4288         (test):
4289         * stress/object-constructor-undefined-edge.js: Added.
4290         (shouldBe):
4291         (test):
4292         * stress/symbol-array-from.js: Added.
4293         (shouldBe):
4294         * stress/to-object-intrinsic-boolean-edge.js: Added.
4295         (shouldBe):
4296         (builtin.createBuiltin):
4297         * stress/to-object-intrinsic-null-or-undefined-edge.js: Added.
4298         (shouldThrow):
4299         * stress/to-object-intrinsic-number-edge.js: Added.
4300         (shouldBe):
4301         (builtin.createBuiltin):
4302         * stress/to-object-intrinsic-object-edge.js: Added.
4303         (shouldBe):
4304         (builtin.createBuiltin):
4305         (i.arg):
4306         * stress/to-object-intrinsic-string-edge.js: Added.
4307         (shouldBe):
4308         (builtin.createBuiltin):
4309         * stress/to-object-intrinsic-symbol-edge.js: Added.
4310         (shouldBe):
4311         (builtin.createBuiltin):
4312         * stress/to-object-intrinsic.js: Added.
4313         (shouldBe):
4314         (shouldThrow):
4315         (builtin.createBuiltin):
4316